Re-instating header pins on a PCB
One trick here is to clamp the board vertically while working on it.
The solder pads need to be cleaned out to expose the thru-holes.
From one side of the board, apply heat to one of the solder pads using a fine soldering iron bit.
Simultaneously, and working from the other side of the PCB, use a desoldering pump (solder sucker) to remove the molten solder from the hole.
Repeat for each thru-hole.
Sometimes one or more of the holes isn't properly drilled out.
If so, use a 1mm HSS drill bit and twist it manually between fingers
Ensure all the holes are clean and free from grease and PCB coating materials.
Install the header pins and solder in place
Job done!
Attached are some photos showing the reinstatement of header pins for JTAG/UART on the PCB of a Huawei HG612.
Sounds good!
ROM VER: 1.0.5
CFG 01
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa1ffffff
DDR check ok... start booting...
U-Boot 1.0.4 (Oct 18 2010 - 16:20:02)
CLOCK CPU 333M RAM 166M
DRAM: 32 MB
relocate_code start
relocate_code finish.
FLASH MANUFACT: c2
FLASH DEVICEID: cb
Flash: 8 MB
In: serial
Out: serial
Err: serial
Net: fw_addr=0xa0200000
Internal phy(FE) firmware version: 0x0108
vr9 Switch
Type "run flash_flash" to mount root filesystem over flash
Hit 'Esc' key to stop autoboot: 0
## Booting image from active region 2 at b03f0000 ...
Check RSA image magic--OK!
Please type [setenv rsa_check 1] !!!
Image Name: MIPS Linux-2.6.20
Created: 2011-08-09 3:31:37 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 3629088 Bytes = 3.5 MB
Load Address: 80002000
Entry Point: 802cd000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 802cd000) ...
## Giving linux memsize in MB, 32
Starting kernel ...
Infineon xDSL CPE VR9
mips_hpt_frequency = 166666666, counter_resolution = 2
Linux version 2.6.20.19
(hyhuang@BSD7.localdomain) (gcc version 3.4.6 (OpenWrt-2.0)) #1 Tue Aug 9 11:27
:46 CST 2011
Active Region: 2
phym = 02000000, mem = 01f00000, max_pfn = 00001f00
Reserving memory for CP1 @0xa1f00000, size 0x00100000
CPU revision is: 00019555
Determined physical RAM map:
User-defined physical RAM map:
memory: 01f00000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Built 1 zonelists. Total pages: 7874
Kernel command line: root=/dev/mtdblock2 ro rootfstype=squashfs ip=5.57.33.103:5
.57.33.111::::eth0:on console=ttyS0,115200 ethaddr=5C:33:8E:xx:xxx:xx phym=32M me
m=31M panic=1
1 MIPSR2 register sets available
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
Lantiq ICU driver, version 3.0.1, (c) 2001-2010 Lantiq Deutschland GmbH
PID hash table entries: 128 (order: 7, 512 bytes)
Using 166.667 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 28152k/31744k available (2239k kernel code, 3592k reserved, 616k data, 1
56k init, 0k highmem)
Security Framework v1.0.0 initialized
Mount-cache hash table entries: 512
NET: Registered protocol family 16
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 1024 bind 512)
TCP reno registered
gptu: totally 6 16-bit timers/counters
gptu: misc_register on minor 63
gptu: succeeded to request irq 118
gptu: succeeded to request irq 119
gptu: succeeded to request irq 120
gptu: succeeded to request irq 121
gptu: succeeded to request irq 122
gptu: succeeded to request irq 123
IFX DMA driver, version ifxmips_dma_core.c:v1.0.9
,(c)2009 Infineon Technologies AG
Lantiq CGU driver, version 1.0.9, (c) 2001-2010 Lantiq Deutschland GmbH
Wired TLB entries for Linux read_c0_wired() = 0
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered (default)
ifx_pmu_init: Major 252
Lantiq PMU driver, version 1.1.4, (c) 2001-2010 Lantiq Deutschland GmbH
Lantiq GPIO driver, version 1.2.12, (c) 2001-2010 Lantiq Deutschland GmbH
Infineon Technologies RCU driver version 1.0.6
Lantiq LED Controller driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland Gm
bH
MEI CPE Driver, Version 1.0.2
<6>(c) Copyright 2009, Infineon Technologies AG
<6>### MEI CPE - MEI CPE - MEI CPE - MEI CPE ###
<6>ttyS0 at MMIO 0xbe100c00 (irq = 105) is a IFX_ASC
Lantiq ASC (UART) driver, version 1.0.5, (c) 2001-2010 Lantiq Deutschland GmbH
RAMDISK driver initialized: 1 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
IFX SWITCH API, Version 0.9.9.5
SWAPI: Registered character device [switch_api] with major no [81]
Switch API: PCE MicroCode loaded !!
Switch Auto Polling value = 0
GPHY FIRMWARE LOAD SUCCESSFULLY AT ADDR : 310000
IFX GPHY driver FE Mode, version ifxmips_vr9_gphy: V0.6 - Firmware: 109
ifx_nor0: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
[ACTIVE REGION]: 2
RSA_CHECK: 0
squashfsb->s_magic=71736873 SQUASHFS_MAGIC=71736873
ifx_nor0: squashfs filesystem found at 0x4e10a0.
ifx_mtd_init flash0: Using static image partition
Creating 9 MTD partitions on "ifx_nor0":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "h/w setting"
0x004e10c0-0x007670c0 : "rootfs"
0x00040000-0x00050000 : "rgdb"
0x00050000-0x003f0000 : "upgrade"
0x003f0000-0x00790000 : "upgrade2"
0x00790000-0x007f0000 : "btagent"
0x00000000-0x00800000 : "flash"
0x00000000-0x00800000 : "<NULL>"
Lantiq MTD NOR driver, version 1.0.4, (c) 2001-2010 Lantiq Deutschland GmbH
Registered led device: broadband_led
Registered led device: internet_led
Registered led device: ledc_8
Registered led device: ledc_9
Registered led device: ledc_10
Registered led device: ledc_11
Registered led device: wps_led
Registered led device: ledc_13
Registered led device: ledc_14
Registered led device: usb2_link_led
Registered led device: ledc_16
Registered led device: ledc_17
Registered led device: usb1_link_led
Registered led device: fxo_act_led
Registered led device: internet_red_led
Registered led device: voip_led
Registered led device: warning_led
Registered led device: ledc_23
Lantiq LED driver, version 1.0.15, (c) 2001-2010 Lantiq Deutschland GmbH
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (248 buckets, 1984 max)
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Bridge firewalling registered
NET: Registered protocol family 8
atmpvc_init() failed with -17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
Time: MIPS clocksource has been installed.
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 156k freed
init started: BusyBox v1.00 (2011.08.09-03:28+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
[/etc/init.d/S03config.sh]
Starting mdev ...
Mounting proc and var ...
JFFS2 notice: (226) jffs2_build_xattr_subsystem: complete building xattr subsyst
em, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
Start xmldb ...
[/etc/scripts/misc/profile.sh] init ...
[/etc/scripts/misc/profile_action.sh] get ...
[/etc/scripts/misc/defnodes.sh] ...
SH [/etc/defnodes/S10syncnodes.sh] ...
[/etc/defnodes/S10syncnodes.sh] ...
SH [/etc/defnodes/S11setext.sh] ...
[/etc/defnodes/S11setext.sh] ...
PHP [/etc/defnodes/S12setnodes.php] ...
SH [/etc/defnodes/S13setext.sh] ...
[/etc/defnodes/S13setext.sh] ...
PHP [/etc/defnodes/S14setnodes.php] ...
PHP [/etc/defnodes/S16features.php] ...
SH [/etc/defnodes/S19setext.sh] ...
PHP [/etc/defnodes/S20setnodes.php] ...
SH [/etc/defnodes/S20upnp_igd.sh] ...
SH [/etc/defnodes/S21upnp_wfa.sh] ...
SH [/etc/defnodes/S22setext.sh] ...
PHP [/etc/defnodes/S40brand.php] ...
[/etc/scripts/misc/defnodes.sh] Done !!
[/etc/templates/timezone.sh] ...
[/etc/templates/logs.sh] ...
[/var/run/logs_run.sh] ...
ifxmips_ppa_datapath_vr9_e5: module license 'unspecified' taints kernel.
Loading D5 (MII0/1) driver ......
xuliang: warning NONE
Succeeded!
PPE datapath driver info:
Version ID: 128.3.3.1.0.0.1
Family : N/A
DR Type : Normal Data Path | Indirect-Fast Path
Interface : MII0 | MII1
Mode : Routing
Release : 0.0.1
PPE 0 firmware info:
Version ID: 7.1.5.1.0.33
Family : VR9
FW Type : Standard
Interface : MII0/1 + PTM
Mode : reserved - 1
Release : 0.33
PPE 1 firmware info:
Version ID: 7.2.1.6.1.12
Family : VR9
FW Type : Acceleration
Interface : MII0 + MII1
Mode : Bridging + IPv4 Routing
Release : 1.12
PPA API --- init successfully
Init VDSL Driver ...
- VDSL -
- llcs loading!!! -
- loading drv_ifxos.ko -
strings: not found
IFXOS, Version 1.5.11
<6>(c) Copyright 2007, Infineon Technologies AG
<6>### IFXOS - IFXOS - IFXOS - IFXOS ###
- loading drv_dsl_cpe_api.ko
- loading dsl_cpe_api (drv_dsl_cpe_api.ko device) driver -
Lantiq CPE API Driver version: DSL CPE API V4.6.3.5-pd3
Predefined debug level: 3
- create device nodes for dsl_cpe_api device driver -
- execute vdsl_cpe_control
[: missing ]
IFXOS - User Thread Startup <tcpmsg>, TID 1026 (PID 609) - ENTER
IFXOS - User Thread Startup <tcpcli>, TID 2051 (PID 610) - ENTER
IFXOS - User Thread Startup <evnthnd>, TID 3076 (PID 612) - ENTER
IFXOS - User Thread Startup <tPipe_0>, TID 4101 (PID 613) - ENTER
IFXOS - User Thread Startup <tPipe_1>, TID 5126 (PID 614) - ENTER
nReturn=0
nReturn=0
nReturn=4
nReturn=0
eth0: change MAC from 00:20:DA:86:23:74 to 5C:33:8E:xx:xx:xx
setup layout ...
[/etc/scripts/layout.sh] [start] ...
[/var/run/layout_start.sh] ...
Start modem layout ...
device eth0 entered promiscuous mode
br0: port 1(eth0) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0) entering forwarding state
[/etc/templates/cfm/cfm.sh] [restart] ...
[/var/run/cfm_start.sh] ...
Enable ALPHA CFM ...
ENTER - Kernel Thread Startup <autbtex>
<7>ENTER - Kernel Thread Startup <pmex_ne>
<7>ENTER - Kernel Thread Startup <pmex_fe>
[/etc/init.d/S03config.sh] done!
[/etc/init.d/S10system.sh]
start LAN ...
[/etc/templates/lan.sh] [start] ...
[/var/run/lan_start.sh] ...
