Skip to content

Instantly share code, notes, and snippets.

@smarek smarek/00README.md
Last active Mar 15, 2020

Embed
What would you like to do?
E3372s-153 from Stick mode to HiLink mode automatic installer

E3372s from STICK to HiLink mode installer

You need

  • curl, usb-modeswitch, grep, awk, sudo (not necessary, last step can fail safely)
  • balong_flash in $PATH ( https://github.com/forth32/balongflash.git )
  • atinout in $PATH ( https://github.com/beralt/atinout.git will work fine )
  • 2 files we flash (core sw update version 22.x, WebUI installer), we use these (you can probably use different balong-compatible):
    • core sw: "E3372sUpdate_22.298.03.02.965.BIN" / "E3372sUpdate_22.298.03.02.965.exe"
    • webui: "Update_WEBUI_17.100.06.00.03_Hilink_V7R2_9x25_CPIO.exe"

Scripts handle these situations:

  • Taking the device from storage/cd-rom mode to correct flashing mode (godload)
  • Taking the device from debug mode to correct flashing mode (godload)
  • Handling special state, where 12d1:1442 ttyUSB0 provides AT-mode instead of correct godload
  • Handling, when the device is hi-link but has no UI (see part with curl POST xml to /CGI)

Step-by-step

  • (Optional) put 70-huawei-e3.rules and huawei_e3.conf in correct places for UDEV usb-modeswitch and reload-rules/restart-computer
  • Put all files into one folder, together with firmware 22.x and WebUI updates
  • Plug the E3372s-153 in stick-mode to USB, and wait for it to appear in lsusb
  • Run ./auto_install.sh, observe output
  • If everything runs correctly, the modem will restart itself, script will set it up with ifconfig/dhclient, and web interface should be on address http://192.168.8.1/

WARNING, this is alpha version of scripts, everything you do is on your risk, i do not take any responsibility

