[Hardware Hacking General] E:V:A:
After connecting to the router modem via microUSB connection and a terminal application (Putty or RealTerm) we can issue some standard ATC's. Here are the results.

Huawei/Qualcomm standard AT commands (E589u-12 via "AT+CLAC")

The 3GPP ETSI standard [part 1/2]:

[SIZE=2]&C
&D
&E
&F
&S
&V
&W

A
D
E
H
I
L
M
O
P
Q
T
V
X
Z

\Q
\S
\V
%V

S0
S2
S3
S4
S5
S6
S7
S8
S9
S10
S11
S30
S103
S104

+CACM
+CAMM
+CAOC
+CBC
+CBST
+CCFC
+CCLK
+CCUG
+CCWA
+CDIP
+CEER
+CEMODE
+CEREG
+CFUN
+CGACT
+CGATT
+CGCLASS
+CGCMOD
+CGCONTRDP
+CGDATA
+CGDCONT
+CGDSCONT
+CGEQMIN
+CGEQNEG
+CGEQOS
+CGEQOSRDP
+CGEQREQ
+CGEREP
+CGMI
+CGMM
+CGMR
+CGPADDR
+CGQMIN
+CGQREQ
+CGREG
+CGSCONTRDP
+CGSMS
+CGSN
+CGTFT
+CGTFTRDP
+CHLD
+CHSN
+CHUP
+CIMI
+CIND
+CLAC
+CLCC
+CLCK
+CLIP
+CLIR
+CMEC
+CMEE
+CMER
+CMGC
+CMGD
+CMGF
+CMGL
+CMGR
+CMGS
+CMGW
+CMMS
+CMOD
+CMSS
+CNMA
+CNMI
+CNUM
+COLP
+COPN
+COPS
+CPAS
+CPBF
+CPBR
+CPBS
+CPBW
+CPIN
+CPLS
+CPMS
+CPOL
+CPUC
+CPWD
+CQI
+CR
+CRC
+CREG
+CRES
+CRLP
+CRSM
+CSAS
+CSCA
+CSCB
+CSCS
+CSDH
+CSIM
+CSMP
+CSMS
+CSQ
+CSSN
+CSTA
+CTFR
+CTZR
+CTZU
+CUSD
+CV120
+CVHU
+DR
+DS
+ES
+ESA
+FAR
+FCL
+FCLASS
+FDD
+FIT
+GCAP
+GCAP
+GMI
+GMM
+GMR
+GSN
+ICCID
+ICF
+IFC
+IPR
+PACSP
+VTS
+WS46
[/SIZE]

The Qualcomm Specific standard AT's [part 2/2]:

[SIZE=2]*CNTI Displays the access technology; refer to GSM 07.07 subclause 9.2 for err value

$BREW ?? Start a "Brew MP" serial session (by entering the BrewMP Command Processor)
$CCLK ?? sets the clock of the device
$CREG ?? gives information about the registration status and access technology of the serving cell.
$CSQ

$QCAPNE Command is used to edit APN values in APN table.
$QCBANDPREF Sets the band preferences of the device
$QCBOOTVER Returns boot image version
$QCCLR Clears mobile error log
$QCCNMI Similar to 27.005 +CNMI except for the behavior with $QCCNMI=1,2
$QCDEFPROF Sets the given profile number as default profile for the family of the specified technology and subscription.
$QCDGEN Generates data over +CGACT activated PDP context
[B]$QCDMG[/B] [COLOR=Red]Transitions to Diagnostics Monitor (DM) operation[/COLOR]
$QCDMR Sets DM baud rate
$QCDNSP Sets primary DNS IP address
$QCDNSS Sets secondary DNS IP address
$QCHWREV Provides MDM1000 chip hardware revision
$QCMRUC Command is used to edit/set MRU database.
$QCMRUE Command is used to clear/delete MRU database
$QCPDPCFGE Sets PDN teardown time interval
$QCPDPIMSCFGE Command is used to edit PDP profile registry
$QCPDPLT Enables/disables tolerance to long delays in PDP call setup
$QCPDPP Sets authentication for PDP-IP packet data calls
$QCPINSTAT? Sends to the ME the status of all PINs for all cards
[B]$QCPWRDN[/B] Power Down the UE
$QCSIMAPP This command is applicable only for DSDS target. User can select Active subscription.
$QCSIMSTAT Get/Set SIM status (init completed?)
$QCSLOT Sets SIM card on which slot commands will operate
$QCSYSMODE Get hardware available network modes (e.g. WCDMA + HSDPA + HSUPA)
$QCTER Sets TE-DCE baud rate; baud rates supported are identical to +IPR command
$QCVOLT Provides the input voltage level of VMAIN_3.3 as measured by the DUT power management IC
[/SIZE]

Here is a list of Huawei OEM extracted AT commands. They were extracted from

the E392u-12 firmware update (11.836.13.00.209), since I didn't have any

firmware for my own router. Later, I also managed to extract the firmware (via

QPST's Memory Debug Application) for the E589. The result after having spent

considerable time manually checking the availability for most of these, are

shown in the table below. It is very likely that there could be other commands

in our router firmware, not shown here, that I have either missed, or that

remain disabled until certain features are enabled and other criteria

fulfilled. For example, DIAG,FTM,LTE,USSD modes etc.

