Rayhunter on a HiMI MSM8916 Dongle

What this build is, and isn't

Rayhunter is EFF's open-source IMSI-catcher detector. It runs a small daemon on a Qualcomm hotspot, reads the modem's diagnostic stream (/dev/diag), and watches the LTE control plane for the tricks fake base stations use - odd identity requests, forced downgrades to 2G, null-cipher. It is passive and defensive: it only observes the cell your own SIM is camped on. It does not transmit, does not see other people's phones, and is not an IMSI catcher.

Rayhunter officially supports the UZ801 (also MSM8916). This guide adapts that to a HiMI-firmware dongle - a different vendor on the same chip - where the official installer's backdoor doesn't apply and the autostart path is different. The daemon binary and device = "uz801" config are reused as-is; everything around them is device-specific.

Confirm ADB is reachable, the SoC is MSM8916, and the diag device exists. If any of these fail, stop - this device isn't a Rayhunter target.

$ sudo apt install -y android-tools-adb fastboot
$ adb devices
# 234a3430    device   ← your serial, "device" state

$ adb shell "cat /proc/cpuinfo | grep Hardware"
# Hardware : Qualcomm Technologies, Inc MSM8916
$ adb shell "ls -l /dev/diag"
# crw-rw---- system qcom_diag 243, 0 ... diag   ← must exist
$ adb shell "getprop ro.product.manufacturer; getprop ro.build.version.release"
# HiMI
# 4.4.4

Rayhunter and the backup both need root. On a userdebug build this is one command - but it resets on every reboot, so you'll re-run it often.

$ adb shell "setprop service.adb.root 1; busybox killall adbd"
$ adb wait-for-device
$ adb shell id
# uid=0(root) gid=0(root) ...   ← you're root

Before touching anything, dump the flash. The modem/calibration partitions hold your IMEI and radio tuning and cannot be recovered any other way. This backup is also what saves you if a later step goes wrong.

$ adb shell "ls -l /dev/block/platform/*/by-name/"
# note the mmcblk0pN number for each name

$ mkdir -p ~/stick-backup && cd ~/stick-backup
$ for pair in modem:1 sbl1:2 sbl1bak:3 aboot:4 abootbak:5 \
      rpm:6 rpmbak:7 tz:8 tzbak:9 hyp:10 hypbak:11 pad:12 \
      modemst1:13 modemst2:14 misc:15 fsc:16 ssd:17 splash:18 \
      DDR:19 fsg:20 sec:21 boot:22 system:23 persist:24 \
      config:26 recovery:27; do
    name=${pair%%:*}; num=${pair##*:}
    echo "== $name (mmcblk0p$num)"
    adb shell "dd if=/dev/block/mmcblk0p$num of=/data/local/tmp/$name.img bs=4096" && \
    adb pull /data/local/tmp/$name.img . && \
    adb shell "rm /data/local/tmp/$name.img"
  done
$ ls -lh

$ adb shell "busybox md5sum /dev/block/mmcblk0p1 \
      /dev/block/mmcblk0p13 /dev/block/mmcblk0p14 \
      /dev/block/mmcblk0p20 /dev/block/mmcblk0p24"
$ md5sum modem.img modemst1.img modemst2.img fsg.img persist.img
# the two lists must match line-for-line

The official ./installer uz801 fails on HiMI because it expects a web backdoor the firmware doesn't have. ADB is already open, so we push the daemon by hand instead - which is simpler and more reliable here.

$ wget https://github.com/EFForg/rayhunter/releases/download/v0.13.0/rayhunter-v0.13.0-linux-aarch64.zip
$ unzip rayhunter-v0.13.0-linux-aarch64.zip
$ cd rayhunter-v0.13.0-linux-aarch64
$ file rayhunter-daemon/rayhunter-daemon
# ELF 32-bit LSB executable, ARM, EABI5 ... statically linked, stripped

$ cat > config.toml <<'EOF'
device = "uz801"
qmdl_store_path = "/data/rayhunter/qmdl"
port = 8080
EOF

$ adb shell "setprop service.adb.root 1; busybox killall adbd"
$ adb wait-for-device
$ adb shell "mkdir -p /data/rayhunter/qmdl"
$ adb push rayhunter-daemon/rayhunter-daemon /data/rayhunter/
$ adb push config.toml /data/rayhunter/
$ adb shell "chmod 755 /data/rayhunter/rayhunter-daemon"

Prove the daemon runs and opens diag before automating anything. Run it in the foreground once - that's the most reliable way to see the log and confirm the web UI.

$ adb shell
# now inside the device shell:
# cd /data/rayhunter
# RUST_LOG=info ./rayhunter-daemon config.toml

R A Y H U N T E R 🐳
Using configuration for device: Uz801
Diag device initialization succeeded after 0 retries
enabled logging for log type 1 / 4 / 5 / 7 / 10 / 11 / 13
Starting recording with 1502MB disk space available
The orca is hunting for stingrays...

http://192.168.100.1:8080

Make it launch itself on power-on, with no PC. The key insight: edits to the init ramdisk don't persist (it's rebuilt from boot.img each boot), and repacking boot.img risks a no-boot. The safe path is a /system script that init already runs late in boot - HiMI even uses it for its own launcher.

