How to unlock Huawei 3G modems

ginggs

༼ つ ◕_◕ ༽つ
Super Moderator
Joined
Jun 26, 2006
Messages
12,171
Reaction score
737
Location
Kapkaupunki
Thanks to dogbert for sharing this:
Code:
#!/usr/bin/env python
#
# Copyright 2010: dogbert <[email protected]>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
#

import hashlib, getopt, sys

def info():
	print "huawei-unlock.py: calculates unlock codes for Huawei modems"
	print "Copyright (c) 2010 dogbert <[email protected]>"
	print "For information and updates, visit http://dogber1.blogspot.com"
	print ""

def usage():
	print "Options: -i*, --imei=*      IMEI of the device"
	print ""
	print "Example: huawei-unlock.py --imei=351234567891239"
	print ""

def testIMEIChecksum(digits):
	_sum = 0
	alt = False
	for d in reversed(digits):
		assert 0 <= d <= 9
		if alt:
			d *= 2
		if d > 9:
			d -= 9
		_sum += d
		alt = not alt
	return (_sum % 10) == 0

def checkIMEI(imei):
	digits = []
	if len(imei) != 15:
		print "IMEI too short/long"
		return False
	for i in imei:
		digits.append(int(i))
	if not testIMEIChecksum(digits):
		print "IMEI checksum invalid"
		return False
	return True

def getCode(imei, salt):
	digest = hashlib.md5((imei+salt).lower()).digest()
	code = 0
	for i in range(0,4):
		code += (ord(digest[i])^ord(digest[4+i])^ord(digest[8+i])^ord(digest[12+i])) << (3-i)*8
	code &= 0x1ffffff
	code |= 0x2000000
	return code

def main():
	info()
        try:   
                opts, args = getopt.getopt(sys.argv[1:], "hi:", ["help", "imei="])
        except getopt.GetoptError, err:
                print str(err) # will print something like "option -a not recognized"
                usage()
                sys.exit(2)

	imei = ""
	interactive = False

        for o, a in opts:
                if o in ("-i", "--imei"):
                        imei = a
                elif o in ("-h", "--help"):
                        usage()
                        sys.exit()

	if imei == "":
		imei = raw_input("Please enter the IMEI of the device: ")
		interactive = True

	if checkIMEI(imei):
		print "Unlock Code: %d" % (getCode(imei, hashlib.md5("hwe620datacard").hexdigest()[8:24]))
		print "Flash Code:  %d" % (getCode(imei, hashlib.md5("e630upgrade").hexdigest()[8:24]))
		print "done."

	if interactive:
		raw_input()
	
if __name__ == "__main__":
	main()
 
How do you run this?

So if for example I slap an MTN simcard in a Vodafone Huawei modem and it says "Must be on a Vodacom Network", this code will fix it?
 
......anyone?

How would you run this code? What exactly does it do?
 
I hate to break it to you guys, but if you have to ask then this is probably not for you... :p
 
I hate to break it to you guys, but if you have to ask then this is probably not for you... :p

ok, could you explain what this code is?

CREATE PROC dbo.dba_backupdelete
@vcDatabaseName VARCHAR(100)
AS
SET NOCOUNT ON

DECLARE
@vcDatetime VARCHAR(214)
,@vcDosCmd VARCHAR(130)
,@vcBackup VARCHAR(110)
,@vchh VARCHAR(2)
,@vcmin VARCHAR(2)
,@cmd VARCHAR(50)
,@vcLocation VARCHAR(50)
,@cmddelete VARCHAR(200)
,@vcTable VARCHAR(50)
SET @vcDosCmd = 'MD C:\MSSQL.1\MSSQL\Backup\'+@vcDatabaseName+''
SET @vcLocation = 'C:\MSSQL.1\MSSQL\Backup\'+@vcDatabaseName+'\'
SET @cmd = 'DIR '+ @vcLocation + @vcDatabaseName + '*.BAK /OD /B '
EXEC master.dbo.xp_cmdshell @vcDosCmd

