Modify

Opened 10 years ago

Closed 6 years ago

Last modified 4 years ago

#2711 closed enhancement (invalid)

Huawei E960

Reported by: openwrt@… Owned by: developers
Priority: normal Milestone: Features Paradise
Component: base system Version: Kamikaze trunk
Keywords: Cc: openwrt@…

Description

Hi there!

I got an Huawei E960 Wireless LAN-Router with built-in HSDPA-Modem.
The functionality (control with HTTP) from the router is nice - but surely not that I want.
So i tried an nmap at that device and see, port 23 is open.

So I connected to that port via telnet and after 10 seconds I logged in the device (User/Pass=admin/admin ;-) ).
The next surprise: There is a busybox running on it.

Slow but sure I guess, if there is a possibility to get an openwrt running on that thing.

I attach a file with all the information I could get from the device.

Maybe someone is interested to get that thing running with openwrt.
I would try it but need some help, cause I don't know how to begin.

Attachments (7)

e960 (11.7 KB) - added by openwrt@… 10 years ago.
e960dump.txt (16.0 KB) - added by andrewbevitt@… 10 years ago.
more file dumps from e960 (contains klogd)
e960apart.jpg (256.0 KB) - added by andrewbevitt@… 10 years ago.
e960 component picture
serial.jpg (230.6 KB) - added by andrewbevitt@… 10 years ago.
Serial Headers
info.txt (4.3 KB) - added by andrewbevitt@… 9 years ago.
Hacking the firmware
Mobile Partner.exe (108.0 KB) - added by anonymous 9 years ago.
192_168_2_default.html (784 bytes) - added by anonymous 2 years ago.

Download all attachments as: .zip

Change History (133)

Changed 10 years ago by openwrt@…

comment:1 Changed 10 years ago by florian

BCM5354 is already supported by OpenWrt under both brcm-2.4 and brcm47xx-2.6, and if you have serial headers or reverse engineer the firmware format, you might be able to generate the proper .bin image ready to be flashed.

comment:2 follow-ups: Changed 10 years ago by florian

HSPDA support seems to be compiled in-kernel, could you check wich 3G controller you have in your device ? I am not sure whether it is already supported or not.

comment:3 in reply to: ↑ 2 Changed 10 years ago by openwrt@…

Thanks for your answer.
How can I find out, which 3G-Controller I have in the device.
I don't think, you speak from screwing-work. ;-) But how can I find out, which controller is used? Is nothing the attachment (maybe the '/proc/pci'-Section), to find out something about components?

comment:4 Changed 10 years ago by kaloz

Florian is wrong, we only have preliminary support in 2.6 only. 2.4 lacks support for the 5354 as none of the developers have one and noone submitted patches for it.

Regarding the 3G controller, 'cat /proc/pci' should give some hints, and maybe 'dmesg' as well.

comment:5 Changed 10 years ago by openwrt@…

It would not be quiet easy as I thought. ;-)

The output of the 'cat /proc/pci' is already in the attached file.

Does anyone know, where I can get informations about the product-codes from that output?
eg: Class 0280: PCI device 14e4:4318 (rev 2).

Thanks!

comment:6 Changed 10 years ago by kaloz

  • Cc openwrt@… added

http://pci-ids.ucw.cz/iii/?i=14e44318 ? ;)

Anyways, your lspci translates to:

14e4:0800 - Broadcom Corporation Sentry5 Chipcommon I/O Controller
14e4:4713 - Broadcom Corporation Sentry5 Ethernet Controller
14e4:0816 - Broadcom Corporation BCM3302 Sentry5 MIPS32 CPU
14e4:471a - Broadcom Corporation ?
14e4:471a - Broadcom Corporation ?
14e4:080f - Broadcom Corporation Sentry5 DDR/SDR RAM Controller
14e4:4318 - Broadcom Corporation BCM4318 [AirForce One 54g] 802.11g Wireless LAN Controller
14e4:4719 - Broadcom Corporation BCM47xx/53xx RoboSwitch Core

the 471a units are probably usb.. I guess your hsdp modem is conencted to the usb bus.
Try 'cat /proc/bus/usb/devices'

comment:7 Changed 10 years ago by openwrt@…

There no files in the '/proc/bus/usb'. :-(
Any other ideas where I can find some information?
Thanks!

comment:8 follow-up: Changed 10 years ago by anonymous

dmesg/kmesg?

comment:9 in reply to: ↑ 8 Changed 10 years ago by anonymous

Replying to anonymous:

dmesg/kmesg?

# dmesg
dmesg: not found
# kmesg
kmesg: not found
#

comment:10 Changed 10 years ago by openwrt@…

The system is really very small. Very much functions are not included.
I'm afraid, that the only way to get all information is to flash the system with another image.

comment:11 Changed 10 years ago by tyke@…

Is it possible to do this safely?
It's really anoying that port forwarding is not possible through the webinterface. I tried with the iptables command, without success so far.

comment:12 Changed 10 years ago by openwrt@…

The main problem is to find a way to get original-image out of the box.
If you can dump it successful, you can upload a openwrt-image (Web-Interface) without problems and change it back, if you have troubles.
With the current firmware is port-forwarding nearly impossible. Because you cannot assign an IP-Adress to a MAC-Adress and I also haven't found a way to save the IP-Tables-Config.

comment:13 follow-ups: Changed 10 years ago by anonymous

maybe a unit should be donated to the developers

comment:14 in reply to: ↑ 13 Changed 10 years ago by kaloz

Replying to anonymous:

maybe a unit should be donated to the developers

That would be welcomed of course.

comment:15 Changed 10 years ago by openwrt@…

Good idea - but who can give his device away?
I asked my boss if it's ok, to lend the device the developer-team but he wasn't quiet happy about the idea because before we only had a GPRS-Connection and that only for one computer and he never wants that again. :-/

comment:16 Changed 10 years ago by anonymous

would this image help?
http://www.huawei.com/mobileweb/en/doc/list.do?type=-1&id=2625
E960 UTPS V100R001B002D03SP21C03(Normal) (25421 KB) 01-Nov-2007

comment:17 Changed 10 years ago by openwrt@…

I fear, that the 'drei'-Image is another, which you can download on the Huawei-Homepage. :-/

comment:18 follow-up: Changed 10 years ago by anonymous

I flashed the above image, the webinterface looks as bevore. semms like the provider specific data is stored somewhere else.

comment:19 Changed 10 years ago by anonymous

Good day,
Any update on this issue.

