Unlock Airtel E5172Bs-925 4G LTE Router

I've had this 4G router or gateway for a while and have been looking for a way to unlock the router and use it with other operators. The Airtel branded firmware has blocked unlocking, it shows zero available attempts to enter an unlock code. So like other routers and modems from Hauwei or similar brands, we need to flash a firmware which allows you to enter an unlock code or comes unlocked.

huawei-e5172

The firmware which worked for me was named MPWUDPUPDATE_V200R001C284SP100.BIN however once flashed, the device displays the version as V200R001C209SP100. My guess is that, the metadata of the BIN file was updated to reflect a firmware version which passes the internal firmware update checks. Big thanks to whoever came up with the idea!

Below image shows the details after the update.

post-upgrade-info

Click here to download the firmware update.

Steps to unlock the device

  • Reset the device and connect to the PC over ethernet (updating over WiFi is not really recommended). Remove the SIM if any or use an Airtel SIM.
  • Open the router configuration web UI. The default URL is http://airtel4grouter.cpe/ or http://192.168.1.1/
  • Navigate to Home --> Update. Select the extracted update file MPWUDPUPDATE_V200R001C284SP100.BIN and press Update. This might take 5-10 minutes.
  • Once the update completes, reset the device again using the option in the System page. The UI would now change to that of Megafone (a Russian operator)
  • Insert non-Airtel SIM and it should be detected. You can now proceed to create a profile for your operator (Internet -- APN Management)

Note

  • The router seem to support only the 2300 MHz or the TDD-LTE Band 40. So this would work only with operators supporting this band -- Airtel, Jio. For the same reason, you may not be able to use 2G or 3G networks.
  • If it asks for an unlock code on inserting a non-Airtel sim after the update, please leave a message and I will try to get it for you. For me, there was no prompt for the unlock code and it worked straight away.

connected-to-jio

Recovering a bricked Beetel 220BX ADSL Router / Modem

Either the BSNL wiring to my house is faulty or I'm very [un]lucky, eitherway my BSNL modem / router gets fried every three months or so. Instead of buying a new device each time, I have turned to used devices which I can get for about Rs 100 shipped from eBay after coupons.

So I bought a used Beetel 220BX which arrived in a not-so bad physical condition, I kept it aside to be used when my current modem fails. It was only when I tried to configure it two months later that I realized the modem was faulty.

beetel-220bx

Initial observations

  • Powers on.
  • Power and Link LEDs are solid even without the DSL cable.
  • PC/USB LED glows when an ethernet cable is attached.
  • Does not respond to a DHCPDISCOVER, DHCP server doesn't appear to be running/enabled.
  • Assigned an IP address in the 192.168.1.0/24 subnet to a PC directly attached to the device, 192.168.1.1 does not respond to ping, web interface is not accessible. An nmap scan shows no active services listening on any port.
  • Tried pressing and holding the reset button for well over 2-3 min, but no difference.

So it became perfectly clear that the device is either severely bricked or simply dead. As I didn't want to just trash the device, I opened the device and was happy to see that there was an easily accessible serial port. Connected my serial adapter using the wire tester hooks and I was looking at the serial output in no time. The pins are GND-TX-RX-VCC from the bottom.

The serial output had lot of SQUASHFS errors and it looked like the filesystem got corrupt somehow. Full boot log here.

BusyBox v1.00 (2006.06.14-14:54+0000) Built-in shell (msh) Enter 'help' for a list of built-in commands.

Loading drivers and kernel modules...

CodeReal: invalid data

SQUASHFS error: lzmafs error while decompressing! SQUASHFS error: Unable to read page, block 10a9c1, size 5379
CodeReal: invalid data
SQUASHFS error: lzma
fs error while decompressing!
SQUASHFS error: Unable to read page, block 10a9c1, size 5379

There is an option to interrupt the boot process which would drop you in a CFE shell. CFE acts like a boot loader and the limited shell gives you the option to flash a firmware from a TFTP server. Now all I had to do was to find the right firmware for my modem and flash away (or I thought). Luckily Shanker Balan had uploaded the firmware image for this modem on his site.

While researching more, I came across two excellent articles which proved to be invaluable in getting my modem fixed. Thank you mrmt32!

Only after reading those articles I realised that I cannot directly flash the image file as it contained three components ie CFE + Kernel + Filesystem and the CFE firmware flash tool was expecting an image file without the CFE component. I used mrmt32's tool to create an image in the right format for the Beetel 220BX. Here is the final image file, ready to flash.

