Huawei modem universal flasher

[vve]

Originally Posted by kalbar555

Hi.

I just flashed Huawei E398u-18 with E398u-1 firmware. It is not compatible but friend said it works. After Flashing my modem doesn't show any signal and any mobile operator.

Flash it once again with correct firmware if available.
If not, post here the results of following commands execution:

AT^VERSION?
AT^SYSCFGEX=?
AT^SYSCFGEX?
AT+GSN
AT+CIMI
AT+COPS=?

[YLG80]

@ vve
@ fr3nsis

I eventually was successfull with the flash downgrade !
See snapshot below.

Thanks a million to vve for teaching me many tips on that matter.
Thanks a million to fr3nsis for his outstanding job to make Huawei Flasher.
It works like a charm ... once my hacked drivers were correctly setup !

There was a bug in my drivers hack.
It's so complex with so many ports and drivers options to be setup for a unknown device.
There is a difference in drivers assignment between the modem with pid 1404 and the same MBIM type with pid 1571.
When in Download mode with pid 1568 devices instances have to be swapped compared to the standard modem with pid 1003 !
That did the trick ! No need to change ^SETMODE or any other option.
again.
Yves

[vve]

Originally Posted by YLG80

I eventually was successfull with the flash downgrade !

Congratulations! Really good news.

There is a difference in drivers assignment between the modem with pid 1404 and the same MBIM type with pid 1571.
When in Download mode with pid 1568 devices instances have to be swapped compared to the standard modem with pid 1003 !

Could you tell about this in more details?
I'm absolutely sure that your experience will be extremely helpful - a year later, when MBIM devices will flood the market.

[YLG80]

HOW TO

@ vve , the trick is shown in red below in patch # 3.


Huawei 3G modem drivers hack to use and flash an MBIM modem with an OS < Win8

This hack will allow a flash downgrade of your MBIM modem to the former standard mode.

Modem : EM820W flashed with the MBIM Win8 update 11.810.10.02.00
Problem: The modem can no longer be used with any OS < Win8, Androïd, or even Linux with kernel < 3.85 (as of Feb 2013)
Target : downgrade the modem to 11.810.09.24.00 standard mode.

This hack will likely also work to downgrade the MU733 modem in Samsung computers.(change your vid/pid accordingly)
The Samsung software update All-in-One package updates the firmware w/o asking the user to confirm that option !

It allows also to use the MBIM modem with Mobile Partner in a Win7 machine.(Huawei MP23 was happy with the hacked drivers)

Driver set : 3G_Huawei(EM770W-EM820W) version 4.25.11.00
Tools : Revskills (credit B. Kerler)
Flasher : Huawei Flasher 1.6 or > (credit fr3nsis)
(I've used XP as I got some debugger errors under Win7 (.Net Framework), but it should work with Win7.)

Requirements :
-------------
Remove any other Huawei driver prior to start with the new drivers set.(Use DriverUninstall.exe)
Remove Mobile Partner (installs it's own drivers set).
Remove QPST that install a few drivers in confilt with the normal drivers.

Optionnaly use USBDeview to check that the drivers have been removed and remove any remaining Huawei driver.

Standard MODEM (NON MBIM)
-------------------------------
You should know the vid-pid of your modem when in standard mode. EM820W: VID:12d1 PID:1404
You should know the vid-pid of your modem when in Download mode. EM820W: VID:12d1 PID:1003

MBIM MODEM
--------------
You should know the vid-pid of your modem when in standard mode. EM820W: VID:12d1 PID:1571
You should know the vid-pid of your modem when in Download mode. EM820W: VID:12d1 PID:1568

Double click on the peripheral in Device Manager, select Details, Hardware ID to find the vid, pid and MI#.

There are five files to hack in the drivers package.

- ew_busfilter.inf (will allow the enumeration of a single instance MBIM device.)
- ewmdm2k.inf (modem device)
- ewser2k.inf (virtual com ports)
- ewusbwwan.inf (HUAWEI Mobile Connect - 3G Network Card instance available in MBIM modem)
- ewnet.inf (virtual ethernet available in MBIM modem)

Warning : I've only hacked the X86 driver set.
If you have an X64 you should hack the X64 set AND take care of patching
the correct X64 groups in the .inf files. That's easy.

As my target was to flash-downgrade, I've not modified the ewdsc.inf for the Smartcard.

The above listed inf files are including declarations for the standard mode with pid 1404/1003, EXCEPT ONE: ew_usbfilter.inf.

Connect your modem via a USB port.
The Windows Devices Manager will show only two devices:

! HUAWEI MBIM MODEM
! HUAWEI MBIM MODEM

In Windows Device Manager, Double click on each instance, select the Details tab
There is of course a Yellow Warning in front of each device as there are no drivers available.
The trick is to force the MBIM modem to enumerate all peripherals:
That's the reason why we have to hack ew_busfilter.inf as follows:

.INF files Patches:
-------------------
1- Add this in ew_busfilter.inf in the [Standard] section

%BusFilter.DeviceDesc%=Bus_Device, USB\VID_12D1&PID_1568
%BusFilter.DeviceDesc%=Bus_Device, USB\VID_12D1&PID_1571

2- Add this in ewmdm2k.inf in the [Models] section

%HUAWEI00% = Modem0, USB\VID_12d1&PID_1568&MI_01

%HUAWEI00% = Modem0, USB\VID_12d1&PID_1571&MI_00

3- Add this in ewser2k.inf in the [[QcomSerialPort]] section

%QcomDevice00% = QportInstall00, USB\VID_12d1&PID_1571&MI_01
%QcomDevice01% = QportInstall01, USB\VID_12d1&PID_1571&MI_02
%QcomDevice02% = QportInstall02, USB\VID_12d1&PID_1571&MI_03
%QcomDevice08% = QportInstall08, USB\VID_12d1&PID_1571&MI_04

%QcomDevice01% = QportInstall01, USB\VID_12d1&PID_1568&MI_00

NOTE on PID_1568&MI_00:
This is the trick!
The same modem (Standard) in download mode with pid 1003 uses interface MI_01 as PC UI Interface
while the MBIM modem in download mode with pid 1568 uses the interface MI_00 for the PC UI Interface !

