[R&D] Hacking the Huawei E589 (4G LTE Mobile Router)

E:V:A · Aug 7, 2013

NOTE: This is the same as the Vodafone R210.

Someone handed me a Huawei E589u-12 Mobile 4G LTE WiFi Router, so I thought
I'd have a look at the firmware. However, I was not able to find any firmware
for this device, so I started looking at firmware for similar devices such as
the E5776 and the E392. The only one I found something for, was the E392u-92.
I looked inside and found some undocumented proprietary Huawei/Qualcomm AT
commands. They're listed in the next posts.

So I'm just posting some of my findings here, so don't expect any major events here.

But most importantly: DO NOT ask for device unlocking codes!
(I don't have the new Huawei unlock algorithm and neither the software.)

The devices mentioned above should use the following Qualcomm modems:

Code:

[SIZE=2]E589u-12        MDM9200 (WiFi)
E392u-92        MDM9200 (USB dongle)
E5776u-72       MDM9615 (150 Mbps + voice capability)[/SIZE]

Then after first having installed the device drivers (in Windows), I used the DC-unlocker (Client 1.00.1034) tool.
From that I got the following information:

Code:

[SIZE=2]--------------------------------------------------------
Found modem         : E589u-12
Model               : Huawei E589
IMEI                : 86303001*******
Serial NR.          : P2T7NB929*******
Firmware            : 11.433.13.00.01
Compile date / time : Jun 18 2012 13:27:56
Hardware ver.       : CL1E589M22
Chipset             : Qualcomm MDM9200
NAND Flash          : TC58NYG1S3C
SIM Lock status     : unlocked
Wrong codes entered : 10 (unlock attempts left : 0)
--------------------------------------------------------[/SIZE]

AFAIK the DC-unlocker is just connecting to modem via the AT command interface,
and querying the various info from a set of AT commands (ATC's).

Some additional info:

Code:

[SIZE=2][URL="http://transition.fcc.gov/oet/ea/fccid/"]FCCID[/URL]:          [URL="https://apps.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=285796&fcc_id=QISE589U-512"]QISE589U-512[/URL]
Battery:        Huawei [B]HB5P1H [/B]3.7V, 3000 mAh, Li-Polymer
USB-ID:         [B]12d1:1f01[/B]

Modem:          Qualcomm MDM9200
RF:             Qualcomm RTR8600 
PMIC:           Qualcomm PM8028 
Wifi:           Qualcomm WCN1314
[/SIZE]

So why bother with all this? Perhaps to answer:

Where can we get and download the firmware?
Answer: We can't! We have to extract it...
How can we manually update the FW?
Answer: Get the FW first and I'll show you...
Can we use standard Qualcomm tools like QPST/QXDM with this?
Answer: YES!
What other hidden ATC's are available?
Answer: See Post#2.
What is the new Huawei router unlock algorithm?
Answer: It's secret, so that greedy people can make $$$.

Apparently this device firmware is based on Qualcomm Gobi, and thus we may find some clues in those repositories.
Certainly the Qualcomm MSM Interface (QMI) documents are all available there as well...

If you want to play with this device, you'll need to install the device drivers. The easiest way is probably to install
Huawei's Mobile Partner (Windows) application or to avid bloatware, use only the drivers in Huawei Drivers (4.25.18) .
I have no idea where the hell Huawei keep all their software,
or if there's better way. Perhaps by just extracting application and just use the drivers. Then you should be able to
use any terminal program to connect with. I use RealTerm or Putty, but you can also use the online
Java AT command tester/terminal.

For a complete bunch of useful Windows utilities, see post#12 to download the Huawei Modem HackPack.

E:V:A · Aug 7, 2013

After connecting to the router modem via microUSB connection and a terminal application (Putty or RealTerm) we can issue some standard ATC's. Here are the results.

Huawei/Qualcomm standard AT commands (E589u-12 via "AT+CLAC")

The 3GPP ETSI standard [part 1/2]:

Code:

[SIZE=2]&C
&D
&E
&F
&S
&V
&W

A
D
E
H
I
L
M
O
P
Q
T
V
X
Z

\Q
\S
\V
%V


S0
S2
S3
S4
S5
S6
S7
S8
S9
S10
S11
S30
S103
S104

+CACM
+CAMM
+CAOC
+CBC
+CBST
+CCFC
+CCLK
+CCUG
+CCWA
+CDIP
+CEER
+CEMODE
+CEREG
+CFUN
+CGACT
+CGATT
+CGCLASS
+CGCMOD
+CGCONTRDP
+CGDATA
+CGDCONT
+CGDSCONT
+CGEQMIN
+CGEQNEG
+CGEQOS
+CGEQOSRDP
+CGEQREQ
+CGEREP
+CGMI
+CGMM
+CGMR
+CGPADDR
+CGQMIN
+CGQREQ
+CGREG
+CGSCONTRDP
+CGSMS
+CGSN
+CGTFT
+CGTFTRDP
+CHLD
+CHSN
+CHUP
+CIMI
+CIND
+CLAC
+CLCC
+CLCK
+CLIP
+CLIR
+CMEC
+CMEE
+CMER
+CMGC
+CMGD
+CMGF
+CMGL
+CMGR
+CMGS
+CMGW
+CMMS
+CMOD
+CMSS
+CNMA
+CNMI
+CNUM
+COLP
+COPN
+COPS
+CPAS
+CPBF
+CPBR
+CPBS
+CPBW
+CPIN
+CPLS
+CPMS
+CPOL
+CPUC
+CPWD
+CQI
+CR
+CRC
+CREG
+CRES
+CRLP
+CRSM
+CSAS
+CSCA
+CSCB
+CSCS
+CSDH
+CSIM
+CSMP
+CSMS
+CSQ
+CSSN
+CSTA
+CTFR
+CTZR
+CTZU
+CUSD
+CV120
+CVHU
+DR
+DS
+ES
+ESA
+FAR
+FCL
+FCLASS
+FDD
+FIT
+GCAP
+GCAP
+GMI
+GMM
+GMR
+GSN
+ICCID
+ICF
+IFC
+IPR
+PACSP
+VTS
+WS46
[/SIZE]

The Qualcomm Specific standard AT's [part 2/2]:

Code:

[SIZE=2]*CNTI                   Displays the access technology; refer to GSM 07.07 subclause 9.2 for err value

$BREW                   ??      Start a "Brew MP" serial session (by entering the BrewMP Command Processor)
$CCLK                   ?? sets the clock of the device
$CREG                   ?? gives information about the registration status and access technology of the serving cell.
$CSQ                    

$QCAPNE                 Command is used to edit APN values in APN table.
$QCBANDPREF             Sets the band preferences of the device 
$QCBOOTVER              Returns boot image version
$QCCLR                  Clears mobile error log
$QCCNMI                 Similar to 27.005 +CNMI except for the behavior with $QCCNMI=1,2
$QCDEFPROF              Sets the given profile number as default profile for the family of the specified technology and subscription.   
$QCDGEN                 Generates data over +CGACT activated PDP context
[B]$QCDMG[/B]                  [COLOR=Red]Transitions to Diagnostics Monitor (DM) operation[/COLOR]
$QCDMR                  Sets DM baud rate
$QCDNSP                 Sets primary DNS IP address
$QCDNSS                 Sets secondary DNS IP address
$QCHWREV                Provides MDM1000 chip hardware revision 
$QCMRUC                 Command is used to edit/set MRU database.
$QCMRUE                 Command is used to clear/delete MRU database
$QCPDPCFGE              Sets PDN teardown time interval 
$QCPDPIMSCFGE           Command is used to edit PDP profile registry    
$QCPDPLT                Enables/disables tolerance to long delays in PDP call setup
$QCPDPP                 Sets authentication for PDP-IP packet data calls
$QCPINSTAT?             Sends to the ME the status of all PINs for all cards
[B]$QCPWRDN[/B]                Power Down the UE
$QCSIMAPP               This command is applicable only for DSDS target. User can select Active subscription.   
$QCSIMSTAT              Get/Set SIM status (init completed?)
$QCSLOT                 Sets SIM card on which slot commands will operate
$QCSYSMODE              Get hardware available network modes (e.g. WCDMA + HSDPA + HSUPA)       
$QCTER                  Sets TE-DCE baud rate; baud rates supported are identical to +IPR command
$QCVOLT                 Provides the input voltage level of VMAIN_3.3 as measured by the DUT power management IC
[/SIZE]

Here is a list of Huawei OEM extracted AT commands. They were extracted from
the E392u-12 firmware update (11.836.13.00.209), since I didn't have any
firmware for my own router. Later, I also managed to extract the firmware (via
QPST's Memory Debug Application) for the E589. The result after having spent
considerable time manually checking the availability for most of these, are
shown in the table below. It is very likely that there could be other commands
in our router firmware, not shown here, that I have either missed, or that
remain disabled until certain features are enabled and other criteria
fulfilled. For example, DIAG,FTM,LTE,USSD modes etc.

Unsolicited ATCoP Messages

When connected directly to your modem port via some terminal application,
the ATCoP will occasionally produce informative messages about the status
and changes to network connections etc. These messages are called
"Unsolicited message". In many of the newer Qualcomm based Huawei (OEM)
mobile USB routers/modems, these messages appear prefixed with the
tilde/carrot, "^". But although Huawei uses the carrot for their
proprietary AT commands, these are not actually commands. In newer Huawei
modems, these messages are controlled by the AT^CURC command. Here is a
list of these unsolicited messages and their meanings.

