How-To: Cell Comm Killer.

[Lilschmied]

Ive found nothing in the dealer or the supplier menus related to cellular unfortunately.

My unit isn't nav, so that's why I can't see the bars there.

I would try 2 things from here:

1. Unplug gps. It should not be related but it is hitting the same card so let's rule that out.

2. I would trace where the 3 rf cables go to internally, is it straight to the back of the unit and the fakra plugs or does it go to another PCBA?

 

[HotWheels22]

Ive found nothing in the dealer or the supplier menus related to cellular unfortunately.

My unit isn't nav, so that's why I can't see the bars there.

I would try 2 things from here:

1. Unplug gps. It should not be related but it is hitting the same card so let's rule that out.

2. I would trace where the 3 rf cables go to internally, is it straight to the back of the unit and the fakra plugs or does it go to another PCBA?

1. Did this. In fact, did it both externally AND internally. There are 3 small coaxial leads that run from the main PCB (from the FAKRA input traces) to the AirCard. I pulled all 3 of those small internal connector wires off, system still receives the same level of 4G signal. I'm satisfied that there's an internal antenna on that AirCard somewhere.

2. The path for the internal coax antenna connector cables is pretty straightforward.

The headers are in this order on the back:


And the traces look like this:


As the colors are labeled on the AirCard, the black/white/gray leads match those. (See earlier photo of AirCard)
The empty coax connector in this photo (CN512) goes to the main board and attaches to the large silver SiriusXM radio tuner. This makes sense as the satellite antenna (white coax internal cable) goes to both the AirCard for GPS and the SXM Tuner for radio.

 

[Lilschmied]

I find it highly unlikely that there's an antenna embedded on that card from what has been shown so far. I don't see it on the pcba, so if it's somehow under the shield as part if the sierra chip, try to wrap your cloth over the chip area and see if the signal drops out. They might just have amazing sensitivity in the unit and you need more isolation.

Have you tried the assist button with the blocker on?

 

[HotWheels22]

I find it highly unlikely that there's an antenna embedded on that card from what has been shown so far. I don't see it on the pcba, so if it's somehow under the shield as part if the sierra chip, try to wrap your cloth over the chip area and see if the signal drops out. They might just have amazing sensitivity in the unit and you need more isolation.

Have you tried the assist button with the blocker on?

It's coming down to trying that (shielding the chip/card), but that's going to require some significant engineering, to ensure no shorting. The AirCard is attached to the housing via thermal adhesive, so the back of the card can't be directly shielded. May try a generic shield over one end of the housing first (much easier to test) to see if there's a measurable drop.

I have not specifically tried the assist button with the blocker on, as it did not work even with standard antenna connected. I could test, but seemed like if it didn't work with the standard antenna, the blocker wouldn't be likely to make it function any better.

 

[Lilschmied]

Put down a layer of kapton tape first then your fabric. The kapton will prevent shorting. You can put a layer of tape on the other side under the pcb as well if your worried about where the board attaches.

Edit: I re-read how it's attached, does it only mount to the housing or is it mounted to the other pcbas and the housing is just a heatsink?

 

[HotWheels22]

Put down a layer of kapton tape first then your fabric. The kapton will prevent shorting. You can put a layer of tape on the other side under the pcb as well if your worried about where the board attaches.

Edit: I re-read how it's attached, does it only mount to the housing or is it mounted to the other pcbas and the housing is just a heatsink?

Kapton's no issue for the top, agreed. For the bottom, the back of the AirCard PCB mounts directly to the main head unit housing inside with thermal adhesive.

 

[Lilschmied]

Tape a piece of fabric to the housing and cut a hole for the thermal pad. Leave excess on the side that can be folded over and tied into the top piece?

 

[HotWheels22]

Tape a piece of fabric to the housing and cut a hole for the thermal pad. Leave excess on the side that can be folded over and tied into the top piece?

