NOTE: This is the same as the Vodafone R210.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Someone handed me a Huawei E589u-12 Mobile 4G LTE WiFi Router, so I thought
I'd have a look at the firmware. However, I was not able to find any firmware
for this device, so I started looking at firmware for similar devices such as
the E5776 and the E392. The only one I found something for, was the E392u-92.
I looked inside and found some undocumented proprietary Huawei/Qualcomm AT
commands. They're listed in the next posts.
So I'm just posting some of my findings here, so don't expect any major events here.
But most importantly: DO NOT ask for device unlocking codes!
(I don't have the new Huawei unlock algorithm and neither the software.)
The devices mentioned above should use the following Qualcomm modems:
Code:
[SIZE=2]E589u-12 MDM9200 (WiFi)
E392u-92 MDM9200 (USB dongle)
E5776u-72 MDM9615 (150 Mbps + voice capability)[/SIZE]
Then after first having installed the device drivers (in Windows), I used the DC-unlocker (Client 1.00.1034) tool.
From that I got the following information:
Code:
[SIZE=2]--------------------------------------------------------
Found modem : E589u-12
Model : Huawei E589
IMEI : 86303001*******
Serial NR. : P2T7NB929*******
Firmware : 11.433.13.00.01
Compile date / time : Jun 18 2012 13:27:56
Hardware ver. : CL1E589M22
Chipset : Qualcomm MDM9200
NAND Flash : TC58NYG1S3C
SIM Lock status : unlocked
Wrong codes entered : 10 (unlock attempts left : 0)
--------------------------------------------------------[/SIZE]
AFAIK the DC-unlocker is just connecting to modem via the AT command interface,
and querying the various info from a set of AT commands (ATC's).
Some additional info:
Code:
[SIZE=2][URL="http://transition.fcc.gov/oet/ea/fccid/"]FCCID[/URL]: [URL="https://apps.fcc.gov/oetcf/eas/reports/ViewExhibitReport.cfm?mode=Exhibits&RequestTimeout=500&calledFromFrame=N&application_id=285796&fcc_id=QISE589U-512"]QISE589U-512[/URL]
Battery: Huawei [B]HB5P1H [/B]3.7V, 3000 mAh, Li-Polymer
USB-ID: [B]12d1:1f01[/B]
Modem: Qualcomm MDM9200
RF: Qualcomm RTR8600
PMIC: Qualcomm PM8028
Wifi: Qualcomm WCN1314
[/SIZE]
So why bother with all this? Perhaps to answer:
Where can we get and download the firmware?
Answer: We can't! We have to extract it...
How can we manually update the FW?
Answer: Get the FW first and I'll show you...
Can we use standard Qualcomm tools like QPST/QXDM with this?
Answer: YES!
What other hidden ATC's are available?
Answer: See Post#2.
What is the new Huawei router unlock algorithm?
Answer: It's secret, so that greedy people can make $$$.
Apparently this device firmware is based on Qualcomm Gobi, and thus we may find some clues in those repositories.
Certainly the Qualcomm MSM Interface (QMI) documents are all available there as well...
If you want to play with this device, you'll need to install the device drivers. The easiest way is probably to install
Huawei's Mobile Partner (Windows) application or to avid bloatware, use only the drivers in Huawei Drivers (4.25.18) .
I have no idea where the hell Huawei keep all their software,
or if there's better way. Perhaps by just extracting application and just use the drivers. Then you should be able to
use any terminal program to connect with. I use RealTerm or Putty, but you can also use the online
Java AT command tester/terminal.
For a complete bunch of useful Windows utilities, see post#12 to download the Huawei Modem HackPack.
After connecting to the router modem via microUSB connection and a terminal application (Putty or RealTerm) we can issue some standard ATC's. Here are the results.
Huawei/Qualcomm standard AT commands (E589u-12 via "AT+CLAC")
The 3GPP ETSI standard [part 1/2]:
Code:
[SIZE=2]&C
&D
&E
&F
&S
&V
&W
A
D
E
H
I
L
M
O
P
Q
T
V
X
Z
\Q
\S
\V
%V
S0
S2
S3
S4
S5
S6
S7
S8
S9
S10
S11
S30
S103
S104
+CACM
+CAMM
+CAOC
+CBC
+CBST
+CCFC
+CCLK
+CCUG
+CCWA
+CDIP
+CEER
+CEMODE
+CEREG
+CFUN
+CGACT
+CGATT
+CGCLASS
+CGCMOD
+CGCONTRDP
+CGDATA
+CGDCONT
+CGDSCONT
+CGEQMIN
+CGEQNEG
+CGEQOS
+CGEQOSRDP
+CGEQREQ
+CGEREP
+CGMI
+CGMM
+CGMR
+CGPADDR
+CGQMIN
+CGQREQ
+CGREG
+CGSCONTRDP
+CGSMS
+CGSN
+CGTFT
+CGTFTRDP
+CHLD
+CHSN
+CHUP
+CIMI
+CIND
+CLAC
+CLCC
+CLCK
+CLIP
+CLIR
+CMEC
+CMEE
+CMER
+CMGC
+CMGD
+CMGF
+CMGL
+CMGR
+CMGS
+CMGW
+CMMS
+CMOD
+CMSS
+CNMA
+CNMI
+CNUM
+COLP
+COPN
+COPS
+CPAS
+CPBF
+CPBR
+CPBS
+CPBW
+CPIN
+CPLS
+CPMS
+CPOL
+CPUC
+CPWD
+CQI
+CR
+CRC
+CREG
+CRES
+CRLP
+CRSM
+CSAS
+CSCA
+CSCB
+CSCS
+CSDH
+CSIM
+CSMP
+CSMS
+CSQ
+CSSN
+CSTA
+CTFR
+CTZR
+CTZU
+CUSD
+CV120
+CVHU
+DR
+DS
+ES
+ESA
+FAR
+FCL
+FCLASS
+FDD
+FIT
+GCAP
+GCAP
+GMI
+GMM
+GMR
+GSN
+ICCID
+ICF
+IFC
+IPR
+PACSP
+VTS
+WS46
[/SIZE]
The Qualcomm Specific standard AT's [part 2/2]:
Code:
[SIZE=2]*CNTI Displays the access technology; refer to GSM 07.07 subclause 9.2 for err value
$BREW ?? Start a "Brew MP" serial session (by entering the BrewMP Command Processor)
$CCLK ?? sets the clock of the device
$CREG ?? gives information about the registration status and access technology of the serving cell.
$CSQ
$QCAPNE Command is used to edit APN values in APN table.
$QCBANDPREF Sets the band preferences of the device
$QCBOOTVER Returns boot image version
$QCCLR Clears mobile error log
$QCCNMI Similar to 27.005 +CNMI except for the behavior with $QCCNMI=1,2
$QCDEFPROF Sets the given profile number as default profile for the family of the specified technology and subscription.
$QCDGEN Generates data over +CGACT activated PDP context
[B]$QCDMG[/B] [COLOR=Red]Transitions to Diagnostics Monitor (DM) operation[/COLOR]
$QCDMR Sets DM baud rate
$QCDNSP Sets primary DNS IP address
$QCDNSS Sets secondary DNS IP address
$QCHWREV Provides MDM1000 chip hardware revision
$QCMRUC Command is used to edit/set MRU database.
$QCMRUE Command is used to clear/delete MRU database
$QCPDPCFGE Sets PDN teardown time interval
$QCPDPIMSCFGE Command is used to edit PDP profile registry
$QCPDPLT Enables/disables tolerance to long delays in PDP call setup
$QCPDPP Sets authentication for PDP-IP packet data calls
$QCPINSTAT? Sends to the ME the status of all PINs for all cards
[B]$QCPWRDN[/B] Power Down the UE
$QCSIMAPP This command is applicable only for DSDS target. User can select Active subscription.
$QCSIMSTAT Get/Set SIM status (init completed?)
$QCSLOT Sets SIM card on which slot commands will operate
$QCSYSMODE Get hardware available network modes (e.g. WCDMA + HSDPA + HSUPA)
$QCTER Sets TE-DCE baud rate; baud rates supported are identical to +IPR command
$QCVOLT Provides the input voltage level of VMAIN_3.3 as measured by the DUT power management IC
[/SIZE]
Here is a list of Huawei OEM extracted AT commands. They were extracted from
the E392u-12 firmware update (11.836.13.00.209), since I didn't have any
firmware for my own router. Later, I also managed to extract the firmware (via
QPST's Memory Debug Application) for the E589. The result after having spent
considerable time manually checking the availability for most of these, are
shown in the table below. It is very likely that there could be other commands
in our router firmware, not shown here, that I have either missed, or that
remain disabled until certain features are enabled and other criteria
fulfilled. For example, DIAG,FTM,LTE,USSD modes etc.
Unsolicited ATCoP Messages
When connected directly to your modem port via some terminal application,
the ATCoP will occasionally produce informative messages about the status
and changes to network connections etc. These messages are called
"Unsolicited message". In many of the newer Qualcomm based Huawei (OEM)
mobile USB routers/modems, these messages appear prefixed with the
tilde/carrot, "^". But although Huawei uses the carrot for their
proprietary AT commands, these are not actually commands. In newer Huawei
modems, these messages are controlled by the AT^CURC command. Here is a
list of these unsolicited messages and their meanings.
From 909u-512 manual:
Code:
[SIZE=2]^ACTIVEBAND
^ANLEVEL
^BOOT [info] During device re/boot-up
^CEND
^CONF
^CONN
^CRSSI
^CSNR
^DATASETRULT
^DATAVALIDITY
^DSDORMANT
^DSFLOWRPT [info] about the current connection statistics during dial-up. (curr_ds_time,tx_rate,rx_rate,curr_tx_flow,curr_rx_flow, qos_tx_rate,qos_rx_rate)
^EARST
^ECCLIST
^ECLSTAT
^HCSQ
^HDRRSSI
^HRSSILVL
^HWNAT [info] Service State Change Indication (GSM,CDMA,LTE etc.)
^IPDATA
^IPSTATE
^LOCCHD
^MODE [info] System mode change event indication
^NDISEND
^NDISSTAT
^NWTIME
^ORIG
^OTACMSG
^POSEND
^POSITION
^RFSWITCH
^RSSI [info] RSSI change indication
^RSSILVL
^SIMFILEREFRESH
^SIMST [info] USIM card state change indication
^SMMEMFULL [info] When message storage is full, this unsolicited indication is sent.
^SRVST [info] Service state change indication
^STIN
^THERM
^TIMESETRULT
^WNINV
^WPDCP
^WPDDL
^WPDOP
^XDSTATUS
Maybe in E589:
^THERMST [info] ?? Thermal Step Timer
[/SIZE]
Error/Response Table
To see what ATC work or not, I just marked the various ATC with their allowed options.
Code:
[SIZE=2]Type:
-------------------------
[B]-[/B] Command Not Supported
[B]! [/B]Unsolicited message[B]
E[/B] ERROR
[B]CE[/B] +CME ERROR: 1
[B]/[/B] [no response] or just "OK"
Allowed options:
[B]1[/B] Raw: Used without parameter)
[B]2[/B] Read: Read with "?"
[B]3[/B] Query: Read write options with "=?"
[/SIZE]
Huawei Proprietary AT commands (Qualcomm Modems)
Code:
[SIZE=2]
^ANQUERY Query current network parameters (rscp,ecio,rssi,antenna_level,cellid)
^APBATLVL *1 Battery State/Level (chargerState,batterylvl)
^AUTHDATA 123
^AUTHVER 2
^BSN ?? Get Backward Sequence Number. The sequence number of the last correctly received MTP frame received.
^BTRSN
^CARDLOCK Unlock SIM network lock. Set: AT^CARDLOCK="<unlockcode>" (Query: state,times,operator) [NV item 50001]
^CARDMODE Get currently installed SIM/USIM card type. [2]
^CCV / ??
^CELLMODE 123 ?? Get current cell mode (0-9)??
^CMDLEN 2 ?? 480 ??
^CPBR Get Phonebook entries
^CPBW Set Phonebook entries
^CPIN 23 Get?set SIM PIN/PUK management
^CPNN E ?? Calling Party Number?