Best regards

comment:20 Changed 10 years ago by johnson.cslee@…

Based on above information, E960 uses Broadcom BCM5354 SoC solution. BCM5354 is single SoC solution, this SoC includes MIPs CPU (it is what BCM47xx/53xx means)+ 802.11g (it is what BCM4318 means) + 4 port switch. As I know, HDSPA diver is not done in Linux 2.4, so HDSPA would drop line after couple minutes. If you someguy is interested for BCM5354 + Huawei HDSPA porting, I can try to get the HW to donate for the develpment. My company is trying to sell such products based on BCM5354 + HDSPA solution in Linux 2.4, that's why I have chance to donate them. ( By the way, Linksys WRH54G sold in China used the same chipset BCM5354. )

comment:21 Changed 10 years ago by kaloz

I would be interested for sure adding support for it.

comment:22 Changed 10 years ago by johnson.cslee@…

Nice to heard you are interested for it. I would check my company for sampling, will keep update for the status here.

comment:23 Changed 10 years ago by openwrt@…

Yap, i'm also very interested for adding support. :-)

comment:24 Changed 10 years ago by johnson.cslee@…

Hi,
I am sorry that I haven't sample any more. I just got information from our RD/Sales team. This project was postponed due to business point, thanks your interested for it.

comment:25 follow-up: Changed 10 years ago by andrewbevitt@…

I was given an E960 last week when swapping 3G providers... frankly it needs a better firmware. I have to reboot each time the ppp connection needs restarting, on demand dialing fixes this, but that only seems to work for LAN machines and not for wireless.

I pulled mine apart to see what was inside since the firmware is limited and I've dumped a few extra files. I'll upload a photo and file dump shortly.

In the photo (I lifted the covers but those photos are worse - had to use camera phone):
A - BCM5453
B - Hynix 32M SDR (I think, couldn't find exact code match)
C - Spansion Flash Memory: S29GL032A

The 3G device seems to be connected via usb device /dev/usb/tts/0 and the logs indicate that the kernel is booted with a serial console option of ttyS0. The yellow circled area is a 16 pin connector that joins the two boards together, I'm hoping it contains a serial port.

I was specifically looking for serial ports. I found no other area where a serial port could be attached (no pins, no holes). As indicated in the klogd dump (bottom of file) there are two serial ports. So out of those 16 pins some must be for the usb 3G device and power coupling the rest ??? Is there an easy way to test for serial port pins?

Changed 10 years ago by andrewbevitt@…

more file dumps from e960 (contains klogd)

Changed 10 years ago by andrewbevitt@…

e960 component picture

comment:26 in reply to: ↑ 2 Changed 10 years ago by andrewbevitt@…

Replying to florian:

HSPDA support seems to be compiled in-kernel, could you check wich 3G controller you have in your device ? I am not sure whether it is already supported or not.

There are QualComm ICs on the board I don't remember exactly which model...

comment:27 in reply to: ↑ 25 ; follow-up: Changed 10 years ago by anonymous

It looks like there are 6 testpoints at the upper left corner of the yellow circle and 3 below the yellow circle.

comment:28 in reply to: ↑ 27 ; follow-up: Changed 10 years ago by andrewbevitt@…

Replying to anonymous:

It looks like there are 6 testpoints at the upper left corner of the yellow circle and 3 below the yellow circle.

Testing the 6 points would require building something to expand the bridge between the two boards.

However I have tested the 3 ports below the yellow circle. I used an LED between each port and ground to test. Going left to right:
1 - ~3.3V LED flashes fast random intervals until bootup complete then on/off every ~0.5s
2 - GND
3 - ~5.25V LED flashes fast random intervals until bootup complete then on/off every ~0.5s

I don't have (easy) access to a serial port at the moment, nor do I have a sufficiently fine soldering tip to connect a RS232-TTL to the E960. I can get a tip and dig an old computer out of the cupboard, but first, does the 1/3 flashing seem like RX/TX pins?

comment:29 in reply to: ↑ 28 Changed 10 years ago by anonymous

Replying to andrewbevitt@gmail.com:

Replying to anonymous:

It looks like there are 6 testpoints at the upper left corner of the yellow circle and 3 below the yellow circle.

Testing the 6 points would require building something to expand the bridge between the two boards.

It's sufficient to solder 6 wires to the points and lead them out between the two boards.

However I have tested the 3 ports below the yellow circle. I used an LED between each port and ground to test. Going left to right:
1 - ~3.3V LED flashes fast random intervals until bootup complete then on/off every ~0.5s
2 - GND
3 - ~5.25V LED flashes fast random intervals until bootup complete then on/off every ~0.5s

I don't have (easy) access to a serial port at the moment, nor do I have a sufficiently fine soldering tip to connect a RS232-TTL to the E960. I can get a tip and dig an old computer out of the cupboard, but first, does the 1/3 flashing seem like RX/TX pins?

