E3533 » History » Version 6
demodulate, 10/04/2017 03:04 PM
add FCC documents
1 | 1 | demodulate | h1. E3533 |
---|---|---|---|
2 | |||
3 | The E3533 HSPA+ USB stick is a USB type-A device with a single SIM slot. The E3533 appears to use a HiSilicon chipset. It has an external antenna connector inside of the |
||
4 | 3 | demodulate | case which is not exposed to the end user without disassembly. The E3533 costs around 35 Euro at Media Markt unlocked and without ties to a specific carrier. The [[E3531]] is usually available for 15 Euro locked to O2 and it requires ID to purchase because of the included SIM card. |
5 | 1 | demodulate | |
6 | 4 | demodulate | h2. Chipset information |
7 | |||
8 | According to a published Huawei technical document about the CH1E3533SM device we know the following details: |
||
9 | <pre> |
||
10 | Hardware Version: |
||
11 | CH1E3533SM |
||
12 | Platform & Chipset: |
||
13 | Balong V3R3 |
||
14 | BB Hi6758 |
||
15 | PMU Hi6561 |
||
16 | RFIC Hi6361 |
||
17 | </pre> |
||
18 | |||
19 | More information about the platform and each chipset is welcome. |
||
20 | |||
21 | 6 | demodulate | FCC documents: |
22 | https://fccid.io/QISE3533S-58 |
||
23 | |||
24 | 1 | demodulate | Upon insertion @lsusb@ reports: |
25 | <pre> |
||
26 | Bus 001 Device 115: ID 12d1:157d Huawei Technologies Co., Ltd. |
||
27 | </pre> |
||
28 | |||
29 | The @dmesg@ entries generated on first insert show an emulated CD-ROM and a cdc_mbim device: |
||
30 | <pre> |
||
31 | [749819.192948] usb 1-1.2: New USB device found, idVendor=12d1, idProduct=157d |
||
32 | [749819.192955] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 |
||
33 | [749819.192959] usb 1-1.2: Product: HUAWEI Mobile |
||
34 | [749819.192961] usb 1-1.2: Manufacturer: HUAWEI |
||
35 | [749819.192963] usb 1-1.2: SerialNumber: FFFFFFFFFFFFFFFF |
||
36 | [749819.251102] usb-storage 1-1.2:1.0: USB Mass Storage device detected |
||
37 | [749819.251591] scsi host6: usb-storage 1-1.2:1.0 |
||
38 | [749819.971474] usb 1-1.2: usbfs: interface 0 claimed by usb-storage while 'usb_modeswitch' sets config #2 |
||
39 | [749820.191555] cdc_mbim 1-1.2:2.0: SET_NTB_FORMAT failed |
||
40 | [749820.220636] cdc_mbim 1-1.2:2.0: bind() failure |
||
41 | [749820.404469] usb 1-1.2: USB disconnect, device number 46 |
||
42 | [749824.924301] usb 1-1.2: new high-speed USB device number 47 using ehci-pci |
||
43 | [749825.036441] usb 1-1.2: New USB device found, idVendor=12d1, idProduct=157d |
||
44 | [749825.036449] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=3 |
||
45 | [749825.036453] usb 1-1.2: Product: HUAWEI Mobile |
||
46 | [749825.036455] usb 1-1.2: Manufacturer: HUAWEI |
||
47 | [749825.036458] usb 1-1.2: SerialNumber: FFFFFFFFFFFFFFFF |
||
48 | [749825.088470] usb-storage 1-1.2:1.0: USB Mass Storage device detected |
||
49 | [749825.088940] scsi host6: usb-storage 1-1.2:1.0 |
||
50 | [749826.129411] scsi 6:0:0:0: CD-ROM HUAWEI Mass Storage 2.31 PQ: 0 ANSI: 2 |
||
51 | [749826.254200] sr 6:0:0:0: [sr0] scsi-1 drive |
||
52 | [749826.254681] sr 6:0:0:0: Attached scsi CD-ROM sr0 |
||
53 | [749826.254999] sr 6:0:0:0: Attached scsi generic sg1 type 5 |
||
54 | [749829.765943] ISO 9660 Extensions: Microsoft Joliet Level 1 |
||
55 | [749829.766741] ISOFS: changing to secondary root |
||
56 | </pre> |
||
57 | |||
