User comments on ISPs
  >> EE (Everything Everywhere) and Orange


Register (or login) on our website and you will not see this ad.


Pages in this thread: 1 | 2 | (show all)   Print Thread
Standard User glossywhite
(member) Tue 15-Jul-14 18:52:32
Print Post

[NEW] Bright Box 2 hacking


[link to this post]
 
So, I've finally got a Bright Box 2 to hack laugh

Here's the start of the hacking - I found the serial header and took a boot log:

HELO

CPUI

L1CI

HELO

CPUI

L1CI

DRAM

----

PHYS

STRF

400H

PHYE

DDR2

SIZ4

SIZ3

SIZ2

DINT

USYN

LSYN

MFAS

LMBE

RACE

PASS

----

ZBSS

CODE

DATA

L12F

ROMM

====

HELO

ZBSS

RAMM

====

Copyright (C) 2013 Arcadyan Technology.



NANDFLASH:

DEVICE ID: 0x92f1809540, size: 131072KB, type: SLC

block: 128KB(1024), page: 2KB, oob: 64Bytes

nandflash_bbt_scan_block: detect bad block marker @ 0x7fe0000

NANDFLASH:

DEVICE ID: 0x92f1809540, size: 131072KB, type: SLC

block: 128KB(1024), page: 2KB, oob: 64Bytes

nandflash_bbt_scan_block: detect bad block marker @ 0x7fe0000



NVRAM(0) MAGIC checking passed!

NVRAM(0) CRC checking passed!

total 5 of NVRAM(0) entries loaded



NVRAM(1) MAGIC checking passed!

NVRAM(1) CRC checking passed!

total 8 of NVRAM(1) entries loaded

env_delenv bootcmd:1



BOOTLOADER version 0.0.9 for BrightBox2

Build Date: Thu Aug 8 18:14:37 2013 (brian_chang@BuildBed)



Chip ID: BCM63168D0, MIPS: 400MHz, DDR2: 400MHz, Bus: 200MHz

Memory Test Passed!

Total Memory: 134217728 bytes (128MB)



Total memory used by CFE: 0x87500000 - 0x876260F0 (1204464)

Initialized Data: 0x87522F60 - 0x87523610 (1712)

BSS Area: 0x87523610 - 0x875240F0 (2784)

Local Heap: 0x875240F0 - 0x876240F0 (1048576)

Stack Area: 0x876240F0 - 0x876260F0 (8192)

Text (code) segment: 0x87500000 - 0x87522F2C (143148)

Boot area (physical): 0x074BF000 - 0x074FF000

Relocation Factor: I:00000000 - D:00000000

Board IP address 192.168.1.1

Board IP netmask 255.255.255.0

Gateway IP address 0.0.0.0

Server IP address 192.168.1.99

Boot image (1 or 2) 1

MAC address number 1

MAC address base 9C-80-DF-3C-0C-50

*** Press any key to stop auto run (3 seconds) ***

Auto run second count down: 3210

Loading primary image ...

Finished loading 3145728 bytes

DATE : Thu Jan 16 12:53:50 2014

VER : v0.01.47.0001

CRC : C67BD1BF

Code Address: 0x80010000, Entry Address: 0x802735d0

Decompression OK!

Entry at 0x802735d0

Closing network.

Disabling Switch ports.

Flushing Receive Buffers...

0 buffers found.

Closing DMA Channels.

Starting program at 0x802735d0

Linux version 2.6.30 (brian_chang@BuildBed) (gcc version 4.1.2) #1 SMP PREEMPT Thu Jan 16 12:41:38 CST 2014


Detected Broadcom 0x63168 CPU revision d0


CPU frequency is 400 MHz


128MB of RAM installed


registering 48 GPIOs


console [early0] enabled


CPU revision is: 0002a080 (Broadcom BCM63168)


Internal 1P2 VREG will be shutdown if unused...Unused, turn it off (00009326-00009321=5<300)


board_bcm963268: board name: BrightBox2


Determined physical RAM map:


memory: 07ece000 @ 00000000 (usable)


Zone PFN ranges:


DMA 0x00000000 -> 0x00001000


Normal 0x00001000 -> 0x00007ece


Movable zone start PFN for each node


early_node_map[1] active PFN ranges


0: 0x00000000 -> 0x00007ece


On node 0 totalpages: 32462


free_area_init_node: node 0, pgdat 803035b0, node_mem_map 81000000


DMA zone: 32 pages used for memmap


DMA zone: 0 pages reserved


DMA zone: 4064 pages, LIFO batch:0


Normal zone: 222 pages used for memmap


Normal zone: 28144 pages, LIFO batch:7


Built 1 zonelists in Zone order, mobility grouping on. Total pages: 32208


Kernel command line: console=ttyS0,115200 root=/dev/mtdblock4 ro rootfstype=squashfs


wait instruction: enabled


Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.


Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes


NR_IRQS:92


PID hash table entries: 512 (order: 9, 2048 bytes)


Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)


Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)


Memory: 125176k/129848k available (2476k kernel code, 4500k reserved, 557k data, 152k init, 0k highmem)


Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)


Mount-cache hash table entries: 512


--Kernel Config--


SMP=1


PREEMPT=1


DEBUG_SPINLOCK=0


DEBUG_MUTEXES=0


CPU revision is: 0002a080 (Broadcom BCM63168)


Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.


Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes


Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)


Brought up 2 CPUs


/proc/net/netfilter/nf_cli_bw_mon created


NET: Registered protocol family 16


registering PCI controller with io_map_base unset


registering PCI controller with io_map_base unset


bio: create slab <bio-0> at 0


pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10013fff]


pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x0007ff]


pci 0000:00:00.0: supports D1 D2


pci 0000:00:00.0: PME# supported from D0 D3hot D3cold


pci 0000:00:00.0: PME# disabled


pci 0000:00:09.0: reg 10 32bit mmio: [0xb0002600-0xb00026ff]


pci 0000:00:0a.0: reg 10 32bit mmio: [0xb0002500-0xb00025ff]


pci 0000:01:00.0: PME# supported from D0 D3hot


pci 0000:01:00.0: PME# disabled


pci 0000:02:00.0: reg 10 64bit mmio: [0x000000-0x007fff]


pci 0000:02:00.0: supports D1 D2


pci 0000:01:00.0: PCI bridge, secondary bus 0000:02


pci 0000:01:00.0: IO window: disabled


pci 0000:01:00.0: MEM window: 0x11000000-0x110fffff


pci 0000:01:00.0: PREFETCH window: disabled


PCI: Enabling device 0000:01:00.0 (0000 -> 0002)


PCI: Setting latency timer of device 0000:01:00.0 to 64


skbFreeTask created successfully


BLOG v3.0 Initialized


BLOG Rule v1.0 Initialized


Broadcom IQoS v0.1 Jan 16 2014 12:40:02 initialized


Broadcom GBPM v0.1 Jan 16 2014 12:40:03 initialized


NET: Registered protocol family 8


NET: Registered protocol family 20


NET: Registered protocol family 2


IP route cache hash table entries: 1024 (order: 0, 4096 bytes)


TCP established hash table entries: 4096 (order: 3, 32768 bytes)


TCP bind hash table entries: 4096 (order: 3, 32768 bytes)


TCP: Hash tables configured (established 4096 bind 4096)


TCP reno registered


NET: Registered protocol family 1


bcmPktDma_init: Broadcom Packet DMA Library initialized


Total # RxBds=1448


bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized





squashfs: version 4.0 (2009/01/31) Phillip Lougher


msgmni has been set to 244


io scheduler noop registered (default)


PCI: Setting latency timer of device 0000:01:00.0 to 64


bcm63268-uart.0: ttyS0 at MMIO 0xb0000180 (irq = 13) is a bcm63268-uart0

\CAconsole handover: boot [early0] -> real [ttyS0]


bcm63268-uart.1: ttyS1 at MMIO 0xb00001a0 (irq = 42) is a bcm63268-uart1

loop: module loaded

PPP generic driver version 2.4.2

NET: Registered protocol family 24

PPPoL2TP kernel driver, V1.0

Broadcom NAND FLASH Controller Version 4.0

NAND device: Manufacturer ID: 0x92, Chip ID: 0xf1 (Zentel NAND 128MiB 3,3V 8-bit)

NAND device: Erase 131072 bytes Write 2048 bytes OOB 64 bytes

Bad block table not found for chip 0

Bad block table not found for chip 0

Scanning device for bad blocks

Bad eraseblock 1023 at 0x000007fe0000

Bad block table written to 0x000007fc0000, version 0x01

Bad block table written to 0x000007fa0000, version 0x01

Creating 10 MTD partitions on "bcm63268-nand":

0x000000000000-0x000000100000 : "bootldr"

0x000000100000-0x000000180000 : "manuf"

0x000000180000-0x000000200000 : "nvram"

0x000000200000-0x000000500000 : "linux"

0x000000500000-0x000001900000 : "rootfs"

0x000001900000-0x000001a00000 : "pricfg"

0x000001a00000-0x000001d00000 : "sec_linux"

0x000001d00000-0x000003100000 : "sec_rootfs"

0x000003100000-0x000003200000 : "seccfg"

0x000003200000-0x000006200000 : "ubifs"

bcm63268-nand bcm63268-nand: at 0xb0000200 (irq 58, cache 0xb0000600) v1.0

Registered led device: wifi_green

Registered led device: power_green

Registered led device: vdata_green

Registered led device: vsync_green

Registered led device: vsync_red

Registered led device: power_red

Registered led device: vdata_red

Registered led device: wifi_int_green

Registered led device: vsync_orange

Registered led device: vdata_orange

Registered led device: wifi2G_green

Registered led device: wifi5G_green

GACT probability on

u32 classifier

Actions configured

TCP cubic registered

NET: Registered protocol family 10

NET: Registered protocol family 17

Bridge firewalling registered

Initializing MCPD Module

802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>

All bugs added by David S. Miller <davem@redhat.com>

VFS: Mounted root (squashfs filesystem) readonly on device 31:4.