# place in /etc/udev/rules.d/70-huawei-e3.rules
SUBSYSTEM=="usb", ACTION=="add", ATTRS{idVendor}=="12d1", ATTRS{idProduct}=="1f01", RUN+="/usr/sbin/usb_modeswitch -c /etc/usb_modeswitch.d/huawei_e3.conf"
SUBSYSTEM=="usb", ACTION=="add", ATTRS{idVendor}=="12d1", ATTRS{idProduct}=="14fe", RUN+="/usr/sbin/usb_modeswitch -c /etc/usb_modeswitch.d/huawei_e3.conf"
SUBSYSTEM=="net", ACTION=="add", ATTRS{idVendor}=="12d1", ATTRS{idProduct}=="14dc", NAME="usb0"
#!/bin/bash
echo () {
bash -c "echo [E3372s stick-to-hilink] $1"
}
IS_14FE=$(lsusb | grep 12d1\:14fe | wc -l)
if [ "$IS_14FE" == "1" ] ; then
echo "14FE (mass-storage), switching to 1506 (AT mode)"
usb_modeswitch --verbose -J -v 0x12d1 -p 0x14fe
sleep 5
else
echo "14FE not found, not switching"
fi
IS_1506=$(lsusb | grep 12d1\:1506 | wc -l)
IS_1C05=$(lsusb | grep 12d1\:1c05 | wc -l)
IS_14DC=$(lsusb | grep 12d1\:14dc | wc -l)
IS_1566=$(lsusb | grep 12d1\:1566 | wc -l)
if [ "$IS_1506" == "1" ] || [ "$IS_1566" == "1" ] ; then
echo "1506/1566 to godload"
./godload.sh
elif [ "$IS_1C05" == "1" ] ; then
echo "already in godload, not switching"
elif [ "$IS_14DC" == "1" ] ; then
echo "in hi-link mode, switching back to debug"
sudo ifconfig usb0 up
sudo dhclient usb0
sleep 3
timeout 3 curl -X POST -d @sw_debug_mode.xml http://192.168.8.1/CGI
sleep 6
./godload.sh
fi
IS_1C05=$(lsusb | grep 12d1\:1c05 | wc -l)
IS_1442=$(lsusb | grep 12d1\:1442 | wc -l)
if [ "$IS_1C05" == "1" ] ; then
balong_flash -p /dev/ttyUSB2 -gd E3372sUpdate_22.298.03.02.965.BIN
sleep 15
elif [ "$IS_1442" == "1" ] ; then
echo "skip, 1442 means 1st balong flash already passed"
else
echo "not in godload mode, exiting"
exit 1
fi
IS_1506=$(lsusb | grep 12d1\:1506 | wc -l)
IS_1442=$(lsusb | grep 12d1\:1442 | wc -l)
if [ "$IS_1506" == "1" ] && [ "$IS_1442" == "0" ] ; then
echo "1506 to godload"
./godload.sh
elif [ "$IS_1442" == "1" ] ; then
echo "skip, 1442 means we are still in godload mode"
else
echo "not 1506 after balong_flash, something went wrong"
exit 1
fi
IS_USB0_AT=$(timeout 5 bash -c "echo 'AT' | atinout - /dev/ttyUSB0 - | grep OK | wc -l")
IS_USB0_AT=$(timeout 5 bash -c "echo 'AT' | atinout - /dev/ttyUSB0 - | grep OK | wc -l")
if [ "$IS_USB0_AT" == "1" ] ; then
./godload.sh
fi
sleep 5
IS_1C05=$(lsusb | grep 12d1\:1c05 | wc -l)
IS_1442=$(lsusb | grep 12d1\:1442 | wc -l)
if [ "$IS_1C05" == "1" ] || [ "$IS_1442" == "1" ] ; then
balong_flash -p /dev/ttyUSB0 -gd Update_WEBUI_17.100.06.00.03_Hilink_V7R2_9x25_CPIO.exe
sleep 15
else
echo "not 1C05 after godload, something went wrong"
exit 1
fi
IS_1F01=$(lsusb | grep 12d1\:1f01 | wc -l)
if [ "$IS_1F01" == "1" ] ; then
usb_modeswitch --verbose -J -v 0x12d1 -p 0x1f01
sleep 5
else
echo "not 1F01 after balong_flash, maybe already automatically usb-modeswitched?"
fi
IS_14DC=$(lsusb | grep 12d1\:14dc | wc -l)
if [ "$IS_14DC" == "1" ] ; then
sudo ifconfig usb0 up
ps aux | grep -i dhclient\ usb0 | awk '{print $2}' | xargs -L1 sudo kill -9
sudo dhclient usb0
./device_info.sh
fi
exit 0
#!/bin/sh
MODEM_IP="192.168.8.1"
curl -s -X GET "http://$MODEM_IP/api/webserver/SesTokInfo" > /tmp/ses_tok.xml
COOKIE=`grep "SessionID=" /tmp/ses_tok.xml | cut -b 10-147`
TOKEN=`grep "TokInfo" /tmp/ses_tok.xml | cut -b 10-41`
curl -s -X GET "http://$MODEM_IP/api/device/information" \
-H "Cookie: $COOKIE" -H "__RequestVerificationToken: $TOKEN" \
-H "Content-Type: text/xml"
# in case of broken MTD16 (data) partition, will print out error 100002
curl -s -X GET "http://$MODEM_IP/api/dialup/profiles" \
-H "Cookie: $COOKIE" -H "__RequestVerificationToken: $TOKEN" \
-H "Content-Type: text/xml"
#!/bin/bash
at() {
timeout 1 echo "$1" | atinout - /dev/ttyUSB0 -
}
echo "[godload] startup"
at "AT"
sleep 1
at "AT"
sleep 1
at "AT^GODLOAD"
echo "[godload] waiting 10 sec"
sleep 10
# place in nano /etc/usb_modeswitch.d/huawei_e3.conf
TargetVendor=0x12d1
TargetProductList="14db,14dc"
HuaweiNewMode=1
NoDriverLoading=1
DefaultVendor=0x12d1
DefaultProduct=0x1f01
<?xml version="1.0" encoding="UTF-8" ?>
<api version="1.0">
<header>
<function>switchMode</function>
</header>
<body>
<request>
<switchType>1</switchType>
</request>
</body>
</api>
@smarek

This comment has been minimized.