58 | The MBIM device does not always properly initialize on a 4.9.33 kernel. If it doesn't there is an error: |
||
59 | <pre> |
||
60 | [749820.191555] cdc_mbim 1-1.2:2.0: SET_NTB_FORMAT failed |
||
61 | [749820.220636] cdc_mbim 1-1.2:2.0: bind() failure |
||
62 | </pre> |
||
63 | |||
64 | If the MBIM device does properly initialize it may present as follows: |
||
65 | <pre> |
||
66 | [759552.947138] cdc_mbim 1-1.2:2.0: NDP will be placed at end of frame for this device. |
||
67 | [759552.947675] cdc_mbim 1-1.2:2.0: cdc-wdm0: USB WDM device |
||
68 | [759552.948368] cdc_mbim 1-1.2:2.0 wwan0: register 'cdc_mbim' at usb-0000:00:1a.0-1.2, CDC MBIM, bb:cc:dd:ee:ff:ff |
||
69 | [759552.955609] cdc_mbim 1-1.2:2.0 wwp0sXXXXXXXXX: renamed from wwan0 |
||
70 | [759552.995969] usb 1-1.2: USB disconnect, device number 78 |
||
71 | [759552.996056] cdc_mbim 1-1.2:2.0 wwp0sXXXXXXXXX:: unregister 'cdc_mbim' usb-0000:00:1a.0-1.2, CDC MBIM |
||
72 | </pre> |
||
73 | |||
74 | |||
75 | h2. Modem details |
||
76 | |||
77 | @ATI@ output: |
||
78 | <pre> |
||
79 | Manufacturer: huawei |
||
80 | Model: E3533 |
||
81 | Revision: 22.318.25.00.414 |
||
82 | IMEI: 000000000000000 |
||
83 | +GCAP: +CGSM,+DS,+ES |
||
84 | </pre> |
||
85 | |||
86 | @AT^VERSION?@ output: |
||
87 | <pre> |
||
88 | ^VERSION:BDT:Mar 26 2014, 17:17:00 |
||
89 | ^VERSION:EXTS:22.318.25.00.414 |
||
90 | ^VERSION:INTS:22.318.25.00.414 |
||
91 | ^VERSION:EXTD:WEBUI_15.100.10.00.414 |
||
92 | ^VERSION:INTD:WEBUI_15.100.10.00.414 |
||
93 | ^VERSION:EXTH:CH1E3533SM |
||
94 | ^VERSION:INTH:CH1E3533SM Ver.A |
||
95 | ^VERSION:EXTU:E3533 |
||
96 | ^VERSION:INTU:E3533s-2EA |
||
97 | ^VERSION:CFG:1004 |
||
98 | ^VERSION:PRL: |
||
99 | ^VERSION:INI: |
||
100 | </pre> |
||
101 | |||
102 | @AT^DLOADINFO?@ output: |
||
103 | <pre> |
||
104 | swver:22.318.25.00.414 |
||
105 | |||
106 | isover:WEBUI_15.100.10.00.414 |
||
107 | |||
108 | |||
109 | webuiver: |
||
110 | |||
111 | product name:E3533s-2EA |
||
112 | |||
113 | dload type:0 |
||
114 | </pre> |
||
115 | |||
116 | @AT^HWVER@ output: |
||
117 | <pre> |
||
118 | ^HWVER:"CH1E3533SM" |
||
119 | </pre> |
||
120 | |||
121 | h2. Modem configuration |
||
122 | |||
123 | The E3533 modem may be reconfigured in at least four ways: |
||
124 | |||
125 | * @usb_modeswitch@ |
||
126 | * Sending @AT^SETMODE=0@ or @AT^SETMODE=1@ using /dev/ttyUSB0 |
||
127 | * Posting an XML request to the internal webserver listening on 192.168.8.1 when the device is in cdc_ethernet mode |
||
128 | * @AT^GODLOAD@ |
||
129 | |||
130 | h2. Reconfigure the modem with usb_modeswitch: |
||
131 | |||
132 | Serial port with three ttyUSB devices: |
||
133 | <pre>@usb_modeswitch -v 12d1 -p 157d -V 0x12d1 -P 0x157d --message-content "5553424312345678000000000000001106200000010000000 |
||
134 | 0000000000000" -s 60</pre> |
||
135 | |||
136 | @lsusb@ shows: |
||
137 | <pre> |
||
138 | Bus 001 Device 028: ID 12d1:1001 Huawei Technologies Co., Ltd. E169/E620/E800 HSDPA Modem |
||
139 | </pre> |
||
140 | |||
141 | @dmesg@ shows: |
||
142 | <pre> |
||
143 | [749902.292987] usb 1-1.2: new high-speed USB device number 48 using ehci-pci |
||
144 | [749902.403329] usb 1-1.2: New USB device found, idVendor=12d1, idProduct=1001 |
||
145 | [749902.403334] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 |
||
146 | [749902.403337] usb 1-1.2: Product: HUAWEI Mobile |
||