Freeing unused kernel memory: 152k freed

System logger start...

Kernel logger start...

arc_oshal: module license 'Propritary' taints kernel.

Disabling lock debugging due to kernel taint



oshal_init(1110) DRV: Created Successfully



ARC_KERNEL_OSIX_init(402) DRV: Created Successfully

Broadcom Logger v0.1 Jan 16 2014 12:41:57

brcmchipinfo: brcm_chipinfo_init entry

Broadcom Ingress QoS Module Char Driver v0.1 Jan 16 2014 12:42:03 Registered<243>



Broadcom Ingress QoS ver 0.1 initialized

BPM: tot_mem_size=134217728B (128MB), buf_mem_size=20132655B (19MB), num of buffers=9460, buf size=2128

Broadcom BPM Module Char Driver v0.1 Jan 16 2014 12:42:04 Registered<244>

[NTC bpm] bpm_set_status: BPM status : enabled



bcmxtmrt: Broadcom BCM63168D0 ATM/PTM Network Device v0.4 Jan 16 2014 12:42:05

bcmxtmcfg: bcmxtmcfg_init entry

NBUFF v1.0 Initialized

Initialized fcache state

Broadcom Packet Flow Cache Char Driver v2.2 Jan 16 2014 12:42:10 Registered<242>

Created Proc FS /procfs/fcache

Broadcom Packet Flow Cache registered with netdev chain

Broadcom Packet Flow Cache learning via BLOG enabled.

Constructed Broadcom Packet Flow Cache v2.2 Jan 16 2014 12:42:10

chipId 0x631680D0

Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jan 16 2014 12:42:11 Registered <241>

Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000

FAP Soft Reset Done

4ke Reset Done

Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000

FAP Soft Reset Done

4ke Reset Done

FAP Debug values at 0xa541dbd0 0xa549dbd0

Allocated FAP0 GSO Buffers (0xA542EC58) : 1048576 bytes @ 0xA5500000

Allocated FAP1 GSO Buffers (0xA54AEC58) : 1048576 bytes @ 0xA5600000

Allocated FAP0 TM SDRAM Queue Storage (a542ec5c) : 341376 bytes @ a5700000

Allocated FAP1 TM SDRAM Queue Storage (a54aec5c) : 341376 bytes @ a5780000

[NTC fapProto] fapReset : Reset FAP Protocol layer

[FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3960>, free <2696>, total<8192>

[FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><3960>, free <2696>, total<8192>

[FAP0] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576>

[FAP1] PSM : addr<0x80002000>, used <23452>, free <1124>, total <24576>

[FAP0] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948

[FAP1] DQM : availableMemory 14652 bytes, nextByteAddress 0xE0004948

[FAP0] GSO Buffer set to 0xA5500000

[FAP1] GSO Buffer set to 0xA5600000

[FAP0] FAP BPM Initialized.

[FAP1] FAP BPM Initialized.

fapDrv_construct: FAP0: pManagedMemory=b0820650. wastage 8 bytes

fapDrv_construct: FAP1: pManagedMemory=b0a20650. wastage 8 bytes

bcmPktDma_bind: FAP Driver binding successfull

[FAP0] FAP TM: ON

[FAP1] FAP TM: ON

[NTC arl] arlEnable : Enabled ARL binding to FAP

Broadcom Address Resolution Logic Processor (ARL) Char Driver v0.1 Jan 16 2014 12:42:18 Registered <245>

adsl: adsl_init entry

Broadcom BCM63168D0 Ethernet Network Device v0.1 Jan 16 2014 12:42:20

Broadcom GMAC Char Driver v0.1 Jan 16 2014 12:42:24 Registered<249>

Broadcom GMAC Driver v0.1 Jan 16 2014 12:42:24 Initialized

fapDrv_psmAlloc: fapIdx=1, size: 4800, offset=b0a20650 bytes remaining 7000

ETH Init: Ch:0 - 200 tx BDs at 0xb0a20650

fapDrv_psmAlloc: fapIdx=0, size: 4800, offset=b0820650 bytes remaining 7000

ETH Init: Ch:1 - 200 tx BDs at 0xb0820650

fapDrv_psmAlloc: wastage 8 bytes

fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821910 bytes remaining 2184

ETH Init: Ch:0 - 600 rx BDs at 0xb0821910

fapDrv_psmAlloc: wastage 8 bytes

fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21910 bytes remaining 2184

ETH Init: Ch:1 - 600 rx BDs at 0xb0a21910

bcm63268-dg: register bcmsw

eth2: MAC Address: 9C:80:DF:3C:0C:50

eth1: MAC Address: 9C:80:DF:3C:0C:50

eth0: MAC Address: 9C:80:DF:3C:0C:50

eth4: MAC Address: 9C:80:DF:3C:0C:53

eth3: MAC Address: 9C:80:DF:3C:0C:50

Broadcom Wireless LAN Devices

--SMP support

wl: dsl_tx_pkt_flush_len=338

wl: norm_wmark_tot=6149, pktc_wmark_tot=2048

wl: passivemode=1

wl: napimode=0

wl0: allocskbmode=1 currallocskbsz=512

Neither SPROM nor OTP has valid image

wl:srom/otp not programmed, using main memory mapped srom info(wombo board)

wl:loading /etc/wlan/bcm6362_map.bin

wl: sprom_update_params NIY!