From 909u-512 manual:

Code:

[SIZE=2]^ACTIVEBAND
^ANLEVEL 
^BOOT           [info] During device re/boot-up
^CEND
^CONF 
^CONN 
^CRSSI
^CSNR 
^DATASETRULT
^DATAVALIDITY
^DSDORMANT 
^DSFLOWRPT      [info]  about the current connection statistics during dial-up. (curr_ds_time,tx_rate,rx_rate,curr_tx_flow,curr_rx_flow, qos_tx_rate,qos_rx_rate)
^EARST
^ECCLIST 
^ECLSTAT 
^HCSQ
^HDRRSSI 
^HRSSILVL 
^HWNAT          [info]  Service State Change Indication (GSM,CDMA,LTE etc.)
^IPDATA 
^IPSTATE
^LOCCHD 
^MODE           [info]  System mode change event indication
^NDISEND 
^NDISSTAT 
^NWTIME 
^ORIG 
^OTACMSG 
^POSEND
^POSITION
^RFSWITCH 
^RSSI           [info]  RSSI change indication
^RSSILVL 
^SIMFILEREFRESH 
^SIMST          [info]  USIM card state change indication
^SMMEMFULL      [info]  When message storage is full, this unsolicited indication is sent.
^SRVST          [info]  Service state change indication
^STIN
^THERM
^TIMESETRULT
^WNINV 
^WPDCP 
^WPDDL 
^WPDOP
^XDSTATUS

Maybe in E589:

^THERMST        [info]  ?? Thermal Step Timer 
[/SIZE]

Error/Response Table

To see what ATC work or not, I just marked the various ATC with their allowed options.

Code:

[SIZE=2]Type:
-------------------------
[B]-[/B]  Command Not Supported
[B]!  [/B]Unsolicited message[B]
E[/B]  ERROR
[B]CE[/B] +CME ERROR: 1
[B]/[/B]  [no response] or just "OK"

Allowed options:
[B]1[/B]  Raw:        Used without parameter)
[B]2[/B]  Read:    Read with "?"
[B]3[/B]  Query:    Read write options with "=?"
[/SIZE]

Huawei Proprietary AT commands (Qualcomm Modems)

Code:

[SIZE=2]
^ANQUERY                Query current network parameters (rscp,ecio,rssi,antenna_level,cellid)
^APBATLVL       *1      Battery State/Level (chargerState,batterylvl)
^AUTHDATA       123     
^AUTHVER        2               
^BSN                    ?? Get Backward Sequence Number. The sequence number of the last correctly received MTP frame received.
^BTRSN                  
^CARDLOCK               Unlock SIM network lock. Set: AT^CARDLOCK="<unlockcode>" (Query: state,times,operator) [NV item 50001]
^CARDMODE               Get currently installed SIM/USIM card type. [2]
^CCV            /       ??
^CELLMODE       123     ?? Get current cell mode (0-9)??
^CMDLEN         2       ?? 480 ??
^CPBR                   Get Phonebook entries
^CPBW                   Set Phonebook entries
^CPIN           23      Get?set SIM PIN/PUK management 
^CPNN           E       ??      Calling Party Number? 
^CPWORD         /       [1]
^CQLM           /       
^CRADLE         -       
^CRPN           /E
^CSDFLT                 ?? Circuit Switched Data?  Related to Field Test Mode
^CSVER          2       Get XXXX version number. I.e. "1004"

^CSQLVLEXT                      +CSQ? Level Extension, shows RSSI Level and BER (rssilv,ber)

[B]^CURC[/B]           *23     [COLOR=DarkGreen]Get/Set presentation of unsolicited results (^BOOT, ^RSSI etc.) [0-disable, 1-enable standard set, 2-modes][/COLOR]
^DATACLASS              Get info on supported UMTS protocols
^DATALOCK       
^DHCP           CE      Get interface IPv4 addrs assigned by network DHCP server
^DHCPv6                 Get interface IPv6 addrs assigned by network DHCP server
^DIALMODE               Get/Set dial-up mode (Modem/NDIS)
^DISLOG                 ?? Disable Diagnostics Mode use for ceratin NV items? (NV_FORBID_DIAG) Also see [1]
^DLR                    ??      Current USB? Download Rate (in kbps)
^DNSP                   Get/Set the Primary DNS server address
^DNSS                   Get/Set the Secondary DNS server address
^DSFLOWCLR              Clears the DS traffic to zero, including the DS accumulated connection time
^DSFLOWQRY              Show last DS connection time and traffic
^ECIOCFG                ?? Ec/Io Configuration (related to signal quality)  RSSI [dBm] = RSCP [dBm] - Ec/I0 [dB]
^ENABLESD       *23     Enable/Disable router SD-card slot. (0:disable, 1:enable) [NV_SD_CARD_ENABLE_I]
^FACINFO        /       Get/Set Factory Information 
^FCHAN          /E      [2]
^FDAC           CE      [2]
^FLASH                  Get NAND flash information (chiptype, block statistics etc.)
^FLNA                   [2]
^FPA            CE      [2] Set RF Power Amplifier level 
^FREQLOCK               Enable/disable RF PLL lock to specific ARFCN (By setting NV item "NV_FREQLOCK_I".)
^FRSSI          CE      [2] Get GSM/LTE RSSI values
^FRXON          2       [2] ?? RF Receiver On
^FTXON          2       [2] ?? RF Tranmitter On
^GETPORTMODE    1       ?? Show active port mode: "TYPE:WCDMA:Qualcomm,PCUI:0,DIAG:1"
^GLASTERR       E       Get list of latest firmware errors
^GPIOPL         2       Get/Set PIN on OPL ??? (14 bits?) 
^HS             E       ?? Switching to HS USB mode? (id,protocol,IsOffline,p_class,p_id,s_id)
^HSPA                   Get/Set "recommended" UMTS protocol
^HVER           1       Get PCB? hardware version/name
^HWDUMP         2       
^HWNATQRY               Get NAT of current network
^HWVER                  Get the Hardware Version number (31 characters)
^ICCID          2       Get the SIM card CID
^IMSICHG                [3] Change IMSI
^INFORBU                
^IPV4V6TEST     -
^IPV6CAP        -       Check if IPv6 is supported
^JAPAN                  [1]
^LED            12      
^LEDTEST                Check color combinations of device's LED
^LTECAT         2       Get the device LTE Category
^LTECS          2       ? Get/Set LTE circuit switched (CS) fallback?? See: http://tinyurl.com/l2k3drz http://tinyurl.com/mjemr2u
^LTEPDPTIME             ? [4] 
^LTERSRP        E       [4] Get RSRP and RSRQ for serving cell
^LTESCINFO      E       [4] Get PCI, SINR, MIMO rank and bandwidth for serving cell
^MAXLCKTMS              Get/Set (protected) maximum number of tries to enter wrong NCK [NV item 50005]
^MDATE          E       
^NDISDUP                Get/Set NDIS based dialing (ECM) [Require enabled NDIS port]
^NDISEND                ?? NDIS/WWAN Disconnect report 
^NVMBN          123     
^NVTEST         12      
^OPL                    [3] ?? Get Operator PLMN List
^OPWORD                 [1]
^PHYNUM                 ?? Get/Set (protected) IMEI
^PLATFORM       2
^PNN                    [3] ?? Get PLMN Network Name (PNN) List
^PORTLOCK               Enable/Disable switching PC UI to Diag mode
^PORTSEL        23      Proactive event report port setting for non-data service (Modem,PCUI,...) (0-disable*, 1-enable)
^PREFMODE               Get/Set the preferential network mode
^RDCUST         123     Get/Set various Huawei customization parameters (NV), may need password! (~29 in total)
^RRCVER         23              ?? Get/Set RRC version? [0-4] (Begin to parse "Receiver" messages?) 
^RSCPCFG                Get/Set lower UMTS RSCP thresholds
^RSFR                   ??SF=SIM Filesystem??  Read
^RSFW                   ??SF=SIM Filesystem??  Write
^RSIM           ?       
^RSTRIGGER      *23     ??      Writing to Huawei NV item [NV_HUAWEI_WMS_CONFIG_INFO_I]
^SCPBR                  ?? See +CPBR and ^CPBR  Get Phonebook entries
^SCPBW                  ?? See +CPBW and ^CPBW  Set Phonebook entries
^SD             CE
^SETPID                 [3] Change device's USB PID to generic 1001 (until reboot)
^SETPORT                Set modem port modes: (MODEM,PCUI,DIAG,PCSC,GPS,CDROM,SD, ... etc.)
[B]^SFM                    Set modem to "Factory Mode": AT^SFM=1  (Disconnect and reconnect) [NV_FTM_MODE_I ?? nv number?][/B]
^SIMLOCK        
^SLOTCFG                Get/Set maximum number of allocated data timeslots (GPRS/EDGE)
^SN                     ?? Write Serial Number into factory NV item 114 "Factory Information" [NV_FACTORY_ITEM ???]  
^SPN                    [3] TE Query the Service Provider Name (SPN) file of 2G/3G stored on the SIM/USIM card through the ME.
^SSID                           Wifi ESSID? [NV-item 50290]?
^STGI                   [3]
^STGR                   [3]
^STIN                   [3]
^STSF                   [3] Related to writing NV item [NV_HUAWEI_STK_CFG_I]
^SWDUMP         2       
^SYSCFG         -       (old)   System configuration reference setting  (Mode,Acqorder,Band,Roam,Srvdomain)
^SYSCFGEX       23      (new)   System configuration reference setting  (Acqorder,Band,Roam,Srvdomain,lteBand)
^SYSINFO        1       (old)   Query the current system information  (service state, domain, roaming etc.)
^SYSINFOEX      1       (new)   Query the current system information  (service state, domain, roaming etc.)
^SYSMODE        1       Get current network mode (WCDMA, HDSPA etc) [use ]
^TBAT           *2      ?? Perhaps battery charger mode or Type? (0-normal, 1-, 2-charging)??? [NV-item 90]?
^TCHRENABLE     *3      ?? Is trickle charge enabled ??
[B]^TMODE[/B]                  [COLOR=Red][2] ?? Enter Factory Test (?) Mode (WARNING: Will reboot/reset router)[/COLOR]
^TSELRF         2       ?? Get selected/supported RF modes/bands?
^UIMDELAY       23      ??      (0,1,2)
^USSDMODE               Get/Set the USSD method to process the USSD data.
^VERSION        2       Get External/Internal hardware and firmware version information. 
^WIKEY          *23             [NV-item 50291]?
^WIWEP          *23             [NV-item 50292]?
^YJCX           1       ?? Show some kind of combo of HW features (at least in other modems)
-------------------------------------------------------------------------------
*   New in E589u-12 compared to E392u-12 FW
[1] DoCoMo (Japan) specific OEM and/or "authority" related commands. 
    Affected commands: ^JAPAN, ^OPWORD, ^CPWORD and ^DISLOG ?
[2] Some commands give weird responses, it could be that they're only
    available when modem is set to Factory Test Mode (FTM) or when in 
    Diagnostic Mode (DIAG) ?
[3] Related to SIM Tool Kit (STK) functions.
[4] Certain LTE related commands has to have an active LTE connection 
    in order to work.
-------------------------------------------------------------------------------

