Unlocking the Huawei E585 MiFi 3G Device from Three UK, for free

MiFi is a wireless 3G access point, which allows several devices to use a 3G connection over Wireless. The Huawei E585 is sold by Three in the UK, and of course comes locked to the network.

There are different versions of the software on the device, but luckily (at the time of writing), the unlock code is stored unencrypted in the firmware in all current versions. You just have to read the code our from the device.

So, on to the unlock procedure. You will need either one, or two pieces of software (available below), depending on the firmware version. New devices require one extra step and the extra software, which is free.

Firstly, this procedure comes without warranty. The chances of you breaking anything are slim, but undertake everything at your own risk.

What you will need:

• A MiFi device, locked to Three (or another provider, however this has only been tested on Three)
• PSAS – Available HERE
• DC-Unlocker (for the newer software versions) – Available HERE
• Notepad – built in to Windows

Step 1, required for all versions:

The first thing you need to do, is plug in the MiFi device to your PC using a USB cable. Make sure that nothing is connected to the MiFi via wireless for all of the following steps . Let Windows automatically install the communication drivers.  If Autorun is disabled, manually run the autorun.exe file on the virtual CD drive that appears when you plug the MiFi in. These drivers are required for the following steps.

Confirm the drivers are all installed by unplugging, and plugging the device back in at least once. When the drivers and software are installed, put a different SIM into the MiFi & turn it on. Plug it in to your PC again using the USB cable.

At this point, a quick check in device manager (click start and type devmgmt.msc into the run/search box) should show some ports related to the MiFi which appear and disappear when you plug/unplug the device.

Make sure that the connection manager isn’t running (it may not be, but check the system tray near the clock just in case). Click the ‘Safely remove hardware’ icon in the tray too, and disconnect the virtual CD drive.

Step 2, required before step 3, for newer firmware versions only. Try step 3 FIRST, and come back here if you can’t read the EFS data. If you just received the device, the chances are that this step will be required, as your software will likely be the new version. (1026.11.64.18.505sp01 is an example of the new firmware version)

Install the DC-Unlocker client. After it has installed,  right-click the shortcut and choose “Run as administrator” if using Vista/Win7. XP users can just double-click it.

When the DC-Unlocker software opens, click the search (magnifying glass button). After a few seconds, you should have the details of your device listed in the software, as shown below:

If you don’t get a full reading, check again that device is on, the connection manager software isn’t running, and that the ports are showing in device manager. Having already unlocked my device using this method, the SIM Lock status above shows “unlocked”

Leave the software open just as it is, and move on to the next step.

Step 3, reading the firmware from the phone.

Install the PSAS (Phone System Analysis Software) tool from the link above. Run it as administrator from the right-click menu.

Choose “Hardware Forensics” from the menu at the top, and select “Use Mobile Ports”

From the dropdown I chose the selected option in blue, however some have reported the other “Com10” option worked for them. The port number may not be the same for you, but you should be able to identify the MiFi device port for yourself pretty easily. It will be one of a maximum 3 options.

For the baud rate, 115200, & 57600 allowed me to read the filesystem, but be warned that it takes around 5 minutes or so to complete.

Now click the “Diag Port” tab, and click the “Send” button. This should return a result similar to this:

If you don’t get a response similar to this, you may need to go through Step 2. If you followed Step 2 with success, try changing the port, or the baud rate and try again.

Next choose “Read EFS” & “Use alternate method” in the software as below:

Click the “lets go” button, and choose a filename and location for the firmware dump that you will locate easily (like Desktop).

The software will say “Please Wait…” and take several minutes to complete. Be patient. When the process is complete, “successfully read EFS” wil be displayed. If you have trouble and the software crashes, try setting the lines to 250, but this only works for older firmware with the unlock code that isn’t at the end. New firmware (SP01 in the version) needs the whole file. The whole file is around 742kb.

Step 4, finding the unlock code

For this step, you will need the file you read from the MiFi, and notepad to read the file. Open the file in Notepad Click start and type notepad into the run/search box). It may take a while for the file to open.

If you have the earlier firmware versions, the code can be found by using the “find” feature under the notepad edit menu. Search for PST, the number after PST is the unlock code.

For later firmware, the code is located at the and of the file, scroll to the bottom of the file with notepad maximised, as shown below (the code is 54951935 in this case)

Step 6, Entering the code

Connect to the MiFi with no other internet connections on your PC, and the Simlock page should show up. Simply enter the code.

Alternatively, type http://192.168.1.1/simlock.asp into the address bar and press enter.

If that fails, you can follow the instructions and use the software HERE.

The device will now reboot and is unlocked.

You will need to create a profile for the network providers and input the APN (including Three again) to connect to the internet.

Step 7, Adding network profiles

Make sure that you are connected to the MiFi, preferably by cable.

• Open http://3.home,  or Click http://192.168.1.1
• Find the section ‘Change Your Settings’
• Enter admin password (By default the password is ‘Admin’)
• Click Log In
• Click Advanced Settings > Connection Settings > Profile Settings > New
• ‘Profile Name’ – Anything you want (e.g. Vodafone )
• ‘Connection Number’- *99#
• ‘UserName’ – Your network operator’s username (See below)
• ‘Password’ – Your network operator’s password (See below)
• ‘Authntication’ – PAP
• APN – Your network operator’s APN (See below)
• IP Address – Dynamic
• Click Save > Continue > Advance Settings > Connection Settings > Connection Settings
• Select your new profile from the ‘Profile List’ drop down menu (e.g. Vodafone)
• Click Apply

Please see This page for APN settings.

If you want the MiFi device to work on 2G too (required in some countries, like T-Mobile USA), go to the following setting:

Advanced Settings > Mobile Network Settings > Network Settings > Select “3G Preferred > Apply

All that there is left to do is enjoy your unlocked MiFi Device!