srom rev:8

wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32

wlc_bmac_attach(3293): BpGetWirelessFlags NIY!

wl0: Broadcom BCM435f 802.11 Wireless Controller 6.30.163.23.cpe4.12L08.0

bcm63268-dg: register wl0

PCI: Enabling device 0000:02:00.0 (0000 -> 0002)

Overriding devID to 0x43a2

wl: passivemode=1

wl: napimode=0

wl1: allocskbmode=1 currallocskbsz=3500

Neither SPROM nor OTP has valid image

wl:srom/otp not programmed, using main memory mapped srom info(wombo board)

wl:loading /etc/wlan/bcm4352_map.bin

wl: sprom_update_params NIY!

srom rev:11

wl: reading /etc/wlan/bcmcmn_nvramvars.bin, file size=32

wl: reading /etc/wlan/bcm4352_nvramvars.bin, file size=32

wlc_bmac_attach(3293): BpGetWirelessFlags NIY!

wl1: Broadcom BCM43a2 802.11 Wireless Controller 6.30.163.23.cpe4.12L08.0

bcm63268-dg: register wl1

Broadcom Power Management v0.1 Jan 16 2014 12:44:07

CFM Device Driver: Created Successfully


EFM Device Driver: Created Successfully


Netfilter messages via NETLINK v0.30.

nf_conntrack version 0.5.0 (2028 buckets, 8112 max)

CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use

nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or

sysctl net.netfilter.nf_conntrack_acct=1 to enable it.

ctnetlink v0.93: registering with nfnetlink.

UBI device number 0, total 384 LEBs (48758784 bytes, 46.5 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)

UBIFS DBG (pid 637): ubifs_bg_thread: background thread "ubifs_bgt0_0" started, PID 637

UBIFS DBG (pid 635): mount_ubifs: min. I/O unit size: 2048 bytes

UBIFS DBG (pid 635): mount_ubifs: max. write size: 2048 bytes

UBIFS DBG (pid 635): mount_ubifs: LEB size: 126976 bytes (124 KiB)

UBIFS DBG (pid 635): mount_ubifs: data journal heads: 1

UBIFS DBG (pid 635): mount_ubifs: UUID: CF11813B-9EE2-4DFF-95FC-6E39040D3F06

UBIFS DBG (pid 635): mount_ubifs: big_lpt 0

UBIFS DBG (pid 635): mount_ubifs: log LEBs: 3 (3 - 5)

UBIFS DBG (pid 635): mount_ubifs: LPT area LEBs: 2 (6 - 7)

UBIFS DBG (pid 635): mount_ubifs: orphan area LEBs: 2 (8 - 9)

UBIFS DBG (pid 635): mount_ubifs: main area LEBs: 364 (10 - 373)

UBIFS DBG (pid 635): mount_ubifs: index LEBs: 1

UBIFS DBG (pid 635): mount_ubifs: total index bytes: 152 (0 KiB, 0 MiB)

UBIFS DBG (pid 635): mount_ubifs: key hash type: 0

UBIFS DBG (pid 635): mount_ubifs: tree fanout: 8

UBIFS DBG (pid 635): mount_ubifs: reserved GC LEB: 13

UBIFS DBG (pid 635): mount_ubifs: first main LEB: 10

UBIFS DBG (pid 635): mount_ubifs: max. znode size 240

UBIFS DBG (pid 635): mount_ubifs: max. index node size 192

UBIFS DBG (pid 635): mount_ubifs: node sizes: data 48, inode 160, dentry 56

UBIFS DBG (pid 635): mount_ubifs: node sizes: trun 56, sb 4096, master 512

UBIFS DBG (pid 635): mount_ubifs: node sizes: ref 64, cmt. start 32, orph 32

UBIFS DBG (pid 635): mount_ubifs: max. node sizes: data 4144, inode 4256 dentry 312, idx 188

UBIFS DBG (pid 635): mount_ubifs: dead watermark: 2048

UBIFS DBG (pid 635): mount_ubifs: dark watermark: 6144

UBIFS DBG (pid 635): mount_ubifs: LEB overhead: 2656

UBIFS DBG (pid 635): mount_ubifs: max. dark space: 2236416 (2184 KiB, 2 MiB)

UBIFS DBG (pid 635): mount_ubifs: maximum bud bytes: 1904640 (1860 KiB, 1 MiB)

UBIFS DBG (pid 635): mount_ubifs: BG commit bud bytes: 1547520 (1511 KiB, 1 MiB)

UBIFS DBG (pid 635): mount_ubifs: current bud bytes 241664 (236 KiB, 0 MiB)

UBIFS DBG (pid 635): mount_ubifs: max. seq. number: 122

UBIFS DBG (pid 635): mount_ubifs: commit number: 18

mkdir: can't create directory '/var/diagnostic': File exists

act_api service start...