Start LAN ( br0/192.168.168.168/255.255.255.0)...
start BT Switch configurations ...
start alphaLogd
[/etc/templates/logd.sh] ...
[/var/run/logd_start.sh] ...
Starting logd ...
start Flash Agent ...
>>> ALPHA Log:
/bin/alphaLogd: create logd_ipc(3) OK !
[/etc/templates/flash_agent.sh] [start] ...
[/var/run/flash_agent_start.sh] ...
>>> ALPHA Flash Agent:
16:00:17 FLASHAGENT: Create fa_r_fa_ipc(4) OK !
start BTAgent ...
Starting BTAgent
library_load: start plugin_source/libalpha2.so
library_load: success
library_load: start plugin_source/libbtagent.so
library_load: success
File Path is /BTAgent/rw/btagent.conf
rw config file exists
Versions match
library_load: start plugin_source/libfwm.so
library_load: success
library_load: start plugin_source/liblogger.so
library_load: success
library_load: start plugin_source/libprobe.so
library_load: success
library_load: start plugin_source/librsa.so
library_load: success
main: Loaded source plugins
library_load: start plugin_transport/libsec.so
library_load: success
main: Loaded transport plugins
library_load: start plugin_parse/libxml.so
library_load: success
main: Loaded parse plugins
GPIO 18 set to 0
GPIO 17 set to 1
GPIO 16 set to 1
GPIO 6 set to 1
start alphaHousekeeper
[/etc/templates/housekeeper.sh] [start] ...
[/var/run/housekeeper_start.sh] ...
Starting housekeeper ...
BBU Status: Status Change
BBU Status: Adapter Mode
- presented Inventory information
nReturn=0
nReturn=0 nDirection=0 G994VendorID=(B5,00,49,46,54,4E,53,26) SystemVendorID=(58
,20,45,43,49,4C,20,20) VersionNumber=(35,2E,33,2E,32,2E,36,2E,31,2E,36,20,20,20,
20,20) SerialNumber=(45,35,43,33,33,38,45,38,34,38,39,44,42,20,20,20,20,20,20,20
,20,20,20,20,20,20,20,20,20,20,20,20) SelfTestResult=0 XTSECapabilities=(00,00,0
0,00,00,00,00,07)
[/etc/templates/wan_vlan.sh] [start] ...
[/var/run/wan_vlan_start.sh] ...
Start CPE SPECIFIC WAN VLAN ...
VLAN Enable...
Added VLAN with VID == 301 to IF -:ptm0:-
Set egress mapping on device -:ptm0.301:- Should be visible in /proc/net/vlan/pt
m0.301
Set egress mapping on device -:ptm0.301:- Should be visible in /proc/net/vlan/pt
m0.301
Set egress mapping on device -:ptm0.301:- Should be visible in /proc/net/vlan/pt
m0.301
Set egress mapping on device -:ptm0.301:- Should be visible in /proc/net/vlan/pt
m0.301
Set egress mapping on device -:ptm0.301:- Should be visible in /proc/net/vlan/pt
m0.301
Set egress mappingptm0.301: Setting MAC address to 5c 33 8e xx xx xx.
VLAN (ptm0.301): Underlying device (ptm0) has same MAC, not checking promisciou
s mode.
on device -:ptm0.301:- Should be visible in /proc/net/vlan/ptm0.301
Set egress mapping on device -:ptm0.301:- Should be visible in /proc/net/vlan/pt
m0.301
Set egress mapping on device -:ptm0.301:- Should be visible in /proc/net/vlan/pt
m0.301
Added VLAN with VID == 101 to IF -:ptm0:-
Added VLAN with VID == 102 to IF -:ptm0:-
Set egress mapping on device -:ptm0.101:- Should be visible in /proc/net/vlan/pt
m0.101
Set egress mapping on device -:ptm0.101:- Should be visible in /proc/netptm0.101
: add 01:00:5e:00:00:01 mcast address to master interface
/vlan/ptm0.101
Set egrptm0.102: add 01:00:5e:00:00:01 mcast address to master interface
ess mapping on device -:ptm0.102:- Should be visible in /proc/net/vlan/ptm0.102
Added VLAN with VID == 101 to IF -:eth0:-
device eth0 left promiscuous mode
br0: port 1(eth0) entering disabled state
Added VLAN with VID == 102 to IF -:eth0:-
eth0.102: dev_set_promiscuity(master, 1)
device eth0 entered promiscuous mode
device eth0.102 entered promiscuous mode
br0: port 1(eth0.101) entering learning state
br0: topology change detected, propagating
br0: port 1(eth0.101) entering forwarding state
DSL[00]: WARNING - SRA not supported by the FW
br0: port 2(eth0.102) entering learning state
br0: topology change detected, propagating
br0: port 2(eth0.102) entering forwarding state
ifx_ppa_init - init succeeded
VID 0 remove is enabled
[/etc/init.d/S10system.sh] done!
rcS done!
- presented Inventory information
- presented Inventory information
nReturn=0
nReturn=0 nDirection=0 G994VendorID=(B5,00,49,46,54,4E,53,26) SystemVendorID=(58
,20,45,43,49,4C,20,20) VersionNumber=(35,2E,33,2E,32,2E,36,2E,31,2E,36,20,20,20,
20,20) SerialNumber=(45,35,43,33,33,38,45,38,34,38,39,44,42,20,20,20,20,20,20,20
,20,20,20,20,20,20,20,20,20,20,20,20) SelfTestResult=0 XTSECapabilities=(00,00,0
0,00,00,00,00,07)
xDSL SILENT
login:
ROM VER: 1.0.5
CFG 01
DDR Access auto data-eye tuning Rev 0.3a
DDR size from 0xa0000000 - 0xa1ffffff
DDR check ok... start booting...
U-Boot 1.0.4 (Oct 18 2010 - 16:20:02)
CLOCK CPU 333M RAM 166M
DRAM: 32 MB
relocate_code start
relocate_code finish.
FLASH MANUFACT: c2
FLASH DEVICEID: cb
Flash: 8 MB
In: serial
Out: serial
Err: serial
Net: fw_addr=0xa0200000
Internal phy(FE) firmware version: 0x0108
vr9 Switch
Type "run flash_flash" to mount root filesystem over flash
Hit 'Esc' key to stop autoboot: 0
VR9 # help
? - alias for 'help'
askenv - get environment variables from stdin
base - print or set address offset
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
cp - memory copy
crc32 - checksum calculation
echo - echo args to console
erase - erase FLASH memory
flinfo - print FLASH memory information
go - start application at address 'addr'
help - print online help
imls - list all images found in flash
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
tftpboot- boot image via network using TFTP protocol
upgrade - forward/backward copy memory to pre-defined flash location
version - print monitor version
VR9 # imls
Have RSA magic !!!
Image at B0051060:
Image Name: MIPS Linux-2.6.20
Created: 2011-02-14 6:44:17 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 3624992 Bytes = 3.5 MB
Load Address: 80002000
Entry Point: 802cd000
Verifying Checksum ... OK
Have RSA magic !!!
Image at B03F1060:
Image Name: MIPS Linux-2.6.20
Created: 2011-08-09 3:31:37 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 3629088 Bytes = 3.5 MB
Load Address: 80002000
Entry Point: 802cd000
Verifying Checksum ... OK
VR9 #
Ok one quick question what address range do I need to dump ?
Also I did not mention I could login to the unit on the UART console, username and pass where admin admin :0)
This thread is getting quite interesting and, er, tasty. Excellent work to date. :)
Bank # 1: MXIC 29LV640BB (64 Mbit, boot sector SA0~SA126 size 64k bytes,other s
ectors SA127~SA135 size 8k bytes)
Size: 8 MB in 135 Sectors
Sector Start Addresses:
B0000000 B0002000 B0004000 B0006000 B0008000
B000A000 B000C000 B000E000 B0010000 B0020000
B0030000 B0040000 B0050000 B0060000 B0070000
B0080000 B0090000 B00A0000 B00B0000 B00C0000
B00D0000 B00E0000 B00F0000 B0100000 B0110000
B0120000 B0130000 B0140000 B0150000 B0160000
B0170000 B0180000 B0190000 B01A0000 B01B0000
B01C0000 B01D0000 B01E0000 B01F0000 B0200000
B0210000 B0220000 B0230000 B0240000 B0250000
B0260000 B0270000 B0280000 B0290000 B02A0000
B02B0000 B02C0000 B02D0000 B02E0000 B02F0000
B0300000 B0310000 B0320000 B0330000 B0340000
B0350000 B0360000 B0370000 B0380000 B0390000
B03A0000 B03B0000 B03C0000 B03D0000 B03E0000
B03F0000 B0400000 B0410000 B0420000 B0430000
B0440000 B0450000 B0460000 B0470000 B0480000
B0490000 B04A0000 B04B0000 B04C0000 B04D0000
B04E0000 B04F0000 B0500000 B0510000 B0520000
B0530000 B0540000 B0550000 B0560000 B0570000
B0580000 B0590000 B05A0000 B05B0000 B05C0000
B05D0000 B05E0000 B05F0000 B0600000 B0610000
B0620000 B0630000 B0640000 B0650000 B0660000
B0670000 B0680000 B0690000 B06A0000 B06B0000
B06C0000 B06D0000 B06E0000 B06F0000 B0700000
B0710000 B0720000 B0730000 B0740000 B0750000
B0760000 B0770000 B0780000 B0790000 B07A0000
B07B0000 B07C0000 B07D0000 B07E0000 B07F0000
Dumping the NAND now going to take a while
Are you running Linux or the other one?
$ head eciflashdumpdemo.hex
b0000000: 2f830000 409eff38 38600000 4bffff3c /...@..88`..K..<
b0000010: 835e000c 809e0008 2b9a00ff 829e0010 .^......+.......
b0000020: 82be0014 7f45d378 409d000c 3b4000ff .....E.x@...;@..
b0000030: 38a000ff 2b9500ff 409d0008 3aa000ff 8...+...@...:...
b0000040: 8002021c 3bfb000a 7f9f0040 419d002c ....;......@A..,
b0000050: 2f9a0000 419e0014 7c1f0050 3925ffff /...A...|..P9%..
b0000060: 7f890040 419d0014 7fe3fb78 4bf1401d ...@A......xK.@.
b0000070: 7c651b78 48000014 3c00bfff 6000ffff |e.xH...<...`...
$ cut -c 2-45 eciflashdumpdemo.hex
0000000: 2f830000 409eff38 38600000 4bffff3c
0000010: 835e000c 809e0008 2b9a00ff 829e0010
0000020: 82be0014 7f45d378 409d000c 3b4000ff
0000030: 38a000ff 2b9500ff 409d0008 3aa000ff
0000040: 8002021c 3bfb000a 7f9f0040 419d002c
0000050: 2f9a0000 419e0014 7c1f0050 3925ffff
0000060: 7f890040 419d0014 7fe3fb78 4bf1401d
0000070: 7c651b78 48000014 3c00bfff 6000ffff
$ cut -c 2-45 eciflashdumpdemo.hex | xxd -r > eciflashdumpdemo.bin
$ xxd eciflashdumpdemo.bin
0000000: 2f83 0000 409e ff38 3860 0000 4bff ff3c /...@..88`..K..<
0000010: 835e 000c 809e 0008 2b9a 00ff 829e 0010 .^......+.......
