Huawei B593 firmware from 3 Denmark
Thursday, September 5. 2013
Sorin was kind enough to comment my article about Telia's firmware. He found a firmware from 3 Denmark for B593. Naturally I had to try that as soon as I could.
My previous articles about B593 are:
- Telia firmware not having SMS-functionality in it, Saunalahti firmware link
- DMZ-setting
- Dropping to 2G EDGE occasionally
The download link for 3's firmware is: http://www.3.dk/Privat/Kundeservice/Hjaelp-til-mobilt-bredbaand/Routere/Huawei-B593/#Firmware_opgradering
You will find a .zip-file, which will contain the firmware file with name hi3g_r+m+h+s.tar.bz2 in it. The file is dated 20th Nov 2012. After the firmware upgrade, a software version of V100R001C26SP054 will be installed:
The previously used Saunalahti firmware has software version of V100R001C260SP055, so the difference is C26 SP054 vs. C260 SP055. It is a known fact that telcos get a firmware modification kit from Huawei and can enable/disable features and add their own skins (see previous posts).
For all of us not fluent in Danish, there is a language selection in the login-screen. Beware: after the upgrade was done, I didn't have any connectivity. See:
The lack of connectivity was for the reason, that during update the APN-settings were set for 3 Denmark. Naturally they didn't work for me. This firmware has the VoIP-functionality enabled, thus, there is need for 2 separate APNs. Finnish telco's don't have the VoIP, so I cannot test that. But that does make the APN-setting -screen quirky. You cannot edit/delete an APN which is in use, either as data connection or VoIP-connection. There is no visual feedback about that, so I had to investigate the setting screen -logic for a while.
I did confirm that SMS-send/receive functionality is there and works. No issues on my tests. Also I confirmed my DMZ-forwarding, it still works as expected.
One fact that Sorin mentioned in his comment was, that he experienced lot of dropped connections with Saunalahti-firmware. His experience is that this firmware is more robust.
I'll update here if something surprising appears.
Gary on :
Jari Turkia on :
Petri on :
Then on the internet settings page you need to enable "data roaming" to establish connection to your Finnish operator.
Let's see if this firmware is more stable or is it the Saunalahti/Elisa 4G network which causes the drops in connectivity.
Jari Turkia on :
Daniel on :
Jari Turkia on :
joshua on :
Can somebody post in summary the changelog between C26 SP054 vs. C260 SP055
Thanks! I am using C260 SP055
Jari Turkia on :
Jukka on :
Jari Turkia on :
There I said: "In UMTS-network, the mobile terminal will negotiate a data connection and get the IP-address associated with the connection". So, in order for both of us to get what we want would be an extension to UMTS-spec. That way we could get multiple IP-addresses via single data connection. Until some data wiz comes up with such a change, we're both out of luck. Sorry.
kevo888 on :
Jari Turkia on :
Simon on :
I would also like to have a working SMS function.
I also must have the ability to choose external antenna.
I live in sweden and use a B593u-12 with the provider Tre (3)
Greatful for your answer.
Jari Turkia on :
nGINMU on :
Jari Turkia on :
nGINMU on :
Jari Turkia on :
I'd like to see my Linux with proper interfaces to all the really good stuff. Open source is about being open. Unfortunately, for the big corporations, open source is simply a method of saving on product development costs. What we'd need is Mr. Torvalds flicking his finger to those big corporations.
Also being an open source kind of guy, I completely miss the point on Huawei closing the box in the first place. Now what we know how to hack ourselves into the box, the natural idea is to really see what's in there.
kevo888 on :
Jari Turkia on :
I'm getting something like this on my box:
Wireless Status
1 PLMN: 24412
2 Service Status: Valid services
3 Bandwidth(kHz): 15000
4 Cell ID: 4
5 Signal Strength: 1
6 RSRP(dBm): -127
7 RSRQ(dB): -14
8 Roam: NO
1) PLMN is Public land mobile network for my Telco (DNA Finland Oy).
4) Is the cell ID where my B593 is connected into, however without the LAC-code (Location Area) it is useless for location purposes.
kevo888 on :
Jari Turkia on :
nGINMU on :
When switched into 2G I get
1 PLMN: N/A
2 Service status: Restricted service
3 RSSI (dBm): -67
4 RSRP (dBm): -0
5 RSRQ (dB): -0
6 Roaming: No
When switched into 3G I get
1 PLMN: 23420
2 Service status: Valid service
3 RSCP (dBm): -82
4 ECIO (dB): -6
5 RSSI (dBm): -81
6 Roaming: No
Switch router into LTE I get;
1 PLMN: 23420
2 Service status: Valid service
3 RSSI (dBm): -85
4 RSRP (dBm): -110
5 RSRQ (dB): -16
6 Roaming: No
Not too sure what all these infos are.
