Programming and Installing HUAWEI HiLink E3131 under Linux

Posted: August 13, 2012 in Information Security

Hi PPL  recently i bought HUAWEI HILINK with the main goal to make my own SMS Getaway

So this are the steps i followed

Installation 

1- In the inside memory of the Dongle there is the driver for both windows and linux , There is a way to make the devise appears as USB storage and this is done by using usb mode switch application BUT YOU CAN INSTALL THE DRIVER FROM HERE

2- The following command will install the driver and next time when you plug the dongle it will appeaser as Ethernet interface

chmod +x autorun.sh

./autorun.sh

3- To make sure everything is fin try to access http://hi.link/  you should  get The web interface :D

Programming 

As you can guess you cant use gammu or other standard libs that use /dev/ttyUSB   so after analyzing  the dongle web interface it appears that it runs as web service  and it is being consumed from the javascript libs of the web app . so here i will post the main methods that you can use to request information and trigger actions , you can build on them any lib from any language

Information : 

Connection Status :
URL : /api/monitoring/status
Request : empty
Respons :
<response>
<ConnectionStatus>901</ConnectionStatus> -> 902 Desconected , 901 -> Connected
<SignalStrength>96</SignalStrength>
<SignalIcon>5</SignalIcon>
<CurrentNetworkType>3</CurrentNetworkType>
<CurrentServiceDomain>3</CurrentServiceDomain>
<RoamingStatus>0</RoamingStatus>
<BatteryStatus></BatteryStatus>
<BatteryLevel></BatteryLevel>
<simlockStatus></simlockStatus>
<WanIPAddress>10.140.3.121</WanIPAddress>
<PrimaryDns>84.235.6.55</PrimaryDns>
<SecondaryDns>84.235.57.230</SecondaryDns>
<CurrentWifiUser></CurrentWifiUser>
<TotalWifiUser></TotalWifiUser>
<ServiceStatus>2</ServiceStatus>
<SimStatus>1</SimStatus>
<WifiStatus></WifiStatus>
</response>

Check Notifications :
URL : /api/monitoring/check-notifications
Request : empty
Response :
<response>
<UnreadMessage>0</UnreadMessage>
<SmsStorageFull>0</SmsStorageFull>
<OnlineUpdateStatus>10</OnlineUpdateStatus>
</response>

Network information :
URL : /api/net/current-plmn
Request : empty
Response :
<response>
<State>0</State>
<FullName> </FullName>
<ShortName> </ShortName>
<Numeric>42001</Numeric>
<Rat>0</Rat>

Device information :
URL : /api/device/information
Request : empty
Response :
<response>
<DeviceName>E3131</DeviceName>
<SerialNumber>G8J7SA1262800904</SerialNumber>
<Imei>862732017115150</Imei>
<Imsi>420013703501160</Imsi>
<Iccid>8996601370035011601F</Iccid>
<Msisdn></Msisdn>
<HardwareVersion>CH2E303SM</HardwareVersion>
<SoftwareVersion>22.157.39.00.00</SoftwareVersion>
<WebUIVersion>11.010.12.00.838</WebUIVersion>
<Uptime>5103</Uptime>
<MacAddress1>00:1E:10:E1:73:01</MacAddress1>
<MacAddress2></MacAddress2>
<ProductFamily>GW</ProductFamily>
<Classify>DataCard</Classify>
</response>

Operating
Desconnect :
URL : /api/dialup/dial
Request : <request><Action>0</Action></request>
OK – Response : <response>OK</response>

Connect :
URL : /api/dialup/dial
Request : <request><Action>1</Action></request>
OK – Response : <response>OK</response>
Get SMS Number :
URL : /api/sms/sms-count
Request : Empty
OK – Response :
<response>
<LocalUnread>0</LocalUnread>
<LocalInbox>0</LocalInbox>
<LocalOutbox>0</LocalOutbox>
<LocalDraft>0</LocalDraft>
<LocalDeleted>0</LocalDeleted>
<SimUnread>0</SimUnread>
<SimInbox>0</SimInbox>
<SimOutbox>0</SimOutbox>
<SimDraft>0</SimDraft>
<LocalMax>500</LocalMax>
<SimMax>100</SimMax>
</response>

