[Hardware Hacking General] E:V:A:
SD-card sharing: Huawei FAILURE!

It is not clear from the instructions that came with the router, what the

exact intended function of an internal SD card would be. But from looking at

other Huawei Mifi routers, it seem to be that one should be able to "share"

the microSD card data in such a way, that anyone connected to the router

should be able to open the web interface to up/download files. However, this

"feature" as it is marketed for the E589, is not available. I have tried

pretty much everything apart from throwing it against the wall, and still no

sign of a working SD card-reader connection in the web-interface, even though

the SD-card is recognized in Window's Device Manager when connected via micro

USB cable. So WTF Huawei!?

Here are 2 pictures of a working interface for the E5776. This is exactly the same

as for the E589u-12, but without the "Sharing" tab enabled.

And here's the actual "sharing" settings page...

So now you think, whoa, no reason for it to work on a different device...right? Wrong!

By poking around in the firmware, I know the "interface" is in there. In fact it is over here:

http://192.168.1.1/html/sdcardsharing.html

However, it is not enabled and does not register my SD card for some reason,

and any clicking on this page results in an error. It seem that the web server

content for this "feature" has been disabled somewhere. We need to find where

and why, and then try to fix it by flashing a new hacked EFS filesystem.

So what would it take to accomplish this?

Answer: Something like this.:

Inspect the HW to make sure SD is connected as it should.

Status: Most likely OK, since already recognized by PC.

Inspect the web-interface and web-server settings, to make sure it has the intended support.

Status: WIP

Partial reverse engineering of the firmware, to make sure it's able to support this "feature".

Status: To do.

Extract the EFS2 to get all the required files and modify as needed.

Status: Partially done. Protected EFS still need to be extracted.

Re-flash modified EFS.

Status: Should be easy, unless EFS files are signed!

A first step is to inspect the JavaScript code, doing all the web serving. Playing around with

the interface, we immediately find the following potential problems:

For example they use iframe's which have been known to be browser dependent, in the past,

and some of the critical variables are disabled and possibly wrong.

sdcard.js

[SIZE=2]...
var SD_STATUS_DISABLE = '0';
var SD_NO_FORMATED = '2';
var SD_SHARE = '1';
var SD_NOSHARE = '0';
var SD_WEB_SHARE = '[B]0[/B]'; <-- [COLOR=Red]Is this correct?[/COLOR]
var SD_USB_SHARE = '1';
var SD_ACCESS_READ = '[B]0[/B]'; <-- [COLOR=Red]Is this correct?[/COLOR]
var SD_ACCESS_WRITE = '1';
var SD_SHARE_ALL_FILE = '0';
var SD_SHARE_CUSTOM_FILE = '1';
var SD_ROOT_DIRECTORY = '[B]tffs0b[/B]'; <-- [COLOR=Red]Is this correct?[/COLOR]
var FILE_LIST_TYPE_FOLDER = '0';
var FILE_LIST_TYPE_FILE = '1';
var LOGIN_STATE_NOMAL = '0';
var LOGIN_STATE_ERROR = '1';
...
[/SIZE]

Then, when loading the following EFS file:

EFS2 location: hdev/ftl1h0p1/WebApp/common/api/sdcard/sdcard
web-server: http://192.168.1.1/api/sdcard/sdcard

in the browser, we obtain the result:

[SIZE=2]<?xml version="1.0" encoding="utf-8"?>
<response>
<sdcard>
<SDShareMode>0</SDShareMode> [COLOR=Red]<-- Is this correct?[/COLOR]
<SDCardShareStatus>1</SDCardShareStatus>
<SDShareFileMode>1</SDShareFileMode>
<SDAccessType>1</SDAccessType>
<SDSharePath>/music</SDSharePath> [COLOR=Red]<-- Is this correct?[/COLOR]
<SDCardStatus>1</SDCardStatus>
</sdcard>
</response>
[/SIZE]

As you can see, these were only 2 files out of hundreds...

But before we go any further, it is wise to backup everything possible. That means

the default router web UI settings, internal router firmware and the router's internal

chip/factory settings, known as NV-items, in case it is a Qualcomm based chipset.