Not easy to answer. The RS232 signals are fast, the LED would look like it's always on. However, the flashes could be some data bursts. I consider taking my own e960 apart and analyze these pins with the oscilloscope.
What would it help if we find the RS232 interface? Is it then possible to flash OpenWRT?

comment:30 Changed 10 years ago by andrewbevitt@…

Soldering those 6 wires is still going to be difficult unless you have a super fine tip. If we can get a serial console going, theoretically, we could use CFE to flash a new image... or at least I think we can.

http://wiki.openwrt.org/OpenWrtDocs/Installing/CFE

Someone with some more knowledge on this subject might know.

comment:31 in reply to: ↑ description ; follow-up: Changed 10 years ago by drahdiwaberl@…

another vote for this box to get hacked! 8) the interface (running on asp!) really sucks and functionality definitly is limited.. but at the price of nearly 300euros i payed i can't really risk to brick it ;(

so hope someone will come up with a solution also a less linux-savvy guy like me can use..

comment:32 in reply to: ↑ 18 Changed 10 years ago by anonymous

Replying to anonymous:

I flashed the above image, the webinterface looks as bevore. semms like the provider specific data is stored somewhere else.

might it be saved in the flash-memory? - the drive containing the windows-drivers when one connects it to a computer via usb?.. no time to have a closer look right now, but just an idea..

comment:33 in reply to: ↑ 31 Changed 10 years ago by andrewbevitt@…

Replying to drahdiwaberl@gmail.com:

the interface (running on asp!) really sucks

For what it's worth, the interface isn't actually running asp. It's a set of custom (C from memory) applications that listen and respond to the HTTP requests; serving up pages and responding to actions appropriately.

My device is actually leased on a contract which obliges me to return the device when I no longer wish to keep my account with the provider. So basically I can't flash mine, unless the original firmware can be re-applied. But more importantly, I can't make the necessary hardware modifications to the board to connect a serial port.

comment:34 Changed 10 years ago by anonymous

Any Update?

Regards

Changed 10 years ago by andrewbevitt@…

Serial Headers

comment:35 follow-up: Changed 10 years ago by andrewbevitt@…

Ok I had a little time to poke around and spotted the above four pcb mounts. There is a 3.3v relative to GND (and a GND) pin, which suggests, along with the nice location of the mounts; that this was a serial port at some point.

Unfortunately I think they've cut the pcb tracks to Tx/Rx. I built a MAX232 converted and soldered on some cables and got nothing. I tried the buzzer idea too with no success.

comment:36 Changed 10 years ago by threegee

Here's something you can do with the E960 in case you're not happy using it as a router....you can use it as a USB modem and use an even better router!

http://www.youtube.com/watch?v=PVweU8m0Hps

Found the box here: www.dovado.com/umr

comment:37 Changed 10 years ago by anonymous

There's a new Firmware which now includes Port Forwarding! At least for the Austrian Provider Hutchinson 3G. It can be obtained through their website www.drei.at under service downloads!

comment:38 Changed 10 years ago by anonymous

There's a new Firmware which now includes Port Forwarding! At least for the Austrian Provider Hutchinson 3G. It can be obtained through their website www.drei.at under service downloads!

hello i need to ask about this firmware its possible to work in other operator if i upgrade my huawei e960

comment:39 Changed 10 years ago by anonymous

No it is not possible. The firmware update software I downloaded from drei.at (http://www.drei.at/portal/de/privat/service/servicedownloads/DMS_-_Entries_200240.html) complaints about that it is not a recognised device. I have bought my device in Sweden.

Workarounds, or better solutions anyone?

Changed 9 years ago by andrewbevitt@…

Hacking the firmware

comment:40 follow-up: Changed 9 years ago by andrewbevitt@…

I've spent a few days going through the firmware and trying to put together a cross compile toolchain. Have a look at info.txt (attached above); it has all my notes etc... about the firmware structure.

I would like to test some simple application before rebuilding the firmware with other software; just to make sure the toolchain works etc.. however I can NOT get a working cross compile toolchain. If you have a toolchain that will work build a simple (see below) c program and send it to me I'm happy to test; or if you have some instructions that would be great!!!

int main(void) { return 0; }

If that can be executed on the E960 then I'll be willing to try and build a new firmware image.

Changed 9 years ago by anonymous

comment:41 Changed 9 years ago by skizzo3000

http://www.huawei.com/mobileweb/en/doc/list.do?type=-1&id=2625

here is empty !!!

Where can i download original e960 firmware ?

Thanks Sk3

comment:42 Changed 9 years ago by anonymous

Is Huawei keeping up with their GPL obligations? Has anyone got a copy of the GPL code used in the E960?

comment:43 in reply to: ↑ 40 Changed 9 years ago by anonymous

Replying to andrewbevitt@gmail.com:

I've spent a few days going through the firmware and trying to put together a cross compile toolchain. Have a look at info.txt (attached above); it has all my notes etc... about the firmware structure.