Copy link
Owner Author

smarek commented Jun 7, 2018

Sample script output, when everything works well :)

> ./auto_install.sh 
++ grep 12d1:14fe
++ wc -l
++ lsusb
+ IS_14FE=1
+ '[' 1 == 1 ']'
+ echo '14FE (mass-storage), switching to 1506 (AT mode)'
+ bash -c 'echo [E3372s stick-to-hilink] 14FE (mass-storage), switching to 1506 (AT mode)'
bash: -c: line 0: syntax error near unexpected token `('
bash: -c: line 0: `echo [E3372s stick-to-hilink] 14FE (mass-storage), switching to 1506 (AT mode)'
+ usb_modeswitch --verbose -J -v 0x12d1 -p 0x14fe
Take all parameters from the command line


 * usb_modeswitch: handle USB devices with multiple modes
 * Version 2.5.0 (C) Josua Dietze 2017
 * Based on libusb1/libusbx

 ! PLEASE REPORT NEW CONFIGURATIONS !

DefaultVendor=  0x12d1
DefaultProduct= 0x14fe
HuaweiNewMode=1

Look for default devices ...
  found USB ID 413c:2513
  found USB ID 413c:818e
  found USB ID 8087:0024
  found USB ID 1d6b:0002
  found USB ID 8087:0024
  found USB ID 1d6b:0002
  found USB ID 1d6b:0003
  found USB ID 413c:2513
  found USB ID 12d1:14fe
   vendor ID matched
   product ID matched
  found USB ID 1d6b:0002
 Found devices in default mode (1)
Access device 016 on bus 001
Get the current device configuration ...
Current configuration number is 1
Use interface number 0
 with class 8
Use endpoints 0x01 (out) and 0x81 (in)

USB description data (for identification)
-------------------------
Manufacturer: HUAWEI_MOBILE
     Product: HUAWEI_MOBILE
  Serial No.: 0123456789ABCDEF
-------------------------
Using standard Huawei switching message
Looking for active driver ...
 OK, driver detached
Set up interface 0
Use endpoint 0x01 for message sending ...
Trying to send message 1 to endpoint 0x01 ...
 OK, message successfully sent
Read the response to message 1 (CSW) ...
 Response reading failed (error -1)
 Device is gone, skip any further commands
-> Run lsusb to note any changes. Bye!

+ sleep 5
++ lsusb
++ grep 12d1:1506
++ wc -l
+ IS_1506=1
++ lsusb
++ grep 12d1:1c05
++ wc -l
+ IS_1C05=0
++ lsusb
++ grep 12d1:14dc
++ wc -l
+ IS_14DC=0
++ grep 12d1:1566
++ lsusb
++ wc -l
+ IS_1566=0
+ '[' 1 == 1 ']'
+ echo '1506/1566 to godload'
+ bash -c 'echo [E3372s stick-to-hilink] 1506/1566 to godload'
[E3372s stick-to-hilink] 1506/1566 to godload
+ ./godload.sh
[godload] startup
AT


OK


OK
AT^GODLOAD
AT^GAT^

OK
[godload] waiting 10 sec
++ lsusb
++ grep 12d1:1c05
++ wc -l
+ IS_1C05=1
++ lsusb
++ grep 12d1:1442
++ wc -l
+ IS_1442=0
+ '[' 1 == 1 ']'
+ balong_flash -p /dev/ttyUSB2 -gd E3372sUpdate_22.298.03.02.965.BIN

 Программа для прошивки устройств на Balong-чипсете, V3.0.280, (c) forth32, 2015, GNU GPLv3
--------------------------------------------------------------------------------------------------

 Код файла прошивки: 0 (UNKNOWN)
                                 
 Цифровая подпись: не найдена
 Версия прошивки: 22.298.03.02.965
 Платформа:       BV7R2HS
 Дата сборки:     2015.01.15 14.45.15
 Заголовок: версия 1, код соответствия: HWEW11.1
 Версия протокола: 7200B--SKCBADZM
 Идентификатор устройства: HUAWEI BV7R2HS
----------------------------------------------------

##  ---- Имя раздела ---- записано
00  M3Boot                100%
01  M3Boot-ptable         100%
02  Fastboot              100%
03  Kernel                100%
04  VxWorks               100%
05  M3Image               100%
06  DSP                   100%
07  Nvdload               100%
08  System                100%
09  APP                   100%