CCFG DB 0 sanity check passed!

extracting CCFG DB 0...

extracting CCFG DB 0 successfully...

Configuration file init successfully

Registered log categories: System|

Log is loaded

Failed to read user header agent seen database!!!

Failed to read known device database!!!

Failed to read OIE database!!!

Failed to read USB device database!!!

mid_core service start...

WAN Daemon start...

DSL Link Monitor start...

Ethernet Link Monitor start...

ntpc start...

ddnsc start...

ddnsc library version 0.1

umts_network_status_poll: enter

UMTS daemon start...

accept_ra and router_solicitations of IPv6 default disabled

mii register 31 is 0x0000

mii register 16 is 0x0000

mii register 20 is 0x0000

mii register 31 is 0x008b

mii register 16 is 0x0700

mii register 20 is 0x7008

mii register 31 is 0x008b

mii register 16 is 0x0700

mii register 20 is 0x7008

Powered down

Powered down

rmmod: can't unload 'nf_nat_pt': unknown symbol in module, or unknown parameter

killall: urlfilterd: no process killed

conntrack v1.0.0 (conntrack-tools): connection tracking table has been emptied.

conntrack v1.0.0 (conntrack-tools): expectation table has been emptied.

_arc_cfg_get(198): Failed to get CCFG section=ip6Firewall, name=ip6firewall_enable !

Failed to initialize ip6tables!!!



ip6tables_cli init: Execution Errors (code -1)

act_api service: shell error(/usr/sbin/util_ip6tables_cli init)!

act_api_sys_act_handler: key-, strategy:0

_arc_cfg_get(198): Failed to get CCFG section=mgmtAccount, name=nologin !

sys_cli_cmd_Run_Action: Got result 0

act_api_wan_act_handler: key-, strategy:0

sys_cli_cmd_Run_Action: Got result 0

WLmngr Daemon is running...

wlc_phy_cal_init_acphy: NOT Implemented

Setting SSID: "wl1-Guest1"

[DBG] EE_WAN_ACTION_IFINIT

Setting SSID: "wl1-Guest2"

Setting SSID: "wl1-Guest3"

Setting SSID: "wl0-Guest1"

[DBG] EE_WAN_ACTION_IFINIT

Setting SSID: "wl0-Guest2"

Setting SSID: "wl0-Guest3"

wlevt_init@158: opened loopback socket 4

wlevt is ready for new msg...

[DBG] EE_WAN_ACTION_IFINIT

[DBG] EE_WAN_ACTION_IFINIT

act_api_xdsl_act_handler: key-, strategy:0

ee_xdsl_main:0,dslinit

[DBG] EE_XDSL_ACTION_INIT

sys_cli_cmd_Run_Action: Got result 0

act_api_xdsl_act_handler: key-, strategy:2

_arc_cfg_get(198): Failed to get CCFG section=xdsl, name=enable !

ee_xdsl_main:0,dslstart

[DBG] EE_XDSL_ACTION_START

BcmAdsl_Initialize=0xC0582C10, g_pFnNotifyCallback=0xC05C1034

BcmAdsl_Initialize(261): BpGetRj11InnerOuterPairGpios NIY

lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000

pSdramPHY=0xA7FFFFF8, 0x2F5CFFFF 0xFBFF5EA2

*** XfaceOffset: 0x5FF90 => 0x5FF90 ***

*** PhySdramSize got adjusted: 0xEE990 => 0x125350 ***

AdslCoreSharedMemInit: shareMemSize=52365(52368)

AdslCoreHwReset: pLocSbSta=82820000 bkupThreshold=3072

AdslCoreHwReset: AdslOemDataAddr = 0xA7FAD878

BcmXdslCoreSendAfeInfo(2134): BpGetExtAFELDPwrGpio NIY!

***BcmDiagsMgrRegisterClient: 0 ***

bcm63268-dg: register dsl0

devCtl_xtmInitiafapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22be0 bytes remaining 584

lize(177): devCtXTM Init: Ch:0 - 200 rx BDs at 0xb0a22be0

l_getSdramSize NfapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a23220 bytes remaining 456

IY!

XTM Init: Ch:1 - 16 rx BDs at 0xb0a23220

bcmxtmrt: PTM/ATM Non-Bonding Mode configured in system

sys_cli_cmd_Run_Action: Got result 0

act_api_lan_act_handler: key-, strategy:0

sys_cli_cmd_Run_Action: Got result 0

act_api_lan_act_handler: key-, strategy:2

_arc_cfg_get(198): Failed to get CCFG section=lan#001, name=dhcp4sequential !

_arc_cfg_get(198): Failed to get CCFG section=lan#002, name=dhcp4sequential !

