How To Create EHI Files: A Complete HTTP Injector Payload And SSH Configuration Guide

Creating an EHI configuration file requires combining an active SSH server credential set, a functional remote proxy, and a tailored HTTP request payload or SNI hostname to direct data traffic through custom network paths. By structuring specific header parameters within HTTP Injector and applying export security controls, users can package operational network tunnels for immediate deployment across mobile devices. Mastering this build process optimizes mobile data routing, enables bypass of restrictive NAT gateways, and delivers persistent connection stability.

Prerequisites & Technical Requirements for EHI Generation

Building an operational EHI (Evozi HTTP Injector) file requires systematic gathering of remote server parameters, custom header attributes, and client-side software dependencies. Before opening the configuration workspace, compile all necessary connection vectors to prevent handshaking timeouts and protocol mismatches.

System & Infrastructure Dependencies

• Host Application: HTTP Injector application (Android architecture v5.0 or higher) installed on the reference device.
• Remote SSH/SSL Server: An active Secure Shell account providing a Host IP or Fully Qualified Domain Name (FQDN), Port assignment (Standard OpenSSH port 22, Dropbear port 109/143, or SSL/TLS port 443), Username, and Password authentication.
• Target Bug Host / SNI Hostname: A functional carrier zero-rated host or Content Delivery Network (CDN) edge domain that passes initial host header validation.
• Remote Proxy Server: An open or private Squid/HTTP proxy matching the IP geographical region of the target network gateway (commonly on ports 80, 8080, 3128, or 8888).
• Benchmark Configuration Window: 10 to 15 minutes for parameter entry, payload syntax compiling, line state validation, and export packaging.

Step-by-Step EHI File Generation & Payload Configuration Workflow

Step 1: Provision Active SSH and Tunneling Credentials

Establishing a encrypted socket tunnel requires active credentials hosted on an SSH server. Register or deploy an SSH server instance through standard administrative platforms or third-party SSH providers. Note the exact protocol parameters provided during account creation: server hostname or IP address, authentication port (Dropbear or OpenSSH), user identifier, and system password. Secure a server close to your target physical location to minimize TCP round-trip latency (RTT).

Step 2: Formulate the HTTP Payload or SSL/TLS SNI Identifier

The payload acts as the header injection script that manipulates the initial HTTP request sent to the gateway. HTTP Injector provides a Payload Generator interface to automate syntax creation.

1. Open HTTP Injector and navigate to the Payload Generator tool from the primary menu.
2. Enter your validated Bug Host or carrier domain into the URL/Host input field.
3. Select the Request Method. Use CONNECT for standard proxy tunneling, or select GET / POST if your network carrier requires explicit web-page request signatures.
4. Set the Injection Method. Choose Normal for standard header injection, Front Inject to position the fake host header before the real target, or Back Inject to append the header after initial connection setup.
5. Check mandatory HTTP Header flags: select Keep-Alive to maintain persistent TCP sockets, User-Agent to emulate browser traffic, and Forward-Host (or Online-Host) to rewrite destination routing headers.
6. Select Generate Payload to compile the raw text string into the primary payload workspace.

For SSL/TLS (Stunnel) connection modes where HTTP headers are ignored, bypass the Payload Generator. Set the connection method to SSL/TLS (Direct) and enter the Bug Host directly into the Server Name Indication (SNI) field.

Pro-Tip: Ensure payload strings explicitly include carriage return line feed breaks (represented as CRLF) between header keys. Missing CRLF breaks cause remote proxy parsing failures and immediate 400 Bad Request status drops.

Step 3: Configure Remote Proxy and Port Parameters

If using standard SSH or Direct Proxy modes, map the client connection to an intermediate proxy capable of forwarding raw socket frames.

1. Tap the Remote Proxy menu item on the main dashboard.
2. Input the target Proxy Host IP address and corresponding port number (e.g., 192.168.1.1:8080).
3. If using an external public proxy, run a host check inside the application menu to verify that the remote proxy supports CONNECT methods and returns an HTTP/1.1 200 Connection Established state.

Step 4: Input SSH Credentials in Application Settings

Link the payload and proxy pipeline directly to your SSH tunnel account.

1. Open the drawer menu and select SSH Settings.
2. Input the exact IP address or domain name into the SSH Host field.
3. Enter the target port into the SSH Port field (use 22 for OpenSSH, 109/143 for Dropbear, or 443 for SSL-encapsulated SSH).
4. Fill in the Username and Password fields under authentication parameters.
5. Enable Data Compression to reduce header overhead and select DNS Forwarder to prevent carrier-level DNS hijacking.

Step 5: Execute Connection Test and Inspect Log Terminal

Before packaging the file, validate that the handshake successfully negotiates authentication levels and upgrades protocols.

1. Return to the main view and tap Start.
2. Instantly switch to the LOG tab to monitor the connection sequence.
3. Observe the TCP handshake trace. A successful setup proceeds from IP socket establishment, through HTTP header injection, to an HTTP/1.1 200 OK or 101 Switching Protocols status code, ending with SSH Shell Established and Connected.