147 | [749902.403338] usb 1-1.2: Manufacturer: HUAWEI |
||
148 | [749902.706904] option 1-1.2:1.0: GSM modem (1-port) converter detected |
||
149 | [749902.707141] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB0 |
||
150 | [749902.707343] option 1-1.2:1.1: GSM modem (1-port) converter detected |
||
151 | [749902.707539] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB1 |
||
152 | [749902.707708] option 1-1.2:1.2: GSM modem (1-port) converter detected |
||
153 | [749902.707894] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB2 |
||
154 | </pre> |
||
155 | |||
156 | Ethernet with cdc_ethernet: |
||
157 | <pre>usb_modeswitch -v 12d1 -p 157d -V 0x12d1 -P 0x157d --message-content "55534243123456780000000000000a11062000000000000100000000000000" -s 60</pre> |
||
158 | |||
159 | @lsusb@ shows: |
||
160 | <pre> |
||
161 | Bus 001 Device 031: ID 12d1:14db Huawei Technologies Co., Ltd. E353/E3131 |
||
162 | </pre> |
||
163 | |||
164 | @dmesg@ shows: |
||
165 | <pre> |
||
166 | [816071.162917] usb 1-1.2: new high-speed USB device number 119 using ehci-pci |
||
167 | [816071.277056] usb 1-1.2: New USB device found, idVendor=12d1, idProduct=14db |
||
168 | [816071.277062] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 |
||
169 | [816071.277065] usb 1-1.2: Product: HUAWEI Mobile |
||
170 | [816071.277067] usb 1-1.2: Manufacturer: HUAWEI |
||
171 | [816071.542615] cdc_ether 1-1.2:1.0 eth0: register 'cdc_ether' at usb-0000:00:1a.0-1.2, CDC Ethernet Device, 00:11:11:11:00:00 |
||
172 | [816071.711157] cdc_ether 1-1.2:1.0 enx001111110000: renamed from eth0 |
||
173 | [816073.487379] cdc_ether 1-1.2:1.0 enx001111110000: kevent 12 may have been dropped |
||
174 | </pre> |
||
175 | |||
176 | |||
177 | h2. Debug mode serial ports |
||
178 | |||
179 | After insertion and reconfiguration to cdc_ethernet, it is possible to interact with the web service on the modem to enable a debug mode. |
||
180 | |||
181 | This XML file switches it into a debug mode where additional AT commands are available: |
||
182 | <pre> |
||
183 | cat << 'EOF' >> debug.xml |
||
184 | <?xml version="1.0" encoding="UTF-8" ?> |
||
185 | <api version="1.0"> |
||
186 | <header> |
||
187 | <function>switchMode</function> |
||
188 | </header> |
||
189 | <body> |
||
190 | <request> |
||
191 | <switchType>1</switchType> |
||
192 | </request> |
||
193 | </body> |
||
194 | </api> |
||
195 | EOF |
||
196 | </pre> |
||
197 | |||
198 | Enable the single serial port mode: |
||
199 | <pre>cat debug.xml | curl -X POST -d @- http://192.168.8.1/CGI</pre> |
||
200 | |||
201 | @lsusb@ shows: |
||
202 | <pre> |
||
203 | Bus 001 Device 032: ID 12d1:1001 Huawei Technologies Co., Ltd. E169/E620/E800 HSDPA Modem |
||
204 | </pre> |
||
205 | |||
206 | @dmesg@ shows: |
||
207 | <pre> |
||
208 | [748005.066836] usb 1-1.2: new high-speed USB device number 32 using ehci-pci |
||
209 | [748005.178045] usb 1-1.2: New USB device found, idVendor=12d1, idProduct=1001 |
||
210 | [748005.178053] usb 1-1.2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 |
||
211 | [748005.178057] usb 1-1.2: Product: HUAWEI Mobile |
||
212 | [748005.178060] usb 1-1.2: Manufacturer: HUAWEI |
||
213 | [748005.367337] option 1-1.2:1.0: GSM modem (1-port) converter detected |
||
214 | [748005.367991] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB0 |
||
215 | </pre> |
||