0000020: 82be 0014 7f45 d378 409d 000c 3b40 00ff .....E.x@...;@..
0000030: 38a0 00ff 2b95 00ff 409d 0008 3aa0 00ff 8...+...@...:...
0000040: 8002 021c 3bfb 000a 7f9f 0040 419d 002c ....;......@A..,
0000050: 2f9a 0000 419e 0014 7c1f 0050 3925 ffff /...A...|..P9%..
0000060: 7f89 0040 419d 0014 7fe3 fb78 4bf1 401d ...@A......xK.@.
0000070: 7c65 1b78 4800 0014 3c00 bfff 6000 ffff |e.xH...<...`...
[nor] dump complete and converted to bin image
http://www.mediafire.com/?1tcdqu616xpfofe (http://www.mediafire.com/?1tcdqu616xpfofe) (EDIT: corrected URL)
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (NAND) (SUMMARY) (C) 2001-2006 Red Hat, Inc.
$ xxd eciflash.bin | grep -A2 'qshs\|sqsh\|hsqs\|shsq'
01410c0: 7173 6873 0000 034c 0000 0000 0d69 6910 qshs...L.....ii.
01410d0: 0000 0000 0000 0008 4001 a000 0003 0000 ........@.......
01410e0: 0f94 0010 c002 014d 58cf 3e00 0000 0015 .......MX.>.....
--
04e10c0: 7173 6873 0000 034c 0000 0000 0d69 6910 qshs...L.....ii.
04e10d0: 0000 0000 0000 0008 4001 a000 0003 0000 ........@.......
04e10e0: 0f94 0010 c002 014e 40aa 1700 0000 0015 .......N@.......
$
$ ./ecisquash-extract eciflash.bin
Size of firmware 'eciflash.bin' : 5856192 octets
---------------------------------------------------------------
Signature of SquashFS found:
---------------------------------------------------------------
Signature : 0x71736873 ('qshs')
Format : LZMA-Big Endian
Offset : 0x1410c0
Version SquashFS : 3.0
Octets utilised : 2641669 octets
Date of creation : Mon Feb 14 06:44:14 2011
---------------------------------------------------------------
Signature of SquashFS found:
---------------------------------------------------------------
Signature : 0x71736873 ('qshs')
Format : LZMA-Big Endian
Offset : 0x4e10c0
Version SquashFS : 3.0
Octets utilised : 2642454 octets
Date of creation : Tue Aug 9 04:31:35 2011
---------------------------------------------------------------
$ dd if=eciflash.bin of=ecirootfs1 bs=1 skip=$((0x1410c0)) count=2641669
2641669+0 records in
2641669+0 records out
2641669 bytes (2.6 MB) copied, 5.69564 s, 464 kB/s
Are you running Linux or the other one?
Wassup asbokid? Were you choking too much to actually type the 'W' word? :lol:
nand dump complete and converted to bin image
http://dl.dropbox.com/u/6134482/ecinand.rar
Excellent job. You deserve a pint!
Silly question time.
As that ECI B-FOCuS modem was supplied as the active NTE for your FTTC service, with it in a disembowelled state, what are you currently using? ???
$ md5sum eciflashdump8mb.bin
2a2db35f797546c0e3e036a469a942d4 eciflashdump8mb.bin
$ ./ecisquash-extract eciflashdump8mb.bin
Size of firmware 'eciflashdump8mb.bin' : 8388608 octets
----------------------------------------------------------------
Signature of SquashFS found:
----------------------------------------------------------------
Signature : 0x71736873 ('qshs')
Format : LZMA-Big Endian
Offset : 0x1410c0
Version SquashFS : 3.0
Octets utilised : 284f05 octets
Date of creation : Mon Feb 14 06:44:14 2011
----------------------------------------------------------------
Signature of SquashFS found:
----------------------------------------------------------------
Signature : 0x71736873 ('qshs')
Format : LZMA-Big Endian
Offset : 0x4e10c0
Version SquashFS : 3.0
Octets utilised : 285216 octets
Date of creation : Tue Aug 9 04:31:35 2011
----------------------------------------------------------------
$ dd if=eciflashdump8mb.bin of=ecirootfs1 bs=1 skip=$((0x1410c0)) count=$((0x284f05))
2641669+0 records in
2641669+0 records out
2641669 bytes (2.6 MB) copied, 3.36489 s, 785 kB/s
$ dd if=eciflashdump8mb.bin of=ecirootfs2 bs=1 skip=$((0x4e10c0)) count=$((0x285216))
2642454+0 records in
2642454+0 records out
2642454 bytes (2.6 MB) copied, 3.40498 s, 776 kB/s
$ dd if=eciflashdump8mb.bin of=jffs2 bs=1 skip=$((0x790000)) count=$((0x10000))
65536+0 records in
65536+0 records out
65536 bytes (66 kB) copied, 0.09391 s, 698 kB/s
$ sudo apt-get install mtd-tools
$ sudo jffs2dump --bigendian jffs2 --endianconvert=jffs2.le
$ sudo modprobe mtdblock
$ sudo modprobe jffs2
$ sudo modprobe mtdram total_size=30000
$ cat /proc/mtd
dev: size erasesize name
mtd0: 01d4c000 00020000 "mtdram test device"
$ sudo dd if=./jffs2.le of=/dev/mtdblock0
128+0 records in
128+0 records out
65536 bytes (66 kB) copied, 0.001695 s, 38.7 MB/s
$ sudo mount -t jffs2 /dev/mtdblock0 /mnt/
$ ls -l /mnt/
total 1
-rw-r--r-- 1 root root 681 Jan 1 2000 btagent.conf
$ cat /mnt/btagent.conf
|BTAgent.ForceReboot||1|ForceReboot
|BTAgent.Restart||1|Restart
|BTAgent.Version|1.21|4|
|BTAgent.FirmwareInformServerIP|firmware.mms.bt.com|6|
|BTAgent.FirmwareInformServerPort|80|6|
|BTAgent.FirmwareInformRequest|GET /%s.txt?modelName=%s&manufacturer=%s&serialnumber=%s&firmwareversion=%s%s HTTP/1.1|6|
|BTAgent.FirmwareInformPeriod|86400|6|
|BTAgent.Default.FirmwareInformPeriod|86400|4|
|BTAgent.Default.FirmwarePullEnable|0|4|
|BTAgent.FirmwarePullEnable|0|6|
|BTAgent.FirmwarePullDelay|0|6|
|BTAgent.FirmwareSupported||6|
|BTAgent.FirmwareAdditional1||6|
|BTAgent.FirmwareAdditional2||6|
|BTAgent.MaxAttempts|10|6|
|BTAgent.ConnectTimeout|60|6|
|BTAgent.TimeoutMultiple|2|6|
$
Any updates uklad?
Line Status
Line Status: Connected
Operational Mode: VDSL2-17a
CO VendorID: IFTN
CO Version: 0xB201
DownStream Parameter
Max BitRate: 131990 kbps
ActualBitRate: 39998 kbps PASS
Capacity: 30.3 %
Latency: Fast
UpStream Parameter
Max BitRate: 32787 kbps
ActualBitRate: 9995 kbps PASS
Capacity: 30.5 %
Latency: Fast...
Kernel command line: root=/dev/mtdblock2 ro rootfstype=squashfs ip=5.57.33.103:5.57.33.111::::eth0:on console=ttyS0,115200 ethaddr=5C:33:8E:xx:xxx:xx phym=32M mem=31M panic=1
....
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
....
squashfsb->s_magic=71736873 SQUASHFS_MAGIC=71736873
ifx_nor0: squashfs filesystem found at 0x4e10a0.
ifx_mtd_init flash0: Using static image partition
Creating 9 MTD partitions on "ifx_nor0":
0x00000000-0x00030000 : "uboot"
0x00030000-0x00040000 : "h/w setting"
0x004e10c0-0x007670c0 : "rootfs"
0x00040000-0x00050000 : "rgdb"
0x00050000-0x003f0000 : "upgrade"
0x003f0000-0x00790000 : "upgrade2"
0x00790000-0x007f0000 : "btagent"
0x00000000-0x00800000 : "flash"
0x00000000-0x00800000 : "<NULL>"
....
VFS: Mounted root (squashfs filesystem) readonly.
$ src/others/squashfs-3.2-r2-lzma/squashfs3.2-r2/squashfs-tools/unsquashfs -ls ecirootfs2
Reading a different endian SQUASHFS filesystem on ecirootfs2
Can't find a SQUASHFS superblock on ecirootfs2
$
$ ~/src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs -stat ecirootfs2
Reading a different endian SQUASHFS filesystem on ecirootfs2
Found a valid big endian SQUASHFS 3:0 superblock on ecirootfs2.
Creation or last append time Tue Aug 9 04:31:35 2011
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Check data is not present in the filesystem
Fragments are present in the filesystem
Always_use_fragments option is not specified
Duplicates are removed
Filesystem size 2580.52 Kbytes (2.52 Mbytes)
Block size 65536
Number of fragments 42
Number of inodes 844
Number of uids 2
Number of gids 1
$
$ ~/src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs -lls ecirootfs2
Reading a different endian SQUASHFS filesystem on ecirootfs2
drwxr-xr-x 505/users 181 2011-08-09 04:31 squashfs-root
drwxr-xr-x 505/users 26 2011-08-09 04:31 squashfs-root/BTAgent
drwxr-xr-x 505/users 280 2011-08-09 04:31 squashfs-root/BTAgent/ro
-rwxr-xr-x 505/users 13 2011-08-09 04:31 squashfs-root/BTAgent/ro/RWPath
-rwxr-xr-x 505/users 10701 2011-08-09 04:31 squashfs-root/BTAgent/ro/btagent
-rwxr-xr-x 505/users 681 2011-08-09 04:31 squashfs-root/BTAgent/ro/btagent.conf
-rwxr-xr-x 505/users 183 2011-08-09 04:31 squashfs-root/BTAgent/ro/btagentstart.sh
-rwxr-xr-x 505/users 5392 2011-08-09 04:31 squashfs-root/BTAgent/ro/libparseplugins.so
-rwxr-xr-x 505/users 6372 2011-08-09 04:31 squashfs-root/BTAgent/ro/libplugin.so
-rwxr-xr-x 505/users 5924 2011-08-09 04:31 squashfs-root/BTAgent/ro/libplugins.so
-rwxr-xr-x 505/users 7316 2011-08-09 04:31 squashfs-root/BTAgent/ro/libsourceplugins.so
-rwxr-xr-x 505/users 8264 2011-08-09 04:31 squashfs-root/BTAgent/ro/libtcp.so
-rwxr-xr-x 505/users 5888 2011-08-09 04:31 squashfs-root/BTAgent/ro/libtransportplugins.so
drwxr-xr-x 505/users 26 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_parse
-rwxr-xr-x 505/users 14956 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_parse/libxml.so
drwxr-xr-x 505/users 108 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source
-rwxr-xr-x 505/users 7944 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libalpha2.so
-rwxr-xr-x 505/users 10212 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libbtagent.so
-rwxr-xr-x 505/users 14248 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libfwm.so
-rwxr-xr-x 505/users 14316 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/liblogger.so
-rwxr-xr-x 505/users 7836 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libprobe.so
-rwxr-xr-x 505/users 27328 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/librsa.so
drwxr-xr-x 505/users 26 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_transport
-rwxr-xr-x 505/users 51820 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_transport/libsec.so
-rwxr-xr-x 505/users 286 2011-08-09 04:31 squashfs-root/BTAgent/ro/publickeys.dat
-rwxr-xr-x 505/users 183 2011-08-09 04:31 squashfs-root/BTAgent/ro/start
drwxr-xr-x 505/users 3 2011-08-09 04:31 squashfs-root/BTAgent/rw
drwxr-xr-x 505/users 456 2011-08-09 04:31 squashfs-root/bin
-rwxr-xr-x 505/users 17992 2011-08-09 04:31 squashfs-root/bin/alphaFlashAgent
-rwxr-xr-x 505/users 33992 2011-08-09 04:31 squashfs-root/bin/alphaHousekeeper
-rwxr-xr-x 505/users 10512 2011-08-09 04:31 squashfs-root/bin/alphaLogd
-rwxr-xr-x 505/users 5272 2011-08-09 04:31 squashfs-root/bin/alpha_flash_cmd
-rwxrwxr-x 505/users 461960 2011-08-09 04:31 squashfs-root/bin/busybox
lrwxrwxrwx 505/users 7 2011-08-09 04:31 squashfs-root/bin/cat -> busybox
[..snipped..]