$ adb shell "ls -l /system/etc/init.qcom.post_boot.sh"
$ adb shell "busybox tail -4 /system/etc/init.qcom.post_boot.sh"
# ... ends with:  /data/SelfHost/startRIDL.sh &

#!/system/bin/sh
(
sleep 30
RUST_LOG=info /data/rayhunter/rayhunter-daemon /data/rayhunter/config.toml \
  > /data/rayhunter/rayhunter.log 2>&1
) &

$ printf '#!/system/bin/sh\n(\nsleep 30\nRUST_LOG=info /data/rayhunter/rayhunter-daemon /data/rayhunter/config.toml > /data/rayhunter/rayhunter.log 2>&1\n) &\n' > ~/stick-backup/start.sh
$ adb push ~/stick-backup/start.sh /data/rayhunter/start.sh
$ adb shell "chmod 755 /data/rayhunter/start.sh"

$ cd ~/stick-backup
$ adb shell "mount -o remount,rw /system"
$ adb pull /system/etc/init.qcom.post_boot.sh .
$ cp init.qcom.post_boot.sh init.qcom.post_boot.sh.bak
$ nano init.qcom.post_boot.sh

# Start Rayhunter IMSI-catcher detector
/system/bin/sh /data/rayhunter/start.sh &

$ tail -6 init.qcom.post_boot.sh    # confirm your line is there
$ adb push init.qcom.post_boot.sh /system/etc/init.qcom.post_boot.sh
$ adb shell "chmod 644 /system/etc/init.qcom.post_boot.sh"

$ adb reboot
# wait ~75s (boot + the 30s sleep), then:
$ adb shell "setprop service.adb.root 1; busybox killall adbd"
$ adb wait-for-device
$ adb shell "ps | busybox grep rayhunter"
# root 1387 1207 ... /data/rayhunter/rayhunter-daemon  ← PPID 1207 = launched by boot
$ adb shell "busybox cat /data/rayhunter/rayhunter.log"
# ... Using configuration for device: Uz801 ... The orca is hunting ...

The payoff, plus the one thing that makes it actually detect.

• Power: plug into any USB power bank or charger. It boots, the modem attaches, and ~30s later the daemon starts recording - no computer in the loop.
• Insert an active SIM. This is essential. With no SIM the modem never attaches to a network, so there is nothing to detect. The log line reading the home PLMN from the SIM isn't supported / no operator means no SIM is attached. Use a SIM from the carrier you want to monitor.
• Read it: connect any phone/laptop to the stick's Wi-Fi, open http://192.168.100.1:8080 for status, warnings, and recordings.
• Analyze: download a capture (QMDL/PCAP) from the web UI and open the PCAP in Wireshark to inspect the LTE RRC/NAS signaling.

A standalone unit benefits from an at-a-glance status light. This dongle makes it awkward, so treat it as polish - the web UI already shows everything.

What we found on this board:

So a single echo > brightness won't hold. Three options, in order of effort:

• Out-write it - a watcher that rewrites the LED every ~150 ms wins visually over himiwebserver's slower updates. Keeps Wi-Fi/admin UI alive. The rayled.sh sketch below.
• Freeze himiwebserver on a warning - setprop sys.himiweb_start 0 to stop its repaints and hold a solid LED. Cleaner, but test whether Wi-Fi/admin UI survive it first.
• Reverse-engineer himiwebserver - patch out just its LED writes, keep the web/Wi-Fi logic. A real RE project, but the proper fix.

/data/rayhunter/rayled.sh - adjust the API path after capturing the real endpoint from the web UI's DevTools → Network

#!/system/bin/sh
LED=/sys/class/leds/wifistatus/brightness
API=http://127.0.0.1:8080
PREV=0
led(){ echo "$1" > "$LED" 2>/dev/null; }
blink(){ n=0; while [ $n -lt 6 ]; do led 255; usleep 150000; led 0; usleep 150000; n=$((n+1)); done; }
while true; do
  J=$(curl -s --max-time 3 "$API/api/analysis-report" 2>/dev/null)
  W=$(echo "$J" | busybox grep -o warning | busybox wc -l)
  if   [ -z "$J" ];          then led 0
  elif [ "$W" -gt "$PREV" ]; then blink; PREV=$W
  else led 255; fi
  sleep 2
done

To auto-run it too, add /system/bin/sh /data/rayhunter/rayled.sh & to start.sh after the daemon line.

You have full backups, so a bad boot image is a 2-minute fix, not a brick.

If an experiment (e.g. a boot.img repack) leaves the stick not booting - no Wi-Fi, no adb - check USB:

$ lsusb
# 18d1:d00d ... (fastboot)   → bootloader/fastboot mode: easy recovery
# 05c6:9008                 → EDL mode: use an EDL/QDL tool

From fastboot, restore the original boot partition:

$ cd ~/stick-backup
$ sudo fastboot devices
$ sudo fastboot flash boot boot.img
$ sudo fastboot reboot
# wait ~60s - Wi-Fi and adb should return

Because the /system/etc/init.qcom.post_boot.sh method in Phase 5 never touches boot.img, it can't cause a no-boot - the worst case is the daemon not starting, fixed by re-editing that one line.

• Can: detect suspicious behavior on its own LTE connection - abnormal identity requests, forced 2G downgrades, null-cipher - and save QMDL/PCAP evidence.
• Can't: monitor other phones, locate the source, analyze 5G in depth, or catch passive/network-side interception. A warning means "investigate," not "confirmed Stingray" - misconfigured real towers cause false positives.
• Bands matter: UZ801-class MSM8916 sticks are typically LTE 1/3/5/8/20. In India, band 3 covers Jio/Airtel/Vi, but band 40 (common in cities) is often absent, so the stick may camp on a different cell than your phone. Verify your SIM gets LTE data through the stick.
• Legal/ethical: this is a passive receiver on your own connection - fine. Building an actual IMSI catcher (a fake base station) is illegal and is not what this is.