_arc_cfg_get(198): Failed to get CCFG section=lan#003, name=dhcp4sequential !

sys_cli_cmd_Run_Action: Got result 0

System Power Management is now enabled

Host MIPS Clock divider pwrsaving is enabled

DDR Self Refresh pwrsaving is enabled

Ethernet Auto Power Down and Sleep is enabled

Energy Efficient Ethernet is disabled

Multicast Daemon is ready to service...

iptables: No chain/target/match by that name.

eth3 (switch port: 6) Link UP 1000 mbps full duplex

act_api_oie_act_handler: key-, strategy:2

HTTPD: main(1683)

main(1778): I am child for HTTPD SVR 2

main(1778): I am child for HTTPD SVR 0

accept: Bad file descriptor

LAN PORT 4

_arc_cfg_get(198): Failed to get CCFG section=oie, name=eng_mode_tmo !

NDD App: Failed to get variable(ENGINEER_MODE_TIMEOUT)!

_arc_cfg_get(198): Failed to get CCFG section=oie, name=sec_itf !

NDD App: Failed to get variable(SECONDARY_INTERFACE)!

_arc_cfg_get(198): Failed to get CCFG section=oie, name=ukn_dev_tmo !

NDD App: Failed to get variable(UNKNOWN_DEVICE_TIMEOUT)!

init for dnsmasq lease database NIY!

iptables: No chain/target/match by that name.

init for dnsmasq lease database NIY!

iptables: No chain/target/match by that name.

act_api_wlan_service: key-, strategy:131

init for dnsmasq lease database NIY!

sys_cli_cmd_Run_Action: Got result 0

act_api_wlan_service: key-2, strategy:3

[LED] WIFI ON

[LED] WIFI ON

sys_cli_cmd_Run_Action: Got result 0

act_api_wlan_service: key-1, strategy:3

[LED] WIFI ON

[LED] WIFI ON

sys_cli_cmd_Run_Action: Got result 0

mii register 31 is 0x0000

mii register 16 is 0x0000

mii register 20 is 0x0000

mii register 31 is 0x0000

mii register 31 is 0x008b

mii register 16 is 0x0400

mii register 20 is 0x0008

mii register 31 is 0x000b

mii register 31 is 0x008b

mii register 16 is 0x0400

mii register 20 is 0x0008

mii register 31 is 0x000b

mii register 0 is 0x0000

mii register 0 is 0x3000

mii register 0 is 0x3000

Powered up

eth3 (switch port: 6) Link DOWN.

act_api_nas_act_handler: key-, strategy:0

sys_cli_cmd_Run_Action: Got result 0

LAN PORT 4

LAN port 3 DOWN

PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)

PCI: Enabling device 0000:00:09.0 (0000 -> 0002)

eth3 (switch port: 6) Link UP 1000 mbps full duplex

LAN PORT 4

wl_wscPinGen(4203): read device pin NIY!

NDD App: Time of DHCP fingerprint detection: 0.001941

mcpd_igmp_process_input(259): Invalid pkt rcvd. on interface index: 21 name eth3 br br0

mcpd_igmp_process_input(259): Invalid pkt rcvd. on interface index: 21 name eth3 br br0

Driver 'sd' needs updating - please use bus_type methods

act_api_nas_act_handler: key-, strategy:2

Password for 'user' changed

/opt/arc_middle/oie/ip_changed.sh: line 26: /usr/sbin/sh_ip6tables_modify_ip.sh: not found

WPS Device PIN = 74857210

Setting SSID: "5GHz-EE-pm2mke"

Current SSID: "wl1-Guest1"

Current SSID: "wl1-Guest2"

Current SSID: "wl1-Guest3"

sys_cli_cmd_Run_Action: Got result 0

transit LED power to state ready


LLTD daemon is ready to service

insmod: can't insert '/opt/arc_p8021ag.ko': File exists

insmod: can't insert '/opt/arc_p8023ah.ko': File exists

EAP daemon is ready to service

NAS daemon is ready to service

acs_retrieve_config: flags 0x8

Trigger UP TR069 Module.

Key id=0x61090046

Message Q 0x0 create

fread_config_b(309): get FirstUseDate 0000-00-00T00:00:00

fread_config_b(323): get URL https://arcadyan.cwmp.eu:443/

fread_config_b(337): get username 9C-80-DF-3C-0C-50

fread_config_b(351): get password EE-pm2mke

fread_config_b(364): get periodic inform enable 1

fread_config_b(377): get periodic inform interval 86400

fread_config_b(391): get periodic inform time 0001-01-01T00:00:00

fread_config_b(405): get parameter key

fread_config_b(420): get ConnReqURL

fread_config_b(435): get ConnReq username username

fread_config_b(450): get ConnReq password password

fread_config_b(463): get tr69_m_reboot 0

fread_config_b(475): get TransferFaultCode 0

fread_config_b(488): get CommandKey

fread_config_b(501): get TransferStartTime

fread_config_b(514): get TransferEndTime

size InternetGatewayDevice_T = 3360

Register InternetGatewayDevice Successful

size LANDevice_T[1] = 85572

Register LANDevice Successful

size WANDevice_T[1] = 11888

size PortMapping_T[20] = 3920

[TR098] Register WANDevice Successful <Tr69Nodes_SetupWANDevice [4967]>

size IPPingDiagnostics_T = 584

size DownloadDiagnostics_T = 724

size UploadDiagnostics_T = 724

size UDPEchoConfig_T = 380

Register IPPingDiagnostics Successful

size Layer3Forwarding_T = 7700

Register function 0x2ac40018 to TR69_MSG_NONE!

