Introduction⌗

The Huawei E3372 is a popular and quite cheap 4G LTE stick. The on-board LTE Cat 4 modem supports up to 150 MBit/s in download and up to 50 MBit/s in upload. It has a fallback on (DC-)HSPA(+), UMTS and EDGE when needed. The whole package is rounded off by small handy dimensions (88m x 28mm x 11.5mm).

But as usual there is a footgun on purchasing the E3372 for your desired use case:

  • E3372h-xxx are shipped with “HiLink” firmware (version 22.x or newer). The LTE-stick appears as an Ethernet device, with own DHCP server, and runs a web portal on 192.168.8.1 for configuration and stats. This includes the fact that it’s “NATting” for you and has a built-in firewall, which is not configurable at all.
  • E3372s-xxx are shipped with a so called “Stick” firmware (version 21.x). The LTE-stick appears as two USB serial devices. One of them has an AT-interface that can use both PPP (slow) and NCM (faster). In this mode, the created interface displays the IP address assigned by the mobile network directly without NAT.

You want your E3372 in Stick-mode or Modem-mode if yourr plan includes Gammu or connecting it to a MikroTik router.

WARNING: Don’t buy the E3372h-320 for flashing, it’s not possible to replace the firmware on this new hardware revision anymore!

Disassembled E3372-320 Stick
Disassembled E3372-320 Stick

Flashing the Modem Mode Firmware⌗

  1. The first step is to prepare the necessary flashing software. You can either clone the two repositories and compile them with make or download pre-compiled linux binaries directly.

    Pre-Compiled Packages:

    In order to compile the software yourself, simply follow these steps:

    1. To be able to compile the code, a few dependencies needs to be installed:

      sudo dnf install -y gcc zlib-devel

    2. Balong-usbload is an emergency USB boot loader utility for Huawei LTE modems and routers with Balong V2R7, V7R11 and V7R22 chipsets. It loads external boot loader/firmware update tool file (usbloader.bin) via emergency serial port available if the firmware is corrupted or boot pin (test point) is shorted to the ground.

      git clone https://git.zaage.it/robert/balong-usbload.git
cd balong-usbload
make

    3. This program is used to flash BIN and EXE firmware files to the device in download mode. It also supports flashing separate firmware components from selected directories.

      git clone https://git.zaage.it/robert/balong-flash.git
cd balong-flash
make

  2. Now we physically open the LTE stick with a knive and use the “needle method” as demonstrated in this picture to get it in flash mode.

    Disassembled E3372-153 Stick
    Disassembled E3372-153 Stick

    This is what the stick looks like disassembled.

    Needle Method
    Using the needle method for flashing

    Plugging the stick into the USB port effectively shorts a test point on the stick’s circuit board to ground. Watch your device manager or syslog for a newly detected USB serial port.

  3. Then use the balong-usbload utility to put the stick into a special non-persistent download mode (note the use of sudo, the balong utilities must run as root):

    sudo ./balong-usbdload -p /dev/ttyUSB0 usblsafe-3372h.bin

    Of course you have to use the correct ttyUSBX device (try lsusb, e.g. in your case it could be ttyUSB1 or ttyUSB2).

  4. After that, the stick’s LED should blink and the technical firmware can now be flashed to it using balong-flash utility:

    sudo ./balong-flash -p /dev/ttyUSB2 E3372h-153_UPDATE_21.180.01.00.00.BIN

    Note that the actual ttyUSBX device may have changed from the previous step.

    You can find different firmware versions on the net, but for convenience I leave you a working one here:

    Huawei_E3372h-153_21.180.01.00.00_Firmware_general.zip

Congrats, now you have a patched a E3372h stick to E3372s non-HiLink!