A lightweight Rust HTTP server that runs directly on the router (port 9090, LAN-only). It proxies ubus calls, AT commands, and sysfs reads into a typed REST API that mobile apps consume over WiFi.

# Cross-compile for the device
cargo build --release --target aarch64-unknown-linux-musl -p zte-agent

156 endpoints across 17 categories:

Native apps that connect directly over WiFi -- no computer needed.

From the iOS app on iPhone. Personal identifiers (ICCID digits, cell IDs) are masked in these images.

The Dashboard shows the operator, network type, live traffic, battery, CPU temperature and connected devices. Tap Connection & signal for 5G NR and LTE readings (RSRP, RSRQ, SINR, RSSI), band, channel, bandwidth, the operator's speed cap, and a signal history chart.

Dashboard	Connection & signal

With an eSIM card such as the 9eSIM B1 in the SIM slot, Router → eSIM Profiles lists the operator profiles on the card. Swipe right on a profile to switch to it; the app shows each step until mobile data is back. Setup: eSIM profiles.

Profiles on the card	Switching profile

Battery details, USB-C mode (charge your phone from the router's battery), and device controls: charge limit, power-save mode, fast boot and auto sleep.

Battery details	USB-C mode	Device controls

Live modem signal on the Lock Screen and in the Dynamic Island: see iOS Live Activities.

The stock ZTE U60 Pro runs 44 proprietary daemons consuming 225 MB of RAM just for device management. Many of these are unnecessary (TR-069 remote management, MQTT telemetry, Samba, NFC, diagnostics) and phone home to ZTE servers.

zte-agent replaces the need for the official ZTE management app with a single ~2.3 MB binary:

The official ZTE stack's top memory consumers:

zte-agent provides equivalent API access to the same underlying ubus/AT services using 0.35% of the memory -- freeing ~224 MB of RAM for actual routing and WiFi workloads.

The eSIM feature first ran lpac, the open-source eSIM manager, as a separate program on the router. To reach the card through the modem, lpac needs its own copy of GLib, libqmi, libqrtr, curl, OpenSSL and their dependencies (31 shared libraries in all), so it had to be cross-built into a 23.5 MB bundle and installed next to the agent. The agent then started a new lpac process for every card command, including every profile list the app asked for.

zte-agent now has the same eSIM code built in: lpac's card library translated to Rust (euicc/) plus a small driver that talks to the modem directly. It adds about 130 KB to the agent.

Measured on the router (U60 Pro, 9eSIM B1, 2026-10-19):

The results are the same as lpac's. On the router, chip info, profile list and notification list gave identical output. About 1 million generated cases matched the C library. A download sends byte-for-byte the same card commands and server requests. Delete, download, switching and receipts have been tested on a real card (see zte-agent/docs/esim.md).

lpac is still the better tool elsewhere. It supports many card readers and modems (PC/SC, AT, MBIM, QMI) and more commands, such as SM-DS discovery, and it gets upstream fixes. The agent covers only what the app needs on this router, through the modem's QMI over QRTR, and is pinned to lpac commit c7c8d4f: upstream fixes have to be ported by hand. For a USB card reader on a computer, use lpac.

Warning -- The agent exposes device control endpoints that modify firmware settings. Destructive actions (factory reset, reboot) require confirmation in the mobile app.

/data/                              (writable /data partition)
├── zte-agent                       <- on-device REST agent
└── local/tmp/
    ├── start_zte_agent.sh          <- agent boot script
    ├── dropbear                    <- SSH binary (if installed)
    └── start_dropbear.sh          <- SSH boot script (if installed)

/etc/                               (read-only rootfs)
├── rc.local                        <- boot hooks appended here
└── dropbear/
    ├── authorized_keys             <- SSH public key (if installed)
    └── dropbear_rsa_host_key       <- generated host key (if installed)

# 1. Install Rust -- see https://rustup.rs
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

# 2. Add musl cross-compilation target
rustup target add aarch64-unknown-linux-musl

# 3. Install musl cross-linker
# macOS:
brew install filosottile/musl-cross/musl-cross
# Ubuntu/Debian:
sudo apt install musl-tools gcc-aarch64-linux-gnu

# 4. Install ADB
# macOS:
brew install android-platform-tools
# Ubuntu/Debian:
sudo apt install android-tools-adb

# 5. Build the agent
cargo build --release --target aarch64-unknown-linux-musl -p zte-agent

For a factory-fresh device that has never had zte-agent installed:

Option A -- Browser (no tools needed)

Visit open-u60-pro.vercel.app, enter your router password and desired agent password, connect USB, and click Deploy. Requires Chrome or Edge.

