Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[zte931]

Hi all!

I have this ZTE 931VII v2 HGW (BCM6368). In the past the telnet was enabled, so I got the line stats.  8)
Now the device has a new firmware and telnet is disabled.

I disassembled it and found UART port, connected it by USB, but it needs password even on the console.
I tried trivial combinations like admin/root, etc., bot no luck.

I don't have any other ideas, so guys please help me!

This is the output on serial when I interrupted the boot

Code: [Select]

ZXDSL 931VII V1.0.02 for BCM96368 (32bit,SP,BE)
Build Date: 2012�� 01�� 16�� �����Ļ 09:12:34 CST (xia@njzd)
Copyright (C) 2000-2006 Broadcom Corporation.
 
Boot Address 0xb8000000
 
Initializing Arena.
Initializing Devices.
Parallel flash device: name AM29LV320MB, id 0x2200, size 8192KB
CPU type 0x2A031: 400MHz, Bus: 160MHz, Ref: 64MHz
CPU running TP0
Total memory: 67108864 bytes (64MB)
 
Total memory used by CFE:  0x80401000 - 0x80598FB0 (1671088)
Initialized Data:          0x80424190 - 0x80426DE0 (11344)
BSS Area:                  0x80426DE0 - 0x80496FB0 (459216)
Local Heap:                0x80496FB0 - 0x80596FB0 (1048576)
Stack Area:                0x80596FB0 - 0x80598FB0 (8192)
Text (code) segment:       0x80401000 - 0x80424178 (143736)
Boot area (physical):      0x00599000 - 0x005D9000
Relocation Factor:         I:00000000 - D:00000000
 
Board IP address                  : 192.168.1.254:ffffff00 
Host IP address                   : 192.168.1.100 
Gateway IP address                : 
Run from flash/host (f/h)         : f 
Default host run file name        : vmlinux 
Default host flash file name      : bcm963xx_fs_kernel 
Boot delay (0-9 seconds)          : 1 
Board Id (0-8)                    : 96368VVW 
Number of MAC Addresses (1-32)    : 4 
Base MAC Address                  : 00:00:00:00:00:34 
PSI Size (1-64) KBytes            : 24 
Main Thread Number [0|1]          : 0 
 
*** Press 1 means entering boot mode***
Press 2 means entering testing mode***
Press 3 means entering norm mode***
*** Press key to stop auto run (1 seconds) ***
Auto run second count down: 1
Entering boot mode ...
web info: Waiting for connection on socket 0.
CFE>
CFE> help
Available commands:
 
e                   Erase [n]vram or [a]ll flash except bootrom
p                   Print boot line and board parameter info
c                   Change booline parameters
f                   Write image to the flash
i                   Erase persistent storage data
b                   Change board parameters
reset               Reset the board
tag                 Get/Set/Del/List tag parameters
help                Obtain help for CFE commands

[roseway]

I don't know anything about hacking, but have you tried port forwarding? It might be possible to enable the telnet interface by forwarding port 23.

[burakkucat]

I would be interested to know a little more of the background information.

The device was being used with an ADSL2+ or with a VDSL2 service?
Who is the CP/ISP?
The device has had the firmware updated. I assume not by you, so by whom?
Was it a remotely instigated update?
Has any information been provided as to reason for the firmware update?
Do you know the version number of the previous and the present firmware?

[zte931]

I don't know anything about hacking, but have you tried port forwarding? It might be possible to enable the telnet interface by forwarding port 23.

I tried to create an explicit rule for port 23, but didn't work. I assume the telnetd is not running in this firmware.

I would be interested to know a little more of the background information.

The device was being used with an ADSL2+ or with a VDSL2 service?
Who is the CP/ISP?
The device has had the firmware updated. I assume not by you, so by whom?
Was it a remotely instigated update?
Has any information been provided as to reason for the firmware update?
Do you know the version number of the previous and the present firmware?

The HGW is being used with a VDSL2 service (30/5 mbit/s).
Well the ISP is T-Home (hungarian division of Deutsche Telekom). I live in Hungary, I didn't write this in my previous post.
The firmware was updated by CPE remote management. The client is integrated in the HGW.
The current firmware version is V2.0.00.HU.T17, and the previous was V2.0.00.HU.T10.

[burakkucat]

Thank you for "filling in the gaps". Unfortunately I don't have any suggestions to offer. 

Have you asked your ISP why it was decided to block telnet access to the device? Perhaps they are unaware of the problems that action has caused with respect to monitoring the status of the line.

[james]

This blog and asbokid's posts in the comments might be useful:

http://amazingdiy.wordpress.com/2011/06/06/zxdsl-931wii-hacking/

[zte931]

Thank you for "filling in the gaps". Unfortunately I don't have any suggestions to offer. 

Have you asked your ISP why it was decided to block telnet access to the device? Perhaps they are unaware of the problems that action has caused with respect to monitoring the status of the line.

I'd rather not call the helpdesk, because they are incompetent at cases like this, and even if they are, they doesn't care about it, because monitoring the line by the subscriber is not the part of the internet service.

This blog and asbokid's posts in the comments might be useful:

http://amazingdiy.wordpress.com/2011/06/06/zxdsl-931wii-hacking/

Thanks for the link, but I found it a week ago. Unfortunately my HGW's bootloader is more crippled, I cannot dump the flash config, etc., and cannot log in the console.


Well, it seems I have to live with lack of the line status... 

[roseway]

The other possible option is to use a different modem/router, or is that not allowed?

[zte931]

It's not possible. The HGW is authenticated somehow with the serial number of it.

I don't have any particular problem with the line yet, but the attainable speed decreased from ~ 50 mbit/s to 30 mbit/s, and I see 725 CRC errors in 4 hours. I have a 30/5 mbit/s line, so it's okay, but it's maxed out.
I assume the reason for the speed decrease is when they upgraded my line from ADSL2+ to VDSL2, I was in the very early stage of the upgrade, but nowadays many people switched to VDSL2 because of IPTV/3play, and now the DSLAM/ANMS is full.
Only the CRC errors are annoying.

I'm glad I could the check the line status when I switched to VDSL2, because the engineer ****** up something, and my line was not perfect. Next day I phoned the helpdesk, they sent another engineer, and voilą. The picture worth thousand words.

Before


After

[ibsenleo]

Hello,
I know this post is a bit old, but i recently moved to hungary and have the same issue. I would like to try to forward some ports (web server) via telnet, because i tried by web interface and it seems not to work well. I have the same config than you (zxdsl 931vii, t-home, vdsl). The problem is in the web interface i can se my ports opened, but i cant reach my services (i turn off firewall, AV, have static IP and the port is forwarded to my ip.) i also tried with another port (FE: 8081) but is the same. I could search information about this, but everything is in hungarian and dont understand yet... Any idea? thans