[Hardware Hacking General] E589u:
3G mode

Hi Guys,

Thanks for your replies.

I tried to play with the modem and got it working over 3G mode hack (/dev/ttyUSBx & dial-up scripts), however I wanted to activate RNDIS interface and haven't succeeded with that yet(

Well, what I did using Asus AC66U router (you can do it on any linux-running box near you, NAS, routers and etc):

1) install latest usb_modeswitch package or sg3_utils

*** you don't need to install them both, only one package is needed to send the modem some AT or SCSI commands ***

2) run:

lsusb

to check that your modem was identified as:

Bus xxx Device xxx: ID 12d1:1f01

, where 12d1 - Huawei and 1f01 - WiFi only mode?!

3 - usb_modeswitch: run

usb_modeswitch -v 12d1 -p 1f01 -V 12d1 -P 14db -M "55534243123456780000000000000a11062000000000000100000000000000" -W

to switch your modem to SERIAL PORT COMMUNICATION (3G Mode) which is 1442, however the command asked for 14db - RNDIS, probably this is due to raw command which I will try catch up from google later

OR

3 - sg3utils: check where your SD-Card or CDROM was mounted when you plugged the modem (dmesg /dev/srX or /dev/sgX) then run

sg_raw /dev/srX 11 06 20 00 00 00 00 00 01 00

to switch the modem to 1442 mode (3G)

4) repeat:

lsusb

to check that your modem was successfully switched to 1442 (3G):

Bus xxx Device xxx: ID 12d1:1442

and your kernel (dmesg) must return the following records:

usb 1-1.1: USB disconnect, address 6
usb 1-1.1: new high speed USB device using ehci_hcd and address 7
usb 1-1.1: configuration #1 chosen from 1 choice
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for GSM modem (1-port)
option 1-1.1:1.0: GSM modem (1-port) converter detected
usb 1-1.1: GSM modem (1-port) converter now attached to ttyUSB0
option 1-1.1:1.1: GSM modem (1-port) converter detected
usb 1-1.1: GSM modem (1-port) converter now attached to ttyUSB1
usbcore: registered new interface driver option
drivers/usb/serial/option.c: USB Driver for GSM modems: v0.7.2

saying that the modem was recognized as Serial Modem and was mounted to /dev/ttyUSBx

5) from here on you can proceed with usual 3G modem setup, so for Asus Merlin's build it will be as follows:

WAN -> Enable USB Modem = Yes

Location = Manual

USB modem = CDMA2000 (EVDO)

APN service = internet ***or check you ISP***

Dial number = *99#

PIN code =

Username =

Password =

USB Adapter = Huawei-E160g

Click "Apply" and after router's reboot you will get WAN connection running

Note that the 3G mode is automatically reset when you power-off/power-on your modem, so in order to keep the connection running after modem's reboot you need to put some scripts to repeat usb_modeswitch or sg_raw

The script within Merlin's build used internally to dialup the ISP is as follows:

pengt
set com 460800n81
set senddelay 0.05
waitquiet 1 0.2
system "nvram set g3state_pin=1"
let $x=$rpipe("nvram get modem_pincode")
let a=len($x)
if a=0 goto ready
if a<>4 goto pinerror
let c=0
:test
let $c=$mid($x,c,1)
if $c<"0" goto pinerror
if $c>"9" goto pinerror
inc c
if c<4 goto test
let a=val($x)
if a<0 goto pinerror
if a>9999 goto pinerror
let $c=$left($x,4)
let $y=$rpipe("nvram get pinerr")
let a=val($y)
if a=1 goto pinerror
#if a=2 goto pintimeerror
send "AT+CPIN?^m"
waitfor 20 "SIM PIN","READY","ERROR","ERR"
if % = -1 goto pintimeerror
if % = 0 goto enterpin
if % = 1 goto ready
goto pinerror
:enterpin
system "nvram set g3state_pin=2"
send "AT+CPIN=\""
send $c
send "\"^m"
waitfor 20 "OK","ERR","ERROR","+CME ERROR"
if % = -1 goto pintimeerror
if % = 0 goto ready
:pinerror
system "nvram set pinerr=1"
system "nvram set g3err=1"
print "ERROR: PIN code must be 4 decimal digits only\n"
print "Caution! - entering the wrong PIN code three times will lock the SIM\n"
send "ATH^m"
exit 1
:pintimeerror
system "nvram set pinerr=2"
system "nvram set g3err=1"
print "ERROR: timeout, device did not respond to PIN command entry.\n"
send "ATH^m"
exit 1
:ready
system "nvram set g3state_rd=1"
system "nvram set simerr=0"
system "nvram set connerr=0"
system "nvram set pinerr=0"
system "nvram set apnerr=0"
system "nvram set g3err=0"
let $x=$rpipe("nvram get modem_dialnum")
let a=len($x)
if a=0 goto error
send "ATD"
send $x
send "^m"
waitfor 10 "CONNECT","ERR","ERROR"
if % = -1 goto timeerror
if % = 0 goto next3
goto error
:next3
system "nvram set g3state_conn=1"
print "CONNECTED\n"
exit 0
:error
system "nvram set connerr=1"
system "nvram set g3err=1"
print "CONNECT ERROR\n"
send "ATH^m"
exit 1
:timeerror
system "nvram set connerr=2"
system "nvram set g3err=1"
print "CONNECT TIMEOUT\n"
send "ATH^m"
exit 1

I'm still looking for the raw command to send to the modem to switch it to 12d1:14db (RNDIS) mode as the cdc_acm driver is more reliable and perhaps faster?! than the 3G modem using pppd+dialup.

The first benefit of connecting via USB is that our ISP ALTEL4G is shaping P2P for USB-only modems to 64-128Kilobytes and don't shape such strictly for Wi-Fi-only modems (which is Huawei E589u-12, ZTE MF91d and etc)