[/SIZE]

These are device dependent, so obviously not all of them will work on all devices. There are probably
many others on more advanced routers, which is why we need the firmware.

Here are a few command descriptions/examples:

Code:

[SIZE=2]at^sysinfo                                                                      
^SYSINFO:2,3,1,5,1,,4

at^setport?                                                                     
FF;1,2,3,7,A1,A2

WHERE: 
1:MODEM
2:PCUI
3:DIAG
4:PCSC
5:GPS
6:GPS CONTROL
7:NDIS
A:BLUE TOOTH
B:FINGER PRINT
D:MMS
E:PC VOICE
A1:CDROM
A2:SD

at^getportmode                                                                  
^GETPORTMODE:TYPE:WCDMA:Qualcomm,PCUI:0,DIAG:1

at^portsel?
^PORTSEL:0

at^portsel=?
^PORTSEL:(0-1)

at^rdcust=?
(0: 0) (1: 0) (2: 1) (3: 0) (4: 0) (5: 0) (6: 0) (7: 0) (8: 0) (9: 0) (10: 0) (1
1: 0) (12: 1) (13: 0) (14: 0) (15: 0) (16: 0) (17: 0) (18: 0) (19: 0) (20: 0) (2
1: 0) (22: 0) (23: 1) (25: 0 0) (26: 0) (27: 0) (28: 1 1) (29: 0)

at^cardmode                                                                     
^CARDMODE: 2

at^hver                                                                         
^HVER:"CL1E589M22"
[/SIZE]

For more info on the at^syscfgex command, please have a look at the Russian forum post HERE.

References:

[1] HUAWEI UMTS Datacard Modem AT Command Interface Specification_V2.3.pdf
[2] HUAWEI CDMA Datacard Modem AT Command Interface Specification (2008)
[3] AT Command Interface Specification (2010) [MG323 GSM]
[4] Comprehensive AT Command Set in AMSS Software [80-VR432-1 C]
[5] ME909u-521Application-Guide.pdf
[6] ME909u-521-AT-Command-Specification.pdf

E:V:A · Aug 7, 2013

The OLD Huawei unlock algorithm

For reference I post a Python script using the OLD method for obtaining the
NCK and Flash unlock codes. The original source for this was found in THIS
thread at GSM-forum. However, all recent Huawei routers use a NEW method, which
has already been compromised but is strongly held secret by a bunch of
greedy hackers. Fortunately my router was already unlocked. But it would
still be interesting for the common good to understand how this works.

The general outline of the OLD method can be summarized as follows:

Generate your constants ("salt") from "hwe620datacard" and "e630upgrade",
using MD5 and discarding first 8, last 8 bytes of the result.
Concat IMEI + the constant for unlock or flash code
Apply MD5 to this string
Apply XOR operations to get 4 special bytes
Apply AND, OR operations to byte 3 (most significant byte)
Convert result to decimal <code>
Unlock modem/router with AT command: at^cardlock=<code>

Then you'll have:

Code:

[SIZE=2]SaltText        MD5(SaltText)                           Salt
------------------------------------------------------------------------
hwe620datacard  a32fe72c 5e8dd316726b0335 d5513ba0      5e8dd316726b0335
e630upgrade     aa91cee2 97b7bc6be525ab44 cdc63be0      97b7bc6be525ab44
------------------------------------------------------------------------
==>
#salt = "5e8dd316726b0335"      # sim:          hwe620datacard
#salt = "97b7bc6be525ab44"      # flash:        e630upgrade[/SIZE]

Here the two salts obtained are used for the Sim unlock (NCK) and Flash
unlock, respectively. As you can see, this was valid for the very old
Huawei E620 data-card, but used on many other devices since.

The OLD Python script:

Code:

[SIZE=2]#!/usr/bin/python
import os, sys, re, StringIO
import hashlib

def getCode(imei, salt):
        digest = hashlib.md5((imei+salt).lower()).digest()
        code = 0
        for i in range(0,4):
                code += (ord(digest[i])^ord(digest[4+i])^ord(digest[8+i])^ord(digest[12+i])) << (3-i)*8
        code &= 0x1ffffff
        code |= 0x2000000
        return code

salt = "5e8dd316726b0335"
imei = "863030010760596"

print getCode(imei, salt)[/SIZE]

The NEW Huawei unlock algorithm

As for the the new method of obtaining these constants I have no idea,
but many people do seem to know. However, if you like to find out for
yourself, you have to reverse engineer the at^cardlock command in the
modem firmware.

But from THIS post (and the ones following) on GSM-forum, you will find
out that the new "algorithm", really consists of 7 separate sub-routines using
slightly different algorithms/methods depending on the IMEI. At least one of
these use the new constant "hwideadatacard"...

The algorithm selection code look like this in PHP:

Code:

[SIZE=2]function HW_ALGO_V2_SELECTOR($imei){
        $id = "";
        for ($i = 0; $i<15; $i++) {
          $id = $id + (ord($imei[$i]) +($i+1))*($i+1);
        }  
    return ($id % 7);
} [/SIZE]

If you do decide to dig in to this problem statement, here are a couple
of publicly available IMEI and unlock combinations, you can use to test
with, for the E589u-12.

Code:

[SIZE=2]IMEI                    Unlock
--------------------------------
863030010760596         26561436 
863030010201062         24290098
863030010953233         52096763
863030011597427         56285257
[/SIZE]

E:V:A · Aug 7, 2013

Opening the E589

The E589 tear apart or tear down!

So, since I could not find any information anywhere, on how to tear this baby
open, I had to do essentially that. I though the the FCC internal and external
photos would have helped me out, but with my inexperience, I did not recognize
the signs of the attachment mechanics. This made me break two plastic pryer
tools and almost the back cover itself, until I found that magic screw!

The screw is hidden under the SD card slot and under a cover of white paint,
which is why I missed it, since I thought it was the SD card eject button!
This is a normal Phillips head screw (PH00), and once you get it out, you
should be able to slide the cover off easily. Here's a picture showing the SD
card slot with the screw and the direction of the cover slide-off movement.
This movement is downwards from the back side/label point of view.

Then the battery seem attached somehow, first with a plastic flap and then most
likely with some glue/sticky tape... It seem very hard to detach, so I gave
up at this point, in fear of braking something that I need and that is not
already broken. (I don't wanna ruin the battery.) Here's a picture of that.

Now you should be able to remove the whole battery and then the battery connector.
The battery is glued to the back plate which also works as a heat sink for the underlying
components, so you have to be very careful not to pull too hard on the battery or you
risk also pulling some components from the PCB. Use some kind of tool to carefully pry the
battery lose, one side at the time.

Secrets under the battery

Thanks to chup in THIS post at MobilaBredband, we find some more secrets
behind the battery.

The first thing that sticks out, is the 5-pad slot. If it's a serial connection,
we only need 3 pads; Rx/Tx/GND. Indeed the square pad is connected
to GND. So what are the other options?

It could be either one of:
1) a set of minimal JTAG terminals according to SW-DP specifications for IEEE P1149.7.
2) a way to shorten something out, like an MDM9200 XO BOOT device option pin.
3) a second set of UART serial connection. We know MDM9200's have more than one...
4) a battery replacement port during assembly, service or factory testing.

Here we can also see the various internal antennas. There are three (3)
strip-line antennas integrated into the plastic parts on the top and the
bottom of the router PCB. Two in the top parts and one in the bottom. On the
top-left of the front/screen side of the PCB, is the connector to what Huawei
call the "Wifi Antenna". Then on the top-left, of the backside of the PCB, we
find what Huawei call the "Diversity Antenna" connectors, while on the
bottom-right, we find the "Main Antenna" connectors. Basically:

Code:

TOP-F   "WiFi Antenna"          Wifi (~2400 GHz)
TOP-B   "Diversity Antenna"     <GPS/unknown>
BOT     "Main Antenna"          Mobile RF (GSM/LTE etc.)

Here we continue to notice that:

The external antenna jack is connected to the mobile "Main Antenna".
The left-hand-side internal RF jack is connected to the "Diversity Antenna".
The right-hand-side internal RF jack may be connected to the "Wifi Antenna",
on the back, or something else...

According to Google, a "Diversity Antenna" is part of an intelligent
multi-antenna system that senses the incoming signals to automatically
select the antenna best positioned to receive it...
A more clear description can be found HERE.