216 | |||
217 | h2. GODLOAD mode serial port |
||
218 | |||
219 | It is possible to enable a currently undocumented two serial port mode from the single serial port mode. |
||
220 | While configured in debug mode, open /dev/ttyUSB0 and issue the @AT^GOADLOAD@ command. This will close /dev/ttyUSB0 and open two other /dev/ttyUSB0 and /dev/ttyUSB1 devices. Neither device responds to the AT command set. |
||
221 | |||
222 | @lsusb@ shows: |
||
223 | <pre> |
||
224 | Bus 001 Device 124: ID 12d1:1442 Huawei Technologies Co., Ltd. |
||
225 | </pre> |
||
226 | |||
227 | @dmesg@ shows: |
||
228 | <pre> |
||
229 | [818963.315945] usb 1-1.2: New USB device found, idVendor=12d1, idProduct=1442 |
||
230 | [818963.315953] usb 1-1.2: New USB device strings: Mfr=2, Product=1, SerialNumber=0 |
||
231 | [818963.315956] usb 1-1.2: Product: HUAWEI Mobile |
||
232 | [818963.315959] usb 1-1.2: Manufacturer: HUAWEI Technology |
||
233 | [818963.317395] option 1-1.2:1.0: GSM modem (1-port) converter detected |
||
234 | [818963.319958] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB0 |
||
235 | [818963.320236] option 1-1.2:1.1: GSM modem (1-port) converter detected |
||
236 | [818963.320610] usb 1-1.2: GSM modem (1-port) converter now attached to ttyUSB1 |
||
237 | </pre> |
||
238 | |||
239 | h2. Exploring the emulated CD-ROM |
||
240 | |||
241 | In the initial mode, a CD-ROM is emulated. |
||
242 | |||
243 | It is possible to mount this disk: |
||
244 | <pre> |
||
245 | mount /dev/sr0 /mnt/ |
||
246 | mount: /dev/sr0 is write-protected, mounting read-only |
||
247 | </pre> |
||
248 | |||
249 | It contains various drivers for the modem itself: |
||
250 | <pre> |
||
251 | $ ls -l |
||
252 | total 582 |
||
253 | -r-------- 1 user user 1523 Feb 19 2014 ArConfig.dat |
||
254 | -r-------- 1 user user 142416 Jul 24 2013 AutoRun.exe |
||
255 | -r-------- 1 user user 45 Jun 22 2011 AUTORUN.INF |
||
256 | -r-------- 1 user user 94 Apr 5 2011 autorun.sh |
||
257 | dr-x------ 1 user user 2048 Feb 19 2014 HiLink.app |
||
258 | -r-------- 1 user user 3262 Jun 23 2011 install_linux |
||
259 | dr-x------ 1 user user 2048 Feb 19 2014 linux_mbb_install |
||
260 | dr-x------ 1 user user 2048 Feb 19 2014 MobileBrServ |
||
261 | -r-------- 1 user user 439926 Dec 1 2010 Startup.ico |
||
262 | </pre> |
||
263 | |||
264 | The install_linux modem software inspected reports as version 22.001.03.01.03. |
||
265 | |||
266 | h2. Exploring the cdc_ethernet mode |
||
267 | |||
268 | The cdc_ethernet mode creates an ethernet device on your computer. It is possible to change the MAC address of the presented cdc_ethernet device with ip and ifconfig as if it were a normal ethernet device. Using DHCP on this interface will result in being assigned an address in the 192.168.8.100-254 range. The default route is 192.168.8.1. The device itself has a clock which is exposed in ICMP, DHCP, and HTTP requests. They're not all in sync. |
||
269 | |||
270 | This default router address 192.168.8.1 exposes DNS, DHCPD, HTTPD and a UPnP daemon: |
||
271 | <pre> |
||
272 | DHCPD - unknown server - other than 192.168.8.1 as router/dns it reports hi.link as the dns search domain |
||
273 | DNS - fpdns says: fingerprint (192.168.8.1, 192.168.8.1): Meilof Veeningen Posadis [Old Rules] |
||
274 | DNS - nmap says ISC BIND (Fake version: [secured]) |
||