^CPWORD / [1]
^CQLM /
^CRADLE -
^CRPN /E
^CSDFLT ?? Circuit Switched Data? Related to Field Test Mode
^CSVER 2 Get XXXX version number. I.e. "1004"
^CSQLVLEXT +CSQ? Level Extension, shows RSSI Level and BER (rssilv,ber)
[B]^CURC[/B] *23 [COLOR=DarkGreen]Get/Set presentation of unsolicited results (^BOOT, ^RSSI etc.) [0-disable, 1-enable standard set, 2-modes][/COLOR]
^DATACLASS Get info on supported UMTS protocols
^DATALOCK
^DHCP CE Get interface IPv4 addrs assigned by network DHCP server
^DHCPv6 Get interface IPv6 addrs assigned by network DHCP server
^DIALMODE Get/Set dial-up mode (Modem/NDIS)
^DISLOG ?? Disable Diagnostics Mode use for ceratin NV items? (NV_FORBID_DIAG) Also see [1]
^DLR ?? Current USB? Download Rate (in kbps)
^DNSP Get/Set the Primary DNS server address
^DNSS Get/Set the Secondary DNS server address
^DSFLOWCLR Clears the DS traffic to zero, including the DS accumulated connection time
^DSFLOWQRY Show last DS connection time and traffic
^ECIOCFG ?? Ec/Io Configuration (related to signal quality) RSSI [dBm] = RSCP [dBm] - Ec/I0 [dB]
^ENABLESD *23 Enable/Disable router SD-card slot. (0:disable, 1:enable) [NV_SD_CARD_ENABLE_I]
^FACINFO / Get/Set Factory Information
^FCHAN /E [2]
^FDAC CE [2]
^FLASH Get NAND flash information (chiptype, block statistics etc.)
^FLNA [2]
^FPA CE [2] Set RF Power Amplifier level
^FREQLOCK Enable/disable RF PLL lock to specific ARFCN (By setting NV item "NV_FREQLOCK_I".)
^FRSSI CE [2] Get GSM/LTE RSSI values
^FRXON 2 [2] ?? RF Receiver On
^FTXON 2 [2] ?? RF Tranmitter On
^GETPORTMODE 1 ?? Show active port mode: "TYPE:WCDMA:Qualcomm,PCUI:0,DIAG:1"
^GLASTERR E Get list of latest firmware errors
^GPIOPL 2 Get/Set PIN on OPL ??? (14 bits?)
^HS E ?? Switching to HS USB mode? (id,protocol,IsOffline,p_class,p_id,s_id)
^HSPA Get/Set "recommended" UMTS protocol
^HVER 1 Get PCB? hardware version/name
^HWDUMP 2
^HWNATQRY Get NAT of current network
^HWVER Get the Hardware Version number (31 characters)
^ICCID 2 Get the SIM card CID
^IMSICHG [3] Change IMSI
^INFORBU
^IPV4V6TEST -
^IPV6CAP - Check if IPv6 is supported
^JAPAN [1]
^LED 12
^LEDTEST Check color combinations of device's LED
^LTECAT 2 Get the device LTE Category
^LTECS 2 ? Get/Set LTE circuit switched (CS) fallback?? See: http://tinyurl.com/l2k3drz http://tinyurl.com/mjemr2u
^LTEPDPTIME ? [4]
^LTERSRP E [4] Get RSRP and RSRQ for serving cell
^LTESCINFO E [4] Get PCI, SINR, MIMO rank and bandwidth for serving cell
^MAXLCKTMS Get/Set (protected) maximum number of tries to enter wrong NCK [NV item 50005]
^MDATE E
^NDISDUP Get/Set NDIS based dialing (ECM) [Require enabled NDIS port]
^NDISEND ?? NDIS/WWAN Disconnect report
^NVMBN 123
^NVTEST 12
^OPL [3] ?? Get Operator PLMN List
^OPWORD [1]
^PHYNUM ?? Get/Set (protected) IMEI
^PLATFORM 2
^PNN [3] ?? Get PLMN Network Name (PNN) List
^PORTLOCK Enable/Disable switching PC UI to Diag mode
^PORTSEL 23 Proactive event report port setting for non-data service (Modem,PCUI,...) (0-disable*, 1-enable)
^PREFMODE Get/Set the preferential network mode
^RDCUST 123 Get/Set various Huawei customization parameters (NV), may need password! (~29 in total)
^RRCVER 23 ?? Get/Set RRC version? [0-4] (Begin to parse "Receiver" messages?)
^RSCPCFG Get/Set lower UMTS RSCP thresholds
^RSFR ??SF=SIM Filesystem?? Read
^RSFW ??SF=SIM Filesystem?? Write
^RSIM ?
^RSTRIGGER *23 ?? Writing to Huawei NV item [NV_HUAWEI_WMS_CONFIG_INFO_I]
^SCPBR ?? See +CPBR and ^CPBR Get Phonebook entries
^SCPBW ?? See +CPBW and ^CPBW Set Phonebook entries
^SD CE
^SETPID [3] Change device's USB PID to generic 1001 (until reboot)
^SETPORT Set modem port modes: (MODEM,PCUI,DIAG,PCSC,GPS,CDROM,SD, ... etc.)
[B]^SFM Set modem to "Factory Mode": AT^SFM=1 (Disconnect and reconnect) [NV_FTM_MODE_I ?? nv number?][/B]
^SIMLOCK
^SLOTCFG Get/Set maximum number of allocated data timeslots (GPRS/EDGE)
^SN ?? Write Serial Number into factory NV item 114 "Factory Information" [NV_FACTORY_ITEM ???]
^SPN [3] TE Query the Service Provider Name (SPN) file of 2G/3G stored on the SIM/USIM card through the ME.
^SSID Wifi ESSID? [NV-item 50290]?
^STGI [3]
^STGR [3]
^STIN [3]
^STSF [3] Related to writing NV item [NV_HUAWEI_STK_CFG_I]
^SWDUMP 2
^SYSCFG - (old) System configuration reference setting (Mode,Acqorder,Band,Roam,Srvdomain)
^SYSCFGEX 23 (new) System configuration reference setting (Acqorder,Band,Roam,Srvdomain,lteBand)
^SYSINFO 1 (old) Query the current system information (service state, domain, roaming etc.)
^SYSINFOEX 1 (new) Query the current system information (service state, domain, roaming etc.)
^SYSMODE 1 Get current network mode (WCDMA, HDSPA etc) [use ]
^TBAT *2 ?? Perhaps battery charger mode or Type? (0-normal, 1-, 2-charging)??? [NV-item 90]?
^TCHRENABLE *3 ?? Is trickle charge enabled ??
[B]^TMODE[/B] [COLOR=Red][2] ?? Enter Factory Test (?) Mode (WARNING: Will reboot/reset router)[/COLOR]
^TSELRF 2 ?? Get selected/supported RF modes/bands?
^UIMDELAY 23 ?? (0,1,2)
^USSDMODE Get/Set the USSD method to process the USSD data.
^VERSION 2 Get External/Internal hardware and firmware version information.
^WIKEY *23 [NV-item 50291]?
^WIWEP *23 [NV-item 50292]?
^YJCX 1 ?? Show some kind of combo of HW features (at least in other modems)
-------------------------------------------------------------------------------
* New in E589u-12 compared to E392u-12 FW
[1] DoCoMo (Japan) specific OEM and/or "authority" related commands.
Affected commands: ^JAPAN, ^OPWORD, ^CPWORD and ^DISLOG ?
[2] Some commands give weird responses, it could be that they're only
available when modem is set to Factory Test Mode (FTM) or when in
Diagnostic Mode (DIAG) ?
[3] Related to SIM Tool Kit (STK) functions.
[4] Certain LTE related commands has to have an active LTE connection
in order to work.
-------------------------------------------------------------------------------
[/SIZE]
These are device dependent, so obviously not all of them will work on all devices. There are probably
many others on more advanced routers, which is why we need the firmware.
Here are a few command descriptions/examples:
Code:
[SIZE=2]at^sysinfo
^SYSINFO:2,3,1,5,1,,4
at^setport?
FF;1,2,3,7,A1,A2
WHERE:
1:MODEM
2:PCUI
3:DIAG
4:PCSC
5:GPS
6:GPS CONTROL
7:NDIS
A:BLUE TOOTH
B:FINGER PRINT
D:MMS
E:PC VOICE
A1:CDROM
A2:SD
at^getportmode
^GETPORTMODE:TYPE:WCDMA:Qualcomm,PCUI:0,DIAG:1
at^portsel?
^PORTSEL:0
at^portsel=?
^PORTSEL:(0-1)
at^rdcust=?
(0: 0) (1: 0) (2: 1) (3: 0) (4: 0) (5: 0) (6: 0) (7: 0) (8: 0) (9: 0) (10: 0) (1
1: 0) (12: 1) (13: 0) (14: 0) (15: 0) (16: 0) (17: 0) (18: 0) (19: 0) (20: 0) (2
1: 0) (22: 0) (23: 1) (25: 0 0) (26: 0) (27: 0) (28: 1 1) (29: 0)
at^cardmode
^CARDMODE: 2
at^hver
^HVER:"CL1E589M22"
[/SIZE]
For more info on the at^syscfgex command, please have a look at the Russian forum post HERE.
References:
[1] HUAWEI UMTS Datacard Modem AT Command Interface Specification_V2.3.pdf
[2] HUAWEI CDMA Datacard Modem AT Command Interface Specification (2008)
[3] AT Command Interface Specification (2010) [MG323 GSM]
[4] Comprehensive AT Command Set in AMSS Software [80-VR432-1 C]
[5] ME909u-521Application-Guide.pdf
[6] ME909u-521-AT-Command-Specification.pdf
The OLD Huawei unlock algorithm
For reference I post a Python script using the OLD method for obtaining the
NCK and Flash unlock codes. The original source for this was found in THIS
thread at GSM-forum. However, all recent Huawei routers use a NEW method, which
has already been compromised but is strongly held secret by a bunch of
greedy hackers. Fortunately my router was already unlocked. But it would
still be interesting for the common good to understand how this works.
The general outline of the OLD method can be summarized as follows:
Generate your constants ("salt") from "hwe620datacard" and "e630upgrade",
using MD5 and discarding first 8, last 8 bytes of the result.
Concat IMEI + the constant for unlock or flash code
Apply MD5 to this string
Apply XOR operations to get 4 special bytes
Apply AND, OR operations to byte 3 (most significant byte)
Convert result to decimal <code>
Unlock modem/router with AT command: at^cardlock=<code>
Then you'll have:
Code:
[SIZE=2]SaltText MD5(SaltText) Salt
------------------------------------------------------------------------
hwe620datacard a32fe72c 5e8dd316726b0335 d5513ba0 5e8dd316726b0335
e630upgrade aa91cee2 97b7bc6be525ab44 cdc63be0 97b7bc6be525ab44
------------------------------------------------------------------------
==>
#salt = "5e8dd316726b0335" # sim: hwe620datacard
#salt = "97b7bc6be525ab44" # flash: e630upgrade[/SIZE]
Here the two salts obtained are used for the Sim unlock (NCK) and Flash
unlock, respectively. As you can see, this was valid for the very old
Huawei E620 data-card, but used on many other devices since.
The OLD Python script:
Code:
[SIZE=2]#!/usr/bin/python
import os, sys, re, StringIO
import hashlib
def getCode(imei, salt):
digest = hashlib.md5((imei+salt).lower()).digest()
code = 0
for i in range(0,4):
code += (ord(digest[i])^ord(digest[4+i])^ord(digest[8+i])^ord(digest[12+i])) << (3-i)*8
code &= 0x1ffffff
code |= 0x2000000
return code
salt = "5e8dd316726b0335"
imei = "863030010760596"
print getCode(imei, salt)[/SIZE]
The NEW Huawei unlock algorithm
As for the the new method of obtaining these constants I have no idea,
but many people do seem to know. However, if you like to find out for
yourself, you have to reverse engineer the at^cardlock command in the
modem firmware.
But from THIS post (and the ones following) on GSM-forum, you will find
out that the new "algorithm", really consists of 7 separate sub-routines using
slightly different algorithms/methods depending on the IMEI. At least one of
these use the new constant "hwideadatacard"...
The algorithm selection code look like this in PHP:
Code:
[SIZE=2]function HW_ALGO_V2_SELECTOR($imei){
$id = "";
for ($i = 0; $i<15; $i++) {
$id = $id + (ord($imei[$i]) +($i+1))*($i+1);
}
return ($id % 7);
} [/SIZE]
If you do decide to dig in to this problem statement, here are a couple
of publicly available IMEI and unlock combinations, you can use to test
with, for the E589u-12.
Code:
[SIZE=2]IMEI Unlock
--------------------------------
863030010760596 26561436
863030010201062 24290098
863030010953233 52096763
863030011597427 56285257
[/SIZE]
Opening the E589
The E589 tear apart or tear down!
So, since I could not find any information anywhere, on how to tear this baby
open, I had to do essentially that. I though the the FCC internal and external
photos would have helped me out, but with my inexperience, I did not recognize
the signs of the attachment mechanics. This made me break two plastic pryer
tools and almost the back cover itself, until I found that magic screw!