I would like to test some simple application before rebuilding the firmware with other software; just to make sure the toolchain works etc.. however I can NOT get a working cross compile toolchain. If you have a toolchain that will work build a simple (see below) c program and send it to me I'm happy to test; or if you have some instructions that would be great!!!

int main(void) { return 0; }

If that can be executed on the E960 then I'll be willing to try and build a new firmware image.

anyone been successful in doing this?

comment:44 in reply to: ↑ 13 Changed 9 years ago by anonymous

Replying to anonymous:

maybe a unit should be donated to the developers

byeeeee

comment:46 Changed 9 years ago by Lars

The code of the rar file is:Huawei-source-for-T-Mobile-B970 in above link

comment:47 follow-up: Changed 9 years ago by anonymous

uhm, Huawei-source-for-T-Mobile-B970.rar is password protected(;

comment:48 in reply to: ↑ 47 Changed 9 years ago by anonymous

Replying to anonymous:

uhm, Huawei-source-for-T-Mobile-B970.rar is password protected(;

password is "Huawei-source-for-T-Mobile-B970"

comment:49 Changed 9 years ago by nos_com71

i m willing to upgrade my box. even it is damaged but i m totally do not which version to use and how to update! someone to make step by step how it is done.

comment:50 follow-up: Changed 9 years ago by zandbelt

it is indeed possible to build (partially working) E960 firmware from the sources linked above; below you can find a pseudo command sequence to do so; the new image runs telnetd, so commandline access is enabled; work is still needed on the web interface and the modem driver

mkdir <dir>
cd <dir>
tar zxvf ../archive/TOOL_2004_03_31.tgz
sudo mkdir /opt
sudo cp -ar tools/brcm /opt
tar zxvf ../archive/linux-open-router-4.131.25.0.tar.gz
rar x ../archive/Huawei-source-for-T-Mobile-B970.rar
<passwd> Huawei-source-for-T-Mobile-B970
[A]
cp -ar Huawei-source-for-T-Mobile-B970/* .
rm -rf Huawei-source-for-T-Mobile-B970
patch -p0 < ../archive/mconf.patch
patch -p0 < ../archive/Makefile.patch
chmod a+x src/router/misc/rootprep.sh
chmod a+x tools/trx_new
export PATH=$PATH:/opt/brcm/hndtools-mipsel-linux/bin:/opt/brcm/hndtools-mipsel-uclibc/bin:<dir>/tools
cd src
make

comment:51 in reply to: ↑ 50 Changed 9 years ago by anonymous

Replying to zandbelt:

it is indeed possible to build (partially working) E960 firmware from the sources linked above; below you can find a pseudo command sequence to do so; the new image runs telnetd, so commandline access is enabled; work is still needed on the web interface and the modem driver

mkdir <dir>
cd <dir>
tar zxvf ../archive/TOOL_2004_03_31.tgz
sudo mkdir /opt
sudo cp -ar tools/brcm /opt
tar zxvf ../archive/linux-open-router-4.131.25.0.tar.gz
rar x ../archive/Huawei-source-for-T-Mobile-B970.rar
<passwd> Huawei-source-for-T-Mobile-B970
[A]
cp -ar Huawei-source-for-T-Mobile-B970/* .
rm -rf Huawei-source-for-T-Mobile-B970
patch -p0 < ../archive/mconf.patch
patch -p0 < ../archive/Makefile.patch
chmod a+x src/router/misc/rootprep.sh
chmod a+x tools/trx_new
export PATH=$PATH:/opt/brcm/hndtools-mipsel-linux/bin:/opt/brcm/hndtools-mipsel-uclibc/bin:<dir>/tools
cd src
make

Thats awesome. Any new progress?

comment:52 Changed 8 years ago by ....LOL?

Did any1 get to portforward yet lol?

comment:53 follow-up: Changed 8 years ago by Guido

I can confirm to have build something that looks like a firmware.

My E960 device (branded for Telkom South Africa) gave this nasty looking error: "Parsing error on the name of the uploaded file" when pressing the button. It's an artifical javascript error designed to avoid flashing.

I bypassed it by making this tagsoup.html file:

<form method="post" action="http://10.0.0.1/en/upgrade.cgi" enctype="multipart/form-data">
  <input type="hidden" name="page" value="firmware.asp">
  <input type="file" name="file">
  <input type="submit" value="Upload new Firmware">
</form>

After a minute I got this message in my browser: Upgrading succeeded. The gateway is restarting.

The upload succeeded, and it was bricked. :-(

But not completely. It shows all normal signs of life (signal strength indicator green when it has the sim-card, fast blinking red when I remove the card).

The network interfaces are gone, no WLAN and it blinks the ethernet leds in a steady 1 second on, one second off rhythm. No response to pings.

How can I get access to the CFE to try again?

comment:54 Changed 8 years ago by Flo

Until here same way on the B970/E970 from Huawei

I own an web-n-walk-box-4 from t-mobile germany.
After reading about Telnet access to the box i was surprised cause on my box port 23 is closed.

trying to find Firmware... nothing... trying more...

finally found http://www.mtn.co.za/Support/DeviceDownloads/Documents/B970-South%20Africa-MTN-TA%20version-20080811.zip from MTN South Africa.

There are several images in that package.
First try (im a lucky bastard) WLAGAPM11002_APP.BIN uploaded to the box, using little html workaround from Guido, rebooting... *bing* new web interface and telnet access.

Taking apart the WLAGAPM11002_APP.BIN works aswell just as described in "info.txt"

Now i would like to stick some more software onto that thing... lets see.

Until now this wiki has helped me more than 2 weeks of google :-) thanks guys good work.

Im still waiting for my local isp to give me some cables, thats why i still need this WCDMA Box, but as soon as ive got a decent DSL connection ill send this box over to you if someone wants to do some porting.

Here comes more informations from the box.