4- Add this in ewusbwwan.inf in the [QCOM], [QCOM.NTia64], [QCOM.NTamd64] sections

%qcwwan.DeviceDesc00% = qcwwan.ndi, USB\VID_12d1&PID_1571&MI_05

5- Add this in ewnet.inf in the [QCOM], [QCOM.NTia64], [QCOM.NTamd64] sections

%qcwwan.DeviceDesc00% = qcwwan.ndi, USB\VID_12d1&PID_1571&MI_05

Once you've patched the .inf files, open the Devices Manager and run DriverSetup.exe

This will install the drivers and you will see the process in the Devices Manager window.
Click Continue when Windows complains about Unsigned Drivers.

Once finished, run Revskills to verify that your Modem will switch between Normal and Download Mode.
(thanks to vve and fr3nsis for that tip)

Click Menu, Hardware Forensics, Port Utils, QC + AT-Cmd
Check that Serial ComPort shows your modem PC UI Interface
Click on Switch -> You should receive a "Done" answer.
Got the BL tab
In the second Drop box, Select DWNMODE:SwitchDwnMode
Click on Send Command and look at your Device Manager Window

The modem will switch to Download mode, loading new drivers
In Devices Manager, check that you have a COM port assigned to PC UI Interface

Go Back to the SETUP tab
Select the new PC UI Interface with the new assigned COM Port number.
Click on Switch -> You should receive a "Done" answer.
Got the BL tab
In the second Drop box, Select DWNMODE:ResetPhone
Click on Send Command and look at your Devices Manager window.

The modem will switch back to Normal mode, loading the normal drivers.
As long as you cannot go back to Normal Mode with RevSkills, you cannot flash your modem.

If it's OK, that means that you can use Huawei Flasher to successfully flash-downgrade your modem.
Take care of leaving enough time for the drivers change before clicking OK to flash.

Hope it will help many MBIM flashed modem owners
Yves

[vve]

YLG80

Exellent guide! Thanks a lot.

[binshad]

Is good software but never get success with it coz my modem was not supported( e303d)

[vve]

Originally Posted by binshad

Is good software but never get success with it coz my modem was not supported( e303d)

Yes, this modem is HiSilicon-based. It doesn't supported yet.

[upublished]

Originally Posted by vve

See link in post #43.

Thank you. Unfortunately, after installing this firmware (and the other placed on chomikuj.pl) modem has problems with communication via ports.
Regards

[vve]

Originally Posted by upublished

Unfortunately, after installing this firmware (and the other placed on chomikuj.pl) modem has problems with communication via ports.

Nobody has a chance to help you until you describe what your problem is in details.

[kalbar555]

Originally Posted by vve

Flash it once again with correct firmware if available.
If not, post here the results of following commands execution:

AT^VERSION?
AT^SYSCFGEX=?
AT^SYSCFGEX?
AT+GSN
AT+CIMI
AT+COPS=?

^VERSION:EXTH:E398CD3E398M Ver.A
^VERSION:INTH:E398u-18CD3E398M Ver.A
^VERSION:EXTU:E398
^VERSION:INTU:E398u-18
^VERSION:CFG:104
^VERSION:PRL:

AT^SYSCFGEX=?

^SYSCFGEX"00","03","02","01","99"),((400380,"GSM 900/GSM1800/WCDMA2100"),(280000,"GSM850/GSM1900"),(3fffffff,"All Bands")),(0-2),(0-4),((c1,"LTE2100/LTE2600/LTE900"),(7fffffffffffffff,"All Bands"))

AT^SYSCFGEX?

^SYSCFGEX:"0201",3FFFFFFF,1,2,7FFFFFFFFFFFFFFF

355258040591351

260019408379071

AT+COPS=?
ERROR

[vve]

kalbar555

Hmmm... Everything seems to be OK for now. Run some more commands:

AT+GMR
AT+CFUN?
AT$QCSIMSTAT?
AT^CARDLOCK?
AT^SFM?
AT^SETPORT?
AT+CSQ

[kalbar555]

Originally Posted by vve

kalbar555

hmmm... Everything seems to be ok for now. Run some more commands:

at+gmr
at+cfun?
at$qcsimstat?
at^cardlock?
at^sfm?
at^setport?
at+csq

at+gmr

11.433.57.00.000

at+cfun?

+cfun: 4

at$qcsimstat?

$qcsimstat: 0,sim init completed

at^cardlock?

^cardlock: 2,10,0

at^sfm?

^sfm: 0

at^setport?

Ff;1,2,3,7,a1,a2

at+csq

+csq: 99,99

[vve]

Originally Posted by kalbar555

at+cfun?

+cfun: 4

Modem is in offline mode. Try AT+CFUN=1 then check with AT+CFUN? again.

at^setport?

Ff;1,2,3,7,a1,a2

Weird thing as well. Look at this once more after +CFUN=1 .

[kalbar555]

Originally Posted by vve

Modem is in offline mode. Try AT+CFUN=1 then check with AT+CFUN? again.


Weird thing as well. Look at this once more after +CFUN=1 .

AT+CFUN=1

+CME ERROR: operation not supported


(((((((((((

[vve]

Originally Posted by kalbar555

AT+CFUN=1

+CME ERROR: operation not supported

OK, tet's try from another end:

AT^SETPORT="A1,A2;1,2,3,7,A1,A2"