A few days back I bought a Huawei E3372 4g usb dongle (mokkula in finnish:D) from DNA Finland for about 50 euros.
As any other Huawei surf stick, this device doesn’t work as usb modem but by default it works as a gateway router over usb ethernet.
This way of working is called HiLink mode and it would be the best option for most of people out there.. and it would be great for me too if it would have set my computer as bastion host or it would have allowed me to forward a few ports to the internet.
Since nothing of that is barely possible, my target was to make this device work as standard USB modem to which I can talk to using standard serial AT commands.
After reading here and there on the internet.. mostly playing with usb_switchmode linux tool and magic strings, I managed to find a simple way to get the USB modem appear among the devices recognized by my computer.. Actually from my raspberry pi.
When I plug the device in my raspberry pi USB port, the device cget recognized as 12d1:1f01 (CD mode) or 12d1:14dc (HiLink mode). Most of the time the raspberry detects it as HiLink device:
gnuton@rpi ~ $ lsusb
Bus 001 Device 004: ID 12d1:1f01 Huawei Technologies Co., Ltd.
gnuton@rpi ~ $ lsusb
Bus 001 Device 006: ID 12d1:14dc Huawei Technologies Co., Ltd.
To enable the USB serial interfaces I noticed that I must
1. Browse http://192.168.8.1
2. Open a new tab and browse http://192.168.8.1/html/switchProjectMode.html
For some reasons you have to browse the home page first.
If the switchProjectMode page fails to load, it worked and in this case you can see that the device has switched to a new hidden product mode 0x1442.
Bus 001 Device 007: ID 12d1:1442 Huawei Technologies Co., Ltd.
Here is what the kernel dmesg prints out:
[87.580847] cdc_ether 1-1.3:1.0 eth1: unregister 'cdc_ether' usb-bcm2708_usb-1.3, CDC Ethernet Device
[242388.323300] usb 1-1.3: new high-speed USB device number 5 using dwc_otg
[242388.425042] usb 1-1.3: New USB device found, idVendor=12d1, idProduct=1442
[242388.425080] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[242388.425097] usb 1-1.3: Product: HUAWEI_MOBILE
[242388.425113] usb 1-1.3: Manufacturer: HUAWEI_MOBILE
[242388.514729] usbcore: registered new interface driver usbserial
[242388.516788] usbcore: registered new interface driver usbserial_generic
[242388.517006] usbserial: USB Serial support registered for generic
[242388.565603] usbcore: registered new interface driver option
[242388.567534] usbserial: USB Serial support registered for GSM modem (1-port)
[242388.568183] option 1-1.3:1.0: GSM modem (1-port) converter detected
[242388.569567] usb 1-1.3: GSM modem (1-port) converter now attached to ttyUSB0
[242388.569849] option 1-1.3:1.1: GSM modem (1-port) converter detected
[242388.571140] usb 1-1.3: GSM modem (1-port) converter now attached to ttyUSB1
This process is currently a manual process that could be be automatized with a simple python script, but I would rather try to find the codes the switch to the serial USB mode using some usb messages sent via usb_switchmode command line utility…
I’ll update you as soon as I find those… since nothing currently on the internet worked so far.
Here a few details about the HW and SW version of my huawei device
Device name: E3372
Hardware version: CL1E3372SM Ver.A
Software version: 22.286.03.00.182
Web UI version: 16.100.05.00.182
PS: Forgot to mention that my raspberry pi B model(at least the one that I own) is not able to power the stick from its usb ports and I have been forced to use a kind of home made powered usb hub to get it working. You could bypass the usb PI fuses if you like to have more current on the USB ports..
After some reading and some hacking I find out quite many interesting things about this device.
First of all, there are two different H3372 hardware versions:
1. H3372 STICK
Those devices have firmware version 21.x.
