Coolpad Surf - CP331A

[radec]

I thought I would start a thread for the Coolpad Surf CP331A. Curious if anyone has found anything interesting with the device.

Specifically I have the T-Mobile you can get for free from the T-mobile Test Drive program.

I don't have the Sprint version but from what I can tell from online, the T-mobile and Sprint versions definitely have a different web interface/firmware.

USB tether seems to be enabled by default, when I plug the device in on linux it connects as a Ethernet device and internet works automatically (assuming you have an active account w/ data lol)

here is how it shows up in dmesg:

Code: Select all

[  802.027393] usb 1-1.2: new high-speed USB device number 6 using ehci-pci
[  802.169074] usb 1-1.2: New USB device found, idVendor=05c6, idProduct=9057
[  802.169081] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  802.169085] usb 1-1.2: Product: Coolpad
[  802.169088] usb 1-1.2: Manufacturer: Coolpad
[  802.169091] usb 1-1.2: SerialNumber: 0123---edited----
[  802.466352] usbcore: registered new interface driver cdc_ether
[  802.492886] rndis_host 1-1.2:1.0 usb0: register 'rndis_host' at usb-0000:00:1a.0-1.2, RNDIS device, ae:f5:08:fb:aa:ac
[  802.492945] usbcore: registered new interface driver rndis_host
[  802.876404] rndis_host 1-1.2:1.0 enp0s26u1u2: renamed from usb0
[  802.920810] IPv6: ADDRCONF(NETDEV_UP): enp0s26u1u2: link is not ready

and lsusb

Code: Select all

Bus 001 Device 006: ID 05c6:9057 Qualcomm, Inc.

It also seems like you can boot the device in some sort of fastboot mode
While the device is off hold the WPS down and plug the usb into your computer. All the lights on the the device will hold solid green.

in this mode dmesg shows:

Code: Select all

[  984.811788] usb 3-2: new high-speed USB device number 2 using xhci_hcd
[  984.966952] usb 3-2: New USB device found, idVendor=1ebf, idProduct=7001
[  984.966961] usb 3-2: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  984.966964] usb 3-2: Product: Android
[  984.966967] usb 3-2: Manufacturer: Coolpad
[  984.966970] usb 3-2: SerialNumber: e9edd104

and lsusb

Code: Select all

Bus 001 Device 007: ID 1ebf:7001

sudo fastboot devices shows

Code: Select all

e9edd104	fastboot

ADB devices doesn't show anything.
I also can't find any fastboot commands that work. Not sure if maybe I need different drivers. Maybe someone out there has some other ideas. Just thought I'd see if anyone else was messing with these devices.

[steveg]

Very interesting and timely since I just ordered one to try especially with all the AT&T changes happening.

Found out I should have coverage on their (T-Mobile) new 600MHz band which they are basically calling 5G for rural areas. Guess we'll see.

I'll plan to post back when I get it and have time to play with it some.

[shoulin333]

I tried one and got 50+MBit service 5 miles from the nearest tower. They don't have an external antenna so I got the best service setting it next to my wife's KitchenAid mixer of all things!

Decent device but I tried it with a data only traditional T-Mobile sim and those don't work in the coolpad surf even though it is T-mobile locked.

[shoulin333]

I got curious because of this thread and decided to rip my Coolpad Surf open to see if maybe there are hidden external antenna connectors...... Looks like there is!

I think I will order another set of MHF4 to SMA Female Bulkhead 5" pigtails and see what happens.

If I can get it to accept another T-Mobile sim card this could be a nice modem.

InkedAnnotation 2020-03-06 115250_LI.jpg

Untitled.png

[radec]

@shoulin333 yeah I popped mine open as well and was looking at those. Curious to know if the antennas work out for you. I wish there was a way to see what Band you are connected on.
If you want more internal pictures and pictures without the shields covering everything up, you can check out:
https://fccid.io/R38YLCP331A/


Also if anyone is interested, I was able to change the DNS servers, even though it is grayed out by using "inspect element" in firefox on the Router Settings page. And just removing anything that says disabled="disabled" or is-disabled. The settings seem to have stuck.

