Huawei e3372

A few days back I bought a Huawei E3372 4g usb dongle (mokkula in finnish:D) from DNA Finland for about 50 euros.
As any other Huawei surf stick, this device doesn’t work as usb modem but by default it works as a gateway router over usb ethernet.
This way of working is called HiLink mode and it would be the best option for most of people out there.. and it would be great for me too if it would have set my computer as bastion host or it would have allowed me to forward a few ports to the internet.
Since nothing of that is barely possible, my target was to make this device work as standard USB modem to which I can talk to using standard serial AT commands.

After reading here and there on the internet.. mostly playing with usb_switchmode linux tool and magic strings, I managed to find a simple way to get the USB modem appear among the devices recognized by my computer.. Actually from my raspberry pi.

When I plug the device in my raspberry pi USB port, the device cget recognized as 12d1:1f01 (CD mode) or 12d1:14dc (HiLink mode). Most of the time the raspberry detects it as HiLink device:

gnuton@rpi ~ $ lsusb
Bus 001 Device 004: ID 12d1:1f01 Huawei Technologies Co., Ltd.
gnuton@rpi ~ $ lsusb
Bus 001 Device 006: ID 12d1:14dc Huawei Technologies Co., Ltd. 

To enable the USB serial interfaces I noticed that I must
1. Browse http://192.168.8.1
2. Open a new tab and browse http://192.168.8.1/html/switchProjectMode.html
For some reasons you have to browse the home page first.
If the switchProjectMode page fails to load, it worked and in this case you can see that the device has switched to a new hidden product mode 0x1442.

root@rpi:/home/gnuton# lsusb
Bus 001 Device 007: ID 12d1:1442 Huawei Technologies Co., Ltd. 

Here is what the kernel dmesg prints out:
[87.580847] cdc_ether 1-1.3:1.0 eth1: unregister 'cdc_ether' usb-bcm2708_usb-1.3, CDC Ethernet Device
[242388.323300] usb 1-1.3: new high-speed USB device number 5 using dwc_otg
[242388.425042] usb 1-1.3: New USB device found, idVendor=12d1, idProduct=1442
[242388.425080] usb 1-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[242388.425097] usb 1-1.3: Product: HUAWEI_MOBILE
[242388.425113] usb 1-1.3: Manufacturer: HUAWEI_MOBILE
[242388.514729] usbcore: registered new interface driver usbserial
[242388.516788] usbcore: registered new interface driver usbserial_generic
[242388.517006] usbserial: USB Serial support registered for generic
[242388.565603] usbcore: registered new interface driver option
[242388.567534] usbserial: USB Serial support registered for GSM modem (1-port)
[242388.568183] option 1-1.3:1.0: GSM modem (1-port) converter detected
[242388.569567] usb 1-1.3: GSM modem (1-port) converter now attached to ttyUSB0
[242388.569849] option 1-1.3:1.1: GSM modem (1-port) converter detected
[242388.571140] usb 1-1.3: GSM modem (1-port) converter now attached to ttyUSB1

This process is currently a manual process that could be be automatized with a simple python script, but I would rather try to find the codes the switch to the serial USB mode using some usb messages sent via usb_switchmode command line utility…
I’ll update you as soon as I find those… since nothing currently on the internet worked so far.

Here a few details about the HW and SW version of my huawei device

Device name: E3372
Hardware version: CL1E3372SM Ver.A
Software version: 22.286.03.00.182
Web UI version: 16.100.05.00.182

PS: Forgot to mention that my raspberry pi B model(at least the one that I own) is not able to power the stick from its usb ports and I have been forced to use a kind of home made powered usb hub to get it working. You could bypass the usb PI fuses if you like to have more current on the USB ports..

UPDATE:
After some reading and some hacking I find out quite many interesting things about this device.
First of all, there are two different H3372 hardware versions:
1. H3372 STICK
Those devices have firmware version 21.x.
They work as a 3G USB-Modem which accepts PPP commands through PPP-protocol, although the modem cannot reach more than 20-30 MBit in reception in this mode. Beside PPP-mode, it supports NDIS mode too. NDIS emulates a network interface which through the data is transferred. In both cases the computer gets an IP from the provider for the ppp or wan (NDIS) interface since the modem works as network bridge.
When the device is plugged in the USB port, the computer recognize it as Virtual CD, a mass storage from where a windows pc may get the drivers.
The computer switch the device to modem in a second moment. On Linux the switch works automatically.
The firmware on this device is made of two parts: the main firmware and the dashboard. On the internet you can find instruction on how to flash a new firmware on it. You cannot flash a HiLink firmware on these devices.
H3372s works great with routers having a USB port.