275 | HTTPD - webui: 192.168.8.1 - mini_httpd/1.19 19dec2003 |
||
276 | UPnP- http://192.168.8.1:45532/ is UPNP HTTPD server - Server: E588 UPnP/1.0 MiniUPnPd/1.6 |
||
277 | </pre> |
||
278 | |||
279 | TCP port scan: |
||
280 | <pre> |
||
281 | Not shown: 65391 closed ports, 142 filtered ports |
||
282 | PORT STATE SERVICE VERSION |
||
283 | 53/tcp open domain |
||
284 | 80/tcp open http mini_httpd 1.19 19dec2003 |
||
285 | 45532/tcp open upnp |
||
286 | </pre> |
||
287 | |||
288 | UDP port scan: |
||
289 | <pre> |
||
290 | 53/udp open domain ISC BIND (Fake version: [secured]) |
||
291 | 67/udp open|filtered dhcps |
||
292 | </pre> |
||
293 | |||
294 | UPnP probe with <pre>upnpc -s</pre>: |
||
295 | <pre> |
||
296 | desc: http://192.168.8.1:45532/rootDesc.xml |
||
297 | st: urn:schemas-upnp-org:device:InternetGatewayDevice:1 |
||
298 | |||
299 | Found valid IGD : http://192.168.8.1:45532/ctl/IPConn |
||
300 | Local LAN ip address : 192.168.8.100 |
||
301 | Connection Type : IP_Routed |
||
302 | Status : Connected, uptime=1506822734s, LastConnectionError : ERROR_NONE |
||
303 | Time started : Wed Dec 31 22:59:22 1969 |
||
304 | MaxBitRateDown : 4200000 bps (4.2 Mbps) MaxBitRateUp 4200000 bps (4.2 Mbps) |
||
305 | ExternalIPAddress = 10.75.35.236 |
||
306 | Bytes: Sent: 18531306 Recv: 19775523 |
||
307 | Packets: Sent: 23563 Recv: 22563 |
||
308 | </pre> |
||
309 | |||
310 | As with 192.168.8.1, the 10.75.35.236 device directly ARPs to us: |
||
311 | <pre> |
||
312 | 42 bytes from 00:11:22:33:44:55 (10.75.35.236): index=0 time=14.255 msec |
||
313 | 42 bytes from 00:11:22:33:44:55 (10.75.35.236): index=1 time=5.195 msec |
||
314 | </pre> |
||
315 | |||
316 | A scan of the 10.75.35.236 address reveals similar services as 192.168.8.1 while possibly making them available to the outside world: |
||
317 | <pre> |
||
318 | Nmap scan report for 10.75.35.236 |
||
319 | Host is up (0.0013s latency). |
||
320 | PORT STATE SERVICE VERSION |
||
321 | 1/tcp closed tcpmux |
||
322 | 53/tcp open tcpwrapped |
||
323 | 80/tcp open http mini_httpd 1.19 19dec2003 |
||
324 | |_http-title: Did not follow redirect to http://192.168.8.1/html/index.html?url=10.75.35.236 |
||
325 | 123/tcp closed ntp |
||
326 | </pre> |
||
327 | |||
328 | These services may provide a TR-069 https://en.wikipedia.org/wiki/TR-069 interface. There appears to be no authentication to access the web service at all. |
||
329 | |||
330 | h2. AT commands |
||
331 | |||
332 | Depending on the mode of operations, different AT commands are available - the default three serial port mode is restricted and the single serial port debug mode appears to allow many additional commands. |
||
333 | |||
334 | h2. Firmware |
||
335 | |||
336 | Firmware is available as an OTA update from within the web interface. It is possible to query for a firmware update and the device will connect to a Huawei webserver to see if there are firmware updates. The update process is currently undocumented. |
||
337 | |||
338 | Firmware appears to be available from various Huawei servers and through careful querying it is possible to create a list as one internet user has published: https://gist.github.com/ValdikSS/f0f0d5ab9444b74ffedb7a41572bbbb5 |
||
339 | |||
340 | Relevant firmware for the E3533 is available at the following urls: |
||
