Flashing a Huawei E3372h 4G LTE stick from Hilink to Stick mode

The Huawei E3372 is quite a popular LTE stick: it’s widely available (in retail stores, on eBay and also in branded variations, eg. “Telekom Speedstick V”, “Megafon M150-2”) and rather affordable (currently starting at €60 in Germany). It features a LTE Cat 4 modem supporting up to 150 MBit/s download and up to 50 MBit/s upload speeds, falls back to (DC-)HSPA(+), UMTS and EDGE, if necessary, and has quite small dimensions (88m x 28mm x 11.5mm).

The bad news is that the E3372 comes in one of two variants:

  • with a “Hilink” firmware (version numbers 22.x) the stick appears to the USB host as an Ethernet device, runs an own DHCP server and provides a Web interface at the IP address 192.168.8.1 to control its router operation. This also means it will do the network address translation (NAT) for you and has some sort of firewall, which, at least in the version I had (see below) was not configurable at all. Sticks that come with the Hilink firmware seem to carry the model code E3372h-xxx.
  • with a “Stick” firmware (version numbers 21.x) the stick appears to the USB host with two USB serial devices one of which exposes an AT-style interface over which both PPP (slow) and NCM (Network Control Model, part of the USB implementers forum Communications Device Class (CDC) class of protocols for providing Ethernet-over-USB style networking, faster) modes can be employed. In this mode the interface created exposes the IP address assigned by the mobile network directly, ie. there is no NAT. Sticks that come with the stick firmware seem to carry the model code E3372s-xxx (but see below).

Hilink mode is practical for most users because they likely need no special drivers to use the LTE stick but it’s disadvantageous if you want to provide services to the Internet. Unfortunately you can’t see from the outside whether you get a E3372h or a E3372s unless you can slide the stick’s cap off to access the SIM slot (see the gallery). It is, luckily, possible to flash a stick with the respective opposite kind of firmware, eg. a Hilink firmware stick with a Stick firmware and vice versa. However this process can get a bit cumbersome as quite a lot of information on the Web is incomplete, outdated or in a foreign language.

The stick I bought carried the following version information:

Model code E3372h-153 E3372h: Apparantly sold with Hilink firmware, E3372s: Apparantly sold with stick firmware (but see below)
E3372x-yyy: Apparantly a region-specific code, couldn’t find its exact meaning however
Hardware version CL2E3372HM The HM indicate it’s a E3372h whereas SM would mean it’s a E3372s.
Software version 22.200.15.02.1217 All Hilink firmwares use a 22.x version number.
Web UI version 17.100.12.01.1217 The Web UI gets flashed separately from the Hilink firmware (first the Web UI, then the Hilink firmware). With a stick firmware the Web UI is inactive.

The following describes the steps that did not work for me to flash a stick firmware and those that did. Note that my stick wasn’t SIM-locked or anything and I didn’t flash from stick to Hilink firmware, so I didn’t need an unlock code or something like that.

What did NOT work for me

  • Instructions that report that mode switching would be a simple as accessing an URL such as http://192.168.8.1/html/switchProjectMode.html. As this finnish blog post points out, this appears to have worked with older E3372s versions only. Note that this seems to imply that there were E3372s versions with Hilink firmware, too.
  • Sending a specially crafted XML packet to the Hilink API as described in Ivan’s post gave me just a pretty useless error message.
  • Flashing under Windows 10. Something changed in between 7 and 10 that hinders almost all flashing tutorials given. I had to explicitly install Windows 7 on a spare SSD to get further (but then flashing didn’t work for other reasons). Your mileage may vary.
  • The flash instructions given eg. in said blog post and others such as in the widely distributed E3372h-Nadelmethode-mmtk.rar (involving Huawei official .exe files) and those given in this internet-sim.at blog post (using a Huawei_Flasher_v2.exe) did not work either. I kept receiving Code 13 error messages.

What worked for me

Following the first four steps from this lteforum.at post, which have the advantage that they work without a Windows installation as well:

  1. I cloned the forth32/balong-usbdload and forth32/balongflash repos from Github and compiled the software (which is pretty easy, given it has no special requirements).
  2. I physically opened the LTE stick and used the “needle method” as demonstrated in this YouTube video by a clever Russian: you effectively shorten a test point of the stick’s PCB to Ground when plugging the stick into the USB port which seems to put it into some special bootloader mode. Watch Windows’ device manager resp. syslog for a newly detected USB serial port.
  3. I then used the balong-usbdload utility to put the stick into a special, non-persistent download mode (note the use of sudo, the balong utilities need to run as root): sudo balong-usbdload -p /dev/ttyUSB0 usblsafe-3372h.bin. Of course you need to use the right ttyUSBX device (try lsusb, e.g. it might be ttyUSB1 or ttyUSB2 in your case).
  4. Afterwards I could flash the stick firmware with balong_flash: sudo balong_flash -p /dev/ttyUSB0 3372h-153_UPDATE_21.180.01.00.00.BIN (taken from this a bit confusing lteforum.at page, look for the link “E3372h-153 21.180.01.00.00 general”). Note that the actual ttyUSBX device might have changed from the previous step, I’ve been told the balong-usbload utility might interfere here.

And that’s it! Note that I didn’t select that particular stick firmware version intentionally. I haven’t found a changelog of some kind between the different firmware revisions yet.

EDIT 21-Nov-2017: Added the missing -p option to the balong-usbflash command as well as the use of sudo. Thanks to Benjamin Berger for notifying me.

EDIT 14-Jan-2018: Reflected renamed balong utilities. Thanks to Josef Hölzl for notifying me.

EDIT 13-Jul-2018: Added more information on the meaning of the hardware version thanks to William Poetra Yoga.

EDIT 07-Oct-2018: Added info on what link to look for on the lteforum.at page.

EDIT 29-Sep-2020: Added info that the actual ttyUSBX might change after balong-usbload. Thanks to Torsten Neumann.