# cat /proc/cpuinfo 
system type             : Broadcom BCM5354 chip rev 3
processor               : 0
cpu model               : BCM3302 V2.9
BogoMIPS                : 237.56
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available
unaligned_instructions  : 0
dcache hits             : 0
dcache misses           : 0
icache hits             : 0
icache misses           : 0
instructions            : 0

# cat /proc/pci 
PCI devices found:
  Bus  0, device   0, function  0:
    Class 0501: PCI device 14e4:0800 (rev 3).
      IRQ 3.
      Non-prefetchable 32 bit memory at 0x18000000 [0x18000fff].
      Non-prefetchable 32 bit memory at 0x1fc00000 [0x1fffffff].
      Non-prefetchable 32 bit memory at 0x1c000000 [0x1dffffff].
      Non-prefetchable 32 bit memory at 0x1a000000 [0x1bffffff].
  Bus  0, device   1, function  0:
    Class 0200: PCI device 14e4:4713 (rev 3).
      IRQ 4.
      Non-prefetchable 32 bit memory at 0x18001000 [0x18001fff].
  Bus  0, device   2, function  0:
    Class 0b30: PCI device 14e4:0816 (rev 3).
      IRQ 5.
      Non-prefetchable 32 bit memory at 0x18002000 [0x18002fff].
  Bus  0, device   3, function  0:
    Class 0c03: PCI device 14e4:471a (rev 3).
      IRQ 6.
      Non-prefetchable 32 bit memory at 0x18003000 [0x180031ff].
  Bus  0, device   3, function  1:
    Class 0c03: PCI device 14e4:471a (rev 3).
      IRQ 6.
      Non-prefetchable 32 bit memory at 0x18003800 [0x180038ff].
  Bus  0, device   4, function  0:
    Class 0500: PCI device 14e4:080f (rev 3).
      IRQ 3.
      Non-prefetchable 32 bit memory at 0x18004000 [0x18004fff].
      Non-prefetchable 32 bit memory at 0x0 [0x7ffffff].
      Non-prefetchable 32 bit memory at 0x10000000 [0x17ffffff].
      Non-prefetchable 32 bit memory at 0x80000000 [0x9fffffff].
  Bus  0, device   5, function  0:
    Class 0280: PCI device 14e4:4318 (rev 3).
      IRQ 13.
      Non-prefetchable 32 bit memory at 0x18005000 [0x18005fff].
  Bus  0, device   6, function  0:
    Class 0280: PCI device 14e4:4719 (rev 3).
      IRQ 3.
      Non-prefetchable 32 bit memory at 0x18006000 [0x18006fff].

# cat /proc/version 
Linux version 2.4.20 (x127667@old_server.com) (gcc version 3.2.3 with Broadcom modifications) #1 �� 7�� 31 12:15:39 CST 2008

# mount
rootfs on / type rootfs (rw)
/dev/root on / type cramfs (ro)
none on /dev type devfs (rw)
proc on /proc type proc (rw)
ramfs on /tmp type ramfs (rw)
/dev/mtdblock/3 on /tmp/var/custom type cramfs (ro)

# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00040000 00010000 "cfe"
mtd1: 00340000 00010000 "linux"
mtd2: 00281f40 00010000 "rootfs"
mtd3: 00060000 00010000 "resource"
mtd4: 00010000 00010000 "factory"
mtd5: 00010000 00002000 "nvram"

comment:55 follow-up: Changed 8 years ago by eb@…

OK, so having owned a B970 for a couple of months, I must say am happy with it, the firmware is pretty cool and heavily customizable. Apart from some really geeky functions like over-clocking and data-rate graphs, i have failed to find seriously major differences between the stock huawei firmware's web UI and dd-wrt's UI. I'm doing WDS between th eb970 and a linksys wrt54gsv7. If anyone needs advanced functionality from the b970, look for latest firmware from huawei.

comment:56 Changed 8 years ago by parasect

eb@… where did you find that link to the latest firmware?

Thanks!

comment:57 follow-up: Changed 8 years ago by fox

I'd like to know where to get the latest firmware as well. It's not even on their official site.

comment:58 in reply to: ↑ 57 Changed 8 years ago by islamsamy@…

i have the firmware upgrade software for the e960 if someone is interrested in it .

it upgrades to 246.11.07.02.109

comment:59 follow-ups: Changed 8 years ago by axylum

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

comment:60 in reply to: ↑ 59 ; follow-up: Changed 8 years ago by databin <databin@…>

Great stuff axylum!
would you please mail it to me?
thx!

comment:61 Changed 8 years ago by islamsamy@…

Nice axylum. I need that firmware too. Would u send it to me
islamsamy@…
Or upload it somewhere and give me the link
thx

comment:62 in reply to: ↑ 59 ; follow-up: Changed 8 years ago by siggilong@…

Hi, I would highly appreciate you sending me this file also.

thanks!

Replying to axylum:

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

comment:63 Changed 8 years ago by spudz76

  • Milestone changed from Kamikaze to Kamikaze Features Paradize
  • Type changed from task to enhancement
  • Version set to Kamikaze trunk

[patchteam] Bouncing to features/enhancements, but leaving open, as it seems no hardware has met up with any equipped platform maintainer yet there is still recent interest.

comment:64 in reply to: ↑ 59 Changed 8 years ago by hru@…

Replying to axylum:
I would like this version in my e960
How can I get it....

comment:65 Changed 8 years ago by jeffrey.gascon@…

axylum please email me the firmware upgrade. thanks!

comment:66 Changed 8 years ago by jan.ritonnale@…

Hallo, axylum i would be very happy if you would send that firmware also to me.
thanks!

comment:67 in reply to: ↑ 59 Changed 8 years ago by jan.ritonnale@…

Would be great if you could send that B970 files to me!

comment:68 Changed 8 years ago by funsun@…

Would be great if you could send that B970 files also to me!
Thx!!!

comment:69 Changed 8 years ago by fab

Is there dyndns support for this box?

comment:70 in reply to: ↑ 62 Changed 8 years ago by =CråckHeåd=

Replying to siggilong@…:

Hi, I would highly appreciate you sending me this file also.

thanks!