Recive SMS Inbox :
URL : /api/sms/sms-list
Header : Referer = … /html/smsinbox.html?smsinbox
Request :
<request>
<PageIndex>1</PageIndex>
<ReadCount>20</ReadCount>
<BoxType>1</BoxType> -> 1 Full details
<SortType>0</SortType>
<Ascending>0</Ascending>
<UnreadPreferred>0</UnreadPreferred>
</request>
OK- Response:
Box Type 1 :
<response>
<Count>1</Count>
<Messages>
<Message>
<Smstat>0</Smstat>
<Index>20000</Index>
<Phone> ######## </Phone>
<Content>Message content here </Content>
<Date>2012-08-13 20:54:42</Date>
<Sca>########</Sca>
<SaveType>4</SaveType>
<Priority>0</Priority>
<SmsType>1</SmsType>
</Message>
</Messages>
</response>

IF THE PAGE NUMBER DOSE’T EXIST THE RESPONSE WILL BE
<response>
<Count>0</Count>
<Messages></Messages>
</response>

Set SMS AS READED :
URL : /api/sms/send-sms
Request : <request><Index>20000</Index></request>
OK – Response : <response>OK</response>

Send SMS :
URL : /api/sms/send-sms
Request :
<request>
<Index>-1</Index> -> -1 if its not a replay to any index
<Phones><Phone>+23428479287</Phone></Phones>
<Sca></Sca>
<Content>HELLO</Content>
<Length>29</Length>
<Reserved>1</Reserved>
<Date>2012-08-13 23:25:07</Date>
</request>
Response :
<response>OK</response>

Send USSD :
URL :
REQUEST : <request><content>*333#</content><codeType>CodeType</codeType></request>

RESPONSE : <response>OK</response>

Get OUTBOX SMS List :
URL : /api/sms/sms-list
HEADER : Referer = … /html/smsinbox.html?smssent
Request :
<request>
<PageIndex>1</PageIndex>
<ReadCount>20</ReadCount>
<BoxType>2</BoxType>
<SortType>0</SortType>
<Ascending>0</Ascending>
<UnreadPreferred>0</UnreadPreferred>
</request>
Response :
<response>
<Count>4</Count>
<Messages>
<Message>
<Smstat>3</Smstat>
<Index>20001</Index>
<Phone>########## </Phone>
<Content> asdfasdfasdf </Content>
<Date>2012-08-13 23:25:07</Date>
<Sca>+966505031999</Sca>
<SaveType>3</SaveType>
<Priority>4</Priority>
<SmsType>1</SmsType>
</Message>
….
</Messages>

Managment : 

Auto Connect Settings :
URL : /api/dialup/connection
Header : Referer: … /html/autoconnection.html
Request :
<request>
<RoamAutoConnectEnable>0</RoamAutoConnectEnable>
<AutoReconnect>1</AutoReconnect>
<RoamAutoReconnctEnable>1</RoamAutoReconnctEnable>
<ReconnectInterval>3</ReconnectInterval>
<MaxIdelTime>0</MaxIdelTime>
<ConnectMode>0</ConnectMode>
</request>
RESPONSE :
<response>OK</response>

Pin Operations :
URL : /api/pin/operate
Header : Referer: http://hi.link/html/pincodemanagement.html
OperationType = 1 Enable Pin
OperationType = 2 Disable Pin
OperationType = 3 New Pin

Example of OP3 :
Request :
<request>
<OperateType>3</OperateType>
<CurrentPin>6132</CurrentPin>
<NewPin>6132</NewPin>
<PukCode></PukCode>
</request>

Response :
<response>OK</response>

soon i will provide a Java and Python libs built on this services , if you have any question feel free to mail me

About these ads
Comments
  1. max246 says:

    Thanks so much! I am going to create a class in Python and then I will share it :)

  2. SimonJZurek says:

    Hi Chaddy HV!

