Huawei modem universal flasher

[fr3nsis]

ok here is the problem
for switch to download mode i send 0x3a command
strange , i have one hisilicon device and it can switch on download mode like qm devices

[vve]

Originally Posted by fr3nsis

for switch to download mode i send 0x3a command

This will not (and doesn't) work for this modem since Huawei's native firmware doesn't support QCDM protocol. Its own proprietary protocol resembles QCDM - it's HDLC-like too, maybe some commands are the same...but it's different.

I've just ran sniffer on PC UI while flashing E3276 with native "wizard": it doesn't go to diag at all! AT^GOLOAD command is used to switch to download mode instead.

[vve]

E3276 is funny device. It supports a number of extremely long AT-commands, like AT^GETEXBANDTESTINFO.

[YLG80]

Hello,
@vve and fr2nsis.
Thanks a lot for your valuable information.
I'm going to investigate that issue further and report the results to help in the development.
In the meantime I've got another EM820W with the non MBIM firmware.
It will help me to check if the drivers hacked to make the MBIM device working are OK.
I will also check if HF 1.2 works with the standard non MBIM modem under Win7.
Juts give me more time.
Yves

[YLG80]

@vve
Regarding your question on disabling unneeded components, the answer is yes.
I've disabled the occurrence of a 3G broadband network card, keeping only the 3G broadband connect modem.
When the network card was enabled I had no communication.

Here are the AT^SETPORT results:

AT^SETPORT?
ff;1,3,2,5,6,7;ff;20
OK

AT^SETPORT=?

^RSSI:9
^CSNR:-95,-23
AT^SETPORT=?
1:MODEM
2:PCUI
3IAG
4:PCSC
5:GPS
6:GPS CONTROL
7:NDIS
A:BLUE TOOTH
B:FINGER PRINT
D:MMS
E:PC VOICE
20:MBIM(NCM2.0)
A1:CDROM
A2:SD
OK

Regards.
Yves

Originally Posted by vve

YLG80

Since I don't have any MDM8200-based Huawei devices in my hands, I did some modes/drivers investigation with MDM9200 modem, E392. PIDs are not the same as yours, of course, but this info can be helpful for you, I think.
Here are results in format "Mode - PID - components available - INF file(s) used":

1. Initial (before modeswitch) - 1505 - CD or SD or both, as configured with AT^SETPORT - ew_hwusbdev.inf .
2. Normal - 1506 - any supported combination, as configured with AT^SETPORT - ew_busfilter.inf + ewser2k.inf etc. (depends on component).
3. Factory - 1001 - Modem, PC UI, Diag - ewser2k.inf .
4. Download - 1003 - Modem, PC UI - ewser2k.inf .

P.S. Didn't you try to disable "unneeded" components before your flashing attempts? Say, to disable all but PC UI, modem and diag ports:
AT^SETPORT="A1;1,2,3" .

And what is your current component configuration (AT^SETPORT?) ?

[mobile killer]

ok dear i will try it

[vve]

Originally Posted by YLG80

Here are the AT^SETPORT results:

AT^SETPORT?
ff;1,3,2,5,6,7;ff;20

Well, you have an EXTREMELY new firmware! Even in latest available versions for latest devices (with LTE support etc.) we have the following format for AT^SETPORT parameters:
AT^SETPORT="<list for Initial mode/PID>;<list for Nomal mode/PID>". List is set of comma separated component IDs for respective mode.
For example, AT^SETPORT="A1;2,3" means that CD only is enabled in Initial mode plus PC UI and diag port are enabled in Normal mode.
Value "FF" for component ID has a special, not completely explored meaning. E.g. in case of MDM9200-based devices putting FF in Initial mode list results in some "modified" or "default" Normal mode with diffetent PID - 140C instead of 1505 in case of E392 and E398.

In your case, we can see 4 - separated by semicolons - lists istead of 2. Each of them corresponds to different mode/PID. What are 2 additional modes? The last, 4th one, is clearly MBIM. And the 3rd...I don't have a clue for now. Let's make some investigation here. Try to execute the following commands and see what is changing in Device Manager.

First of all, let's try to get rid of that "FFs":

AT^SETPORT="A1;1,2,3;A1;20" or
AT^SETPORT="A1;1,2,3;2;20" .

If above results in error, let's leave that 3rd list unchanged for this time:

AT^SETPORT="A1;1,2,3;FF;20" .

Next thing to try - is it possible to add more components to MBIM mode list? From initial state:

AT^SETPORT="FF;1,2,3;FF;2,20"

And last combination for now - what if we try to set "FF" as an only value for MBIM list? Try this:

AT^SETPORT="A1;1,2,3;FF;FF"

[YLG80]

Hello vve,
Yes the firmware is new, dated of December, 15, 2012. (Lenovo S206)

I've tried to send the AT^SETPORT parameters, but it looks like that modem does not accept that command to set parameters.
Still investigating how to use that command.

I've checked the drivers loaded with the standard and the MBIM modem.
They are the same, so I guess you're right when you advise to change the MBIM mode and get rid of the FF's.

@ fr3nsis
Don't worry with HF version 1.1 and 1.2.
Your prog is working OK with an EM820W with the standard firmware (non MBIM).
So I guess I shoudl find a way to switch the settings as advised by vve.

