Difference between revisions of "Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem"

From RECESSIM, A Reverse Engineering Community
Jump to navigation Jump to search
Line 44: Line 44:
 
|}<br />
 
|}<br />
  
=== Operating system ===
+
===Operating system===
OS is VxWorks 5.4.2 working on Intel SmartARM ARMSA1100<br />
+
OS is VxWorks 5.4.2 working on Intel SmartARM ARMSA1100<br /><syntaxhighlight lang="abap">
 
 
 
VxWorks (for HNS inmEET - ARMSA1110) version VxWorks5.4.2.
 
VxWorks (for HNS inmEET - ARMSA1110) version VxWorks5.4.2.
  
Line 58: Line 57:
  
 
value = 140 = 0x8c
 
value = 140 = 0x8c
 +
</syntaxhighlight>

Revision as of 09:42, 18 August 2021

After wikipedia: The Broadband Global Area Network (BGAN) is a global satellite network with telephony owned by Inmarsat using portable terminals. The terminals are normally used to connect a laptop computer to broadband Internet in remote locations, although as long as line-of-sight to the satellite exists


From technical perspective BGAN is an UMTS compatible network running on L-Band satellite frequencies - with the terminal receiving frequencies of 1525.0-1559.0MHz & transmitting frequencies of 1626.5-1660.5MHz. BGAN is standarized under ETSI GMR-1 standard.

RBGAN (Regional BGAN) was initial service offering by Inmarsat, limited to 144 kbps and using leased regional beams from Thuraya satellites. After Inmarsat I-4 satellites were deployed, service was superseded by BGAN with more beams and higher capacity.


Goal of this reverse engineering effort is to get access to potential debugging modes to decode Inmarsat BGAN control channels (as I suppose control channels are still compatible between RBGAN and BGAN). Same goal can be probably achieved using SDR radio and Osmocom GMR project as both BGAN and Thuraya use GMR-1 protocols.


Terminal connectivity

Hughes 9101 can be interfaced using Ethernet, Bluetooth and USB.Only one interface can be active - you select interface using "select" button and then modem restarts with selected interface active. To check what interface is active - press "select" for 2 seconds and proper LED blinks for a very short time.

  • Bluetooth - device is detected as some kind of ancient Bluetooth PPP profile, probably additional drivers are needed (bluetooth password: "blue")
  • USB - no known drivers, although I suspect this is some kind of virtual/RNDIS-type device, showing as ethernet network card on your PC
  • Ethernet (actually works)


IP address: 192.168.128.100

Open ports

Port number Protocol Description
Port number
80 TCP Web interface. Used to configure device and assists with pointing it to the proper satellite. Part of the interface is in Java and uses proprietary debug interface.

Please note that without BGAN SIM car, web interface will not start - leaving you with an error message. You cannot trick it by inserting regular SIM card.


Operating system

OS is VxWorks 5.4.2 working on Intel SmartARM ARMSA1100

VxWorks (for HNS inmEET - ARMSA1110) version VxWorks5.4.2.

Kernel: WIND version 2.5.

Made on Jul 11 2005, 14:12:40.

Boot line:

tffsBootDev(0,0)host:/tffs0/vxWorks h=192.168.128.50 e=192.168.128.100:ffffff00 g=192.168.128.200 u=anonymous pw=inmarsat  o=ekh

value = 140 = 0x8c