If he has a hacked HG612, then he can find out what dslam it is via the band plans.
Post this section and somebody better informed than me will tell you (BE1)
Discovery Phase (Initial) Band Plan
US: (6,31) (882,1193) (1984,2770)
DS: (33,857) (1218,1959) (2795,4083)
I'm on an ECI cab, and my modem has updated firmware.