-rw-r--r-- 505/users 21189 2011-08-09 04:31 squashfs-root/www/layout/alpha.css
drwxr-xr-x 505/users 19 2011-08-09 04:31 squashfs-root/www/locale
drwxr-xr-x 505/users 20 2011-08-09 04:31 squashfs-root/www/locale/en
drwxr-xr-x 505/users 3 2011-08-09 04:31 squashfs-root/www/locale/en/dsc
drwxr-xr-x 505/users 230 2011-08-09 04:31 squashfs-root/www/public
-rw-r--r-- 505/users 402 2011-08-09 04:31 squashfs-root/www/public/__all_need.js
-rw-r--r-- 505/users 2775 2011-08-09 04:31 squashfs-root/www/public/__button.js
-rw-r--r-- 505/users 3173 2011-08-09 04:31 squashfs-root/www/public/__comm.js
-rw-r--r-- 505/users 2595 2011-08-09 04:31 squashfs-root/www/public/__display.js
-rw-r--r-- 505/users 227 2011-08-09 04:31 squashfs-root/www/public/__head.js
-rw-r--r-- 505/users 7992 2011-08-09 04:31 squashfs-root/www/public/__ip.js
-rw-r--r-- 505/users 10249 2011-08-09 04:31 squashfs-root/www/public/__js_comm.js
-rw-r--r-- 505/users 4252 2011-08-09 04:31 squashfs-root/www/public/__menu.js
-rw-r--r-- 505/users 2242 2011-08-09 04:31 squashfs-root/www/public/__no_changes.js
-rw-r--r-- 505/users 184 2011-08-09 04:31 squashfs-root/www/public/__session_timeout.js
-rw-r--r-- 505/users 1473 2011-08-09 04:31 squashfs-root/www/public/__tb_display.js
-rwxr-xr-x 505/users 2115 2011-08-09 04:31 squashfs-root/www/public/__tree.js
-rw-r--r-- 505/users 13508 2011-08-09 04:31 squashfs-root/www/public/__wan_adv.js
lrwxrwxrwx 505/users 17 2011-08-09 04:31 squashfs-root/www/syslog -> /var/log/messages
lrwxrwxrwx 505/users 17 2011-08-09 04:31 squashfs-root/www/tsyslog.rg -> /var/log/tlogsmsg
$
$ ~/src/others/squashfs-3.3-lzma/squashfs3.3/squashfs-tools/unsquashfs -li ecirootfs2
Reading a different endian SQUASHFS filesystem on ecirootfs2
drwxr-xr-x 505/users 181 2011-08-09 04:31 squashfs-root
drwxr-xr-x 505/users 26 2011-08-09 04:31 squashfs-root/BTAgent
drwxr-xr-x 505/users 280 2011-08-09 04:31 squashfs-root/BTAgent/ro
-rwxr-xr-x 505/users 13 2011-08-09 04:31 squashfs-root/BTAgent/ro/RWPath
-rwxr-xr-x 505/users 10701 2011-08-09 04:31 squashfs-root/BTAgent/ro/btagent
-rwxr-xr-x 505/users 681 2011-08-09 04:31 squashfs-root/BTAgent/ro/btagent.conf
-rwxr-xr-x 505/users 183 2011-08-09 04:31 squashfs-root/BTAgent/ro/btagentstart.sh
-rwxr-xr-x 505/users 5392 2011-08-09 04:31 squashfs-root/BTAgent/ro/libparseplugins.so
-rwxr-xr-x 505/users 6372 2011-08-09 04:31 squashfs-root/BTAgent/ro/libplugin.so
-rwxr-xr-x 505/users 5924 2011-08-09 04:31 squashfs-root/BTAgent/ro/libplugins.so
-rwxr-xr-x 505/users 7316 2011-08-09 04:31 squashfs-root/BTAgent/ro/libsourceplugins.so
-rwxr-xr-x 505/users 8264 2011-08-09 04:31 squashfs-root/BTAgent/ro/libtcp.so
-rwxr-xr-x 505/users 5888 2011-08-09 04:31 squashfs-root/BTAgent/ro/libtransportplugins.so
drwxr-xr-x 505/users 26 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_parse
-rwxr-xr-x 505/users 14956 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_parse/libxml.so
drwxr-xr-x 505/users 108 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source
-rwxr-xr-x 505/users 7944 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libalpha2.so
-rwxr-xr-x 505/users 10212 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libbtagent.so
-rwxr-xr-x 505/users 14248 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libfwm.so
-rwxr-xr-x 505/users 14316 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/liblogger.so
-rwxr-xr-x 505/users 7836 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/libprobe.so
-rwxr-xr-x 505/users 27328 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_source/librsa.so
drwxr-xr-x 505/users 26 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_transport
-rwxr-xr-x 505/users 51820 2011-08-09 04:31 squashfs-root/BTAgent/ro/plugin_transport/libsec.so
-rwxr-xr-x 505/users 286 2011-08-09 04:31 squashfs-root/BTAgent/ro/publickeys.dat
-rwxr-xr-x 505/users 183 2011-08-09 04:31 squashfs-root/BTAgent/ro/start
drwxr-xr-x 505/users 3 2011-08-09 04:31 squashfs-root/BTAgent/rw
drwxr-xr-x 505/users 456 2011-08-09 04:31 squashfs-root/bin
-rwxr-xr-x 505/users 17992 2011-08-09 04:31 squashfs-root/bin/alphaFlashAgent
-rwxr-xr-x 505/users 33992 2011-08-09 04:31 squashfs-root/bin/alphaHousekeeper
-rwxr-xr-x 505/users 10512 2011-08-09 04:31 squashfs-root/bin/alphaLogd
-rwxr-xr-x 505/users 5272 2011-08-09 04:31 squashfs-root/bin/alpha_flash_cmd
-rwxrwxr-x 505/users 461960 2011-08-09 04:31 squashfs-root/bin/busybox
err -22
sqlzma_un: LZMA Unknown error 18446744073709551594
Aborted
$
Any more updates mate?
Any more updates mate?
Any information obtained will be revealed, in good time. ;)
Advice: "Nay harry a hacker". ::)
Any more updates mate?
Any more updates mate?Hi Josh,
Debug output to the squashfs tools has been enabled. From call tracing, it looks like ECI has achieved a 'vendor lock' by patching the LZMA compression code for squashfs, the root file system used in the ECI.
Specifically, code in the file LzmaDecode.c (part of the LZMA SDK) is unexpectedly returning an LZMA_RESULT_DATA_ERROR when decoding one of the squashfs data blocks to a large file.
No obvious explanations yet for why that is happening!
cheers, a
$ sudo ./unsquashfs ecirootfs2
Reading a different endian SQUASHFS filesystem on ecirootfs2
err -22
sqlzma_un: LZMA Unknown error 18446744073709551594
err -22
sqlzma_un: LZMA Unknown error 18446744073709551594
created 612 files
created 83 directories
created 118 symlinks
created 31 devices
created 0 fifos
$
int read_data_block(long long start, unsigned int size, char *block) {
int res;
unsigned long bytes = block_size;
int c_byte = SQUASHFS_COMPRESSED_SIZE_BLOCK(size);
TRACE("read_data_block: block @0x%llx, %d %s bytes\n", start,
SQUASHFS_COMPRESSED_SIZE_BLOCK(c_byte),
SQUASHFS_COMPRESSED_BLOCK(c_byte) ? "compressed" : "uncompressed");
if(SQUASHFS_COMPRESSED_BLOCK(size)) {
enum {Src, Dst};
struct sized_buf sbuf[] = {
{.buf = (void *)data, .sz = c_byte},
{.buf = (void *)block, .sz = bytes}
};
if(read_bytes(start, c_byte, data) == FALSE)
return 0;
res = sqlzma_un(&un, sbuf + Src, sbuf + Dst);
if (res) {
TRACE("read_data_block: abort() because res = sqlzma_un = %08x\n", res);
// abort();
}
bytes = un.un_reslen;
return bytes;
} else {
if(read_bytes(start, c_byte, block) == FALSE)
return 0;
return c_byte;
}
}
(the code is from the squashfs-3.3-lzma version [2])Been rummaging through your filesystem dump to look for scripts configuring the modem to be 'locked down'. No dice. Would put money on said files being in that block you can't get to.
That, or it's configured by some arbitrary binary that I've overlooked.
Edit: Also, quite an amusing and bemusing "default" response by Mr Pavlov over at Sourceforge where you raised the issue.
This is an unsatisfactory hack. And it still doesn't explain why the decompression of 2 data blocks is failing while decompression of the remaining 150+ blocks is successful.
Been rummaging through your filesystem dump to look for scripts configuring the modem to be 'locked down'. No dice. Would put money on said files being in that block you can't get to.
That, or it's configured by some arbitrary binary that I've overlooked.
Edit: Also, quite an amusing and bemusing "default" response by Mr Pavlov over at Sourceforge where you raised the issue.
But it does indeed look like there are no licensing issues arising from providing a mangled LZMA filesystem due to the LZMA SDK being released into the public domain.
This is an unsatisfactory hack. And it still doesn't explain why the decompression of 2 data blocks is failing while decompression of the remaining 150+ blocks is successful.
Is it possible I have done a bad NAND dump ?
$ cd ~/Documents/btinfinity/eci_asbo001/squashfs-3.3-lzma-asbo001/squashfs3.3/squashfs-tools
$ ls -ln ecirootfs*
-rw-r--r-- 1 1000 1000 2641669 Feb 14 2011 06:44 ecirootfs1
-rw-r--r-- 1 1000 1000 2642454 Aug 9 2011 04:31 ecirootfs2
$ sudo ./unsquashfs -d ./ecirootfs1-squashfs-root/ ecirootfs1
Reading a different endian SQUASHFS filesystem on ecirootfs1
err -22: sqlzma_un: LZMA Unknown error 18446744073709551594
err -22: sqlzma_un: LZMA Unknown error 18446744073709551594
created 612 files
created 83 directories
created 118 symlinks
created 31 devices
created 0 fifos
$
$ sudo ./unsquashfs -d ./ecirootfs2-squashfs-root/ ecirootfs2
Reading a different endian SQUASHFS filesystem on ecirootfs2
err -22: sqlzma_un: LZMA Unknown error 18446744073709551594
err -22: sqlzma_un: LZMA Unknown error 18446744073709551594
created 612 files
created 83 directories
created 118 symlinks
created 31 devices
created 0 fifos
$
$ diff -r ecirootfs*-squ*
Binary files ecirootfs1-squashfs-root/bin/busybox and ecirootfs2-squashfs-root/bin/busybox differ
Binary files ecirootfs1-squashfs-root/bin/cat and ecirootfs2-squashfs-root/bin/cat differ
Binary files ecirootfs1-squashfs-root/bin/chmod and ecirootfs2-squashfs-root/bin/chmod differ
Binary files ecirootfs1-squashfs-root/bin/cp and ecirootfs2-squashfs-root/bin/cp differ
Binary files ecirootfs1-squashfs-root/bin/date and ecirootfs2-squashfs-root/bin/date differ
Binary files ecirootfs1-squashfs-root/bin/dd and ecirootfs2-squashfs-root/bin/dd differ
Binary files ecirootfs1-squashfs-root/bin/df and ecirootfs2-squashfs-root/bin/df differ
Binary files ecirootfs1-squashfs-root/bin/echo and ecirootfs2-squashfs-root/bin/echo differ
Binary files ecirootfs1-squashfs-root/bin/egrep and ecirootfs2-squashfs-root/bin/egrep differ
Binary files ecirootfs1-squashfs-root/bin/false and ecirootfs2-squashfs-root/bin/false differ
Binary files ecirootfs1-squashfs-root/bin/fgrep and ecirootfs2-squashfs-root/bin/fgrep differ
Binary files ecirootfs1-squashfs-root/bin/grep and ecirootfs2-squashfs-root/bin/grep differ
Binary files ecirootfs1-squashfs-root/bin/gunzip and ecirootfs2-squashfs-root/bin/gunzip differ
Binary files ecirootfs1-squashfs-root/bin/gzip and ecirootfs2-squashfs-root/bin/gzip differ
Binary files ecirootfs1-squashfs-root/bin/kill and ecirootfs2-squashfs-root/bin/kill differ
Binary files ecirootfs1-squashfs-root/bin/ln and ecirootfs2-squashfs-root/bin/ln differ
Binary files ecirootfs1-squashfs-root/bin/login and ecirootfs2-squashfs-root/bin/login differ
Binary files ecirootfs1-squashfs-root/bin/ls and ecirootfs2-squashfs-root/bin/ls differ
Binary files ecirootfs1-squashfs-root/bin/mkdir and ecirootfs2-squashfs-root/bin/mkdir differ
Binary files ecirootfs1-squashfs-root/bin/mknod and ecirootfs2-squashfs-root/bin/mknod differ
Binary files ecirootfs1-squashfs-root/bin/more and ecirootfs2-squashfs-root/bin/more differ
Binary files ecirootfs1-squashfs-root/bin/mount and ecirootfs2-squashfs-root/bin/mount differ
Binary files ecirootfs1-squashfs-root/bin/msh and ecirootfs2-squashfs-root/bin/msh differ
Binary files ecirootfs1-squashfs-root/bin/mv and ecirootfs2-squashfs-root/bin/mv differ
Binary files ecirootfs1-squashfs-root/bin/ping and ecirootfs2-squashfs-root/bin/ping differ
Binary files ecirootfs1-squashfs-root/bin/ps and ecirootfs2-squashfs-root/bin/ps differ
Binary files ecirootfs1-squashfs-root/bin/pwd and ecirootfs2-squashfs-root/bin/pwd differ
Binary files ecirootfs1-squashfs-root/bin/rm and ecirootfs2-squashfs-root/bin/rm differ
Binary files ecirootfs1-squashfs-root/bin/sed and ecirootfs2-squashfs-root/bin/sed differ
Binary files ecirootfs1-squashfs-root/bin/sh and ecirootfs2-squashfs-root/bin/sh differ
Binary files ecirootfs1-squashfs-root/bin/sleep and ecirootfs2-squashfs-root/bin/sleep differ
Binary files ecirootfs1-squashfs-root/bin/touch and ecirootfs2-squashfs-root/bin/touch differ
Binary files ecirootfs1-squashfs-root/bin/true and ecirootfs2-squashfs-root/bin/true differ
Binary files ecirootfs1-squashfs-root/bin/umount and ecirootfs2-squashfs-root/bin/umount differ
Binary files ecirootfs1-squashfs-root/bin/uname and ecirootfs2-squashfs-root/bin/uname differ
Binary files ecirootfs1-squashfs-root/bin/usleep and ecirootfs2-squashfs-root/bin/usleep differ
Binary files ecirootfs1-squashfs-root/bin/zcat and ecirootfs2-squashfs-root/bin/zcat differ
[..snipped - errors from missing symlinks and from reading device nodes..]
diff -r ecirootfs1-squashfs-root/etc/config/builddate ecirootfs2-squashfs-root/etc/config/builddate
1c1
< 2011-02-14 14:44
---
> 2011-08-09 11:31
diff -r ecirootfs1-squashfs-root/etc/config/buildno ecirootfs2-squashfs-root/etc/config/buildno
1c1
< b2ee
---
> b89b
diff -r ecirootfs1-squashfs-root/etc/config/buildrev ecirootfs2-squashfs-root/etc/config/buildrev
1c1
< 3067
---
> 3123
Binary files ecirootfs1-squashfs-root/etc/config/defaultvalue.gz and ecirootfs2-squashfs-root/etc/config/defaultvalue.gz differ
Binary files ecirootfs1-squashfs-root/ifx/vdsl2/drv_dsl_cpe_api.ko and ecirootfs2-squashfs-root/ifx/vdsl2/drv_dsl_cpe_api.ko differ
Binary files ecirootfs1-squashfs-root/ifx/vdsl2/drv_ifxos.ko and ecirootfs2-squashfs-root/ifx/vdsl2/drv_ifxos.ko differ
Binary files ecirootfs1-squashfs-root/ifx/vdsl2/xcpe_hw.bin and ecirootfs2-squashfs-root/ifx/vdsl2/xcpe_hw.bin differ
Binary files ecirootfs1-squashfs-root/lib/libsystem.so and ecirootfs2-squashfs-root/lib/libsystem.so differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/connector/cn.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/connector/cn.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/dummy.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/dummy.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/platform/vr9/e5/ifxmips_ppa_datapath_vr9_e5.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/platform/vr9/e5/ifxmips_ppa_datapath_vr9_e5.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/platform/vr9/e5/ifxmips_ppa_hal_vr9_e5.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/platform/vr9/e5/ifxmips_ppa_hal_vr9_e5.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/ppa_api/ifx_ppa_api.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/ppa_api/ifx_ppa_api.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/ppa_api/ifx_ppa_api_proc.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/drivers/net/ifxmips_ppa/ppa_api/ifx_ppa_api_proc.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/fs/configfs/configfs.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/fs/configfs/configfs.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/security/capability.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/security/capability.ko differ
Binary files ecirootfs1-squashfs-root/lib/modules/2.6.20.19/kernel/security/commoncap.ko and ecirootfs2-squashfs-root/lib/modules/2.6.20.19/kernel/security/commoncap.ko differ
Binary files ecirootfs1-squashfs-root/sbin/getty and ecirootfs2-squashfs-root/sbin/getty differ
Binary files ecirootfs1-squashfs-root/sbin/ifconfig and ecirootfs2-squashfs-root/sbin/ifconfig differ
Binary files ecirootfs1-squashfs-root/sbin/init and ecirootfs2-squashfs-root/sbin/init differ
Binary files ecirootfs1-squashfs-root/sbin/insmod and ecirootfs2-squashfs-root/sbin/insmod differ
Binary files ecirootfs1-squashfs-root/sbin/lsmod and ecirootfs2-squashfs-root/sbin/lsmod differ
Binary files ecirootfs1-squashfs-root/sbin/mdev and ecirootfs2-squashfs-root/sbin/mdev differ
Binary files ecirootfs1-squashfs-root/sbin/modprobe and ecirootfs2-squashfs-root/sbin/modprobe differ
Binary files ecirootfs1-squashfs-root/sbin/reboot and ecirootfs2-squashfs-root/sbin/reboot differ
Binary files ecirootfs1-squashfs-root/sbin/rmmod and ecirootfs2-squashfs-root/sbin/rmmod differ
Binary files ecirootfs1-squashfs-root/sbin/route and ecirootfs2-squashfs-root/sbin/route differ
Binary files ecirootfs1-squashfs-root/sbin/swapoff and ecirootfs2-squashfs-root/sbin/swapoff differ
Binary files ecirootfs1-squashfs-root/sbin/swapon and ecirootfs2-squashfs-root/sbin/swapon differ
Binary files ecirootfs1-squashfs-root/sbin/sysctl and ecirootfs2-squashfs-root/sbin/sysctl differ
Binary files ecirootfs1-squashfs-root/usr/bin/[ and ecirootfs2-squashfs-root/usr/bin/[ differ
Binary files ecirootfs1-squashfs-root/usr/bin/basename and ecirootfs2-squashfs-root/usr/bin/basename differ
Binary files ecirootfs1-squashfs-root/usr/bin/cut and ecirootfs2-squashfs-root/usr/bin/cut differ
Binary files ecirootfs1-squashfs-root/usr/bin/dirname and ecirootfs2-squashfs-root/usr/bin/dirname differ
Binary files ecirootfs1-squashfs-root/usr/bin/expr and ecirootfs2-squashfs-root/usr/bin/expr differ
Binary files ecirootfs1-squashfs-root/usr/bin/free and ecirootfs2-squashfs-root/usr/bin/free differ
Binary files ecirootfs1-squashfs-root/usr/bin/killall and ecirootfs2-squashfs-root/usr/bin/killall differ
Binary files ecirootfs1-squashfs-root/usr/bin/logger and ecirootfs2-squashfs-root/usr/bin/logger differ
Binary files ecirootfs1-squashfs-root/usr/bin/mpstat and ecirootfs2-squashfs-root/usr/bin/mpstat differ
Binary files ecirootfs1-squashfs-root/usr/bin/test and ecirootfs2-squashfs-root/usr/bin/test differ
Binary files ecirootfs1-squashfs-root/usr/bin/test_agent and ecirootfs2-squashfs-root/usr/bin/test_agent differ
Binary files ecirootfs1-squashfs-root/usr/bin/tftp and ecirootfs2-squashfs-root/usr/bin/tftp differ
Binary files ecirootfs1-squashfs-root/usr/bin/top and ecirootfs2-squashfs-root/usr/bin/top differ
Binary files ecirootfs1-squashfs-root/usr/bin/tr and ecirootfs2-squashfs-root/usr/bin/tr differ
Binary files ecirootfs1-squashfs-root/usr/bin/uptime and ecirootfs2-squashfs-root/usr/bin/uptime differ
Binary files ecirootfs1-squashfs-root/usr/bin/wc and ecirootfs2-squashfs-root/usr/bin/wc differ
Binary files ecirootfs1-squashfs-root/usr/bin/wget and ecirootfs2-squashfs-root/usr/bin/wget differ
Binary files ecirootfs1-squashfs-root/usr/bin/yes and ecirootfs2-squashfs-root/usr/bin/yes differ
Binary files ecirootfs1-squashfs-root/usr/sbin/cfm and ecirootfs2-squashfs-root/usr/sbin/cfm differ
$
$ cat ecirootfs2-squashfs-root/etc/config/defaultvalue.gz | gunzip
<lantiq_vr9_generic_asl56026>
<check>
<is_factory>factory</is_factory>
</check>
<vdsl2>
<infineon>
<fw_variant>VA</fw_variant>
<annex>A</annex>
<adsl_encaps>1</adsl_encaps>
<default_vpi_vci>1</default_vpi_vci>
<line_config>
<filter>0</filter>
<hw_hybrid>2</hw_hybrid>
<line_mode>102</line_mode>
</line_config>
</infineon>
</vdsl2>
<switch>
<bypass_mode>0</bypass_mode>
<lan_access_cpe_enable>0</lan_access_cpe_enable>
<discard_specific_pkt>1</discard_specific_pkt>
<igmp_queue>3</igmp_queue>
<port id="1">
<vid>101</vid>
<pri>2</pri>
<loopback>0</loopback>
<activate>1</activate>
<special_vlan>0</special_vlan>
</port>
<port id="2">
<vid>102</vid>
<pri>7</pri>
<loopback>0</loopback>
<activate>0</activate>
<special_vlan>0</special_vlan>
</port>
</switch>
<wan>
<physical_type>1</physical_type>
<enable_dhcp60>0</enable_dhcp60>
<dhcp_option60></dhcp_option60>
<enable_dhcp61>0</enable_dhcp61>
<dhcp_iaid></dhcp_iaid>
<dhcp_duid>0</dhcp_duid>
<enable_dhcp125>0</enable_dhcp125>
<dhcp_option125></dhcp_option125>
<enable_prepadt>0</enable_prepadt>
<dsl>
<defaultroute>1</defaultroute>
<inf id="1">
<mode>1</mode>
<enable>1</enable>
<atm>
<pvc>
<settings>
<vpi>8</vpi>
<vci>35</vci>
</settings>
</pvc>
</atm>
<ptm>
<vtag>
<settings>
<connection>connection1</connection>
<enable>1</enable>
<vid>301</vid>
<priority>5</priority>
<bt>
<enable>1</enable>
<wan_vid1>101</wan_vid1>
<wan_vid2>102</wan_vid2>
</bt>
</settings>
</vtag>
</ptm>
<dhcp>
<hostname></hostname>
<clonemac></clonemac>
<autodns>1</autodns>
<mtu>1500</mtu>
</dhcp>
<static>
<mode>1</mode>
<ip>5.60.39.51</ip>
<netmask>255.0.0.0</netmask>
<gateway>5.21.97.200</gateway>
<clonemac></clonemac>
<mtu>1500</mtu>
</static>
</inf>
[...snipped...]
</lantiq_vr9_generic_asl56026>
interesting i spent some time trying to get port 2 active with no luck..
do you know what files are failing during the decompression..
$ cd ~/Documents/btinfinity/eci_asbo001/lzma439_asbo002/C/7zip/Compress/LZMA_C
$ xxd -l 13 test1.lzma
0000000: 5d00 0080 0000 0001 0000 0000 00 ]............
$ xxd -l 13 test2.lzma
0000000: 5d00 0080 0000 0001 0000 0000 00 ]............
$ ./lzmadec test2.lzma test2.bin
Opened test2.lzma
compressedSize = 17129
outSizeFull = 65536
Calling LzmaDecode(compressedSize = 17129, estimOutSize = 17079) : returned res = 0 (success) -- inProcessed = 7525, outProcessed = 17079
Calling LzmaDecode(compressedSize = 17129, estimOutSize = 17080) : returned res = 0 (success) -- inProcessed = 7525, outProcessed = 17080
Calling LzmaDecode(compressedSize = 17129, estimOutSize = 17081) : returned res = 0 (success) -- inProcessed = 7525, outProcessed = 17081
Calling LzmaDecode(compressedSize = 17129, estimOutSize = 17082) : returned res = 0 (success) -- inProcessed = 7525, outProcessed = 17082
Calling LzmaDecode(compressedSize = 17129, estimOutSize = 17083) : returned res = 0 (success) -- inProcessed = 7527, outProcessed = 17083
[.. snipped ..]
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31866) : returned res = 0 (success) -- inProcessed = 12067, outProcessed = 31866
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31867) : returned res = 0 (success) -- inProcessed = 12067, outProcessed = 31867
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31868) : returned res = 0 (success) -- inProcessed = 12069, outProcessed = 31868
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31869) : returned res = 0 (success) -- inProcessed = 12069, outProcessed = 31869
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31870) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31871) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31872) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31873) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31874) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31875) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
[.. snipped ..]
$ ./lzmadec test1.lzma test1.bin
Opened test1.lzma
compressedSize = 25826
outSizeFull = 65536
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 25776) : returned res = 0 (success) -- inProcessed = 10700, outProcessed = 25776
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 25777) : returned res = 0 (success) -- inProcessed = 10701, outProcessed = 25777
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 25778) : returned res = 0 (success) -- inProcessed = 10701, outProcessed = 25778
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 25779) : returned res = 0 (success) -- inProcessed = 10701, outProcessed = 25779
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 25780) : returned res = 0 (success) -- inProcessed = 10702, outProcessed = 25780
[.. snipped ..]
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65530) : returned res = 0 (success) -- inProcessed = 25824, outProcessed = 65530
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65531) : returned res = 0 (success) -- inProcessed = 25824, outProcessed = 65531
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65532) : returned res = 0 (success) -- inProcessed = 25824, outProcessed = 65532
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65533) : returned res = 0 (success) -- inProcessed = 25826, outProcessed = 65533
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65534) : returned res = 0 (success) -- inProcessed = 25826, outProcessed = 65534
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65535) : returned res = 0 (success) -- inProcessed = 25826, outProcessed = 65535
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65536) : returned res = 0 (success) -- inProcessed = 25826, outProcessed = 65536
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65537) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65538) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65539) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65540) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65541) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65542) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
Calling LzmaDecode(compressedSize = 25826, estimUncompSize = 65543) : returned res = 1 (fail) -- inProcessed = 0, outProcessed = 0
[.. snipped ..]
Calling LzmaDecode(compressedSize = 17129, estimUncompSize = 31869) : returned res = 0 (success) -- inProcessed = 12069, outProcessed = 31869
do you know what files are failing during the decompression..
Reading a different endian SQUASHFS filesystem on ecirootfs1
-rwxr-xr-x 505/users 578157 2011-02-14 06:44 squashfs-root/ifx/vdsl2/drv_dsl_cpe_api.ko
unsquashfs: dir_scan: name drv_dsl_cpe_api.ko, start_block 0, offset 7621, type 2
unsquashfs: create_inode: pathname squashfs-root/ifx/vdsl2/drv_dsl_cpe_api.ko
unsquashfs: create_inode: regular file, file_size 578157, blocks 9
unsquashfs: write_file: regular file, blocks 9
unsquashfs: read_data_block: block @0x44e35, 14351 compressed bytes
unsquashfs: read_bytes: reading from position 0x44e35, bytes 14351 (0x380f)
[...snipped...]
unsquashfs: read_data_block: block @0x4dffe, 18111 compressed bytes
unsquashfs: read_bytes: reading from position 0x4dffe, bytes 18111 (0x46bf)
00000000: 5d 00 00 80 00 00 00 01 00 00 00 00 00 00 13 af
00000010: 3c 06 45 13 7d b5 59 62 72 8f db b5 8f 8e f0 bb
[...snipped...]
000045a0: a3 d0 37 83 70 87 5c 82 2b 3a fd 66 9b d6 b6 0c
000045b0: b2 6e 0d d5 34 07 57
err -22: sqlzma_un: LZMA Unknown error 18446744073709551594
ea ae 66 04 51 9e 5e be 31
000045c0: 4c 0b 51 6f 16 63 d7 cb da 76 cb ce c5 00 69 8f
[...snipped...]
000046b0: 4d 78 5c af fa f7 81 18 0c f1 6d 19 6c 95 03
unsquashfs: read_data_block: abort() because res = sqlzma_un = ffffffea
[...snipped...]
-rwxr-xr-x 505/users 767376 2011-02-14 06:44 squashfs-root/ifx/vdsl2/xcpe_hw.bin
unsquashfs: read_fragment: reading fragment 10
unsquashfs: dir_scan: name xcpe_hw.bin, start_block 0, offset 8001, type 2
unsquashfs: create_inode: pathname squashfs-root/ifx/vdsl2/xcpe_hw.bin
unsquashfs: create_inode: regular file, file_size 767376, blocks 12
unsquashfs: write_file: regular file, blocks 12
unsquashfs: read_data_block: block @0x7af16, 40885 compressed bytes
unsquashfs: read_bytes: reading from position 0x7af16, bytes 40885 (0x9fb5)
[...snipped...]
unsquashfs: read_data_block: block @0x8e143, 40792 compressed bytes
unsquashfs: read_bytes: reading from position 0x8e143, bytes 40792 (0x9f58)
00000000: 5d 00 00 80 00 00 00 01 00 00 00 00 00 00 02 00
00000010: 09 91 c2 58 7c 6b 07 b7 bc e8 98 5f 1e 63 13 cc
[...snipped...]
00009d30: 44 e8 23 9d 7c 3c 87 30 50 9c da d2 d1 f5 84 e9
00009d40: fa f4 51 2c d8 fb 48 be 51 56 97 20 b5 e7 de 72
00009d5
err -22: sqlzma_un: LZMA Unknown error 18446744073709551594
0: 73 e3 e1 51 75 8a 59 d1 b2 73 04 4a 9b 7f 89 28
00009d60: 90 61 9f b6 9c 9b 9b b3 5f 38 6a a5 90 d5 85 11
[...snipped...]
00009f50: c0 ae c7 10 5e 2a f0 94
unsquashfs: read_data_block: abort() because res = sqlzma_un = ffffffea
Reading a different endian SQUASHFS filesystem on ecirootfs2
-rwxrwxr-x 505/users 461960 2011-08-09 04:31 squashfs-root/bin/busybox
unsquashfs: dir_scan: name busybox, start_block 0, offset 936, type 2
unsquashfs: create_inode: pathname squashfs-root/bin/busybox
unsquashfs: create_inode: regular file, file_size 461960, blocks 8
unsquashfs: write_file: regular file, blocks 8
unsquashfs: read_data_block: block @0x10de0, 24250 compressed bytes
unsquashfs: read_bytes: reading from position 0x10de0, bytes 24250 (0x5eba)
[...snipped...]
unsquashfs: read_data_block: block @0x32edc, 17142 compressed bytes
unsquashfs: read_bytes: reading from position 0x32edc, bytes 17142 (0x42f6)
00000000: 5d 00 00 80 00 00 00 01 00 00 00 00 00 00 31 19
00000010: 40 06 32 0a 09 7e e1 df 4a af 79 8a 22 ec c1 75
[...snipped...]
00004180: 12 55 4f b3 18 02 b9 38 8d 36 1b 65 cd 44 43 f2
err -22
sqlzma_un: LZMA Unknown error 18446744073709551594
00004190: 8d f9 4a 51 0d 4a 8f 85 2d c4 95 5c 07 a9 6e e3
[...snipped...]
000042e0: 50 71 26 6b 9d 15 b9 f0 b8 bc ab 34 65 9a e4 86
000042f0: 6e f7 89 92 48 ae
unsquashfs: read_data_block: abort() because res = sqlzma_un = ffffffea
[...snipped...]
-rwxr-xr-x 505/users 357839 2011-08-09 04:31 squashfs-root/ifx/vdsl2/drv_ifxos.ko
unsquashfs: dir_scan: name drv_ifxos.ko, start_block 0, offset 7689, type 2
unsquashfs: create_inode: pathname squashfs-root/ifx/vdsl2/drv_ifxos.ko
unsquashfs: create_inode: regular file, file_size 357839, blocks 6
unsquashfs: write_file: regular file, blocks 6
unsquashfs: read_data_block: block @0x63bb1, 25245 compressed bytes
unsquashfs: read_bytes: reading from position 0x63bb1, bytes 25245 (0x629d)
00000000: 5d 00 00 80 00 00 00 01 00 00 00 00 00 00 3f 91
00000010: 45 84 68 34 8a 09 0a 41 50 57 af 46 76 b3 d7 96
[...snipped...]
00006200: 07 3b e0 a3 cb 88 2d 62 b0 6f 1e 6c 26 47 da b5
0000
err -22: sqlzma_un: LZMA Unknown error 18446744073709551594
6210: e8 90 91 68 22 96 49 a8 9f 06 19 d7 b7 50 71 2e
[...snipped...]
00006280: 4b 29 9c 2d 1f 9b 5f 33 49 de 42 43 03 45 f2 42
00006290: 1f ba 76 8a d3 b5 72 d7 34 8c f9 62 32
unsquashfs: read_data_block: abort() because res = sqlzma_un = ffffffea
Hi uklad,interesting i spent some time trying to get port 2 active with no luck..
One trick is as follows:
Copy that file /etc/config/defaultvalue.gz from the squashfs read-only root file system to a read-write file system (e.g. a ramdisk).
Modify that read-writable copy with the desired configurations.
Re-mount the modified file over the top of the original in the read-only squashfs.
(See the Linux/busybox manpage for mount, and the --bind option.)
Force the config software - the firmware utility that actually reads the contents of that file - to re-load it.
Since this doesn't modify the squashfs system it is non-destructive. The hack is described well by paul at sbrk.co.uk at [1].
I'm not sure what any of that proves.. except that there are exactly two bad blocks per file system, and they are in different places in each file system.
QuoteI'm not sure what any of that proves.. except that there are exactly two bad blocks per file system, and they are in different places in each file system.
May be just pointless caterwauling on my part but if those two squashfs' are supposed to be identical, with two defects in different places in them both, then surely a controlled merge of both will give you one complete file system. :-\
Hmm . . . am I yowling from the wrong tree-top? ???
Attached to this post is a "screen-scrape" from a BT Slide Presentation. It shows the Huawei and ECI modems side-by-side.
flamey, a FTTC subscriber from Colchester, has posted some useful exterior pictures of the ECI to the Sky User forum As flamey points out, it is very difficult to distinguish the ECI from the Huawei. The LEDs and the sockets are spaced slightly differently on the ECI, but on purely physical appearance, they are otherwise virtually identical devices.
http://www.skyuser.co.uk/forum/router-stats/47260-hacking-bt-openreach-modem-hg612.html#post358530
cheers, a
EDIT:
@uklad: did you find time to try the 'mount' hack?
Hi uklad!
Did you get a chance to have another look?
cheers, a
// The Telnet Upload Trick - asbokid 2012 <ballymunboy@gmail.com>
//
// How to download an arbitrary binary to an embedded device
//
// 1) convert the binary into an octal dump using the code below
// 2) paste the dump into a telnet shell or a serial console
// 3) chmod +x the dumped file (myscript.sh) and run it
// 4) the octal dump will be echoed into a binary file (mybinary)
// 5) chmod +x that new binary and run it
#include <stdio.h>
void main(int argc, char **argv) {
FILE *fp;
unsigned int c, d = 0;
if(!(fp = fopen(argv[1], "rb"))) {
fprintf(stderr, "can't open file %s\n", argv[1]);
return;
}
while(1) {
if((c = fgetc(fp)) == EOF)
break;
if(!(d++ % 0x10))
fprintf(stdout, "echo -n -e ");
fprintf(stdout, "\\\\%04o", c);
if(!(d % 0x10))
fprintf(stdout, " >> mybinary\n");
}
if (d % 0x10)
fprintf(stdout, " >> mybinary\n");
fclose(fp);
}
$ gcc -o octaldump octaldump.c
$ ./octaldump octaldump > myscript.sh
$ head myscript.sh
echo -n -e \\0177\\0105\\0114\\0106\\0002\\0001\\0001\\0000\\0000\\0000\\0000\\0000\\0000\\0000\\0000\\0000 >> mybinary
echo -n -e \\0002\\0000\\0076\\0000\\0001\\0000\\0000\\0000\\0300\\0005\\0100\\0000\\0000\\0000\\0000\\0000 >> mybinary
echo -n -e \\0100\\0000\\0000\\0000\\0000\\0000\\0000\\0000\\0130\\0015\\0000\\0000\\0000\\0000\\0000\\0000 >> mybinary
echo -n -e \\0000\\0000\\0000\\0000\\0100\\0000\\0070\\0000\\0010\\0000\\0100\\0000\\0037\\0000\\0034\\0000 >> mybinary
$ chmod +x myscript.sh
$ ./myscript.sh
$ xxd -l80 mybinary
0000000: 7f45 4c46 0201 0100 0000 0000 0000 0000 .ELF............
0000010: 0200 3e00 0100 0000 c005 4000 0000 0000 ..>.......@.....
0000020: 4000 0000 0000 0000 580d 0000 0000 0000 @.......X.......
0000030: 0000 0000 4000 3800 0800 4000 1f00 1c00 ....@.8...@.....
0000040: 0600 0000 0500 0000 4000 0000 0000 0000 ........@.......
$ $ md5sum mybinary octaldump
64f293a8272b7938ace5c805f6873402 mybinary
64f293a8272b7938ace5c805f6873402 octaldump
Aww! Don't give up! ??? you've already done all the hard work!
From using both the ECI and huawei hg612, I have noticed that I get more jitter using the hg612. The eci seems to perform a little better on my connection. may be different for your connection.
From using both the ECI and huawei hg612, I have noticed that I get more jitter using the hg612. The eci seems to perform a little better on my connection. may be different for your connection.
Josh -- A quick couple of questions for you. When you had your FTTC service installed, which VDSL2 modem was officially provided as the active CPE? The Huawei or the ECI? As you probably realise, Openreach supply the modem to match the DSLAM in the FTTC.
If your installation was a Huawei, I wonder from where did you obtain the ECI B-FOCuS modem? Care to share the information, please? ;)
I know ECI modems are hard to track down, I have not seen one on eBay!
Also I did not mention I could login to the unit on the UART console, username and pass where admin admin :0)
No problem at all, I can accommodate ANY hosting needs, especially to aid the greater good of a freed community --decentralising, and taking back control/data, is my computing MO.A man after my own heart!
..would you mind sending me (or attaching) the bin file, as I don't want a Google account --yes, one of those!
Once this is opened, what then? What are the options? Fundamental question, and possibly obvious answers, but I'm naive in this area of computing, what cool things can be done?
Also, would you mind sending me (or attaching) the bin file, as I don't want a Google account --yes, one of those!
Lastly, did uklad not get shell access:-
Also I did not mention I could login to the unit on the UART console, username and pass where admin admin :0)
Is it not straight forward to "re-enable web and telnet/ssh access from the LAN-side." ?
QuoteAlso, would you mind sending me (or attaching) the bin file, as I don't want a Google account --yes, one of those!
For a short time only (just to allow you to download it), I have made the file available from a temporary location (http://elrepo.org/people/ajb/tmp/ECI). Please let me know once you have got a copy. ;)
Thanks burakkucat :)
QuoteAlso, would you mind sending me (or attaching) the bin file, as I don't want a Google account --yes, one of those!
For a short time only (just to allow you to download it), I have made the file available from a temporary location (http://elrepo.org/people/ajb/tmp/ECI). Please let me know once you have got a copy. ;)
Thanks, I've got the files I need.
Lastly, did uklad not get shell access:-
Also I did not mention I could login to the unit on the UART console, username and pass where admin admin :0)
Yes, uklad indeed got shell access.QuoteIs it not straight forward to "re-enable web and telnet/ssh access from the LAN-side." ?
It should be. Unfortunately before uklad got there, he was distracted by his family who obviously have no appreciation of the importance to this work!
cheers, a
Full time job one wife two kids and builders out the back is leaving me with very little spare time !! but i`m still lurking.. and you are correct I did try explaining once what i was doing with the ECI modem and she gave me the rolled eyes nod !! followed by ohhh yeah !!
I have recently got one of these with my FTTC install although I'm not quite ready to kill it. I have emailed sfconservancy.org and they have shown an interest in the situation. I will keep you posted on any progress relating to GPL compliance. If someone can show me the exact solder points I do have the required equipment here already for a serial-usb adapter...
I should get my converter tomorrow, one advantage of paying extra for buying from the UK. From there I'm quite happy to help out as I can, although I'm not really that sure what I'm doing. What if we were to use mine to modify the firmware to enable the web interface? Surely that would give a usable image for an "upgrade" of everyone elses.