Now, let's wildly speculate about this design. Many phones have their main
antennas in the bottom. Check! Then, since this device was meant to be carried
in the pocket, which mostly means back-pocket, with the screen towards your
body, because of shape. The Wifi signal need to go through your body, and thus
antenna should be on the screen side. Check! Then if you're to recive any
external/GPS signal at all, you'd like the antenna to be pointed on the
outside, which means on the backside of the PCB. Check!

All-in-all, we have 6 antenna connectors!

Beyond the event horizon

Next, you have 4 Torx (T5?) screws around the corners and 2 more behind the
battery, to undo. Then you can gently push into the holes, and the front
screen will hopefully come out (?) and should not have any other attached
connections.

I leave the rest up to you (or to me for a much later date), to fill in the
remaining blanks and post some internal pictures...

In the meantime, you can look at these internal pictures, that I obtained
from the FCC website and searching for FCCID: QIS E589U-512.

Front Side PCB.

As you can see on the front side we the following:

- 2-7 test points
- Chips:

(1) Toshiba TC58NYG1S3C NAND flash chip
(2) Qualcomm
(3)

Back Side PCB.

Here you can see:

- 2 internal RF connectors
- a 4G external RF antenna connector (See one HERE.)
- JTAG pads in typical Huawei layout of 10 pads in line (See HERE)
- Possible UART/Serial islands (5 pads)

< More Dragons TBA >

E:V:A · Aug 13, 2013

The NAND Memory

Is a Toshiba TC58NYG1S3C, and according to THIS document, we can decode the Toshiba product code to find:

Code:

[SIZE=2]TC58NYG1S3C

TC58 NY G1 S 3 C
   | ||  | | | +--  70 nm
   | ||  | | +----  2 KB page size, 128 KB block size.
   | ||  | +------- 2 Level cells
   | ||  +--------- 2 Gbit = [B]256 MB[/B]
   | |+------------ 1.8 V
   | +------------- NAND
   +--------------- Single Chip
[/SIZE]

But the only datasheet I could find HERE, is for the slightly different
TC58NYG1S3 EBAI4 which should be just fine.

The NAND pin assignments

E:V:A · Aug 19, 2013

Built-in GPS capability!

It all started when I noticed that my router showed "GPS" as part of the interface ports that can be enumerated. Surely enough after playing with the at^setport command, my PC enumerated a "HUAWEI Mobile Connect - 3G GPS Interface" serial interface. However, I did not see anything on this, but then again I'm not sure how to use it properly either. So...

After having looked at my router using QXDM, I noticed there were GPS messages in the info logs. Later Googling around and a brief chat with vve (from gsm-forum), confirms that indeed the MDM9200 has a built-in gpsOne Generation 8 engine. I then found some Qualcomm documents that clearly states that the components (SAW filters etc.) needed for full GPS + GLONASS functionality are "strongly recommended", even if not used/enabled. Here is a picture of that.

In addition, there are (apparently from the bad FCC photo above) 2 internal antenna connectors on the PCB,
that could be related, in addition to the external connector.

However, all this info is little worth without ripping apart my router to see what's actually present inside.
So unless someone else has something to say about this, you'll just have to be patient...

Later, we will see which GPS-related NV-items are set in firmware, if any.
Thanks to autoprime's exhaustive list of NV-items, we can easily find those
only related to the GPS subsystem, HERE.

< more TBA >

E:V:A · Aug 19, 2013

Huawei firmware numbering system / description

How does Huawei classify their firmware versions/revisions?
Well, let's have a look at my own example. My firmware is:

11.433.13.00.01

We that that it consists of 5 sets of numbers. These can be described as:

Code:

[SIZE=2]
"[B]11[/B]"    - is for [I]Qualcomm [/I]based devices ([B]23[/B] for [I]HiSilicon[/I])
"[B]433[/B]"   - is the firmware [I]Build [/I]version: 
          Same HW platforms generally use the same builds. For example:
          All MDM9200-based modules: E392u, E397u, E398u, EM920u, EM930u etc. 
"[B]13[/B]"    - is the [I]Debug[/I][/SIZE][SIZE=2][SIZE=2] version and prefixed by "D"[/SIZE] in FW updates. 
"[B]00[/B]"    - probably [I]Service Pack[/I] version and prefixed by "SP" in FW updates. 
"[B]01[/B]"    - Network Operator / [I]Carrier[/I] Customization. ("00" = No customization.)
[/SIZE]

[Many thanks to VVE (from GSM-Forum) for this info.]

Similarly for firmware updates. For example:

Code:

[SIZE=2]HUAWEI_E589u-12_[B][COLOR=Red]V[/COLOR][/B]100[COLOR=Red][B]R[/B][/COLOR]001[B][COLOR=Red]B[/COLOR][/B]433[B][COLOR=Red]D[/COLOR][/B]15[B][COLOR=Red]SP[/COLOR][/B]02[B][COLOR=Red]C[/COLOR][/B]260_Finland (Elisa)_05021CTE.zip

Just add "Version" after each:

V  = Version
R  = Release
B  = Build
D  = Debug 
SP = Service Pack 
C  = Customization [/SIZE]

Huawei Carrier Customization Codes

The firmware distributed by Huawei for use on their 3G/4G mobile wifi routers
(MiFi) and dongles, are usually customized by each of the mobile service
provider that sell them. Here we attempt to list all the customization codes
used by Huawei, so that we can better understand the many variations that are
purely firmware dependent versus hardware dependent.

According to belief, a customization code of "00" refer to no-customization,
in other words it should be original "vanilla" Huawei firmware.

So far we have:

Code:

[SIZE=2]code    Provider        Country
--------------------------------------
00/000  <na>            <na>

01      Netcom          Norway
07      Telia           Sweden
08      MTN             SA
16      KPN             Holland
18      TME             Spain
24      H3G             Sweden
26      H3G             Denmark
43      Etisalat        UAE
55      DT              Germany
56      Tele2           Sweden
58      Optimus         Portugal
61      Cosmote         Greece
69      Polkomtel       Poland
74      Optus           Australia
77      Telenor         Hungary
78      T-Mobile        Hungary
84      TMN             Portugal
87      Mobitel         Slovenia
99      Maxis           Malaysia
110     Entel           Chile
115     Nawras          Oman
132     Utel            Ukraine
136     Nova            Island
141     Batelco         Bahrain
143     MTS             Russia
149     Vivo            Brazil
151     Channel??       India
157     PCCW            HK
158     Globe           Philippines
161     Beeline         Russia
174     Kyivstar        Ukraine
180     Orange          Spain
186     Zain            Kuwait
192     TIM             Italy
203     M1              Singapore
209     MegaFon         Russia
222     MTS             Ukraine
228     Personal        Argentina
238     Smart           Philippines
253     Personal        Paraguay
260     Elisa           Finland
272     Mobinil         Egypt
284     Airtel          India
309     Bytel           France
349     Telia           Denmark
362     MoldCell        Moldova
388     Life            Ukraine
391     Tele2           Russia
397     KTC             Kuwait
400     OM*             UK
409     Mobistar        Belgium
422     Telenor         Sweden
436     Omantel         Oman
464     Telus           Canada
479     Bytel           France
570     UNE             Colombia
577     Beeline         Kazakhstan
618     Polsat          Poland
622     "SFR"           ??
626     Orange          Uganda
632     STC             Bahrain
634     MTS             Uzbekistan
673     Altel           Kazakhstan
697     MTN             SA
778     OM*             Russia
801     A1TA            Austria
838     Global          Saudi Arabia
883     Beeline         Uzbekistan
991     MTC(Zain)       Lebanon
1020    iinet           Australia
1047    Orange          France
1049    Eastlink        Canada
1050    USCC ??         US
1055    EE              UK
1062    Orange          France
1064    OM*             Norway
1099    OM*             US
1102    20/20 ??        Sweden
1129    A&C             Belgium
1134    OM*             "Baltic Region"
1158    Spectranet      Nigeria
--------------------------------------
OM* = "Open Market" and possibly without customization
UAE = United Arab Emirates
UK = United Kingdom
US = United States
HK = Hong Kong
SA = South Afrika
--------------------------------------
[/SIZE][SIZE=2]
[/SIZE]

E:V:A · Aug 24, 2013

AT^RDCUST: Analysis & Research

Most Qualcomm based 3G/4G Huawei devices have this special proprietary command that you will not find documented anywhere! So I decided to take the first steps in that direction. The typical output from that command look like this:

Code:

[SIZE=2]at^rdcust=?
 (0: 0)  (1: 0)  (2: 0)  (3: 0)  (4: 0)     (5: 0)  (6: 0)  (7: 0)   (8: 0)    (9: 0) 
(10: 0) (11: 0) ([B]12: 1[/B]) (13: 0) (14: 0)    (15: 0) (16: 0) (17: 0)  (18: 0)   (19: 0) 
(20: 0) (21: 0) (22: 0) ([B]23: 1[/B]) [B]---?---[/B]  ([COLOR=Red]25: 0 0[/COLOR]) (26: 0) (27: 0)  ([COLOR=Red]28: 1 1[/COLOR]) (29: 0)
[/SIZE]

We see that items 25 and 28 are special as they return two numbers, while item
24 is missing altogether. So far we understand that rdcust consists of a
table of ID's (probably the ones above). Some of these items in the table has
an NV-item associated.

So from poking around in the firmware, I composed the following table.