I have B593s-22
Hardware version: Ver.B
Firmware version: V200R001B180D15SP00C00
This was bought on eBay as a straight Huawei unit with no telco branding. I'm operating it with a '3 UK' telco simcard.
I used to have a Huawei USB dongle & I noted with that, that there was a heck of a lot could be done with some xml-style config files to get the 'Mobile Partner' PC software it used, to open up additional config options and features. That was on the attached PC though, not the dongle firmware.
I'm pointing directional antennas at distant masts here too
Vlado on :
I had the B593u-12 modem in Slovakia Telefonica with FW which does not support external antennas. Therefore I flashed the new FW you recommended - the V100R001C26SP054.
After flashing, modem still works fine on LTE, but the admin password does not work any more. So I cannot log in nor configure the modem anymore. Have you had similar troubles with the password? I have read your articles about hacking the modem and even have tried to use the steps described here - http://blog.asiantuntijakaveri.fi/2013/08/gaining-root-shell-on-huawei-b593-4g.html, but could not run any simple linux command like "ls-l", or "pwd". I am not sure about the passswords f5338SA1kb4=(CLI) and HoHSyzm0ye4=(WEB) and what you have discovered from the curcfg.xml. In your perl script you use the YWRtaW4=, (because of the result of the encode_base64('admin') ).
I tried all of them, but could not connect. Maybe I am doing something wrong. After trying to connect I just obtained some html script without sense. I am thinking about reseting the modem to factory settings but I am not sure if this reverts the admin password to admin.
Please don't you have any hint? I will repeat all the steps again and carefully, writing down all preconditions and results this is the way I see yet. Could I send it to you then, please?
Thank you very much for your time.
Vlado
Jari Turkia on :
On another article about gaining a prompt (http://blog.hqcodeshop.fi/archives/151-Huawei-B593-Logging-into-shell-Solved!.html), I described the encrypted passwords of f5338SA1kb4= and 2n+mVpCOAaY= representing words "admin" and "user". Your passwords of HoHSyzm0ye4= and YWRtaW4= are unknown to me. Since the passwords are encrypted and currently the algorithm is not known, it is impossible to reverse or brute force them. This may change in the future, but as of now I don't know how they are handled.
Please note, that I did never use a password of YWRtaW4= anywhere. In my perl-script I used a plaintext default password of "admin", which is stored as f5338SA1kb4= in the curcfg.xml.
My only advice for you is to do a factory reset. To my understanding it will reset the admin password back to "admin" and you're back in business. As you may already know, many devices (motherboards, network appliance, etc.) either do a factory reset after firmware upgrade, or instruct the user do do so. Based on that I'm positive it won't hurt your current situation.
Please inform what you chose to do and if it helped. Plenty of people here are anxious to know.
Vlado on :
From more sides I heard about the nice external antenna settings feature provided by the 3.dk FW V100R001C26SP054 to switch from built-in to external antennas and vice versa. Therefore I downloaded it and flashed my modem. After that I was unable to log in as admin/admin any more. Nevertheless modem did work properly (since I had the Auto APN checkbox checked) and before I decided to do some hasty step I started to investigate whether to:
1 - restore the modem to the factory settings (then it sure loses the Auto APN settings and if I did not get my admin password back I would become a loser )
2 - unlock it by the dc-unlocker (which does not help for the admin password, as I have finally learned)
3 - hack it using the procedure described here by Jari and and/or here: http://blog.asiantuntijakaveri.fi/2013/08/gaining-root-shell-on-huawei-b593-4g.html
Jari encouraged me to restore that potential brick and since I have before even called to the hotline to 3.dk and they encouraged me to do that as well so I did it.
Uff, without success. I just lost my settings, neither connection nor the admin password.
Then the last shot to switch it OFF and ON and then --------- BINGOOO!
Everything works fine!
Changed the Data APN field to my provider’s one, the activate the external antennas settings and that’s it!
Experiences with the 3.dk FW:
Good, stable, nice and enabling the external antennas.
@Jari:
Thank you for those lovely pages I strongly booked them. Try to process this nice hacking you described and will post my experience here.
My truly thank you
Vlado
Jari Turkia on :
As I expected, the factory reset will also affect the admin password. Turning the device off and back on is part of the factory reset -procedure.
Vlado on :
BTW is there any possibility to follow particular forums (e.g. to be informed by email when new post is added)?
Thanks
Jari Turkia on :
This is a blog, not a forum. I'd recommend for you to follow the RSS-feed (see the right side of the page) at http://blog.hqcodeshop.fi/feeds/categories/7-Huwei-B593.rss for Huawei-postings.
