ITrax Module Teardown

While working on my car battery, I discovered a forgotten little GPS tracker tossed in with the jack. At first I couldn't figure out what I was looking at...

Why, it's a cellular GPS tracker! Eventually I figured out it came with the ITrax system I got when I bought the car way back in 2016. Some online investigation found that the company is long dead, and many believe it may have died in 2015, when the last Facebook post is: https://www.facebook.com/goitrax/

Anyway, I figured no harm seeing what was inside, so I took it apart.

Inside the base is this little instruction pad. Under that are a number of strong magnets used to attach it to metal parts of the car.

On the other side, we have two tiny antenna - labelled on the sides -- which are attached to with little pogo pins on the PCB.

PCB itself looks like this. There's a GPS module and a cellular modem, presumably under the two shields (which I didn't remove). They are labelled MB81 and MB70, but this doesn't appear to be meaningful.

On the other side of this PCB, and taking up most of the space, is this big ol' battery. It's a D cell sized 3.6v ER34615M - apparently a rather standard battery. It's pretty dead, of course. It had a foam pad glued all around it that was quite difficult to remove, even with heat (not that I wanted to try too much heat.) ie: https://www.batteryjunction.com/titus-er34615m-ax

The SIM card has no markings besides the standard identification data on the reverse side. I didn't take a picture of that in case it still worked -- but of course it doesn't still work. ;)

The USB port was interesting so I decided to power it up and see if it spoke to me as anything. It didn't take power from the USB port, so I ran 3.6v across the battery terminals, which happily didn't explode. The LEDs began blinking as the lid suggested they might.

Windows didn't know what to make of it, but gave me the VID/PID 0E8D/0003, which mapped down to a MediaTek MT6227 phone. I couldn't find a lot of information about this unit, but I did see it was supported under Linux. https://linux-hardware.org/index.php?id=usb:0e8d-0003

So I booted up Minicom to have a look at it, and yeah, it talks like a GSM modem! 

The MCU is also trying to initialize the connection, but since there wasn't one, it didn't seem to get very far.

I did try putting my T-Mobile SIM in, and seemed like it may have initialized it, eventually stopping on an ATH instead of the repeated AT%IPSYS? above, but I didn't catch it going further. (I didn't leave it on long, perhaps it was trying to acquire satellites.)

The MCU would appear to be over here, labelled SBK TI 571 AKY1. Couldn't find much, though there is a CH571 based on RISC-V. I think it has the right number of pins... This page has the 573/571 datasheet: https://www.aliexpress.com/item/1005005805175647.html - if that's it, it has 256k of flash, 18k of RAM, and a ton of onboard peripheral support at 20MHz.

I didn't go any further with it, but I was surprised to see at least as recently as 2020 people were still being sold these systems. The unit was dropped randomly all over the car - one person found it in their glove box! And cellular modems aren't really expensive anymore, so I'm not sure how useful this may be. But, if you wanted to use such a thing, you could try disabling the MCU to just have a USB modem (possibly), or even potentially try to reprogram it.

Other things I should have done but didn't - remove the the shields to verify what's under them, and see what the RX/TX pads under the SIM card are for. ;)