Unsolicited ATCoP Messages

When connected directly to your modem port via some terminal application,

the ATCoP will occasionally produce informative messages about the status

and changes to network connections etc. These messages are called

"Unsolicited message". In many of the newer Qualcomm based Huawei (OEM)

mobile USB routers/modems, these messages appear prefixed with the

tilde/carrot, "^". But although Huawei uses the carrot for their

proprietary AT commands, these are not actually commands. In newer Huawei

modems, these messages are controlled by the AT^CURC command. Here is a

list of these unsolicited messages and their meanings.

From 909u-512 manual:

[SIZE=2]^ACTIVEBAND
^ANLEVEL
^BOOT [info] During device re/boot-up
^CEND
^CONF
^CONN
^CRSSI
^CSNR
^DATASETRULT
^DATAVALIDITY
^DSDORMANT
^DSFLOWRPT [info] about the current connection statistics during dial-up. (curr_ds_time,tx_rate,rx_rate,curr_tx_flow,curr_rx_flow, qos_tx_rate,qos_rx_rate)
^EARST
^ECCLIST
^ECLSTAT
^HCSQ
^HDRRSSI
^HRSSILVL
^HWNAT [info] Service State Change Indication (GSM,CDMA,LTE etc.)
^IPDATA
^IPSTATE
^LOCCHD
^MODE [info] System mode change event indication
^NDISEND
^NDISSTAT
^NWTIME
^ORIG
^OTACMSG
^POSEND
^POSITION
^RFSWITCH
^RSSI [info] RSSI change indication
^RSSILVL
^SIMFILEREFRESH
^SIMST [info] USIM card state change indication
^SMMEMFULL [info] When message storage is full, this unsolicited indication is sent.
^SRVST [info] Service state change indication
^STIN
^THERM
^TIMESETRULT
^WNINV
^WPDCP
^WPDDL
^WPDOP
^XDSTATUS

Maybe in E589:

^THERMST [info] ?? Thermal Step Timer
[/SIZE]

Error/Response Table

To see what ATC work or not, I just marked the various ATC with their allowed options.

[SIZE=2]Type:
-------------------------
[B]-[/B] Command Not Supported
[B]! [/B]Unsolicited message[B]
E[/B] ERROR
[B]CE[/B] +CME ERROR: 1
[B]/[/B] [no response] or just "OK"

Allowed options:
[B]1[/B] Raw: Used without parameter)
[B]2[/B] Read: Read with "?"
[B]3[/B] Query: Read write options with "=?"
[/SIZE]

Huawei Proprietary AT commands (Qualcomm Modems)

[SIZE=2]
^ANQUERY Query current network parameters (rscp,ecio,rssi,antenna_level,cellid)
^APBATLVL *1 Battery State/Level (chargerState,batterylvl)
^AUTHDATA 123
^AUTHVER 2
^BSN ?? Get Backward Sequence Number. The sequence number of the last correctly received MTP frame received.
^BTRSN
^CARDLOCK Unlock SIM network lock. Set: AT^CARDLOCK="<unlockcode>" (Query: state,times,operator) [NV item 50001]
^CARDMODE Get currently installed SIM/USIM card type. [2]
^CCV / ??
^CELLMODE 123 ?? Get current cell mode (0-9)??
^CMDLEN 2 ?? 480 ??
^CPBR Get Phonebook entries
^CPBW Set Phonebook entries
^CPIN 23 Get?set SIM PIN/PUK management
^CPNN E ?? Calling Party Number?
^CPWORD / [1]
^CQLM /
^CRADLE -
^CRPN /E
^CSDFLT ?? Circuit Switched Data? Related to Field Test Mode
^CSVER 2 Get XXXX version number. I.e. "1004"

^CSQLVLEXT +CSQ? Level Extension, shows RSSI Level and BER (rssilv,ber)

