6 ms·

Hayes command set history: The tech that dialed in a million modems

80 points by ohjeez 4y ago

joezydeco 4y ago
The AT command set is very much alive and well. All those cellular chips in your smartphones and IoT devices still communicate with their host processors over a serial communication line, identical to the Hayes box back in 1978. The commands have gotten more complicated, but as far as I know ATI will still give you a typical part identification code.
- mocko 4y ago
  It truly is. For an example look at these guys juggling AT commands to control 5G modems fresh off the production line - https://forums.whirlpool.net.au/archive/3vx1k1r3-39 https://forums.whirlpool.net.au/archive/3vx1k1r3-39.
- Nextgrid 4y ago
  Qualcomm (and maybe others) have alternatives though such as QMI.
  - joezydeco 4y ago
    I'm figuring that Apple has probably developed their own as well.
    - Reason077 4y ago
      You certainly used to be able to get a tty to the baseband and enter AT commands on a jailbroken iPhone back in the iPhone 5 (or so) days... https://www.theiphonewiki.com/wiki/Baseband_Commands https://www.theiphonewiki.com/wiki/Baseband_Commands
      - joezydeco 4y ago
        Right. But Apple bought the entire cell modem arm of Intel three years ago. This should be fun. https://www.apple.com/newsroom/2019/07/apple-to-acquire-the-majority-of-intels-smartphone-modem-business/ https://www.apple.com/newsroom/2019/07/apple-to-acquire-the-...
        Reason077 4y ago
        I don't think that's a bad thing. Qualcomm absolutely dominates high-end modem chips right now and, if Apple can pull it off, competition will be good for the industry. Only the Chinese (Huawei/HiSilicon) have come close to challenging Qualcomm in recent years, until they got shut down by US import restrictions and seem to have given up at this point.
tyingq 4y ago
I like this old summary of various ways to trick a modem connected server into outputting +++ATH0, which would disconnect it. https://opennet.ru/base/usersoft/3.txt.html https://opennet.ru/base/usersoft/3.txt.html It did work on some modems with loose requirements around the timing and pauses.
- tonyarkles 4y ago
  Heh, I was one of the first in my group of friends to get DSL and the ping trick was a wonderful way to troll people. Before the DSL line, I too had a modem that was vulnerable so trying to send the ping would kick me off instead of the target.
- rchowe 4y ago
  It’s because Hayes held the patent on the modem having to pause for one second before it could receive commands. Other modem manufacturers implemented the “time-independent escape sequence” to get around the patent[0]… the only issue being binaries that contained control codes and meddlesome kids. [0] https://en.m.wikipedia.org/wiki/Time_Independent_Escape_Sequence https://en.m.wikipedia.org/wiki/Time_Independent_Escape_Sequ...
hrunt 4y ago
One of my first jobs was working for a mom-and-pop dial-up ISP. I persuaded my mom to get an account with them when I saw them in a computer magazine. I did not even have a web browser! A little after that, they hired me. One of the things we used to do when I first started was shuck modems. We would buy the consumer models, break open the plastic cases, pull the circuit boards out, and slide them into slots of custom enclosures. Then we would hand-assemble DB-to-ethernet adapters and plug them into serial controller banks. We bought any and all modems, but the cheap models from US Robotics and Supra were really a game changer. The only tough part was that dealing with the slight differences in command differences on the client side needed to connect to the different modem types.
- ghaff 4y ago
  There was a period when various modem manufacturers were pushing speed limits and they did some non-standard things to do so. As I recall, USR's 9600 bps was one of the more non (Hayes) standard. Since you mention ISPs though, this was probably a bit earlier.
  - bhauer 4y ago
    You might be right about the USR 9600 bps mode, but for certain their original 14.4k bps mode was proprietary and named "HST." I still fondly remember when I got my Courier HST and witnessed its intense speed boost versus my prior 2400 bps modem.
    - ghaff 4y ago
      There were 9600 bps USR Courier HST models. Pretty sure I still have one up in the attic unless I've tossed it. I forget what I had in the 14K generation.
      - bhauer 4y ago
        Maybe I am misremembering, then. Perhaps I had a 9600 bps HST.
  - 4y ago
asah 4y ago
LOL, a lot more than 1 million... more like 100M+
netsharc 4y ago
Somewhat related to AT commands, there's a collection of anecdotes from Linus Torvalds' old officemate in Uni Helsinki, one time Linus had a brainfart while trying to dial into his ISP, the result of which was that his harddisk bootsector ended up beginning with the string "ATDT " and his ISP's phone number. The next day Linus implemented permission controls. Sadly DDG and Google can't find me anything with those keywords. Either that story has disappeared off the web, or search engines really suck nowadays. Edit: Well, I found it, but I had to go to a blog where the story was quoted, and the blog author had written down the link not as a hyperlink: https://liw.fi/linux-anecdotes/ https://liw.fi/linux-anecdotes/
- nico 4y ago
  > Either that story has disappeared off the web, or search engines really suck nowadays. Given you found the story, it seems like it hadn’t disappeared off the web. However, search engines might suck.
- hulitu 4y ago
  > If we play our cards right, the Linux penguin could be the next mass-consumer hit product. Can you imagine a Windows flag competing against our penguin?
- dezgeg 4y ago
  Hmm, there is a different 'accidental hard drive dialing' story in his autobiography (Just for Fun) - where that happened in Minix and as a result Linus chose to move to Linux full-time: > But in December, I mistakenly auto-dialed my hard disk instead of my modem. I was trying to auto-dial /dev/tty1, which is the serial line. But by mistake I auto-dialed /dev/hda1, which is the hard disk device. The end result was that I inadvertently overwrote some of the most critical parts of the of the partition where I had Minix. Yes, that meant I couldn’t boot Minix anymore. > > That was the point where I had a decision to make: I could reinstall Minix, or I could bite the bullet and acknowledge that Linux was good enough that I didn’t need Minix. I would write the programs to compile Linux, under itself, and whenever I felt I needed Minix I would just add the desired feature to Linux. It’s a big conceptual step when you drop the original hosting environment and truly make a program self-hosting, so big that I released the new version as 0.10 in late November. Of course, maybe he did do the same mistake twice :)
Reason077 4y ago
In the early days of the iPhone you could jailbreak and get a tty into the baseband chip to do all kinds of cool stuff. And at least back in those days (iPhone 3GS/4/5 era), the Qualcomm baseband chips still very much used the AT command set. Took me right back to the BBS era. I wonder if they still use AT commands today?
- flangola7 4y ago
  Are there any FOSS baseband systems?
anigbrowl 4y ago
More like a billion (soon to be trillion!). Hayes is still in use on pretty much all IOT modems. I was digging through the docs of some a few months ago and thinking 'welp, guess I have to learn about cellular data modems...sigh' only to find the chip maker's API involved sending AT commends to the hardware, and not much had changed in 30 years since I had lest needed them. IOT hacking in general is a fun nostalgia trip. Edge device sims are limited to very paltry monthly data caps unless you want to pay fat money, and it's kinda fun to work within such tight constraints and think of ways to squeeze value out of every last byte.
rcarmo 4y ago
I used to know a bunch of those by heart from doing tech support at an ISP (and testing several different modems). Fun fact: it’s all still there in a lot of mobile chipsets, just like fax emulation :)