The screw is hidden under the SD card slot and under a cover of white paint,
which is why I missed it, since I thought it was the SD card eject button!
This is a normal Phillips head screw (PH00), and once you get it out, you
should be able to slide the cover off easily. Here's a picture showing the SD
card slot with the screw and the direction of the cover slide-off movement.
This movement is downwards from the back side/label point of view.
Then the battery seem attached somehow, first with a plastic flap and then most
likely with some glue/sticky tape... It seem very hard to detach, so I gave
up at this point, in fear of braking something that I need and that is not
already broken. (I don't wanna ruin the battery.) Here's a picture of that.
Now you should be able to remove the whole battery and then the battery connector.
The battery is glued to the back plate which also works as a heat sink for the underlying
components, so you have to be very careful not to pull too hard on the battery or you
risk also pulling some components from the PCB. Use some kind of tool to carefully pry the
battery lose, one side at the time.
Secrets under the battery
Thanks to chup in THIS post at MobilaBredband, we find some more secrets
behind the battery.
The first thing that sticks out, is the 5-pad slot. If it's a serial connection,
we only need 3 pads; Rx/Tx/GND. Indeed the square pad is connected
to GND. So what are the other options?
It could be either one of:
1) a set of minimal JTAG terminals according to SW-DP specifications for IEEE P1149.7.
2) a way to shorten something out, like an MDM9200 XO BOOT device option pin.
3) a second set of UART serial connection. We know MDM9200's have more than one...
4) a battery replacement port during assembly, service or factory testing.
Here we can also see the various internal antennas. There are three (3)
strip-line antennas integrated into the plastic parts on the top and the
bottom of the router PCB. Two in the top parts and one in the bottom. On the
top-left of the front/screen side of the PCB, is the connector to what Huawei
call the "Wifi Antenna". Then on the top-left, of the backside of the PCB, we
find what Huawei call the "Diversity Antenna" connectors, while on the
bottom-right, we find the "Main Antenna" connectors. Basically:
Code:
TOP-F "WiFi Antenna" Wifi (~2400 GHz)
TOP-B "Diversity Antenna" <GPS/unknown>
BOT "Main Antenna" Mobile RF (GSM/LTE etc.)
Here we continue to notice that:
The external antenna jack is connected to the mobile "Main Antenna".
The left-hand-side internal RF jack is connected to the "Diversity Antenna".
The right-hand-side internal RF jack may be connected to the "Wifi Antenna",
on the back, or something else...
According to Google, a "Diversity Antenna" is part of an intelligent
multi-antenna system that senses the incoming signals to automatically
select the antenna best positioned to receive it...
A more clear description can be found HERE.
Now, let's wildly speculate about this design. Many phones have their main
antennas in the bottom. Check! Then, since this device was meant to be carried
in the pocket, which mostly means back-pocket, with the screen towards your
body, because of shape. The Wifi signal need to go through your body, and thus
antenna should be on the screen side. Check! Then if you're to recive any
external/GPS signal at all, you'd like the antenna to be pointed on the
outside, which means on the backside of the PCB. Check!
All-in-all, we have 6 antenna connectors!
Beyond the event horizon
Next, you have 4 Torx (T5?) screws around the corners and 2 more behind the
battery, to undo. Then you can gently push into the holes, and the front
screen will hopefully come out (?) and should not have any other attached
connections.
I leave the rest up to you (or to me for a much later date), to fill in the
remaining blanks and post some internal pictures...
In the meantime, you can look at these internal pictures, that I obtained
from the FCC website and searching for FCCID: QIS E589U-512.
Front Side PCB.
As you can see on the front side we the following:
- 2-7 test points
- Chips:
(1) Toshiba TC58NYG1S3C NAND flash chip
(2) Qualcomm
(3)
Back Side PCB.
Here you can see:
- 2 internal RF connectors
- a 4G external RF antenna connector (See one HERE.)
- JTAG pads in typical Huawei layout of 10 pads in line (See HERE)
- Possible UART/Serial islands (5 pads)
< More Dragons TBA >
The NAND Memory
Is a Toshiba TC58NYG1S3C, and according to THIS document, we can decode the Toshiba product code to find:
Code:
[SIZE=2]TC58NYG1S3C
TC58 NY G1 S 3 C
| || | | | +-- 70 nm
| || | | +---- 2 KB page size, 128 KB block size.
| || | +------- 2 Level cells
| || +--------- 2 Gbit = [B]256 MB[/B]
| |+------------ 1.8 V
| +------------- NAND
+--------------- Single Chip
[/SIZE]
But the only datasheet I could find HERE, is for the slightly different
TC58NYG1S3 EBAI4 which should be just fine.
The NAND pin assignments
Built-in GPS capability!
It all started when I noticed that my router showed "GPS" as part of the interface ports that can be enumerated. Surely enough after playing with the at^setport command, my PC enumerated a "HUAWEI Mobile Connect - 3G GPS Interface" serial interface. However, I did not see anything on this, but then again I'm not sure how to use it properly either. So...
After having looked at my router using QXDM, I noticed there were GPS messages in the info logs. Later Googling around and a brief chat with vve (from gsm-forum), confirms that indeed the MDM9200 has a built-in gpsOne Generation 8 engine. I then found some Qualcomm documents that clearly states that the components (SAW filters etc.) needed for full GPS + GLONASS functionality are "strongly recommended", even if not used/enabled. Here is a picture of that.
In addition, there are (apparently from the bad FCC photo above) 2 internal antenna connectors on the PCB,
that could be related, in addition to the external connector.
However, all this info is little worth without ripping apart my router to see what's actually present inside.
So unless someone else has something to say about this, you'll just have to be patient...
Later, we will see which GPS-related NV-items are set in firmware, if any.
Thanks to autoprime's exhaustive list of NV-items, we can easily find those
only related to the GPS subsystem, HERE.
< more TBA >
Huawei firmware numbering system / description
How does Huawei classify their firmware versions/revisions?
Well, let's have a look at my own example. My firmware is:
11.433.13.00.01
We that that it consists of 5 sets of numbers. These can be described as:
Code:
[SIZE=2]
"[B]11[/B]" - is for [I]Qualcomm [/I]based devices ([B]23[/B] for [I]HiSilicon[/I])
"[B]433[/B]" - is the firmware [I]Build [/I]version:
Same HW platforms generally use the same builds. For example:
All MDM9200-based modules: E392u, E397u, E398u, EM920u, EM930u etc.
"[B]13[/B]" - is the [I]Debug[/I][/SIZE][SIZE=2][SIZE=2] version and prefixed by "D"[/SIZE] in FW updates.
"[B]00[/B]" - probably [I]Service Pack[/I] version and prefixed by "SP" in FW updates.
"[B]01[/B]" - Network Operator / [I]Carrier[/I] Customization. ("00" = No customization.)
[/SIZE]
[Many thanks to VVE (from GSM-Forum) for this info.]
Similarly for firmware updates. For example:
Code:
[SIZE=2]HUAWEI_E589u-12_[B][COLOR=Red]V[/COLOR][/B]100[COLOR=Red][B]R[/B][/COLOR]001[B][COLOR=Red]B[/COLOR][/B]433[B][COLOR=Red]D[/COLOR][/B]15[B][COLOR=Red]SP[/COLOR][/B]02[B][COLOR=Red]C[/COLOR][/B]260_Finland (Elisa)_05021CTE.zip
Just add "Version" after each:
V = Version
R = Release
B = Build
D = Debug
SP = Service Pack
C = Customization [/SIZE]
Huawei Carrier Customization Codes
The firmware distributed by Huawei for use on their 3G/4G mobile wifi routers
(MiFi) and dongles, are usually customized by each of the mobile service
provider that sell them. Here we attempt to list all the customization codes
used by Huawei, so that we can better understand the many variations that are
purely firmware dependent versus hardware dependent.
According to belief, a customization code of "00" refer to no-customization,
in other words it should be original "vanilla" Huawei firmware.
So far we have:
Code:
[SIZE=2]code Provider Country
--------------------------------------
00/000 <na> <na>
01 Netcom Norway
07 Telia Sweden
08 MTN SA
16 KPN Holland
18 TME Spain
24 H3G Sweden
26 H3G Denmark
43 Etisalat UAE
55 DT Germany
56 Tele2 Sweden
58 Optimus Portugal
61 Cosmote Greece
69 Polkomtel Poland
74 Optus Australia
77 Telenor Hungary
78 T-Mobile Hungary
84 TMN Portugal
87 Mobitel Slovenia
99 Maxis Malaysia
110 Entel Chile
115 Nawras Oman
132 Utel Ukraine
136 Nova Island
141 Batelco Bahrain
143 MTS Russia
149 Vivo Brazil
151 Channel?? India
157 PCCW HK
158 Globe Philippines
161 Beeline Russia
174 Kyivstar Ukraine
180 Orange Spain
186 Zain Kuwait
192 TIM Italy
203 M1 Singapore
209 MegaFon Russia
222 MTS Ukraine
228 Personal Argentina
238 Smart Philippines
253 Personal Paraguay
260 Elisa Finland
272 Mobinil Egypt
284 Airtel India
309 Bytel France
349 Telia Denmark
362 MoldCell Moldova
388 Life Ukraine
391 Tele2 Russia
397 KTC Kuwait
400 OM* UK
409 Mobistar Belgium
422 Telenor Sweden
436 Omantel Oman
464 Telus Canada
479 Bytel France
570 UNE Colombia
577 Beeline Kazakhstan
618 Polsat Poland
622 "SFR" ??
626 Orange Uganda
632 STC Bahrain
634 MTS Uzbekistan
673 Altel Kazakhstan
697 MTN SA
778 OM* Russia
801 A1TA Austria
838 Global Saudi Arabia
883 Beeline Uzbekistan
991 MTC(Zain) Lebanon
1020 iinet Australia
1047 Orange France
1049 Eastlink Canada
1050 USCC ?? US
1055 EE UK
1062 Orange France
1064 OM* Norway
1099 OM* US
1102 20/20 ?? Sweden
1129 A&C Belgium
1134 OM* "Baltic Region"
1158 Spectranet Nigeria
--------------------------------------
OM* = "Open Market" and possibly without customization
UAE = United Arab Emirates
UK = United Kingdom
US = United States
HK = Hong Kong
SA = South Afrika
--------------------------------------
[/SIZE][SIZE=2]
[/SIZE]
AT^RDCUST: Analysis & Research
Most Qualcomm based 3G/4G Huawei devices have this special proprietary command that you will not find documented anywhere! So I decided to take the first steps in that direction. The typical output from that command look like this:
Code:
[SIZE=2]at^rdcust=?
(0: 0) (1: 0) (2: 0) (3: 0) (4: 0) (5: 0) (6: 0) (7: 0) (8: 0) (9: 0)
(10: 0) (11: 0) ([B]12: 1[/B]) (13: 0) (14: 0) (15: 0) (16: 0) (17: 0) (18: 0) (19: 0)
(20: 0) (21: 0) (22: 0) ([B]23: 1[/B]) [B]---?---[/B] ([COLOR=Red]25: 0 0[/COLOR]) (26: 0) (27: 0) ([COLOR=Red]28: 1 1[/COLOR]) (29: 0)
[/SIZE]
We see that items 25 and 28 are special as they return two numbers, while item
24 is missing altogether. So far we understand that rdcust consists of a
table of ID's (probably the ones above). Some of these items in the table has
an NV-item associated.
So from poking around in the firmware, I composed the following table.
