Huawei B593 firmware from 3 Denmark

Thursday, September 5. 2013

Sorin was kind enough to comment my article about Telia's firmware. He found a firmware from 3 Denmark for B593. Naturally I had to try that as soon as I could.

My previous articles about B593 are:

The download link for 3's firmware is: http://www.3.dk/Privat/Kundeservice/Hjaelp-til-mobilt-bredbaand/Routere/Huawei-B593/#Firmware_opgradering

You will find a .zip-file, which will contain the firmware file with name hi3g_r+m+h+s.tar.bz2 in it. The file is dated 20th Nov 2012. After the firmware upgrade, a software version of V100R001C26SP054 will be installed:

The previously used Saunalahti firmware has software version of V100R001C260SP055, so the difference is C26 SP054 vs. C260 SP055. It is a known fact that telcos get a firmware modification kit from Huawei and can enable/disable features and add their own skins (see previous posts).

For all of us not fluent in Danish, there is a language selection in the login-screen. Beware: after the upgrade was done, I didn't have any connectivity. See:

The lack of connectivity was for the reason, that during update the APN-settings were set for 3 Denmark. Naturally they didn't work for me. This firmware has the VoIP-functionality enabled, thus, there is need for 2 separate APNs. Finnish telco's don't have the VoIP, so I cannot test that. But that does make the APN-setting -screen quirky. You cannot edit/delete an APN which is in use, either as data connection or VoIP-connection. There is no visual feedback about that, so I had to investigate the setting screen -logic for a while.

I did confirm that SMS-send/receive functionality is there and works. No issues on my tests. Also I confirmed my DMZ-forwarding, it still works as expected.

One fact that Sorin mentioned in his comment was, that he experienced lot of dropped connections with Saunalahti-firmware. His experience is that this firmware is more robust.

I'll update here if something surprising appears.

by Jari Turkia in Huawei B593 at 08:42 | Comments (66) | Share in LinkedIn

Comments
Display comments as (Linear | Threaded)

Gary on :

Do you know if this firmware unlocks the use of the external antenna ports?
Comment (1)

Jari Turkia on :

Oh? I didn't realize that there existed firmwares which wouldn't utilize the external antenna ports. To my understanding the funny looking flappy paddles which come in the box with the B593 are both connected to "external" antenna ports. Sure, you don't have to use them, but in my case, I'm really using an external antenna. As in: I have 10 meters of coaxial cable and an omidirectional jar bolted to my roofing in order to get proper 3G/4G-connectivity. In my instruction manual there was an extra leaflet saying to use the right antenna connector for that purpose. When it comes to firmware, there is a setting for using external or built-in antenna.
Comments (29)

Petri on :

You can add the Finnish APN profiles by first clicking Edit APN Profile button and then by clicking the shaded area saying "Add APN Profile". Then add APN for your operator. I added "internet" for Saunalahti data and "voip.saunalahti.fi" for Saunalahti VOIP that they unfortunately retired couple of years back already.

Then on the internet settings page you need to enable "data roaming" to establish connection to your Finnish operator.

Let's see if this firmware is more stable or is it the Saunalahti/Elisa 4G network which causes the drops in connectivity.
Comment (1)

Jari Turkia on :

The 3.dk firmware has been very stable for me. The APN management in the B593 is very clumsy, you cannot edit/delete an APN which is in use, but the UI does not say anything about that. I had to figure this out with a dozen or so attempts. The idea is to insert a "dummy" APN, start using it and then you can edit the settings.
Comments (29)

Vlado on :

Hi, Jari,
I had the B593u-12 modem in Slovakia Telefonica with FW which does not support external antennas. Therefore I flashed the new FW you recommended - the V100R001C26SP054.