341 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v60716/f1/full/E3533_All_UPDATE_22.318.39.00.105_gz.BIN |
||
342 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v61754/f1/full/E3533_All_UPDATE_22.318.39.00.105_gz.BIN |
||
343 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v64855/f1/full/E3533_All_UPDATE_22.318.39.00.105_gz.BIN |
||
344 | |||
345 | Firmware for the E3531 is available as well: |
||
346 | http://update.hicloud.com:8180/TDS/data/files/p9/s43/G134/g1/v29051/f1/full/E3531_All_UPDATE_22.318.35.00.916_gz.BIN |
||
347 | http://update.hicloud.com:8180/TDS/data/files/p9/s43/G134/g1/v85063/f1/full/E3531_FW_UPDATE_22.318.31.01.00.BIN |
||
348 | http://update.hicloud.com:8180/TDS/data/files/p9/s92/G247/g0/v50833/f1/full/E3531_All_UPDATE_22.318.35.00.225_gz.BIN |
||
349 | http://update.hicloud.com:8180/TDS/data/files/p9/s92/G247/g0/v51374/f1/full/E3531_All_UPDATE_22.318.35.00.370_gz.BIN |
||
350 | http://update.hicloud.com:8180/TDS/data/files/p9/s92/G247/g0/v55519/f1/full/E3531_All_UPDATE_22.521.31.01.408_gz.BIN |
||
351 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v38584/f1/full/E3531_All_UPDATE_22.521.31.01.801_gz.BIN |
||
352 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v38958/f1/full/E3531_All_UPDATE_22.318.35.00.422_gz.BIN |
||
353 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v42810/f1/full/E3531_All_UPDATE_22.521.31.00.1036_gz.BIN |
||
354 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v44501/f1/full/E3531_All_UPDATE_22.318.35.00.07_gz.BIN |
||
355 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v77588/f1/full/E3531i-2_All_UPDATE_22.521.35.00.801_gz.BIN |
||
356 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v81503/f1/full/E3531i-2_All_UPDATE_22.521.35.00.61_gz.BIN |
||
357 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v85007/f1/full/E3531Update_21.318.35.01.26.zip |
||
358 | http://update.hicloud.com:8180/TDS/data/files/p9/s93/G249/g0/v85008/f1/full/E3531UPDATE_21.318.35.01.26.exe |
||
359 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v26461/f1/full/E3531_All_UPDATE_22.521.31.02.40_gz.BIN |
||
360 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v27507/f1/full/E3531_All_UPDATE_22.318.35.00.40_gz.BIN |
||
361 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v28924/f1/full/E3531Update_21.521.31.02.382.zip |
||
362 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v28925/f1/full/E3531UPDATE_21.521.31.02.382.exe |
||
363 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v36752/f1/full/E3531_All_UPDATE_22.318.35.00.705_gz.BIN |
||
364 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v85083/f1/full/E3531UPDATE_21.521.35.00.382.exe |
||
365 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v85084/f1/full/E3531Update_21.521.35.00.382.zip |
||
366 | http://update.hicloud.com:8180/TDS/data/files/p9/s94/G251/g0/v91656/f1/full/E3531Update_21.318.35.00.382.zip |
||
367 | |||
368 | Other firmware and related files are floating around on the internet: |
||
369 | <pre> |
||
370 | E3531_E3533Update_22.318.05.00.00.7z |
||
371 | E3531&E3533_UPDATE_22.318.05.00.00.exe |
||
372 | E3533_All_UPDATE_22.318.39.00.105_gz.BIN |
||
373 | E3533_All_UPDATE_22.318.39.00.105_gz.BIN.changelog.xml |
||
374 | E3533s-2_22.318.23.00.105_T-Mobile.7z |
||
375 | E3533s-2_22.318.27.00.441_Tele2_Kazakhstan.7z |
||
376 | E3533s-2TCPU-22.318.27.00.441 Release Notes.pdf |
