Hg8145v5 Unlock New! — Huawei

You can post this on DSLReports, TechKings, Reddit (r/ONU), or Huawei-Fibre forums.

📦 Useful Tools (search online)

  • Huawei Enable Telnet (exe)
  • Huawei XML Decryptor (Python)
  • HG8145V5 shell.bin (for R019/R020)
  • ONT firmware upgrade tool (for flashing unlocked firmware)

Troubleshooting Common Issues

  1. I see garbage text in the terminal: Your baud rate is wrong, or TX/RX are not connected correctly.
  2. The router won't boot after U-Boot changes: You need to reset the environment variables. In U-Boot, type default_env then saveenv then reset. This restores factory defaults.
  3. Firmware upgrade failed: The router likely has a "digital signature" check preventing third-party firmware. This is common in newer V5 units. You may need to stick with the hardware exploit to extract the password instead of changing the OS.
  4. Login fails with known password: Some ISPs implement a "lockout" timer. Wait 10-15 minutes before trying again.

2. The Challenge of Access Control

The primary barrier for users is the authentication system. The HG8145V5 typically has two levels of access:

  • User Account: Usually user / user or admin / admin. This level allows basic Wi-Fi password changes but restricts critical WAN and VLAN settings.
  • Super Admin Account: This account (often username telecomadmin or root) has full control over the device.

The Problem: ISPs routinely change the default Super Admin passwords from the factory default to a custom string. In some cases, the password is generated dynamically based on the device's MAC address (via an algorithm) or the device's Serial Number (SN). On the HG8145V5, gaining this access is the first step of "unlocking."

Step 3: Bypassing Configuration (The "Unlock")

There are two main approaches here.

Method A: Booting into a failsafe/generic mode (Often works on V5) You can try to force the router to load a default configuration by changing the boot arguments. This tricks the router into thinking it is booting for the first time or ignoring the ISP's encrypted config.

Input this command (syntax may vary slightly based on U-Boot version):

setenv bootargs console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=squashfs

(Note: /dev/mtdblock2 is an example. You must verify which block is the root filesystem using printenv.) huawei hg8145v5 unlock

A safer, more common trick for Huawei V5 devices is modifying the WAP mode variable:

setenv sw_standby 0
saveenv
reset

Or forcing the router to accept a firmware update:

setenv update_mode 1
saveenv
reset

Method B: Dumping the Configuration (Advanced) If the above does not work, you can use the bootloader to read the memory where the password is stored. You can post this on DSLReports, TechKings, Reddit

  1. Identify the config partition address (e.g., 0x...).
  2. Use the md (memory dump) command to read that address.
    • Example: md 0x80000000 0x10000
  3. You would then need to scroll through the hex dump to find the string telecomadmin followed by a password string. This requires patience and knowledge of Hex/ASCII conversion.

If root password is unknown (common on V500R020):

You need to decrypt the hw_ctree.xml file. Method:

  1. Backup config from web UI.
  2. Use aes_decrypt_tool (Huawei XML decryptor) – search online.
  3. Look for X_HW_WebUserInfoInstance – extract Password for user root.

Phase 3: The Hardware Method (UART/TTL Serial)

This is the most effective method for the HG8145V5. It involves connecting directly to the router's motherboard to interrupt the boot process.

Phase 1: Understanding the Lock

When you attempt to access the web interface (usually 192.168.100.1), you are typically presented with two user levels: 📦 Useful Tools (search online)

  1. User: (Username: user / Password: varies). Limited access to basic Wi-Fi settings.
  2. Super Admin: (Username: telecomadmin or admin / Password: unknown). Full access to all settings.

ISPs change the default Super Admin password to prevent users from misconfiguring the network. The goal of unlocking is to regain access to this Super Admin account or to flash generic Huawei firmware.

Step 3: Use a Config File Decoder

This is the most reliable method:

  1. Back up your configuration from Management -> Device Management -> Backup Configuration.
  2. The file is backupsettings.conf (encrypted).
  3. Use a tool like Huawei XML Encrypt/Decrypt Tool or Online Huawei Config Decoder (search GitHub).
  4. Decode the file and search for http://192.168.1.1:8080/ or 0x00000000 passwords. You will find the root or telecomadmin plaintext password.