After flashing, modem still works fine on LTE, but the admin password does not work any more. So I cannot log in nor configure the modem anymore. Have you had similar troubles with the password? I have read your articles about hacking the modem and even have tried to use the steps described here - http://blog.asiantuntijakaveri.fi/2013/08/gaining-root-shell-on-huawei-b593-4g.html, but could not run any simple linux command like "ls-l", or "pwd". I am not sure about the passswords f5338SA1kb4=(CLI) and HoHSyzm0ye4=(WEB) and what you have discovered from the curcfg.xml. In your perl script you use the YWRtaW4=, (because of the result of the encode_base64('admin') ).
I tried all of them, but could not connect. Maybe I am doing something wrong. After trying to connect I just obtained some html script without sense. I am thinking about reseting the modem to factory settings but I am not sure if this reverts the admin password to admin.
Please don't you have any hint? I will repeat all the steps again and carefully, writing down all preconditions and results this is the way I see yet. Could I send it to you then, please?

Thank you very much for your time.
Vlado
Comments (4)

Jari Turkia on :

In order to use the exploit from asiantuntijakaveri.fi or an automated version of it (my Perl-exploit from http://blog.hqcodeshop.fi/archives/130-Exploit-Running-commands-on-B593-shell.html), you will need a working admin password for the web. If you don't have that, you're out of luck.

On another article about gaining a prompt (http://blog.hqcodeshop.fi/archives/151-Huawei-B593-Logging-into-shell-Solved!.html), I described the encrypted passwords of f5338SA1kb4= and 2n+mVpCOAaY= representing words "admin" and "user". Your passwords of HoHSyzm0ye4= and YWRtaW4= are unknown to me. Since the passwords are encrypted and currently the algorithm is not known, it is impossible to reverse or brute force them. This may change in the future, but as of now I don't know how they are handled.

Please note, that I did never use a password of YWRtaW4= anywhere. In my perl-script I used a plaintext default password of "admin", which is stored as f5338SA1kb4= in the curcfg.xml.

My only advice for you is to do a factory reset. To my understanding it will reset the admin password back to "admin" and you're back in business. As you may already know, many devices (motherboards, network appliance, etc.) either do a factory reset after firmware upgrade, or instruct the user do do so. Based on that I'm positive it won't hurt your current situation.

Please inform what you chose to do and if it helped. Plenty of people here are anxious to know.
Comments (29)

Vlado on :

So short story about my B593u-12. Bougth in Slovakia O2 with the V100R001C445SP100 FW. In my house there is a weak signal so I decided to buy external antennas. In the meantime I put the modem under the roof in order to gain the signal. But this is not the place with thermo insulation (modem works in temperature range from 0 to 40 degrees) so this can be considered only as a temporary solution. But the FW mentioned above does not support external antennas.
From more sides I heard about the nice external antenna settings feature provided by the 3.dk FW V100R001C26SP054 to switch from built-in to external antennas and vice versa. Therefore I downloaded it and flashed my modem. After that I was unable to log in as admin/admin any more. Nevertheless modem did work properly (since I had the Auto APN checkbox checked) and before I decided to do some hasty step I started to investigate whether to:

1 - restore the modem to the factory settings (then it sure loses the Auto APN settings and if I did not get my admin password back I would become a loser )
2 - unlock it by the dc-unlocker (which does not help for the admin password, as I have finally learned)
3 - hack it using the procedure described here by Jari and and/or here: http://blog.asiantuntijakaveri.fi/2013/08/gaining-root-shell-on-huawei-b593-4g.html

Jari encouraged me to restore that potential brick  and since I have before even called to the hotline to 3.dk and they encouraged me to do that as well so I did it.
Uff, without success. I just lost my settings, neither connection nor the admin password.
Then the last shot to switch it OFF and ON and then --------- BINGOOO!
Everything works fine!

Changed the Data APN field to my provider’s one, the activate the external antennas settings  and that’s it!

Experiences with the 3.dk FW:
Good, stable, nice and enabling the external antennas.

@Jari:
Thank you for those lovely pages I strongly booked them. Try to process this nice hacking you described and will post my experience here.

My truly thank you

Vlado
Comments (4)

Jari Turkia on :

You're welcome! I share, because I care.

