Modifying Huawei B593u firmware images using FMK

Nothing special here in my opionion, but I've seen few comments saying that FMK doesn't work with Huawei B593u. Just follow instructions below and you end up with normal firmware image having one important difference - you can telnet in as admin from LAN side of device.

This is for latest T-Mobile firmware SP106, but adjust firmware identifiers and it'll work for others as well.

# Install some tools needed
sudo apt-get update
sudo apt-get -y install git build-essential zlib1g-dev liblzma-dev python-magic zip unzip

# Download and compile fmk
mkdir -p ~/fmk
cd ~/fmk
git clone https://code.google.com/p/firmware-mod-kit/
cd firmware-mod-kit/src
./configure
make

# Download and unpack B593u firmware
mkdir -p ~/fmk/106
cd ~/fmk/106
wget "http://hilfe.telekom.de/dlp/eki/downloads/Speedport/Speedport%20LTE%20II/Firmware_Speedport_LTE_II_B593u-12_V100R001C748SP106.zip"
unzip Firmware_Speedport_LTE_II_B593u-12_V100R001C748SP106.zip
tar xvf V100R001C748SP106.tar.bz2 

# Extract trx
~/fmk/firmware-mod-kit/extract-firmware.sh B593.trx 

# Make backup of file we're going to patch
cp -a fmk/rootfs/bin/cms fmk

# Allow inbound telnet from LAN
# Make sure your replacement string is exactly same length as original!
sed fmk/rootfs/bin/cms -i \
    -e's|iptables -A INPUT_SERVICE -p tcp  --dport 23 -j DROP 2>/dev/null|iptables -I INPUT -s 192.168.1.0/24 -j ACCEPT ##################|g'

# Check that original and modified binaries are same size but have different date stamps
ls -l fmk/cms fmk/rootfs/bin/cms

# Remove some unnecessary files to shrink squashfs image and keep fmk happy
rm -f fmk/rootfs/sbin/mkntfs

# Update version string in headers so device already running SP106 will accept our customized version
sed -i.bak fmk/image_parts/header.img \
    -e's|V100R001C748SP106\x00\x00\x00|V100R001C748SP106hax|g'

# Rebuild trx
~/fmk/firmware-mod-kit/build-firmware.sh

# Create new firmware archive
mv fmk/new-firmware.bin B593.trx
chmod 0644 B593.trx modem.bin help.tar.bz2 B593-small.trx
tar --owner=LTECPE --group=LTECPE -cvjf V100R001C748SP106_TELNET.tar.bz2 B593.trx modem.bin help.tar.bz2 B593-small.trx

# Cleanup
sudo rm -rf fmk

Done, upload V100R001C748SP106_TELNET.tar.bz2 to your router

After firmware upgrade simply telnet from LAN to 192.168.1.1. Usually first attempt fails with connection refused but try again after few seconds and it'll work. Login as "admin" with password "HW4GCPE". When in ATP prompt type "shell" to open root shell.

Almost same procedure works for B593u-91 although as I don't have u91 resulting firmware has not been tested.

mkdir -p ~/fmk/u91
cd ~/fmk/u91
wget https://www.dropbox.com/s/ij2npnp6klweaxa/u91_r%2Bm%2Bh%2Bs.tar.bz2
tar xvf u91_r+m+h+s.tar.bz2
~/fmk/firmware-mod-kit/extract-firmware.sh B593.trx 
cp -a fmk/rootfs/bin/cms fmk
sed fmk/rootfs/bin/cms -i \
    -e's|iptables -A INPUT_SERVICE -p tcp  --dport 23 -j DROP 2>/dev/null|iptables -I INPUT -s 192.168.1.0/24 -j ACCEPT ##################|g'
ls -l fmk/cms fmk/rootfs/bin/cms
rm -f fmk/rootfs/sbin/mkntfs
sed -i.bak fmk/image_parts/header.img \
    -e's|V100R001C00SP053\x00\x00\x00|V100R001C00SP053hax|g'
~/fmk/firmware-mod-kit/build-firmware.sh
mv fmk/new-firmware.bin B593.trx
chmod 0644 B593.trx product_info modem.bin help.tar.bz2 B593-small.trx
tar --owner=LTECPE --group=LTECPE -cvjf V100R001C00SP053_TELNET.tar.bz2 B593.trx modem.bin product_info help.tar.bz2 B593-small.trx
sudo rm -rf fmk