Switching control hilink modems and routers to secondary usb song in windows

With this firmware, the device behaves like a classic USB modem: there is a command AT-port through which you can establish a connection using the PPP protocol. This is how almost all previous-generation 3G modems work. The speed is limited — no more than 20-30 Mbit at the reception. In addition to the PPP mode, there is an NDIS mode. In this case, the modem emulates a network interface through which data is transmitted, and only control commands are sent through the AT port. In this mode, the speed is not limited. The main feature of the stick mode is to establish the connection and support the operation of the channel using the OS of the computer to which the modem is connected. At the same time, the computer receives an IP address directly from the cellular provider through a DHCP request, and the modem acts as a network bridge, transmitting the packets from the computer to the cellular network and back without changing them.

The initial USB stick stick composition is a virtual CD-ROM and microSD card reader. In order for modem ports to appear, you need to switch the composition. Under windows, this is done by carrier software available on a virtual CD, or by the huawei proprietary program Mobile Partner. Under linux, switching is done by the usb-modeswitch program. It is possible to prohibit the transformation of songs. This is done with the following command:

At the same time, the modem immediately after switching on will look like 2 AT ports and a NDIS network card. CD and microSD will be excluded from the configuration. This mode is extremely convenient for using the modem in various home routers. To switch back the composition with switching, use the command:

Version numbers of stick-firmware always start at 21 — for example, 21.285.01.02.143. With this type of firmware, modems from MTS and Megaphone are supplied.

Included with the Stick-firmware, a so-called Dashboard is flashed into the modem — an image of a virtual CD that appears in the system after the modem is connected. This CD contains modem drivers for various operating systems, as well as a control program that establishes a connection to the Internet, reads SMS, makes USSD requests, and so on. There is a universal version of this program from the manufacturer of the Huawei modem (Huawei Modem), as well as specialized versions from specific telecom operators.

With HILINK firmware, the modem works in the router mode and is presented to the computer as a network interface (usb-ethernet-rndis). The computer receives network settings from this interface via DHCP, and then goes through it to the Internet, like through a regular wired LAN. The modem assumes all care for establishing a connection and maintaining the channel, the computer does not even notice that access to the Internet is through a cellular network. In this mode, the modem has its own local IP address (usually 192.168.8.1), visible from the computer as a default gateway (default route), as well as an external IP address obtained from the cellular network. Routing is performed between the network of the cellular provider and the local network (modem-computer) using the address translation mechanism (NAT). Provides port forwarding from the external network (port forwarding and DMZ).

The modem is configured in this mode via the WEB interface available in the modem and accessible via its local IP address. Also through the WEB-interface information is available on the state of the modem and the signal of the cellular network, connection management, reception and transmission of SMS messages and USSD commands, SIM menu and much more. This is especially valuable for Linux users, as well as for those who have a modem connected not to a computer, but to a home router. Modem configuration via AT commands, as in stick firmware, is not performed in the normal mode of hilink firmware, although it is possible in the special DebugMode debug mode.

The initial HILINK modem USB composition is exactly the same as that of the stick — a virtual CD-ROM and microSD card reader. Switching tracks under windows is a small program mbbservice, run from the built-in CD. Under linux, this is done by the usb-modeswitch program. Regularly modem developers do not provide a mode without switching tracks. Nevertheless, it is possible to make such a mode by some modification of the firmware. At the same time, the built-in SD card reader is lost, however, it becomes possible to use a modem with any router that supports usb-rndis network cards.

Version numbers of hilink firmware always start at 22 — for example, 22.286.03.00.00. With this type of firmware modem comes from Beeline.
HILINK firmware consists of two parts — the firmware itself, and the WebUI (web interface). The first firmware is the main firmware, then the WebUI.

The participants of this forum completed the revision of the standard firmware to extend the functionality and enable the functions initially blocked.

If the modem asks a password when flashing, then it can be calculated with the same calculator (link in the header of the header). It is called flash code there.

Inside the modem, an operating system based on Android 2.3 with a linux 3.4.5 kernel works. Modified firmware allows access to the console of the Linux-part of the modem via telnet:

And also through the Android debugging utility — ADB:

When you first flash operator modems, the flash driver will request the Flash code (password).
This code can be calculated from the IMEI modem usingThis code calculator .
If during the firmware the flash program stops seeing the modem, then you need to install the mbbservice drivers.
If you are working under Linux, then you can use the modem firmwareby thisflasher.
If you forgot to flash Dashboard 3.5 before uploading HILINK firmware, then you will not be able to create and edit network connection profiles in the web interface (settings ->profile management). In this case, go to the Linux console (via telnet, adb or A-shell), and enter the commands:

umount / data
(for E3372S)busybox flash_eraseall / dev / mtd / mtd16
(for E3372H)flash_erase / dev / mtd / mtd17 0 0

And then restart the modem.
For windows users, scripts have been developed to automatically perform all actions to resolve problems with profiles. See section useful links.