[lmore377]

This thread seems pretty dead but I just wanted to say that I found a serial terminal under the metal shield nearest to the battery connector. Red is TX and black is RX and this is the boot log: https://pastebin.com/Rh2FAeJ9

It disables all serial input but if you hold down the wps button until the wifi led starts blinking, it allows you to type but there's a login. If anyone wants to try bruteforcing the login with mine, just reply and maybe we can arrange something with ssh or something

[user232]

Found this forum while searching for antenna info for my coolpad surf. Unfortunately my device is a CP332A which has a similar board judging by the FCC pics, but is for Sprint so i'm not sure if I could help with the bruteforce. Has anyone experimented with attaching an antenna to the device? Currently using this as my dedicated internet access but speeds and signal could certainly be improved. Will update if I figure anything out in the mean time.

[grant11]

So, found this forum while looking for antenna solutions for this also. I ordered the pigtails that normally go on a motherboard wireless card - i think same really as the link in one of the earlier posts - but it looks like the part on the board is a female connector - which is the same as what I had ordered so while it looked the right size, no go. I found it hard to find a similar male connector pigtail. Maybe that will prevent others from doing the same. Anyone have any advice on that, much appreciated.

Another thing is I've got it setup for my grandmother who is an hour away but I've got a problem where it will freeze up after a few days. It's connected to an asus router that supports the tether in the stock firmware. I've eliminated the router as the problem - solution has been to turn the hotspot off and on. I've haven't had a chance to debug this issue with the distance and such but in case anyone has a solution more elegant - would love to hear it. thinking maybe I can get it to reboot once a day or something at least. Any clues out there?

[radec]

This thread seems pretty dead but I just wanted to say that I found a serial terminal under the metal shield nearest to the battery connector. Red is TX and black is RX and this is the boot log: https://pastebin.com/Rh2FAeJ9

thanks for the info, super interesting. definitely over my head but still interesting.
unfortunately I broke my cp331a (just being super clumsy while removing the metal shields lol)so until I find another one I can't mess around with it much.

[Whitt]

Anybody tried any kind of booster with the CoolPad Surf?

I realize some have pointed out that boosters end up amplifying a lot of noise along with the signal, but I'm reminded they had a similar issue in the early days of uhf/vhf TV antennas, with inline amps amplifying the noise as well as the signal after long runs from roof or tower mounted antennas.

Then somebody invented a split system that mounted the input of the amp directly to the output of the antenna up on the roof or tower, thereby amplifying the signal without all the noise in the intervening cable run. They utilized a unique method of sending the voltage for the amp up the coax simultaneous with the signal coming down. Anyway, I thought instead of the standard booster with the long cable run of noise, what about a deconstructed assembly?

The input of the Wilson 460219 could be connected directly to the output of the optionally shown roof or tower mounted yagi, and the 5 volts could be run up inside some thin-walled plastic conduit to protect it from the weather. Then an inexpensive indoor antenna could be connected to the output of the amp.

[Didneywhorl]

Give it a go! Usually the amplifiers seem to work best with very narrow spectrums of frequency. Sounds like you got a project!

[Whitt]

I'm already in the middle of another (unrelated) project, but as soon as it wraps up, I need to get a more reliable signal.

Amp Frequencies: BANDS 04, 05, 13, 17, 25/2

(Up/Down):

698 - 716 MHz / 728 - 746 MHz, 776 - 787 MHz / 746 - 757 MHz, 824 - 849 MHz / 869 - 894 MHz, 1710 - 1755 MHz / 2110 - 2155 MHz, 1850 - 1915 MHz / 1930 - 1995 MHz

Also, the amp is bidirectional, so it amplifies the signal both ways.