 Перезагрузка модема...
+ sleep 15
++ lsusb
++ grep 12d1:1506
++ wc -l
+ IS_1506=0
++ lsusb
++ grep 12d1:1442
++ wc -l
+ IS_1442=1
+ '[' 0 == 1 ']'
+ '[' 1 == 1 ']'
+ echo 'skip, 1442 means we are still in godload mode'
+ bash -c 'echo [E3372s stick-to-hilink] skip, 1442 means we are still in godload mode'
[E3372s stick-to-hilink] skip, 1442 means we are still in godload mode
++ timeout 5 bash -c 'echo '\''AT'\'' | atinout - /dev/ttyUSB0 - | grep OK | wc -l'
+ IS_USB0_AT=1
++ timeout 5 bash -c 'echo '\''AT'\'' | atinout - /dev/ttyUSB0 - | grep OK | wc -l'
+ IS_USB0_AT=1
+ '[' 1 == 1 ']'
+ ./godload.sh
[godload] startup




OK
AT


OK
AT^GODLOAD
AT^GAT^

OK
[godload] waiting 10 sec
++ timeout 5 bash -c 'echo '\''AT'\'' | atinout - /dev/ttyUSB0 - | grep OK | wc -l'
fopen(/dev/ttyUSB0) failed: No such file or directory
+ IS_USB0_AT=0
+ '[' 0 == 1 ']'
+ sleep 5
++ lsusb
++ grep 12d1:1c05
++ wc -l
+ IS_1C05=0
++ lsusb
++ grep 12d1:1442
++ wc -l
+ IS_1442=1
+ '[' 0 == 1 ']'
+ '[' 1 == 1 ']'
+ balong_flash -p /dev/ttyUSB0 -gd Update_WEBUI_17.100.06.00.03_Hilink_V7R2_9x25_CPIO.exe

 Программа для прошивки устройств на Balong-чипсете, V3.0.280, (c) forth32, 2015, GNU GPLv3
--------------------------------------------------------------------------------------------------

 Код файла прошивки: e (ISO_WEBUI)
                                 
 Цифровая подпись: 1110 байт
 Хеш открытого ключа: 778A8D175E602B7B779D9E05C330B5279B0661BF2EED99A20445B366D63DD697
 Версия прошивки: INPUT
 Дата сборки:     2014.09.03 10:34:49
 Заголовок: версия 1, код соответствия: HWEW11.1
 Версия протокола: 7200B--SKCBADZM
 Идентификатор устройства: HUAWEI BV7R2HS
----------------------------------------------------

##  ---- Имя раздела ---- записано
00  Oeminfo               100%
01  CDROMISO              100%
02  WEBUI                 100%

 Перезагрузка модема...
+ sleep 15

++ lsusb
++ grep 12d1:1f01
++ wc -l
+ IS_1F01=0
+ '[' 0 == 1 ']'
+ echo 'not 1F01 after balong_flash, maybe already automatically usb-modeswitched?'
+ bash -c 'echo [E3372s stick-to-hilink] not 1F01 after balong_flash, maybe already automatically usb-modeswitched?'
[E3372s stick-to-hilink] not 1F01 after balong_flash, maybe already automatically usb-modeswitched?
++ lsusb
++ wc -l
++ grep 12d1:14dc
+ IS_14DC=1
+ '[' 1 == 1 ']'
+ sudo ifconfig usb0 up
+ ps aux
+ grep -i 'dhclient usb0'
+ awk '{print $2}'
+ xargs -L1 sudo kill -9
kill: (21955): No such process
+ sudo dhclient usb0
+ ./device_info.sh
<?xml version="1.0" encoding="UTF-8"?>
<response>
<DeviceName>E3372</DeviceName>
<SerialNumber>XXXXXXXXXXXXXX</SerialNumber>
<Imei>1234567890123456</Imei>
<Imsi></Imsi>
<Iccid></Iccid>
<Msisdn></Msisdn>
<HardwareVersion>CL1E3372SM</HardwareVersion>
<SoftwareVersion>22.298.03.02.965</SoftwareVersion>
<WebUIVersion>17.100.06.00.03</WebUIVersion>
<MacAddress1>00:0D:87:8E:4B:AC</MacAddress1>
<MacAddress2></MacAddress2>
<ProductFamily>LTE</ProductFamily>
<Classify>hilink</Classify>
<supportmode>LTE|WCDMA|GSM</supportmode>
<workmode>NO SERVICE</workmode>
</response>
+ exit 0
@smarek

This comment has been minimized.