    Great article! Where did you get all that api info from?
    I have this modem installed under Windows and I cant find it as modem. Looks like this modem is designed for Linux being accessible simply by /dev/ttyUSB.

    I have build a gateway myself with 4 usb modems (different make) using “gammu”. I am running four gammu services(daemons) on one PC that access same one database run on mysql. I have PHP scripts that populate outbox. It works really well.

    This api is very different and it looks like you don’t need to have a program like gammu. It looks like I can use it straight from PHP level.

    Anyway I would still like to use gammu. Do you have any idea how to it in windows like you do on linux? It would be great if I could assign a com port to it. Do you know what I mean?

    Best regards
    Simon.

    • Chaddy HV says:

      Hi SimonJZurek , i just reversed the functionality of the web application that’s all.
      You can use it directly from PHP it’s just mater of knowing what URL request with witch parameters , and then parsing the json response .

      About how to use it from windows , the things is it works perfect under windows for me it appears as a modem but i meant to use it in linux so i did what i did . the simplicity was thanks to the web services implemented in the device , i don’t know if you can access it throw COM port it will work fine .

  3. steven says:

    Hey there, I am trying to do the same, can you tell me how you got those responses, every time I try to a post and get a response I get an error.

  4. mark says:

    Hi Chad,

    What Python code would I use to send a sms message with the E3131?

    Thanks
    Mark

  5. […] great help from this article by Chaddy HV, we have setup a php library with functions for the features we use. Which […]

    • Chaddy HV says:

      Hi emilbunk , i am glade it helped .
      i sow your script you may like to edit your function getList to function getList($boxNo,$pageNumber) and make the function a little more flexible .

      and thanks for referencing.

  6. Hi Chaddy, great post. many thanks. did you ever find a command to gather the cell id?

  7. Dustin Pinedo says:

    Hi,

    This is really helpful!!. I am doing the url request from terminal. So far, it worked for the reciving the SMS Inbox but everytime I tried to send a sms I get an error 100002. I tried with wget and curl. I know the sms service is working because the hi.link interface for sending sms works.

    What do you think may be the problem?

    Thanks,
    Dustin

  8. 手機殼 says:

    Great day! I just want to offer you a huge thumbs up for your fantastic information you’ve received right here on this post. I’ll be coming back to your blog for much more soon.

  9. Homepage says:

    … [Trackback]

    [...] Read More Infos here: chaddyhv.wordpress.com/2012/08/13/programming-and-installing-huawei-hilink-e3131-under-linux/ [...]

  10. Good day! I know this is somewhat off topic but
    I was wondering if you knew where I could get a captcha plugin for
    my comment form? I’m using the same blog platform as yours and I’m having problems finding one?
    Thanks a lot!

  11. Bart Elffers says:

    Hi Chaddy,

    Great work! You said in your post that you would come back with Python-libs, where can I find them? ;) I’m very new to programming AND Linux.
    I want to use a Raspberry Pi (Raspbian distro) with a Huawei E303s-2 3G-dongle for a stand-alone automatic temperature measurement project that will send me an email every now and then.To reduce power-consumption the RasPi will be switched on and off every 6 hours to do it’s thing.
    I like to connect to internet via a (Python-)script, not by loading a browser and visiting the address “http://192.168.1.1″, fill in PIN and click on “Submit”, step 3 in your post. Is that possible?
    The 3G-dongle is in “12d1:14db – Web Mode / HiLink” (via /etc/udev/rules.d/10-Huawei.rules) and working properly. I can connect to internet using step 3 of your post. cdc_ether as driver, eth2 is on with address 192.168.1.100 (but I can’t get ttyUSB0 and ttyUSB1 working).
    I hope you can help me, although I know there will be differences between the E3131 and E303 dongle….

    Thanks for any reply!
    Bart.

