2347 pagesV  < 1 2 3 4 5 6 > »  
 
REPLY
> Huawei E3372 (MTS 827F / 829F, MegaFon M150-2, Beeline E3372 / E3370, TELE2 E3372h-153) - Discussion | [usbmodem] [ltemodem]
forth32
Message#1
25.07.14, 21:59
Experienced
******
[offline]

Group: Friendssavagemessiahzine.com
Messages 694
Check in: 05.12.06
TurboPad 910

Reputation:-  739  +

Huawei E3372h / E3372s (MTS 827F / 829F / 829FT, Megaphone M150-2, Beeline E3370)- Discussion



Attached Image




Attention!
The most popular questions with answers and off-topic (which will be deleted),refrain from themso as not to shower you with tomatoes!
The answers to these questions are in the topic header or in other profile topics!
  • How to unlock (unlock) modem
  • How to fix TTL
  • How to change IMEI
  • How to change the MAC address
  • How to bypass the torrent
  • How to make friends with the router
  • How the operator distinguishes the phone from the modem
  • Any question about the operators, including the tariffs Yota, Unlimited, #CanAll, All for ..., MegaEz-Limit, Unlimited Black

Rules of conduct in the subject
  1. We read this item carefully, 90% of messages are deleted due to non-compliance with this item!First check if there is an answer to your question in the FAQ. Use the search on the topic, perhaps a similar question already understood. If you did not find the answer to your question,necessarilyattach all the information that is listed in the spoiler "Necessary information for help", and write as fully as possible so that you do not have to clarify the details.
    If you are unable to unlock or flash the modem, please read all the information in the header (the first message of the topic you are reading now), try different USB cables, operating systems and computers, and only after that if you have failed ask a question.
    Remember - for all actions with your modem, you are responsible, and not someone else. Expect help in the subject, but rely only on yourself.
    Necessary information for help
    You need a screenshot, or text in the log code tag fromDC-Unlocker. An important requirement - the serial number, firmware version and the rest not to paint over!


    If the DC-Unlocker modem does not see, then you can only take a screenshot of the Device Manager.

    You also need a screenshot of the Device Manager with the expanded:
    1. DVD and CD drives
    2. Disk devices
    3. USB controllers
    4. Ports (COM and LPT)
    5. Network adapters
    For Linux users
    We need results in the code tag of the following AT commands:
    1. ATI
    2. AT ^ SN
    3. AT ^ FHVER
    4. AT ^ DLOADINFO?
    5. AT ^ HWVER

    An important requirement - IMEI, serial number, firmware version and the rest do not paint!

    And we also need the results of the lsusb and ifconfig command (not ipconfig!) In the code tag.
  2. Please do not write messages in the style of “I’m not getting anything”, “I tried - it didn’t work”, “Throw me detailed instructions”.
    Better in each message, clearly indicate what specific actions you performed, what result they received, with screenshots.
  3. Questions about the modem with your router ask in the topic of your router. We do not know the features of your router, but they know the subject of the router. Old-timers are not millionaires, they do not have all the routers.
  4. Please remove the images under the spoiler. The image without a spoiler like a man without clothes - looks, to put it mildly, ugly. Anyway, unethical.
  5. Do not use the BMP format! Such messages will be 100% deleted.
  6. Write correctly!
  7. Be sure to read the spoiler. Important information! There really is important information, without knowing which, you can mimic the modem!
Important information!
All the manipulations with the firmware and configuration of the modem you do at your own peril and risk!


  • Existstwo models of modemsE3372: E3372sand E3372h. They are built on different platforms, firmware from one will not fit the other. Model E3372hnewer and E3372salready out of production.
  • There are two types of firmware:StickandHilink. With the Stick's firmware, the modem will be seen as an AT-modem, to connect to the Internet you need to "dial". With HiLink firmware, the modem is represented by an Ethernet network card and does not require any configuration in the OS.
  • For E3372h modems, the serial number starts atG4P, and at E3372s -L8f. More precisely, your modem candefine like this. You can not flash E3372h firmware from E3372s - get a brick. However, she herself will not go - will give an error. Is that under pressure ...
  • If you have E3372h and firmware on your modem from 2x.200.15.xx.xx to (not including!) 2x.317.xx.xx.xx, then send the command AT ^ SFM = 1 before the firmware, otherwise you will get error 19 ( Moreover, 2x.200.15.xx.xx and above can not be removed from the download mode, you will have to alter using the needle method or look for your firmware on the network and sew on it)
  • If the modem has stopped seeing the network, or has become unknown or an ADB deviceit means the flash is broken. You can fix itlike this.
  • The modem is not compatible with Kaspersky products!The muzzle is unavailable from it, disabling does not help,only delete! Before buying a modem, think about whether you are ready to abandon this product.
  • The firmware flasher and boot loader (the one used for the needle) under macOS can be foundhere. There is no need to resort to virtualka, and it is dangerous. Also, balong_flash'em can remove the modem from boot mode (switch -r).
  • Formodem works with HiLink firmware in Windows 10 Version 1709patch requiredKB4051963and update the driver through the device manager
  • Change the MAC address is not possible


Beginner, if you don’t understand anything about computers and don’t know where to start, read HERE!
First you need to start by readingRules of the topic, especially the sub-spoiler "Useful info for help" - in order to know what information to provide in case of problems, to know how to ask a question, to know what you shouldn’t ask, etc.Without DC-Unlcoker log and device manager screen with expanded categories from that spoiler, messages will be deleted without warning!
Next, readImportant information- to learn about important nuances and how not to get to the elementary error.

Further, if you just need an unlock, then in this post there is a spoiler "Modem unlocking"(a little running ahead, I will say that most likely" just unlock "will not work, all current models come with strong protection, which is the easiest to defeat with firmware)
And if you need to flash / upgrade the modem, then in the Important Information there is a link to the instructions for the firmware in HiLink and Stick.
In case you need to flash the modem "under the phone" and "so that the operator does not burn the distribution", then there is a FAQdetailed instructionsI.

I would also like to note that there are no such concepts as “flash under mts”, “flash under the beeline”, etc. You will simply not be understood if you ask to flash under some kind of operator.

Also, I present to the attention of a small glossary with local slang and terms:
Glossary
Firmware- starts at 22 (HiLink) or 21 (Stick) and nothing else (for this model). Also, this can be understood not just as a version, but as a file stitched by you, since it is impossible to add modification identifiers to the version, therefore they are present only in the firmware file (For example: M_AT_05, M_01).
Dashboard- management program, or its firmware file. His version starts with 23 or whatever.
HiLink- this is router mode. The modem in this mode has a web interface, like a router (of course, Wi-Fi doesn’t have any growth at all: D), it’s very convenient when using a router, and in general you don’t need to install extra software.
Stick- this is a normal modem that connects through a control program (dashboard) or through the Windows Network Manager (which is built into Windows 7 and higher)
Modified firmware- firmware modified by the forum member. There may be many of them, so it is better to read the explanations for the identifiers that are in the post with these firmware.
Modification Identifiers- short letter designation built-in modifications.
Unlock- unlock modem to work on all SIM-cards.
Cleaning flush- an operation that almost completely clears the internal memory of the modem, clearing away the contrived damage (this modem has such a complex that over time it begins to think that all its internal memory is in error). The link to the installation is in this post, in the spoiler "Useful links ->Firmware / Recovery. "
Needle, pricking, etc.- recovery operation, at which the test point closes. This instruction is also in the FAQ, which was already mentioned above.
About modem
Photo modem
Attached ImageAttached ImageAttached ImageAttached Image
Insides
E3372h
Attached Image
Attached Image

Photo from Sou1t
E3372s
Attached Image
Attached Image

Photo from Sou1t
Specifications
Supported ranges:
GSM / EDGE / EVDO / LTE / FDD / TDD / UMTS
The speed of data reception modem up to 150 Mbps,
Data transfer rate - up to 50 Mbps

Supported frequencies
GSM / GPRS / EDGE 850/900/1800/1900
UMTS / DC-HSPA + / WCDMA 900/2100
LTE 800/900/1800/2100/2600 MHz

Additionally
MicroSD card support up to 32 GB

External antenna
The type of connector of the external antenna is CRC9, which, in the huawei terminology, is TS-5.
The modem has 2 antenna connectors (for MIMO antennas), a single antenna connects to the connector closest to USB

Operating Systems:
Support for Windows XP SP3, Windows Vista SP1 / SP2, Windows 7, Windows 8, Mac OS X 10.5, 10.6, 10.7, 10.8, Linux

Link to the product page on the manufacturer's website
http: //consumer.huawei…s/tech-specs/e3372.htm
Reviews
Types and features of modem firmware
For this modem, there are 2 fundamentally different types of firmware - STICK and HILINK. Firmware interchangeable, that is, in any modem you can flash any firmware. The following describes their features and provides links to the firmware files.
STICK
With this firmware, the device behaves like a classic USB modem: there is a command AT-port through which you can establish a connection using the PPP protocol. This is how almost all previous-generation 3G modems work. The speed is limited - no more than 20-30 Mbit at the reception. In addition to the PPP mode, there is an NDIS mode. In this case, the modem emulates a network interface through which data is transmitted, and only control commands are sent through the AT port. In this mode, the speed is not limited. The main feature of the stick mode is to establish the connection and support the operation of the channel using the OS of the computer to which the modem is connected. At the same time, the computer receives an IP address directly from the cellular provider through a DHCP request, and the modem acts as a network bridge, transmitting the packets from the computer to the cellular network and back without changing them.

The initial USB stick stick composition is a virtual CD-ROM and microSD card reader. In order for modem ports to appear, you need to switch the composition. Under windows, this is done by carrier software available on a virtual CD, or by the huawei proprietary program Mobile Partner. Under linux, switching is done by the usb-modeswitch program. It is possible to prohibit the transformation of songs. This is done with the following command:
AT ^ SETPORT = "FF; 10,12,16"

At the same time, the modem immediately after switching on will look like 2 AT ports and a NDIS network card. CD and microSD will be excluded from the configuration. This mode is extremely convenient for using the modem in various home routers. To switch back the composition with switching, use the command:
AT ^ SETPORT = "A1, A2; 10,12,16, A1, A2"

Version numbers of stick-firmware always start at 21 — for example, 21.285.01.02.143. With this type of firmware, modems from MTS and Megaphone are supplied.

