Huawei EC150 3G USB Modem Unlocking – Complete Guide – Trusted Method
Disclaimer: This document is intend to show the way how to unlock a Huawei EC150 USB Modem / or a CDMA Mobile device. Methods presented here are tested on a specific models and won’t work or no need to work on all models. Do the unlocking process at your own risk. I am not responsible for any damage cause to the device or loss.
For unlocking Huawei EC150 you’ll need the following Tools & Softwares:
- DFS 22.214.171.124 - CDMA Reprogram, flashing software.(www.cdmatool.com)
- IDM UltraEdit v.17.0.XXX (www.ultraedit.com)
- EC150Update_11.104.04.00.114.B416.exe – Firmware Update (Incase you need to update the firmware, Not necessary if you don’t want to update)
- CDMA Workshop 2.7.rar – Reprogram, Flashing (www.cdma-ware.com) (www.filecrop.com)
- EC150 Drivers – (to install the device without operators dashboard)
- Mobile_Partner_11.302.09.01.539_Voice_USSD – Dashboard for setting up the connection.
Preface: The Standard freeware and tools that available on the internet won’t work on this device because this device has no IMEI Number instead of that it has a MEID number. So you cannot calculate the unlock code based on an MEID. The Standard methods presented for Huawei USB Modems won’t work on this device. You cannot able to update the firmware without SPC Code. So I hereby presented the other way used to read the code from the memory dump.
Finding out the SPC (Service Programming Code) of your device:
- Plug in your Huawei EC150 device to the PC.
- I assume that you’ve already installed the drivers, if you’re not done already install the drivers with original software comes with the device.
- After installing the device the system will auto detect and run the User Interface of your service provider.
- Just Close the Application, Do not Shutdown the device. (See Fig 1.1)
Note: Normally EC150 will connect to the system by using the following 3 COM Ports.
- Modem Device
- Application Interface
- PC UI Interface (this one is used to run the operators application.)
We are not going to use the PC UI Interface port here to unlock the device.
- Install DFS 126.96.36.199 on your PC and disconnect your Internet connection. (If any)
Because the DFS 188.8.131.52 checks for an online account, there is no need to run the DFS online and the demo mode is enough for this process.
Fig 1.2 The DFS User Interface without connecting any device
1. DFS User Interface Explained:
1.1 On top of the Interface you will see a “Ports” Command button to detect the connected ports.
1.2. After that you see a connection icon to connect or disconnect a specific port. Mouse Roll or Double click on the port you want to connect.
1.3. Below that you see a button named “SPC” used to type & send SPC codes to the device.
1.4. On the right side of the SPC You see a “PWD” which is a standard PWD for all devices. Usually 16 digits of Hexadecimal value, you can change it into “00000000000000000”
1.5. After that you see a “CMD” which is used to send “AT COMMANDS” to the device. You can find and use an ATsimulator.ini to know the AT COMMANDS of your device (search the directory where you installed the Service Providers Software.)
Note: The AT Commands may vary for each model. Make a Google search for AT Commands.
1.7. On the Right side of the application window you see “Reset” icon which is used to change the mode of the device.
- Offline D – Device is offline Dead mode
- Offline A – Device is offline Active Mode
- Reset – Device will disconnect and will automatically connect again.
- FTM – File Transfer Mode (for CDMA Mobile phones)
- Radio on – Turn on Radio Frequency
- Radio off - Turn off Radio Frequency
- Power off – Device will shutdown (Unplug the device and Plug it Again)
- Data Mode – Device will go online.
- Rebuild – Restore Device to Factory Settings.
1.8. You can see various Tabs that used to READ, WRITE and Reprogram the Device
1.9. On below of the application you see a message box which shows you the response of the device & ports.
1.10. After Connecting a port the software will try to retrieve the device information and show it to you on the front panel.
- Connect the “Huawei Mobile Connect - Application Interface” Port (See Fig 1.3)
- Go to Memory Tab and change the Type to “CEFS” and press Read. The Software started to read the memory
- Send a false code (any six digits) to the Device by using the SPC Button.
- The device will show you an error “BAD SPC UNLOCK FAILED” and the device will go to offline for few seconds. During this period the software will read the SPC Code.
- Immediately Press the “Save Buffer” Button. (Choose a path to save that memory dump file)
- Save that dump file to your hard disk. Most of the case the file size should be 228 KB
- Open the file with data analyzer and press “Analyze”
- Now the Data Analyzer will analyze the data and show you the Results in the result text box. You’ll see the contents in the Data monitoring page.
- Click on SPC1 and press the memory address listed right to the SPC1.
- The first six digits is the SPC code of your USB Modem. Note down the ASCII Value.
- Type it on the SPC and send it to the device (See fig 1.4)
- Now you see the “DEVICE UNLOCKED” Message on the bottom of the message box.
Now you’re Done Unlocking the device. Reprogram the device with other tabs presented on the software.
2. Another Method to Find SPC from Memory Dump Using UltraEdit:
- Open the dump file with UltraEdit text editor.
- Find the Hexadecimal string 00 00 00 38 35 6E FF 01 (it will work for other models also). Other models you’ve to find out …85nÿ on the ASCII section.
- The six digit hexadecimal value next to this string is the SPC code. (See fig 2.1)