Warning: If the log displays HTTP/1.1 302 Found or 403 Forbidden, the Bug Host host header is being rejected or redirected by the carrier firewall. Disconnect immediately and update the host parameters before proceeding to export.

Step 6: Export and Secure the EHI File

Once a stable connection is confirmed, package the configuration into an encrypted .ehi format to protect credentials and distribution logic.

1. Tap the top-right menu icon (three vertical dots) and select Config, then Export Config.
2. Specify a clear filename ending automatically with the .ehi extension.
3. Enable Lock Config to prevent end users from inspecting or modifying payload strings, proxy settings, and SSH accounts.
4. Apply security restrictions as required: set an Expiration Date to auto-invalidate stale SSH accounts, enable Block Root Access to prevent hardware tracing on unlocked devices, or enforce a Password requirement for importing.
5. Input any operational notes or operator instructions into the Note/Message field.
6. Tap Export File. The finished EHI file is saved into the default application directory, ready for network deployment.

Technical Specifications & Protocol Matrix

Selecting the appropriate connection mode inside HTTP Injector depends on carrier firewall inspectability, protocol restrictions, and socket performance targets. The table below outlines standard operational parameter combinations used when creating EHI configurations.

Common Connection Failures & Field Fixes

Error Scenario 1: HTTP Status Code 302 Found / 403 Forbidden Error

• Root Cause: The target carrier gateway detected an unauthorized or invalid Bug Host header, triggering a HTTP redirect to a payment landing page (302) or dropping the packet entirely (403).
• Actionable Fix: Replace the current host domain in the Payload Generator with an active, zero-rated CDN domain or sub-domain belonging to the specific mobile network. If using HTTP Proxy mode, switch the injection type from Normal to Front Inject or move directly to SSL/TLS SNI mode using Port 443.

Error Scenario 2: Connection Timeout / Socket Failure on Port Attempt

• Root Cause: The selected SSH server port is blocked by the upstream Internet Service Provider (ISP), or the Remote Proxy server has gone offline.
• Actionable Fix: Open SSH settings and switch the port from default port 22 to Dropbear port 143 or SSL port 443. If using a remote proxy, verify the proxy IP status via an external ping utility or replace it with a fresh Squid proxy located on the same subnet as your SSH server.

Error Scenario 3: SSH Authentication Failure (Auth Failed Key Error)

• Root Cause: SSH login credentials have expired, maximum connection limits per IP address have been reached, or typographical errors exist within the SSH user/password fields.
• Actionable Fix: Re-register the SSH account on the designated server panel to refresh access tokens. Ensure that the username includes any mandatory server prefixes generated during account setup.

Error Scenario 4: EHI Configuration Fails to Import or Unlocks Prematurely

• Root Cause: Device architecture incompatibility, application build version mismatches between exporter and importer, or target device root detection triggers.
• Actionable Fix: Update all deployment hardware to the latest stable release of HTTP Injector. When exporting, uncheck "Block Root Access" if deploying to custom Android ROMs or developer environments, and verify that the local system time matches UTC standards to prevent false expiration triggers.

Frequently Asked Questions

What is an EHI file and how does HTTP Injector utilize it?

An EHI file is a proprietary, encrypted configuration file created specifically for the HTTP Injector Android application. It packages complex network instructions—including HTTP payloads, remote proxy settings, SNI targets, and SSH credentials—into a single file that can be imported to establish secure tunnel connections without manual user configuration.

Can I generate a working EHI file without using an SSH account?

No, an EHI file requires a functional backend tunnel server to process and forward data traffic. While you can build the payload structure independently, the HTTP Injector app requires either an active SSH, Shadowsocks, V2Ray, or OpenVPN server backend to establish an encrypted data tunnel across the network interface.

How do I identify a working Bug Host or SNI domain for my target network?

Working Bug Hosts are identified by analyzing domains that remain accessible on the target carrier network when account balances are zero. Network administrators and security testers locate these hosts using DNS enumeration tools, host header inspection utilities, or network packet analyzers to find domain endpoints that return HTTP 200 OK responses without requiring active data billing.

How do I secure my EHI file so secondary users cannot extract my payload syntax?

To prevent unauthorized access to payload strings and server details, open the Config Export screen in HTTP Injector and enable the Lock Config option. Additionally, check the options to block root access, assign a strong import password, and set an explicit expiration date to ensure configuration data remains protected.

Why does my custom EHI connection disconnect automatically every few minutes?

Periodic disconnections typically point to aggressive aggressive carrier TCP keep-alive timeouts, high server load, or mobile device battery optimization killing the background socket service. To resolve this, enable the Keep-Alive option within the Payload Generator, toggle the Power Saving Exclusion setting for HTTP Injector in Android system settings, and set the SSH Pinger interval to 10 seconds inside application options.

Elevate Your Network Architecture Strategy

Deploying custom EHI configurations provides precise control over data encapsulation, routing protocols, and mobile gateway transport efficiency. Maintain operational stability by regularly auditing active SSH accounts, rotating target SNI endpoints, and enforcing updated encryption standards across all exported configuration builds.