Code:
[SIZE=2]-------------------------------------------------------------------------------------------------------
Item Function (allow/change/forbid) Source NV-item/Comment
-------------------------------------------------------------------------------------------------------
0 Replace Firmware Version rdcust_version_replace.c "00.000.00.00.00"
1 ?Forbid 2G registration rdcust_efust_disable.c
2 Forbid AT^CURC type/port rdcust_forbid_curc.c
3 Change Mean TPT Size rdcust_mean_tpt_size.c "Token Passing Tree"? (Ad-Hoc Wifi)
4 Change MTU size rdcust_mtu_size.c
5 Replace Product ID (PID) rdcust_product_id_replace.c
6 Change APN values rdcust_apn_set.c
7 Disable Video Calls rdcust_disable_video_call.c
8 Change USSD Mode rdcust_ussd_mode.c
9 Change? Full Frequency Scan rdcust_full_freq_scan.c
10 ? LED Light rdcust_led_light_cust.c
11 Exclusive Cardlock rdcust_exclusive_cardlock.c nv_huawei_specail_simlock_ind NV
[B]12 Huawei Special SIM lock [/B] rdcust_egy_cardlock.c
13 Permanent Cardlock rdcust_permanent_cardlock.c
14 Class-0 SMS Route rdcust_class0_sms_route.c calss0_sms_route NV
15 Roaming HPLMN (count?) rdcust_not_roam_plmn.c
16 Diasble RPLMN (PME?) rdcust_disable_rplmn_act.c RDCUST_DISABLE_RPLMN_ACT
17 Change GPRS Recent Activity Timer rdcust_gprs_recent_activity_timer.c
18 Change Default Traffic Class rdcust_default_traffic_class.c
19 Change STK rdcust_stk.c
20 Huawei Manual 3G? band Search Order rdcust_manual_srch_order_3.c NV_HUAWEI_MANUAL_BAND_SRCH_ORDER_I
21 Current ^SYSCFGEX Mode List rdcust_syscfgex_mode_list.c nv_syscfgex_mode_list NV
22 Get/Set Attach PDP Parameters rdcust_attach_pdp.c ..Inactivity timer, and also EFS related..
[B]23 Disable F-DPCH (WCDMA)[/B] rdcust_disable_fdpch.c NV-item?
[COLOR=Purple]24 Huawei IPV4 and IPV6 Configuration[/COLOR] rdcust_ipv4v6_cfg.c
[COLOR=Red]25* ? Modified UI Network PLMN[/COLOR] rdcust_uinetwk_plmn_modified.c
26 [1] GID1 Customer Forbid Band rdcust_forbid_band.c NV_HUAWEI_CUST_FORBID_BAND_I
27 [1] Start Telus GID1 check rdcust_gid1.c NV_HUAWEI_GID1_I
[COLOR=Red]28* Set HS-DSCH Physical Layer Category [/COLOR] rdcust_set_hsdsch_phy_layer_cat_ext.c
29 [1] Set GID1 LTE Band Preference rdcust_lte_band_pref.c
-------------------------------------------------------------------------------
* Returns 2 digits in E589u-12.
[1] GID1 = "Group Identifier Level 1" and is a type of SIM network
lockout mechanism. The GID1 elementary files on the SIM are
specified in GSM 11.11 (ETS 300 977)
[/SIZE]
Now, the item numbering was completely arbitrary, based on the order of appearance in the firmware. But closer inspection seem to confirm that this is not at all very arbitrary, as the colored items actually seem to confirm what fits the behavior of my device. How so? I don't have IPV4/6 (#24) configured, nor using WCDMA (#23). But hey, I could also be completely wrong here!
It would certainly be interesting to see what exactly items #11 and #12 does, as they're called "Exclusive Cardlock" and "Huawei Special SIM lock", respectively. Could one of these be part of the mysterious QXDM 16-digit password, that can be used to further unlock access to certain EFS files and NV-items?
...
< More TBA >
I like your courage and passion in each your post ! anytime fully documented ..
The Battery
The internal battery is labelled "HB5P1H" and is a 3.7V, 3000mAh (11.1 Wh)
Li-Polymer battery. The battery has 5 lead ribbon connector. Which seem to
indicate that it has an internal programmable charge controller aka "gas gauge".
A typical internal battery design can be seen in THIS (bq27x00) TI datasheet.
So as an initial guess (until tested), the pins on the battery connector
could have the following functions.
Code:
[SIZE=2]pin color signal function
----------------------------------------------
1 red PACK + Battery Positive
2 red SCL I2C Serial Clock Input
3 white GND ground
4 black SDA I2C Serial Data Input
5 black PACK - Battery Minus
[/SIZE]
These type of batteries generally have 5 internal power "modes".
Code:
[SIZE=2]Active During normal ON operation
Sleep Low power mode
Ship Low power mode for shipping
Hibernate Used when Vcc drops below Vpor
Data Retention (RBI) ??
[/SIZE]
A few battery related ATC's...
Code:
[SIZE=2]at^apbatlvl (chargerState,batterylvl)
^APBATLVL:1,4 ==> STATE: 1, LEVEL=4
at^tbat?
^TBAT:2
at^tchrenable=?
^TCHRENABLE:0
at+cbc
+CBC: 0,100
[/SIZE]
< more TBA >
Table of Contents (ToC)
Table of Contents (ToC)
The next steps in looking under the hood of this device, have been rather heavy.
The collection of relevant software, information and analysis of all that above and
below, have been extremely time consuming and suprisingly hard to organize in
a pedagogical and useful manner. Here is a short and partial summary of what
is to come.
The Huawei Modem HackPack
Huawei, Windows Drivers & COM ports...
SD-card sharing: Huawei FAILURE!
Backing the Router Settings
Backing the Router Firmware
- Qualcomm NV-items
- Qualcomm EFS2 (internal file system)
- Huawei/Qualcomm Firmware (internal partitions)
Extracting the router firmware
a) From Huawei firmware update
b) From raw NAND dump
c) From T32 JTAG debugger
d) From 3rd party raw JTAG ram dump
The Web User Interface (Web UI)
The Huawei Mobile Partner Software
Click to expand...
Click to collapse
PLEASE HOLD ANY COMMENTS UNTIL COMPLETE!
(and this message removed)
Huawei Modem HackPack
Version: 0.1
Last Update: 2013-09-26
Here is a collection of some very useful windows tools when dealing with any
Qualcomm-based devices, such as our Huawei.
This HackPack is to be considered a one-time only, as-is download. That means:
I will not maintain it.
I will not update it.
I will not answer any questions about it.
I will not be held responsible if any of the tools mess up your system, wife or life.
I will not keep a copy on my PC for you to send me PM's asking for it.
In fact I will probably not even maintain the download link below, in case it dies.
If I decide otherwise, you will find this post updated.
Download ==> HERE <==
=======================================
All utilities are for 32-bit Windows!
And that's YOUR problem, if any.
=======================================
Package Contents:
Code:
[SIZE=2]3rd party Qualcomm Tools:
CDMA Workshop [3.9.0] [URL="http://www.cdma-ware.com/workshop.html"]HERE[/URL]
DFS CDMA Tool [13.9.19.0] [URL="http://cdmatool.com/download"]HERE[/URL]
RevSkills / PSAS [2.08.6] [URL="http://revskills.de/downloads/revskills.zip"]HERE[/URL] EOL 2013-03-01: [URL="http://tinyurl.com/phpkbca"]HERE[/URL]
MDMA [1.1.0.1] [URL="http://www.nerve.org.za/mdma/index.html"]HERE[/URL] Forum: [URL="http://tinyurl.com/peq9635"]HERE[/URL]
RadioComm [11.12.2] [URL="http://tinyurl.com/pqgg3v3"]HERE[/URL] Download: [URL="http://tinyurl.com/p43a5gp"]HERE[/URL]
3rd party Huawei Tools:
DC-Unlocker Client [1.00.1045] [URL="https://www.dc-unlocker.com/downloads"]HERE[/URL]
Huawei Flasher [1.6] [URL="http://www.francesco-pompili.it/"]HERE[/URL] Download: [URL="http://tinyurl.com/k4z3blr"]HERE[/URL]
Huawei Drivers [[COLOR=Red]4.25.18[/COLOR]] [URL="http://vve.su/vvesu/files/misc/MP/Huawei_Driver_4.25.18.zip"]HERE[/URL]
Windows Utilities (various):
UsbTreeView [2.1.8] [URL="http://www.uwe-sieber.de/usbtreeview_e.html"]HERE[/URL]
SerialMon [?] [URL="http://www.serialmon.com/"]HERE[/URL]
SPCA [1.1.1] [URL="http://www.yo3ggx.ro/spca/spca.html"]HERE[/URL] Serial Port Communication Analyzer
vspd [7.1.289] [URL="http://www.eltima.com/products/vspdxp/"]HERE[/URL] Virtual Serial Port Driver
com0com [3.0.0.0] [URL="http://sourceforge.net/projects/com0com/"]HERE[/URL] Null-modem emulator
ReAssignCOMPortNumb.exe [1.0.0.0] [URL="http://www.ftdichip.com/Support/Utilities/Reassign%20COMNo%20Utility.zip"]HERE[/URL]
Windows Utilities (Nirsoft):
USBDeview [2.27] [URL="http://www.nirsoft.net/utils/usb_devices_view.html"]HERE[/URL]
DevManView [1.35] [URL="http://www.nirsoft.net/utils/device_manager_view.html"]HERE[/URL]
DriverView [1.45] [URL="http://www.nirsoft.net/utils/driverview.html"]HERE[/URL]
DeviceIOView [1.02] [URL="http://www.nirsoft.net/utils/device_io_view.html"]HERE[/URL]
RegFromApp [1.30] [URL="http://www.nirsoft.net/utils/reg_file_from_application.html"]HERE[/URL]
RegScanner [2.01] [URL="http://www.nirsoft.net/utils/regscanner.html"]HERE[/URL]
Data:
nv_complete.zip [2013-06-07] [URL="http://forum.xda-developers.com/showthread.php?t=1954029"]HERE[/URL]
[/SIZE]
Additional Links:
Code:
QPST [2.7.402] Download [URL="http://tinyurl.com/oggkkz6"]HERE[/URL]
QXDM-winxp [3.12.714] Download [URL="http://tinyurl.com/nkvv636"]HERE[/URL]
USBlyzer [2.0] Download [URL="http://www.usblyzer.com/files/USBlyzer.zip"]HERE[/URL]
Putty [beta 0.63] Download [URL="http://www.chiark.greenend.org.uk/~sgtatham/putty/"]HERE[/URL]
RealTerm [2.0.0.70] Download [URL="http://sourceforge.net/projects/realterm/"]HERE[/URL]
Huawei Mobile Partner[COLOR=Red]**[/COLOR] [23.009.05.03.1014] Download [URL="http://www.huaweidevice.com/mpartner"]HERE[/URL]
** NOTE:
This version is using the older (4.25.10.00) Huawei drivers.
So if you want to use this, install this first, and then the new driver package.
There is an update on that link, but it is not clear what it does.
Click to expand...
Click to collapse
Huawei, Windows Drivers & COM ports...
First Connections
Connecting your E589 to a windows box, for the first time, will enumerate a couple of (possibly old default windows) drivers. This of course depends on what you have installed and used before. As I have never used any Huawei device before, all I got was something like this. "Something", because I don't remember exactly what was there, since I tried to use the DC-Unlocker Client to get some device info.