Included with the Stick-firmware, a so-called Dashboard is flashed into the modem - an image of a virtual CD that appears in the system after the modem is connected. This CD contains modem drivers for various operating systems, as well as a control program that establishes a connection to the Internet, reads SMS, makes USSD requests, and so on. There is a universal version of this program from the manufacturer of the Huawei modem (Huawei Modem), as well as specialized versions from specific telecom operators.
HILINK
With HILINK firmware, the modem works in the router mode and is presented to the computer as a network interface (usb-ethernet-rndis). The computer receives network settings from this interface via DHCP, and then goes through it to the Internet, like through a regular wired LAN. The modem assumes all care for establishing a connection and maintaining the channel, the computer does not even notice that access to the Internet is through a cellular network. In this mode, the modem has its own local IP address (usually 192.168.8.1), visible from the computer as a default gateway (default route), as well as an external IP address obtained from the cellular network. Routing is performed between the network of the cellular provider and the local network (modem-computer) using the address translation mechanism (NAT). Provides port forwarding from the external network (port forwarding and DMZ).

The modem is configured in this mode via the WEB interface available in the modem and accessible via its local IP address. Also through the WEB-interface information is available on the state of the modem and the signal of the cellular network, connection management, reception and transmission of SMS messages and USSD commands, SIM menu and much more. This is especially valuable for Linux users, as well as for those who have a modem connected not to a computer, but to a home router. Modem configuration via AT commands, as in stick firmware, is not performed in the normal mode of hilink firmware, although it is possible in the special DebugMode debug mode.

The initial HILINK modem USB composition is exactly the same as that of the stick - a virtual CD-ROM and microSD card reader. Switching tracks under windows is a small program mbbservice, run from the built-in CD. Under linux, this is done by the usb-modeswitch program. Regularly modem developers do not provide a mode without switching tracks. Nevertheless, it is possible to make such a mode by some modification of the firmware. At the same time, the built-in SD card reader is lost, however, it becomes possible to use a modem with any router that supports usb-rndis network cards.

Version numbers of hilink firmware always start at 22 — for example, 22.286.03.00.00. With this type of firmware modem comes from Beeline.
HILINK firmware consists of two parts - the firmware itself, and the WebUI (web interface). The first firmware is the main firmware, then the WebUI.

The participants of this forum completed the revision of the standard firmware to extend the functionality and enable the functions initially blocked.

If the modem asks a password when flashing, then it can be calculated with the same calculator (link in the header of the header). It is called flash code there.

Inside the modem, an operating system based on Android 2.3 with a linux 3.4.5 kernel works. Modified firmware allows access to the console of the Linux-part of the modem via telnet:
telnet 192.168.8.1

And also through the Android debugging utility - ADB:
adb connect 192.168.8.1
adb shell
Useful information on the procedure for flashing the modem
When you first flash operator modems, the flash driver will request the Flash code (password).
This code can be calculated from the IMEI modem usingThis code calculator .
If during the firmware the flash program stops seeing the modem, then you need to install the mbbservice drivers.
If you are working under Linux, then you can use the modem firmwareby thisflasher.
If you forgot to flash Dashboard 3.5 before uploading HILINK firmware, then you will not be able to create and edit network connection profiles in the web interface (settings ->profile management). In this case, go to the Linux console (via telnet, adb or A-shell), and enter the commands:

umount / data
(for E3372S)busybox flash_eraseall / dev / mtd / mtd16
(for E3372H)flash_erase / dev / mtd / mtd17 0 0


And then restart the modem.
For windows users, scripts have been developed to automatically perform all actions to resolve problems with profiles. See section useful links.

Note!Each of the firmware consists of 2 components: stick-firmware and Dashboard, hilink-firmware and WebUI. Do not try to flash WebUI on stick-firmware, and Dashboard - on Hilink-firmware. You can bring the modem into a completely non-operational state!
Useful and interesting AT commands and modem configuration
The following commands mainly refer to stick modems. Hilink modems are configured via a web interface, and under normal conditions they do not have an AT command port in the configuration at all. Some commands require the release of a command lock (datalock) using the at ^ datalock comand. This will be noted in the description of specific commands.
Modem Command Help
A list of all commands supported by the modem can be obtained from the command:
at + clac
This list will list all command names that are in the internal modem command table, except for hidden commands. Hidden commands are commands marked with a special flag in the command table. You can find them only by disassembling the kernel of the Linux part of the modem. For those interested, here is a list of these commands for the E3372 modem:
+ CEER
^ CPULOAD
^ MFREELOCKSIZE
^ MEMQUERY
^ CMST
^ CMSTUB
^ CVOICE
^ DDSETEX
^ CMMI
^ ADCTEMP
^ YJCX
^ USSDMODE
^ BOOT
^ CMM
^ RSSI
^ LFROMCONNTOIDLE
^ CNMR
^ CECELLID
^ CIMEI
^ CGAUTH
^ CCIN
^ CSND
^ DWINS
^ SETPID
In general, commands have 4 forms of recording (hereinafter cmd is the name of the command):
atcmd - command without parameters
atcmd? - view the current value of the parameters controlled by the command
atcmd = X - setting parameter values
atcmd =? - request for help on the command format

Each of the commands supports one or more recording forms. For example:

at + cgdcont
+ CME ERROR: Incorrect parameters

The form without parameters is not supported by the command.
at + cgdcont?
+ CGDCONT: 0, "IP", "", "", 0,0,0,0
+ CGDCONT: 1, "IP", "internet.mts.ru", "", 0,0,0,0

The form of request for the current value of the parameters - a list of Internet connection profiles
at + cgdcont = 1, "ip", "internet.mts.ru"
Ok

Assigning a value to the parameters - profile setting 1.
at + cgdcont =?
+ CGDCONT: (0-31), "IP" , (0-2), (0-3), (0,1), (0,1)
+ CGDCONT: (0-31), "IPV6" , (0-2), (0-3), (0.1), (0.1)
+ CGDCONT: (0-31), "IPV4V6" , (0-2), (0-3), (0.1), (0.1)
+ CGDCONT: (0-31), "PPP" , (0-2), (0-3), (0,1), (0,1)

View the + CGDCONT command format and a list of valid parameters.
USB modem control
On the computer side, the USB modem looks like a collection of separate, independent USB devices. The list of devices represented in the modem can be managed using the special command ^ setport.
Initially, after connecting to a computer, the modem usually looks like a CD-ROM and microSD card reader. This is the primary composition of the modem. After a special command from the operating system, the modem switches its composition to the secondary — ports of AT commands and network interfaces appear. Such a switch is made solely because of the ideological curvature of the Windows operating systems, and in many cases it only hurts. For example, when connecting a modem to home routers. Therefore, it is possible to prohibit such switching - then the modem will immediately turn on with the secondary (working) device composition.
Command format ^ setport:

at ^ setport = "<list of primary composition>;<secondary composition list>"

Each of the lists is a comma-separated device code. A semicolon is put between the primary and secondary list. In the pre-list, only codes A1, A2 and FF are allowed, in the secondary list, all but FF. The modem understands the following codes:
FF - prohibit the primary composition
10 - AT port for establishing PPP connections (modem)
12 - AT port for setting up NDIS connections (PCUI)
16 - NDIS-network card
5 - Linux console (A-shell)
A - VxWorks console (C-shell)
A1 - CD-ROM with dashboards and drivers
A2 - microSD card reader

Letter codes can be written in both large and small letters. Changing the device list takes effect only after the modem is rebooted (using the at ^ reset command or reconnection).
Note! The command ^ setport is able to manage the composition only in stick firmwares! In hilink, the composition can be changed only by editing the record nvram 50091.

USB song setting examples:

at ^ setport = "a1, a2; 10,12,16, a1, a2" - standard factory composition. Only a CD and a card reader are visible in the primary composition, all AT ports, a network card, a CD, a card reader in the secondary composition.

at ^ setport = "ff; 10,12,16, a2" - composition without switching. Very convenient for use in home routers and computers with operating systems other than windows. After connecting, the modem immediately appears as 2 AT ports, a network card and a card reader.

at ^ setport = "FF; 10,12,16,5, A, A1, A2" - Composition with included all devices that are only in the modem. Convenient for those who need access to modem consoles.

The current usb-track used can be viewed with the ^ getportmode command. For example:
at ^ setport?
^ SETPORT: FF; 10,12,16,5, A, A1, A2
Ok
at ^ getportmode
^ GETPORTMODE: TYPE: WCDMA:, modem: 1, pcui: 2, ncm: 3, a_shell: 4, c_shell: 5, mass: 6, mass_two: 7,

The device names are listed here in the same order as they appear in the ^ setport command. Note that the ^ getportmode command shows exactly the current composition. If you changed it with the ^ setport command, but have not yet reset the modem, the changes will not be taken into account.
Network priority setting and allowed ranges
The modem allows you to explicitly specify with which types of networks (GSM / UMTS / LTE) and the ranges it should work. To do this, use the at ^ syscfgex command. The command format is:

AT ^ SYSCFGEX = "<net_order>",<band>,<roaming>,2,<lteband>,,

<net order> - a list of preferences for network types. Valid values ​​are:
00 - all types of networks
01 - only 2G
02 - only 3G
03 - only 4G
99 - leave the value unchanged
Codes can be combined. Naprimer “0302” - LTE preference ->3G

<band> - code of acceptable ranges for 2G / 3G networks. Possible values:
80 - GSM 1800
300 - GSM 900
80000 - GSM 850
200000 - GSM 1900
400000 - UMTS B1 (2100)
2000000000000 - UMTS B8 (900)
3FFFFFFF - all ranges
Each of the codes is a hexadecimal (HEX) number. To specify a combination of ranges, add the corresponding codes. For example, to set GSM850, GSM900, GSM1800 ranges, you need to calculate 0x80 + 0x300 + 0x0x80000 = 0x80380. This will be the resulting code range - 80380.