2. H3372 HILINK
HiLink devices have always 22.x as firmware version.
The HiLink firmware let the H3372 operate as a router which communicates to your computer through a USB network interface (usb-ethernet-rndis). The computer gets the network settings via DHCP. Usually the computer gets 192.168.168.1 and the H3373 gets 192.168.8.1 as IP. My device doesn’t support port forwarding(web or UPNP) nor DMZ, but maybe those features may be enabled. I should try to find out more on this topic.
The web interface at http://192.168.8.1 shows you info about LTE/3G quality signal, send and receive SMS and more.
If you like to hack it, this modem supports two special modes: Project and Debug mode.
Debug mode should allow you to communicate to the modem through AT commands,
The Debug mode provides a network interface along with 6 serial interfaces:

[118524.048898] option 1-5:1.2: GSM modem (1-port) converter detected
[118524.049081] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB0 [118524.049181] option 1-5:1.3: GSM modem (1-port) converter detected
[118524.049335] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB1 [118524.049434] option 1-5:1.4: GSM modem (1-port) converter detected
[118524.049590] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB2 [118524.049688] option 1-5:1.5: GSM modem (1-port) converter detected
[118524.049853] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB3
[118524.049954] option 1-5:1.6: GSM modem (1-port) converter detected
[118524.050111] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB4
[118524.050210] option 1-5:1.7: GSM modem (1-port) converter detected
[118524.050488] usb 1-5: GSM modem (1-port) converter now attached to ttyUSB5 [118524.050825] usb-storage 1-5:1.8: USB Mass Storage device detected

 

Those 6 serial interfaces are:

  1. Modem/Port for AT commands (ttyUSB0),
  2. VxWorks console (ttyUSB1),
  3. Linux console or what you may see in /dev/console (ttyUSB2),
  4. unknown (ttyUSB3)
  5. unknown (ttyUSB4)
  6. DSP log (ttyUSB5)

The debug interface can be enabled by browsing http://192.168.8.1/html/switchDebugMode.html but that didn’t work for me and switchProjectMode.html doesn’t work anymore for me. The following method to switch mode works perfectly and 100% times reliable:

  1. Get API token by going to http://192.168.8.1/api/webserver/token
  2. echo “<request><mode>1</mode></request>” | curl -X POST -H “__RequestVerificationToken:1099746139” -H “Content-type: text/xml” -d @- http://192.168.8.1/api/device/mode

VxWorks commands can be found here: http://read.pudn.com/downloads153/doc/670753/vxworks_cli_tools_users_guide_6.2.pdf
If you wanna play with HiLink API, please take a look at: https://blog.hqcodeshop.fi/archives/259-Huawei-E5186-AJAX-API.html
The firmware consists of two parts: WebUI and the main firmware. The main firmware is based on Android 2.3 and runs a 3.4.5 linux kernel. On some Russian websites it’s possible to find custom firmware that unlock some features and allow you to telnet onto the device and allow you to debug the device through the ADB android tool.
Flashing a new firmware on those devices may require an unlock code which can be found on the internet. The unlock code is usually needed when you flash the device for the first time. The code is calculated from the IMEI.
Never flash Stick firmware on those HiLink devices.
Those devices works only with routers that support usb-rndis.

A ton of information can of information can be found at this page http://4pda.ru/forum/lofiversion/index.php?t582284-3660.html

I have played a little bit with the AT commands.. but I’ll show that in a new post!

22 comments on “Huawei e3372

  1. Do you have information about the modem mode once you switch using switchProjectMode.html ?
    I found out there are many ways to connect to a broadband modem, and I am wondering which one should I try to use: cdc_mbib cdc_ncm (and cdc_huawei_ncm) or qmi_wwan

  2. Do you have information about the modem mode once you switch using switchProjectMode.html ?
    I found out there are many ways to connect to a broadband modem, and I am wondering which one should I try to use: cdc_mbib cdc_ncm (and cdc_huawei_ncm) or qmi_wwan

    I don’t know if the device can be switched using other method than HTTP. But there are a few other interesting tricks I have found:

    http://192.168.8.1/html/switchDebugMode.html – gives you more serial devices to play with
    telnet 192.168.8.1 gives me root access to a Linux distribution, kind of insecure I think.