Initially the only thing I could see in the windows Device Manager was this:
Code:
[SIZE=2]DeviceType VID:PID Description
-------------------------------------------------------------------
USB Mass Storage Device 12d1:1f01 Router SD card slot
[/SIZE]
However, when using DC-Unlocker Client to find the modem, it seem to find and/or install its own drivers and ended up enlist the following, as shown
in Device Manager under "Ports (COM/LPT)" as:
Code:
[SIZE=2]Device Name VID:PID SYS INF Ver Date
---------------------------------------------------------------------------------------------------------
FC - Application Interface 12d1:1442 FcSerial.sys oem214.inf 2.0.6.705 1/17/2012
FC - PC UI Interface 12d1:1442 FcSerial.sys oem214.inf 2.0.6.705 1/17/2012
G:\ wpdfs.inf 6.0.6002.18112 6/21/2006
Huawei SD Storage? 12d1:1f01 disk.sys wpdfs.inf 6.0.6002.18005 6/21/2006
[/SIZE]
This is much better, but not at all satisfying. So I proceeded to install the proper Huawei Device Drivers (see HackPack). After rebooting machine (and/or selecting the drivers when asked), I got these:
Code:
[SIZE=2]Device Name VID:PID INF InfSec Ver Date
-----------------------------------------------------------------------------------------------------------------------------------------
HUAWEI Mobile Connect - 3G Modem 12d1:1001 oem204.inf Modem0.NT 2.0.6.720 3/19/2013
HUAWEI Mobile Connect - 3G Application Interface 12d1:1001 oem203.inf QportInstall00.NT 2.0.6.720 3/19/2013
HUAWEI Mobile Connect - 3G PC UI Interface 12d1:1001 oem203.inf QportInstall01.NT 2.0.6.720 3/19/2013
[/SIZE]
What happened to my SD card and storage device!? Nobody knows, but enabling the hidden view in Device Manager, eventually helped... Doing some studying of the Huawei AT command set led me to connecting to the modem via terminal (Putty) and issue the following AT commands:
Code:
at^sfm=1
at^setport="FF;1,2,3,A2"
Disconnect, and reboot router, and reconnect. BAM! There they are:
Code:
[SIZE=2]Device Name Drive VID:PID SYS INF InfSec Ver Date
-----------------------------------------------------------------------------------------------------------------------------------------
HUAWEI Mobile Connect - 3G Modem 12d1:1413 modem.sys oem204.inf Modem0.NT 2.0.6.720 3/19/2013 USB\VID_12D1&PID_1413& MI_00 \6&39cbb52c&0& 0000
HUAWEI Mobile Connect - 3G Network Card 12d1:1413 ewusbnet.sys oem205.inf qcwwan.ndi 1.0.4.017 2/17/2013 USB\VID_12D1&PID_1413& MI_01 \6&39cbb52c&0& 0001
HUAWEI Mobile Connect - 3G Application Interface 12d1:1413 ewusbmdm.sys oem203.inf QportInstall00.NT 2.0.6.720 3/19/2013 USB\VID_12D1&PID_1413& MI_02 \6&39cbb52c&0& 0002
HUAWEI Mobile Connect - 3G PC UI Interface 12d1:1413 ewusbmdm.sys oem203.inf QportInstall01.NT 2.0.6.720 3/19/2013 USB\VID_12D1&PID_1413& MI_03 \6&39cbb52c&0& 0003
HUAWEI Mobile Connect - 3G GPS Interface 12d1:1413 ewusbmdm.sys oem203.inf QportInstall01.NT 2.0.6.720 3/19/2013 USB\VID_12D1&PID_1413& MI_04 \6&39cbb52c&0& 0004
HUAWEI Mass Storage USB Device G: 12d1:1413 USBSTOR.SYS 6.0.6002.18005 USB\VID_12D1&PID_1413& MI_05\6 &39cbb52c&0& 0005
HUAWEI SD Storage USB Device H: 12d1:1413 USBSTOR.SYS 6.0.6002.18005 USB\VID_12D1&PID_1413& MI_06\6 &39cbb52c&0& 0006
[/SIZE]
9 new drivers and they smell fresh! The info above was obtained by playing around with the USBDeview (from HackPack). Very useful when you have USB driver issues. We can also list the available ports by issuing the following AT command:
Code:
[SIZE=2]at^getportmode
^GETPORTMODE:TYPE:WCDMA:Qualcomm,MDM:0,NDIS:1,DIAG:2,PCUI:3,GPS:4,CDROM:5,SD:6
[/SIZE]
Tracking Down Windows Driver Issues
The best way to resolve windows device/driver issues is to first being able to see what drivers are already installed and available. Problem is that windows defaults to hiding drivers not used. We will need to remedy this. in order to remove faulty drivers.
There are 3 ways to list hidden devices in device manager.
(a) Set a permanent environment variable.
(b) Use a temporary environment variable in a command shell and
open Device Manager from within that shell.
(c) Make a simple permanent change to your registry.
The best way (from HERE) is (c) :
Open Registry Editor.
In Registry Editor, navigate to the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
Create the following value (DWORD):
devmgr_show_nonpresent_devices
Change it's value to 1. Close Regedit.
Kill and restart Windows Explorer or just reboot.
But if you want to try this first, use (b):
Open a command window.
Type "set DEVMGR_SHOW_NONPRESENT_DEVICES=1" without the quotes at the command line then press enter.
Type "devmgmt.msc" without the quotes at the command line then press enter.
Under the "View" menu click on "Show hidden devices".
Navigate to "Ports (COM & LPT)" and there should be many more devices listed and can be removed with a simple right click uninstall.
Some of the Nirsoft tools in the HackPack can do some of this automatically...
You'll be surprised how much driver junk you will find in your machine after only a year...
Too Many COM Ports
It's quite annoying that every time you change USB port on your Windows box, the Device Manager insists on re-installing the drivers for that device and give them a new COM port! You'll endup having several dozens of COM ports in a short time. The very small and nice FTDI utility in the HackPack allow you to easily re-assign the COM ports to where ever you like. And you can use some of the other utilities to remove device drivers that are using old/other COM ports.
SD-card sharing: Huawei FAILURE!
It is not clear from the instructions that came with the router, what the
exact intended function of an internal SD card would be. But from looking at
other Huawei Mifi routers, it seem to be that one should be able to "share"
the microSD card data in such a way, that anyone connected to the router
should be able to open the web interface to up/download files. However, this
"feature" as it is marketed for the E589, is not available. I have tried
pretty much everything apart from throwing it against the wall, and still no
sign of a working SD card-reader connection in the web-interface, even though
the SD-card is recognized in Window's Device Manager when connected via micro
USB cable. So WTF Huawei!?
Here are 2 pictures of a working interface for the E5776. This is exactly the same
as for the E589u-12, but without the "Sharing" tab enabled.
And here's the actual "sharing" settings page...
So now you think, whoa, no reason for it to work on a different device...right? Wrong!
By poking around in the firmware, I know the "interface" is in there. In fact it is over here:
http://192.168.1.1/html/sdcardsharing.html
However, it is not enabled and does not register my SD card for some reason,
and any clicking on this page results in an error. It seem that the web server
content for this "feature" has been disabled somewhere. We need to find where
and why, and then try to fix it by flashing a new hacked EFS filesystem.
So what would it take to accomplish this?
Answer: Something like this.:
Inspect the HW to make sure SD is connected as it should.
Status: Most likely OK, since already recognized by PC.
Inspect the web-interface and web-server settings, to make sure it has the intended support.
Status: WIP
Partial reverse engineering of the firmware, to make sure it's able to support this "feature".
Status: To do.
Extract the EFS2 to get all the required files and modify as needed.
Status: Partially done. Protected EFS still need to be extracted.
Re-flash modified EFS.
Status: Should be easy, unless EFS files are signed!
A first step is to inspect the JavaScript code, doing all the web serving. Playing around with
the interface, we immediately find the following potential problems:
For example they use iframe's which have been known to be browser dependent, in the past,
and some of the critical variables are disabled and possibly wrong.
sdcard.js
Code:
[SIZE=2]...
var SD_STATUS_DISABLE = '0';
var SD_NO_FORMATED = '2';
var SD_SHARE = '1';
var SD_NOSHARE = '0';
var SD_WEB_SHARE = '[B]0[/B]'; <-- [COLOR=Red]Is this correct?[/COLOR]
var SD_USB_SHARE = '1';
var SD_ACCESS_READ = '[B]0[/B]'; <-- [COLOR=Red]Is this correct?[/COLOR]
var SD_ACCESS_WRITE = '1';
var SD_SHARE_ALL_FILE = '0';
var SD_SHARE_CUSTOM_FILE = '1';
var SD_ROOT_DIRECTORY = '[B]tffs0b[/B]'; <-- [COLOR=Red]Is this correct?[/COLOR]
var FILE_LIST_TYPE_FOLDER = '0';
var FILE_LIST_TYPE_FILE = '1';
var LOGIN_STATE_NOMAL = '0';
var LOGIN_STATE_ERROR = '1';
...
[/SIZE]
Then, when loading the following EFS file:
Code:
EFS2 location: hdev/ftl1h0p1/WebApp/common/api/sdcard/sdcard
web-server: http://192.168.1.1/api/sdcard/sdcard
in the browser, we obtain the result:
Code:
[SIZE=2]<?xml version="1.0" encoding="utf-8"?>
<response>
<sdcard>
<SDShareMode>0</SDShareMode> [COLOR=Red]<-- Is this correct?[/COLOR]
<SDCardShareStatus>1</SDCardShareStatus>
<SDShareFileMode>1</SDShareFileMode>
<SDAccessType>1</SDAccessType>
<SDSharePath>/music</SDSharePath> [COLOR=Red]<-- Is this correct?[/COLOR]
<SDCardStatus>1</SDCardStatus>
</sdcard>
</response>
[/SIZE]
As you can see, these were only 2 files out of hundreds...
But before we go any further, it is wise to backup everything possible. That means
the default router web UI settings, internal router firmware and the router's internal
chip/factory settings, known as NV-items, in case it is a Qualcomm based chipset.
Backing up the router web UI settings (NV data)
Although, they call this "NV data" backup, it is not the same as backing
up the Qualcomm NV-items used to configure the internal modem processor.
This need to be done from another application such as QPST, CDMA-tools,
or RevSkills etc... Instead, this is only a backup of the router's web user interface (UI).
There are 2 different ways to do this.
One way is to:
Go to the web interface and login. Then navigate to:
Settings --> System --> "Back up and Restore"
Click on "Backup" button.
The other way is this:
Just go to: http://192.168.1.1/nvram.bak to download & save the file.
Then to see the contents which are Base64 encoded, you need to decode
by ignoring non-Base64 characters:
Code:
base64.exe -d -i nvram.bak >nvram.txt
Here's my output with the IMSI, "<custom-dir>" (which are the 8-first digits of the IMSI) and wifi SSID edited out with #'s:
Code:
[SIZE=2]model_verify
start_file
E589u-12
end_file
softversion_verify
start_file
11.433.13.00.01
end_file
dailup_file:
/hdev/ftl1h0p1/userdata/dialup/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<profile_imsi>###############</profile_imsi>
<current_profile>1</current_profile>
</config>
end_file:
profile_list_file:
/hdev/ftl1h0p1/userdata/dialup/profilelist.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<profile>
<index>1</index>
<is_valid>1</is_valid>
<profile_name>NetCom</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username/>
<password/>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
<profile>
<index>2</index>
<is_valid>1</is_valid>
<profile_name>Chess internet</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username>chess</username>
<password>chess</password>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
<profile>
<index>3</index>
<is_valid>1</is_valid>
<profile_name>Vitel</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username/>
<password/>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
</config>
end_file:
lan_config_file:
/hdev/ftl1h0p1/userdata/lan/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8" ?>
<config>
end_file:
firewall_config_file:
/hdev/ftl1h0p1/userdata/firewall/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<fwswitch>
<firewallwanportpingswitch>0</firewallwanportpingswitch>
<firewallipfilterswitch>0</firewallipfilterswitch>
<firewallmainswitch>0</firewallmainswitch>
</fwswitch>
</config>
end_file:
ipfilter_file:
/hdev/ftl1h0p1/userdata/firewall/ipfilter.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<ipfilters>
<ipfilter>
<lanipfilterprotocol>0</lanipfilterprotocol>
<lanipfilterstatus>0</lanipfilterstatus>
<lanipfilterlanstartaddress/>
<lanipfilterlanendaddress/>
<lanipfilterlanstartport>0</lanipfilterlanstartport>
<lanipfilterlanendport>0</lanipfilterlanendport>
<lanipfilterwanstartaddress/>
<lanipfilterwanendaddress/>
<lanipfilterwanstartport>0</lanipfilterwanstartport>
<lanipfilterwanendport>0</lanipfilterwanendport>
<lanipfiltersrcstartipmask>0</lanipfiltersrcstartipmask>
<lanipfilterdeststartipmask>0</lanipfilterdeststartipmask>
<lanipfilterpolicy>0</lanipfilterpolicy>
</ipfilter>
... [several more]
</ipfilters>
</config>
end_file:
specialapp_file:
/hdev/ftl1h0p1/userdata/firewall/specialapp.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<lanports>
<lanport>
<specialapplicationtriggername/>
<specialapplicationtriggerport>0</specialapplicationtriggerport>
<specialapplicationtriggerportend>0</specialapplicationtriggerportend>
<specialapplicationtriggerprotocol>0</specialapplicationtriggerprotocol>
<specialapplicationstartopenport0>0</specialapplicationstartopenport0>
<specialapplicationendopenport0>0</specialapplicationendopenport0>
<specialapplicationstartopenport1>0</specialapplicationstartopenport1>
<specialapplicationendopenport1>0</specialapplicationendopenport1>
<specialapplicationstartopenport2>0</specialapplicationstartopenport2>
<specialapplicationendopenport2>0</specialapplicationendopenport2>
<specialapplicationstartopenport3>0</specialapplicationstartopenport3>
<specialapplicationendopenport3>0</specialapplicationendopenport3>
<specialapplicationstartopenport4>0</specialapplicationstartopenport4>
<specialapplicationendopenport4>0</specialapplicationendopenport4>
<specialapplicationtriggerstatus>0</specialapplicationtriggerstatus>
<specialapplicationopenprotocol>0</specialapplicationopenprotocol>
</lanport>
... [several more]
</lanports>
</config>
end_file:
virtualserver_file:
/hdev/ftl1h0p1/userdata/firewall/virtualserver.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<servers>
<server>
<virtualserveripname/>
<virtualserverstatus>0</virtualserverstatus>
<virtualserverremoteip/>
<virtualserverwanport>0</virtualserverwanport>
<virtualserverwanportend>0</virtualserverwanportend>
<virtualserverlanport>0</virtualserverlanport>
<virtualserveripaddress/>
<virtualserverprotocol>0</virtualserverprotocol>
</server>
... [several more]
</servers>
</config>
end_file:
device_config_file:
/hdev/ftl1h0p1/userdata/firewall/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<fwswitch>
<firewallwanportpingswitch>0</firewallwanportpingswitch>
<firewallipfilterswitch>0</firewallipfilterswitch>
<firewallmainswitch>0</firewallmainswitch>
</fwswitch>
</config>
end_file:
device_config_file:
/hdev/ftl1h0p1/userdata/device/config.xml
start_file:
<?xml version="1.0" encoding="utf-8" ?>
<config>
</config>
end_file:
global_config_file:
/hdev/ftl1h0p1/userdata/global/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<custom_dir>########</custom_dir>
</config>
end_file:
webserver_config_file:
/hdev/ftl1h0p1/userdata/webserver/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
end_file:
wifi_config_file:
/hdev/ftl1h0p1/userdata/wifi/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<wifiwps>
<wpspin></wpspin>
</wifiwps>
<wifisec>
<WifiRestart>0</WifiRestart>
<wifiwpscfg>1</wifiwpscfg>
<wifiwpsenbl>1</wifiwpsenbl>
<wifiwepkeyindex>1</wifiwepkeyindex>
<wifiwpaencryptionmodes>MIX</wifiwpaencryptionmodes>
<wifibasicencryptionmodes>NONE</wifibasicencryptionmodes>
<wifiauthmode>WPA/WPA2-PSK</wifiauthmode>
<wifiwpapsk>10234873</wifiwpapsk>
<wifiwepkey4>34873</wifiwepkey4>
<wifiwepkey3>34873</wifiwepkey3>
<wifiwepkey2>34873</wifiwepkey2>
<wifiwepkey1>34873</wifiwepkey1>
</wifisec>
<wifibasic>
<WifiRestart>1</WifiRestart>
<wifiprotectionmode>0</wifiprotectionmode>
<wifipamode>0</wifipamode>
<wifiwme>1</wifiwme>
<wifibcnintvl>100</wifibcnintvl>
<wifidtmintvl>1</wifidtmintvl>
<wifirtsthrshld>2347</wifirtsthrshld>
<wififrgthrshld>2346</wififrgthrshld>
<wifitxpwrpcnt>128</wifitxpwrpcnt>
<wifiofftime>600</wifiofftime>
<wifioffenable>0</wifioffenable>
<wifiisolate>0</wifiisolate>
<wifimaxassoc>10</wifimaxassoc>
<wifirate>0</wifirate>
<wifimode>b/g/n</wifimode>
<wificountry>NO</wificountry>
<wifihide>0</wifihide>
<wifichannel>0</wifichannel>
<wifienable>1</wifienable>
<wifissid>###-############</wifissid>
</wifibasic>
</config>
end_file:
upnp_config_file:
/hdev/ftl1h0p1/userdata/upnp/config.xml
start_file:
<?xml version="1.0" encoding="utf-8"?>
<config>
</config>
end_file:
[B]<checksum>29905063</checksum>[/B]
[/SIZE]
At the very end of the file, you find a "checksum" tag like this:
Code:
<checksum>29905063</checksum>
I don't know how this checksum is calculated. (Anyone?) But I think it could be some kind of CRC of the contents previous to, and above the tag.