As I expected, the factory reset will also affect the admin password. Turning the device off and back on is part of the factory reset -procedure.
Comments (29)

Vlado on :

Excuse me, by my last sentence I meant... I will try to process this nice hacking you described and I will post my experience here. :-)

BTW is there any possibility to follow particular forums (e.g. to be informed by email when new post is added)?

Thanks
Comments (4)

Jari Turkia on :

I got your meaning. :-)

This is a blog, not a forum. I'd recommend for you to follow the RSS-feed (see the right side of the page) at http://blog.hqcodeshop.fi/feeds/categories/7-Huwei-B593.rss for Huawei-postings.

If you're interested in comments, see http://blog.hqcodeshop.fi/feeds/comments.rss2

There is also one other way of following comments for this single post http://blog.hqcodeshop.fi/rss.php?type=comments&cid=112

I don't know how the last feed could be made public nor why it is hidden by default.
Comments (29)

Daniel on :

Will this firmware work with B593s?
Comment (1)

Jari Turkia on :

No it won't. It is for B593u-12.
Comments (29)

joshua on :

hello,

Can somebody post in summary the changelog between C26 SP054 vs. C260 SP055

Thanks! I am using C260 SP055
Comment (1)

Jari Turkia on :

I'm positive, that such a list is not available for general public like us. It has already been established, that Huawei B593 is handled via telcos only and they manage the support for that hardware. Most operators won't disclose anything about that router, not even firmware upgrades.
Comments (29)

Vlado on :

Bjorn started doing some comparisons here, but SP055 is not tested yet. Anyway this is very nice table :-)
https://onedrive.live.com/view.aspx?resid=B483589C2FD81F7D!207

Vlado
Comments (4)

Jari Turkia on :

Yeah. That is mighty generous of Bjørn to share his findings with us. I really appreciate his hard work.

As we can see he haven't tested all of the firmwares. I think he will be using his box to provide internet access, like most of us do.
Comments (29)

Jukka on :

Do you know is it possible to bypass NAT in any firmware version? I have my B593 connected to pfsense firewall and double NAT is not needed.
Comment (1)

Jari Turkia on :

Read my previous post about B593's DMZ setting: http://blog.hqcodeshop.fi/archives/105-Using-the-DMZ-setting-of-Huawei-B593.html
There I said: "In UMTS-network, the mobile terminal will negotiate a data connection and get the IP-address associated with the connection". So, in order for both of us to get what we want would be an extension to UMTS-spec. That way we could get multiple IP-addresses via single data connection. Until some data wiz comes up with such a change, we're both out of luck. Sorry.
Comments (29)

kevo888 on :

I installed the Danish software into my B593u-12 hardware version B. My original generic firmware had no external/internal antenna feature. A mimo antenna would work, as the router uses software to detect the antenna...but it would not detect my 3G yagi with one connection. With the new firmware I am able to use any antenna now. Mimo, single connection or internal. Very happy. Thankyou very much :-)
Comments (3)

Jari Turkia on :

You're most welcome. :-)
Comments (29)

Simon on :

In the different versions of FW you have tried, have you stumbled upon any one where you can select a specific band, say like 2600 Mhz. As of right now i can only select 3G and 4G.
I would also like to have a working SMS function.
I also must have the ability to choose external antenna.

I live in sweden and use a B593u-12 with the provider Tre (3)

Greatful for your answer.
Comment (1)

Jari Turkia on :

Sorry no. All of the firmware I have seen use the "big switch", meaning that a 4G is either enabled or disabled. Nothing on the actual frequencies used can be selected by user. All of the firmware I've seen have functioning SMS and external antenna. See my original post http://blog.hqcodeshop.fi/archives/14-Huawei-B593-4G-router-SMS.html about me being pissed off about the missing SMS-functionality. My original firmware had the external antenna selection, though.
Comments (29)

nGINMU on :

Is it at all possible in any firmwares seen, to get the B593 to divulge cell station info (BSIC, Cell ID that sort of thing)? Could such info be extracted by consoling / command lining into the box somehow? Thanks for any info
Comments (3)

Jari Turkia on :

Not that I know of. There is very little access to any of the radio interfaces from the Linux-side. As you can guess, the 3G/4G interface is Huawei proprietary, so there is no public information how to access that. The WLAN-side should be easier, but that is not what you asked.
Comments (29)

nGINMU on :

Thanks - pity.
Comments (3)

Jari Turkia on :

I'm totally with you on this.

