Elektroda.com
Elektroda.com
X

Search our partners

Find the latest content on electronic components. Datasheets.com
Elektroda.com

Huawei LTE CPE B593s-22 - Extracting firmware files - already possible.

3810 6
This content has been translated » The original version can be found here
  • Level 11  
    Hello,
    I wanted to share my observations regarding the structure / structure of the firmware
    router: Huawei B593s-22 . I have succeeded in this play by accident, and I have little free time
    I decided to publish all the information on how to do it on this forum.

    !!! For the first time on the Internet - you won't find this information anywhere else !!!
    This is of course the ability to extract files and directory structure from
    "firmware.bin" designed for Huawei LTE CPE B593s-22 !!!




    I think that there will be a few people on the elektroda.pl forum who can use this information
    find a way to freely modify the firmware of this device,
    and to extract the password encryption algorithm - what would be possible to log into the SSH console.

    It is interesting as it would allow us to restore, for example, "POLISH" language for the last one
    FW: V200R001B270D10SP00C00 (probably due to Polish operators it was " / * commented * / ".
    Huawei LTE CPE B593s-22 - Extracting firmware files - already possible.
    I will not even mention the menu for selecting the frequency of the 3g / 4g modem.

    As for the firmware itself, I have a few questions, I hope someone knows the answers, or has an unnecessary B593s-22 router for testing and knows how to use the programmer:
    - FW consists of 9 parts - would it be successful to try to upload one (which is a partition image, e.g.: WebUI)?
    - Do we skip Android for VxWorks when updating with the tool: "B593s-22 Multicast upgrade tool"?
    - What is the probability that FW (update.app) is "signed" for Android, and how is it signed: as a whole or each of the images
    in turn, or maybe only the Android partition is signed?
    - How is it possible that replacing the firmware version works if this value is involved in counting the checksum of the header section?
    - How is it possible that the replacement of the FW number in the header section ending with 2 digits into 3 digits "broke" the equipment?

    Attached is a file in [pdf] format with the entire extraction procedure and a few details about the structure of this firmware.

    In the tutorial I used a free "hex" editor HxD .

    * if you have any comments or noticed mistakes in the publication, write and I will introduce corrections
    (if you find spelling mistakes, write to "priv" - save me the embarrassment :!: :) )

    Ekstrakcja...CEDURA.pdf Download (9.04 MB)

    I invite you to read the materials - GREETINGS :spoko:

    Moderated By jimasek:

    Online Safety Notice:
    Please note that the sources provided by the colleague of the author of the post are not authorized by the manufacturer in any way, so downloading, changing and installing such software is at your own risk.

  • Level 1  
    Or do you have a "cleaner" V200R001B270D05SP00C00 at hand?
  • Level 11  
    Hello,
    as for: V200R001B270D05SP00C00 - unfortunately at the moment I only have V200R001B270 D10 SP00C00 - I attach as an attachment to my answer (RAR "self extractor" + 10% recovery).

    B710C0UPDA...P00C00.exe Download (49.97 MB)


    I am currently exploring the knowledge of the file system " yaffs1 "but I'm just learning programming (I'm trying to write a program to calculate ECC on this system) - it will take me a while.

    With "WinMerge" I know which lines in the files "WebUi" update to enable: frequency selection not only for LTE, but also for WCDMA / HSPA :idea: :)

    So far I analyzed the list of available * .cgi and their functions and everything looks optimistic (the relevant commands are not cut with the upg.software :D )

    From the observation of various "firmware" from this manufacturer, I find that the section structure HeaderAPP is "the same" (only the DataAPP structure structure differs) ... You can check it, for example, on the example of the model B315s-22 ...

    I'm buying a cord next month "usb uart" and see what NAND and flash look like in this device ...

    GREETINGS
  • Level 11  
    Hello, I am closing the thread due to the lack of interest in the topic
  • Level 11  
    Hello,
    I open the thread again, because as it turned out, Huawei draws conclusions and in newer FW versions for the B593-s22 model, i.e .:

    Vodafone _ B710C0UPDATE_V200R001 B270 D25SP81C11
    Telia _ B710C0UPDATE_V200R001B270D25SP01C07
    Elisa _ B710C0UPDATE_V200R001B270D25SP01C260


    introduced digital signatures (key 2048b) to verify "firmware.bin" :cry: .

    After installing any of these firmware NOT POSSIBLE there is an installation of a different version, and the so-called "debranding".
    I will provide details in the coming days (I came across a lead this morning).
    Greetings.
  • Level 1  
    Re.Mastered.M wrote:

    After installing any of these firmware NOT POSSIBLE there is an installation of a different version, and the so-called "debranding".
    I will provide details in the coming days (I came across a lead this morning).
    Greetings.


    Any news on that?
    I was stuck on the V200R001B270 D25 SP00C00 :cry:
  • Level 8  
    Quote:
    With "WinMerge" I know which lines in the files "WebUi" update to enable: frequency selection not only for LTE, but also for WCDMA / HSPA :idea: :)

    Be so good and add to Vodafone the LTE900 frequency (only available in tele2 firmware) and LTE2100 which is not included in any firmware and it would be very useful.
    You would extend the life of this router