[B]^CURC[/B] *23 [COLOR=DarkGreen]Get/Set presentation of unsolicited results (^BOOT, ^RSSI etc.) [0-disable, 1-enable standard set, 2-modes][/COLOR]
^DATACLASS Get info on supported UMTS protocols
^DATALOCK
^DHCP CE Get interface IPv4 addrs assigned by network DHCP server
^DHCPv6 Get interface IPv6 addrs assigned by network DHCP server
^DIALMODE Get/Set dial-up mode (Modem/NDIS)
^DISLOG ?? Disable Diagnostics Mode use for ceratin NV items? (NV_FORBID_DIAG) Also see [1]
^DLR ?? Current USB? Download Rate (in kbps)
^DNSP Get/Set the Primary DNS server address
^DNSS Get/Set the Secondary DNS server address
^DSFLOWCLR Clears the DS traffic to zero, including the DS accumulated connection time
^DSFLOWQRY Show last DS connection time and traffic
^ECIOCFG ?? Ec/Io Configuration (related to signal quality) RSSI [dBm] = RSCP [dBm] - Ec/I0 [dB]
^ENABLESD *23 Enable/Disable router SD-card slot. (0:disable, 1:enable) [NV_SD_CARD_ENABLE_I]
^FACINFO / Get/Set Factory Information
^FCHAN /E [2]
^FDAC CE [2]
^FLASH Get NAND flash information (chiptype, block statistics etc.)
^FLNA [2]
^FPA CE [2] Set RF Power Amplifier level
^FREQLOCK Enable/disable RF PLL lock to specific ARFCN (By setting NV item "NV_FREQLOCK_I".)
^FRSSI CE [2] Get GSM/LTE RSSI values
^FRXON 2 [2] ?? RF Receiver On
^FTXON 2 [2] ?? RF Tranmitter On
^GETPORTMODE 1 ?? Show active port mode: "TYPE:WCDMA:Qualcomm,PCUI:0,DIAG:1"
^GLASTERR E Get list of latest firmware errors
^GPIOPL 2 Get/Set PIN on OPL ??? (14 bits?)
^HS E ?? Switching to HS USB mode? (id,protocol,IsOffline,p_class,p_id,s_id)
^HSPA Get/Set "recommended" UMTS protocol
^HVER 1 Get PCB? hardware version/name
^HWDUMP 2
^HWNATQRY Get NAT of current network
^HWVER Get the Hardware Version number (31 characters)
^ICCID 2 Get the SIM card CID
^IMSICHG [3] Change IMSI
^INFORBU
^IPV4V6TEST -
^IPV6CAP - Check if IPv6 is supported
^JAPAN [1]
^LED 12
^LEDTEST Check color combinations of device's LED
^LTECAT 2 Get the device LTE Category
^LTECS 2 ? Get/Set LTE circuit switched (CS) fallback?? See: http://tinyurl.com/l2k3drz http://tinyurl.com/mjemr2u
^LTEPDPTIME ? [4]
^LTERSRP E [4] Get RSRP and RSRQ for serving cell
^LTESCINFO E [4] Get PCI, SINR, MIMO rank and bandwidth for serving cell
^MAXLCKTMS Get/Set (protected) maximum number of tries to enter wrong NCK [NV item 50005]
^MDATE E
^NDISDUP Get/Set NDIS based dialing (ECM) [Require enabled NDIS port]
^NDISEND ?? NDIS/WWAN Disconnect report
^NVMBN 123
^NVTEST 12
^OPL [3] ?? Get Operator PLMN List
^OPWORD [1]
^PHYNUM ?? Get/Set (protected) IMEI
^PLATFORM 2
^PNN [3] ?? Get PLMN Network Name (PNN) List
^PORTLOCK Enable/Disable switching PC UI to Diag mode
^PORTSEL 23 Proactive event report port setting for non-data service (Modem,PCUI,...) (0-disable*, 1-enable)
^PREFMODE Get/Set the preferential network mode
^RDCUST 123 Get/Set various Huawei customization parameters (NV), may need password! (~29 in total)
^RRCVER 23 ?? Get/Set RRC version? [0-4] (Begin to parse "Receiver" messages?)
^RSCPCFG Get/Set lower UMTS RSCP thresholds
^RSFR ??SF=SIM Filesystem?? Read
^RSFW ??SF=SIM Filesystem?? Write
^RSIM ?
^RSTRIGGER *23 ?? Writing to Huawei NV item [NV_HUAWEI_WMS_CONFIG_INFO_I]
^SCPBR ?? See +CPBR and ^CPBR Get Phonebook entries
^SCPBW ?? See +CPBW and ^CPBW Set Phonebook entries
^SD CE
^SETPID [3] Change device's USB PID to generic 1001 (until reboot)
^SETPORT Set modem port modes: (MODEM,PCUI,DIAG,PCSC,GPS,CDROM,SD, ... etc.)
[B]^SFM Set modem to "Factory Mode": AT^SFM=1 (Disconnect and reconnect) [NV_FTM_MODE_I ?? nv number?][/B]
^SIMLOCK
^SLOTCFG Get/Set maximum number of allocated data timeslots (GPRS/EDGE)
^SN ?? Write Serial Number into factory NV item 114 "Factory Information" [NV_FACTORY_ITEM ???]
^SPN [3] TE Query the Service Provider Name (SPN) file of 2G/3G stored on the SIM/USIM card through the ME.
^SSID Wifi ESSID? [NV-item 50290]?
^STGI [3]
^STGR [3]
^STIN [3]
^STSF [3] Related to writing NV item [NV_HUAWEI_STK_CFG_I]
^SWDUMP 2
^SYSCFG - (old) System configuration reference setting (Mode,Acqorder,Band,Roam,Srvdomain)
^SYSCFGEX 23 (new) System configuration reference setting (Acqorder,Band,Roam,Srvdomain,lteBand)
^SYSINFO 1 (old) Query the current system information (service state, domain, roaming etc.)
^SYSINFOEX 1 (new) Query the current system information (service state, domain, roaming etc.)
^SYSMODE 1 Get current network mode (WCDMA, HDSPA etc) [use ]
^TBAT *2 ?? Perhaps battery charger mode or Type? (0-normal, 1-, 2-charging)??? [NV-item 90]?
^TCHRENABLE *3 ?? Is trickle charge enabled ??
[B]^TMODE[/B] [COLOR=Red][2] ?? Enter Factory Test (?) Mode (WARNING: Will reboot/reset router)[/COLOR]
^TSELRF 2 ?? Get selected/supported RF modes/bands?
^UIMDELAY 23 ?? (0,1,2)
^USSDMODE Get/Set the USSD method to process the USSD data.
^VERSION 2 Get External/Internal hardware and firmware version information.
^WIKEY *23 [NV-item 50291]?
^WIWEP *23 [NV-item 50292]?
^YJCX 1 ?? Show some kind of combo of HW features (at least in other modems)
-------------------------------------------------------------------------------
* New in E589u-12 compared to E392u-12 FW
[1] DoCoMo (Japan) specific OEM and/or "authority" related commands.
Affected commands: ^JAPAN, ^OPWORD, ^CPWORD and ^DISLOG ?
[2] Some commands give weird responses, it could be that they're only
available when modem is set to Factory Test Mode (FTM) or when in
Diagnostic Mode (DIAG) ?
[3] Related to SIM Tool Kit (STK) functions.
[4] Certain LTE related commands has to have an active LTE connection
in order to work.
-------------------------------------------------------------------------------

[/SIZE]

These are device dependent, so obviously not all of them will work on all devices. There are probably

many others on more advanced routers, which is why we need the firmware.

Here are a few command descriptions/examples:

[SIZE=2]at^sysinfo
^SYSINFO:2,3,1,5,1,,4

at^setport?
FF;1,2,3,7,A1,A2

WHERE:
1:MODEM
2:PCUI
3:DIAG
4:PCSC
5:GPS
6:GPS CONTROL
7:NDIS
A:BLUE TOOTH
B:FINGER PRINT
D:MMS
E:PC VOICE
A1:CDROM
A2:SD

at^getportmode
^GETPORTMODE:TYPE:WCDMA:Qualcomm,PCUI:0,DIAG:1

at^portsel?
^PORTSEL:0

at^portsel=?
^PORTSEL:(0-1)

at^rdcust=?
(0: 0) (1: 0) (2: 1) (3: 0) (4: 0) (5: 0) (6: 0) (7: 0) (8: 0) (9: 0) (10: 0) (1
1: 0) (12: 1) (13: 0) (14: 0) (15: 0) (16: 0) (17: 0) (18: 0) (19: 0) (20: 0) (2
1: 0) (22: 0) (23: 1) (25: 0 0) (26: 0) (27: 0) (28: 1 1) (29: 0)

at^cardmode
^CARDMODE: 2

at^hver
^HVER:"CL1E589M22"
[/SIZE]

For more info on the at^syscfgex command, please have a look at the Russian forum post HERE.

References:

[1] HUAWEI UMTS Datacard Modem AT Command Interface Specification_V2.3.pdf

[2] HUAWEI CDMA Datacard Modem AT Command Interface Specification (2008)

[3] AT Command Interface Specification (2010) [MG323 GSM]

[4] Comprehensive AT Command Set in AMSS Software [80-VR432-1 C]

[5] ME909u-521Application-Guide.pdf

[6] ME909u-521-AT-Command-Specification.pdf