The eagle-eyed would also have noticed the lack of the closing "</config>" tag for the "lan_config_file:". Could this influence the SD-card sharing problems?
Backing up the router Firmware
Now, this is the place where siht is starting to get real. The main problem is that Huawei
has blatantly abandoned their device support, in pursuit for a more profitable build-sell-and-forget
strategy. Just what we're used to Samsung doing! So we're left in the dust of greed, to fight for
ourselves. The firmware for this device is nowhere to be seen in the wild apart some occasional
JTAG dumped fakes, behind some far-east pay-walls. So we have to resort to our own back-to-basics
low-level tools. Fortunately, Qualcomm is on our side, with occasional document leaks and
various OEM tools. Let's see what we can do with them and what need to be done.
Basically, the "firmware" (FW) consists of several parts.
The raw CP firmware code containing the RTOS.*
The raw AP (here UI) firmware code containing the APPS OS.*
The factory hardware settings, containing chip specific configuration data.
E.g. Qualcomm MDM9200 + related chipset data.
The OEM (Huawei) hardware settings, containing device design specific configuration data.
E.g. microSD-card, display, USB and antenna/band settings.
The Carrier customization settings, that determines the available/allowed networks,
bands and carriers, including the web-interface and server.
* Note that in our E589, (1) and (2) are the same as there is no real AP nor UI. That means all
UI-like (display and web-UI) operations are happening in (1), the modem itself.
Parts (1) and (2) are generally stored on the eMMC in separate partitions, while parts (3-5) are redundantly stored on one or more partitions, using a special (virtual) file system called Embedded File System, EFS2. This is not a real FS, in the low-level HW sense. Within this EFS, are all the parameters and settings required for normal operation of the device, including the web-server and UI filesystem. That means (in our case), that we have the following:
all IMEI/IMSI and carrier data
web-server and UI data
all RF related parameter data
most/all of AP/CP/PMIC/WiFi/BT/NFC low/chip-level parameters
carrier customization configuration
etc etc
However, most of the data and parameters that are not directly part of the web-interface, are stored in a number of proprietary Qualcomm Non-Volatile (NV) items, the "NV-items". Each individual NV-item is usually stored in its own separate file in the EFS under the "nv" directory. They can have names or simply numbers, depending on OEM and NV-item values. To simplify the loading, editing, backup and restore of these, Qualcomm uses a special file format, called a QCN file. Special tools like, QPST, QXDM etc, are used to create, edit, compare, merge or upload these files to the device. We will look in more detail at these tools later.
The important thing here, is that we want to backup both the full EFS and the QCN file for easy access. Later we'll attempt to make a low-level (partion-level) backup, of the rest of the internal firmware, in case something would go wrong or if we would need a more low-level RTOS firmware modification.
< WIP >
Backing up the EFS
There are several ways to backup the EFS2, internal filesystem.
Qualcomm QPST
Qualcomm QXDM
RevSkills
< tba >
One way to backup the EFS2, is to use the QPST plugin, "EFS Explorer".
a) Open QPST and connect your phone
b) Go to: menu > EFS Explorer
c) In the new EFS Explorer window, ...
d) < tba >
e) Send your SPC, normally "000000" for unlocked modems.
f) ...
This will also generate the EFS logfile "efs.log". This is a text-file that contains all filenames part of the backup. Here you will not only find the path to all XML configuration files, JavaScript, nv/item_files/ and manuals etc, but will also be very useful to show you what URL's are available through the router web-UI.
HERE is the entire list, with some edits for readability.
We'll discuss the details of this in a later post about the web-UI and API.
Incomplete EFS Backup
Backing up your EFS in this way, will not allow you to get all items. Some of the EFS files containing crucial HW specific data are read/write protected. These protected folders are shown in EFS Explorer as crossed out, like this:
I have not yet figured out how to get these out in a simple way, without having to resort to more advanced methods, as mentioned later.
Please send me a PM if you know how!
< WIP >
The Huawei E589u-12 Firmware is here!
Thanks to some very helpful GSM-forum members, we now have 3 different
firmware versions for our 4G MiFi router. Here they are:
Code:
[SIZE=2]MDM9200Update_11.433.14.01.[B]1064[/B].B788.exe <none> (Norway) [URL="http://d-h.st/4Lj"]HERE[/URL] (15.33 MB) [URL="http://tilbehor.emcom.no/download/Huawei/E589/MDM9200Update_11.433.14.01.1064.B788.exe"]original[/URL]
MDM9200Update_11.433.15.01.[B]673[/B].B788.exe Altel (Kazakhstan) [URL="http://d-h.st/fo3"]HERE[/URL] (15.08 MB) [URL="http://vve.su/vvesu/files/misc/E589/MDM9200Update_11.433.15.01.673.B788.exe"]original[/URL]
MDM9200Update_11.433.15.00.[B]422[/B].B788.exe Telenor (Sweden) [URL="http://d-h.st/lea"]HERE[/URL] (15.27 MB) [URL="http://www.telenor.se/published_images/MDM9200Update_11.433.15.00.422.B788.zip"]original[/URL][/SIZE]
These have been compressed with 7zip.
[UPDATE: 2014-01-05]
We have now many more E589 firmwares available HERE at the Russian 3ginfo site. They are:
Code:
Huawei E589 11.433.15.00.375 Zain +sdimage
Huawei E589 11.433.15.01.115 Nawras +sdimage
Huawei E589 11.433.15.01.157 PCCW +sdimage
Huawei E589 11.433.17.01.260 Elisa
Huawei E589u-12 11.433.14.02.990 OpenMarket
Huawei E589u-12 11.433.14.02.1055 EE +sdimage
Huawei E589u-12 11.433.15.00.158 Globe +sdimage
Huawei E589u-12 11.433.15.00.422 Telenor +sdimage
Huawei E589u-12 11.433.15.01.673 Altel +sdimage
Huawei E589u-12 11.433.15.02.260 Elisa +sdimage
Huawei E589u-12 11.433.15.03.1020 iinet +sdimage
Huawei E589u-12 11.433.15.04.192 Tim
Huawei E589u-512 11.433.19.00.228 Personal +sdimage
Huawei E589u-512 11.433.19.00.256 Personal
Huawei E589u-512 11.433.99.51.000.B730 normal
Some of these include a mysterious file: SDimage.BIN (~44 MB)
I don't know what it does, but hope that perhaps it could fix the SD-card sharing problem. Please post if you have any idea!
WARNING
Do not randomly flash these to your modem.
These have not yet been tested and confirmed to work.
They are just for your convenience in case you have
a dead router or other serious problem. I will not be
held responsible for what happens, if you do.
Most likely they will completely change the LTE-band availability,
depending on the carrier it was originally meant for. Perhaps
we will see later what exact bands and features they have.
See post#7 for more Huawei firmware descriptions.
Hi just wondering, how you able to hack Japan E-mobile's Huawei GL04P LTE mifi? Im trying to get it work with other country's LTE network. Currently only 3G is able to.
I would really guess that the two reds are both connected to battery+ and the two blacks to battery-.
That leaves one pin leftover.
I'd guess that it is a standard 10K NTC thermistor.
It would be easy enough to measure the resistance of the white to the black.
I2C would be cute, but how could it have that?
Your work is awesome!!!!
I've only one question... I would like reboot this router with some scripts, or similar (curl, telnet,lynx..),,, Did you find any tips?
Thank you!
Related
Hello, I am a Treo 650 guy and have made a lot of progress in hacking various aspects of the phone, including custom roms, dun, and several others. However most all of these hacks have been accomplished without the bootloader. I have found the bootloader on the phone is known as the Sausalito Bootloader and is a spin-off of HTC's many. It appears to offer a similar list of commands:
Bootload Start
pmsys =0xA171A808
HTC Sausalito Bootloader Version : BOOTLOAD V0.24
Built on Apr 14 2005 at 15:
Copyright (c) 2003 High Tech Computer Corporation
++Check BT Router
>>?
Available monitor commands are:
? [command]
h [command]
mb [StartAddr [Count [Filler]]] --- Display/Set memory
mh [StartAddr [Count [Filler]]] --- Display/Set memory
mw [StartAddr [Count [Filler]]] --- Display/Set memory
l [pathname] --- Start a BIN file download via MTTY
lr [pathname] --- Same as above, but run it when complete
tftp --- Start a BIN file download via tFtp
flashtest --- This appears to try writing to every byte of memory, it will kill a phone!
jump [addr] --- Jump to a memory address
touch --- Touch Screen Test
touchssp --- Touch SSPx panel test??
idle --- Put the CPU into idle state
sense --- Put the CPU into sense state
standby --- Put the CPU into standby state
sleep --- Put the CPU into sleep state
deepsleep --- Put the CPU into deepsleep state
fcs [CLKCFG] --- Alter the CPU freq.
keytest --- Keypad test
pi2ctest --- Power I2C bus tests
debug
flashtype 0 (or 1)
rdoc 0(IPL)/1(SPL)/2(XIPKERNEL)/3(BINFS)
os
upload [addr] [size] --- Upload memory to terminal - writes binary to your connection!
pwr [0:normal; 1:idle; 2:standby; 3:sleep; 5:sense;
wpdoc [0/1] KEY
usb --- USB debug mode enable
led [1:LED1; 2:LED2; 3:LED3 ]
r2sd [command]
sd2r
rtask [Type[Value]]
rroute
rtest
rimgdata
jmptoos
pwm
audio
btrouter
vibratortest
audiogsm
audiocdma
dsdoc 1 or 0
gsm460
hwt
gsmdl
---------
However I have found the r2sd and other commands do not work with the palm OS on the phone. They can read the bootloader, but not the operating system. When I flash a custom rom to the phone via the palm programs we use, it is sent as a zip file with a matching md5 checksum. I am looking for a method to restore dead phones via the bootloader as it appears to always remain working to date. However I believe the only method is going to be the same as the Wallaby bootloader patch hack. Using a SD card to write a small program that will act as a reader/writer/and eraser of flash memory.