I'd like to see my Linux with proper interfaces to all the really good stuff. Open source is about being open. Unfortunately, for the big corporations, open source is simply a method of saving on product development costs. What we'd need is Mr. Torvalds flicking his finger to those big corporations. :-)

Also being an open source kind of guy, I completely miss the point on Huawei closing the box in the first place. Now what we know how to hack ourselves into the box, the natural idea is to really see what's in there.
Comments (29)

kevo888 on :

You can read the "Cell ID" in the danish firmware. It is available under "diagnosis" "wireless status".
Comments (3)

Jari Turkia on :

Wow! You're absolutely right. Apparently I never visited that.

I'm getting something like this on my box:
Wireless Status
1 PLMN: 24412
2 Service Status: Valid services
3 Bandwidth(kHz): 15000
4 Cell ID: 4
5 Signal Strength: 1
6 RSRP(dBm): -127
7 RSRQ(dB): -14
8 Roam: NO

1) PLMN is Public land mobile network for my Telco (DNA Finland Oy).
4) Is the cell ID where my B593 is connected into, however without the LAC-code (Location Area) it is useless for location purposes.
Comments (29)

kevo888 on :

Switch your modem to WCDMA to get more cell info. The cell ID is very useful when setting up 2 external antennas. If you have many cell sites in your area you can tune them, one at a time, to make sure they are both focused on the same cell. I use 2 large grid antennas as cell sites are 15km from my house. They are very directional, and this really helps at installation. I also have B593-22, which does not have this feature in the firmware.
Comments (3)

Jari Turkia on :

That does not seem to be the case. I forced the box into 3G and it provided much less information. It had pretty much only PLMN and RSSI [dBm].
Comments (29)

nGINMU on :

Thanks kevo888, excellent!

When switched into 2G I get

1 PLMN: N/A
2 Service status: Restricted service
3 RSSI (dBm): -67
4 RSRP (dBm): -0
5 RSRQ (dB): -0
6 Roaming: No

When switched into 3G I get

1 PLMN: 23420
2 Service status: Valid service
3 RSCP (dBm): -82
4 ECIO (dB): -6
5 RSSI (dBm): -81
6 Roaming: No

Switch router into LTE I get;

1 PLMN: 23420
2 Service status: Valid service
3 RSSI (dBm): -85
4 RSRP (dBm): -110
5 RSRQ (dB): -16
6 Roaming: No

Not too sure what all these infos are.

I have B593s-22
Hardware version: Ver.B
Firmware version: V200R001B180D15SP00C00

This was bought on eBay as a straight Huawei unit with no telco branding. I'm operating it with a '3 UK' telco simcard.

I used to have a Huawei USB dongle & I noted with that, that there was a heck of a lot could be done with some xml-style config files to get the 'Mobile Partner' PC software it used, to open up additional config options and features. That was on the attached PC though, not the dongle firmware.

I'm pointing directional antennas at distant masts here too :-)
Comments (3)

Taranis on :

Hi, I installed the Danish FW to my B593u-12, and I'm having a problem with VOIP. I'm not sure if this is a FW related problem, but maybe you can help me. Whenever I try to register a SIP server, I get the following message: "Invalid parameter settings". What I do is enter "sip.browsercalls.com" to the proxy/registrant domain, and enter "5060" to the proxy/registrant port. I really don't know how this is invalid.
Comments (2)

Jari Turkia on :

I'm so sorry, but in Finland we don't use VOIP at all. So basically I don't know anything about B593 VOIP setup. The telcos simply don't offer such service and pretty much everybody here is using either a phone or Skype.
Comments (29)

Taranis on :

No problem, I have found a solution. There was something messed up in the config, as a factory reset cured the problem. I have to mention that this is the 2nd time I hade to make a factory reset since the firmware upgrade. The first time I could not submit APN information.
Comments (2)

Al_shmlani on :

http://www.mediafire.com/download/50hc3ve9qz94o5x/Abo+Yazid.rar
Comment (1)

Jari Turkia on :

Would you like to elaborate?