||
377 | E3533s-2TCPU-V200R002B318D27SP00C441&WEBUI-V100R005B100D10SP01C441 Version Configuration Information Form.doc |
||
378 | E3533s TCPU-22.318.23.00.105 Release Notes.pdf |
||
379 | E3533s_WEBUI-15.100.03.00.03_Universal.zip |
||
380 | E3533_UPDATE_22.318.23.00.105.BIN |
||
381 | E3533_UPDATE_22.318.23.00.105.exe |
||
382 | E3533UPDATE_22.318.27.00.441.BIN |
||
383 | E3533UPDATE_22.318.27.00.441.BIN.asc |
||
384 | E3533UPDATE_22.318.27.00.441.exe |
||
385 | E3533UPDATE_22.318.27.00.441.exe.asc |
||
386 | SHA256_E3533s-2TCPU-V200R002B318D23SP00C105.html |
||
387 | </pre> |
||
388 | |||
389 | |||
390 | In each E3533 firmware examined, the firmware contains a VxWorks kernel, an Android kernel, multiple YAFFS file systems, and an ISO which is presented as the emulated CD-ROM. The firmware format is not yet documented. It is possible to use @binwalk@ to extract files and information. |
||
391 | |||
392 | h2. Flashing new firmware |
||
393 | |||
394 | This is currently undocumented. The apparent internet expert on similar modems is this github user: |
||
395 | https://github.com/forth32/balong-usbdload |
||
396 | https://github.com/forth32/balong-fbtools |
||
397 | https://github.com/forth32/balongflash |
||
398 | |||
399 | h2. Additional software |
||
400 | |||
401 | A number of strange cargo cult websites offer a bunch of non-free software to help reflash firmware, "reconfigure", or "unlock" the E3533 or similar devices. Some of this software should provide a basis for reverse engineering the flashing process and possibly provide information about the format or the firmware structure. |
||
402 | |||
403 | h2. Photos |
||
404 | |||
405 | 2 | demodulate | [[E3533Images]] |
406 | 5 | demodulate | |
407 | h2. Hardware Serial console |
||
408 | |||
409 | There is possibly a serial console available. This has not been explored. |
||
410 | |||
411 | h2. Boot pin |
||
412 | |||
413 | On other Huawei devices a pad or pin may be grounded to provide a console and/or to interrupt the boot loader. |
||
414 | |||
415 | The boot pin is undocumented and is possible similar to others which are documented: https://routerunlock.com/boot-pin-of-different-huawei-hi-silicon-modem-and-router/ |
||
416 | |||
417 | h2. Possibly related links |
||
418 | |||
419 | http://www.gnuton.org/blog/2015/07/huawei-e3372/ |
||
420 | http://www.gnuton.org/blog/2015/08/huawei-e3371-part-2-at-commands/ |
||
421 | http://blog.asiantuntijakaveri.fi/2014/08/differences-of-huawei-b593u-and-b593s.html |
||
422 | https://gist.github.com/ValdikSS/323bcdfceb2f09d9c6ef02db1bc573e2 |
||
423 | http://www.0xf8.org/2017/01/flashing-a-huawei-e3372h-4g-lte-stick-from-hilink-to-stick-mode/ |
||
424 | https://www.dc-unlocker.com/huawei-e3533-unlock-guide |
||
425 | https://www.dc-unlocker.com/file-list/Firmwares/Huawei_modems/HiSilicon_platform/E3533 |
||
426 | https://routerunlock.com/boot-pin-of-different-huawei-hi-silicon-modem-and-router/ |
||
427 | https://www.unlockmyrouter.com/bypass-datalock-code-installing-huawei-firmwares/ |
||
428 | https://github.com/ilya-fedin/autoflash/blob/master/main.sh |
||
429 | https://www.unlock4modems.com/how-to-bypass-datalock-code-while-updating-firmware-of-huawei-algo-v4-modem/ |
||
430 | https://forum.dc-unlocker.com/forum/modems-and-phones/huawei/14570-huawei-hisilicon-firmware-writer/page12 |