Option B -- Command line

./setup.sh <router-password> <agent-password>

Enables ADB, builds and pushes the agent, creates boot scripts, and optionally sets up SSH for wireless deploys.

./deploy.sh yourpassword

This builds, deploys the binary to the device via SSH (port 2222), updates the boot password, and restarts the agent.

With an eSIM card in the SIM slot (tested with a 9eSIM B1), the agent manages its operator profiles itself, as a GSMA SGP.22 eSIM manager built in (its card code is a Rust translation of lpac's library); nothing else needs installing (why not lpac):

• List profiles and card details (EID, firmware, free space).
• Switch the active profile. The agent verifies each step (card → modem identity → mobile data) and reports why a switch didn't complete; it never switches back on its own. Internet returns in about 15–45 s; Wi‑Fi stays on.
• Add a profile from the operator's QR code or activation code, with a preview of the operator and profile name before anything is written, and cancel.
• Rename profiles (nicknames) and delete inactive ones.
• Operator receipts: the card's add, switch and remove notifications are sent to the operator's server one by one, right after the change once data is up, and retried while the router has mobile data.
• Safety:
  • one eSIM operation at a time;
  • checks that it's still the same card before any change;
  • no switching while you have airplane mode on;
  • downloads only with mobile data.
  • operator servers are reached over TLS checked against the GSMA eSIM root certificate that the card trusts.

Switching, adding, renaming and deleting require an agent password. In the apps: Router → eSIM Profiles. For diagnostics on the router, /data/zte-agent esim-native chip info (or profile list) prints one card command's result; it waits for nothing and answers busy while the agent uses the card. API and behaviour: zte-agent/docs/esim.md. An lpac bundle in /data/lpac from earlier versions is no longer used and can be deleted.

1. Connect your phone to the router's WiFi
2. Open OpenU60 app
3. Set agent URL: http://192.168.0.1:9090
4. Enter the agent password you set above

u60-Pro-rs/
├── zte-agent/                 On-device REST API server
│   └── src/
│       ├── main.rs            Entry point (Axum HTTP server)
│       └── routes/            REST endpoint handlers
│
└── mobile/                    Native companion apps
    ├── README.md              Mobile apps documentation
    ├── ios/OpenU60/           SwiftUI app
    │   ├── Core/              Networking, crypto, models
    │   ├── Features/
    │   │   ├── BandLock/      Band locking
    │   │   ├── Call/          Voice calls
    │   │   ├── Clients/       Connected devices
    │   │   ├── Config/        Config backup/restore
    │   │   ├── Dashboard/     Signal cards, WiFi card, status
    │   │   ├── DeviceInfo/    Hardware + firmware info
    │   │   ├── Login/         Auth + keychain
    │   │   ├── RouterSettings/
    │   │   │   ├── APN/       APN profile management
    │   │   │   ├── CellLock/  Cell locking
    │   │   │   ├── Device/    Reboot, USB, battery, charge policy
    │   │   │   ├── DNS/       DNS settings
    │   │   │   ├── Firewall/  Firewall rules
    │   │   │   ├── LAN/       DHCP settings
    │   │   │   ├── MobileNetwork/  Network mode, SA/NSA
    │   │   │   ├── NetworkMode/    Network selection
    │   │   │   ├── QoS/       Traffic shaping
    │   │   │   ├── Schedule/  Scheduled reboot/wifi
    │   │   │   ├── SignalDetect/   Signal quality detection
    │   │   │   ├── SIM/       SIM card PIN/PUK management
    │   │   │   │   └── STK/   SIM Toolkit & USSD
    │   │   │   ├── STC/       Smart Tower Connect
    │   │   │   ├── Telemetry/ Telemetry blocking
    │   │   │   ├── VPN/       VPN settings
    │   │   │   └── WiFi/      WiFi configuration
    │   │   ├── Scheduler/     Scheduled/recurring jobs
    │   │   ├── Settings/      App settings
    │   │   ├── Signal/        Signal monitor
    │   │   ├── SMS/           SMS compose/read/conversations
    │   │   ├── Tools/         Band lock, clients, config, etc.
    │   │   └── USBMode/       USB mode detection/switching
    │   └── Navigation/        5-tab bar (Dashboard, SMS, Tools, Router, Settings)
    └── android/OpenU60/       Jetpack Compose app
        ├── core/              Network, crypto, models, DI
        ├── feature/           bandlock, clients, config, dashboard,
        │                      deviceinfo, login, router, scheduler,
        │                      settings, signal, sms, tools, usb
        └── navigation/        NavHost + bottom bar