I downloaded the rar-archive, but it contains the files from a B593-u12 firmware. Pretty much anybody can access those files from their own box.

In case there is something really nice for us to see, please inform.
Comments (29)

dayton on :

Hi to all!
Can someone tell me why firmware update for my B593s-ss ( from Spain) fail?

I tried to load the universal firmw but results always file check failed, why?
I need TO open the 5060 port !!

B593s-22
Hardware version B
Firmware version V200R001B180D20SP50C314
Comments (2)

Fernando on :

Same router with same hw/fw versions.
Have you a backup of the fw?. Mine is blocked by Orange. I am looking for VoIp.
BR
Comments (4)

Jari Turkia on :

I have a number of firmwares, also you can have them see: http://blog.hqcodeshop.fi/categories/7-Huwei-B593

For VoIP, see http://blog.hqcodeshop.fi/archives/215-Huawei-B593-u-12-firmware-spreadsheet.html for information about various firmwares and their features.

Blocked meaning?
Comments (29)

Fernando on :

Thanks Jari,
Blocked means (to me) modified by Orange to delete VoIP entry in the menu.
I am looking for a backup of the Orange fw (or the way and directions to do it) and the original Huawei fw for the router.
My model is B593s-22
My Hw version is Version B
My Fw version is V200R001B180D20SP50C314

Thanks for your help
BR
Fernando
Comments (4)

Jari Turkia on :

This is a FAQ. There is no original Huawei firmware for B593. The units are sold to telcos only, and they get a customization kit with it.

All I can do to help is to re-direct you to my previous comment. Go see, the spreadsheet. There are firmwares which support VoIP. Go download one of them and upgrade to that.
Comments (29)

Fernando on :

Thanks again and apologizes to not found the topic in FAQ.
I saw the spreadsheet but my main fear is how to come back to the original fw.
BR
Fernando
Comments (4)

Jari Turkia on :

You can do a factory reset if necessary. The FlashROM contains the running firmware and the factory one for recovery.

My own experience is, that once you upgrade, you don't want to go back. :-)
Comments (29)

Fernando on :

Again thank you for your help.
Any recommendation for my s-22?
Comments (4)

Jari Turkia on :

s-22? Ok, that's a game changer.

Most stuff in this blog is for u-12, which is the model I have. Generally for s-22 there is only one known working firmware upgrade available and I don't think German Telekom has VoIP. At least their u-12 firmware doesn't.
Comments (29)

dayton on :

Finally I solved my problem ( 5060 voip port blocked ) on my B593-s22 fw.V200R001B180D20SP50C314 putting into registar and proxy settings of my ATA adapter "myvoipproviderdata :80 ".
No 5060!!
No flag on ALG !!

It seems strange but now it works well .

In firewall rules I kept 80 tcp/udp open to ATA ip .
:-)

Dayton
Comments (2)

Adrian on :

i have A b593u-501 i updated it and now i cant get it to work. the white light indicator just keep blinking and no service any help pls...
Comments (2)

Jari Turkia on :

More information is needed.

I'm guessing you upgraded your u-501 with a proper u-501 firmware and now it doesn't work. Have you done a factory-reset to it? It should restore your original firmware.
Comments (29)

Adrian on :

Did that nothing happen... where can I get a b593u-501 firmware. Think I uploaded the wrong firmware in the beginning....
Comments (2)

Jari Turkia on :

I have no idea.

Another thing: if you bricked your router, how can you update the proper firmware?
Comments (29)

jafar on :

Thank you so much Jari bro i done everything successfully and now i am on it..