    • Chaddy HV says:

      Hi Bart , i am sorry but i did’t had the time to work on that , right now the project is dismantled , i did it for testing propose only but you may like to use the script made by Emilbunk , its in PHP but you can script it using the PHP command interpreter under Linux ,

      regard your question off-course you can automate the whole process , i think yo may like to do something like this

      Arquitecture

      Control Center : Web application working as main interface to the Respbia , With the following functionality
      1- Chart a log information from the Respbia DB
      2- Control the Respbia functionality
      Respbia : Need to have a 2 daemon you can code it with your favorite programming language , i think it should follow this pseudo code

      1-
      Looping
      Delay of time
      Get Respbia DB control table
      get the sensor temperature
      store the sensor temperature
      if the column regarded the monitor functionality is true
      compare the sensor temperature with the top temperature
      if the actual temperature its above
      Di-activate the AC
      Use the dongle interface and to sendthe information
      else
      get The minimum temperature
      if the actual temp is bellow
      Activate the AC
      Use the dongle interface to send the information
      2-
      Looping
      Delay of time
      Get Msgs from dongle
      if any of the messages arrived contain a special format
      Get Rispba DB authorized number , userName, userPassword
      if authentication bypassed
      parse the command string & do action

      I hope this could help in some way .
      Best Regards

  12. I tried to send sms on Mac OS with curl tool. I must provide Http version on my request otherwise i got an “407 Expected Error”:

    curl -X POST -T ./content.xml http://192.168.1.1/api/sms/send-sms –http1.0

    Best regards,
    Vianney.

  13. Bruno LEGAY says:

    Hi,
    Great stuff !!!
    Just got it to work on a huawei e5220 (mifi : gsm wifi gateway) :-)

    Note : I had an error “100003” which meant It needed a “login” (I guessed that since I haven’t got the documentation).
    I used also an http snooper to check what was done during the login and bingo :

    url : http://192.168.1.1/api/user/login
    post body :

    login
    passwordBase64Encoded

    Has anybody tried on a equivalent device with ethernet port ?

    Best
    Bruno

  14. Linus says:

    Thanks for all the inquiry. I’m very interested in the USSD-messages, but you don’t provide the URL, do you have that?

  15. StarkJohan says:

    I’m using PHP and cURL and most features work great (I’m using a 3231 but it’s the same so far).

    However I’m struggling with two things.

    1. Unlocking PIN-lock on the sim via the api, is this possible? Been trying with the /api/pin/operate part of the api with no luck.
    2. I’d like to get the balance on the sim card using USSD. Not sure on how to get this part of the api to work. What is the “CodeType”? The code I’m using to get my balance is *150#.

    Can anyone shed some light on this?

  16. Alejandro says:

    Hi,
    Great API tricks!

    I also use http://192.168.1.1/api/net/net-mode to know the configuration about the network mode to be used (00=>Auto, 01=>2G, 02=>3G, 04=>4G) and the frequency/band to be used.

    These can be changed simply posting to the same address a modified XML with our needs.

    In other terms, I’d like to know if any of you has realized about how to obtain the LacID (Location ID) and Cell ID. I’d really appreciate it!

    Best regards and Merry Christmas,
    Alejandro

    • Chaddy HV says:

      Hi Alejandro , i don’t know how to find the LID it will be good to see how !, Sadly the project was canceled, and i don’t have the enviorment to test the things now.

  17. Solick says:

    Hi chaddy, there are some mistakes in your api interpretation:
    To set a sms as read you need to call api/sms/set-read and use the referer http://192.168.1.1/html/smsinbox.html?smsinbox

    For deleting a sms you need to use api/sms/delete-sms

    There are some more api commands which i discovered. At the moment i´m writing a c api for the huawei api (which seems to be the general api for all huawei sticks and routers) which makes it more simple to implement into existing c based projects.

    Kind regards

    solick

    • Chaddy HV says:

      Thanks for pointing the mistakes up.

    • StarkJohan says:

      Do you have a link for your project? I’d love to check it out.