Code:

[SIZE=2]-------------------------------------------------------------------------------------------------------
Item    Function (allow/change/forbid)          Source                                  NV-item/Comment
-------------------------------------------------------------------------------------------------------
0       Replace Firmware Version                rdcust_version_replace.c                "00.000.00.00.00"
1       ?Forbid 2G registration                 rdcust_efust_disable.c
2       Forbid AT^CURC type/port                rdcust_forbid_curc.c
3       Change Mean TPT Size                    rdcust_mean_tpt_size.c                  "Token Passing Tree"? (Ad-Hoc Wifi)
4       Change MTU size                         rdcust_mtu_size.c
5       Replace Product ID (PID)                rdcust_product_id_replace.c
6       Change APN values                       rdcust_apn_set.c
7       Disable Video Calls                     rdcust_disable_video_call.c
8       Change USSD Mode                        rdcust_ussd_mode.c
9       Change? Full Frequency Scan             rdcust_full_freq_scan.c
10      ?       LED Light                       rdcust_led_light_cust.c
11      Exclusive Cardlock                      rdcust_exclusive_cardlock.c             nv_huawei_specail_simlock_ind NV
[B]12      Huawei Special SIM lock [/B]                rdcust_egy_cardlock.c
13      Permanent Cardlock                      rdcust_permanent_cardlock.c
14      Class-0 SMS Route                       rdcust_class0_sms_route.c               calss0_sms_route NV
15      Roaming HPLMN (count?)                  rdcust_not_roam_plmn.c
16      Diasble RPLMN (PME?)                    rdcust_disable_rplmn_act.c              RDCUST_DISABLE_RPLMN_ACT
17      Change GPRS Recent Activity Timer       rdcust_gprs_recent_activity_timer.c
18      Change Default Traffic Class            rdcust_default_traffic_class.c
19      Change STK                              rdcust_stk.c
20      Huawei Manual 3G? band Search Order     rdcust_manual_srch_order_3.c            NV_HUAWEI_MANUAL_BAND_SRCH_ORDER_I
21      Current ^SYSCFGEX Mode List             rdcust_syscfgex_mode_list.c             nv_syscfgex_mode_list NV
22      Get/Set Attach PDP Parameters           rdcust_attach_pdp.c                     ..Inactivity timer, and also EFS related..
[B]23      Disable F-DPCH (WCDMA)[/B]                  rdcust_disable_fdpch.c                  NV-item?
[COLOR=Purple]24      Huawei IPV4 and IPV6 Configuration[/COLOR]      rdcust_ipv4v6_cfg.c             
[COLOR=Red]25*     ?       Modified UI Network PLMN[/COLOR]        rdcust_uinetwk_plmn_modified.c
26      [1] GID1 Customer Forbid Band           rdcust_forbid_band.c                    NV_HUAWEI_CUST_FORBID_BAND_I
27      [1] Start Telus GID1 check              rdcust_gid1.c                           NV_HUAWEI_GID1_I
[COLOR=Red]28*     Set HS-DSCH Physical Layer Category [/COLOR]    rdcust_set_hsdsch_phy_layer_cat_ext.c   
29      [1] Set GID1 LTE Band Preference        rdcust_lte_band_pref.c
-------------------------------------------------------------------------------
*   Returns 2 digits in E589u-12. 
[1] GID1 = "Group Identifier Level 1" and is a type of SIM network 
    lockout mechanism. The GID1 elementary files on the SIM are 
    specified in GSM 11.11 (ETS 300 977)
[/SIZE]

Now, the item numbering was completely arbitrary, based on the order of appearance in the firmware. But closer inspection seem to confirm that this is not at all very arbitrary, as the colored items actually seem to confirm what fits the behavior of my device. How so? I don't have IPV4/6 (#24) configured, nor using WCDMA (#23). But hey, I could also be completely wrong here!

It would certainly be interesting to see what exactly items #11 and #12 does, as they're called "Exclusive Cardlock" and "Huawei Special SIM lock", respectively. Could one of these be part of the mysterious QXDM 16-digit password, that can be used to further unlock access to certain EFS files and NV-items?

...

< More TBA >

psytr0nic · Aug 24, 2013

I like your courage and passion in each your post ! anytime fully documented ..

E:V:A · Aug 25, 2013

The Battery

The internal battery is labelled "HB5P1H" and is a 3.7V, 3000mAh (11.1 Wh)
Li-Polymer battery. The battery has 5 lead ribbon connector. Which seem to
indicate that it has an internal programmable charge controller aka "gas gauge".

A typical internal battery design can be seen in THIS (bq27x00) TI datasheet.

So as an initial guess (until tested), the pins on the battery connector
could have the following functions.

Code:

[SIZE=2]pin     color   signal  function
----------------------------------------------
1       red     PACK +  Battery Positive
2       red     SCL     I2C Serial Clock Input
3       white   GND     ground
4       black   SDA     I2C Serial Data Input   
5       black   PACK -  Battery Minus
[/SIZE]

These type of batteries generally have 5 internal power "modes".

Code:

[SIZE=2]Active                  During normal ON operation 
Sleep                   Low power mode
Ship                    Low power mode for shipping
Hibernate               Used when Vcc drops below Vpor 
Data Retention (RBI)    ??
[/SIZE]

A few battery related ATC's...

Code:

[SIZE=2]at^apbatlvl             (chargerState,batterylvl)
^APBATLVL:1,4           ==> STATE: 1, LEVEL=4

at^tbat?               
^TBAT:2               

at^tchrenable=?         
^TCHRENABLE:0           

at+cbc
+CBC: 0,100

[/SIZE]

< more TBA >

E:V:A · Sep 25, 2013

Table of Contents (ToC)

Table of Contents (ToC)

The next steps in looking under the hood of this device, have been rather heavy.
The collection of relevant software, information and analysis of all that above and
below, have been extremely time consuming and suprisingly hard to organize in
a pedagogical and useful manner. Here is a short and partial summary of what
is to come.

The Huawei Modem HackPack

Huawei, Windows Drivers & COM ports...

SD-card sharing: Huawei FAILURE!

Backing the Router Settings

Backing the Router Firmware
- Qualcomm NV-items
- Qualcomm EFS2 (internal file system)
- Huawei/Qualcomm Firmware (internal partitions)

Extracting the router firmware
a) From Huawei firmware update
b) From raw NAND dump
c) From T32 JTAG debugger
d) From 3rd party raw JTAG ram dump

The Web User Interface (Web UI)

The Huawei Mobile Partner Software

PLEASE HOLD ANY COMMENTS UNTIL COMPLETE!
(and this message removed)

E:V:A · Sep 25, 2013

Huawei Modem HackPack

Version: 0.1
Last Update: 2013-09-26

Here is a collection of some very useful windows tools when dealing with any
Qualcomm-based devices, such as our Huawei.

This HackPack is to be considered a one-time only, as-is download. That means:

I will not maintain it.
I will not update it.
I will not answer any questions about it.
I will not be held responsible if any of the tools mess up your system, wife or life.
I will not keep a copy on my PC for you to send me PM's asking for it.
In fact I will probably not even maintain the download link below, in case it dies.

If I decide otherwise, you will find this post updated.

Download ==> HERE <==

=======================================
All utilities are for 32-bit Windows!
And that's YOUR problem, if any.
=======================================

Package Contents:

Code:

[SIZE=2]3rd party Qualcomm Tools:
        CDMA Workshop           [3.9.0]         [URL="http://www.cdma-ware.com/workshop.html"]HERE[/URL]
        DFS CDMA Tool           [13.9.19.0]     [URL="http://cdmatool.com/download"]HERE[/URL]
        RevSkills / PSAS        [2.08.6]        [URL="http://revskills.de/downloads/revskills.zip"]HERE[/URL]   EOL 2013-03-01: [URL="http://tinyurl.com/phpkbca"]HERE[/URL]
        MDMA                    [1.1.0.1]       [URL="http://www.nerve.org.za/mdma/index.html"]HERE[/URL]   Forum: [URL="http://tinyurl.com/peq9635"]HERE[/URL]
        RadioComm               [11.12.2]       [URL="http://tinyurl.com/pqgg3v3"]HERE[/URL]   Download: [URL="http://tinyurl.com/p43a5gp"]HERE[/URL]

3rd party Huawei Tools:
        DC-Unlocker Client      [1.00.1045]     [URL="https://www.dc-unlocker.com/downloads"]HERE[/URL]
        Huawei Flasher          [1.6]           [URL="http://www.francesco-pompili.it/"]HERE[/URL]   Download: [URL="http://tinyurl.com/k4z3blr"]HERE[/URL]
        Huawei Drivers          [[COLOR=Red]4.25.18[/COLOR]]       [URL="http://vve.su/vvesu/files/misc/MP/Huawei_Driver_4.25.18.zip"]HERE[/URL]

Windows Utilities (various):
        UsbTreeView             [2.1.8]         [URL="http://www.uwe-sieber.de/usbtreeview_e.html"]HERE[/URL]
        SerialMon               [?]             [URL="http://www.serialmon.com/"]HERE[/URL]
        SPCA                    [1.1.1]         [URL="http://www.yo3ggx.ro/spca/spca.html"]HERE[/URL]   Serial Port Communication Analyzer
        vspd                    [7.1.289]       [URL="http://www.eltima.com/products/vspdxp/"]HERE[/URL]   Virtual Serial Port Driver
        com0com                 [3.0.0.0]       [URL="http://sourceforge.net/projects/com0com/"]HERE[/URL]   Null-modem emulator
        ReAssignCOMPortNumb.exe [1.0.0.0]       [URL="http://www.ftdichip.com/Support/Utilities/Reassign%20COMNo%20Utility.zip"]HERE[/URL]