├── web/                       Landing page & web dashboard (open-u60-pro.vercel.app)
│   ├── src/
│   │   ├── app/               Next.js app router (page, layout, globals)
│   │   ├── components/        Landing sections, UI primitives
│   │   └── data/              Feature data, API endpoints, device specs
│   └── public/                Static assets (images, icons)

Show the modem's signal on your iPhone Lock Screen and Dynamic Island. The layout adapts to LTE, LTE carrier aggregation (4G+), and 5G, with signal bars, RSRP, SINR, and sample age. Readings describe the modem's cellular connection.

1. Prepare Apple signing. Use your own Apple Developer team, an explicit app bundle ID with Push Notifications enabled, a matching provisioning profile, and an APNs authentication key (AuthKey_<KEY_ID>.p8). Update the app and extension bundle IDs/signing in project.yml. The ActivityKit manager, Live Activity extension, and Live Activities Info.plist flags are included. The current iOS project targets iOS 17 or later.

2. Configure the modem. Copy your .p8 and an edited example configuration to /data/zte-agent-apns/. Set enabled to true, fill in your Team ID, Key ID, containing-app bundle ID, and key path. Match environment to the installed build: sandbox for development, production for TestFlight/App Store. Keep the directory root-owned with mode 700 and both files mode 600.

3. Enable the agent sender. Preserve the existing password and startup settings, add the following environment variable to the agent launch script, and restart only zte-agent to load the configuration:

   export ZTE_AGENT_LIVE_ACTIVITY_CONFIG=/data/zte-agent-apns/live-activity.private.json

4. Start on the iPhone. Install your signed app, connect to the modem, log in, and tap Dashboard → Live signal → Start. Allow Live Activities in iPhone Settings. Lock the phone to see the card, or expand the Dynamic Island on a supported iPhone. Tap Stop in the app to end the session.

The modem sends directly to Apple Push Notification service (APNs); no hosted backend is required. Both the modem and iPhone need internet access for push updates. Keep private keys out of Git and the app bundle; self-hosting developers use their own credentials. See the full setup and API guide for file provisioning, signing, and configuration details.

• The default send interval is 15 seconds, with readings marked stale after 30 seconds. Apple controls delivery, so this is not a guaranteed refresh rate. Sample age should reset when a newly sampled update reaches the phone.
• Sessions last one hour. Currently the agent holds one registration; starting an activity on another phone replaces it. Agent restarts clear that registration; reopen the app to register again, or use Stop/Start if needed.
• SIM removal/ready and WAN events trigger agent recovery. It verifies internet access and UTC before resuming delivery, retaining an unexpired registration.
• Apple accepted an update confirms submission, not phone delivery. During physical testing after a SIM swap, agent sends recovered but the iPhone stayed stale until Wi-Fi was toggled off/on. If this happens, reconnect the iPhone's Wi-Fi and check sample age. Fully automatic phone-side recovery is not yet verified; see the SIM-swap test findings.

This project is licensed under the MIT License, except:

• euicc/ (the eSIM card library linked into zte-agent) is a Rust translation of lpac's libeuicc and stays under the LGPL-2.1-only (euicc/LICENSE).

THIRD_PARTY_NOTICES.md lists everything the zte-agent binary contains and is published with every release.

Disclaimer: This software is provided "as is", without warranty of any kind. Use it at your own risk. The authors are not responsible for any damage to your device, voided warranties, or other consequences arising from the use of this software.

• Not affiliated with ZTE Corporation. This is an independent community project.
• Intended for use on devices you personally own.
• Reverse engineering was performed solely for interoperability and educational purposes.
• Encryption keys and protocol details are sourced from publicly available community research.
• No proprietary source code from ZTE is included in this repository.