      • Solick says:

        Hi, i´m sorry, the emails has been lost in my spam folder so i recognized them just know. I would love to share the project, unfortunately i have faced a problem with libcurl under ubuntu, where my code crashes and did not have the time to debug it. On Mac OS X.9 the code works fine. If you are interested i can share the code with you via github and you could help finding out the problem unter ubuntu / raspian. KR Solick

  18. durje says:

    Hi,
    Great article!
    Do you have any idea f how to configure profile in profile Management..?

    I tried with:

    URL : /api/dialup/profiles
    Header : Referer: … /html/profilesmgr.html
    Request :

    2

    1
    1
    O2
    1
    payandgo.o2.co.uk
    *99#

    2
    0

    0

    2

    2
    1
    O2
    1
    mobile.o2.co.uk
    *99#
    o2web
    password
    0
    0

    0

    0

    But the RESPONSE is:

    100001

    Thans in advance

    • durje says:

      URL : /api/dialup/profiles
      Header : Referer: … /html/profilesmgr.html
      Request :

      2

      1
      1
      O2
      1
      payandgo.o2.co.uk
      *99#

      2
      0

      0

      2

      2
      1
      O2
      1
      mobile.o2.co.uk
      *99#
      o2web
      password
      0
      0

      0

      0

  19. durje says:

    Hi,
    Great article!
    Do you have any idea of how to configure profiles in profile Management..?

    I tried with:

    URL : /api/dialup/profiles
    Header : Referer: … /html/profilesmgr.html

    Request :

    request
    CurrentProfile>211O21payandgo.o2.co.uk*99#200221O21mobile.o2.co.uk*99#o2webpassword2002
    code>100001

  20. durje says:

    Hi,
    Great article!
    Do you have any idea of how to configure profiles in profile Management..?

    I tried with:

    URL : /api/dialup/profiles
    Header : Referer: … /html/profilesmgr.html

    Request :

    request
    CurrentProfile 2 CurrentProfile
    Profiles
    Profile
    Index 1 Index
    IsValid 1 IsValid
    Name O2 Name
    ApnIsStatic 1 ApnIsStatic
    ApnName payandgo.o2.co.uk ApnName
    DailupNum *99# DailupNum
    Username
    Password
    AuthMode 2 AuthMode
    IpIsStatic 0 IpIsStatic
    IpAddress
    DnsIsStatic 0 DnsIsStatic
    PrimaryDns
    SecondaryDns
    ReadOnly 2 ReadOnly
    Profile
    Profile
    Index 2 Index
    IsValid 1 IsValid
    Name O2 Name
    ApnIsStatic 1 ApnIsStatic
    ApnName mobile.o2.co.uk ApnName
    DailupNum *99# DailupNum
    Username o2web Username
    Password password Password
    AuthMode 2 AuthMode
    IpIsStatic 0 IpIsStatic
    IpAddress
    DnsIsStatic 0 DnsIsStatic
    PrimaryDns
    SecondaryDns
    ReadOnly 2 ReadOnly
    Profile
    Profiles
    request

    But the RESPONSE is:

    error
    code 100001code
    message message
    error

  21. Hey,
    thanks for your Programming examples!
    I put them together and completed them into an PHP Class

    For anyone interessted: https://github.com/BlackyPanther/Huawei-HiLink

  22. Dylan says:

    Hi Chaddy!

    great stuff! This has been very useful for me :-) I was wondering if you could help me out, with the “send USSD” command, how do I actually send the command to the phone? I am using shell scripts + curl to send the xml data to the USB modem, but for the USSD command you have the URL empty – not sure what to do :( My script is as below

    echo ‘*100*1#CodeType’ | curl -X POST -H ‘Content-type: text/xml’ -d @- http://192.168.1.1

    but this does not work

    A testsend.sh script which does work for me is

    echo ‘-10274124360Hello world1111′ | curl -X POST -H ‘Content-type: text/xml’ -d @- http://192.168.1.1/api/sms/send-sms

    Thanks for your help!

  23. StarkJohan says:

    Still wondering if anybody has the USSD codes working…

    • Solick says:

      unfortunately huawei seens not to provice access to the USSD codes. I spend some time to reverse engineer this but did not find out anything.