AT$QCDMG:
Playing with revskills with the standard modem, I've found that I can switch back and forth to download (pid 1003) and normal mode (pid 1404).
It's interesting because that was what I was looking for to resolve the issue in the android tablet with that modem.
After a while (up to sevral hours), it drops down to download mode (pid 1003) and we cannot not get it back to normal mode without rebooting.
I believe that we must use QCDMG commands.
How can I send that command 0x7E3A to switch to download mode and 7E02 to reset the modem to normal mode, via a terminal.
Do I have to enter the ascii equivalent char for 3A or 02 ?

Thanks for your information.
Yves

[fr3nsis]

remember that need to send also checksum + 7e at the end
if i rememer good for 3a lcommand is 7e 3a 3a 31 7e
sniff revskills or my prog...now i havent pc with me

[vve]

Originally Posted by YLG80

Yes the firmware is new, dated of December, 15, 2012. (Lenovo S206)

Well, I've taken a look at it and compared its code to code in 11.810.09.
The first things I've seen were a lot of strings with "MBIM" and new command - AT^SETMODE. Isn't it the one that can be used for MBIM/usual mode switching?
For the start, try to execute it in these forms:

AT^SETMODE=?

and

AT^SETMODE?

Let's look at results.

I've tried to send the AT^SETPORT parameters, but it looks like that modem does not accept that command to set parameters.

What exactly is going wrong? You got error message after, say,
AT^SETPORT="A1;1,2,3;FF;20"
or something else? Are you sure if you enter all those double quotes, colons and semicolons correctly?

How can I send that command 0x7E3A to switch to download mode and 7E02 to reset the modem to normal mode, via a terminal.
Do I have to enter the ascii equivalent char for 3A or 02 ?

No. Just create a binary file with desired bytes and sent it to port with copy (Windows) or cat (UNIX) OS shell command. Examples:
copy a.bin COM5 (Windows) ;
cat a.bin >/dev/ttyS5 (UNIX).

[vve]

Originally Posted by fr3nsis

if i rememer good for 3a lcommand is 7e 3a 3a 31 7e

No, correct is 7E 3A A1 6E 7E. First 7E may be omitted, if desired.

[YLG80]

@ vve and fr3nsis
Thanks so much for your great knowledge. It helps so much !

I've captured the data to switch the modem to download mode and I've found the exact binary sequence that you mentioned above .
A giant step ahead to resolve that really annoying android issue that drains our battery.
I think we can now make a little prog to monitor the pid and when it switches to pid:1003 send a reset command to the modem without reboorting. Or even patch the RIL.

MBIM MODEM
About the commands with the MBIM modem:

AT^SETMODE=?
ERROR

AT^SETMODE?
^SETMODE=0
OK.

AT^SETPORT?
ff:1:3:2:5,6,7;ff;20
OK

AT^SETPORT=?
1:MODEM
2:PCUI
3IAG
4:PCSC
5:GPS
6:GPS CONTROL
7:NDIS
A:BLUE TOOTH
B:FINGER PRINT
D:MMS
E:PC VOICE
20:MBIM(NMC2,0)
A1:CDROM
A2:SD
OK

I've make sure to enter your command exactly as follows :

AT^SETPORT="A1;1,2,3;FF;20"

ERROR

I've alos tried after an ATZ to no avail.
Regards
Yves

[vve]

Originally Posted by YLG80

I think we can now make a little prog to monitor the pid and when it switches to pid:1003 send a reset command to the modem without reboorting. Or even patch the RIL.

Didn't get it. What OS you are talking about - Windows or Android?
If you are going to flash your modem in Windows, you should make a driver to be installed for PC UI port in download mode, not a modem reset...

AT^SETMODE?
^SETMODE=0
OK.

Good. And what will happen if we try
AT^SETMODE=1
?
Look at Device Manager in case of positive result ("OK" answer).

AT^SETPORT="A1;1,2,3;FF;20"

ERROR

It's a pity. Haven't you tried all 5 combinations from my yesterday's post?

[YLG80]

@vve
Sorry, I'm busy on that modem in 2 forums.
The other is dedicated to the Lenovo K1/ Medion P9516 Android tablet.
That modem often drops to DM mode draining the battery in idle mode.
That was the reason why I was talking about pid 1003 in that tablet.

I'm currently trying to downgrade that modem mainly under Windows 7.
(My old XP laptop has died a few day's ago).
I'm still trying to fix that issue with fr3nsis HF with the MBIM modem.
It should work as is.
But ... I will also test downgrade methods under android/linux if possible.
If I can drop the MBIM modem to DM mode under android, I know how to downgrade the f/w.

Tomorrow I will test the different AT^TESMODE combinations.
If I remember AT^SETMODE=1 returned an ERROR. I will double check that as well.

[YLG80]

Hello vve
only that SETPORT command is returning OK:

AT^SETPORT="FF;1,2,3;FF;2,20"
OK

However AT^SETPORT=? returns the same list as above.


@fr3nsis
Don't ask me why, but today HF can Read Modem Info from my MBIM modem.
I've started USBtrace to try to find why it was unable to read the Info, and surprisingly the Modem Info was immediately displayed.
It continues to work without USBTrace.
It's perhaps due to the SETPORT tests I've made, I don't know.

Yves