/usr/bin/gl_modem                ## The gl_modem binary
/lib/netifd/proto/ncm.sh         ## Part of netifd
/lib/netifd/netifd-proto.sh      ## More netifd
/usr/bin/modem_network_recover_detection.sh  ## part of glinet kmwan for fixing broken connections.
ls -l  /usr/bin/modem*

Modem details:

# This is for a Huawei E3372-320h
Vendor=12d1 ProdID=155e Rev= 1.02

AT Commands:

ATI
AT+CPIN?
AT^ICCID?
  ^ICCID: 8912345678987654321  # Not the real iccid!
  OK
AT^NDISDUP=1,1,"giffgaff.com"

drop pdp for testing

gl_modem -B 1-1 AT 'AT+CGACT=0,1'

bring pdp up:

gl_modem -B 1-1 AT 'AT+CGACT=1,1'

OS and uci peek and poke:

ls -l /var/usbnode/1-1/modem/
cat /var/state/network
uci -P /var/state show network.wwan.ifname
  network.wwan.ifname='wwan0'
uci -P /var/state show network.modem_1_1.ifname
  network.modem_1_1.ifname='wwan0'
uci -P /var/state show
uci -q get glmodem.global.log_level

Databases:

/www/js/apns-full-conf.json.gz      ## An isp apn list in the firmware that gets unzipped to...
/var/run/modem/apns-full-conf.json  ## ...here. If it exists already it doesn't get re-unzipped.

I added giffgaff entry to the apns-full-conf.json files above:

   {
      "-carrier": "giffgaff",
      "-carrier_id": "2118",
      "-mcc": "234",
      "-mnc": "10",
      "-apn": "giffgaff.com",
      "-type": "default,ia,supl,mms,xcap"
    },
    {
      "-carrier": "giffgaff",
      "-carrier_id": "2118",
      "-mcc": "234",
      "-mnc": "105",
      "-apn": "giffgaff.com",
      "-type": "default,ia,supl,mms,xcap"
    },

Sniffing the calls made to gl_modem:

# A shim to wrap around gl_modem to sniff calling info and processes.
nano /usr/bin/gl_modem

#!/bin/sh
# Stub wrapper for gl_modem to log calls and forward to the real binary
logger -p notice -t gl_modem_AndyFix "gl_modem called args: $*"

# Run the real binary with all arguments, capture its exit code
/usr/bin/gl_modem.patched4 "$@"
ret=$?

# Log the exit code
logger -p notice -t gl_modem_AndyFix "gl_modem exit code: $ret"

# Propagate the exit code back to the caller
exit $ret

If you see this in the logs:

Wed Dec 17 07:15:17 2025 daemon.info gl_modem: (modem_cm.c:1324) Enter the dialing process
Wed Dec 17 07:15:17 2025 daemon.err gl_modem: (modem_cm.c:1343) Failed to get iccid, maybe PIN code is locked,please check!

It probably means the sim is returning a 19 digit iccid. gl_modem is hardcoded to look for 20 digits.

At file address 019990 change:

BF 52 00 71     cmp        w21,#0x14      // 20 digit check

to

BF 4E 00 71     cmp        w21,#0x13      // 19 digit check

gl_modem has a lookup table for each modem it recognises and a list of functions it can call to do various things.

The idea (i think) is that the command gl_m#odem -B 1-1 connect-auto uses this table and the info in the apn database to setup the modem and populate a config interface xxxx in /etc/config/network as if by magic.

modem_head is the start of the table at 029000 in the file, 439000 in the ghidra project.

Modem Struct E3372 Model ID:

(029DE0) 00439de0 5E 15 00 00     int32_t         155Eh                modem_productid
(-29e88) 00000000 Remove modem_get_sim_mcc_mnc call, not supported.