They work as a 3G USB-Modem which accepts PPP commands through PPP-protocol, although the modem cannot reach more than 20-30 MBit in reception in this mode. Beside PPP-mode, it supports NDIS mode too. NDIS emulates a network interface which through the data is transferred. In both cases the computer gets an IP from the provider for the ppp or wan (NDIS) interface since the modem works as network bridge.
When the device is plugged in the USB port, the computer recognize it as Virtual CD, a mass storage from where a windows pc may get the drivers.
The computer switch the device to modem in a second moment. On Linux the switch works automatically.
The firmware on this device is made of two parts: the main firmware and the dashboard. On the internet you can find instruction on how to flash a new firmware on it. You cannot flash a HiLink firmware on these devices.
H3372s works great with routers having a USB port.
2. H3372 HILINK
HiLink devices have always 22.x as firmware version.
The HiLink firmware let the H3372 operate as a router which communicates to your computer through a USB network interface (usb-ethernet-rndis). The computer gets the network settings via DHCP. Usually the computer gets 192.168.168.1 and the H3373 gets 192.168.8.1 as IP. My device doesn’t support port forwarding(web or UPNP) nor DMZ, but maybe those features may be enabled. I should try to find out more on this topic.
The web interface at http://192.168.8.1 shows you info about LTE/3G quality signal, send and receive SMS and more.
If you like to hack it, this modem supports two special modes: Project and Debug mode.
Debug mode should allow you to communicate to the modem through AT commands,
The Debug mode provides a network interface along with 6 serial interfaces:
[118524.048898] option 1-5:1.2: GSM modem (1-port) converter detected
[118524.049081] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB0 [118524.049181] option 1-5:1.3: GSM modem (1-port) converter detected
[118524.049335] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB1 [118524.049434] option 1-5:1.4: GSM modem (1-port) converter detected
[118524.049590] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB2 [118524.049688] option 1-5:1.5: GSM modem (1-port) converter detected
[118524.049853] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB3
[118524.049954] option 1-5:1.6: GSM modem (1-port) converter detected
[118524.050111] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB4
[118524.050210] option 1-5:1.7: GSM modem (1-port) converter detected
[118524.050488] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB5 [118524.050825] usb-storage 1-5:1.8: USB Mass Storage device detected
Those 6 serial interfaces are:
- Modem/Port for AT commands (ttyUSB0),
- VxWorks console (ttyUSB1),
- Linux console or what you may see in /dev/console (ttyUSB2),
- unknown (ttyUSB3)
- unknown (ttyUSB4)
- DSP log (ttyUSB5)
The debug interface can be enabled by browsing http://192.168.8.1/html/switchDebugMode.html but that didn’t work for me and switchProjectMode.html doesn’t work anymore for me. The following method to switch mode works perfectly and 100% times reliable:
- Get API token by going to http://192.168.8.1/api/webserver/token
- echo “<request><mode>1</mode></request>” | curl -X POST -H “__RequestVerificationToken:1099746139” -H “Content-type: text/xml” -d @- http://192.168.8.1/api/device/mode
VxWorks commands can be found here: http://read.pudn.com/downloads153/doc/670753/vxworks_cli_tools_users_guide_6.2.pdf
If you wanna play with HiLink API, please take a look at: https://blog.hqcodeshop.fi/archives/259-Huawei-E5186-AJAX-API.html
The firmware consists of two parts: WebUI and the main firmware. The main firmware is based on Android 2.3 and runs a 3.4.5 linux kernel. On some Russian websites it’s possible to find custom firmware that unlock some features and allow you to telnet onto the device and allow you to debug the device through the ADB android tool.
Flashing a new firmware on those devices may require an unlock code which can be found on the internet. The unlock code is usually needed when you flash the device for the first time. The code is calculated from the IMEI.
Never flash Stick firmware on those HiLink devices.
Those devices works only with routers that support usb-rndis.
A ton of information can of information can be found at this page http://4pda.ru/forum/lofiversion/index.php?t582284-3660.html
I have played a little bit with the AT commands.. but I’ll show that in a new post!