Replying to axylum:

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Yes that would be awesome.. Please forward the link.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

Dude PLZ.... :-) I would like to test it...
Could you pass it PLZ?

comment:71 Changed 8 years ago by djheaton@…

B970 please, been waiting for this for ages... thanks

comment:72 follow-up: Changed 8 years ago by andyw@…

Axylum Could you also maul the file to me ... Great stuff

comment:73 in reply to: ↑ 59 Changed 8 years ago by khunjj@…

Replying to axylum:

axylum, please give it to me too. Thanks,

comment:74 Changed 8 years ago by smcgarry@…

Replying to axylum:

Can you please mail me a copy of the firmware upgrade. Thanks,

comment:75 Changed 8 years ago by vecherkin_dv@…

how is reset password in web interface from console? I forgot password and can not reset in defaul settings E960. Please help.

comment:76 follow-ups: Changed 8 years ago by ipmaks2@…

You can telnet to you box with admin/admin
After that you can find your password for WEB like this:

nvram show | grep pass

user_passwd=user
admin_passwd=admin

comment:77 Changed 8 years ago by adnan_235@…

axylum Can you please help me

plese mail a copy of the upgrade firmware

thanks a lot in advance

comment:78 Changed 8 years ago by adnan_235@…

axylum Can you please help me

plese mail a copy of the upgrade firmware
adnan_235@…

thanks a lot in advance

comment:79 follow-up: Changed 8 years ago by islamsamy@…

If anyone got the firmware from axylum please tell me
please send to islamsamy@…

comment:80 in reply to: ↑ 55 Changed 8 years ago by getnix@…

Replying to eb@…:

OK, so having owned a B970 for a couple of months, I must say am happy with it, the firmware is pretty cool and heavily customizable. Apart from some really geeky functions like over-clocking and data-rate graphs, i have failed to find seriously major differences between the stock huawei firmware's web UI and dd-wrt's UI. I'm doing WDS between th eb970 and a linksys wrt54gsv7. If anyone needs advanced functionality from the b970, look for latest firmware from huawei.

Could you please mail me the B970 firmware?
Many Thanks!

comment:81 Changed 8 years ago by Hassan

Hi,

After "half-bricking" my E960 I was forced to find a firmware update. My own operator didn't have one, and they were actually the cause of the bricking. My router was only showing an "Update Firmware Page", after using wrong firmware, which was meant for D100.

Anyway, after searching half of the net, I found out that Optus is providing an upgrade, however they do a full upgrade of more than just the firmware, I think they update the bootloader and some other stuff too.

The upgrade can downloaded from here:

http://help.optuszoo.com.au/img/cms/zoohelp/connected/e960_upgrade_246.11.04.07.116_20080526.zip

I extracted the file and ONLY USED the:

WLAGCPO11011_APP.BIN

I didn't use the attached exe file but used the routers webinterface to upgrade.

Obviously I had to set my LAN to a static ip (192.168.1.100) and the routers ip was (192.168.1.1).

It's working fine perfectly fine now :)

comment:82 Changed 8 years ago by anonymous

Wanted to add a static route but the web interface forces the destination IP to end in .0

So I just telnet to the device and then type 'nvram show'. This allows you to change some of those settings using nvram set. Solved all my problems!

comment:83 Changed 8 years ago by Kaballasx@…

axylum I would appreciate if you could mail me the firmware please. I have been struggling with my E960, damn thing drop connection every 10 min. I am going out of my mind with frustration, Service providers say they cant help... So if you could please. I would very much appreciate it.

comment:84 follow-up: Changed 8 years ago by anonymous

Hi, I have a e968. I has telnetd enable. Do you think its possible to have a script executed after starup? rc_startup dosn't work at all.

Thanks in advance.

comment:85 Changed 8 years ago by islamsamy@…

Hassan

Did you get any new features like port forwarding in the image from optus u used to upgrade ?

I noticed from the txt file included that this firmware is for STC , im not on STC im on mobily , so will it be locked to STC only ??

comment:86 Changed 8 years ago by florian

Guys! At some point we need to converge, so either you continue doing your own stuff on your side with binary firmwares and such, or you submit patches to add support for this router in OpenWrt.

comment:87 in reply to: ↑ 59 ; follow-up: Changed 7 years ago by terabol@…

Replying to axylum:

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

Hi axylum,

can you send me the firmware for E960, thanks.

comment:88 in reply to: ↑ 79 Changed 7 years ago by axylum

Replying to islamsamy@…:

If anyone got the firmware from axylum please tell me
please send to islamsamy@…

Yep.Finally i posted these files.....

let's see what happens..

comment:89 in reply to: ↑ 60 Changed 7 years ago by anonymous

Replying to databin <databin@…>:

Great stuff axylum!
would you please mail it to me?
thx!

Yes unfortunately it's foreign language.

Still it's maybe valuable files to any skilled person. Im not such person.
But still I help what I can.

comment:90 in reply to: ↑ 72 Changed 7 years ago by anonymous

Replying to andyw@…:

Axylum Could you also maul the file to me ... Great stuff

I can .

but I dont have you address...

comment:91 in reply to: ↑ 87 ; follow-up: Changed 7 years ago by anonymous

Replying to terabol@…:

Replying to axylum:

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

Hi axylum,

can you send me the firmware for E960, thanks.

I dont have your address.

comment:92 in reply to: ↑ 91 ; follow-up: Changed 7 years ago by anonymous

Replying to anonymous:

Replying to terabol@…:

Replying to axylum:

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

Hi axylum,

can you send me the firmware for E960, thanks.

I dont have your address.

you can send the firmware to : terabol@…, thanks.

comment:93 in reply to: ↑ 92 ; follow-up: Changed 7 years ago by terabol@…

Replying to anonymous:

Replying to anonymous:

Replying to terabol@…:

Replying to axylum:

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

Hi axylum,

can you send me the firmware for E960, thanks.

I dont have your address.

you can send the firmware to : terabol@…, thanks.

sorry perhaps you cannot see the email, my email is : terabol@ gmail.com

comment:94 in reply to: ↑ 93 Changed 7 years ago by Kaballasx

Replying to terabol@…:

Replying to anonymous:

Replying to anonymous:

Replying to terabol@…:

Replying to axylum:

I have this kind and have also portforwarding and all bells and whistles.
just ask if u want.

Boot Loader Version:
246.11.16.02.113

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.16.02.113
Release At:
Jul 2 2008 07:38:46

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.00.11.110

Hi axylum,

can you send me the firmware for E960, thanks.

I dont have your address.

you can send the firmware to : terabol@…, thanks.

sorry perhaps you cannot see the email, my email is : terabol@ gmail.com

Hi axylum,
Please if you do not find it to troublesome can you email me the firmware of E960 aswel. Kaballasx@ gmail.com

Thanks in advance.

comment:95 Changed 7 years ago by anonymous

there is any new??????

comment:96 follow-up: Changed 7 years ago by centurion79b@…

Axylum please e-mail me the upgraded firmware for my e960.

comment:97 in reply to: ↑ 96 Changed 7 years ago by anonymous

Replying to centurion79b@…:

Axylum please e-mail me the upgraded firmware for my e960.

centurion79b@…

comment:98 Changed 7 years ago by anonymous

Axylum
please send me
mazen_skystar@ hotma1l.com

thx

comment:99 Changed 7 years ago by anonymous

Version
Boot Loader Version:
726.11.47.02.103

Router Hardware Version:
WLA1GCPU
Router Software Version:
726.11.47.02.103
Release At:
Jul 28 2009 23:21:59

Modem Hardware Version:
WLA1TIZU
Modem Software Version:
726.11.47.02.104

comment:100 in reply to: ↑ 59 Changed 7 years ago by anonymous

Hi Axylum,

in great need for the port forwarding firmware for my E960. Could you send it to janni007@… ? Highly appreciated.

Cheer
Jan

comment:101 in reply to: ↑ 76 Changed 7 years ago by g4sbd@…

BEST SOLUTION..........

Replying to ipmaks2@…:

You can telnet to you box with admin/admin
After that you can find your password for WEB like this:

nvram show | grep pass

user_passwd=user
admin_passwd=admin

comment:102 Changed 7 years ago by g4sbd@…

Hello,

Please help me !!!

I have a router (VOIP router) brand= InterEdge, Model ITA200.
I have only lan and wan screen. No control screen. Master account is blocked
I can do Telnet or hyperTerminal.

Please help me how can I grab master account ??

g4sbd@…

comment:103 Changed 7 years ago by florian

Guys! You stop that immediately. Like I said earlier, either you start your own OpenWrt fork for the E960, or you contribute your patches to OpenWrt and we finally close this ticket.

comment:104 Changed 7 years ago by vbcc@…

I have a newer version of the E960, but I still have problems with port mapping

Boot Loader Version:
246.11.89.02.113sp01

Router Hardware Version:
WLA1GCPU
Router Software Version:
246.11.89.02.113sp01
Release At:
Sep 25 2008 17:36:50

Modem Hardware Version:
WLB1TCPU
Modem Software Version:
246.11.89.02.117

Is there anyone that could guide me trough the mapping

comment:105 Changed 7 years ago by sajj4u@…

hi expert guys i am looking unlock for this device b970 can nayone tell me how to do.i tried all the possible ways those avaiable at net. now i need you guys to sort out this issue. thanks in advance..
regards
sajid

comment:106 Changed 7 years ago by florian

  • Resolution set to invalid
  • Status changed from new to closed

OpenWrt's trac is not a place for an E960 community! Start your own thread on the forum and get patches posted to the OpenWrt mailing to support this device!

comment:107 Changed 7 years ago by sirwinb@…

help with B970 need 3G Gateway Update software image file for web updates
I have a Huawei B970 wifi router and the web interface keeps asking for the firmware for this as the the only way I can connect to this device is through a web page. This is what is displayed. I contacted my ISP Etisalat Egypt and they tell me they do not have updated software image file that would work through the web interface download, so I hope you can help me out so that I can reset back to factory default and then upgrade using ISP's executable update program from the laptop.
Had to Manual congig IP addr on PC 192.168.1.20
from browser i typed http://192.168.1.1/

3G Gateway Update Software

Step 1: Obtain an updated software image file from your ISP.

Step 2: Enter the path to the image file location in the box below or click the "Browse" button to locate the image file.

Step 3: Click the "Update Software" button once to upload the new image file.

NOTE: The update process takes about 2 minutes to complete, and your Gateway will reboot.

regards

comment:108 Changed 7 years ago by motia_tenteng@…

Guys,
How can I know the modem speed I'm running from the command line interface of the E960. Can I have the full command and syntax list? I'm using a version;
Version Boot Loader Version: 246.11.108.03.114sp01

Router Hardware Version: WLA1GCPU
Router Software Version: 246.11.108.03.114sp01
Release At: Nov 18 2008 21:28:51

Modem Hardware Version: WLB1TCPU
Modem Software Version: 246.11.00.18.117

Motia.

comment:109 Changed 7 years ago by anonymous

can you help me guys, i cannot change my pasword of my e960, if i will do this advance settings>device advance settings>update password>current password,new password, confirm password= the result is
This page prompts you the errors in the process of modifying the settings of the gateway.
Changing password...Wrong password.
Wait for three seconds, and then click Continue, or you can refresh this page.

i enter the right password so many times same result, help me guys to solve this problem....

thanks in advance

regards

dhan

comment:110 follow-up: Changed 7 years ago by anonymous

i am new at this stuff. how does one telnet?
i just got a huawei e960 wireless gateway router from an service provider (Zain)
i changed the admin password but later on forgot it. can anyone help?
i saw this:
nvram show | grep pass

user_passwd=user
admin_passwd=admin

but i do not know how to telnet
pls help.

comment:111 in reply to: ↑ 110 Changed 7 years ago by anonymous

Replying to anonymous:

i am new at this stuff. how does one telnet?
i just got a huawei e960 wireless gateway router from an service provider (Zain in Ghana)
i changed the admin password but later on forgot it. can anyone help?
i saw this:
nvram show | grep pass

user_passwd=user
admin_passwd=admin

but i do not know how to telnet
pls help.

my email is atsuawa@…

comment:112 in reply to: ↑ 76 Changed 7 years ago by anonymous

Replying to ipmaks2@…:

You can telnet to you box with admin/admin
After that you can find your password for WEB like this:

nvram show | grep pass

user_passwd=user
admin_passwd=admin

pls how does one telnet

comment:113 Changed 7 years ago by anonymous

OpenWrt's trac is not a place for an E960 community! Start your own thread on the forum and get patches posted to the OpenWrt mailing to support this device!

This is getting annoying, so please guys have a little respect for the people watching tickets.

comment:114 Changed 7 years ago by kafaman1@…

i have a e960 and i updated it.. after the update it's only the 3G modem which is working.. the wifi led doesn't show and when i connect it with the ethernet port with the lan cable it doesn't connect to my pc.. Am very worried and don't know what to do please help me GUYS... please..

comment:115 Changed 7 years ago by anonymous

  • Resolution invalid deleted
  • Status changed from closed to reopened

e960 wlan not working after upgrading... it don't connect to lan either and the wifi led don't blink, it's off.. please help me to solve this problem..

comment:116 Changed 6 years ago by jow

  • Resolution set to invalid
  • Status changed from reopened to closed

comment:117 in reply to: ↑ 84 Changed 6 years ago by anonymous

  • Resolution invalid deleted
  • Status changed from closed to reopened

Replying to anonymous:

Hi, I have a e968. I has telnetd enable. Do you think its possible to have a script executed after starup? rc_startup dosn't work at all.

Thanks in advance.

Hi I also need the E968 firmware upgrade, can you share???? please send it to dprintsgg@… thanks in advance

comment:118 Changed 6 years ago by florian

  • Resolution set to invalid
  • Status changed from reopened to closed

The next person re-opening this ticket for support or firmware sharing will be banned, I am getting seriously tired of you guys using a bug tracker as a forum.

comment:119 Changed 6 years ago by anonymous

  • Resolution invalid deleted
  • Status changed from closed to reopened

comment:120 Changed 6 years ago by nbd

  • Resolution set to invalid
  • Status changed from reopened to closed

seriously?

comment:121 Changed 6 years ago by anonymous

Hi Great info here, however I am really struggling to build the firmware form the huawei source file stated above. Also I have been able to reverse the firmware with firmware tools and recreate the bin files, but the router rejects the files. I there a straight wrt version for this device now that has wcdma, wlan, lan and usb support? Sorry for posting again in this ticket, but have completely run out of ideas, cant even mount / filesystem as rw says access denied.

comment:122 in reply to: ↑ 53 Changed 6 years ago by anonymous

Replying to Guido:

I can confirm to have build something that looks like a firmware.

My E960 device (branded for Telkom South Africa) gave this nasty looking error: "Parsing error on the name of the uploaded file" when pressing the button. It's an artifical javascript error designed to avoid flashing.

I bypassed it by making this tagsoup.html file:

<form method="post" action="http://10.0.0.1/en/upgrade.cgi" enctype="multipart/form-data">
  <input type="hidden" name="page" value="firmware.asp">
  <input type="file" name="file">
  <input type="submit" value="Upload new Firmware">
</form>

After a minute I got this message in my browser: Upgrading succeeded. The gateway is restarting.

The upload succeeded, and it was bricked. :-(

But not completely. It shows all normal signs of life (signal strength indicator green when it has the sim-card, fast blinking red when I remove the card).

The network interfaces are gone, no WLAN and it blinks the ethernet leds in a steady 1 second on, one second off rhythm. No response to pings.

How can I get access to the CFE to try again?

how to make this tagsoup.html file ? mine half bricked.I m stuck in this point.

comment:123 in reply to: ↑ 35 Changed 5 years ago by anonymous

Replying to andrewbevitt@…:

Ok I had a little time to poke around and spotted the above four pcb mounts. There is a 3.3v relative to GND (and a GND) pin, which suggests, along with the nice location of the mounts; that this was a serial port at some point.

Unfortunately I think they've cut the pcb tracks to Tx/Rx. I built a MAX232 converted and soldered on some cables and got nothing. I tried the buzzer idea too with no success.

The pcb mounts shown in the picture are not the serial port. These four mounts are intended for the reset switch. This is populated on my B970b router.

The serial ports should be on the other side of this pcb (4 round, golden test points surrounded by white colored rings).
There should also be an unpopulated JTAG header 2x5.

comment:124 Changed 5 years ago by umarmahmood94@…

i want to start my sim zain or stc on mobily modem huawei model b660 imei :353361040682121 i want the crack or some thing to play my sims on mobily modem plzzz help

comment:125 Changed 4 years ago by anonymous

i managed to reset my huawei e960 wireless router alright but i tried connecting to it and im being asked for a network security key.. can someone please help me with that

comment:126 Changed 4 years ago by Mateusz

Hi, can someone send me newest firmware for this gateway ;P m@… thx.

Changed 2 years ago by anonymous

Add Comment

Modify Ticket

Action
as closed .
The resolution will be deleted. Next status will be 'reopened'.
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.