I like this idea. Step one is gonna be shield the end of the whole head unit (quick and dirty) to see if it's measurable.

Then if it seems promising, step 2 is the full shield approach. If I'm doing it, I only want to do it once due to the teardown and re-thermal process to put it back together, so it's gonna be done right. a piece of secondary fabric outside on the end of the head unit to block the hole beneath the PCB (big overlap) would likely help reduce the leakage.

 

[HotWheels22]

General update:

I was able to create a bench test of @Diboblo 's blockers, using the RF meter, a short, shielded coax pigtail with a male FAKRA connector on the end, and the blocker connected directly.

This setup confirmed two things:
- The blockers I crafted are behaving as blockers, significantly reducing signal reception, not increasing.
- My blockers are not perfect, and when put near strong direct signal sources (such as a WiFi router), they do allow some signal to pass.

When compared to the normal antenna, the signal blockers represent a dramatic decrease.

I also tested a non-shielded version of the same blocker - the exposed resistor/wiring with no Faraday cloth around it. It behaves much like a normal antenna, greatly increasing the signal gathered by the RF meter. This confirms that the shielding in the blockers is working correctly, heavily reducing signal.

Conclusion from these tests:
It's not likely that the blockers themselves are the problem, they appear to be functioning well.
It may be that the cell signal in the area, combined with the sensitivity of the AirCard, is simply strong enough to overpower them, but this seems to be the less likely option.
It may be that the AirCard is detecting poorer (or no) signal through the external blocked antennas, and is simply switching to an internal antenna instead. This seems like the more likely option.

 

[MMissile]

I applaud your efforts, guys. It's diabolical, to what extent the modern corporations will go to spy on people, and make money doing it.......all the while stealing your privacy, with absolutely no concern.

 

[Lilschmied]

General update:

I was able to create a bench test of @Diboblo 's blockers, using the RF meter, a short, shielded coax pigtail with a male FAKRA connector on the end, and the blocker connected directly.

This setup confirmed two things:
- The blockers I crafted are behaving as blockers, significantly reducing signal reception, not increasing.
- My blockers are not perfect, and when put near strong direct signal sources (such as a WiFi router), they do allow some signal to pass.

When compared to the normal antenna, the signal blockers represent a dramatic decrease.

I also tested a non-shielded version of the same blocker - the exposed resistor/wiring with no Faraday cloth around it. It behaves much like a normal antenna, greatly increasing the signal gathered by the RF meter. This confirms that the shielding in the blockers is working correctly, heavily reducing signal.

Conclusion from these tests:
It's not likely that the blockers themselves are the problem, they appear to be functioning well.
It may be that the cell signal in the area, combined with the sensitivity of the AirCard, is simply strong enough to overpower them, but this seems to be the less likely option.
It may be that the AirCard is detecting poorer (or no) signal through the external blocked antennas, and is simply switching to an internal antenna instead. This seems like the more likely option.

Depends if the signal is bleeding through the plastic fakra, your test lead(however you adapted to the fakra) or the cloth. What kind of frequency bands did you test? Would be interesting to know if 700MHz leaks through less than 2 Ghz, the shorter wavelength I'd expect to bleed through more and an additional layer of cloth should attenuate it more.

The sierra card lists sensitivity at -105dBm which is better than anything a cheap test setup I could currently assemble would pick up. I still don't know where they'd have hidden an additional antenna in that assembly. Would be great if we could get a schematic of the chip or even a broken one to probe around in. The low res picture online doesn't give us much to work from.

Maybe we're going the wrong direction, and we should be adding an rf jammer on the ports instead...

 

[Diboblo]

Depends if the signal is bleeding through the plastic fakra, your test lead(however you adapted to the fakra) or the cloth. What kind of frequency bands did you test? Would be interesting to know if 700MHz leaks through less than 2 Ghz, the shorter wavelength I'd expect to bleed through more and an additional layer of cloth should attenuate it more.