      • StarkJohan says:

        Yes, please share on github. I can’t say I have too much time at my hands but I’ll definitely check it out and have a look.

  24. Ata Fatahi says:

    hi chaddy!
    thank you for your geat article it is helpful.
    and i could send sms with that.
    to disconect i wrote this python script :
    import requests
    URL = ‘http://192.168.8.1/’
    d = “0”
    r = requests.post(URL + ‘api/dialup/dial’ , data = d)
    print r.status_code
    print r.text
    altough this scipt return OK but in fact and real connection does not disconnect.
    why?
    and for check connection status i write this script too:
    import requests
    URL = ‘http://192.168.8.1/’
    d = “”
    r = requests.post(URL + ‘api/monitoring/status’ , data = d)
    print r.status_code
    print r.text
    but this script returns Error.
    why ? and you said to connection status request must be empty.
    what is empty ? d = ” or d = ‘ ‘ ?
    thank a lot for reply :)

  25. Dylan says:

    Hi Chaddy,

    your scripts have helped heaps – thanks! I have deployed a bunch of raspberry pis sending data back via bash/curl and the Huawei E303 3g modem thanks to your help so it is very much appreciated :-) I have just bought another one, and it seems like the firmware/hilink software has been updated – it now has a 192.168.8.1 address (instead of 192.168.1.1) and the 3g connect string returns an error – the below used to work with my other E303s…

    # Connect to the internet

    echo “1” | curl -X POST -H “Content-type: text/xml” -d @- http://192.168.8.1/api/dialup/dial

    (note: at a guess your commenting system might mangle the code a bit?)

    now when I try and run the above, the modem returns an error

    125001

    Error code is 125001

    any idea how to fix that? Thanks so much for your help!!!

    • Dylan says:

      The code got mangled!!!
      I’ve replaced all angle-brackets with curly ones below…

      echo “(request)(Action)1(/Action)(/request)” | curl -X POST -H “Content-type: text/xml” -d @- http://192.168.8.1/api/dialup/dial

      hopefully that posts OK now :-)

      The error from the modem was

      (?xml version=”1.0″ encoding=”UTF-8″?)
      (error)
      (code)125001(/code)
      (message)(/message)
      (/error)

      • Hi Dylan, i am glade to see the post helped the project. can you trace the javascript code in the web interface and posted here ? ( i have no access now to the dongle )

      • Dylan says:

        I’m not sure how to trace the code sorry, I installed Firebug and from the console found the headers/post/response from pressing the “connect” button – as below

        Headers:
        view source
        Cache-Control no-cache
        Connection close
        Content-Length 61
        Content-Type text/html
        Date Thu, 01 Jan 1970 00:00:00 GMT
        Server mini_httpd/1.19 19dec2003
        view source
        Accept */*
        Accept-Encoding gzip, deflate
        Accept-Language en-US,en;q=0.5
        Content-Length 75
        Content-Type application/x-www-form-urlencoded; charset=UTF-8
        Host 192.168.8.1
        Referer http://192.168.8.1/html/home.html
        User-Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
        X-Requested-With XMLHttpRequest
        __RequestVerificationToke… 340528667

        Post:
        1

        Response:
        OK

        If you can tell me where/what to find to help you further I can post anything you need

        Thanks :-)

      • MMM i Really cant help only with this , go to the button that trigger the action click if you are using chrome inspect ,try check if it tigers a java script function ( look for events onclick ) if is not inside a form go to the function it calls and pasted it here, if its inside a form and the action is a submit action post the full form here

  26. As there is so many people interested in this subject i will buy soon the dongle and try to find a time to setup the project again then walk throught the development of a full Restclient for this Dongle , I am very sorry if there is some posts i did’t answer at that time i got very busy with my BS thesis but as i graduated now i may have a bit of time to help

    • Solick says:

      Maybe it would be good to create a community project. I think there are several aspects:
      1. general api reverse enginnering
      2. Implementation with different languages like C, C++, python, java, javascript etc.

      I would offer to host a website with wordpress, forum and what else is needed. Code could be hosted at github.

      What do you think?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s