Can anyone please point me in the right direction? I'm pretty experienced with development, but I've never tried much cross-platform stuff before. Thanks,
Shadowmite
Tutorial Inject on Sprint Samsung Galaxy Tab-P100 SPH
Software:
- QPST 2.7 build 323
- QPST 2.7 build 215
- CDMA Workshop 2.7
Others that need to be prepared as well:
- Number Flexi/Esia/Smartfren ready diinject
- Akey (26 digits) is obtained from the gallery
- PRL (from galeri)
There are 4 steps so that you can use both text and data
- Unlock MSL / SPC CODE
- Setting Akey, MIN and MDN in order to do sms.
- Setting EVDO
- Final Setting
FIRST STEP (UNLOCK MSL / SPC CODE):
- Install the application from the Android Market: connectbot
In the lower left corner to move to the local type in any name and then let the Android will go into a black screen logo $ dng
- Type: getprop ril.MSL
MSN / SPC you I 6-digit code will appear
STEP TWO (SETTING Akey, PRL, MIN and MDN)
1. Install CDMA Workshop
- The first thing to do is to enter Akey, the 26-digit number given by the Custemer service when registering card number.
- How to enter into Gtab Akey must be signed in diag mode -> press # # 8778 # to enter the menu to the MODEM Phoneutil replace PDAto modem
Do not forget in a position Gtab USB debuging (go to settings - application - development - USB debuging)
- Note on the control panel - System - Hardware - Device Manager. Looking at what ports samsung gtab installed, (eg) on COM port 7.
Open Workshop CDMA (CDMA WAS), select (eg) COM 7, and then press CONNECT.
Select READ
- Next you need to unlock Gtab to enter the MSL / SPC to do on the security tab and enter your SPC "6 digits" and press send, after a statement that HP can be unlocked then you are ready to enter Akey.
- In the CDMA workshop, typing or copy and paste the 26 digits Calculator Akey Akey on like the image above in the Dec, only 20 digits will be accepted Dec. text box is.
- Then automatically on Colom will appear Akey Hex Hex, you can check whether Akey terrsebut ESN is correct by entering the column and then click calc ESN, the checksum will pop up the last 6 digits of your 26-digit Akey, if true, then the Hex Akey already ready to use, copy and paste from the column Hex to Colom-Akey Cave and select write.
- your akey has been wrote on your device
2. Install QPST 2.7 build 3.2.3, plug into your PC and open Gtab QPSTConfiguration program.
- Select Add New Port, and select COM 7 (eg) corresponding config on CDMA WAS
- Select the Start Clients, select SERVICE PROGRAMMING and select an active phone
- Tap OK in the Phone Selection
- Click READ FROM PHONE, press OK if MSL Code appears.
On the Settings tab,
Slot Cycle Index: 2
Current NAM: NAM1
Auto NAM: unchecked
In Tab CDMA, fill in the following parameters:
NAM Name: Flexi
Directory #: No MDN (no flexi complete with area code, but the writing without the written numbers from 0 eg 02144445555 2144445555)
AOC: 2
CDMA
- MCC: 510
- 11_12: 00
- IMSI_S: No MIN (same as no MDN)
- Registration terminated (Checked All - Home SID - SID Foreign Foreign NID)
- Primary Channel A: 119
- Channel Primary B: 384
- Secondary Channel A: 78
- Channel Secondary B: 777
In Tab CDMA-2 (Optional)
NAM Name: Flexi
Directory #: No MDN (same as the MDN)
CDMA / True IMSI:
- MCC: 510
- 11_12: 00
- IMSI_S: No MIN (the same as the MDN)
- AOC: 2
In Tab AMPS Ignore
In Tab System
HOME SID / NID (Double click)
Fill with parameters:
- SID: 10 496
- NID: 65 535
Preferred Mode and so on selected Automatic
In Roam Tab
NAM Name: Flexi
Directory: No MDN (no flexi complete with area code, but the writing without the written numbers from 0 eg 02144445555 2144445555)
AOC: 2
Enter the PRL Preferred Roaming with the browse button click: select dr hard drive where you store the PRL
On the Display tab
Display Items:
- Banner: TELKOMFlexi (or may pake your name, ill effect to the existing parameters)
- Backlight: always on
INJECT ALREADY FINISHED.
Press the Write to Phone, ignore if there is an error. Then Gtab will restart, after restart should be able to sms.
STEP THREE (ACTIVATE EVDO)
Prior to this step is done please register in advance for your flexi mobile broadband it by typing PROMO (space) MONTHLY send to 2255
After that there will be information that your broadband has been active with the user id: [email protected] and password: your ESN
1. Through QPST 2.7 build 3.2.3
Gtab plug into your PC and open QPST Configuration program
Select Add New Port, and select COM 7 (eg) corresponding config on CDMA WAS
Clients select Start, select SERVICE PROGRAMMING and select an active phone
Press OK in the Phone Selection
Press the READ FROM PHONE, press OK if MSL Code appears.
2. In the M. IP tab
In the User Profile, select the profile 0, press the edit
- Fill in the parameters of the NAI: [email protected] (or [email protected] for smart isp)
- Fill in the parameters in the Tethered NAI: [email protected] (or [email protected] for smart isp)
- Home Address: 0.0.0.0
- Primary HA Address: 255.255.255.0
- Secondary HA Address: 0.0.0.0
- And press OK
In the User Profile, select a profile, repeat the process as the point a.
Mobile IP Behavior: Simple IP Only
3. On the PPP tab Config
Select the UM
In the PPP Authentication:
Contents Tethered NAI: [email protected] (or [email protected] for smart isp)
User ID: [email protected] (or [email protected] for smart isp)
Password: No. ESN
Check Optimized Dormant Handoff
Then Select AN
User ID: [email protected] (or [email protected] for smart isp)
Password: No. ESN
Others, are ignored.
4. In Tab RmNet
Select Device 0, click Edit ---> if no live Add
Check the "Enable Auto Connection", click OK
5. CLICK "wite to Phone"
Setting Gtab Completed.
After restarting the logo should appear on the notification of 3G already.
FINAL STEP
Unistal QPST 3.2.3 and install QPST 2.1.5
Go to the Service Programming menu.
Then on the PPP tab, fill in data such as fill on the PPP tab in QPST 2.7 Build 323.
After that write to phone again, then it will restart again gtab.
When finished restart, (For those who berOS Froyo) do a move like that anymore diawal2
Go to the application type in the search field NOTE # # 8778 # -> enter phoneutil, change the settings of the modem to the PDA.
thanks
source
http://www.kaskus.us/showthread.php?t=10869930
During the last weeks I was researching how to build a cable to establish an UART connection to my I9300. This guide should work but is still work in progress. Feel free to contribute.
Info: this is a guide for the international version I9300 with XMM6260 modem. The SGH-I747-variant uses a different baseband/modem from Qualcomm.
Warning: This guide allows you to interface your device at a very low level. You might brick your device or damage vital parts of it. A lot of this stuff is undocumented and there might be side effects. Be warned!
Short technical explanation:
By using a custom build USB cable you can establish a serial connection to your phone. It offers a UART interface to the XMM6260/X-Gold 626 modem used in the I9300.
The longer technical explanation:
The I9300 uses a FSA9485 USB Port Multimedia Switch (https://www.fairchildsemi.com/products/analog-mixed-signal/switches/accessory-switches/FSA9485.html) behind the MicroUSB port. This IC can detect what kind of accessories are plugged to your USB port. The detection is done by a resistor wired between GND and ID pin of the USB cable. Using a resistance level of 523K will trigger the UART Mode. While in UART mode the I9300 will use the D- and D+ pins of the MicroB-plug as serial TX/RX data lines.
What to to with it?
While booting you can see debugging output of the secondary bootloader (not that much though, mainly eMMC initialize). Once booted you can see modem output and send commands to it. Another option is to show "PDA" messages, but i never managed to get any output with this setting.
You can communicate to your modem using AT-commands. For more information I recommend reading E:V:A's great post "[XMM6260][X-GOLD 626] Modem Specification / Documentation / Hack-Pack". While his guide is focussing on the SGS2, i want to keep this guide I9300 specific.
How to build a cable?
Stuff you need:
A USB to serial converter supporting 3,3V(!) TTL levels (lots of this stuff around, check eBay or your local electronics supplier. Common chipsets are FTDIs FT232RL or Silicon Labs CP21xx, just make sure it supports 3,3V!)
A USB MicroB plug (like this https://www.sparkfun.com/products/10031 or I just sacrificed a cable for soldering directly to the connector which works too)
a resistor with 523K resistance (close value will work)
some wires
a soldering iron
Wire it like this:
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
How to use it (tested with I9300XXELL4 (Android 4.1.2):
Install the drivers for your USB to serial converter (running linux your device will most likely be autodetected and assigned to /dev/ttyUSB0 or similar)
On your I9300 Dial *#7284# and set UART mode to "modem"
use your favorite serial console and set the following parameters for the serial port: rate: 115200 baud, data: 8 bits, parity: none, stop bit: 1, software flow-control: enable
I prefer using the "screen"-command on linux: "screen -t 'ttyUSB0 115200 8n1' /dev/ttyUSB0 115200,-ixoff,-ixon"
Now connect your UART-cable to the phone (it will power up on its own due to the FSA9485 chip, no need to worry)
If you see console output like this you got it right:
Code:
PMIC rev = PASS2(2)
BUCK1OUT(vdd_mif) = 0x05
BUCK3DVS1(vdd_int) = 0x20
[MMC] there are pending interrupts 0x00010000
cardtype: 0x00000007
SB_MMC_HS_52MHZ_1_8V_3V_IO
mmc->card_caps: 0x00000311
mmc->host_caps: 0x00000311
mmc_initialize: mmc->capacity = 30777344
�
AST_POWERON
AST_POWERON
AST_POWERON
Now you should be ready to send AT-commands to your phone.
Try send a simple "AT" and your phone should respond with "OK"
Code:
AT
OK
If everything above works you successfully managed to establish a serial console to your baseband processor. congratulations! proceed to the next post for tested AT commands.
Another warning at this time: Do not send random characters/commands to your modem. This is an easy way to brick your network connection or even your entire phone.
Troubleshooting:
check the wiring, maybe you switched TX/RX data lines
on linux check user rights on your /dev/ttyUSBX device, check with superuser if unsure
to be extended
THX to:
E:V:A for his great guides about modems/AT commands in general and the XMM6260
the Replicant project: http://www.replicant.us/
many other guys gave me a hint in the right direction which I forgot to mention here
Supported AT commands on the I9300
Please take this warning serious! As this is a debugging console to your baseband/modem the wrong command can easily overwrite vital data on you phone. Think before typing!
I won't go into detail about AT command syntax here. I recommend to read the following infos before trying any own approaches:
http://en.wikipedia.org/wiki/Hayes_command_set
http://www.codeproject.com/Articles/85636/Introduction-to-AT-commands-and-its-uses
http://forum.xda-developers.com/showthread.php?p=53175152#post53175152
AT commands are modem specific. Not all commands work on all modems, but there are still some general commands working on most phones!