If you're interested in comments, see http://blog.hqcodeshop.fi/feeds/comments.rss2
There is also one other way of following comments for this single post http://blog.hqcodeshop.fi/rss.php?type=comments&cid=112
I don't know how the last feed could be made public nor why it is hidden by default.
Vlado on :
https://onedrive.live.com/view.aspx?resid=B483589C2FD81F7D!207
Vlado
Jari Turkia on :
As we can see he haven't tested all of the firmwares. I think he will be using his box to provide internet access, like most of us do.
Taranis on :
Jari Turkia on :
Taranis on :
Al_shmlani on :
dayton on :
Can someone tell me why firmware update for my B593s-ss ( from Spain) fail?
I tried to load the universal firmw but results always file check failed, why?
I need TO open the 5060 port !!
B593s-22
Hardware version B
Firmware version V200R001B180D20SP50C314
Jari Turkia on :
I downloaded the rar-archive, but it contains the files from a B593-u12 firmware. Pretty much anybody can access those files from their own box.
In case there is something really nice for us to see, please inform.
Fernando on :
Have you a backup of the fw?. Mine is blocked by Orange. I am looking for VoIp.
BR
Jari Turkia on :
For VoIP, see http://blog.hqcodeshop.fi/archives/215-Huawei-B593-u-12-firmware-spreadsheet.html for information about various firmwares and their features.
Blocked meaning?
Fernando on :
Blocked means (to me) modified by Orange to delete VoIP entry in the menu.
I am looking for a backup of the Orange fw (or the way and directions to do it) and the original Huawei fw for the router.
My model is B593s-22
My Hw version is Version B
My Fw version is V200R001B180D20SP50C314
Thanks for your help
BR
Fernando
Jari Turkia on :
All I can do to help is to re-direct you to my previous comment. Go see, the spreadsheet. There are firmwares which support VoIP. Go download one of them and upgrade to that.
Fernando on :
I saw the spreadsheet but my main fear is how to come back to the original fw.
BR
Fernando
Jari Turkia on :
My own experience is, that once you upgrade, you don't want to go back.
Fernando on :
Any recommendation for my s-22?
Jari Turkia on :
Most stuff in this blog is for u-12, which is the model I have. Generally for s-22 there is only one known working firmware upgrade available and I don't think German Telekom has VoIP. At least their u-12 firmware doesn't.
dayton on :
No 5060!!
No flag on ALG !!
It seems strange but now it works well .
In firewall rules I kept 80 tcp/udp open to ATA ip .
Dayton
Adrian on :
Jari Turkia on :
I'm guessing you upgraded your u-501 with a proper u-501 firmware and now it doesn't work. Have you done a factory-reset to it? It should restore your original firmware.
Adrian on :
Jari Turkia on :
Another thing: if you bricked your router, how can you update the proper firmware?
jafar on :
One thing i would like to know is on previous firmware i had 2G selection but in this i only has now LTE (4G) and WCDMA (3G) is this mean i won't be able to use 2G if 3G and 4G is not available?
Jari Turkia on :
What worries me is, you went for SP054 firmware. What you might consider is getting something newer. See http://blog.hqcodeshop.fi/archives/215-Huawei-B593-u-12-firmware-spreadsheet.html for firmware comparision.
jafar on :
yes i downloaded some other firmwares tried few and i found Polkomtel one best...
thank you for your very helpful webpage its awesome
Jari Turkia on :
jafar on :
due to its limited availability i guess and with locked features i can't find much about b593u-12 on internet... but you has great knowledge about this device please guide me how can i stream videos from storage connected to b593u-12..or if you can redirect me to some tutorial etc that would be much helpful thanks
Jari Turkia on :
Without that, you're pretty much out of luck.
jafar on :
on android using ES file explorer...
my firmware is Zain
Q: any firmware in which VPN is enabled?
Earl on :
PS. I bought my huawei LTE CPE B593u-12 on a independent retailer
Jari Turkia on :
See: https://blog.hqcodeshop.fi/archives/227-u-12-pre-SP100-exploits-in-a-single-tool.html
From SSH-prompt you can see/change your admin password.
Leon on :
Thanks.
Jari Turkia on :
LeePriv08 on :
Peter on :
Thank you
Jari Turkia on :
Depending on your firmware version, there are exploits, and the password is printed in plain-text during boot. To see boot messages you'd need to solder a 1,8 volt RS-232 adapter to the board.
Tomasz on :
Fortunly i try old one ( this original one on the label in beck of the router ) and it works - meybe it help sombody like me too.
philip on :