One thing i would like to know is on previous firmware i had 2G selection but in this i only has now LTE (4G) and WCDMA (3G) is this mean i won't be able to use 2G if 3G and 4G is not available?
Comments (4)

Jari Turkia on :

The answer to your question is yes and no. The selector in that firmware has very little options, meaning that you force the connection into that. On auto, the connection can be 2G if nothing else is available.

What worries me is, you went for SP054 firmware. What you might consider is getting something newer. See http://blog.hqcodeshop.fi/archives/215-Huawei-B593-u-12-firmware-spreadsheet.html for firmware comparision.
Comments (29)

jafar on :

Thank you for response brother Jari

yes i downloaded some other firmwares tried few and i found Polkomtel one best...

thank you for your very helpful webpage its awesome
Comments (4)

Jari Turkia on :

Thanks for your kind words.
Comments (29)

jafar on :

Jari bro sorry to bother you again...

due to its limited availability i guess and with locked features i can't find much about b593u-12 on internet... but you has great knowledge about this device please guide me how can i stream videos from storage connected to b593u-12..or if you can redirect me to some tutorial etc that would be much helpful thanks
Comments (4)

Jari Turkia on :

Go for https://blog.hqcodeshop.fi/archives/215-Huawei-B593-u-12-firmware-spreadsheet.html and see which firmware have DLNA enabled.

Without that, you're pretty much out of luck.
Comments (29)

jafar on :

thank you so much for response..i actually enabled ftp server and configured on other devices to stream videos music and pics it works

on android using ES file explorer...

my firmware is Zain

Q: any firmware in which VPN is enabled?
Comments (4)

Earl on :

hello :-) I installed this firmware as well, used it a couple of months without problems. But then one day, i couldn't connect to the wifi of the router, only to discover that it restored to its factory setting BY ITSELF. Now, i tried to log in to Admin using "admin" password but i couldn't. So I decided to factory restore my router and tried to login as Admin and used the "admin" password again but to my disappointment, i still can not log in. I need some help. How will i know the password? :-(

PS. I bought my huawei LTE CPE B593u-12 on a independent retailer
Comment (1)

Jari Turkia on :

You'll need to use one of the hacks to get past login.
See: https://blog.hqcodeshop.fi/archives/227-u-12-pre-SP100-exploits-in-a-single-tool.html

From SSH-prompt you can see/change your admin password.
Comments (29)

LeePriv08 on :

Hello dear, are you still need help on this thread about huawei CPE LTE B593-12? I had this kind of issue but recently I managed to get rid of the admin password. I can help if u still need it. Thx.
Comment (1)

Peter on :

How did you manage to find password for huawei cpe b593u-12?
Thank you
Comment (1)

Jari Turkia on :

Did you browse https://blog.hqcodeshop.fi/categories/7-Huawei-B593 ?

Depending on your firmware version, there are exploits, and the password is printed in plain-text during boot. To see boot messages you'd need to solder a 1,8 volt RS-232 adapter to the board.
Comments (29)

Leon on :

Firmware is working but country cod... has only three country (no Australia) - Q. is - does it matter if stated not right country for VOIP? Please answer who know.
Thanks.
Comment (1)

Jari Turkia on :

We don't use the VOIP at all here in Finland, so I know nothing about that. Sorry.
Comments (29)

Tomasz on :

Hi, i have the same problem with password.
Fortunly i try old one ( this original one on the label in beck of the router ) and it works - meybe it help sombody like me too.
Comment (1)

philip on :

The download link does not work anymore
Comment (1)

Add Comment
E-Mail addresses will not be displayed and will only be used for E-Mail notifications.
Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
Standard emoticons like :-) and ;-) are converted to images.

Submitted comments will be subject to moderation before being displayed.

Calendar

Mon Tue Wed Thu Fri Sat Sun
← Back November '24 Forward →
        1 2 3
4 5 6 7 8 9 10
11 12 13 14 15 16 17
18 19 20 21 22 23 24
25 26 27 28 29 30  

Quicksearch

Archives

Categories

RSS feeds of this Blog

Blog Administration

Open login screen

Powered by

Parts of this serendipity template are by Abdussamad Abdurrazzaq and Jari Turkia. License