Windows Utilities (Nirsoft):
        USBDeview               [2.27]          [URL="http://www.nirsoft.net/utils/usb_devices_view.html"]HERE[/URL]
        DevManView              [1.35]          [URL="http://www.nirsoft.net/utils/device_manager_view.html"]HERE[/URL]
        DriverView              [1.45]          [URL="http://www.nirsoft.net/utils/driverview.html"]HERE[/URL]
        DeviceIOView            [1.02]          [URL="http://www.nirsoft.net/utils/device_io_view.html"]HERE[/URL]
        RegFromApp              [1.30]          [URL="http://www.nirsoft.net/utils/reg_file_from_application.html"]HERE[/URL]
        RegScanner              [2.01]          [URL="http://www.nirsoft.net/utils/regscanner.html"]HERE[/URL]

Data:
        nv_complete.zip         [2013-06-07]    [URL="http://xdaforums.com/showthread.php?t=1954029"]HERE[/URL]
[/SIZE]

Additional Links:

Code:

QPST            [2.7.402]       Download [URL="http://tinyurl.com/oggkkz6"]HERE[/URL]
QXDM-winxp      [3.12.714]      Download [URL="http://tinyurl.com/nkvv636"]HERE[/URL]
USBlyzer        [2.0]           Download [URL="http://www.usblyzer.com/files/USBlyzer.zip"]HERE[/URL]
Putty           [beta 0.63]     Download [URL="http://www.chiark.greenend.org.uk/~sgtatham/putty/"]HERE[/URL]
RealTerm        [2.0.0.70]      Download [URL="http://sourceforge.net/projects/realterm/"]HERE[/URL]

Huawei Mobile Partner[COLOR=Red]**[/COLOR] [23.009.05.03.1014]  Download [URL="http://www.huaweidevice.com/mpartner"]HERE[/URL]

** NOTE:
This version is using the older (4.25.10.00) Huawei drivers.
So if you want to use this, install this first, and then the new driver package.
There is an update on that link, but it is not clear what it does.

E:V:A · Sep 26, 2013

Huawei, Windows Drivers & COM ports...

First Connections

Connecting your E589 to a windows box, for the first time, will enumerate a couple of (possibly old default windows) drivers. This of course depends on what you have installed and used before. As I have never used any Huawei device before, all I got was something like this. "Something", because I don't remember exactly what was there, since I tried to use the DC-Unlocker Client to get some device info.

Initially the only thing I could see in the windows Device Manager was this:

Code:

[SIZE=2]DeviceType                      VID:PID         Description
-------------------------------------------------------------------
USB Mass Storage Device         12d1:1f01       Router SD card slot
[/SIZE]

However, when using DC-Unlocker Client to find the modem, it seem to find and/or install its own drivers and ended up enlist the following, as shown
in Device Manager under "Ports (COM/LPT)" as:

Code:

[SIZE=2]Device Name                     VID:PID         SYS             INF             Ver             Date
---------------------------------------------------------------------------------------------------------
FC - Application Interface      12d1:1442       FcSerial.sys    oem214.inf      2.0.6.705       1/17/2012
FC - PC UI Interface            12d1:1442       FcSerial.sys    oem214.inf      2.0.6.705       1/17/2012
G:\                                                             wpdfs.inf       6.0.6002.18112  6/21/2006
Huawei SD Storage?              12d1:1f01       disk.sys        wpdfs.inf       6.0.6002.18005  6/21/2006
[/SIZE]

This is much better, but not at all satisfying. So I proceeded to install the proper Huawei Device Drivers (see HackPack). After rebooting machine (and/or selecting the drivers when asked), I got these:

Code:

[SIZE=2]Device Name                                             VID:PID         INF             InfSec                  Ver             Date
-----------------------------------------------------------------------------------------------------------------------------------------
HUAWEI Mobile Connect - 3G Modem                        12d1:1001       oem204.inf      Modem0.NT               2.0.6.720       3/19/2013
HUAWEI Mobile Connect - 3G Application Interface        12d1:1001       oem203.inf      QportInstall00.NT       2.0.6.720       3/19/2013
HUAWEI Mobile Connect - 3G PC UI Interface              12d1:1001       oem203.inf      QportInstall01.NT       2.0.6.720       3/19/2013
[/SIZE]

What happened to my SD card and storage device!? Nobody knows, but enabling the hidden view in Device Manager, eventually helped... Doing some studying of the Huawei AT command set led me to connecting to the modem via terminal (Putty) and issue the following AT commands:

Code:

at^sfm=1
at^setport="FF;1,2,3,A2"

Disconnect, and reboot router, and reconnect. BAM! There they are:

Code:

[SIZE=2]Device Name                                     Drive   VID:PID         SYS             INF             InfSec                  Ver             Date
-----------------------------------------------------------------------------------------------------------------------------------------
HUAWEI Mobile Connect - 3G Modem                        12d1:1413       modem.sys       oem204.inf      Modem0.NT               2.0.6.720       3/19/2013       USB\VID_12D1&PID_1413& MI_00 \6&39cbb52c&0& 0000
HUAWEI Mobile Connect - 3G Network Card                 12d1:1413       ewusbnet.sys    oem205.inf      qcwwan.ndi              1.0.4.017       2/17/2013       USB\VID_12D1&PID_1413& MI_01 \6&39cbb52c&0& 0001
HUAWEI Mobile Connect - 3G Application Interface        12d1:1413       ewusbmdm.sys    oem203.inf      QportInstall00.NT       2.0.6.720       3/19/2013       USB\VID_12D1&PID_1413& MI_02 \6&39cbb52c&0& 0002
HUAWEI Mobile Connect - 3G PC UI Interface              12d1:1413       ewusbmdm.sys    oem203.inf      QportInstall01.NT       2.0.6.720       3/19/2013       USB\VID_12D1&PID_1413& MI_03 \6&39cbb52c&0& 0003
HUAWEI Mobile Connect - 3G GPS Interface                12d1:1413       ewusbmdm.sys    oem203.inf      QportInstall01.NT       2.0.6.720       3/19/2013       USB\VID_12D1&PID_1413& MI_04 \6&39cbb52c&0& 0004
HUAWEI Mass Storage USB Device                  G:      12d1:1413       USBSTOR.SYS                                             6.0.6002.18005                  USB\VID_12D1&PID_1413& MI_05\6 &39cbb52c&0& 0005
HUAWEI SD Storage USB Device                    H:      12d1:1413       USBSTOR.SYS                                             6.0.6002.18005                  USB\VID_12D1&PID_1413& MI_06\6 &39cbb52c&0& 0006
[/SIZE]

9 new drivers and they smell fresh! The info above was obtained by playing around with the USBDeview (from HackPack). Very useful when you have USB driver issues. We can also list the available ports by issuing the following AT command:

Code:

[SIZE=2]at^getportmode
^GETPORTMODE:TYPE:WCDMA:Qualcomm,MDM:0,NDIS:1,DIAG:2,PCUI:3,GPS:4,CDROM:5,SD:6
[/SIZE]

Tracking Down Windows Driver Issues

The best way to resolve windows device/driver issues is to first being able to see what drivers are already installed and available. Problem is that windows defaults to hiding drivers not used. We will need to remedy this. in order to remove faulty drivers.

There are 3 ways to list hidden devices in device manager.

(a) Set a permanent environment variable.
(b) Use a temporary environment variable in a command shell and
open Device Manager from within that shell.
(c) Make a simple permanent change to your registry.

The best way (from HERE) is (c) :

Open Registry Editor.
In Registry Editor, navigate to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
Create the following value (DWORD):
devmgr_show_nonpresent_devices
Change it's value to 1. Close Regedit.
Kill and restart Windows Explorer or just reboot.

But if you want to try this first, use (b):

Open a command window.
Type "set DEVMGR_SHOW_NONPRESENT_DEVICES=1" without the quotes at the command line then press enter.
Type "devmgmt.msc" without the quotes at the command line then press enter.
Under the "View" menu click on "Show hidden devices".
Navigate to "Ports (COM & LPT)" and there should be many more devices listed and can be removed with a simple right click uninstall.

Some of the Nirsoft tools in the HackPack can do some of this automatically...

You'll be surprised how much driver junk you will find in your machine after only a year...

Too Many COM Ports

It's quite annoying that every time you change USB port on your Windows box, the Device Manager insists on re-installing the drivers for that device and give them a new COM port! You'll endup having several dozens of COM ports in a short time. The very small and nice FTDI utility in the HackPack allow you to easily re-assign the COM ports to where ever you like. And you can use some of the other utilities to remove device drivers that are using old/other COM ports.

E:V:A · Sep 26, 2013

SD-card sharing: Huawei FAILURE!

It is not clear from the instructions that came with the router, what the
exact intended function of an internal SD card would be. But from looking at
other Huawei Mifi routers, it seem to be that one should be able to "share"
the microSD card data in such a way, that anyone connected to the router
should be able to open the web interface to up/download files. However, this
"feature" as it is marketed for the E589, is not available. I have tried
pretty much everything apart from throwing it against the wall, and still no
sign of a working SD card-reader connection in the web-interface, even though
the SD-card is recognized in Window's Device Manager when connected via micro
USB cable. So WTF Huawei!?

Here are 2 pictures of a working interface for the E5776. This is exactly the same
as for the E589u-12, but without the "Sharing" tab enabled.

And here's the actual "sharing" settings page...

So now you think, whoa, no reason for it to work on a different device...right? Wrong!
By poking around in the firmware, I know the "interface" is in there. In fact it is over here:

http://192.168.1.1/html/sdcardsharing.html

However, it is not enabled and does not register my SD card for some reason,
and any clicking on this page results in an error. It seem that the web server
content for this "feature" has been disabled somewhere. We need to find where
and why, and then try to fix it by flashing a new hacked EFS filesystem.