Now, all you need to do is setup your TFTP server on a PC, assign the PC an IP address in the 192.168.1.0/24 subnet. From the CFE shell, run the flashimage command.

flashimage 192.168.1.100:bcm963xx_fs_kernel

Loading 192.168.1.2:bcm963xx_fs_kernel ... Finished loading 1817620 bytes
..........................

That's it, type reset and your modem should now boot cleanly. Here is a boot log after flashing the firmware.

Find Google Analytics account associated with a tracking code

Few weeks back while I was making some changes to an old website, I noticed it was setup with Google Analytics but couldn't find the site configured in any of my accounts (well, the ones that I could of think of at the time). Luckily I was able to identify the account with Google's help.

Finding and regaining access to the account is a manual process. Support for Google Analytics is handled by the Google AdWords team so you need an AdWords account to contact them. If you do not have an AdWords account, simply sign up for one. You do not have enter any billing information.

Head over to the contact page for AdWords and choose the email option (or which ever option you'd prefer). Select Google Analytics, fill in the necessary details and describe the issue. Don't forget to include the tracking code. You should get an email response from a Google specialist within a day or two with the next steps.

google-analytics-recover

Process

Ideally, you would need to contact the administrator, but in your case, I understand that you're unable to place them - and for security reasons, we're unable to disclose administrator information to you. What I can do to help you is write on your behalf to the current administrator/s on this Analytics account, requesting them to get in touch with you.

If you would like me to go ahead and do this, please reply to this email stating so, as this will be the first step.

Next steps

In case this doesn't help and we don't hear back from the administrator (within 7 days from when I write to them), I will share with you the steps to prove ownership of the domain(s) being tracked by this account, and thus gain access to the account independently of the administrator(s).

In my case, it was a Google account that I had forgotten about (created when my Google Apps account got transitioned to the new system back in 2011) so was able to reset the password easily and regain access. It was good to know that I could also regain access by proving domain ownership.

Seagate GoFlex Net : Installing Rescue System

After installing Debian using the install script on Jeff Doozan’s page, the stock PogoPlug OS fails to boot on a GoFlex Net even though it works perfectly on a Dockstar or PogoPlug Device. So the alternative is to install Jeff’s Rescue System on the GoFlex Net, but the default installation fails to boot as well and requires a slight modification for it to work properly.

First boot into debian from a USB device and run the following commands

cd /tmp  
wget http://jeff.doozan.com/debian/rescue/install_rescue.sh  
chmod +x install_rescue.sh  
./install_rescue.sh

Once the installation is complete, run the following command

fw_setenv rescue_bootcmd 'if test $rescue_installed -eq 1; then run rescue_set_bootargs; nand read.e 0x500000 0x100000 0x400000; bootm 0x500000; else run pogo_bootcmd; fi'

After this you can shutdown the device, remove the USB drive and restart, it will successfully boot into the rescue system.

You can also load the Rescue System from a USB drive (you need console access), thanks to Johannes. For this you need to download the rescue system from here and put the files on the root directory of a FAT formatted USB drive.

Now you need to interrupt the boot process through the console by pressing a key when prompted. You can either use a serial adapter or netconsole (provided you have set it up already)  for this.

U-Boot 2010.09 (Oct 23 2010 - 11:53:10)  
Marvell-GoflexNet by Jeff Doozan, Peter Carmichael  
Hit any key to stop autoboot:  0

Once you have interrupted uBoot and at the Marvell>> prompt, connect the USB drive and run the following commands

usb start  
fatload usb 0:1 0x500000 uimage  
fatload usb 0:1 0xe00000 uinitrd  
setenv bootargs console=$console $mtdparts  
bootm 0x500000 0xe00000

The rescue system now boots and you can re run the debian installer or do further troubleshooting.

Seagate GoFlex Net : Serial Connection

If your GoFlex Net is no longer booting cause you made some change you will probably need to establish a serial connection to troubleshoot the problem. For this you need a serial adapter, but the GoFlex Net uses 3.3 V TTL levels so do not connect your PC’s serial connector to the device as its 12 V.

To establish a serial connection you will need the following items

  1. USB Serial Adapter – You can get one from eBay based on the PL2303 or CP2102 chips.
  2. Wire Testing Hooks – You will need this to properly attach the cable to the pins.