Copy link
Owner Author

smarek commented Jul 10, 2018

Healthy response to device_info.sh script:

<?xml version="1.0" encoding="UTF-8"?>
<response>
<DeviceName>E3372</DeviceName>
<SerialNumber>--redacted--</SerialNumber>
<Imei>--redacted--</Imei>
<Imsi>--redacted--</Imsi>
<Iccid>--redacted--</Iccid>
<Msisdn></Msisdn>
<HardwareVersion>CL1E3372SM</HardwareVersion>
<SoftwareVersion>22.298.03.02.965</SoftwareVersion>
<WebUIVersion>17.100.06.00.03</WebUIVersion>
<MacAddress1>00:0D:87:8E:4B:AC</MacAddress1>
<MacAddress2></MacAddress2>
<ProductFamily>LTE</ProductFamily>
<Classify>hilink</Classify>
<supportmode>LTE|WCDMA|GSM</supportmode>
<workmode>LTE</workmode>
</response>
<?xml version="1.0" encoding="UTF-8"?>
<response>
<CurrentProfile>1</CurrentProfile>
<Profiles>
<Profile>
<Index>1</Index>
<IsValid>1</IsValid>
<Name>T-Mobile Internet</Name>
<ApnIsStatic>1</ApnIsStatic>
<ApnName>internet.t-mobile.cz</ApnName>
<DialupNum>*99#</DialupNum>
<Username>wap</Username>
<Password>wap</Password>
<AuthMode>0</AuthMode>
<IpIsStatic>0</IpIsStatic>
<IpAddress/>
<Ipv6Address/>
<DnsIsStatic>0</DnsIsStatic>
<PrimaryDns/>
<SecondaryDns/>
<PrimaryIpv6Dns/>
<SecondaryIpv6Dns/>
<ReadOnly>2</ReadOnly>
<iptype>2</iptype>
</Profile>
</Profiles>
</response>

Bad response, in case MTD16 partition is broken

<?xml version="1.0" encoding="UTF-8"?>
<response>
<DeviceName>E3372</DeviceName>
<SerialNumber>--redacted--</SerialNumber>
<Imei>--redacted--</Imei>
<Imsi>--redacted--</Imsi>
<Iccid>--redacted--</Iccid>
<Msisdn></Msisdn>
<HardwareVersion>CL1E3372SM</HardwareVersion>
<SoftwareVersion>22.298.03.02.965</SoftwareVersion>
<WebUIVersion>17.100.06.00.03</WebUIVersion>
<MacAddress1>00:0D:87:8E:4B:AC</MacAddress1>
<MacAddress2></MacAddress2>
<ProductFamily>LTE</ProductFamily>
<Classify>hilink</Classify>
<supportmode>LTE|WCDMA|GSM</supportmode>
<workmode>LTE</workmode>
</response>
<?xml version="1.0" encoding="UTF-8"?>
<error>
<code>100002</code>
<message></message>
</error>

In that case:

  • switch to debug mode (using timeout 3 curl -X POST -d @sw_debug_mode.xml http://192.168.8.1/CGI)
  • use "godload.sh" to switch back to flashing mode
  • flash with E3372Update_22.286.53.01.161_S_R_ADB_TLN_02.exe (firmware) and Update_WEBUI_16.100.05.00.03_V7R2_CPIO_Mod1.3.exe (webui)
  • obtain IP address, interface name might differ from linux kernel version (ifconfig, dhclient)
  • telnet to the device (telnet 192.168.8.1)
  • go sh (busybox sh)
  • unmount partition (umount /data)
  • wipe mtd16 (flash_eraseall /dev/mtd/mtd16)
  • use "godload.sh" to switch back to flashing mode
  • flash back previous firmware (E3372sUpdate_22.298.03.02.965.BIN and Update_WEBUI_17.100.06.00.03_Hilink_V7R2_9x25_CPIO.exe)
@neftaly

This comment has been minimized.

Copy link

neftaly commented Oct 4, 2018

Thanks for putting this up!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.