So what would it take to accomplish this?
Answer: Something like this.:

Inspect the HW to make sure SD is connected as it should.
Status: Most likely OK, since already recognized by PC.
Inspect the web-interface and web-server settings, to make sure it has the intended support.
Status: WIP
Partial reverse engineering of the firmware, to make sure it's able to support this "feature".
Status: To do.
Extract the EFS2 to get all the required files and modify as needed.
Status: Partially done. Protected EFS still need to be extracted.
Re-flash modified EFS.
Status: Should be easy, unless EFS files are signed!

A first step is to inspect the JavaScript code, doing all the web serving. Playing around with
the interface, we immediately find the following potential problems:

For example they use iframe's which have been known to be browser dependent, in the past,
and some of the critical variables are disabled and possibly wrong.

sdcard.js

Code:

[SIZE=2]...
var SD_STATUS_DISABLE = '0';
var SD_NO_FORMATED = '2';
var SD_SHARE = '1';
var SD_NOSHARE = '0';
var SD_WEB_SHARE = '[B]0[/B]';                 <-- [COLOR=Red]Is this correct?[/COLOR]
var SD_USB_SHARE = '1';
var SD_ACCESS_READ = '[B]0[/B]';               <-- [COLOR=Red]Is this correct?[/COLOR]
var SD_ACCESS_WRITE = '1';
var SD_SHARE_ALL_FILE = '0';
var SD_SHARE_CUSTOM_FILE = '1';
var SD_ROOT_DIRECTORY = '[B]tffs0b[/B]';       <-- [COLOR=Red]Is this correct?[/COLOR]
var FILE_LIST_TYPE_FOLDER = '0';
var FILE_LIST_TYPE_FILE = '1';
var LOGIN_STATE_NOMAL = '0';
var LOGIN_STATE_ERROR = '1';
...
[/SIZE]

Then, when loading the following EFS file:

Code:

EFS2 location:  hdev/ftl1h0p1/WebApp/common/api/sdcard/sdcard
web-server:     http://192.168.1.1/api/sdcard/sdcard

in the browser, we obtain the result:

Code:

[SIZE=2]<?xml version="1.0" encoding="utf-8"?>
<response>
    <sdcard>
        <SDShareMode>0</SDShareMode>            [COLOR=Red]<-- Is this correct?[/COLOR]
        <SDCardShareStatus>1</SDCardShareStatus>
        <SDShareFileMode>1</SDShareFileMode>
        <SDAccessType>1</SDAccessType>
        <SDSharePath>/music</SDSharePath>        [COLOR=Red]<-- Is this correct?[/COLOR]
        <SDCardStatus>1</SDCardStatus>
    </sdcard>
</response>
[/SIZE]

As you can see, these were only 2 files out of hundreds...

But before we go any further, it is wise to backup everything possible. That means
the default router web UI settings, internal router firmware and the router's internal
chip/factory settings, known as NV-items, in case it is a Qualcomm based chipset.

E:V:A · Sep 27, 2013

Backing up the router web UI settings (NV data)

Although, they call this "NV data" backup, it is not the same as backing
up the Qualcomm NV-items used to configure the internal modem processor.
This need to be done from another application such as QPST, CDMA-tools,
or RevSkills etc... Instead, this is only a backup of the router's web user interface (UI).
There are 2 different ways to do this.

One way is to:

Go to the web interface and login. Then navigate to:
Settings --> System --> "Back up and Restore"
Click on "Backup" button.

The other way is this:

Just go to: http://192.168.1.1/nvram.bak to download & save the file.
Then to see the contents which are Base64 encoded, you need to decode
by ignoring non-Base64 characters:

Code:

base64.exe -d -i nvram.bak >nvram.txt

Here's my output with the IMSI, "<custom-dir>" (which are the 8-first digits of the IMSI) and wifi SSID edited out with #'s:

Code:

[SIZE=2]model_verify
start_file
E589u-12
end_file
softversion_verify
start_file
11.433.13.00.01
end_file
dailup_file:
/hdev/ftl1h0p1/userdata/dialup/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<profile_imsi>###############</profile_imsi>
<current_profile>1</current_profile>
</config>

end_file:
profile_list_file:
/hdev/ftl1h0p1/userdata/dialup/profilelist.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<profile>
<index>1</index>
<is_valid>1</is_valid>
<profile_name>NetCom</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username/>
<password/>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
<profile>
<index>2</index>
<is_valid>1</is_valid>
<profile_name>Chess internet</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username>chess</username>
<password>chess</password>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
<profile>
<index>3</index>
<is_valid>1</is_valid>
<profile_name>Vitel</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username/>
<password/>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
</config>

end_file:
lan_config_file:
/hdev/ftl1h0p1/userdata/lan/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8" ?>
<config>

end_file:
firewall_config_file:
/hdev/ftl1h0p1/userdata/firewall/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<fwswitch>
<firewallwanportpingswitch>0</firewallwanportpingswitch>
<firewallipfilterswitch>0</firewallipfilterswitch>
<firewallmainswitch>0</firewallmainswitch>
</fwswitch>
</config>

end_file:
ipfilter_file:
/hdev/ftl1h0p1/userdata/firewall/ipfilter.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<ipfilters>
<ipfilter>
<lanipfilterprotocol>0</lanipfilterprotocol>
<lanipfilterstatus>0</lanipfilterstatus>
<lanipfilterlanstartaddress/>
<lanipfilterlanendaddress/>
<lanipfilterlanstartport>0</lanipfilterlanstartport>
<lanipfilterlanendport>0</lanipfilterlanendport>
<lanipfilterwanstartaddress/>
<lanipfilterwanendaddress/>
<lanipfilterwanstartport>0</lanipfilterwanstartport>
<lanipfilterwanendport>0</lanipfilterwanendport>
<lanipfiltersrcstartipmask>0</lanipfiltersrcstartipmask>
<lanipfilterdeststartipmask>0</lanipfilterdeststartipmask>
<lanipfilterpolicy>0</lanipfilterpolicy>
</ipfilter>

... [several more]

</ipfilters>
</config>

end_file:
specialapp_file:
/hdev/ftl1h0p1/userdata/firewall/specialapp.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
        <lanports>
                <lanport>
                        <specialapplicationtriggername/>
                        <specialapplicationtriggerport>0</specialapplicationtriggerport>
                        <specialapplicationtriggerportend>0</specialapplicationtriggerportend>
                        <specialapplicationtriggerprotocol>0</specialapplicationtriggerprotocol>
                        <specialapplicationstartopenport0>0</specialapplicationstartopenport0>
                        <specialapplicationendopenport0>0</specialapplicationendopenport0>
                        <specialapplicationstartopenport1>0</specialapplicationstartopenport1>
                        <specialapplicationendopenport1>0</specialapplicationendopenport1>
                        <specialapplicationstartopenport2>0</specialapplicationstartopenport2>
                        <specialapplicationendopenport2>0</specialapplicationendopenport2>
                        <specialapplicationstartopenport3>0</specialapplicationstartopenport3>
                        <specialapplicationendopenport3>0</specialapplicationendopenport3>
                        <specialapplicationstartopenport4>0</specialapplicationstartopenport4>
                        <specialapplicationendopenport4>0</specialapplicationendopenport4>
                        <specialapplicationtriggerstatus>0</specialapplicationtriggerstatus>
                        <specialapplicationopenprotocol>0</specialapplicationopenprotocol>
                </lanport>

                ... [several more]

        </lanports>
</config>

end_file:
virtualserver_file:
/hdev/ftl1h0p1/userdata/firewall/virtualserver.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<servers>
<server>
<virtualserveripname/>
<virtualserverstatus>0</virtualserverstatus>
<virtualserverremoteip/>
<virtualserverwanport>0</virtualserverwanport>
<virtualserverwanportend>0</virtualserverwanportend>
<virtualserverlanport>0</virtualserverlanport>
<virtualserveripaddress/>
<virtualserverprotocol>0</virtualserverprotocol>
</server>

... [several more]

</servers>
</config>

end_file:
device_config_file:
/hdev/ftl1h0p1/userdata/firewall/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<fwswitch>
<firewallwanportpingswitch>0</firewallwanportpingswitch>
<firewallipfilterswitch>0</firewallipfilterswitch>
<firewallmainswitch>0</firewallmainswitch>
</fwswitch>
</config>

end_file:
device_config_file:
/hdev/ftl1h0p1/userdata/device/config.xml
start_file:
<?xml version="1.0" encoding="utf-8" ?>
<config>
</config>


end_file:
global_config_file:
/hdev/ftl1h0p1/userdata/global/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<custom_dir>########</custom_dir>
</config>

end_file:
webserver_config_file:
/hdev/ftl1h0p1/userdata/webserver/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>      

end_file:
wifi_config_file:
/hdev/ftl1h0p1/userdata/wifi/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<wifiwps>
<wpspin></wpspin>
</wifiwps>
<wifisec>
<WifiRestart>0</WifiRestart>
<wifiwpscfg>1</wifiwpscfg>
<wifiwpsenbl>1</wifiwpsenbl>
<wifiwepkeyindex>1</wifiwepkeyindex>
<wifiwpaencryptionmodes>MIX</wifiwpaencryptionmodes>
<wifibasicencryptionmodes>NONE</wifibasicencryptionmodes>
<wifiauthmode>WPA/WPA2-PSK</wifiauthmode>
<wifiwpapsk>10234873</wifiwpapsk>
<wifiwepkey4>34873</wifiwepkey4>
<wifiwepkey3>34873</wifiwepkey3>
<wifiwepkey2>34873</wifiwepkey2>
<wifiwepkey1>34873</wifiwepkey1>
</wifisec>
<wifibasic>
<WifiRestart>1</WifiRestart>
<wifiprotectionmode>0</wifiprotectionmode>
<wifipamode>0</wifipamode>
<wifiwme>1</wifiwme>
<wifibcnintvl>100</wifibcnintvl>
<wifidtmintvl>1</wifidtmintvl>
<wifirtsthrshld>2347</wifirtsthrshld>
<wififrgthrshld>2346</wififrgthrshld>
<wifitxpwrpcnt>128</wifitxpwrpcnt>
<wifiofftime>600</wifiofftime>
<wifioffenable>0</wifioffenable>
<wifiisolate>0</wifiisolate>
<wifimaxassoc>10</wifimaxassoc>
<wifirate>0</wifirate>
<wifimode>b/g/n</wifimode>
<wificountry>NO</wificountry>
<wifihide>0</wifihide>
<wifichannel>0</wifichannel>
<wifienable>1</wifienable>
<wifissid>###-############</wifissid>
</wifibasic>
</config>

end_file:
upnp_config_file:
/hdev/ftl1h0p1/userdata/upnp/config.xml
start_file:
<?xml version="1.0" encoding="utf-8"?> 
<config>
</config>


end_file:
[B]<checksum>29905063</checksum>[/B]
[/SIZE]

At the very end of the file, you find a "checksum" tag like this:

Code:

<checksum>29905063</checksum>

I don't know how this checksum is calculated. (Anyone?) But I think it could be some kind of CRC of the contents previous to, and above the tag.