Register Layer3Forwarding Successful

[TR098] mapi_wan_get_active_wan error <getActiveWanData [2703]>

[TR098] No active WAN <SyncWANPPPConnectionFunc [4158]>

[TR098] mapi_wan_get_active_wan error <getActiveWanData [2703]>

[TR098] No active WAN <SyncWANIPConnectionFunc [3885]>

[TR098] mapi_wan_get_active_wan error <getActiveWanData [2703]>

[TR098] No active WAN <SyncWANConnectionDeviceFunc [3367]>

[TR098] unknown dsl channel type: 0 <SyncWANDSLInterfaceConfigFunc [3106]>

[TR098] signal = -1 <SyncWANUMTSInterfaceConfigFunc [2997]>

SyncWANCommonInterfaceConfigFunc: cannot get connection

Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 br2

TR69Nodes_GetLANIfNodes: ENTRY ifName br2

192.168.2.0 0.0.0.0 255.255.255.0 U 0 0 0 br1

TR69Nodes_GetLANIfNodes: ENTRY ifName br1

192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 br0

TR69Nodes_GetLANIfNodes: ENTRY ifName br0

*****SyncAllNode time = 1371678*****

[Init_SSLClient] Certificate_Id=0, nConnectProtocol=6

[sslc_conf_init] cert_array->verify_peer=0

[1026] [sslc_conf_init] ssl client info:

[1026] PrivateKey=

[1026] MyCertificate=

[1026] CaCertificate=

[1026] SSL_method=30

[1026] verify_mode=0

[1026] cipher_suites=ADH:SHA1:HIGH:EXP

[1026] tftp_server_ip=140.92.61.131

[1026] fn_myCerttificate=ServCert.pem

[1026] fn_privateKey=PrivKey.pem

[1026] fn_caCertificate=CaCert.pem

[1026] sslc_conf_init> ssl client info end:

System Start with Normal Phase

create_debugger_socket: listen at port:6969

VERIFY_TR069::Tr69_Init()::Set BOOTSTRAP or BOOT Inform Message

FirstUseDate:0000-00-00T00:00:00

Run Tr69_Task task id=0x402

Run Tr69_TimerTask task id=0x803

[1026] [sslc_conf_init] pCtx=0x4e05e0 in ssld_conf_init



[1026] [sslc_ctx_reset_cert] re-LoadCACertificate( 3rdCA ) ok!!

[1026] [sslc_ctx_reset_cert] re-LoadCACertificate( 2ndCA ) ok!!

[1026] [sslc_ctx_reset_cert] re-LoadCACertificate( 1stCA ) ok!![sslc_ctx_reset_cert] this is pkcs12 type certificate

LoadServerCertAndKeyFromPKCS12Format> MAC verified OK

LoadServerCertAndKeyFromPKCS12Format> PKCS12_parse() return pkey=0x4e6390, x509=0x4e50e8

data=30:82:2:5b

data=4c:4a:7a:2b

LoadServerCertAndKeyFromPKCS12Format> out_len=1142



[1026] sslc_ctx_reset_cert : re-LoadServerCertAndKey() ok!!

[1026] [sslc_conf_init] sslc_conf_init() ok

[Init_SSLClient] g_Client_Cert_Array[0]=0x4de170

Status: disconnected

transit LED bb to state dsl_down


[LED] DSL DOWN

acs_select_chspec: 0xe22a

waitpid: Interrupted system call

wps_1905_init:77 msgqueue created :32769


WPS daemon is ready to service

WPS daemon is shutting down

Setting SSID: "EE-pm2mke"

Current SSID: "wl0-Guest1"

Current SSID: "wl0-Guest2"

Current SSID: "wl0-Guest3"

LLTD daemon is ready to service

EAP daemon is ready to service

NAS daemon is ready to service

acs_retrieve_config: flags 0x8

acs_select_chspec: 0xe12a

acs_retrieve_config: flags 0x8

acs_select_chspec: 0x100b

Success

Success

Success

Success

Success

Success

Success

Success

Success


Keep your eyes open - I've just finished shooting my "teardown" of Bright Box 2, and I shall post it here + other pertinent and interesting info, very soon indeed smile

Edited by glossywhite (Tue 15-Jul-14 19:19:21)

Standard User glossywhite
(member) Tue 15-Jul-14 19:09:53
Print Post

SERIAL header pinout & boot log video


[re: glossywhite] [link to this post]
 
Bright Box 2 serial header pinout, 115,200 baud, 8N1 (why doesn't this forum allow image embedding? What is this - 1997?)

https://farm4.staticflickr.com/3841/14476438119_82c2...


Here's a screencast of it booting:

https://www.youtube.com/watch?v=RClQOGaj0DA

Edited by glossywhite (Tue 15-Jul-14 19:24:23)

Standard User XRaySpeX
(eat-sleep-adslguide) Tue 15-Jul-14 19:52:46
Print Post

Re: [NEW] Bright Box 2 hacking


[re: glossywhite] [link to this post]
 
What does the top GUI Status page look like (for the benefit of another thread I don't understand)? Copy & paste will do.