<roaming> - permission of the modem in roaming:
0 - ban
1 - allow
2 - leave unchanged

<lte band> - code of valid LTE bands.
1 - B1 (FDD 2100)
4 - B3 (FDD 1800)
40 - B7 (FDD 2600)
80 - B8 (FDD 900)
80000 - B20 (FDD 800)
800C5 - all ranges

As for the 2g / 3g ranges, the codes are hexadecimal numbers that can be added to specify range combinations.

Command example:

AT ^ SYSCFGEX = "00", 3FFFFFFF, 1,2,800C5 , - register in all possible networks and ranges
AT ^ SYSCFGEX = "0302", 400000,1,2,800C5 , - register on the LTE network, if LTE is not available, then on 3G (the modem will not register on 2G networks). All bands are available for LTE, for 3G - only 2100 range.
Search for cellular base stations
This modem has a unique property - it can do a search for all surrounding base stations (BS). And not only the BS of the operator of the sim card inserted in it, but in general all the BSs of all operators, the signal from which reaches the modem antenna. For each BS found, its CID and the level of signal received from it are displayed. This allows you to select the operator with the highest signal level, as well as select a specific BS for pointing an external antenna to it. The only drawback of this modem is that it can only search BS 2G and 3G. He does not know how to search for LTE cells.
Search is made with the help of the command at ^ netscan. Before searching, make sure that:
- Internet channel is disabled
- the modem does not see any LTE-cells.
If there is an LTE signal in the district, then the modem should be switched to 2G3G mode using the command AT ^ SYSCFGEX = "0201", 3FFFFFFF, 1,2,800C5 , or in the settings of the web interface.
Also note that this command can only be entered via the management port (PCUI). If you enter it through the port intended for the PPP connection (modem), the command will issue an empty response (just OK and that's it).
Command format:

AT ^ NETSCAN = num, level, mode
num - the number of BS found, from 1 to 20. If more than num BS is found, then the stations with the weakest signal will be excluded from the list
level - the minimum level of the BS signal included in the list. Set in dB, from -110 (lowest level) to -47 (highest level). Stations with a signal level below the level will not be included in the list.
mode - BS type. 0 search 2G stations, 1 - search for 3G stations.
Command example:
at ^ netscan = 20, -108.1
^ NETSCAN: 10638 , 1e7e, 250.02.0, -78.8b77.400000
^ NETSCAN: 10687 , 1e7e, 250.02.0, -79, d5c8,400000
^ NETSCAN: 10662 , 1e7e, 250.02, -82.8ade, 400,000
^ NETSCAN: 10587 , 4cf8,250,20,0, -105, d4fc, 400000
^ NETSCAN: 10563 , 4cf8,250,20,0, -106, d4f9,400000

In this example, a 3G BS search is ordered with a signal level not lower than -108 dB. The result is given in the form of a list, sorted by signal level. The topmost BS is the most powerful, the bottom one is the weakest. List item format:
^ NETSCAN: 10638 , 1e7e, 250.02.0, -78.8b77.400000

1e7e - LAC Station
250 - MCC (Russia)
02 - MNC (in this case - MTS).
0 - I myself would like to know what it is, from the disassembled code I did not understand the meaning of this field.
-78 - signal level of a given BS
8b77 - station CID
400000 is the range in which the BS signal is received (as in the ^ syscfgex command).

According to the results of this example, we can conclude that the strongest signal in a given area is at the MTS, and the antenna should be sent to the BS with CID = 8b77 LAC = 1e7e. Coordinate BS can be viewed on the site xinit.ru.
Unlocking Extended Command Set
Some commands that are listed in the command list are initially blocked. That is, even if you enter a command in the correct format, the modem will respond ERROR. Apparently, this is done to protect against fools - in some cases, the thoughtless use of an extended command set can lead to a complete inoperability of the modem. To access this set of commands, you need to unlock it. This is done by the command:
at ^ datalock = "<password>"
The password is the same nlock-code, calculated by the algorithm 201 from the IMEI modem, which is used to remove simlock. Command example:
at ^ datalock = "13325014"
If the password is entered correctly, the modem will answer OK and release the datalock lock, otherwise ERROR will respond.
Work with NVRAM modem
The modem has a storage of various configuration information - NVRAM. It is organized as a set of variable-length records. Each record has a number - from 0 to 65535, but not all record numbers are physically present in the modem.
To find out the length of a particular entry, use the command:

at ^ nvrdlen =<item>

<item> - record number. In response, the modem gives its length:
at ^ nvrdlen = 8268
^ NVRDLEN: 12

If instead of length the modem responds with ERROR, then there is no record with that number at all in the modem.
You can view the contents of a specific entry with the command:

at ^ nvrdex =<item>,<offset>,<len>

<offset> - offset from the beginning of the recording to the fragment of interest to us (0 - from the beginning)
<len> - the length of the output fragment must be no more than the full length of the record minus the offset.
Example:
at ^ nvrdex = 8268,0,12
^ NVRD: 8268,0,12,01 00 00 00 01 00 00 00 0A 00 00 00

At the beginning of the response, the command parameters are listed separated by commas, then, by space, the bytes of the record contents.

To change the contents of the nvram command is used:

at ^ nvwrex =<item>,<offset>,<len>,<b0><b1>....<bn>

The meaning of the first three parameters is the same as in the reading command. b0 ... bn - bytes written to nvram. They should be exactly len pieces, and they are listed through the space. For example:
at ^ nvwrex = 8268,0,12,1.00 00 00 02 00 00 00 0A 00 00 00


In addition to the above, there are 2 simplified commands for working with nvram - ^ nvrd and ^ nvwr. Unlike the ones discussed above, these commands require the precautionary release of the datalock lock.

at ^ nvrd =<item> - displays a full dump of the specified entry
at ^ nvwr =<item>,<b0>,...<bn> - saves the specified bytes from the beginning of the item.

Change IMEI modem
You can change IMEI with the command:
at ^ cimei = "new imei"

The command requires prior release of the datalock lock. IMEI change is necessary for work in the yota network - the modem needs to install an IMEI modem imei from a device of the type (smartphone, tablet) for which a sim card was purchased.
Please note that for the command to work correctly, a sim card must be inserted into it. Absolutely any. In addition, IMEI must be correct (with the correct last check digit). Incorrect IMEI modem will not accept with an error message. You can check the correctness of IMEIcalculator
Change modem ID
E3372h with megafon firmware does not work with Omni II and other new routers. The fact is that with this firmware the modem model is defined as "MegaFon M150-2", and not "E3372".
This string is stored in the cell NVRAM 53525, and you can replace it with "E3372" with the following AT commands:
AT ^ NVWREX = 53525.0,84.0 1 1 0 0 0 0 0 45 33 33 37 32 48 2D 31 33 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4 0 32 45 33 33 33 48 4D 0 0
AT ^ NVWREX = 53525,84,84,0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 50 31 31 73 2D 53 53 49 43 4B 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 45 33 33 37 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

After that, the modem will be easily identified by kinetics and work.

In general, in ZyXEL modems are defined by vid / pid (in the config), for example, the E3272 block looks like this:
interface CdcEthernet0
description "USB MODEM"
usb device-id 12d1 14db

and for E3372s - like this:
interface CdcEthernet0
description "USB MODEM"
usb device-id 12d1 14dc

Accordingly, you can enter the necessary values ​​manually for any modem: there are libraries for almost everyone, with very few exceptions (for example, sierra modems)
Blocks are given for modems in HiLink mode (with a CdcEthernet0 upgrade).
Manufacturer field editing
It is necessary to check what lies in the cell NVRAM 8203. In the right case, there will be this:
AT ^ NVRDEX = 8203,0,32

^ NVRDEX: 8203,0,32,68 75 61 77 65 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Ok



If different, write this value there.

at ^ nvwrex = 8203,0,32,68 75 61 77 65 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Access to modem command interfaces
The modem is built on the Hisilicon hi6930 chip (Balong v7r2). This chip has in its composition 2 processor cores ARM7. Each processor core runs on its own operating system.
Kernel 0, which starts when the modem is turned on, runs on Android 2.3 (Linux kernel v3.4.5). The system environment is a stripped down version of Android - without the Dalvik virtual machine. The linux kernel itself is almost completely consistent with the standard Android kernel, but additional proprietary modules developed by Huawei are compiled into it - for example, the AT command handler. In addition to the initial launch of the modem and the processing of AT commands, in the HILINK firmware, the linux part of the modem supports the network stack and the operation of the WEB server.
Kernel 1 is managed by the VxWorks v6.8 real-time operating system. This OS directly manages the radio module and interacts with the cellular network. VxWorks is launched using a special subsystem built into the Linux kernel.
Thus, 2 operating systems work simultaneously in the modem. They can interact with each other using the ICC subsystem, which transfers data packets from one OS to another in a special way. ICC contains debugging tools, which allows, if desired, to consider in detail the process of interaction between VxWorks and Linux. Each OS has a command processor that allows you to talk and command the OS. Further I will tell how to get access to the command line of these OS.
The easiest way to access the command line is the Linux part of the modem in HILINK firmware. To do this, it is enough to flash the modified firmware from this topic. This firmware allows access to the Linux shell via telnet and adb.
telnet:
telnet 192.168.8.1

adb:
adb connect 192.168.8.1
adb shell

Access via the Android debugger ADB also allows you to transfer and receive files from the internal file system of the modem.