The eagle-eyed would also have noticed the lack of the closing "</config>" tag for the "lan_config_file:". Could this influence the SD-card sharing problems?

E:V:A · Sep 27, 2013

Backing up the router Firmware

Now, this is the place where siht is starting to get real. The main problem is that Huawei
has blatantly abandoned their device support, in pursuit for a more profitable build-sell-and-forget
strategy. Just what we're used to Samsung doing! So we're left in the dust of greed, to fight for
ourselves. The firmware for this device is nowhere to be seen in the wild apart some occasional
JTAG dumped fakes, behind some far-east pay-walls. So we have to resort to our own back-to-basics
low-level tools. Fortunately, Qualcomm is on our side, with occasional document leaks and
various OEM tools. Let's see what we can do with them and what need to be done.

Basically, the "firmware" (FW) consists of several parts.

The raw CP firmware code containing the RTOS.*
The raw AP (here UI) firmware code containing the APPS OS.*
The factory hardware settings, containing chip specific configuration data.
E.g. Qualcomm MDM9200 + related chipset data.
The OEM (Huawei) hardware settings, containing device design specific configuration data.
E.g. microSD-card, display, USB and antenna/band settings.
The Carrier customization settings, that determines the available/allowed networks,
bands and carriers, including the web-interface and server.

* Note that in our E589, (1) and (2) are the same as there is no real AP nor UI. That means all
UI-like (display and web-UI) operations are happening in (1), the modem itself.

Parts (1) and (2) are generally stored on the eMMC in separate partitions, while parts (3-5) are redundantly stored on one or more partitions, using a special (virtual) file system called Embedded File System, EFS2. This is not a real FS, in the low-level HW sense. Within this EFS, are all the parameters and settings required for normal operation of the device, including the web-server and UI filesystem. That means (in our case), that we have the following:

all IMEI/IMSI and carrier data
web-server and UI data
all RF related parameter data
most/all of AP/CP/PMIC/WiFi/BT/NFC low/chip-level parameters
carrier customization configuration
etc etc

However, most of the data and parameters that are not directly part of the web-interface, are stored in a number of proprietary Qualcomm Non-Volatile (NV) items, the "NV-items". Each individual NV-item is usually stored in its own separate file in the EFS under the "nv" directory. They can have names or simply numbers, depending on OEM and NV-item values. To simplify the loading, editing, backup and restore of these, Qualcomm uses a special file format, called a QCN file. Special tools like, QPST, QXDM etc, are used to create, edit, compare, merge or upload these files to the device. We will look in more detail at these tools later.

The important thing here, is that we want to backup both the full EFS and the QCN file for easy access. Later we'll attempt to make a low-level (partion-level) backup, of the rest of the internal firmware, in case something would go wrong or if we would need a more low-level RTOS firmware modification.

< WIP >

Backing up the EFS

There are several ways to backup the EFS2, internal filesystem.

Qualcomm QPST
Qualcomm QXDM
RevSkills
< tba >

One way to backup the EFS2, is to use the QPST plugin, "EFS Explorer".

a) Open QPST and connect your phone
b) Go to: menu > EFS Explorer
c) In the new EFS Explorer window, ...
d) < tba >
e) Send your SPC, normally "000000" for unlocked modems.
f) ...

This will also generate the EFS logfile "efs.log". This is a text-file that contains all filenames part of the backup. Here you will not only find the path to all XML configuration files, JavaScript, nv/item_files/ and manuals etc, but will also be very useful to show you what URL's are available through the router web-UI.

HERE is the entire list, with some edits for readability.
We'll discuss the details of this in a later post about the web-UI and API.

Incomplete EFS Backup

Backing up your EFS in this way, will not allow you to get all items. Some of the EFS files containing crucial HW specific data are read/write protected. These protected folders are shown in EFS Explorer as crossed out, like this:

I have not yet figured out how to get these out in a simple way, without having to resort to more advanced methods, as mentioned later.

Please send me a PM if you know how!

< WIP >

E:V:A · Oct 4, 2013

The Huawei E589u-12 Firmware is here!

Thanks to some very helpful GSM-forum members, we now have 3 different
firmware versions for our 4G MiFi router. Here they are:

Code:

[SIZE=2]MDM9200Update_11.433.14.01.[B]1064[/B].B788.exe      <none>  (Norway)        [URL="http://d-h.st/4Lj"]HERE[/URL] (15.33 MB)   [URL="http://tilbehor.emcom.no/download/Huawei/E589/MDM9200Update_11.433.14.01.1064.B788.exe"]original[/URL]
MDM9200Update_11.433.15.01.[B]673[/B].B788.exe       Altel   (Kazakhstan)    [URL="http://d-h.st/fo3"]HERE[/URL] (15.08 MB)   [URL="http://vve.su/vvesu/files/misc/E589/MDM9200Update_11.433.15.01.673.B788.exe"]original[/URL]
MDM9200Update_11.433.15.00.[B]422[/B].B788.exe       Telenor (Sweden)        [URL="http://d-h.st/lea"]HERE[/URL] (15.27 MB)   [URL="http://www.telenor.se/published_images/MDM9200Update_11.433.15.00.422.B788.zip"]original[/URL][/SIZE]

These have been compressed with 7zip.

[UPDATE: 2014-01-05]

We have now many more E589 firmwares available HERE at the Russian 3ginfo site. They are:

Code:

Huawei E589     11.433.15.00.375  Zain    +sdimage      
Huawei E589     11.433.15.01.115  Nawras  +sdimage      
Huawei E589     11.433.15.01.157  PCCW    +sdimage      
Huawei E589     11.433.17.01.260  Elisa 
Huawei E589u-12 11.433.14.02.990  OpenMarket    
Huawei E589u-12 11.433.14.02.1055 EE      +sdimage      
Huawei E589u-12 11.433.15.00.158  Globe   +sdimage      
Huawei E589u-12 11.433.15.00.422  Telenor +sdimage      
Huawei E589u-12 11.433.15.01.673  Altel   +sdimage      
Huawei E589u-12 11.433.15.02.260  Elisa   +sdimage      
Huawei E589u-12 11.433.15.03.1020 iinet   +sdimage      
Huawei E589u-12 11.433.15.04.192  Tim   

Huawei E589u-512 11.433.19.00.228 Personal +sdimage     
Huawei E589u-512 11.433.19.00.256 Personal      
Huawei E589u-512 11.433.99.51.000.B730 normal

Some of these include a mysterious file: SDimage.BIN (~44 MB)

I don't know what it does, but hope that perhaps it could fix the SD-card sharing problem. Please post if you have any idea!

WARNING

Do not randomly flash these to your modem.
These have not yet been tested and confirmed to work.
They are just for your convenience in case you have
a dead router or other serious problem. I will not be
held responsible for what happens, if you do.

Most likely they will completely change the LTE-band availability,
depending on the carrier it was originally meant for. Perhaps
we will see later what exact bands and features they have.

See post#7 for more Huawei firmware descriptions.

webbyboy · Oct 5, 2013

Hi just wondering, how you able to hack Japan E-mobile's Huawei GL04P LTE mifi? Im trying to get it work with other country's LTE network. Currently only 3G is able to.

Renate · Oct 19, 2013

I would really guess that the two reds are both connected to battery+ and the two blacks to battery-.
That leaves one pin leftover.
I'd guess that it is a standard 10K NTC thermistor.
It would be easy enough to measure the resistance of the white to the black.
I2C would be cute, but how could it have that?

dettofatto · Nov 14, 2013

Your work is awesome!!!!
I've only one question... I would like reboot this router with some scripts, or similar (curl, telnet,lynx..),,, Did you find any tips?
Thank you!

[R&D] Hacking the Huawei E589 (4G LTE Mobile Router)

Inactive Recognized Developer

Attachments

Inactive Recognized Developer

Inactive Recognized Developer

Inactive Recognized Developer

Attachments

Inactive Recognized Developer

Attachments

Inactive Recognized Developer

Attachments

Inactive Recognized Developer

Inactive Recognized Developer

Senior Member

Inactive Recognized Developer

Inactive Recognized Developer

Inactive Recognized Developer

Inactive Recognized Developer

Inactive Recognized Developer

Inactive Recognized Developer

Inactive Recognized Developer

Inactive Recognized Developer

Senior Member

Recognized Contributor / Inactive Recognized Dev

Senior Member

Similar threads

Top Liked Posts