80 points by ohjeez 4y ago

The AT command set is very much alive and well. All those cellular chips in your smartphones and IoT devices still communicate with their host processors over a serial communication line, identical to the Hayes box back in 1978. The commands have gotten more complicated, but as far as I know ATI will still give you a typical part identification code.

mocko 4y ago
It truly is. For an example look at these guys juggling AT commands to control 5G modems fresh off the production line - https://forums.whirlpool.net.au/archive/3vx1k1r3-39 https://forums.whirlpool.net.au/archive/3vx1k1r3-39.
Nextgrid 4y ago
Qualcomm (and maybe others) have alternatives though such as QMI.
- joezydeco 4y ago
  I'm figuring that Apple has probably developed their own as well.
  - Reason077 4y ago
    You certainly used to be able to get a tty to the baseband and enter AT commands on a jailbroken iPhone back in the iPhone 5 (or so) days... https://www.theiphonewiki.com/wiki/Baseband_Commands https://www.theiphonewiki.com/wiki/Baseband_Commands
    - joezydeco 4y ago
      Right. But Apple bought the entire cell modem arm of Intel three years ago. This should be fun. https://www.apple.com/newsroom/2019/07/apple-to-acquire-the-majority-of-intels-smartphone-modem-business/ https://www.apple.com/newsroom/2019/07/apple-to-acquire-the-...
      - Reason077 4y ago
        I don't think that's a bad thing. Qualcomm absolutely dominates high-end modem chips right now and, if Apple can pull it off, competition will be good for the industry. Only the Chinese (Huawei/HiSilicon) have come close to challenging Qualcomm in recent years, until they got shut down by US import restrictions and seem to have given up at this point.

tyingq 4y ago

I like this old summary of various ways to trick a modem connected server into outputting +++ATH0, which would disconnect it. https://opennet.ru/base/usersoft/3.txt.html https://opennet.ru/base/usersoft/3.txt.html It did work on some modems with loose requirements around the timing and pauses.

tonyarkles 4y ago
Heh, I was one of the first in my group of friends to get DSL and the ping trick was a wonderful way to troll people. Before the DSL line, I too had a modem that was vulnerable so trying to send the ping would kick me off instead of the target.
rchowe 4y ago
It’s because Hayes held the patent on the modem having to pause for one second before it could receive commands. Other modem manufacturers implemented the “time-independent escape sequence” to get around the patent[0]… the only issue being binaries that contained control codes and meddlesome kids. [0] https://en.m.wikipedia.org/wiki/Time_Independent_Escape_Sequence https://en.m.wikipedia.org/wiki/Time_Independent_Escape_Sequ...