Note!Each of the firmware consists of 2 components: stick-firmware and Dashboard, hilink-firmware and WebUI. Do not try to flash WebUI on stick-firmware, and Dashboard — on Hilink-firmware. You can bring the modem into a completely non-operational state!

A list of all commands supported by the modem can be obtained from the command:
at + clac
This list will list all command names that are in the internal modem command table, except for hidden commands. Hidden commands are commands marked with a special flag in the command table. You can find them only by disassembling the kernel of the Linux part of the modem. For those interested, here is a list of these commands for the E3372 modem:

In general, commands have 4 forms of recording (hereinafter cmd is the name of the command):
atcmd — command without parameters
atcmd? — view the current value of the parameters controlled by the command
atcmd = X — setting parameter values
atcmd =? — request for help on the command format

Each of the commands supports one or more recording forms. For example:

The form without parameters is not supported by the command.

The form of request for the current value of the parameters — a list of Internet connection profiles

Assigning a value to the parameters — profile setting 1.

View the + CGDCONT command format and a list of valid parameters.

On the computer side, the USB modem looks like a collection of separate, independent USB devices. The list of devices represented in the modem can be managed using the special command ^ setport.
Initially, after connecting to a computer, the modem usually looks like a CD-ROM and microSD card reader. This is the primary composition of the modem. After a special command from the operating system, the modem switches its composition to the secondary — ports of AT commands and network interfaces appear. Such a switch is made solely because of the ideological curvature of the Windows operating systems, and in many cases it only hurts. For example, when connecting a modem to home routers. Therefore, it is possible to prohibit such switching — then the modem will immediately turn on with the secondary (working) device composition.
Command format ^ setport:

at ^ setport = «<list of primary composition>;<secondary composition list>»

Each of the lists is a comma-separated device code. A semicolon is put between the primary and secondary list. In the pre-list, only codes A1, A2 and FF are allowed, in the secondary list, all but FF. The modem understands the following codes:
FF — prohibit the primary composition
10 — AT port for establishing PPP connections (modem)
12 — AT port for setting up NDIS connections (PCUI)
16 — NDIS-network card
5 — Linux console (A-shell)
A — VxWorks console (C-shell)
A1 — CD-ROM with dashboards and drivers
A2 — microSD card reader

Letter codes can be written in both large and small letters. Changing the device list takes effect only after the modem is rebooted (using the at ^ reset command or reconnection).
Note! The command ^ setport is able to manage the composition only in stick firmwares! In hilink, the composition can be changed only by editing the record nvram 50091.

USB song setting examples:

at ^ setport = «a1, a2; 10,12,16, a1, a2» — standard factory composition. Only a CD and a card reader are visible in the primary composition, all AT ports, a network card, a CD, a card reader in the secondary composition.

at ^ setport = «ff; 10,12,16, a2» — composition without switching. Very convenient for use in home routers and computers with operating systems other than windows. After connecting, the modem immediately appears as 2 AT ports, a network card and a card reader.

at ^ setport = «FF; 10,12,16,5, A, A1, A2» — Composition with included all devices that are only in the modem. Convenient for those who need access to modem consoles.

The current usb-track used can be viewed with the ^ getportmode command. For example:

The device names are listed here in the same order as they appear in the ^ setport command. Note that the ^ getportmode command shows exactly the current composition. If you changed it with the ^ setport command, but have not yet reset the modem, the changes will not be taken into account.

The modem allows you to explicitly specify with which types of networks (GSM / UMTS / LTE) and the ranges it should work. To do this, use the at ^ syscfgex command. The command format is:

AT ^ SYSCFGEX = «<net_order>»,<band>,<roaming>,2,<lteband>,,

<net order> — a list of preferences for network types. Valid values ​​are:
00 — all types of networks
01 — only 2G
02 — only 3G
03 — only 4G
99 — leave the value unchanged
Codes can be combined. Naprimer “0302” — LTE preference ->3G

<band> — code of acceptable ranges for 2G / 3G networks. Possible values:
80 — GSM 1800
300 — GSM 900
80000 — GSM 850
200000 — GSM 1900
400000 — UMTS B1 (2100)
2000000000000 — UMTS B8 (900)
3FFFFFFF — all ranges
Each of the codes is a hexadecimal (HEX) number. To specify a combination of ranges, add the corresponding codes. For example, to set GSM850, GSM900, GSM1800 ranges, you need to calculate 0x80 + 0x300 + 0x0x80000 = 0x80380. This will be the resulting code range — 80380.

<roaming> — permission of the modem in roaming:
0 — ban
1 — allow
2 — leave unchanged

<lte band> — code of valid LTE bands.
1 — B1 (FDD 2100)
4 — B3 (FDD 1800)
40 — B7 (FDD 2600)
80 — B8 (FDD 900)
80000 — B20 (FDD 800)
800C5 — all ranges

As for the 2g / 3g ranges, the codes are hexadecimal numbers that can be added to specify range combinations.

