Recently, while cleaning my flat, I found an old Huawei E3131 USB modem. I planed to throw it away, but then I reminded myself that this simple device, as virtually all modems, supports a primitive text based interface known as “AT commands”. And so I started thinking about spending a few hours of my time sending AT commands and figuring out what is actually possible. This post is the result of this few hours of hacking. Enjoy!
When I connected the modem to my PC it was immediately
recognized as both an USB Drive and an GSM modem.
dmesg revealed that three serial port
terminals where created at
To be honest I expected only a single
stty command on
some useful information, including
- before an option name means that this option is disabled.
Explanations for all options can be found in
-echo means that the characters that we
are writing, are not visible on the screen.
That is not very comfortable but can be changed easily
(you can try it yourself in bash by executing
stty echo to enable echo).
To connect to
ttyUSB0 I used
We need to create a
minicom configuration first.
For some reason
minicom was not
able to save it’s config file in my home directory and
insisted on saving it into
/etc/minicom/ and so I
have to run it with
minicom is like a journey to 80s,
entire UI is text based:
First we need to go into “Serial port setup” section:
and change “Serial Device” to
(to do this press A, change the field value and press either
Enter to save or Escape to cancel).
Then we need to change baud rate (press E):
On this screen press C and then Enter.
Next we need to go into “Screen and Keyboard” section and
enable echo (press Q) and then Enter:
We need to enable local echo (on the minicom side)
the serial port itself does not support it.
Then we need to return to the main menu (press Enter)
and select “Save setup as…” option. I saved
my config under
huawei2 name. Then we should choose
“Exit from Minicom”. If you chose “Exit” use Ctrl+A
followed by X to exit.
Now we can start
and execute our first AT command which is just
The modem should respons with
OK if everything works:
To find out what options are supported by my modem, I googled for “huawei e3131 at command interface specification” and found a PDF document describing supported AT commands. By the way AT commands are de facto standard and could be used with any modem.
TIP: To exit
minicom press Ctrl+A followed by X (must be upper case).
WARNING: In the following sections I assume that we inserted a working SIM card into the modem.
Obtaining information from the modem
We can obtain a lot of information about our modem and the SIM card just by running AT commands. For example we may ask the modem for its phone number:
(“NUMER WLASNY” is “MY OWN NUMBER” in Polish), or for its IMEI number:
To read a modem flag or a setting we need to run a command
For example to obtain the character set used by the modem
To check what values are acceptable for this flag
we run a command in
And to set flag/setting value we execute
a command in
AT+CMD=value format like
Network signal strength can be checked using
The response has format
+CSQ: signal-strength, error-rate.
Signal strength varies from 31 (very good)
to 0 (very poor / lack of signal).
In my case bit error rate is not supported (99) by the modem.
AT+COPS command allows us to check the
current network and to get a list of
the present networks:
Sending USSD codes
USSD codes (short codes) like “*100#” are quite useful,
we can use them to check money amount on our account or
to change the current tariff.
Let’s see how to send them using AT commands.
First hurdle to overcome is
the encoding used while sending an USSD code.
By default the codes must be encoded using
GSM7Bit encoding, which is not
related to 7-bit ASCII in any way.
I couldn’t find any online encoder/decoder for this
encoding, but fortunatelly
I found a pice of code that does exactly what we want:
And so I added a
main method and pasted the code to
to obtain an online converter.
You can see the final, “paste ready” code
*100# in GSM7Bit gives us
Now we may issue our USSD request using
1 (first value in the request) means that we want to see the response,
15 (the last value) is the encoding type that we are using.
Next we need to use our GSM7Bit decoder to obtain plain text from the network response (in Polish):
Sending and receiving SMS
Our next step will be to send and to receive an SMS:
Before we send a message we must switch to the text mode,
which can be done by issuing
The default mode is the PDU mode, which requires
creating and parsing PDU binary frames.
To send an SMS
AT+CMGS="phone-number" command is used.
AT+CMGS, a command prompt (
appear allowing us to write our message.
When we are done we press Ctrl+Z,
few seconds later the message will be delivered.
To list received and sent messages we can use
Remember to run this command in the text mode (
otherwise you will see hex encoded binary PDU frames.
First value in the row is the message index (
We may use this index to either read the message:
or to remove it:
Playing with the phone book entries
AT+CPBR command can be used to read SIM card phone book entries:
AT+CPBR=? returns supported range of indexes (
(1-250); some of them
may be empty), max. phone number length (
40) and max.
entry name length (
Using this information we may read phone book entries using
When the phone number starts with
+ its type is
otherwise its type is
Adding a phone book entry is very simple:
The same command can be used to remove a phone book entry:
RING RING RING
AT commands can also be used to make and receive phone calls.
Voice is send/received in WAVE format.
Unfortunately I cannot obtain even a simplest
from my modem.