Working AT commands:
AT+CLAC --> gives a list of all supported AT commands, though there are more commands which are undocumented, following output on I9300:
Code:
ATS
ATD
ATA
ATO
ATE
ATH
ATV
ATZ
ATl
ATm
ATQ
ATX
AT&F
AT&D
AT&C
AT\Q
AT+CGSMS
AT+CMGD
AT+CMGF
AT+CMGL
AT+CMGR
AT+CMGS
AT+CMGW
AT+CMMS
AT+CMSS
AT+CNMA
AT+CNMI
AT+CPMS
AT+CSCA
AT+CSCB
AT+CSMS
AT+XCSSMS
AT+XSMS
AT+XTESM
AT+CSDH
AT+CSAS
AT+CRES
AT+CMGC
AT+CSMP
AT+CGREG
AT+COPN
AT+COPS
AT+CREG
AT+CSQ
AT+XBANDSEL
AT+XCOPS
AT+XCSPAGING
AT+XEONS
AT+XREG
AT+XAACOPS
AT+XUBANDSEL
AT+XRAT
AT+CPLS
AT+CPOL
AT+XHOMEZR
AT+XCSQ
AT+CHUP
AT+CMOD
AT+CMUT
AT+CTFR
AT+VTS
AT+XCALLSTAT
AT+XDTMF
AT+XVTS
AT+CSTA
AT+CVHU
AT+VTD
AT+CCWE
AT+CR
AT+CRC
AT+XPROGRESS
AT+XREDIAL
AT+CAOC
AT+XLIN
AT+CCFC
AT+CCWA
AT+CHLD
AT+CLCC
AT+CLCK
AT+CLIP
AT+CLIR
AT+CNAP
AT+COLP
AT+COLR
AT+CPWD
AT+CSSN
AT+CUSD
AT+CCUG
AT+CBST
AT+CEER
AT+CGACT
AT+CGANS
AT+CGATT
AT+CGAUTO
AT+CGCLASS
AT+CGCMOD
AT+CGDATA
AT+CGDCONT
AT+CGDSCONT
AT+CGEQMIN
AT+CGEQNEG
AT+CGEQREQ
AT+CGEREP
AT+CGPADDR
AT+CGQMIN
AT+CGQREQ
AT+CGTFT
AT+XCGCLASS
AT+XDNS
AT+XGAUTH
AT+FCLASS
AT+CRLP
AT+XNVMPLMN
AT+XNVMMCC
AT+CBC
AT+CCID
AT+CCLK
AT+CFUN
AT+CGMI
AT+CGMM
AT+CGMR
AT+CGSN
AT+GSN
AT+CIMI
AT+CMEE
AT+CMUX
AT+CNUM
AT+CPIN
AT+CPWROFF
AT+CRSM
AT+CSCS
AT+CSIM
AT+CSVM
AT+CTZR
AT+CTZU
AT+IPR
AT+XCTMS
AT+XGENDATA
AT+XPINCNT
AT+XLOG
AT+XMER
AT+XSIMSTATE
AT+TRACE
AT+XL1SET
AT+XSIO
AT+XDLCTEST
AT+XPOW
AT+XCEER
AT+XEER
AT+XTRACECONFIG
AT+XMUX
AT+XFDOR
AT+XFDORT
AT+XCONFIG
AT+XAPP
AT+XHSDUPA
AT+XCAP
AT+CPIN2
AT+XDATACHANNEL
AT+CONNECTPORT
AT+CAMM
AT+CACM
AT+CCHO
AT+CCHC
AT+XCSP
AT+NEER
AT+CUAD
AT+XUICC
AT+XLEMA
AT+XSYSTRACE
AT+CLAC
AT+CPUC
AT+CLAN
AT+CGLA
AT+CRLA
AT+CPAS
AT+XSVM
AT+XNOTIFYDUNSTATUS
AT+XRXDIV
AT+XRXDIV3GRAB
AT+XMAGETKEY
AT+XMAGETBLOCK
AT+CPOS
AT+CPOSR
AT+CMOLR
AT+CMTLR
AT+CMTLRA
AT+XCPOSR
AT+XSETCAUSE
AT+XSPEECHINFO
ATV1 --> Enables verbose command results mode
ATE0 --> Turns off local echo
AT+SERIALNO=1,0 --> shows serial number
AT+CGSN --> shows IMEI
AT+XGENDATA --> shows modem version:
Code:
+XGENDATA: " SP6260_M0_MODEM_03.1241_DB121008 2012-Dec-10 11:25:46
PDB_NOT_AVAILABLE
*SP6260_M0_MODEM_03.1241*"
ATi --> shows device info:
Code:
Manufacturer: SAMSUNG
Model: I9300
Revision: I9300XXELL4
IMEI: XXXXXXXXXXXX
AT+HEADINFO=1,1 - Shows device information, "Unique Number" is not that unique. If you copy EFS you copy number.
Code:
+HEADINFO:1,1,1
Model Name = GT-I9300
Country/customer = -
Customer Code = DBT
Date = -
Charger = -
S/W version = I9300XXELL4
Unique Number = CVTXXXXXXXXXXXX
Memory Name = -
Sec Code = -
AT+IMEITEST=1,0 - shows "corrupted!!" with damaged EFS, not yet tested with good EFS
Code:
+IMEITEST:1,corrupted!!
AT+MSLSECUR=1,0 --> Some information I found indicates this is the first security mechanism. You need to send a device specific code to unlock write mode (AT+MSLSECUR=2,<UNLOCK CODE>). I saw examples in this form: AT+MSLSECUR=2,<SERIAL NUMBER>_<HEXADECIMAL KEY> but was not able to generate it.
AT+AKSEEDNO=1,0 --> It seems to be a challenge/response security mechanism: You have to respond to this challenge with another AT-command (AT+AKSEED=2,<RESPONSE CODE>). See next post for details.
Code:
AT+AKSEEDNO=1,0
+AKSEEDNO:1,16799-25-329
Some related technical infos
EFS:
The modem stores its settings in your /efs partition (mmcblk0p3), more precisely in your nv_data.bin file. It might be wise to do a backup. (More information on EFS)
Modem Firmware:
Your modem is running a Real Time Operation System (RTOS) named ThreadX. It is stored in modem.bin and different versions can be flashed by Odin.
The ServiceMode.apk-application talks directly to the modem RTOS.
AKSEED
This seems to be a challenge-response security algorithm. Maybe somebody has a clue as i would love to find out how it works.
I have collected some AKSEED examples from the web:
Challenge: 29987-125-1427 - Correct response: 16096-95-115
Challenge: 8299-182-209 - Correct response: 7928-94-124
Challenge: 767-207-25 - Correct response: 309-93-128
nv_data.bin
If you attempt to change the nv_data.bin within Android it will get restored from .nv_data.bak and .nv_core.bak. It is protected by a special MD5-hash which is stored in nv_data.bin.md5/.nv_data.bak.md5/.nv_core.bak.m5. The MD5-hash is generated from nv_data.bin, but can not be generated using a normal MD5-algorithm. If no backup is present a default nv_data.bin is created.
I assume the ril-daemon is responsible for checking the correct checksum and restoring the backup.
There are some offsets of interest in nv_data.bin (just assumptions, may be different on some modem firmwares):
I believe the modem settings related part starts at Offset 0x180000 with the String "SSNV".
0x181469 - Network Lock (i think its 5 bytes starting from 0x181469: Network Lock, Subset Network Lock, SP Lock, CP Lock, Data Lock)
0x18800F-0x188011 - Product Code (DBT,XEO,etc.)
0x188021-0x188023 - Product Code (DBT,XEO,etc.)
0x18815F-0x188165 - Serial Number
0x194004-0x194023 - Modem Version
0x194049-0x194053 - Firmware Version (I9300XXELL4,I9300XXDLIB,etc.)
0x18146e, 0x18148e, 0x1814ae, 0x1814ce, 0x1814ee - 5 times the same value, most likely a hash of the Unlock Code. The hashes are separated by "4A" hex. The hash is generated different than on SGS2 - see here
If anybody has further information regarding offsets, stored data and used encryption please post here or contact me!
MD5 generation: (cat nv_data.bin; echo -n Samsung_Android_RIL) | md5sum
EDIT: echo -n, not echo - n
Sent from my GT-I9305 using XDA Free mobile app
.NetRolller 3D said:
MD5 generation: (cat nv_data.bin; echo - n Samsung_Android_RIL) | md5sum
Sent from my GT-I9305 using XDA Free mobile app
Click to expand...
Click to collapse
nice one...but you have to stop ril-daemon on device before replacing or it will revert to nv_data.bin from backup:
Code:
stop ril-daemon
The data at 0x180004 to 0x180033 in nv_data.bin seems to be related to the AT+MSLSECUR command:
AT+MSLSECUR=1,0 on a phone with undamaged /efs responds the serial number:
Code:
AT+MSLSECUR=1,0
+MSLSECUR:1,RFXXXXXX
if you copy these offsets from undamaged /efs to another phone the data gets scrambled:
Code:
AT+MSLSECUR=1,0
+MSLSECUR:1,��Lb�šV��Ƨo~
if you edit these offsets to all "FF"s:
Code:
AT+MSLSECUR=1,0
+MSLSECUR:1,0000000000
so i assume it is somehow crypted by the serial number or another physical(?) unique identifier
AT+EGMR command
Does the AT+EGMR command work?
Hello, I have a problem connecting devices through OTG to P10 lite. When connecting the gamepad the LEDs light but no reaction on the phone, similarly with the card reader, the LED flashes for a few seconds and no response. I tested on other devices and everything works fine. If someone has a similar problem, please help. Thank you and best regards
Maybe this will help: https://play.google.com/store/apps/details?id=com.homesoft.otgtroubshooter&hl=en
(sorry I can't post a link so try to copy it to your URL bar )
No problem here. I've successfully used a 64 Gb pendrive with my P10 Lite and an micro USB to USB wire.
Enviado desde mi WAS-LX1A mediante Tapatalk
OTG problems
I have similar issues with using an OTG DAC. I used to be able to use it with my previous SONY Z2 but not on my P10 Lite. The only way I can get it to work is via NEUTRON player which by passes the OS, which is useless when trying to stream music. I suspect it the EMUI os that is getting in the way.
Hi,
trying to get a "GGMM A1" (www . ggmm . com/a1-headphone-amplifier-p00025p1.html) DAC with integrated USB OTG to work.
"OTG Troubleshooter" app isn't recognising a device when plugging it in.
"USB Device Info" app recognises "/dev/bus/usb/001/005" on the "API" tab with the following details:
Device Info
Device Path: /dev/bus/usb/001/005
Device Class: Use class information in the Interface Descriptors (0x0)
Vendor ID: 0418
Vendor Name (reported): Nuvoton
Vendor Name (from DB): AST Research
Product ID: 1418
Product Name (reported): GGMM_A1
Product Name (from DB): not found
Additional Info
Interface #0
Class: Audio Device (0x1)
Endpoints: none
Interface #1
Class: Audio Device (0x1)
Endpoints: none
Interface #2
Class: Audio Device (0x1)
Endpoint: #0
Address : 0x02 (000000010)
Number : 2
Direction : Outbound (0x0)
Type : Isochronous (0x1)
Poll Interval : 1
Max Packet Size: 576
Attributes : 00000001101
Interface #3
Class: Audio Device (0x1)
Endpoint: #0
Address : 0x02 (000000010)
Number : 2
Direction : Outbound (0x0)
Type : Isochronous (0x1)
Poll Interval : 1
Max Packet Size: 576
Attributes : 00000001101
Interface #4
Class: Human Interaction Device (0x3)
Endpoint: #0
Address : 0x83 (10000011)
Number : 3
Direction : Inbound (0x80)
Type : Intrrupt (0x3)
Poll Interval : 5
Max Packet Size: 8
Attributes : 000000011
On the "Linux" tab, no device gets recognised.
I get the adapter to work by using HiBy Music Player, but of course this is not the way it's meant to be...
Any ideas who to get this to work?
Phone is rooted, if you need details which require extended privileges to be gathered.
Edit: I already tried a firmware update.
Based on hints in the firmware, a Nuvoton NUC505 is used: caxapa . ru/thumbs/617532/PB_NUC505_Series_EN_Rev1.02.pdf
Because the DAC should be supportet by P10 (non lite), I dont think it is a general problem with EMUI.
my otg is working fine...Im using a samsung adapter and my controller is working
Running NCK Dongle Android MTK 2.5.9.5
Dongle is original, only 1 month old !
I click read codes I get IMEI info and other data but no simlock is displayed !
So I try direct unlock and I get this !
Can anyone help ? (or calculate correct code for me) ?
Thanks
maxmix
Restarting to meta,wait....
If drivers missing, please install CDC drivers.
This can take up to 5 min on slow phones.
If take too long, check device manager for drivers.
[25]META Port Detected: MediaTek USB VCOM (Android) (COM25)
USB\VID_0E8D&PID_2007\5&387589A8&0&1
Start sync target, waiting responce.....
[AP]BaseBand CPU : mt6737m,S01
[AP]APP_VER: alps-mp-n1.mp1-V1_lenovo6737m.35.n1_P105
Making target channel configuration, wait...
Making tunnel configuration, wait...
Rebooting to meta, wait....
[META]BaseBand CPU : MT6735, E00
[META]SW_VER : ANDY.EMEA.V45
[META]HW_VER : LENOVO6737M_35_N1_HW
Phone imei[1] : 3565060***********
Start direct unlock[SIM1]
Simlock data not found(3).
Clean Boot flag ok.
All done.
maxmix