PRINT @cmddelete

CREATE TABLE #OldestBackupbackup
(Backupname VARCHAR(50)
)

INSERT INTO #OldestBackup(backupname)
EXEC master.dbo.xp_cmdshell @cmd

SET @vcTable = (SELECT TOP 1 backupname FROM #OldestBackup)
SET @cmddelete = 'del /Q '+@vcLocation+@vctable+''
EXEC master.dbo.xp_cmdshell @cmddelete


SET @vchh = (SELECT CASE WHEN DATEPART(hh,GETDATE()) < 10 THEN CAST('0' + CAST(DATEPART(hh,GETDATE())
AS VARCHAR(1))
AS VARCHAR(2))
ELSE
CAST(DATEPART(hh,GETDATE())
AS VARCHAR(2))
END )
SET @vcmin = (SELECT CASE WHEN DATEPART(mi,GETDATE()) < 10 THEN CAST('0' + CAST(DATEPART(mi,GETDATE())
AS VARCHAR(1))
AS VARCHAR(2))
ELSE
CAST(DATEPART(mi,GETDATE())
AS VARCHAR(2))
END )

SET @vcDatetime = 'C:\MSSQL.1\MSSQL\Backup\'+@vcDatabaseName+'\'+@vcDatabaseName+'_backup_'+convert(char(8), GETDATE(),112)+ @vchh+@vcmin+ '.bak '

SET @vcBackup = ' BACKUP DATABASE ' +@vcDatabaseName + ' TO DISK = '''+@vcDatetime+ ''''


EXEC (@vcBackup)
SET NOCOUNT OFF
GO
EXEC backupAllanTry1 @vcDatabaseName = ''

/*
+convert(char(8), GETDATE(),112)+
*/
 
Last edited:
@Osiris85 i'm guessing you need to run the commands from the python software or something like that.
I don't currently have a modem to unlock so i am not gonna spend time on it.
Did you have a look at the link in the op?
 
@Osiris85 i'm guessing you need to run the commands from the python software or something like that.
I don't currently have a modem to unlock so i am not gonna spend time on it.
Did you have a look at the link in the op?

Thank you Park, its nice to get a straight answer from someone for a change.
I tried to check out the link but the site is blocked at work :(

Could you please explain a bit more about the Python Software? What is it? What does it do?
 
I'm not a coder, but at guess I would say it backs up a DB into a temp DB and dumps it to disk. What's your point?
 
I'm not a coder, but at guess I would say it backs up a DB into a temp DB and dumps it to disk. What's your point?

My point being that my code I understand, the code in the thread I dont understand. Hence, the reason I asked for advice, not criticism.

FIY: You are 1/4 correct about my code
 
My point being that my code I understand, the code in the thread I dont understand. Hence, the reason I asked for advice, not criticism.

FIY: You are 1/4 correct about my code

So therein my point. If you don't understand the implications of the code you are executing should you be doing so in the first place?

A simple bit of googling would have revealed that Python is a programming language of sorts common to Linux. So it would be best to run this on such a platform.

I'm not directing this specifically at you, but does everything need to be spelled out to people? What happened to exploring the unknowns for oneself?
 
So therein my point. If you don't understand the implications of the code you are executing should you be doing so in the first place?

A simple bit of googling would have revealed that Python is a programming language of sorts common to Linux. So it would be best to run this on such a platform.

I'm not directing this specifically at you, but does everything need to be spelled out to people? What happened to exploring the unknowns for oneself?

I understand what the code does and the implications, what I don't understand is how the code should be executed.

The reason why I am asking these questions on the forum is because most of the sites are blocked at the office so I cannot do any real research
 
I understand what the code does and the implications, what I don't understand is how the code should be executed.

The reason why I am asking these questions on the forum is because most of the sites are blocked at the office so I cannot do any real research

So that is a much more focused question with a bit more context to your situation than:
......anyone?