1999: Freeserve 48K Dial-Up => 2005: Wanadoo 1 Meg BB => 2007: Orange 2 Meg BB => 2008: Orange 8 Meg LLU => 2010: Orange 16 Meg LLU => 2011: Orange 20 Meg WBC


Register (or login) on our website and you will not see this ad.

Standard User glossywhite
(member) Tue 15-Jul-14 20:36:03
Print Post

Re: [NEW] Bright Box 2 hacking


[re: XRaySpeX] [link to this post]
 
In reply to a post by XRaySpeX:
What does the top GUI Status page look like (for the benefit of another thread I don't understand)? Copy & paste will do.


By the "GUI status page", I take it you mean the status page in the Web interface? I'll have a look later if I get time, and show you smile

Edited by glossywhite (Tue 15-Jul-14 20:37:39)

Standard User XRaySpeX
(eat-sleep-adslguide) Tue 15-Jul-14 20:43:36
Print Post

Re: [NEW] Bright Box 2 hacking


[re: glossywhite] [link to this post]
 
Yes, but not the usual ADSL Status router stats page; just the initial Status page - just the top 'Internet' section.

I used 'GUI' to take your mind off its internals. wink

1999: Freeserve 48K Dial-Up => 2005: Wanadoo 1 Meg BB => 2007: Orange 2 Meg BB => 2008: Orange 8 Meg LLU => 2010: Orange 16 Meg LLU => 2011: Orange 20 Meg WBC

Edited by XRaySpeX (Tue 15-Jul-14 20:46:17)

Standard User glossywhite
(member) Tue 15-Jul-14 20:47:36
Print Post

Re: [NEW] Bright Box 2 hacking


[re: XRaySpeX] [link to this post]
 
In reply to a post by XRaySpeX:
Yes, but not the usual ADSL Status router stats page; just the initial Status page - just the top 'Internet' section.

I used 'GUI' to take your mind off its internals. wink


There's no status page (or *any* web page, come to think of it) visible as a GUI in the command line, so I'd have sussed that out anyhoo (context! context! context!), but cheers for clarifying, Ray smile

Edited by glossywhite (Tue 15-Jul-14 20:49:14)

Standard User XRaySpeX
(eat-sleep-adslguide) Tue 15-Jul-14 20:54:04
Print Post

Re: [NEW] Bright Box 2 hacking


[re: glossywhite] [link to this post]
 
FYI on terminology: Command Line Interface (CLI), which you are currently employing, is not a Graphical User Interface (GUI), which is what the Web interface is.

1999: Freeserve 48K Dial-Up => 2005: Wanadoo 1 Meg BB => 2007: Orange 2 Meg BB => 2008: Orange 8 Meg LLU => 2010: Orange 16 Meg LLU => 2011: Orange 20 Meg WBC
Standard User glossywhite
(member) Tue 15-Jul-14 21:37:04
Print Post

Re: [NEW] Bright Box 2 hacking


[re: XRaySpeX] [link to this post]
 
In reply to a post by XRaySpeX:
FYI on terminology: Command Line Interface (CLI), which you are currently employing, is not a Graphical User Interface (GUI), which is what the Web interface is.


Thanks Ray.

Edited by glossywhite (Tue 15-Jul-14 21:43:47)

Standard User glossywhite
(member) Tue 15-Jul-14 22:22:46
Print Post

EE Bright Box 2: Web GUI overview (YouTube)


[re: XRaySpeX] [link to this post]
 
In reply to a post by XRaySpeX:
What does the top GUI Status page look like (for the benefit of another thread I don't understand)? Copy & paste will do.


Here you go Ray; believe it or not, it was simpler to kill two birds with one stone and just make a quick screencast:

EE Bright Box 2: Web GUI overview

https://www.youtube.com/watch?v=GkgM4uWsk9Q

Edited by glossywhite (Tue 15-Jul-14 22:23:46)

Standard User francisuk25
(learned) Tue 15-Jul-14 23:42:12
Print Post

Re: EE Bright Box 2: Web GUI overview (YouTube)


[re: glossywhite] [link to this post]
 
The EE BB2 has some nice features and is good to see a broadcom 6362 cpu dual core @ 400 mhz chip and a big 128MB RAM.

Virgin Media XL TV with a Samsung TiVo 1TB box.
Sky Fibre Unlimited Pro Since 02/12/2013, Sync speeds:
DownStream Connection Speed: 57146, UpStream Connection Speed: 19075
Sky Hub SR101 & Openreach NGA ECI-CPE-Modems Type 1B Modem
My Broadband Ping Updated 20/06/2014 DHCP IP
Network Traffic SNMP Monitoring via odmon.com
DNS: SafeDNS & OpenDNS

Edited by francisuk25 (Tue 15-Jul-14 23:50:21)

Pages in this thread: 1 | 2 | (show all)   Print Thread

Jump to