The sierra card lists sensitivity at -105dBm which is better than anything a cheap test setup I could currently assemble would pick up. I still don't know where they'd have hidden an additional antenna in that assembly. Would be great if we could get a schematic of the chip or even a broken one to probe around in. The low res picture online doesn't give us much to work from.

Maybe we're going the wrong direction, and we should be adding an rf jammer on the ports instead...

I know you guys have newer telematics cards, but my vehicle has zero signal strength, with the blocker. MY15, only has one cellcomm antenna.

I would think if there was any FAKRA bleed, I would have noticed, by now. Every time I start the vehicle, I get the cell notice, on screen.

My confidence is high, for early build, single antenna total blockage.

I am encouraged, by the present discussion, that we will find an answer. Also, have we considered there may be a second telematics module feeding the radio?

I need to get ahold of a 2024 wiring guide...

 

[fumanchu182]

For those of us with MY15, hasn't the 3g network been disabled? What RF comms are left?

 

[Diboblo]

For those of us with MY15, hasn't the 3g network been disabled? What RF comms are left?

Are MY15 cars comms dead, without the blocker?

There has to be some legacy 3G, otherwise MY15, 16, 17 cars guardian and outbound cellcomms and satcomms would be tits up. So would onboard 911 emergency connectivity, and I haven't heard anyone say that's gone away.

I believe retail 3G is dead, but the infrastructure hasn't gone away... otherwise they'd make 4G upgrades available, for older MY cars. They have a hard on, for collecting our data. It's a passive income stream, for them...probably in the millions, per year... or more.

 

[Lilschmied]

For those of us with MY15, hasn't the 3g network been disabled? What RF comms are left?

Should be none, but I'm not aware that 3g went completely away other than the big guys(including the original provider in sprint) sunset it back in '22. I'd bet some of the lesser providers still run it.

 

[Lilschmied]

Are MY15 cars comms dead, without the blocker?

There has to be some legacy 3G, otherwise MY15, 16, 17 cars guardian and outbound cellcomms and satcomms would be tits up. So would onboard 911 emergency connectivity, and I haven't heard anyone say that's gone away.

I believe retail 3G is dead, but the infrastructure hasn't gone away... otherwise they'd make 4G upgrades available, for older MY cars. They have a hard on, for collecting our data. It's a passive income stream, for them...probably in the millions, per year... or more.

I thought all those things like onstar, etc. were gone? That's why they started pushing the 4G OBD dongles.

 

[HotWheels22]

Depends if the signal is bleeding through the plastic fakra, your test lead(however you adapted to the fakra) or the cloth. What kind of frequency bands did you test? Would be interesting to know if 700MHz leaks through less than 2 Ghz, the shorter wavelength I'd expect to bleed through more and an additional layer of cloth should attenuate it more.

The sierra card lists sensitivity at -105dBm which is better than anything a cheap test setup I could currently assemble would pick up. I still don't know where they'd have hidden an additional antenna in that assembly. Would be great if we could get a schematic of the chip or even a broken one to probe around in. The low res picture online doesn't give us much to work from.

Maybe we're going the wrong direction, and we should be adding an rf jammer on the ports instead...

Good points.

The plastic fakra bleed is there to some degree I'm sure. Is it enough to matter? Inconclusive.

The test lead from RF meter to blocker is a shielded coax cable. That lead is obviously only used when bench-testing the blockers, not in the vehicle.
- I tested the lead itself to see if it's picking up any signal by connecting ONLY the lead to the RF meter, nothing on the end, and measuring signal in a baseline location (away from a strong source), as well as directly next to the wifi router.
- The readings were the same with and without the test lead, so I conclude that it's not acting as an antenna (does not improve or reduce measured signals).

As far as frequency bands, I primarily picked a frequency band from 2400-2500mhz, simply because it's a crowded spectrum so there's lots of noise to pick up.
To the point of 700mhz, I can test that, but don't have a strong 700mhz source to test it near.