How would you run this code? What exactly does it do?
Hence the terse reply :)

So off to your nearest Linux box with you ;)
 
come on guys put away your slongs

Thank you Park, its nice to get a straight answer from someone for a change.
I tried to check out the link but the site is blocked at work
from the link:

Unlocker for Huawei Modems

I've finished a quick and dirty implementation of a script which calculates unlock codes ("NCK") for Huawei modems:
huawei-unlock.py
The algorithm has been published a while ago, and there are a lot of other tools out there which do just the same thing. You need python 2.x to run the script.
This is a list of devices for which the unlock code ought to work:
Huawei: E156, E155, E1550, E1552, E156G, E160, E160G, E161, E166, E169, E169G, E170, E172, E176, E1762, E180, E182E, E196, E226, E270, E271, E272, E510, E612, E618, E620, E630, E630+, E660, E660A, E800, E870, E880, EG162, E880, EG162, EG162G, EG602, EG602G
Vodafone: K2540, K3515, K3520, K3565, K3520, K3565

A method to unlock the popular E220 devices has been published here.
Could you please explain a bit more about the Python Software? What is it? What does it do?
Never used but have a look here:

http://www.python.org/about/
 
damn i'm guessing proxies are blocked also?

Its full of links and images which i don't have time for now. But there's the txt:
unlocking huawei e220..manually
below is my attempt to unlock a huawei e220 datacard. so please understand, i do not take any responsibility for your actions with this information.

let's get it right, shall we...


preparation

1. E220Update_11.117.09.04.00.B268.exe
2. QC BQS Analyzer
3. Hex Editor
4. E220 SimLock_UnLock.exe
5. E220 DataCard in your USB port


the work

run the E220 Firmware Update Wizard until datacard is detected and cancel it. your e220 will be detected more easily by QC BQS Analyzer.


run QC BQS Analyzer, choose 'Communication' - 'Use Com/USB Port'. a 'QC Com Diag Window' will appear. test your connection.

1. set your Serial Com Port (3G PC UI Interface, not the other one)
2. click 'Send Cmd'


you'll get 'Successfully send command.' and output similiar to the textbox. If you got no response at all (no output or 'CommError'), you have to restart the process.

set 'Read EFS' from Standard Mode dropdown menu, click 'Lets go'. name the file (efs.bin), save it.


open saved file with hex editor, search for following hex-chain: 53-64-2C-00, and you should see the unlock code.

run E220 SimLock_UnLock.exe, enter your unlock code.

remarks

Hardware & Firmware Version : ^FHVER:11.117.09.04.00,CD33TCPUB"
(AT^FHVER)

Tested on : T-Mobile E220, INDOSAT E220
 
I understand what the code does and the implications, what I don't understand is how the code should be executed.

The reason why I am asking these questions on the forum is because most of the sites are blocked at the office so I cannot do any real research

The code is written in an older version of
Python, so you would have to download
the 2.7 from http://python.org/

Put the source code into a Python editor
(IDLE) new window, save it as
huawei-unlock.py (don't leave out the .py !!)

Then you have to run it from the command
line with the IMEI (see the example)

It's not difficult.

You may also have to fix the spaces in the
source code. Python is very pedantic about
spacing and doesn't like tabs.


You can also compile the code to run
without the installs. I guess the author
wanted you to see what was going on
or to use it on Linux as well.
 
Last edited:
Found this (2006) here:

http://mybroadband.co.za/vb/showthr...-Data-Card-modem-unlocked?p=631786#post631786

A process is being put into place to unlock network-locked cards already in circulation. This process will commence on the 1st of September and will require the customer who wants his card unlocked to take it to the nearest Vodacare where it will be unlocked for free.

Obviously all new cards or 3G/HSDPA devices will not be network-locked.

Does this still apply? I have a E220, but only ever used it with VC (curious to see if it will work with MTN etc).
 
Top
Sign up to the MyBroadband newsletter
X