Huawei 1550 modem

[rhn_journal]

Recently I decided to give mobile Internet a try. I had an old Three UK branded Huawei E1550 modem laying around, which seemed perfect for my Heyah SIM card.

The modem

The modem has the Three logo printed on the top side, but apart from that, it looks like the regular Huawei E1550 modem. The device is mode switching, meaning it pretends to be a storage device at first, but after it receives a special command, it switches to the actual modem mode.

lspci output in modem mode:

Bus 003 Device 060: ID 12d1:1001 Huawei Technologies Co., Ltd. E169/E620/E800 HSDPA Modem

Unlocking

When I tried to use the modem with ModemManager GUI, it showed error messages in some sections (e.g. SMS) or, in the "Info" section, it showed a lot of blanks. It turned out that the modem was locked to the Three UK network and needed unlocking to work with my SIM.

There are plenty of unlock tutorials online, but no two of them offer the same solution. Some require the user to update firmware, some need unlock codes. Even worse, no tutorial covered Linux.

The unlock is very simple, it takes only 3 steps: 1. Find out your IMEI number 2. Derive your unlock code from the IMEI 3. Start the HUAWEI connection manager with an unauthorized SIM and enter the unlock code.

Unfortunately, all software I could find was Windows only. * For IMEI detection: E155XUpdate_11.608.13.02.00.B418.exe * For unlock code: Universal MasterCode * The connection manager: Mobile Partner's 11.302.09.01.539 Voice USSD

I managed to find the unlock code algorithm in php:

if (isset($_POST['submit']))
{
    $IMEI = $_POST['imeinum'];
    $MD5U = md5($IMEI.'5e8dd316726b0335');
    $MD5F = md5($IMEI.'97b7bc6be525ab44');
    $vector = 0;

    /* $MD5 for Unlock Code in 16 8-bit digits */
    $UNLOCK_CODE = '';
    $FLASH_CODE = '';
    for ($i = 0; $i < 8; $i=$i+2) 
   { 
       $DGU = hexdec(substr($MD5U, $i,2)) ^ 
                     hexdec(substr($MD5U, $i+8,2)) ^ 
                     hexdec(substr($MD5U, $i+16,2)) ^ 
                     hexdec(substr($MD5U, $i+24,2)); 
       $DGF = hexdec(substr($MD5F, $i,2)) ^ 
                     hexdec(substr($MD5F, $i+8,2)) ^ 
                     hexdec(substr($MD5F, $i+16,2)) ^ 
                     hexdec(substr($MD5F, $i+24,2)); 

       $UBYTE = str_pad(dechex($DGU),2,"0",STR_PAD_LEFT); $FBYTE =    str_pad(dechex($DGF),2,"0",STR_PAD_LEFT); 

      $UNLOCK_CODE = $UNLOCK_CODE.$UBYTE; $FLASH_CODE = $FLASH_CODE.$FBYTE; 
   } 

$UNLOCK_CODE = hexdec($UNLOCK_CODE) & 33554431 | 33554432;
$FLASH_CODE = hexdec($FLASH_CODE) & 33554431 | 33554432; 

echo 'IMEI: '.$IMEI;
echo 'UNLOCK: '.$UNLOCK_CODE;
echo 'FLASH: '.$FLASH_CODE;

}

Linux

The modem works well under Linux, but not perfectly. Sometimes it doesn't reconnect automatically and at each connection attempt, it requires entering the APN password manually multiple times. I have no idea if it's the modem's, network's or NetworkManager's fault.