hrunt 4y ago

One of my first jobs was working for a mom-and-pop dial-up ISP. I persuaded my mom to get an account with them when I saw them in a computer magazine. I did not even have a web browser! A little after that, they hired me. One of the things we used to do when I first started was shuck modems. We would buy the consumer models, break open the plastic cases, pull the circuit boards out, and slide them into slots of custom enclosures. Then we would hand-assemble DB-to-ethernet adapters and plug them into serial controller banks. We bought any and all modems, but the cheap models from US Robotics and Supra were really a game changer. The only tough part was that dealing with the slight differences in command differences on the client side needed to connect to the different modem types.

ghaff 4y ago
There was a period when various modem manufacturers were pushing speed limits and they did some non-standard things to do so. As I recall, USR's 9600 bps was one of the more non (Hayes) standard. Since you mention ISPs though, this was probably a bit earlier.
- bhauer 4y ago
  You might be right about the USR 9600 bps mode, but for certain their original 14.4k bps mode was proprietary and named "HST." I still fondly remember when I got my Courier HST and witnessed its intense speed boost versus my prior 2400 bps modem.
  - ghaff 4y ago
    There were 9600 bps USR Courier HST models. Pretty sure I still have one up in the attic unless I've tossed it. I forget what I had in the 14K generation.
    - bhauer 4y ago
      Maybe I am misremembering, then. Perhaps I had a 9600 bps HST.
- 4y ago

asah 4y ago

LOL, a lot more than 1 million... more like 100M+

netsharc 4y ago

Somewhat related to AT commands, there's a collection of anecdotes from Linus Torvalds' old officemate in Uni Helsinki, one time Linus had a brainfart while trying to dial into his ISP, the result of which was that his harddisk bootsector ended up beginning with the string "ATDT " and his ISP's phone number. The next day Linus implemented permission controls. Sadly DDG and Google can't find me anything with those keywords. Either that story has disappeared off the web, or search engines really suck nowadays. Edit: Well, I found it, but I had to go to a blog where the story was quoted, and the blog author had written down the link not as a hyperlink: https://liw.fi/linux-anecdotes/ https://liw.fi/linux-anecdotes/

nico 4y ago
> Either that story has disappeared off the web, or search engines really suck nowadays. Given you found the story, it seems like it hadn’t disappeared off the web. However, search engines might suck.
hulitu 4y ago
> If we play our cards right, the Linux penguin could be the next mass-consumer hit product. Can you imagine a Windows flag competing against our penguin?
dezgeg 4y ago
Hmm, there is a different 'accidental hard drive dialing' story in his autobiography (Just for Fun) - where that happened in Minix and as a result Linus chose to move to Linux full-time: > But in December, I mistakenly auto-dialed my hard disk instead of my modem. I was trying to auto-dial /dev/tty1, which is the serial line. But by mistake I auto-dialed /dev/hda1, which is the hard disk device. The end result was that I inadvertently overwrote some of the most critical parts of the of the partition where I had Minix. Yes, that meant I couldn’t boot Minix anymore. > > That was the point where I had a decision to make: I could reinstall Minix, or I could bite the bullet and acknowledge that Linux was good enough that I didn’t need Minix. I would write the programs to compile Linux, under itself, and whenever I felt I needed Minix I would just add the desired feature to Linux. It’s a big conceptual step when you drop the original hosting environment and truly make a program self-hosting, so big that I released the new version as 0.10 in late November. Of course, maybe he did do the same mistake twice :)

Reason077 4y ago

In the early days of the iPhone you could jailbreak and get a tty into the baseband chip to do all kinds of cool stuff. And at least back in those days (iPhone 3GS/4/5 era), the Qualcomm baseband chips still very much used the AT command set. Took me right back to the BBS era. I wonder if they still use AT commands today?

flangola7 4y ago
Are there any FOSS baseband systems?

anigbrowl 4y ago

More like a billion (soon to be trillion!). Hayes is still in use on pretty much all IOT modems. I was digging through the docs of some a few months ago and thinking 'welp, guess I have to learn about cellular data modems...sigh' only to find the chip maker's API involved sending AT commends to the hardware, and not much had changed in 30 years since I had lest needed them. IOT hacking in general is a fun nostalgia trip. Edge device sims are limited to very paltry monthly data caps unless you want to pay fat money, and it's kinda fun to work within such tight constraints and think of ways to squeeze value out of every last byte.

rcarmo 4y ago

I used to know a bunch of those by heart from doing tech support at an ISP (and testing several different modems). Fun fact: it’s all still there in a lot of mobile chipsets, just like fax emulation :)