A couple of data points regarding shielding: the blocker currently has ~6 layers of Faraday cloth at its thinnest point, and ~14 at its thickest. I tested the RF meter with a real antenna connected to it, but completely sealed in an envelope of Faraday cloth, sitting directly on (touching) a wireless router. Zero signal was picked up. The difference between a perfect seal and a tiny gap in the envelope was significant, not surprisingly.

I tested to -110dbm. At that level, there's honestly noise with/without antennas, blockers, etc. The casing itself and the antenna nub are sufficient to pick up RF at that low level.

I noticed the same regarding sensitivity in the card itself. -105dbm is going to be difficult to defeat without a very good shield, I suspect. 100% agree on the schematic/chip - that would make things WAY easier.

I'm open to the idea of jammers, but the ones I've located all work with an antenna array that works on all signals in close proximity. Are you aware of any targeted ones that can be put on a port specifically to create noise across a specified frequency band?

 

[HotWheels22]

I know you guys have newer telematics cards, but my vehicle has zero signal strength, with the blocker. MY15, only has one cellcomm antenna.

I would think if there was any FAKRA bleed, I would have noticed, by now. Every time I start the vehicle, I get the cell notice, on screen.

My confidence is high, for early build, single antenna total blockage.

I am encouraged, by the present discussion, that we will find an answer. Also, have we considered there may be a second telematics module feeding the radio?

I need to get ahold of a 2024 wiring guide...

I agree regarding bleed. This obviously isn't a little bleed, this is 3-4 bars of strong signal even with both blockers on.

I did a reboot of the head unit as a test with both blockers installed, just to see if perhaps it would force it to reselect the primary antenna. As it was coming back online, it briefly displayed the no signal icon, but only for a couple of seconds before signal was restored.

RE: a second telematics unit - all research I have done into the 23 Challenger head units indicates there is no separate telematics module. Some of the jeeps/trucks are using a telematics box, but the connectivity is very different. I've personally found nothing to indicate the presence of one so far. Welcome input if someone has data that shows otherwise.

Question for you: Do you have any info on what AirCard is in your head unit, if it's a different Sierra card or something else? Any idea on a manual for the AirCard itself (if that's how yours is set up)? Would be curious to compare sensitivities, implementation, etc.

It's going to be a few days before I'm able to attempt the full shielding of the AirCard, waiting on some supplies.

 

[Lilschmied]

I agree regarding bleed. This obviously isn't a little bleed, this is 3-4 bars of strong signal even with both blockers on.

I did a reboot of the head unit as a test with both blockers installed, just to see if perhaps it would force it to reselect the primary antenna. As it was coming back online, it briefly displayed the no signal icon, but only for a couple of seconds before signal was restored.

RE: a second telematics unit - all research I have done into the 23 Challenger head units indicates there is no separate telematics module. Some of the jeeps/trucks are using a telematics box, but the connectivity is very different. I've personally found nothing to indicate the presence of one so far. Welcome input if someone has data that shows otherwise.

Question for you: Do you have any info on what AirCard is in your head unit, if it's a different Sierra card or something else? Any idea on a manual for the AirCard itself (if that's how yours is set up)? Would be curious to compare sensitivities, implementation, etc.

It's going to be a few days before I'm able to attempt the full shielding of the AirCard, waiting on some supplies.

Older uconnect(VP3/4) teardowns show an AR5550 from sierra.

I'm thinking simpler than antennas, just a signal generator straight into the fakra connectors that sweeps constantly to confuse the chip. Would take a little design to impedance match the expected 10k antenna to a typical 50ohm output, but you can get really cheap signal generators online that go up to 4GHz.

Biggest issue I see with this is the car is always 'on', so the signal generator would be a parasitic draw even when parked unless coupled with a radio kill switch. I'd sooner yank the chip.

 

[HotWheels22]

Better photo of the guts of the AR7552 card, heat spreader off, courtesy of the FCC: