Huawei E3372 (MTS 827F / 829F, MegaFon M150-2, Beeline E3372 / E3370, TELE2 E3372h-153) - Discussion | [usbmodem] [ltemodem]



Rep: (806)
Huawei E3372h / E3372s (MTS 827F / 829F / 829FT, Megaphone M150-2, Beeline E3370) - Discussion



Attached Image




Attention!
The most popular questions with answers and off-topic (which will be deleted), refrain from them so as not to shower you with tomatoes!
The answers to these questions are in the topic header or in other profile topics!
  • How to unlock (unlock) modem
  • How to fix TTL
  • How to change IMEI
  • How to change the MAC address
  • How to bypass the torrent
  • How to make friends with the router
  • How the operator distinguishes the phone from the modem
  • Any question about the operators, including the tariffs Yota, Unlimited, #CanAll, All for ..., MegaEz-Limit, Unlimited Black

Rules of conduct in the subject
  1. We read this item carefully, 90% of messages are deleted due to non-compliance with this item! First check if there is an answer to your question in the FAQ. Use the search on the topic, perhaps a similar question already understood. If you did not find the answer to your question, necessarily attach all the information that is listed in the spoiler " Necessary information for help ", and write as fully as possible so that you do not have to clarify the details.
    If you are unable to unlock or flash the modem, please read all the information in the header (the first message of the topic you are reading now), try different USB cables, operating systems and computers, and only after that if you have failed ask a question.
    Remember - for all actions with your modem, you are responsible, and not someone else. Expect help in the subject, but rely only on yourself.
    Necessary information for help
    You need a screenshot, or text in the log code tag fromDC-Unlocker . An important requirement - the serial number, firmware version and the rest not to paint over!


    If the DC-Unlocker modem does not see, then you can only take a screenshot of the Device Manager.

    You also need a screenshot of the Device Manager with the expanded:
    1. DVD and CD drives
    2. Disk devices
    3. USB controllers
    4. Ports (COM and LPT)
    5. Network adapters
    For Linux users
    We need results in the code tag of the following AT commands:
    1. ATI
    2. AT ^ SN
    3. AT ^ FHVER
    4. AT ^ DLOADINFO?
    5. AT ^ HWVER

    An important requirement - IMEI, serial number, firmware version and the rest do not paint!

    And we also need the results of the lsusb and ifconfig command (not ipconfig!) In the code tag.
  2. Please do not write messages in the style of “I’m not getting anything”, “I tried - it didn’t work”, “Throw me detailed instructions”.
    Better in each message, clearly indicate what specific actions you performed, what result they received, with screenshots.
  3. Questions about the modem with your router ask in the topic of your router. We do not know the features of your router, but they know the subject of the router. Old-timers are not millionaires, they do not have all the routers.
  4. Please remove the images under the spoiler. The image without a spoiler like a man without clothes - looks, to put it mildly, ugly. Anyway, unethical.
  5. Do not use the BMP format! Such messages will be 100% deleted.
  6. Write correctly!
  7. Be sure to read the spoiler. Important information! There really is important information, without knowing which, you can mimic the modem!
Important information!
All the manipulations with the firmware and configuration of the modem you do at your own peril and risk!


  • Existstwo models of modems E3372: E3372 s and E3372 h . They are built on different platforms, firmware from one will not fit the other. Model E3372 h newer and E3372 s already out of production.
  • There are two types of firmware:Stick and Hilink . With the Stick's firmware, the modem will be seen as an AT-modem, to connect to the Internet you need to "dial". With HiLink firmware, the modem is represented by an Ethernet network card and does not require any configuration in the OS.
  • For E3372h modems, the serial number starts atG4P and B6k , and at E3372s - L8f . More precisely, your modem can define like this . You can not flash E3372h firmware from E3372s - get a brick. However, she herself will not go - will give an error. Is that under pressure ...
  • If you have E3372h and firmware on your modem from 2x.200.15.xx.xx to (not including!) 2x.317.xx.xx.xx, then send the command AT ^ SFM = 1 before the firmware, otherwise you will get error 19 ( Moreover, 2x.200.15.xx.xx and above can not be removed from the download mode, you will have to alter using the needle method or look for your firmware on the network and sew on it)
  • If the modem has stopped seeing the network, or has become unknown or an ADB device it means the flash is broken. You can fix it like this .
  • The modem is not compatible with Kaspersky products! The muzzle is unavailable from it, disabling does not help, only delete ! Before buying a modem, think about whether you are ready to abandon this product.
  • The firmware flasher and boot loader (the one used for the needle) under macOS can be foundhere. There is no need to resort to virtualka, and it is dangerous. Also, balong_flash'em can remove the modem from boot mode (switch -r).
  • Formodem works with HiLink firmware in Windows 10 Version 1709 patch required KB4051963 and update the driver through the device manager
  • Change the MAC address is not possible


Beginner, if you don’t understand anything about computers and don’t know where to start, read HERE!
First you need to start by readingRules of the topic, especially the sub-spoiler "Useful info for help" - in order to know what information to provide in case of problems, to know how to ask a question, to know what you shouldn’t ask, etc.Without DC-Unlcoker log and device manager screen with expanded categories from that spoiler, messages will be deleted without warning!
Next, readImportant information- to learn about important nuances and how not to get to the elementary error.

Further, if you just need an unlock, then in this post there is a spoiler "Modem unlocking"(a little running ahead, I will say that most likely" just unlock "will not work, all current models come with strong protection, which is the easiest to defeat with firmware)
And if you need to flash / upgrade the modem, then in the Important Information there is a link to the instructions for the firmware in HiLink and Stick.
In case you need to flash the modem "under the phone" and "so that the operator does not burn the distribution", then there is a FAQdetailed instructionsI.

I would also like to note that there are no such concepts as “flash under mts”, “flash under the beeline”, etc. You will simply not be understood if you ask to flash under some kind of operator.

Also, I present to the attention of a small glossary with local slang and terms:
Glossary
Firmware - starts at 22 (HiLink) or 21 (Stick) and nothing else (for this model). Also, this can be understood not just as a version, but as a file stitched by you, since it is impossible to add modification identifiers to the version, therefore they are present only in the firmware file (For example: M_AT_05, M_01).
Dashboard - management program, or its firmware file. His version starts with 23 or whatever.
HiLink - this is router mode. The modem in this mode has a web interface, like a router (of course, Wi-Fi doesn’t have any growth at all: D), it’s very convenient when using a router, and in general you don’t need to install extra software.
Stick - this is a normal modem that connects through a control program (dashboard) or through the Windows Network Manager (which is built into Windows 7 and higher)
Modified firmware - firmware modified by the forum member. There may be many of them, so it is better to read the explanations for the identifiers that are in the post with these firmware.
Modification Identifiers - short letter designation built-in modifications.
Unlock - unlock modem to work on all SIM-cards.
Cleaning flush - an operation that almost completely clears the internal memory of the modem, clearing away the contrived damage (this modem has such a complex that over time it begins to think that all its internal memory is in error). The link to the installation is in this post, in the spoiler "Useful links ->Firmware / Recovery. "
Needle, pricking, etc. - recovery operation, at which the test point closes. This instruction is also in the FAQ, which was already mentioned above.
About modem
Photo modem
Attached ImageAttached ImageAttached ImageAttached Image
Insides
E3372h
Attached Image
Attached Image

Photo from Sou1t
E3372s
Attached Image
Attached Image

Photo from Sou1t
Location flash chip
Specifications
Supported ranges:
GSM / EDGE / EVDO / LTE / FDD / TDD / UMTS
The speed of data reception modem up to 150 Mbps,
Data transfer rate - up to 50 Mbps

Supported frequencies
GSM / GPRS / EDGE 850/900/1800/1900
UMTS / DC-HSPA + / WCDMA 900/2100
LTE 800/900/1800/2100/2600 MHz

Additionally
MicroSD card support up to 32 GB

External antenna
The type of connector of the external antenna is CRC9, which, in the huawei terminology, is TS-5.
The modem has 2 antenna connectors (for MIMO antennas), a single antenna connects to the connector closest to USB

Operating Systems:
Support for Windows XP SP3, Windows Vista SP1 / SP2, Windows 7, Windows 8, Mac OS X 10.5, 10.6, 10.7, 10.8, Linux

Link to the product page on the manufacturer's website
http: //consumer.huawei…s/tech-specs/e3372.htm
Reviews
Types and features of modem firmware
For this modem, there are 2 fundamentally different types of firmware - STICK and HILINK. Firmware interchangeable, that is, in any modem you can flash any firmware. The following describes their features and provides links to the firmware files.
STICK
With this insertion device behaves like the classic USB-modem: AT-command has a port through which a connection can be via PPP-protocol. That's how work almost all 3G-modems previous generations. In this case, the speed is limited - no more than 20-30 Mbit per reception. Besides PPP-mode, there is NDIS mode. In this modem emulates network interface, through which data is transmitted, and through AT-port are only control commands. In this mode, the speed is not limited. The main feature of the stick-mode - to connect and channel support work is carried out by means of a computer operating system that is connected to the modem. In this case, the computer receives the IP-address directly from the mobile service provider via a DHCP request, and the modem operates as a network bridge passing packets from the computer to the cellular network and vice versa, without changing their way.

The initial USB stick stick composition is a virtual CD-ROM and microSD card reader. In order for modem ports to appear, you need to switch the composition. Under windows, this is done by carrier software available on a virtual CD, or by the huawei proprietary program Mobile Partner. Under linux, switching is done by the usb-modeswitch program. It is possible to prohibit the transformation of songs. This is done with the following command:
AT ^ SETPORT = "FF; 10,12,16"

At the same time, the modem immediately after switching on will look like 2 AT ports and a NDIS network card. CD and microSD will be excluded from the configuration. This mode is extremely convenient for using the modem in various home routers. To switch back the composition with switching, use the command:
AT ^ SETPORT = "A1, A2; 10,12,16, A1, A2"

Version numbers of stick-firmware always start at 21 — for example, 21.285.01.02.143. With this type of firmware, modems from MTS and Megaphone are supplied.

Included with the Stick-firmware, a so-called Dashboard is flashed into the modem - an image of a virtual CD that appears in the system after the modem is connected. This CD contains modem drivers for various operating systems, as well as a control program that establishes a connection to the Internet, reads SMS, makes USSD requests, and so on. There is a universal version of this program from the manufacturer of the Huawei modem (Huawei Modem), as well as specialized versions from specific telecom operators.
HILINK
With firmware HILINK modem operates in the router mode, and appears to the computer as a network interface (usb-ethernet-rndis). The computer receives from the interface network settings via DHCP, and then goes through the Internet, either through a wired LAN. All the care of establishing and maintaining a connection channel modem takes over the computer does not even notice that internet access is via sototvuyu network. In this mode, the modem has its own local IP-address (usually 192.168.8.1), visible from the side of the computer as the default gateway (default route), as well as the external IP-address is obtained from the cellular network. Between the cellular network provider and the local network (modem-computer) is carried out using the routing address translation mechanism (NAT). Provided port forwarding from the external network (port forwarding and DMZ).

Setting up the modem in this mode via WEB-interface, available in the modem, and are available through the local IP-address. Also, through the WEB-interface information is available on the modem status and signal the cellular network connection management, send-receive SMS-messages and USSD-command, the SIM-menu, and more. This is especially valuable for users of Linux, as well as for those who have not the modem is connected to the computer and to a home router. Setting up the modem via AT-commands like stick-in firmware, in a normal mode hilink-firmware is not performed, although it is possible in a special debug mode DebugMode.

The initial composition of USB-modem HILINK-is exactly the same as that of the stick - the virtual CD-ROM reader and microSD. Switching tracks the windows made a small program mbbservice, triggered by the built-in CD. Under linux does usb-modeswitch program. Staff Software Developer modem is not a mode without switching tracks. However, by such a modification mode firmware may make. At the same time lost a built-in card reader SD, but it is possible to use a modem with any router that supports the network card usb-rndis.

Version numbers of hilink firmware always start at 22 — for example, 22.286.03.00.00. With this type of firmware modem comes from Beeline.
HILINK firmware consists of two parts - the firmware itself, and the WebUI (web interface). The first firmware is the main firmware, then the WebUI.

The participants of this forum completed the revision of the standard firmware to extend the functionality and enable the functions initially blocked.

If the modem asks a password when flashing, then it can be calculated with the same calculator (link in the header of the header). It is called flash code there.

Inside the modem, an operating system based on Android 2.3 with a linux 3.4.5 kernel works. Modified firmware allows access to the console of the Linux-part of the modem via telnet:
telnet 192.168.8.1

And also through the Android debugging utility - ADB:
adb connect 192.168.8.1
adb shell
Useful information on the procedure for flashing the modem
When you first flash operator modems, the flash driver will request the Flash code (password).
This code can be calculated from the IMEI modem usingThis code calculator .
If during the firmware the flash program stops seeing the modem, then you need to install the mbbservice drivers.
If you are working under Linux, then you can use the modem firmwareby thisflasher.
If you forgot to flash Dashboard 3.5 before uploading HILINK firmware, then you will not be able to create and edit network connection profiles in the web interface (settings ->profile management). In this case, go to the Linux console (via telnet, adb or A-shell), and enter the commands:

umount / data
(for E3372S)busybox flash_eraseall / dev / mtd / mtd16
(for E3372H)flash_erase / dev / mtd / mtd17 0 0


And then restart the modem.
For windows users, scripts have been developed to automatically perform all actions to resolve problems with profiles. See section useful links.

Note!Each of the firmware consists of 2 components: stick-firmware and Dashboard, hilink-firmware and WebUI. Do not try to flash WebUI on stick-firmware, and Dashboard - on Hilink-firmware. You can bring the modem into a completely non-operational state!
Useful and interesting AT commands and modem configuration
The following commands mainly refer to stick modems. Hilink modems are configured via a web interface, and under normal conditions they do not have an AT command port in the configuration at all. Some commands require the release of a command lock (datalock) using the at ^ datalock comand. This will be noted in the description of specific commands.
Modem Command Help
A list of all commands supported by the modem can be obtained from the command:
at + clac
This list will list all command names that are in the internal modem command table, except for hidden commands. Hidden commands are commands marked with a special flag in the command table. You can find them only by disassembling the kernel of the Linux part of the modem. For those interested, here is a list of these commands for the E3372 modem:
+ CEER
^ CPULOAD
^ MFREELOCKSIZE
^ MEMQUERY
^ CMST
^ CMSTUB
^ CVOICE
^ DDSETEX
^ CMMI
^ ADCTEMP
^ YJCX
^ USSDMODE
^ BOOT
^ CMM
^ RSSI
^ LFROMCONNTOIDLE
^ CNMR
^ CECELLID
^ CIMEI
^ CGAUTH
^ CCIN
^ CSND
^ DWINS
^ SETPID
In general, commands have 4 forms of recording (hereinafter cmd is the name of the command):
atcmd - command without parameters
atcmd? - view the current value of the parameters controlled by the command
atcmd = X - setting parameter values
atcmd =? - request for help on the command format

Each of the commands supports one or more recording forms. For example:

at + cgdcont
+ CME ERROR: Incorrect parameters

The form without parameters is not supported by the command.
at + cgdcont?
+ CGDCONT: 0, "IP", "", "", 0,0,0,0
+ CGDCONT: 1, "IP", "internet.mts.ru", "", 0,0,0,0

The form of request for the current value of the parameters - a list of Internet connection profiles
at + cgdcont = 1, "ip", "internet.mts.ru"
Ok

Assigning a value to the parameters - profile setting 1.
at + cgdcont =?
+ CGDCONT: (0-31), "IP" , (0-2), (0-3), (0,1), (0,1)
+ CGDCONT: (0-31), "IPV6" , (0-2), (0-3), (0.1), (0.1)
+ CGDCONT: (0-31), "IPV4V6" , (0-2), (0-3), (0.1), (0.1)
+ CGDCONT: (0-31), "PPP" , (0-2), (0-3), (0,1), (0,1)

View the + CGDCONT command format and a list of valid parameters.
USB modem control
On the computer side, the USB modem looks like a collection of separate, independent USB devices. The list of devices represented in the modem can be managed using the special command ^ setport.
Initially, after connecting to the computer, modem, usually appears as a CD-ROM reader and microSD. This is - the primary composition of the modem. After a special command from the operating system modem switches its composition to the secondary - there are ports of AT commands and network interfaces. This switching is done solely because of the curvature of the ideological class Windows operating systems, and in many cases only hurts. For example, by connecting the modem to a home router. Therefore it is possible to prohibit such switching - then the modem will be immediately switched to a secondary (working) devices composition.
Command format ^ setport:

at ^ setport = "<list of primary composition>;<secondary composition list>"

Each of the lists is a comma-separated device code. A semicolon is put between the primary and secondary list. In the pre-list, only codes A1, A2 and FF are allowed, in the secondary list, all but FF. The modem understands the following codes:
FF - prohibit the primary composition
10 - AT port for establishing PPP connections (modem)
12 - AT port for setting up NDIS connections (PCUI)
16 - NDIS-network card
5 - Linux console (A-shell)
A - VxWorks console (C-shell)
A1 - CD-ROM with dashboards and drivers
A2 - microSD card reader

Letter codes can be written in both large and small letters. Changing the device list takes effect only after the modem is rebooted (using the at ^ reset command or reconnection).
Note! The command ^ setport is able to manage the composition only in stick firmwares! In hilink, the composition can be changed only by editing the record nvram 50091.

USB song setting examples:

at ^ setport = "a1, a2; 10,12,16, a1, a2" - standard factory composition. Only a CD and a card reader are visible in the primary composition, all AT ports, a network card, a CD, a card reader in the secondary composition.

at ^ setport = "ff; 10,12,16, a2" - composition without switching. Very convenient for use in home routers and computers with operating systems other than windows. After connecting, the modem immediately appears as 2 AT ports, a network card and a card reader.

at ^ setport = "FF; 10,12,16,5, A, A1, A2" - Composition with included all devices that are only in the modem. Convenient for those who need access to modem consoles.

The current usb-track used can be viewed with the ^ getportmode command. For example:
at ^ setport?
^ SETPORT: FF; 10,12,16,5, A, A1, A2
Ok
at ^ getportmode
^ GETPORTMODE: TYPE: WCDMA:, modem: 1, pcui: 2, ncm: 3, a_shell: 4, c_shell: 5, mass: 6, mass_two: 7,

The device names are listed here in the same order as they appear in the ^ setport command. Note that the ^ getportmode command shows exactly the current composition. If you changed it with the ^ setport command, but have not yet reset the modem, the changes will not be taken into account.
Network priority setting and allowed ranges
The modem allows you to explicitly specify with which types of networks (GSM / UMTS / LTE) and the ranges it should work. To do this, use the at ^ syscfgex command. The command format is:

AT ^ SYSCFGEX = "<net_order>",<band>,<roaming>,2,<lteband>,,

<net order> - a list of preferences for network types. Valid values ​​are:
00 - all types of networks
01 - only 2G
02 - only 3G
03 - only 4G
99 - leave the value unchanged
Codes can be combined. Naprimer “0302” - LTE preference ->3G

<band> - code of acceptable ranges for 2G / 3G networks. Possible values:
80 - GSM 1800
300 - GSM 900
80000 - GSM 850
200000 - GSM 1900
400000 - UMTS B1 (2100)
2000000000000 - UMTS B8 (900)
3FFFFFFF - all ranges
Each of the codes is a hexadecimal (HEX) number. To specify a combination of ranges, add the corresponding codes. For example, to set GSM850, GSM900, GSM1800 ranges, you need to calculate 0x80 + 0x300 + 0x0x80000 = 0x80380. This will be the resulting code range - 80380.

<roaming> - permission of the modem in roaming:
0 - ban
1 - allow
2 - leave unchanged

<lte band> - code of valid LTE bands.
1 - B1 (FDD 2100)
4 - B3 (FDD 1800)
40 - B7 (FDD 2600)
80 - B8 (FDD 900)
80000 - B20 (FDD 800)
800C5 - all ranges

As for the 2g / 3g ranges, the codes are hexadecimal numbers that can be added to specify range combinations.

Command example:

AT ^ SYSCFGEX = "00", 3FFFFFFF, 1,2,800C5 , - register in all possible networks and ranges
AT ^ SYSCFGEX = "0302", 400000,1,2,800C5 , - register on the LTE network, if LTE is not available, then on 3G (the modem will not register on 2G networks). All bands are available for LTE, for 3G - only 2100 range.
Search for cellular base stations
This modem has a unique feature - it can do a search of the surrounding base stations (BS). And not only BS operator simkarty inserted into it, and in general all the BS of all operators, the signal from the antenna reaches the modem. For each found BS CID and its output received signal level therefrom. This allows the operator to select the signal with the highest level, as well as select a particular BS for guidance on it an external antenna. The only drawback of the modem - it is able to search only the BS 2G and 3G. LTE-cell he did not seek umeeet.
Search is made with the help of the command at ^ netscan. Before searching, make sure that:
- Internet channel is disabled
- the modem does not see any LTE-cells.
If there is an LTE signal in the district, then the modem should be switched to 2G3G mode using the command AT ^ SYSCFGEX = "0201", 3FFFFFFF, 1,2,800C5 , or in the settings of the web interface.
Also note that this command can only be entered via the management port (PCUI). If you enter it through the port intended for the PPP connection (modem), the command will issue an empty response (just OK and that's it).
Command format:

AT ^ NETSCAN = num, level, mode
num - the number of BS found, from 1 to 20. If more than num BS is found, then the stations with the weakest signal will be excluded from the list
level - the minimum level of the BS signal included in the list. Set in dB, from -110 (lowest level) to -47 (highest level). Stations with a signal level below the level will not be included in the list.
mode - BS type. 0 search 2G stations, 1 - search for 3G stations.
Command example:
at ^ netscan = 20, -108.1
^ NETSCAN: 10638 , 1e7e, 250.02.0, -78.8b77.400000
^ NETSCAN: 10687 , 1e7e, 250.02.0, -79, d5c8,400000
^ NETSCAN: 10662 , 1e7e, 250.02, -82.8ade, 400,000
^ NETSCAN: 10587 , 4cf8,250,20,0, -105, d4fc, 400000
^ NETSCAN: 10563 , 4cf8,250,20,0, -106, d4f9,400000

In this example, a 3G BS search is ordered with a signal level not lower than -108 dB. The result is given in the form of a list, sorted by signal level. The topmost BS is the most powerful, the bottom one is the weakest. List item format:
^ NETSCAN: 10638 , 1e7e, 250.02.0, -78.8b77.400000

1e7e - LAC Station
250 - MCC (Russia)
02 - MNC (in this case - MTS).
0 - I myself would like to know what it is, from the disassembled code I did not understand the meaning of this field.
-78 - signal level of a given BS
8b77 - station CID
400000 is the range in which the BS signal is received (as in the ^ syscfgex command).

According to the results of this example, we can conclude that the strongest signal in a given area is at the MTS, and the antenna should be sent to the BS with CID = 8b77 LAC = 1e7e. Coordinate BS can be viewed on the site xinit.ru.
Unlocking Extended Command Set
Some commands that are listed in the command list are initially blocked. That is, even if you enter a command in the correct format, the modem will respond ERROR. Apparently, this is done to protect against fools - in some cases, the thoughtless use of an extended command set can lead to a complete inoperability of the modem. To access this set of commands, you need to unlock it. This is done by the command:
at ^ datalock = "<password>"
The password is the same nlock-code, calculated by the algorithm 201 from the IMEI modem, which is used to remove simlock. Command example:
at ^ datalock = "13325014"
If the password is entered correctly, the modem will answer OK and release the datalock lock, otherwise ERROR will respond.
Work with NVRAM modem
The modem has a storage of various configuration information - NVRAM. It is organized as a set of variable-length records. Each record has a number - from 0 to 65535, but not all record numbers are physically present in the modem.
To find out the length of a particular entry, use the command:

at ^ nvrdlen =<item>

<item> - record number. In response, the modem gives its length:
at ^ nvrdlen = 8268
^ NVRDLEN: 12

If instead of length the modem responds with ERROR, then there is no record with that number at all in the modem.
You can view the contents of a specific entry with the command:

at ^ nvrdex =<item>,<offset>,<len>

<offset> - offset from the beginning of the recording to the fragment of interest to us (0 - from the beginning)
<len> - the length of the output fragment must be no more than the full length of the record minus the offset.
Example:
at ^ nvrdex = 8268,0,12
^ NVRD: 8268,0,12,01 00 00 00 01 00 00 00 0A 00 00 00

At the beginning of the response, the command parameters are listed separated by commas, then, by space, the bytes of the record contents.

To change the contents of the nvram command is used:

at ^ nvwrex =<item>,<offset>,<len>,<b0><b1>....<bn>

The meaning of the first three parameters is the same as in the reading command. b0 ... bn - bytes written to nvram. They should be exactly len pieces, and they are listed through the space. For example:
at ^ nvwrex = 8268,0,12,1.00 00 00 02 00 00 00 0A 00 00 00


In addition to the above, there are 2 simplified commands for working with nvram - ^ nvrd and ^ nvwr. Unlike the ones discussed above, these commands require the precautionary release of the datalock lock.

at ^ nvrd =<item> - displays a full dump of the specified entry
at ^ nvwr =<item>,<b0>,...<bn> - saves the specified bytes from the beginning of the item.

Change IMEI modem
You can change IMEI with the command:
at ^ cimei = "new imei"

The command requires prior release of the datalock lock. IMEI change is necessary for work in the yota network - the modem needs to install an IMEI modem imei from a device of the type (smartphone, tablet) for which a sim card was purchased.
Please note that for the command to work correctly, a sim card must be inserted into it. Absolutely any. In addition, IMEI must be correct (with the correct last check digit). Incorrect IMEI modem will not accept with an error message. You can check the correctness of IMEIcalculator
Change modem ID
E3372h with megafon firmware does not work with Omni II and other new routers. The fact is that with this firmware the modem model is defined as "MegaFon M150-2", and not "E3372".
This string is stored in the cell NVRAM 53525, and you can replace it with "E3372" with the following AT commands:
AT ^ NVWREX = 53525.0,84.0 1 1 0 0 0 0 0 45 33 33 37 32 48 2D 31 33 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 4 0 32 45 33 33 33 48 4D 0 0
AT ^ NVWREX = 53525,84,84,0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 50 50 31 31 73 2D 53 53 49 43 4B 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 45 33 33 37 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

After that, the modem will be easily identified by kinetics and work.

In general, in ZyXEL modems are defined by vid / pid (in the config), for example, the E3272 block looks like this:
interface CdcEthernet0
description "USB MODEM"
usb device-id 12d1 14db

and for E3372s - like this:
interface CdcEthernet0
description "USB MODEM"
usb device-id 12d1 14dc

Accordingly, you can enter the necessary values ​​manually for any modem: there are libraries for almost everyone, with very few exceptions (for example, sierra modems)
Blocks are given for modems in HiLink mode (with a CdcEthernet0 upgrade).
Manufacturer field editing
It is necessary to check what lies in the cell NVRAM 8203. In the right case, there will be this:
AT ^ NVRDEX = 8203,0,32

^ NVRDEX: 8203,0,32,68 75 61 77 65 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Ok



If different, write this value there.

at ^ nvwrex = 8203,0,32,68 75 61 77 65 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Access to modem command interfaces
The modem is built on the Hisilicon hi6930 chip (Balong v7r2). This chip has in its composition 2 processor cores ARM7. Each processor core runs on its own operating system.
Core 0, at the start of the modem is turned on, running Android 2.3 (kernel Linux v3.4.5). System environment is a stripped-down version Android - without the Dalvik virtual machine. Linux kernel itself is almost completely corresponds to the standard kernel of Android, but has been compiled propietarnye additional modules developed by Huawei - for example, the processor of AT-commands. Furthermore bootstrapping modem AT command processing in the firmware HILINK-linux-modem part of the network stack and supports the work WEB-server.
Kernel 1 is managed by the VxWorks v6.8 real-time operating system. This OS directly manages the radio module and interacts with the cellular network. VxWorks is launched using a special subsystem built into the Linux kernel.
Thus, in the modem operate simultaneously two operating systems. They can interact with each other via ICC subsystem, transmitting a specially formed data packets from one OS to another. ICC contains the debugging tools, allowing you, if desired, to consider in detail the interaction of VxWorks and Linux. Each operating system is composed of a shell, which allows to communicate and give a command OS. Next I'll show you how to access the command line of the operating system.
The easiest way to access the command line is the Linux part of the modem in HILINK firmware. To do this, it is enough to flash the modified firmware from this topic. This firmware allows access to the Linux shell via telnet and adb.
telnet:
telnet 192.168.8.1

adb:
adb connect 192.168.8.1
adb shell

Access via the Android debugger ADB also allows you to transfer and receive files from the internal file system of the modem.

If you have a modem with stick-firmware, or standard (unmodified) HILINK-firmware, then the above methods will not work. In addition, these methods do not allow access to the VxWorks console. Therefore, we consider a more universal method, originally incorporated into the modem by the manufacturer - the A-shell and C-shell ports. Both of these ports are USB-serial devices that are included in the USB-modem compression mode DebugMode. The first one is the Linux console, the second is the VxWorks console.
First you need to get access to the command AT-port of the modem. In stick firmware, this port is available immediately - this is the very first port (/ dev / ttyUSB0). In standard HILINK firmware, the AT port is not available by default. To open access to this port, you need to flash the modified web interface, and then go to the browser at this address:
[url = "http://192.168.8.1/html/switchDebugMode.html"] http://192.168.8.1/html/switchDebugMode.html [/ url]

This will switch the modem to debug mode - now, in addition to the network interface, 6 serial ports are also available. The very first of them will be the command AT-port. Now you need to enter any terminalka on this port, and enter the following AT commands:
at ^ spword = "password"
at ^ shell = 2
at ^ reset

The password in the ^ spword command is a code calculated according to the usual algorithm of v201, but from an IMEI modem deployed backwards. In the calculator for this there is a button Reverse. After entering the commands, the modem reboots.
For a HILINK modem, you should again switch to debug mode via the WEB interface, as I wrote above. As a result, the modem will have 6 serial ports:
ttyUSB0 - AT Command Port
ttyUSB1 - VxWorks console
ttyUSB2 - Linux dwarf
ttyUSB3
ttyUSB4
ttyUSB5 - DSP log


For a stick-modem, you will have to enter into the list of available ports (using the ^ setport command) two additional ports - with numbers 5 and A, for example:
at ^ setport = "FF; 10,12,16, A2,5, A"

As a result, the modem will have 4 serial ports:
ttyUSB0 - AT port for PPP connections
ttyUSB1 - AT port for NDIS connections
ttyUSB2 - Linux dwarf
ttyUSB3 - VxWorks console

The Linux console port is the primary system console (/ dev / console), for which all kernel system messages are issued. Shell there is installed the Android toolbox by default, which is extremely inconvenient in operation. To make your life easier, enter the command:
busybox sh

after which the shell will become busybox and a normal command line editor will appear.
VxWorks also has 2 shells - C-shell (installed by default) and CMD (set by the cmd command). Which one is more convenient is a matter of taste. In both shells there is a help command, and more detailed information on working with the VxWorks command line can be obtained from this document -http://read.pudn.com/d...ls_users_guide_6.2.pdf
Access to the modem OS consoles opens up the broadest prospects for a deep study of the modem code and its hidden capabilities. For lovers of poking around in the code, this is just a bonanza. I want to warn all the others - thoughtless input of commands in consoles can lead to negative consequences - from the hangup of the modem to the destruction of important data structures on the flush and the complete loss of performance. Be careful!
Drivers and software
Modem unlocking
E3372h
To begin with, this modem has a v4 unlock algorithm, which means the code is not generated by IMEI.

First of all, determine the firmware version of your modem.
The easiest modem withancient firmware (2x.180) unlock AT command:
at ^ nvwrex = 8268,0,12,1,0,0,0,2,0,0,0, a, 0,0,0

You can also use specials. calculators:
Calculator for E3372h
Calculator for E3372h, showing the process, not hanging, able to take the necessary data from the modem and unlock it
Translated (Russian, English and Urdu) calculator for E3372h with a custom interface, showing a process that is not hanging, able to take the necessary data from the modem, find the COM port, save information to a file and unlock

Well, or change the code to eight zeros:Change of OEM and SIMLOCK modem codes E3372N

Next, with firmware2x.200.07 (except 21.200.07.0 0 .209) it's getting harder.
AT commands are blocked, which means you will not change or calculate the code, and you will not remove the lock flag in NVRAM. There are two options:
  1. Flash on a modified firmware, or older
  2. Calculate code through needle method

Further - even worse! Starting with firmware2x.200.15 just do not flash it, you need to translate the modem in the Factory Mode by the AT command:
AT ^ SFM = 1

And since2x.317 - and this hole was closed! Starting from 2x.317 there are three options:
  • Needle method to upgrade to a modified or old firmware
  • Needle method to calculate the code
  • From Huawei there was a flush of keys; in the instructions for the firmware in HiLink, you can find special firmware for flashing on “needle” firmware without pricking.If your not, write in a personal rust3028.
Fortunately, with MTS 22.323, you can roll back to MTSova 21.315, and even though Beeline made a new one, please, without this hole, although not 317, you can also roll back to the old Beeline.
E3372s
As usual, modems from cellular operators are delivered blocked - they can work only with SIM cards of this operator. The list of plmn-codes allowed for use can be found with the at ^ simlock? Command.
Of course, this situation does not suit us - we want, having bought a modem, to use it with any sim card. For this, the manufacturer laid the opportunity to unlock the modem. This is done by entering the unlock code (nlock-code), calculated by a special tricky algorithm from the IMEI modem. Calculator for calculating codescan be downloaded here (there are versions for windows and linux). To unlock, follow these steps;
- Calculate the unlock code using the above calculator. Of all the codes it calculates, the code v201 is used.
- Insert another SIM card into the modem (SIM card of another cellular provider, not the one who sold you the modem).
- Connect the modem to the computer.
Further, the control program (for stick-modems) or the web interface (for hilink-modems) will ask for the unlock code, which must be entered. All - the modem is unlocked and will work with any sim card.
In addition to entering the code through the program and the web interface, you can also enter it via the AT command. This is especially true for stick-modems under linux. The command looks like this:
at ^ cardlock = "unlock code"
The number of attempts to enter the code is limited to 10 attempts. If the wrong code was entered 10 times, the modem blocks further attempts - more, the at ^ cardlock command will not unblock it, even if you enter it with the correct code. If you still managed to exhaust all input attempts, that's okay - they are easy to recover. This is done by the following commands:
at ^ datalock = "unlock code"
at ^ maxlcktms = 10
10 is the new number of attempts (you can enter any number from 1 to 255). Then you can enter the at ^ cardlock command with the correct code and unlock the modem. This method may work on other 4G modems from huawei.
The lock flag (simlock) is stored in the NVRAM of the modem, in record 8268. In addition, in this record is a flag that allows you to completely disable the unlock code. If your mobile operator turned out to be such a gossip that it set this flag, then all at ^ cardlock commands will be rejected by the modem.
But, as you know, there is no reception against scrap. There is a universal possibility of unlocking the modem by direct recording to nvram by executing the AT command in the Terminal program, joining the modem via the PC UI Interface port or DS Unlock:
at ^ nvwrex = 8268,0,12,1,0,0,0,2,0,0,0, a, 0,0,0

The command must be entered carefully, to the nearest comma, so as not to accidentally damage other nvram entries. This method unlocks the modem ALWAYS - with any, including the native sim card, with exhausted input attempts, with the ^ cardlock command blocked ... In general, I do not imagine the condition under which the command would not work.
Firmware
Recommended firmware version for E3372h:E3372h-153_Update_22.323.01.00.143_M_AT_05.10
Recommended firmware version for E3372s:E3372s-153_Update_22.300.09.00.00_M_AT_04.10
Recommended version of the web interface: There are no friends to choose from, taste or color

Original STICK firmware and Dashboard for the modem Megaphone M150-2 (E3372h-153)

ATTENTION: Here are original, modified and transitional firmware, as well as original and modified web interfaces.
The difference between the original and modified firmware is that most AT commands can be blocked, as well as the possibility of flashing.Be vigilant and sew the original only when you know what you are doing!
The difference between the original and modified interfaces in the functional, the modified ones have more.Before asking to add some function, please carefully examine all interfaces, most likely it is already implemented in one of them.
In addition, there are so-called transitional firmware, they refer to the stick,but they are not intended for everyday work and the Internet does not work for them.
E3372h
E3372s
Web interfaces
Dashboards
Dashboard Set
Dashboard Mobile Partner
Dashboard 23.015.05.11.143 (MTS) for 827F / 829F (WIN10 + MAC10.11)(In the post firmware + dashboard, please only for E3372h, dashboards are placed on both E3372s and E3372h)
useful links
E3372h
E3372s
Firmware / Recovery
Tweaks
Disassembling and exploring VxWorks for lovers of digging into the firmware -Part 1, Part 2
We determine the date of manufacture by serial number
Install the radiator on 4G-modem
We connect external power- for those with whom the modem is unstable, redefined, etc.
Zabbix and modem in HiLink
Switch device in Project / Debug mode
How to make work only in 4g.
Setting up and running Shadowsocks -kienta on E3372
Differences in the frequency range of modems
Solving the problem with the emergency modem boot port in Windows 8.1 and Windows 10
Sequence of actions for erasing bad-blocks with subsequent firmware from under Linux
Disable online update and redirect WebUI page
Crond launch (crond)
Modes of HiLink modem
Carrier Hold in LTE
"Firmware" to exit boot mode
Access to the Hilink web interface with DHCP disabled
Switch Station - automatic change of the external IP addresses
macOS 10.15 Catalina - medication with instructions
How to use the E3372 macOS Catalina

Poll results
Attached Image
Attached Image
Attached Image

Compatible with routers
The modem is not programmed for compatibility with routers, on the contrary, manufacturers of routers do this. Therefore, look for a list of compatible models with your router. If you are looking for a router to work with this modem, then create a theme inSelection and Comparison. Here all requests for help with the choice are deleted.
Furthermore, if you need help to make friends with a modem with a router, then you need to ask for help in the subject of the router. Why? Because routers are very different, the people in this thread have no idea what to do to the modem with him earned. Modems, on the contrary, all determined to a few different ways, something non-standard is rare. This modem has several different ways to determine: RAS, NDIS Stick-in flash and RNDIS, CDC in HiLink-firmware (RNDIS for Windows, the CDC for Linux, including routers and NDIS - not the RNDIS, are two different things.). In other words, you need to be friends with the modem router and not the modem to the router, as the driver must be included in it. And what can be done with a modem? And anything you need to pick a router, it is not the manufacturer has laid driver.
In case you are being driven from the router's topic here, you do not need to write about it, there are no exceptions and the post will still be deleted. It is better to skip the link to this text in the topic of the router, so that they understand that they are wrong. And if it didn’t help, well, that means no luck.

PS: the most hassle-free scheme with a router: HiLink firmware on a modem with auto-switching in CDC + Zyxel Keenetic 4G III rev.A with Padavan firmware

The curator is looking for a topic!
Main tasks: updating the topic header, monitoring the observance of forum rules in the topic.Requirements for candidates to the curators of the forum.
Those wishing to write in QMS moderators section or inI want to be curator.


Post has been editedferhad.necef - 28.03.20, 20:07
Reason for editing: How to use the E3372 macOS Catalina



Rep: (2131)
Virus9xCIH @ 27.04.19, 22:06*
but apparently he did not stand up for me,

open ports and flash web interface Mod1.20
Huawei E3372 (MTS 827F / 829F, MegaFon M150-2, Beeline E3372 / E3370, TELE2 E3372h-153) - Discussion (Post by Klez777 # 64249777)
Huawei E3372 (MTS 827F / 829F, MegaFon M150-2, Beeline E3372 / E3370, TELE2 E3372h-153) - Discussion (Post by Klez777 # 59835504)

Post has been editedrerih59 - 27.04.19, 18:15



Rep: (0)
Good evening . Presented modem 3372h who tried to unlock by all operators as a result in x-inlosker writes Detecting modem:

selection:
manufacturer - Huawei modems
model - Auto detect (recommended)

modem not found! Tell me how to fix it?



Rep: (1183)
* Ivan 2
that is, from the modem in control?
Tried to open the ports of the script?



Rep: (0)
Ivan @ 2 04.27.19, 22:14*
selection:
manufacturer - Huawei modems
model - Auto detect (recommended)


put in the first column manufacturer Novatel, I have the same modem, now here I suffer with him, if it is new you probably just have to fill in another firmware

rerih59 @ 27.04.19, 21:12*
open ports and flash web interface Mod1.20
Huawei E3372 (MTS 827F / 829F, MegaFon M150-2, Beeline E3372 / E3370, TELE2 E3372h-153) - Discussion (Post by Klez777 # 64249777)
Huawei E3372 (MTS 827F / 829F, MegaFon M150-2, Beeline E3372 / E3370, TELE2 E3372h-153) - Discussion (Post by Klez777 # 59835504)


did everything in the instructions, the port is open, even bear just in case of a change, thought that the tariff may not be suitable, that put bear on a smart, replaced without problems but the interface can not go there, although inloker shows that he zashilsya, here infa inlokera:

Found modem: E3372
Model: Huawei E3372h
IMEI: 019711455892506
Serial NR. : G4PDU17B29003967
Firmware: 22.323.01.00.143
Compile date / time: Mar 1 2017 19:15:24
Hardware ver. : CL2E3372HM
Dashboard version: WEBUI_17.100.17.00.143-Mod1.20_HILINK
Web UI version: WEBUI_17.100.13.01.03-Mod1.10_HILINK
SIM Lock status: unlocked
Wrong codes entered: 0 (unlock attempts left: 10)

HZ what else to do with it ...

Post has been editedVirus9xCIH - 27.04.19, 19:34



Rep: (1183)
* Virus9xCIH,
Try a different browser bro and better beg normal 1.12



Rep: (1183)
* ZVEZDOTHOT,
I personally annoying background 19, does not put
but those ports then x .. can open it is certainly better)))



Rep: (32)
ZVEZDOTHOT @ 27.04.2019, 20:27*
Opera set.

Is that antique version. Opera has long been on Chromium, as well as Google Chrome, as well as Yandex, and Vivaldi ... And melkomyagkie decided on Chromium your IE nag ...



Rep: (1183)
* FedorinoFF,
Opera is a block of advertising and vpn



Rep: (8)
* Ivan 2
Try to change the other port, and then determine how the device in the system tray to check in unlocker



Rep: (0)
About Ilya Fedin - do not you see that he - a perpetual online? What does it mean? This means that it is possible someone did not like and it traversed.
Yesterday I unsubscribed and then in a personal get this message:
"Keeping in the hands of the Internet is not worth asking is not quite good questions"
Here, sit on the forum, not only ordinary people but also gavnyuki from the security services, for which purpose in life - to keep the existing system of things, do a good job and get a bone.
It is a pity, of course, Ilya - a real AC was on this forum.



Rep: (32)
alexlaz1982 @ 27.04.2019, 20:43*
Opera is a block of advertising and vpn

Talk about it was not;)
Ad unit has in the other, put adblock 5sec. But when the right "out of the box" yes - it is convenient. Opera itself for a long time ...



Rep: (1183)
* FedorinoFF,
Respect and Christ is risen



Rep: (0)
Good day.

Installed firmware E3372h-153_Update_22.323.01.00.143_M_AT_05.10
Web face as the last of the cap.

Tariff for MegaFon "Internet S", for tablet and phone. Change IMEI on a tablet or phone - megaphone swears "Your Internet option is not designed to work on this device."

Tell me, what kind of data you want to change to the rate earned?
And is it true that when you change the IMEI (and all of the necessary data) traffic statistics reset? That is, the month was 5GB, I changed the IMEI and more gigabytes came. Either I misinformed? In this case, the question is this: it turns out that it is cheaper to buy a sim card with unlimited telephone tariff?



Rep: (1128)
LucasNNOv @ 28.04.19, 00:26*
Tariff for MegaFon "Internet S", for tablet and phone. Change IMEI on a phone or tablet

Check that bear smenon. not swear
LucasNNOv @ 28.04.19, 00:26*
That is, the month was 5GB, I changed the IMEI and more gigabytes came.

No, only 5 GB. Run out and get involved on the term - 28 days.



Rep: (77)
sert55 @ 27.04.19, 17:09*
As far as I understand, Ilya Fedin long been the topic did not appear, and threw the case.
Looks like it had broken (exhausting) long (several months) Work on the web interface 1.21



Rep: (1183)
* (gp,
His life had broken, I'm telling tse woman with large 1.33



Rep: (37)
And there are differences in addition to wi-fi on the E8372?
It is strange that even the e8372 is cheaper



Rep: (43)
* INFLICTED,
both work equally, already tested
if we take the already e8372


Post has been editedsabvirov - 28.04.19, 09:52



Rep: (-4)
BECHA @ 26.04.19, 08:24*
both through the web to see the face of the modem ID SIM card?


This line ICCID in the device information.



Rep: (5)
1. Guys, tell me, is there any difference which date production e3372h my modem?
I unlocked iPhones by the operator that is produced in September 2018.
There are no features, depending on the date of manufacture?

2. And rightly understand that now in the firmware Hilink latched TTL I can produce without resorting to the method of needle?
needle method now only need to restore already problematic modems?

3. And another question, how do you know which version of firmware is now installed in the modem?

Thank you in advance!


Full version    

Help     rules

Time is now: 04/09/20, 00:01