Command example:

AT ^ SYSCFGEX = «00», 3FFFFFFF, 1,2,800C5 , — register in all possible networks and ranges
AT ^ SYSCFGEX = «0302», 400000,1,2,800C5 , — register on the LTE network, if LTE is not available, then on 3G (the modem will not register on 2G networks). All bands are available for LTE, for 3G — only 2100 range.

This modem has a unique property — it can do a search for all surrounding base stations (BS). And not only the BS of the operator of the sim card inserted in it, but in general all the BSs of all operators, the signal from which reaches the modem antenna. For each BS found, its CID and the level of signal received from it are displayed. This allows you to select the operator with the highest signal level, as well as select a specific BS for pointing an external antenna to it. The only drawback of this modem is that it can only search BS 2G and 3G. He does not know how to search for LTE cells.
Search is made with the help of the command at ^ netscan. Before searching, make sure that:
— Internet channel is disabled
— the modem does not see any LTE-cells.
If there is an LTE signal in the district, then the modem should be switched to 2G3G mode using the command AT ^ SYSCFGEX = «0201», 3FFFFFFF, 1,2,800C5 , or in the settings of the web interface.
Also note that this command can only be entered via the management port (PCUI). If you enter it through the port intended for the PPP connection (modem), the command will issue an empty response (just OK and that’s it).
Command format:

AT ^ NETSCAN = num, level, mode
num — the number of BS found, from 1 to 20. If more than num BS is found, then the stations with the weakest signal will be excluded from the list
level — the minimum level of the BS signal included in the list. Set in dB, from -110 (lowest level) to -47 (highest level). Stations with a signal level below the level will not be included in the list.
mode — BS type. 0 search 2G stations, 1 — search for 3G stations.
Command example:

In this example, a 3G BS search is ordered with a signal level not lower than -108 dB. The result is given in the form of a list, sorted by signal level. The topmost BS is the most powerful, the bottom one is the weakest. List item format:
^ NETSCAN: 10638 , 1e7e, 250.02.0, -78.8b77.400000

1e7e — LAC Station
250 — MCC (Russia)
02 — MNC (in this case — MTS).
0 — I myself would like to know what it is, from the disassembled code I did not understand the meaning of this field.
-78 — signal level of a given BS
8b77 — station CID
400000 is the range in which the BS signal is received (as in the ^ syscfgex command).

According to the results of this example, we can conclude that the strongest signal in a given area is at the MTS, and the antenna should be sent to the BS with CID = 8b77 LAC = 1e7e. Coordinate BS can be viewed on the site xinit.ru.

The modem has a storage of various configuration information — NVRAM. It is organized as a set of variable-length records. Each record has a number — from 0 to 65535, but not all record numbers are physically present in the modem.
To find out the length of a particular entry, use the command:

at ^ nvrdlen =<item>

<item> — record number. In response, the modem gives its length:

If instead of length the modem responds with ERROR, then there is no record with that number at all in the modem.
You can view the contents of a specific entry with the command:

at ^ nvrdex =<item>,<offset>,<len>

<offset> — offset from the beginning of the recording to the fragment of interest to us (0 — from the beginning)
<len> — the length of the output fragment must be no more than the full length of the record minus the offset.
Example:

At the beginning of the response, the command parameters are listed separated by commas, then, by space, the bytes of the record contents.

To change the contents of the nvram command is used:

at ^ nvwrex =<item>,<offset>,<len>,<b0><b1>….<bn>

The meaning of the first three parameters is the same as in the reading command. b0 … bn — bytes written to nvram. They should be exactly len pieces, and they are listed through the space. For example:

In addition to the above, there are 2 simplified commands for working with nvram — ^ nvrd and ^ nvwr. Unlike the ones discussed above, these commands require the precautionary release of the datalock lock.

at ^ nvrd =<item> — displays a full dump of the specified entry
at ^ nvwr =<item>,<b0>,…<bn> — saves the specified bytes from the beginning of the item.

You can change IMEI with the command:

The command requires prior release of the datalock lock. IMEI change is necessary for work in the yota network — the modem needs to install an IMEI modem imei from a device of the type (smartphone, tablet) for which a sim card was purchased.
Please note that for the command to work correctly, a sim card must be inserted into it. Absolutely any. In addition, IMEI must be correct (with the correct last check digit). Incorrect IMEI modem will not accept with an error message. You can check the correctness of IMEIcalculator

E3372h with megafon firmware does not work with Omni II and other new routers. The fact is that with this firmware the modem model is defined as «MegaFon M150-2», and not «E3372».
This string is stored in the cell NVRAM 53525, and you can replace it with «E3372» with the following AT commands:

After that, the modem will be easily identified by kinetics and work.

In general, in ZyXEL modems are defined by vid / pid (in the config), for example, the E3272 block looks like this:

and for E3372s — like this:

Accordingly, you can enter the necessary values ​​manually for any modem: there are libraries for almost everyone, with very few exceptions (for example, sierra modems)
Blocks are given for modems in HiLink mode (with a CdcEthernet0 upgrade).
Manufacturer field editing
It is necessary to check what lies in the cell NVRAM 8203. In the right case, there will be this:

If different, write this value there.