IMG_0778You can also get a Nokia CA-42 data cable as the serial adapter but you will have to identify the correct wires etc which might be a little tricky.

On the left you can see how my adapter looked after attaching the hooks.

Now you need to open the GoFlex Net to get access to the serial port. For this you will need a plastic pry tool. Use the pry tool to slowly detach the bottom panel from the GoFlex. There are small clips which is holding the bottom panel.

Once you have removed the bottom panel, you will be able to see the 10 pin port as shown below.

IMG_0771

Now use the cable hooks to attach the cables to respective pins and the final result would be something like below. It may take a while to attach the hooks properly as the pins are really close together.

IMG_0786

Now attach the serial adapter to the PC, install the drivers and you are ready. If you are using Windows you can use Putty to see the serial output. Configure putty with correct COM port, speed as 115200 and no flow control.

serial-puttyNow start the Putty session and then power on the GoFlex Net, you should see the console output.

In linux you can simply run

screen /dev/ttyUSB0 115200

From there you can interrupt uBoot to fix any issues with the uBoot environment for instance. But be careful as you don’t want to brick the device by messing too much with the boot loader and you will probably need a JTAG to recover the device if its bricked.

Boot debian from SATA - Seagate GoFlex Net

This how-to assumes that you have a working Debian installation on a USB drive. If not check Jeff’s site on how to install debian Squeeze on the GoFlex Net.

Once you have installed debian and have verified everything is working fine, we can go ahead with the modifications. It would be a good idea to configure netconsole so that you can monitor and make changes to uBoot if there is any problem. The steps are described in detail here.

The default kernel installed doesn’t have support for the GoFlex Net SATA ports. So we are going to replace it with a newer and updated kernel.

Now we will download and install the updated kernel.

wget http://www.varkey.in/files/linux-image-2.6.37.6-goflex_1.0_armel.deb

dpkg -i linux-image-2.6.37.6-goflex_1.0_armel.deb

cd /boot

# Create the images for uBoot

/usr/bin/mkimage -A arm -O linux -T kernel -C none -a 0x00008000 -e 0x00008000 -n Linux-2.6.37.6 -d /boot/vmlinuz-2.6.37.6-goflex /boot/uImage
/usr/bin/mkimage -A arm -O linux -T ramdisk -C gzip -a 0x00000000 -e 0x00000000 -n initramfs -d /boot/initrd.img-2.6.37.6-goflex /boot/uInitrd


After that reboot GoFlex Net and ‘uname –r’ should show ‘2.6.37.6-goflex’ if the kernel installation was successful. Once you have made sure it’s the updated kernel we can update uBoot environment to the new GoFlex Arch Number to enable the SATA ports.

setenv arcNumber 3089


Reboot again and check the output of ‘dmesg’, it should show something like this

[    1.068182] sata_mv sata_mv.0: version 1.28  
[    1.072505] sata_mv sata_mv.0: slots 32 ports 2
[    1.079814] scsi0 : sata_mv
[    1.083250] scsi1 : sata_mv
[    1.086582] ata1: SATA max UDMA/133 irq 21
[    1.090697] ata2: SATA max UDMA/133 irq 21


Now you can modify the uBoot environment again to make it boot from a SATA drive.

fw_setenv sata_boot 'ide reset; mw 0x800000 0 1; ext2load ide 0:1 0x800000 /boot/uImage; if ext2load ide 0:1 0x1100000 /boot/uInitrd; then bootm 0x800000 0x1100000; else bootm 0x800000; fi'  
fw_setenv sata_bootcmd 'run usb_set_bootargs; run sata_boot'  
fw_setenv bootcmd 'usb start; run force_rescue_bootcmd; run ubifs_bootcmd; run usb_bootcmd; usb stop; run sata_bootcmd; run rescue_bootcmd; run pogo_bootcmd; reset'


Shutdown the GoFlex Net, connect the hard disk to the *right* side SATA port. There seems to be a bug in Jeff’s uBoot for GoFlex Net, so within uBoot only the right port works. That would be all and the GoFlex Net should now boot from the attached SATA disk.

Here are the logs from a successful SATA boot.

And my uBoot environment settings as well.

If you do not have a GoFlex Hard Disk, you can attach an external eSata disk to the GoFlex Net using these cables.

If you are having any trouble setting this up, leave a comment.