Acer Connect Enduro M3 5G WiFi router
I recently got my hands on an Acer Enduro M3 router that I bought for my international trip. It didn't strike me as particulary interesting at first, until I saw navigation buttons on the bottom show up while updating it to a new firmware version. They looked like Android buttons so I thought: well maybe I can leave the custom environment it boots into.
After a few days while I was bored I tried messing around in the menus etc. and leaving the "acer connect" app turned out to be pretty easy. When you go into the settings and find the serial number, just tap that a dozen times to get into some service menu. The notification bar and the navigation buttons are now accesible.
Turns out there's some pretty interesting stuff on there, so I activated ADB developer mode. It runs Android 12 and they used AOSP as base. There's no Google Play services and not even the AOSP messaging app, but there is a phone app and SIM toolkit installed. It seems that this device is called the "Solis 5G" outside of Europe. This trick may work on those devices as well.
The other features include a built-in OpenVPN compatible VPN, and a SIMO-virtual SIM provider. (not to be confused with eSIM, this is basically a built-in vendor locked SIM card, with no option for other providers) More on that later on.
First of all, this router is sturdy, capable and fast, and the battery life is excellent. I have an eSIM-to-SIM adapter inserted with a provider so I don't need a dedicated SIM nor the built-in SIMO-vSIM. Because of the OTG-functionality you can also use it as a power bank, or hook up a computer mouse to it. (it will in fact show you a cursor!) The interface is simple and does not contain any fancy features and the web UI is fairly limited. You cannot set the WLAN channel for example.
After I discovered how to enter the system settings I activated ADB (in the developer settings) and hooked it up to my PC over USB. I then proceeded to push the F-Droid APK and installed the app. I then installed a different launcher, since the "custom UI" turned out to be, in fact, a custom launcher. Setting another launcher as default will also cause the device to start your own launcher on boot instead of the default interface.
This opens up the device to a lot of added features, including installing a web browser (comes in handy if you have a prepaid SIM card and want to check your balance) and configuring some additional settings, like turning off 2G. Or, to 'play' Luanti or Doom, even though the device has a fairly limited built-in screen resolution and size. Or perhaps just a static image of a Bitcoin wallet address so your peers can pay for the shared connection. The possibilities are endless!
However I decided to look around in the preinstalled stuff. One things I noticed while just checking out package names and their activities was the following activity inside the Webserver UI-app ("com.acer.android.m3.webserver"): "de.blinkt.openvpn.LaunchVPN". I recognized this name as it is the same as the application name of the OpenVPN-app that's available on F-Droid. I have yet to investigate this, but if they used components from the GPLv2 licensed OpenVPN for Android project they certainly haven't published the source code on either the Solis or Acer website.
Another interesting thing is an "agent" service that starts by default and connects to an MQTT server to report on your device battery status and connection status. Presumably this is for the included SIMO-service, since going to this website with your devices serial number will show you the battery level and device status, even without an account. Needless to say I'm not using that service anyway, so I disabled the app. This will probably use less battery life if you do not use the built-in virtual SIM card.
I'll update this article as time moves on. For now, if you did figure things out I haven't yet after reading this blog post, please mail them to me to the e-mail address on the bottom of this page.