If you have a modem with stick-firmware, or standard (unmodified) HILINK-firmware, then the above methods will not work. In addition, these methods do not allow access to the VxWorks console. Therefore, we consider a more universal method, originally incorporated into the modem by the manufacturer - the A-shell and C-shell ports. Both of these ports are USB-serial devices that are included in the USB-modem compression mode DebugMode. The first one is the Linux console, the second is the VxWorks console.
First you need to get access to the command AT-port of the modem. In stick firmware, this port is available immediately - this is the very first port (/ dev / ttyUSB0). In standard HILINK firmware, the AT port is not available by default. To open access to this port, you need to flash the modified web interface, and then go to the browser at this address:
[url = "http://192.168.8.1/html/switchDebugMode.html"] http://192.168.8.1/html/switchDebugMode.html [/ url]

This will switch the modem to debug mode - now, in addition to the network interface, 6 serial ports are also available. The very first of them will be the command AT-port. Now you need to enter any terminalka on this port, and enter the following AT commands:
at ^ spword = "password"
at ^ shell = 2
at ^ reset

The password in the ^ spword command is a code calculated according to the usual algorithm of v201, but from an IMEI modem deployed backwards. In the calculator for this there is a button Reverse. After entering the commands, the modem reboots.
For a HILINK modem, you should again switch to debug mode via the WEB interface, as I wrote above. As a result, the modem will have 6 serial ports:
ttyUSB0 - AT Command Port
ttyUSB1 - VxWorks console
ttyUSB2 - Linux dwarf
ttyUSB3
ttyUSB4
ttyUSB5 - DSP log


For a stick-modem, you will have to enter into the list of available ports (using the ^ setport command) two additional ports - with numbers 5 and A, for example:
at ^ setport = "FF; 10,12,16, A2,5, A"

As a result, the modem will have 4 serial ports:
ttyUSB0 - AT port for PPP connections
ttyUSB1 - AT port for NDIS connections
ttyUSB2 - Linux dwarf
ttyUSB3 - VxWorks console

The Linux console port is the primary system console (/ dev / console), for which all kernel system messages are issued. Shell there is installed the Android toolbox by default, which is extremely inconvenient in operation. To make your life easier, enter the command:
busybox sh

after which the shell will become busybox and a normal command line editor will appear.
VxWorks also has 2 shells - C-shell (installed by default) and CMD (set by the cmd command). Which one is more convenient is a matter of taste. In both shells there is a help command, and more detailed information on working with the VxWorks command line can be obtained from this document -http://read.pudn.com/d...ls_users_guide_6.2.pdf
Access to the modem OS consoles opens up the broadest prospects for a deep study of the modem code and its hidden capabilities. For lovers of poking around in the code, this is just a bonanza. I want to warn all the others - thoughtless input of commands in consoles can lead to negative consequences - from the hangup of the modem to the destruction of important data structures on the flush and the complete loss of performance. Be careful!
Drivers and programs
Modem unlocking
E3372h
To begin with, this modem has a v4 unlock algorithm, which means the code is not generated by IMEI.

First of all, determine the firmware version of your modem.
The easiest modem withancient firmware (2x.180) unlock AT command:
at ^ nvwrex = 8268,0,12,1,0,0,0,2,0,0,0, a, 0,0,0

You can also use specials. calculators:
Calculator for E3372h
Calculator for E3372h, showing the process, not hanging, able to take the necessary data from the modem and unlock it
Translated (Russian, English and Urdu) calculator for E3372h with a custom interface, showing a process that is not hanging, able to take the necessary data from the modem, find the COM port, save information to a file and unlock

Well, or change the code to eight zeros:Change of OEM and SIMLOCK modem codes E3372N

Next, with firmware2x.200.07 (except 21.200.07.0 0 .209) it's getting harder.
AT commands are blocked, which means you will not change or calculate the code, and you will not remove the lock flag in NVRAM. There are two options:
  1. Flash on a modified firmware, or older
  2. Calculate code through needle method

Further - even worse! Starting with firmware2x.200.15 just do not flash it, you need to translate the modem in the Factory Mode by the AT command:
AT ^ SFM = 1

And since2x.317 - and this hole was closed! Starting from 2x.317 there are three options:
  • Needle method to upgrade to a modified or old firmware
  • Needle method to calculate the code
  • From Huawei there was a flush of keys; in the instructions for the firmware in HiLink, you can find special firmware for flashing on “needle” firmware without pricking.If your not, write in a personal rust3028.
Fortunately, with MTS 22.323, you can roll back to MTSova 21.315, and even though Beeline made a new one, please, without this hole, although not 317, you can also roll back to the old Beeline.
E3372s
As usual, modems from cellular operators are delivered blocked - they can work only with SIM cards of this operator. The list of plmn-codes allowed for use can be found with the at ^ simlock? Command.
Of course, this situation does not suit us - we want, having bought a modem, to use it with any sim card. For this, the manufacturer laid the opportunity to unlock the modem. This is done by entering the unlock code (nlock-code), calculated by a special tricky algorithm from the IMEI modem. Calculator for calculating codescan be downloaded here (there are versions for windows and linux). To unlock, follow these steps;
- Calculate the unlock code using the above calculator. Of all the codes it calculates, the code v201 is used.
- Insert another SIM card into the modem (SIM card of another cellular provider, not the one who sold you the modem).
- Connect the modem to the computer.
Further, the control program (for stick-modems) or the web interface (for hilink-modems) will ask for the unlock code, which must be entered. All - the modem is unlocked and will work with any sim card.
In addition to entering the code through the program and the web interface, you can also enter it via the AT command. This is especially true for stick-modems under linux. The command looks like this:
at ^ cardlock = "unlock code"
The number of attempts to enter the code is limited to 10 attempts. If the wrong code was entered 10 times, the modem blocks further attempts - more, the at ^ cardlock command will not unblock it, even if you enter it with the correct code. If you still managed to exhaust all input attempts, that's okay - they are easy to recover. This is done by the following commands:
at ^ datalock = "unlock code"
at ^ maxlcktms = 10
10 is the new number of attempts (you can enter any number from 1 to 255). Then you can enter the at ^ cardlock command with the correct code and unlock the modem. This method may work on other 4G modems from huawei.
The lock flag (simlock) is stored in the NVRAM of the modem, in record 8268. In addition, in this record is a flag that allows you to completely disable the unlock code. If your mobile operator turned out to be such a gossip that it set this flag, then all at ^ cardlock commands will be rejected by the modem.
But, as you know, there is no reception against scrap. There is a universal possibility of unlocking the modem by direct recording to nvram by executing the AT command in the Terminal program, joining the modem via the PC UI Interface port or DS Unlock:
at ^ nvwrex = 8268,0,12,1,0,0,0,2,0,0,0, a, 0,0,0

The command must be entered carefully, to the nearest comma, so as not to accidentally damage other nvram entries. This method unlocks the modem ALWAYS - with any, including the native sim card, with exhausted input attempts, with the ^ cardlock command blocked ... In general, I do not imagine the condition under which the command would not work.
Firmware
Recommended firmware version for E3372h:E3372h-153_Update_22.323.01.00.143_M_AT_05.10
Recommended firmware version for E3372s:E3372s-153_Update_22.300.09.00.00_M_AT_04.10
Recommended version of the web interface: There are no friends to choose from, taste or color
ATTENTION: Here are original, modified and transitional firmware, as well as original and modified web interfaces.
The difference between the original and modified firmware is that most AT commands can be blocked, as well as the possibility of flashing.Be vigilant and sew the original only when you know what you are doing!
The difference between the original and modified interfaces in the functional, the modified ones have more.Before asking to add some function, please carefully examine all interfaces, most likely it is already implemented in one of them.
In addition, there are so-called transitional firmware, they refer to the stick,but they are not intended for everyday work and the Internet does not work for them.
E3372h
E3372s
Web interfaces
Dashboards
Dashboard Set
Dashboard Mobile Partner
Dashboard 23.015.05.11.143 (MTS) for 827F / 829F (WIN10 + MAC10.11)(In the post firmware + dashboard, please only for E3372h, dashboards are placed on both E3372s and E3372h)
useful links
E3372h
E3372s
Firmware / Recovery
Tweaks
Disassembling and exploring VxWorks for lovers of digging into the firmware -Part 1, Part 2
We determine the date of manufacture by serial number
Install the radiator on 4G-modem
We connect external power- for those with whom the modem is unstable, redefined, etc.
Zabbix and modem in HiLink
Switch device in Project / Debug mode
How to make work only in 4g.
Setting up and running Shadowsocks -kienta on E3372
Differences in the frequency range of modems
Solving the problem with the emergency modem boot port in Windows 8.1 and Windows 10
Sequence of actions for erasing bad-blocks with subsequent firmware from under Linux
Crond launch (crond)
Modes of HiLink modem
Poll results
Attached Image
Attached Image
Attached Image

Compatible with routers
The modem is not programmed for compatibility with routers, on the contrary, manufacturers of routers do this. Therefore, look for a list of compatible models with your router. If you are looking for a router to work with this modem, then create a theme inSelection and Comparison. Here all requests for help with the choice are deleted.
Further, if you need help in order to make friends with the modem router, then you need to ask for help in the subject of the router. Why? Because the routers are very different, people in this thread have no idea what needs to be done to make the modem work with it. Modems, on the contrary, are determined by everything in only a few different ways, something non-standard is rare. This modem has several different methods for determining: RAS, NDIS in Stick-firmware and RNDIS, CDC in HiLink-firmware (RNDIS for Windows, CDC for Linux, including routers. And NDIS is not RNDIS, they are different things). In other words, you need to be friends with a modem router, not a modem with a router, since drivers must be embedded in it. And what can you do with a modem? And nothing, you need to pick a router, the manufacturer did not put the driver in it.
In case you are being driven from the router's topic here, you do not need to write about it, there are no exceptions and the post will still be deleted. It is better to skip the link to this text in the topic of the router, so that they understand that they are wrong. And if it didn’t help, well, that means no luck.

PS: the most hassle-free scheme with a router: HiLink firmware on a modem with auto-switching in CDC + Zyxel Keenetic 4G III rev.A with Padavan firmware

K
The curator is looking for a topic!
Main tasks: updating the topic header, monitoring the observance of forum rules in the topic.Requirements for candidates to the curators of the forum.
Those wishing to write in QMS moderators section or inI want to be curator.


Post has been editedRamsteiner - 20.04.19, 16:56
rust3028
Message#22
26.01.15, 14:20
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

ADB installationfrom E3372sin E3372h

Download the archive:
busybox wget -g -l adbd_s.tgz -r /vvesu/files/misc/V7R11/adbd_s.tgz vve.su

Allow writing to the system section:
mount -o remount, rw / system / system

Unpack the archive:
busybox tar -xzvf adbd_s.tgz -C / system / xbin

Now ADB can be run and use it:
/ system / xbin / adbd &

Post has been editedrust3028 - 07.06.18, 12:09
rust3028
Message#23
30.01.15, 11:22
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

Autostart ADB and telnet in E3372h

Allow writing to the system section:
root @ android: / # mount -o remount, rw / dev / block / mtdblock16 / system

Add the launch of telnetd and adbd in autorun.sh:
root @ android: / # echo -e "\ nbusybox telnetd -l / bin / sh \ n / system / xbin / adbd &">>/system/etc/autorun.sh

Check the result:
root @ android: / # cat /system/etc/autorun.sh
#! / system / bin / busybox sh

mkdir bin
ln -s / system / bin / sh / bin / sh

/ system / sbin / NwInquire &

busybox echo 0>/ proc / sys / net / netfilter / nf_conntrack_checksum


/system/bin/insmod_ctf_ko.sh
/ etc / huawei_process_start

busybox telnetd -l / bin / sh
/ system / xbin / adbd &
root @ android: / #


Post has been editedrust3028 - 04.05.15, 12:09
rust3028
Message#24
04.02.15, 19:42
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

If you want a number to be displayed in a dashboard or webmord, write it to the SIM card with AT commands:
AT + CPBS = "ON"
AT + CPBW = 1, "+ 79991234567", 145, ""

Check result:
AT + CNUM
+ CNUM: "", "+ 79991234567", 145


Post has been editedrust3028 - 05.02.15, 10:59
rust3028
Message#25
18.02.15, 14:49
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

I decided to post a simple and convenient program written by me for inputting AT commands to modems.
Team history is saved for future sessions.

Screenshot
Attached Image

Attached fileTerminal.rar(135.67 KB)


Post has been editedrust3028 - 24.08.17, 17:16
rust3028
Message#26
01.03.15, 12:14
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

Driver switch for modems with HiLink firmware(alternative to MobileBrServ)

For convenience, assembled the driver in the installer. Removed as normal programs.

Attached fileHUAWEI_HiLink_Switch_Driver_Setup.rar(471.8 KB)

May not work in Windows 10!

Post has been editedrust3028 - 01.09.16, 12:25
rust3028
Message#27
02.03.15, 11:46
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

Installing HUAWEI Modem 3.5 Dashboard in E3372h

Enable and activate the console port (5) by entering AT commands
AT ^ SETPORT = "A1, A2; 10,12,16,5, A1, A2"
AT ^ NVWREX = 33,0,4,2,0,0,0

Restart modem - AT ^ RESET.

Insert the SD memory card formatted in FAT32 into the modem and write the hwmodem35.iso file unpacked from the archive to its root
Attached filehwmodem35.rar(16.42 MB)

Reconnect the modem.

Connect terminal program to the console port. This port in the remote control is called "HUAWEI Mobile Connect - 3G GPS Interface". Enter commands
/ #mount -t vfat / dev / block / mmcblk0p1 / mnt / sdcard
/ #busybox cp /mnt/sdcard/hwmodem35.iso / root / ISO

Now you can remove the memory card, reconnect the modem and make sure that the contents of the modem's CD has changed.

In the same way, you can download any other dashboard or return the stock Connect Manager
Attached fileUTPS23.015.05.07.143_MAC23.015.05.07.143_ISO.rar(62.02 MB)


Post has been editedrust3028 - 03.03.15, 11:55
rust3028
Message#28
06.03.15, 16:10
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

Flashing modem E3372hin HiLink

It is assumed that the modem is unmodified firmware.

1. Remove the installed carrier software from the computer.

2. Install driversHUAWEI DataCard Driver from here.

3. Install the driverFC Serial from here.

4. Enable modem switching to working composition in Windows.

5. If the firmware version in the modem is lower than 2x.200.15.xx.xx or ends in .00, then go to step 6.
If the modem firmware22.3xx.xx.xx.143flashAttached fileE3372h-153_Update_21.329.05.00.00_M_01.10_for_.143.rar(40.19 MB)
If the modem firmware21.3xx.xx.xx.209flashAttached fileE3372h-153_Update_21.329.05.00.00_M_01.10_for_.209.rar(40.19 MB)
If the modem firmware22.3xx.xx.xx.161flashAttached fileE3372h-153_Update_21.180.01.00.00_M_01.10_for_.161.rar(41.09 MB)
If the modem firmware22.3xx.xx.xx.391flashAttached fileE3372h-153_Update_21.180.01.00.00_M_01.10_for_.391.rar(41.09 MB)
If the modem firmware22.3xx.xx.xx.1441flashAttached fileE3372h-153_Update_21.329.05.00.00_M_01.10_for_.1441.rar(40.19 MB)
If the modem firmware2x.3xx.xx.xx.778flashAttached fileE3372h-153_Update_21.180.01.00.00_M_01.10_for_.778.rar(41.09 MB)
If the modem firmware2x.3xx.xx.xx.965flashAttached fileE3372h-153_Update_21.329.05.00.00_M_01.10_for_.965.rar(40.19 MB)
If the modem firmware22.3xx.xx.xx.715flashAttached fileE3372h-153_Update_21.180.01.00.00_M_01.10_for_.715.rar(41.09 MB)
If there is another firmware in the modem, enter the AT command
AT ^ SFM = 1
Screenshot
Attached Image
If instead of "OK" the modem answers "ERROR", then further actions should not be performed - in this case, the flashing is possible only by the "needle method".

6. Flash highlink firmwareE3372h-153_Update_22.333.01.00.00_M_AT_05.10 from here.

7. Flash web interfaceUpdate_WEBUI_17.100.13.01.03_HILINK_Mod1.xfrom here.

If, after flashing, the modem cannot connect to the Internet due to the lack of a profile, and the profile cannot be created manually, you should use the script erase_userdata_e3372h.cmd from the archive erase_userdata_e3372.rarfrom here.

After completion of the flashing, if necessary, unlock the device (untie it from the operator), change IMEI and activate the TTL fix.
To do this, you can use the appropriate scripts.from here.

Post has been editedrust3028 - 27.02.19, 12:38
sm1991
Message#29
14.03.15, 16:58
Local
*****
[offline]

Group: Friendssavagemessiahzine.com
Messages 361
Check in: 17.05.13

Reputation:-  5  +

Hello!
I bought today such a modem from MTS.

I was advised by an acquaintance of our MTS-modem to buy a Zyxel Keenetic 4G II router
Tell me, is it well compatible with this modem?

And another question, advise which antenna is better to buy in order to improve the signal? Well, where to buy - from us in Russia or from China?
M
4.17. It is forbidden to discuss unrelated issues in one topic.


Post has been editedctich - 14.03.15, 17:52
sm1991
Message#30
14.03.15, 20:29
Local
*****
[offline]

Group: Friendssavagemessiahzine.com
Messages 361
Check in: 17.05.13

Reputation:-  5  +

Tell me, is this antenna suitable for the MTS 827 modem?
http://shop.huawei.ru/...uawei-crc9-35-dbi.html
Antenna for HUAWEI CRC9 35 dBi modems

M
I gave you links where you can discuss it, just use the search -http: //savagemessiahzine.com/ forum / i ... =% E0% ED% F2% E5% ED% ED% E0, one more question about antennas and you will be punished.


Post has been editedctich - 14.03.15, 21:27
forth32
Message#31
24.03.15, 06:18
Experienced
******
[offline]

Group: Friendssavagemessiahzine.com
Messages 694
Check in: 05.12.06
TurboPad 910

Reputation:-  739  +

Maybe someone knows how to drive the modem into CDC-ETHER mode via the autorun of the modem itself ??


And what prevents you from accessing the web server from inside the modem to switch the mode? Through the same curl for example. You can assemble it with the help of android NDK or even find it on the web ready.

The USB_PNP kernel subsystem is such an intricate tangle of code that you can figure it out for years. But I can say that switching the mode through the web server is exactly the same operation as switching the mode via / dev / rndisapp, which implements rust3028 in its firmware. You can also switch directly by referring to the kernel function with this command:
ecall rndis_force_switch_debug_mode

But, I repeat, all this is the same operation. Why does it give rndis in some cases, cdc in others - I have not really understood.

Post has been editedforth32 - 24.03.15, 06:30
rust3028
Message#32
24.03.15, 08:57
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

In firmware D and R, the autorun runs the sw-dbg-mode script, which automatically (after 30 seconds) switches the modem to CDC-RNDIS mode ...

In firmware R, sw-dbg-mode does not start. And sw-dbg-mode is not a script, but a program.
Firmware with R differs from the usual one only in that the record contains 50091 NVRAM
1 0 0 0 FF 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
instead
1 0 0 0 A1 A20 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

Post has been editedrust3028 - 24.03.15, 09:25
Delaril
Message#33
26.03.15, 15:15
Visitor
**
[offline]

Group: Banned
Messages 29
Check in: 18.03.15
Samsung Galaxy S5 SM-G900F

Reputation:-  8  +

Change the web interface to a modified one (the one with operator pictures, etc.) with one click. At one's own risk. You can ruin everything.
Attached Image

Unzip to root
Launch WebRepace.bat
To wait

Attached files

Attached fileWebReplace_mod3.zip(7.81 MB)


Post has been editedilya-fedin - 16.02.17, 03:14
forth32
Message#34
02.04.15, 19:32
Experienced
******
[offline]

Group: Friendssavagemessiahzine.com
Messages 694
Check in: 05.12.06
TurboPad 910

Reputation:-  739  +

At the request of workers, I presentDDNS client service no-ip.comadapted to the E3372S modem. Please note that the program will not work in 3372N (it will not be able to resolve the domain name of the server). Why is this happening - while no one understood.

In short, why it is needed. Although everyone who needs it, probably in the know, but still ...
Dynamic DNS (DDNS) services provide the ability to bind a fully qualified domain name (FQDN), such as username.noip.com, to a specific IP address assigned to one of the network interfaces of the system. The address may be white or gray (local). This may be necessary in such cases:

- Most (if not all) cellular operators provide the "external IP-address" service. In order not to memorize this address (and not to retrain after changing the sim card), you can attach a name to it, for example myoffice.ddns.net, and then use only this name. In addition, some operators may provide a dynamic IP address varying from session to session.
- Even if the external IP service is not connected to you, the gray IP addresses allocated by the provider all the same belong to the same subnet within, for example, a settlement. If the provider has internal routing enabled (and this sometimes occurs), then you can establish a direct connection between clients (for example, from one modem to another).

For example, you have a video surveillance system installed somewhere in the country. And connected to the Internet through a router with a modem inserted into it. You can look at the picture from the installed cameras from home at any time if you know the address of the external interface of the modem, and send the necessary ports to the video surveillance server in the modem. But to find out what address is currently assigned to the modem, and the DDNS service will help.
The service no-ip.com allows, after registering on the site, to have up to 3 names associated with addresses free of charge. To bind IP addresses in devices, launch a special daemon, the noip client. He periodically looks at the address of the WAN interface, and sends this information to the no-ip server, which dynamically updates its DNS server tables. Such a client is usually already built into all home routers, media players, satellite receivers, etc. This client opensource, its sources are on the site no-ip.com. I modified these source codes for the features of our modem and assembled a ready-made binary suitable for running inside the modem. His, along with the source text, I attach to the archive to this post.

The process of installing the client in the modem is quite simple. It must be copied (via adb push, ftp or SD card) somewhere inside the modem's file system. You can in / system / bin - there is enough space, or in / online. In the latter case, the program will not be lost in case of a modem flashing. Then you need to remount the / system partition to enable recording (if you have not already done so) and start the program with the -C key. The program will ask you a few questions about the settings, and create a configuration file /system/etc/no-ip2.conf. Here is an example of a setup session:

# mount -o remount, rw / dev / block / mtdblock15 / system
# / online / noip2 -C
Auto configuration for Linux client of no-ip.com.

Multiple network devices have been detected.

Please select the Internet interface from this list.

By typing the number associated with it.
0 br0
1 wan0
1
Please enter the login / email string for no-ip.com forth32
Please enter the password for user 'forth32' *********

Only one host [forth32.ddns.net] is registered to this account.
It will be used.
Please enter an update interval: [30]
Something like a successful update? [N] (y / N) ^ M

New configuration file '/system/etc/no-ip2.conf' created.

/ #


The setup wizard asks questions:
- from which interface it is necessary to take an IP address (in this case we specify WAN, because the address of the internal interface is not of interest)
- login-password, under which you are registered on the site no-ip.com
- the domain name to which the address of the WAN interface will be associated (if only one name is registered, then it will be used)
- address update interval in minutes.

In this case, the IP address of the modem's WAN interface will be associated with the name forth32.ddns.net.
After answering all the questions, the configuration file will be created and the daemon is ready for operation. It should be run at system startup (for example, from /system/etc/autorun.sh, adding the last line / online / noip2 there). The daemon hangs in the system as a separate process, and periodically sends the WAN address to the no-ip server.

A more detailed description of the client and its settings can be obtained on the website no-ip.com, as well as from the source itself. If there is a desire to compile them of this source its version of the daemon, then the assembly should be done using the Android NDK.
That's all. There will be questions - ask.

Attached files

Attached filenoip2.tar.gz(50.34 KB)


Post has been editedforth32 - 26.11.15, 12:56
rust3028
Message#35
11.04.15, 11:31
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

soit's time to start to teachE3372haccept modified firmware.
To do this, you need to replace the firmware server in the modem with a patched one by flashing the kernel section.
  • Extract the dload_patch folder with the files in it from the archiveAttached filedload_patch_E3372h.rar(54.44 MB)
    and put it in the root of a microSD memory card formatted in FAT32.

  • We enter the Linux console modem.
    If the modem is in stick (for example, out of the box):
    Connect with a terminal program, for example,this, to the port "Mobile Connect - Modem" or "Mobile Connect - PC UI Interface".
    Enable and activate the console port (5) by entering AT commands
    AT ^ SETPORT = "A1, A2; 10,12,16,5, A1, A2"
    AT ^ NVWREX = 33,0,4,2,0,0,0
    AT ^ RESET
    Connect terminal program to the console port. This port in the remote control is called "HUAWEI Mobile Connect - 3G GPS Interface".
    As such a program is well suited PuTTY (Serial mode, speed 1,000,000).
    If you need a password to access the console, enter the OEM code, which can be obtained using a specialcalculator. If the password is correct, the prompt "EUAP>".

    If - in highlink, then access to the console is obtained as describedhere.

  • Mount the memory card:
    mount -t vfat / dev / block / mmcblk0p1 / mnt / sdcard

  • Erase the kernel section (this must be done!):
    / mnt / sdcard / dload_patch / flash_erase / dev / mtd / mtd7 0 0

  • Write the image from the file with the patched firmware server to the partition.
    Depending on the firmware in the modem, we enteronefrom the following commands:
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_21.180.01.00.143.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_21.200.07.00.209.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_22.200.09.01.161.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_21.180.01.00.00.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_21.315.01.00.143.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_22.180.05.00.00.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 /mnt/sdcard/dload_patch/kernel_22.200.03.00.1134.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_22.200.09.00.00.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_22.200.15.00.00.bin
    / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 / mnt/sdcard/dload_patch/kernel_22.315.01.00.00.bin

  • Check the recorded - we make a section dump:
    / mnt / sdcard / dload_patch / nanddump -f /testdump.bin / dev / mtd / mtd7

  • Reboot the modem:
    reboot

In a modem with a stick firmware 21.180.01.00.143, it will look like this:
/ # mount -t vfat / dev / block / mmcblk0p1 / mnt / sdcard
/ # [000216093ms] FAT-fs (mmcblk0p1): IO charset for FAT filesystems, filesystem will be case sensitive!
/ # / mnt / sdcard / dload_patch / flash_erase / dev / mtd / mtd7 0 0
Erasing 128 Kibyte @ 660000 - 100% complete
/ # / mnt / sdcard / dload_patch / nandwrite / dev / mtd / mtd7 /mnt/sdcard/dload_patch/kernel_21.180.01.00.143.bin
Writing data to block 0 at offset 0x0
Writing data to block 1 at offset 0x20000
Writing data to block 2 at offset 0x40000
Writing data to block 3 at offset 0x60000
Writing data to block 4 at offset 0x80000
Writing data to block 5 at offset 0xa0000
Writing data to block 6 at offset 0xc0000
Writing data to block 7 at offset 0xe0000
Writing data to block 8 at offset 0x100000
Writing data to block 9 at offset 0x120000
Writing data to block 10 at offset 0x140000
Writing data to block 11 at offset 0x160000
Writing data to block 12 at offset 0x180000
Writing data to block 13 at offset 0x1a0000
Writing data to block 14 at offset 0x1c0000
Writing data to block 15 at offset 0x1e0000
Writing data to block 16 at offset 0x200000
Writing data to block 17 at offset 0x220000
Writing data to block 18 at offset 0x240000
Writing data to block 19 at offset 0x260000
Writing data to block 20 at offset 0x280000
Writing data to block 21 at offset 0x2a0000
Writing data to block 22 at offset 0x2c0000
Writing data to block 23 at offset 0x2e0000
Writing data to block 24 at offset 0x300000
Writing data to block 25 at offset 0x320000
Writing data to block 26 at offset 0x340000
Writing data to block 27 at offset 0x360000
Writing data to block 28 at offset 0x380000
Writing data to block 29 at offset 0x3a0000
Writing data to block 30 at offset 0x3c0000
Writing data to block 31 at offset 0x3e0000
Writing data to block 32 at offset 0x400000
Writing data to block 33 at offset 0x420000
Writing data to block 34 at offset 0x440000
Writing data to block 35 at offset 0x460000
Writing data to block 36 at offset 0x480000
Writing data to block 37 at offset 0x4a0000
Writing data to block 38 at offset 0x4c0000
Writing data to block 39 at offset 0x4e0000
Writing data to block 40 at offset 0x500000
Writing data to block 41 at offset 0x520000
Writing data to block 42 at offset 0x540000
Writing data to block 43 at offset 0x560000
Writing data to block 44 at offset 0x580000
Writing data to block 45 at offset 0x5a0000
Writing data to block 46 at offset 0x5c0000
Writing data to block 47 at offset 0x5e0000
Writing data to block 48 at offset 0x600000
Writing data to block 49 at offset 0x620000
Writing data to block 50 at offset 0x640000
Writing data to block 51 at offset 0x660000
/ # / mnt / sdcard / dload_patch / nanddump -f /testdump.bin / dev / mtd / mtd7
ECC failed: 0
ECC corrected: 0
Number of bad blocks: 0
Number of bbt blocks: 0
Block size 131072, page size 2048, OOB size 64
Dumping data starting at 0x00000000 and ending at 0x00680000 ...
/ # reboot
[000316646ms] Restarting system.
[000316649ms] power reboot process triggered
[000316653ms] 70-00-01 02:59:31
[000316658ms] ######### power_reboot_cmd_set = 0x52454348 ########
In highlink it is the same, only without diagnostic messages "[nnnnnnnnms] xxxxxxxxx" and the invitation is "root @ android: / #" instead of "/ #".

Now you can check the result.
If the modem is in stick, flash any dashboard, for example,HUAWEI Modem 3.5orMegaFon Internet.
If - in highlink, then -modified web interface.

All this, an idea, of course, not only for the sake of dashboards and webmordas.
Once done with the modem this procedure, then you can sewmodified stick and highlink firmware.

Updateable post

Post has been editedrust3028 - 11.02.16, 15:01
rust3028
Message#36
17.04.15, 13:34
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

Modified web interface for E3372hbased on WebUI 17.100.06.00.03

Assembly features:
  • Unlocked sections "USSD", "Contacts", "SIM-menu".
  • Added the display of some parameters in the section "Device Information", organized their auto-update.
  • Unlocked access to various settings.
  • Added a full selection of network type and range selection.
  • In the main menu, added the item "?" for quick access to the "Device Information" section.
  • Set the default language - Russian.
  • Added display of network type in status bar.
  • Added RSSI display in the tooltip of the signal strength indicator.
  • Added display of download / transfer speed.
  • Made a display of the name of the operator "Yota" instead of "25011".
  • Unlockedhttp://192.168.8.1/html/switchDebugMode.html(including composition with RNDIS, SD and 6 ports) and switchProjectMode.
  • Forbidden to go to the page "Autostart. Found updates. ...".
  • Added the ability to disable the sleep timer for idle time.
  • Fixed time synchronization over the Internet.
  • Added a link to switch to Debug mode.

Screenshots
Attached Image
Attached Image
Attached Image
Attached Image
Attached Image
Attached Image


Based on firmware:
Update_WEBUI_17.100.06.00.03_Hilink_V7R2_9x25_CPIO.exe SHA1 2b2fb0db6f58f54bb79ad59ed079edcd185dc22b
WEBUI_17.100.06.00.03_Hilink_V7R2_9x25_CPIO.bin SHA1 97577866e74704754b1ff2a2373f576e9cae275a
from E3372hWEBUI-V100R007B100D06SP00C03_null_null_05012NEA_AsanFile.Com.zip

Focused on working with firmware 22.180.05.00.00. It also works from 22.200.03.00.1134.

After flashing the web interface, you should reset the settings (Settings->System->Reset).

Attached fileUpdate_WEBUI_17.100.06.00.03_V7R2_CPIO_Mod1.4.rar(15.02 MB)

Updateable post

Post has been editedrust3028 - 08.07.17, 19:20
rust3028
Message#37
17.04.15, 14:22
Guru
*********
[offline]

Group: Friendssavagemessiahzine.com
Messages 6650
Check in: 06.01.14

Reputation:-  2120  +

Modified firmware for E3372h

Stick firmware

Mts
Attached fileE3372h-153_Update_21.315.01.00.143_M_U_01.10.rar(41.06 MB)

Unbranded
Attached fileE3372h-153_Update_21.327.01.00.00_M_U_01.10.rar(40.66 MB)

???
Attached fileE3372h-153_Update_21.328.62.00.429_M_U_01.10.rar(40.26 MB)

Unbranded
Attached fileE3372h-153_Update_21.329.05.00.00_M_U_01.10.rar(41.68 MB)

Unbranded
Attached fileE3372h-153_Update_21.333.01.00.00_M_U_01.10.rar(41.92 MB)

The AT ^ SETPORT = "..." command is not supported with firmware 21.327.01.00.00, 21.328.62.00.429, 21.329.05.00.00 and 21.333.01.00.00. Instead, use the command AT ^ NVWREX = 50091,0,60, .... AT ^ GETPORTMODE works.

HiLink firmware

Unbranded
Attached fileE3372h-153_Update_22.200.15.00.00_M_AT_05.10.rar(43.53 MB)

Unbranded
Attached fileE3372h-153_Update_22.315.01.00.00_M_AT_05.10.rar(43.35 MB)

Russia Open Market (non-operator)
Attached fileE3372h-153_Update_22.317.01.00.778_M_AT_05.10.rar(42.69 MB)

Unbranded
Attached fileE3372h-153_Update_22.323.01.00.00_M_AT_05.10.rar(42.9 MB)

Mts
Attached fileE3372h-153_Update_22.323.01.00.143_M_AT_05.10.rar(41.89 MB)
Attached fileE3372h-153_Update_22.328.62.00.143_M_AT_05.10.rar(41.75 MB)

Unbranded
Attached fileE3372h-153_Update_22.329.07.00.00_M_AT_05.11.rar(43 MB)
Fixed hop limit (TTL) for IPv6

Unbranded
Attached fileE3372h-153_Update_22.333.01.00.00_M_AT_05.10.rar(43.34 MB)
Fixed hop limit (TTL) for IPv6

Modified web interface 17.100.13.01.03for firmware 22.200.09. *, 22.200.15.00.00, 22.315.01.00.00, 22.317.01.00. *, 22.323.01.00. *, 22.328.62.00.143, 22.329.07.00.00 and 22.333.01.00.00.

Features of firmware 22. * _ 02, 22.. * _ 04 and 22. * _ 05:
- There is no need for the AT command ^ DATALOCK, AT commands are unlocked.

- Fixed TTL outgoing packet fixing. Activated by writing the corresponding value to the file / system / etc / fix_ttl.
Script to control TTL commit:Attached filefix_ttl_02.rar(274.49 KB)
Screenshot
Attached Image

- Presentatc program to execute AT commands.

22.*_04:
- Ability to set a password for access to the Linux console via telnet.
Password setting:
mount -o remount / system
busybox passwd
...
reboot
Delete password:
mount -o remount / system
busybox passwd -d root
reboot
If the password is set, you need to enter the root username and password that you set. In this case, the ADB server is not automatically launched, but if necessary it can be started manually: adbd &

22.*_05:
- The possibility of auto-switching modem.
Script for selecting the mode to which the modem will switch:Attached fileset_autoswitch.rar(274.41 KB)
Screenshot
Attached Image
Linux Scriptfrom pamigo777.

- Unlocked access to records 50502 and 50503 through AT-commands for working with NVRAM (in firmware, where this access is blocked).

Designations in the names of modified firmware:
M - firmware with patched so-called firmware server, which allows flashing unsigned firmware, dashboards and web interfaces.

U - firmware with unlocked AT-commands.

HR, HC - H ostless-modem. Automatic switching to secondary, working composition with R NDIS (HR) or C DC (HC) and card reader.
There is no need to use toggle switches, such as MobileBrServ (mbbService) on Windows and usb_modeswitch on Linux.
FirmwareHC It is focused mainly on Linux devices, especially routers that cannot switch the modem to the working mode. Well, for Makosi, apparently, fit.

R - firmware with primary USB-composition with RNDIS, card reader and 6 ports. Therefore, there is no need to switch to the operating mode, i.e. MobileBrServ (mbbService) in Windows and usb_modeswitch in Linux are not needed.
Actually turns the device into a real Hostless modem, such as, for example, ZTE MF823.
It is possible that the modem does not work satisfactorily with these firmwares in Linux, including in routers.

AT or ADB_TLN - firmware with activated ADB and Telnet.


Unmodified firmware
Stick firmware
Megaphone
Attached fileE3372h-153_Update_21.200.07.00.209_01.10.rar(40.95 MB)

Updateable post

Post has been editedrust3028 - 04.02.19, 18:46
forth32
Message#38
24.04.15, 08:26
Experienced
******
[offline]

Group: Friendssavagemessiahzine.com
Messages 694
Check in: 05.12.06
TurboPad 910

Reputation:-  739  +

It is finally time to publicize my very useful development. Our world is completely unfair, and for some reason most of the useful software is written under Windows. We, the linuksoids, are simply ignored, and we have to take care of ourselves. It so happened with our E3372 modem - the standard flasher is available only for Windows. I had to correct this injustice. So, I will introduce the program balong_flash:

HUAWEI Linux Modem Flasher


This program allows you to flash under Linux any firmware in any modem, if, of course, the modem and firmware are compatible with each other. You must first transfer the modem to the firmware mode. This is done with the command at ^ godload. If you have a sticky firmware, then the easiest way is to send this command directly to the AT port using echo:

echo -e "at ^ godload \ r">/ dev / ttyUSB0

If you have a modified HILINK firmware (-adb-tln) installed in your modem, then you can switch the modem to the firmware mode via ADB:

adb connect 192.168.8.1
adb shell 'echo -e "at ^ godload \ r">/ dev / appvcom1 '

Or by entering the modem with a telnet and entering the command

echo -e "at ^ godload \ r">/ dev / appvcom1

If you have an unmodified hilink firmware installed, you must first convert the modem to debug mode (there are a lot of ways to do this, and I will not re-describe them now - everything is in the header), and then send the command at ^ godload to the AT port as described above for stick firmware.

After entering the command at ^ godload, the modem will reboot, and, depending on what firmware is installed on the modem at the moment, a special USB flash composition will be created:
- for stick-firmware, a composition with 3 serial ports is formed, and the firmware port will be older (usually / dev / ttyUSB2)
- for hilink firmware, a composition with 2 serial ports is formed, and the firmware port will be the youngest (usually / dev / ttyUSB0)

At this preparatory operations end, and you can proceed to the firmware. Attached to this post are 2 archives - balong_flash32 and balong_flash64. These are 32-bit and 64-bit versions of the flasher — run the version that suits your OS more. Command line format for the case of a full modem flashing:

./balong_flash -p<firmware port><firmware file name>

Firmware port- This is one ttyUSB-device, formed after switching to firmware mode. As I said before, for two-port compositions, this will be the port with the smallest number (usually / dev / ttyUSB0), for three-port compositions - with the largest (usually / dev / ttyUSB2).
Firmware file nameThis is the file containing the firmware you want to write to the modem. You can directly use .exe files with Windows Flash drivers, or specialized .bin files that are in the firmware archives of Huawei. The program itself will understand the internal file structure. You can specify the main firmware files, web interfaces (for HILINK), dashboards (for stick).
An example of the main firmware write session:
$ ./balong_flash -p / dev / ttyUSB0 E3372Update_22.286.53.01.161_S_ADB_TLN_02.exe

Parse the firmware file ...
Found 10 sections
Entering HDLC mode ...
Protocol Version: 7200B - SKCBADZM
Write section 0 - M3Boot
Write section 1 - M3Boot-ptable
Write section 2 - Fastboot
Write section 3 - Kernel
Write section 4 - VxWorks
Write section 5 - M3Image
Record Section 6 - DSP
Write section 7 - Nvdload
Write section 8 - System
Write section 9 - APP
Block 615 of 616

In this case, the firmware port / dev / ttyUSB0 is used, and the modified hilink firmware version 22.286.53.01.161 is written.
Example of a WebUI entry:
$ ./balong_flash -p / dev / ttyUSB0 Update_WEBUI_16.100.05.00.03_V7R2_CPIO_Mod1.3.exe

Parse the firmware file ...
Found 3 sections
Entering HDLC mode ...
Protocol Version: 7200B - SKCBADZM
Write section 0 - Oeminfo
Write section 1 - CDROMISO
Write section 2 - WEBUI
Block 1946 of 1947


After the end of firmware recording, the modem should be removed from the firmware mode by running the program with the -r key:
$ ./balong_flash -p / dev / ttyUSB0 -r

Entering HDLC mode ... ok
Protocol Version: 7200B - SKCBADZM

Rebooting modem ...

That's all. The modem will restart and start working with the new firmware.
In short, once again the sequence of actions on the firmware:
- we transfer the modem to the firmware mode
- we fill in the main firmware
- fill in dashboards or WebUI
- reboot the modem using the -r key
This sequence is very easily wrapped in a script - that is, you can write a script that automatically changes the modem without any human interaction at all.
Now about what problems can meet. If after the launch, the program cannot initialize the firmware protocol in any way and issues such a curse:
Entering HDLC mode ...
The ^ DATAMODE command is rejected, try again ...
Error getting protocol version, retry ...
The ^ DATAMODE command is rejected, try again ...
The ^ DATAMODE command is rejected, try again ...
The ^ DATAMODE command is rejected, try again ...

That should stop the execution of the program (by ctrl-c) and start it again. The second time everything will turn out. So far I have not figured out how to defeat this glitch, but I will soon think of it.
If the modem, after juggling the power supply, again falls into the firmware mode instead of the operating mode, then simply run the program with the –r key, and the modem will be taken out of the firmware mode.
Sometimes dashboards / webwires do not want to be sewed right away in one session with the main firmware. Then, after recording the main firmware, the modem should be reconnected to the USB port (the modem will automatically enter the firmware mode after the restart) and then flash the missing component.
The capabilities of this program are not limited to full modem firmware. It allows you to cut the firmware file into its component sections, and flash only the necessary set of sections into the modem. You can also independently modify the partition images for the firmware — the checksum of the headers is not checked here, and you can flash anything into the modem. Unlike the Windows firmware, there will never be any nonsense like "port not found", you do not need a whistle with installing / reinstalling drivers, unnecessary interfering processes, all sorts of mbbservice and so on. The program simply flashes the modem with the firmware you need.
So far, the program does not support the update mode with the digital signature verification of the flasher (^ signver), but I will soon add this feature to the program. Then it will be possible to flash the E3372H modem as well - as long as this modem is not supported by the program.
The source code of the latest version of the program is inthis githaba repositoryIf you want to have the latest version of the program with all the useful changes - download the source code from there and build.

Soon I will publish a modem disaster recovery technique, and this flash driver will be indispensable for modem firmware in emergency boot mode.

Attached files

Attached filebalong_flash32.gz(9.68 KB)
Attached filebalong_flash64.gz(23.41 KB)


Post has been editedforth32 - 09.04.18, 15:25
forth32
Message#39
26.04.15, 10:31
Experienced
******
[offline]

Group: Friendssavagemessiahzine.com
Messages 694
Check in: 05.12.06
TurboPad 910

Reputation:-  739  +

So, here's what I promised long ago and now I stand for general use.

Disaster recovery modem firmware E3372SandH


Sometimes there are situations in life when a modem dies completely after flashing. Or we deliberately port something in the configuration of the modem, after which it stops downloading and recognizing through the USB interface. In this branch, very often there are calls for help from the owners of such dead modems. Huawei firmly provided a mechanism to correct such situations - it is called USB_boot, downloading modem firmware via USB.
Initially, a modicum of theory for inquisitive minds (I hope there are such here). Who is not interested - skip and go straight to the practical part just below.
After turning on the modem, a special program is launched - Primary Bootloader (PBL). This program lies in the internal, non-erasable memory (ROM) of the Balong-chip. In normal mode, the only PBL function is to initialize the flash memory subsystem and load the very first partition from there - M3boot, the secondary bootloader. Then the secondary bootloader starts up, loads the rest of the modem firmware ... in general, the description of the rest of the modem startup process is beyond the scope discussed here. But it is possible that PBL does not find the m3boot partition on the flash drive. For example, the flash drive was just soldered to the modem at the factory, and it is still completely clean. Or someone curious, experimenting with the firmware, wiped the beginning of the flash drive. Then PBL enters a special mode - USB Boot. In addition, you can also explicitly tell the PBL to enter this mode by closing a special point on the modem card to the ground.
In USBboot mode, a USB composition is formed with a single USB serial port. In this mode, the modem is identified as 12d1: 1443, with a non-standard manufacturer name (HUA WEI) and product name (USB COM):
[1103827.995613] usb 6-2: New USB device found, idVendor = 12d1, idProduct = 1443
[1103827.995617] usb 6-2: New USB device strings: Mfr = 1, Product = 2, SerialNumber = 0
[1103827.995620] usb 6-2: Product: USB COM
[1103827.995622] usb 6-2: Manufacturer: HUA WEI
[1103827.995911] option 6-2: 1.0: GSM modem (1-port) converter detected
[1103827.996271] usb 6-2: GSM modem (1-port) converter now attached to ttyUSB0

Through this port, you can download a special system-independent bootloader-flasher - usbloader, supplied with many branded firmware. This loader initializes the modem in firmware mode, as after executing the command AT ^ godload. And the modem will be ready to write to it any existing firmware. To fill the bootloader, a special protocol is used, somewhat similar to Xmodem, for its implementation I wrote a special program.
But there is one important underwater stone. Standard usbloader boot loaders, bundled with the firmware, will boot ALL FLASH while loading! Including all sections of nvram. If you did not bother to make a copy of nvram beforehand, it will be impossible to fully restore the modem. We'll have to flood someone else's nvram with someone else's adaptive settings, and the modem will become a poorly working disabled person. Therefore, I made a patch of the usbloader bootloader, throwing out the procedure for erasing the flash drive from it. And I advise you NEVER TO USE THE FIRM USBLOADER! Use only mine, patched, safe.
At the theory of everything, go to the practice.
Practical part


First we need to transfer the modem to USB download mode. To do this, disassemble the modem, and find a set of technological contact pads under the sim card connector. For the E3372 modemSit will look like this:
Attached Image

In this picture I signed all the sites known to me:
+ 5V - power bus coming from the USB-connector
GND - Earthen tire
Rx - hardware console port receiver
Tx - hardware console port transmitter
Boot - contact to put the modem in emergency boot mode.

For the E3372H modem, the pads are located as follows:
Attached Image

The area marked in red is the emergency load contact. The appointment of the remaining sites is still unknown - as soon as I have such a modem, I will make a full description.

You need to take tweezers, or some other suitable piece of iron, and connect the Boot (red) and GND (black) platforms to each other. Instead of the GND pad, you can use the metal case of the USB connector or any of the metal screens. After closing the Boot point to ground, we insert the modem into the USB connector of the computer, and in a second the jumper can be removed.
The modem will start up in emergency USB song mode with a single serial port. Then, using the balong-usbdload program (attached to this post), the bootloader is poured into the modem. Once again, I warn you - DO NOT ATTEMPT TO USE THE FIRM USBLOADER that comes with the firmware! use the patched usblsafe.bin attached to this post! Otherwise, you will completely lose the nvram of your modem.
The balong-usbdload program is launched from the command line, its format is as follows:

balong-usbdload -p<serial port device name><download file name>


For example:
$ ./balong-usbdload -p / dev / ttyUSB0 usblsafe.bin

Found 2 blocks to load
Load block 0, address = 00000000, size = 3020
Address: 00000800, package # 3 size: 9724
Download block 1, address = 57700000, size = 5720360
Address: 57c74800, package # 5587 size: 2964
Download complete

After the download is complete, the modem is disconnected from the USB bus, and then connected again, but already in the firmware composition with three USB serial ports. The port with the highest number will be the firmware port. Now you can flash any firmware in the modem. I already recently published a flasher.

For users of alternative operating systems of the Windows family, of which here, unfortunately, the majority, the balong-usbload program was transferred to the windows platform. This port was made by the well-known rust3028, for which it relies on many thanks from all the local windup sites. The program running under Windows is launched exactly the same way from the command line, and the COM port number formed in the system after connecting the modem with the Boot pad closed to the ground is used as the -p key value. For example, if this port in the system is called com6, then the command line will look like this:
balong_usbdload -p6 usblsafe.bin

After the modem is restarted in the firmware mode, you can use the regular flash drivers included with each firmware.

In Windows 8.1, the emergency boot port is not detected correctly. To remedy the situation there isrust3028 solution

For this article, I’m running a balong-usbdload program for Linux-32, Linux-64, and Windows platforms. Also included are patched usblsafe secure bootloaders for the E3372S (usblsafe.7z) and E3372H (usblsafe-3372h.7z) modems.
Traditionally, the source code of the program lies inrepositorieson githabe along with patched usb loader. If you need the latest version of the program - take it from there.

Update as of June 15, 2015: rust3028 modified the win32 version of the program. The archive has been updated both in this post and in the repository. Who has the old version - you can download again.

Attached files

Attached filebalong-usbdload-lnx32.tar.gz(10.33 KB)
Attached filebaslong-usbload-lnx64.tar.gz(8.95 KB)
Attached fileusblsafe-3372h.7z(5.51 MB)
Attached fileusblsafe-3372s.7z(5.32 MB)
Attached filebalong_usbdload_win32.rar(34.3 KB)


Post has been editedforth32 - 20.10.15, 14:55
Chujoi13
Message#40
06.05.15, 15:49
Local
*****
[offline]

Group: Friendssavagemessiahzine.com
Messages 321
Check in: 04.02.12
Sony Xperia T2 Ultra

Reputation:-  55  +

I don’t know whether it was said in this topic or not, but I found a way to connect a modem from the MTS 827F which (E3372H) to the Zyxel Keenetic router without flashing. I don’t know why, but at least on the router the latest official NDMS v2.04 (BFW.0) C6 firmware is installed, which should support this modem, but in reality the modem has not started. Well, to the point, in general, I found out that the modem does not start due to the fact that switching the composition to the modem PID router takes the value 15E7, and the router does not know such a PID; then we will make it so that the modem is defined in the router as he wants to see it. To do this, enter the command via any terminal in the modem:

at ^ nvwrex = 50071,0,8,01 00 00 00 FE 14 06 15 (where we change the value 15E7 to 14FE)
and connect the modem to the router, now our router is happy to meet and be friends with the modem. For those who want to return everything back just enter the command:

at ^ nvwrex = 50071,0,8,01 00 00 00 E7 15 06 15 and the modem will return to its original state.
R-5
Message#41
07.05.15, 11:20
Local
*****
[offline]

Group: Friendssavagemessiahzine.com
Messages 199
Check in: 12.10.13
Samsung Galaxy Tab

Reputation:-  0  +

I want to transfer the date card huawei3131 to the modem only mode I enter the command AT ^ SETPORT = "A1, A2; 1,2,3"
Throws Error How to solve a problem

M


Post has been editedctich - 07.05.15, 11:40
Huawei
 

2347 pagesV  < 1 2 3 4 5 6 > » 


 mobile version    Now: 04/30/19, 01:53