[parkskier426]

So I wanted to try out an external antenna on this thing but based on previously posted pictures, I was pretty sure that this doesn't have an MHF4 connector. After a lot of digging, here's what I've come up with:

• The connector on this board is an RF Switch Connector. See here:[url]http://players.brightcove.net/4741948346001/r1QLbAyn_default/index.html?videoId=6091180662001[/url]

• This type of connector is commonly used during the manufactoring process to measure signal levels to reject bad boards.

• IPEX makes a MHF-SW23 RF Switch and connector cable that can be used to connect an external antenna https://www.i-pex.com/product/mhf-sw23-plug

• What's not clear is if this cable would work with this RF switch. Also, I can't find it anywhere for purchase, and it may cost more than it's worth for this project.

What I did notice is that there are two places where the antennas in the caseing is connected to the board, presumably one for wifi, the other for cellular. It should be easy to solder at these points to add on antenna. This is where I'm stuck. There appear to be 3 contact points for the antennas, and I'm not sure what each are. If anyone has expirience here and could shed some light, it would be helpful. I've attached images of the connection points from the board, the case, and what I belive to be the antennas.

MVIMG_20200715_171238.jpg

MVIMG_20200715_171221.jpg

MVIMG_20200715_171431.jpg

[shoulin333]

I have one of these on the way to see if it works. It should plug on to the "testing port" and allow for external antenna.


https://www.ebay.com/itm/RG174-SMA-FEMA ... 2749.l2649

[shoulin333]

Update: The pigtail didn't work. The connector is smaller than MS-156. Holding off on digging any deeper right now.

[jedihustle]

Another thing is I've got it setup for my grandmother who is an hour away but I've got a problem where it will freeze up after a few days. It's connected to an asus router that supports the tether in the stock firmware.

What Asus router do you recommend me buying for this device? Does that setup allow for you to get around the 13 device limit? Have you been able to figure out how to have it reboot automatically?

[grant11]

So - most of the modern Asus routers have a 3G/4G tether setting built in. (I had a spare RT-AC55U that worked - cheap but better options are available that have alternative firmware) However, it's probably better to go with one of the devices on the ofmodemsandmen website (custom firmware geared toward LTE router/modem support).

On Sprint, I've gone back and forth between using a 1) EM7455 connected to a router and 2) coolpad surf USB tether connected to a router. With the t-mobile take over I've noticed a lot of hangs with the EM7455 setup and the coolpad is not nearly as buggy as it once was. I don't love the fact that the coolpad is always charging (you have to leave the battery in) and it is difficult to reboot the system if the coolpad hangs.

[radec]

On Sprint, I've gone back and forth between using a 1) EM7455 connected to a router and 2) coolpad surf USB tether connected to a router. With the t-mobile take over I've noticed a lot of hangs with the EM7455 setup and the coolpad is not nearly as buggy as it once was. I don't love the fact that the coolpad is always charging (you have to leave the battery in) and it is difficult to reboot the system if the coolpad hangs.

Do you know what band you are connected to when the EM7455 hangs? Or does it do it on all bands?

[marcilla.smith]

What I did notice is that there are two places where the antennas in the caseing is connected to the board, presumably one for wifi, the other for cellular. It should be easy to solder at these points to add on antenna. This is where I'm stuck. There appear to be 3 contact points for the antennas, and I'm not sure what each are. If anyone has expirience here and could shed some light, it would be helpful. I've attached images of the connection points from the board, the case, and what I belive to be the antennas.

MVIMG_20200715_171238.jpg
MVIMG_20200715_171221.jpg
MVIMG_20200715_171431.jpg

Hi parkskier

While the configuration of my 332 is not the same as yours, and I can't quite make out in the photos, I'll do my best to guide you.

Reorienting your device rightside up (opposite of the pic), the smallest antenna in the upper left (uncircled) is most likely the wifi. Mine is labeled "BWG" for "Broadband Wireless Gateway." The one to the right of it I think is labeled "FJ" which I believe means "Friendly Jammer" (security feature). This leaves the large one at the bottom which on mine is labeled "LTE."

Thank you to you and others on this thread for the info that has helped me figure this out