  3. I have updated the post, please have a look at it! What firmware are you running? is it custom stock or custom firmware?
    Is it a operator branded device or what?

  4. Is it possible to edit the html interface from the Huawei E3372? I want a make a own html for the usb stick when it is possible…. I hope you can help me.

    Kind regards,
    Kevin

  5. Hi,

    Do you know how to upgrade firmware on E3372 Stick? I need it to behave like E3372 Hilink (like a router). I’m searching but can not find any valuable informations (or it is in russian maybe).

    Thx

  6. I have a Huawei E5186 and to open some ports (as launching ATProxy or a serial port ttyUSB2) the only way is to echo “4” | curl -X POST …

    But it is not that easy cause some restrictions like: can not access to theses ports from LAN ip adress

  7. I’m trying to load balance two access with e337 and iptable, but there are many problems because the gw (and the network of course) are the same for both keys

    Maybe there is something to do ?

    Sorry I can’t be more explicit because I’m not at home and I don’t remember the ethernet addresses (something like 192.168.8.x I guess)

  8. Thanks

    | If I got it right the problem that you have is that you have two sticks and both use the same IP address.

    No, just the same lan and the same Gw

    | If you have managed to get into the stick via telnet you could switch set a different address..

    Great ! You mean change the key address ? If yes in this case the both gw should be different for my PC

    I should find some documentations about telnet commands

  9. Oh sorry I forgot, thanks for the link
    But If I can make something with different addresses it should be so much more easier to maintain

  10. Hello.
    I implemented your second switch method via shell script, with xmllint(1) to parse XML documents:

    #!/bin/sh
    IPADDR=$1
    TOKEN=$(curl http://${IPADDR}/api/webserver/token|xmllint –xpath ‘//response/token/text()’ -)
    curl -X POST -H “__RequestVerificationToken:${TOKEN}” -H “Content-type: text/xml” -d “1” http://${IPADDR}/api/device/mode

  11. Interesting. do you have a e3372s or e3372h? I have tested only the e3372s. BTW it depends on the webui you have too. cheers

  12. Hi, I have huawei E3372h dongle which i upgraded with a firmware now it is not detecting any sim card.
    please help.

    Thank you

  13. Hi i have EC8372u-876. But I have installed some other webui. LTE is still working but CDMA network isn’t. Please help me.

  14. Thanks for your guide! Unfortunately it only helped me in a few parts. I wanted be able to send AT commands to change the device’s configuration, not to exchange the fw. However, my device has no switchProjectMode.html. Good news are, I found an alternative via the CGI interface, that’s also a little easier to handle without any Request Tokens.
    I documented my findings here: https://devallthethings.wordpress.com/2016/08/18/fix-busy-line-bug-of-huawei-e5330-without-switchprojectmode-html/

  15. Hi guys,
    I have used the procedure of sending the modeswitch XML to the 192.168.8.1/CGI and modem switched to support serial port – looks good.
    What I’m trying to do is to be able to control APN/user/password from the AT port.
    I have tried AT+CGDCONT / AT^NDISDUP / AT+CGACT to control. I’m able to confgiure but I see the modem always return to a pre-defined profile it has. which override my changes on CGDCONT/CGACT, on first entry at least, setting CGACT=1,1 to work with it instead of the one I added on second entry.
    So my question is – can I delete those pre-defined profiles I see on HiLink, so it won’t override mine.
    Where are those default profiles comming from ? – I assume the operator set them up, I want be to able to remove them by an AT command if possible…
    Thanks.

  16. Thanks! FWIW http://192.168.8.1/api/webserver/token didn’t work for me, I got a verification token by instead visiting the web UI, then getting the var “g_requestVerificationToken” (just copy paste it that in the developer console).

    I also had to copy my cookies (session token) from 192.168.8.1 to make it work.

Leave a Reply

Your email address will not be published. Required fields are marked *