[Hardware Hacking General] E:V:A:
Backing up the router Firmware

Now, this is the place where siht is starting to get real. The main problem is that Huawei

has blatantly abandoned their device support, in pursuit for a more profitable build-sell-and-forget

strategy. Just what we're used to Samsung doing! So we're left in the dust of greed, to fight for

ourselves. The firmware for this device is nowhere to be seen in the wild apart some occasional

JTAG dumped fakes, behind some far-east pay-walls. So we have to resort to our own back-to-basics

low-level tools. Fortunately, Qualcomm is on our side, with occasional document leaks and

various OEM tools. Let's see what we can do with them and what need to be done.

Basically, the "firmware" (FW) consists of several parts.

The raw CP firmware code containing the RTOS.*

The raw AP (here UI) firmware code containing the APPS OS.*

The factory hardware settings, containing chip specific configuration data.

E.g. Qualcomm MDM9200 + related chipset data.

The OEM (Huawei) hardware settings, containing device design specific configuration data.

E.g. microSD-card, display, USB and antenna/band settings.

The Carrier customization settings, that determines the available/allowed networks,

bands and carriers, including the web-interface and server.

* Note that in our E589, (1) and (2) are the same as there is no real AP nor UI. That means all

UI-like (display and web-UI) operations are happening in (1), the modem itself.

Parts (1) and (2) are generally stored on the eMMC in separate partitions, while parts (3-5) are redundantly stored on one or more partitions, using a special (virtual) file system called Embedded File System, EFS2. This is not a real FS, in the low-level HW sense. Within this EFS, are all the parameters and settings required for normal operation of the device, including the web-server and UI filesystem. That means (in our case), that we have the following:

all IMEI/IMSI and carrier data

web-server and UI data

all RF related parameter data

most/all of AP/CP/PMIC/WiFi/BT/NFC low/chip-level parameters

carrier customization configuration

etc etc

However, most of the data and parameters that are not directly part of the web-interface, are stored in a number of proprietary Qualcomm Non-Volatile (NV) items, the "NV-items". Each individual NV-item is usually stored in its own separate file in the EFS under the "nv" directory. They can have names or simply numbers, depending on OEM and NV-item values. To simplify the loading, editing, backup and restore of these, Qualcomm uses a special file format, called a QCN file. Special tools like, QPST, QXDM etc, are used to create, edit, compare, merge or upload these files to the device. We will look in more detail at these tools later.

The important thing here, is that we want to backup both the full EFS and the QCN file for easy access. Later we'll attempt to make a low-level (partion-level) backup, of the rest of the internal firmware, in case something would go wrong or if we would need a more low-level RTOS firmware modification.

< WIP >

Backing up the EFS

There are several ways to backup the EFS2, internal filesystem.

Qualcomm QPST

Qualcomm QXDM

RevSkills

< tba >

One way to backup the EFS2, is to use the QPST plugin, "EFS Explorer".

a) Open QPST and connect your phone

b) Go to: menu > EFS Explorer

c) In the new EFS Explorer window, ...

d) < tba >

e) Send your SPC, normally "000000" for unlocked modems.

f) ...

This will also generate the EFS logfile "efs.log". This is a text-file that contains all filenames part of the backup. Here you will not only find the path to all XML configuration files, JavaScript, nv/item_files/ and manuals etc, but will also be very useful to show you what URL's are available through the router web-UI.

HERE is the entire list, with some edits for readability.

We'll discuss the details of this in a later post about the web-UI and API.

Incomplete EFS Backup

Backing up your EFS in this way, will not allow you to get all items. Some of the EFS files containing crucial HW specific data are read/write protected. These protected folders are shown in EFS Explorer as crossed out, like this:

I have not yet figured out how to get these out in a simple way, without having to resort to more advanced methods, as mentioned later.

Please send me a PM if you know how!

< WIP >