$ md5sum ecinand8mb.bin
2a2db35f797546c0e3e036a469a942d4 ecinand8mb.bin
$ binwalk ecinand8mb.bin
DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
17680 0x4510 uImage header, header size: 64 bytes, header CRC: 0xDCFA529A, created: Mon Oct 18 09:20:23 2010, image size: 49728 bytes, Data Address: 0xA0400000, Entry Point: 0xA0400000, data CRC: 0xC1F4907, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: u-boot image
17744 0x4550 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 133532 bytes
262438 0x40126 gzip compressed data, from Unix, last modified: Sat Jan 1 00:02:13 2000, max compression
331872 0x51060 uImage header, header size: 64 bytes, header CRC: 0x6C1EFC77, created: Mon Feb 14 06:44:17 2011, image size: 3624992 bytes, Data Address: 0x80002000, Entry Point: 0x802CD000, data CRC: 0x15E32D3E, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: MIPS Linux-2.6.20
331936 0x510A0 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3084422 bytes
1314976 0x1410A0 PackImg Tag, little endian size: 5253120 bytes; big endian size: 2641920 bytes
1315008 0x1410C0 Squashfs filesystem, big endian, lzma signature, version 3.0, size: 2641669 bytes, 844 inodes, blocksize: 65536 bytes, created: Mon Feb 14 06:44:14 2011
1315127 0x141137 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 61676 bytes
1330443 0x144D0B LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 7100 bytes
[...]
3954947 0x3C5903 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 672 bytes
3955226 0x3C5A1A LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 6752 bytes
4132960 0x3F1060 uImage header, header size: 64 bytes, header CRC: 0x55E6D872, created: Tue Aug 9 04:31:37 2011, image size: 3629088 bytes, Data Address: 0x80002000, Entry Point: 0x802CD000, data CRC: 0xC331258, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: MIPS Linux-2.6.20
4133024 0x3F10A0 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 3084421 bytes
5116064 0x4E10A0 PackImg Tag, little endian size: 6301696 bytes; big endian size: 2646016 bytes
5116096 0x4E10C0 Squashfs filesystem, big endian, lzma signature, version 3.0, size: 2642454 bytes, 844 inodes, blocksize: 65536 bytes, created: Tue Aug 9 04:31:35 2011
5116215 0x4E1137 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 50734 bytes
[...]
7757093 0x765D25 LZMA compressed data, properties: 0x5D, dictionary size: 8388608 bytes, uncompressed size: 6752 bytes
7929856 0x790000 JFFS2 filesystem data big endian, JFFS node length: 12
[...]
8257536 0x7E0000 JFFS2 filesystem data big endian, JFFS node length: 12
$ dd bs=1 if=ecinand8mb.bin of=eciconfig.gz skip=$((0x40126)) count=$((0x8a4))
2212+0 records in
2212+0 records out
2212 bytes (2.2 kB) copied, 0.0065032 s, 340 kB/s
$ gunzip -v -l eciconfig.gz
method crc date time compressed uncompressed ratio uncompressed_name
defla 366d7213 Apr 5 17:45 2212 7929 72.4% eciconfig
$ cat eciconfig.gz | gunzip
<lantiq_vr9_generic_asl56026>
<check>
<is_factory>factory</is_factory>
</check>
<vdsl2>
<infineon>
<fw_variant>VA</fw_variant>
<annex>A</annex>
<adsl_encaps>1</adsl_encaps>
<default_vpi_vci>1</default_vpi_vci>
<line_config>
<filter>0</filter>
<hw_hybrid>2</hw_hybrid>
<line_mode>102</line_mode>
</line_config>
</infineon>
</vdsl2>
<switch>
<bypass_mode>0</bypass_mode>
<lan_access_cpe_enable>0</lan_access_cpe_enable>
<discard_specific_pkt>1</discard_specific_pkt>
<igmp_queue>3</igmp_queue>
<port id="1">
<vid>101</vid>
<pri>2</pri>
<loopback>0</loopback>
<activate>1</activate>
<special_vlan>0</special_vlan>
</port>
<port id="2">
<vid>102</vid>
<pri>7</pri>
<loopback>0</loopback>
<activate>0</activate>
<special_vlan>0</special_vlan>
</port>
</switch>
<wan>
<physical_type>1</physical_type>
<enable_dhcp60>0</enable_dhcp60>
<dhcp_option60></dhcp_option60>
<enable_dhcp61>0</enable_dhcp61>
<dhcp_iaid></dhcp_iaid>
<dhcp_duid>0</dhcp_duid>
<enable_dhcp125>0</enable_dhcp125>
<dhcp_option125></dhcp_option125>
<enable_prepadt>0</enable_prepadt>
<dsl>
<defaultroute>1</defaultroute>
<inf id="1">
<mode>1</mode>
<enable>1</enable>
<atm>
<pvc>
<settings>
<vpi>8</vpi>
<vci>35</vci>
</settings>
</pvc>
</atm>
<ptm>
<vtag>
<settings>
<connection>connection1</connection>
<enable>1</enable>
<vid>301</vid>
<priority>5</priority>
<bt>
<enable>1</enable>
<wan_vid1>101</wan_vid1>
<wan_vid2>102</wan_vid2>
</bt>
</settings>
</vtag>
</ptm>
<dhcp>
<hostname></hostname>
<clonemac></clonemac>
<autodns>1</autodns>
<mtu>1500</mtu>
</dhcp>
<static>
<mode>1</mode>
<ip>5.60.39.51</ip>
<netmask>255.0.0.0</netmask>
<gateway>5.21.97.200</gateway>
<clonemac></clonemac>
<mtu>1500</mtu>
</static>
</inf>
<inf id="2">
<mode>2</mode>
<enable>0</enable>
<atm>
<pvc>
<settings>
<vpi>0</vpi>
<vci>35</vci>
</settings>
</pvc>
</atm>
<ptm>
<vtag>
<settings>
<connection>connection2</connection>
<enable>0</enable>
<vid>12</vid>
<priority>0</priority>
</settings>
</vtag>
</ptm>
<dhcp>
<hostname></hostname>
<clonemac></clonemac>
<autodns>1</autodns>
<mtu>1500</mtu>
</dhcp>
<static>
<mode>1</mode>
<ip>5.55.52.52</ip>
<netmask>255.0.0.0</netmask>
<gateway>5.55.52.1</gateway>
<clonemac></clonemac>
<mtu>1500</mtu>
</static>
</inf>
</dsl>
<defaultroute>1</defaultroute>
</wan>
<lan>
<ethernet>
<inf id="1">
<enable>1</enable>
<defaultip>192.168.168.168</defaultip>
<ip>192.168.168.168</ip>
<netmask>255.255.255.0</netmask>
<dhcp>
<server>
<enable>0</enable>
</server>
</dhcp>
</inf>
</ethernet>
</lan>
<dnsrelay>
<mode>2</mode>
<server>
<primarydns>172.19.10.100</primarydns>
<secondarydns>172.19.10.99</secondarydns>
</server>
</dnsrelay>
<security>
<log>
<systeminfo>1</systeminfo>
<debuginfo>0</debuginfo>
<attackinfo>1</attackinfo>
<droppacketinfo>0</droppacketinfo>
<noticeinfo>1</noticeinfo>
</log>
</security>
<time>
<syncwith>2</syncwith>
<timezone>5</timezone>
<daylightsaving>0</daylightsaving>
<ntpserver>
<ip>pool.ntp.org</ip>
<interval>604800</interval>
</ntpserver>
</time>
<sys>
<brand>Infineon</brand>
<bridge>1</bridge>
<hostname>ECLVL05</hostname>
<type>ResidentialModem</type>
<devicename>VDSL2 2 port Modem</devicename>
<modeldescription>VDSL2 2 port Modem</modeldescription>
<modelname>ECLVL05</modelname>
<vendor>Generic</vendor>
<url></url>
<regdomain>fcc</regdomain>
<language>en</language>
<basicmode>0</basicmode>
<supportlang>auto,en,de</supportlang>
<telnetd>true</telnetd>
<sshd>true</sshd>
<sessiontimeout>600</sessiontimeout>
<user id="1">
<name>admin</name>
<defaultpassword>admin</defaultpassword>
<password>admin</password>
<group>0</group>
</user>
<user id="2">
<name>user</name>
<password>user</password>
<group>1</group>
</user>
<log>
<logserverenable>0</logserverenable>
<loglevel>0</loglevel>
<logserver></logserver>
</log>
<supporturl></supporturl>
</sys>
<function>
<tr069>1</tr069>
<httpd_upnp>1</httpd_upnp>
</function>
<tr069>
<enable>0</enable>
<getrpcmethodsenable>1</getrpcmethodsenable>
<connection_line>1</connection_line>
<route>1</route>
<authenticate>0</authenticate>
<devicesummary>InternetGatewayDevice:1.0[](Baseline:1, EthernetLAN:1, ADSLWAN:1, Time:1, IPPing:1)</devicesummary>
<max_envs>1</max_envs>
<inform_retry_mode>3</inform_retry_mode>
<connect_retry_mode>3</connect_retry_mode>
<inform_retry_interval>30</inform_retry_interval>
<connect_retry_interval>30</connect_retry_interval>
<deviceinfo>
<manufactureroui>001195</manufactureroui>
<specversion>1.0.1</specversion>
<provisioningcode></provisioningcode>
<productclass>ASL-56026</productclass>
<manufacturer>ALPHA</manufacturer>
<hardwareversion>HA1</hardwareversion>
<landevicenumberofentries>1</landevicenumberofentries>
<wandevicenumberofentries>1</wandevicenumberofentries>
</deviceinfo>
<managementserver>
<username></username>
<password></password>
<connectionrequesturl></connectionrequesturl>
<connectionrequestpath>asl56026</connectionrequestpath>
<connectionrequestusername>admin</connectionrequestusername>
<connectionrequestpassword>admin</connectionrequestpassword>
<url>http://iop-tw.workssys.com/comserver/node1/tr069</url>
<defaulturl>http://iop-tw.workssys.com/comserver/node1/tr069</defaulturl>
<periodicinformenable>1</periodicinformenable>
<periodicinforminterval>60</periodicinforminterval>
<periodicinformtime>1157436610</periodicinformtime>
<upgrade>1</upgrade>
<parameterkey></parameterkey>
</managementserver>
<misc>
<recvtimeout>20</recvtimeout>
<rebootcmdkey></rebootcmdkey>
<schedulecmdkey></schedulecmdkey>
<previousurl></previousurl>
<acsport>8082</acsport>
<debuglevel>7</debuglevel>
<pfdebuglevel>7</pfdebuglevel>
<entry id="1">
<commandkey></commandkey>
<filetype></filetype>
<url></url>
<username></username>
<password></password>
<filesize>0</filesize>
<targetfilename></targetfilename>
<starttime>0</starttime>
</entry>
<entry id="2">
<commandkey></commandkey>
<filetype></filetype>
<url></url>
<username></username>
<password></password>
<filesize>0</filesize>
<targetfilename></targetfilename>
<starttime>0</starttime>
</entry>
<entry id="3">
<commandkey></commandkey>
<filetype></filetype>
<url></url>
<username></username>
<password></password>
<filesize>0</filesize>
<targetfilename></targetfilename>
<starttime>0</starttime>
</entry>
<entry id="4">
<commandkey></commandkey>
<filetype></filetype>
<url></url>
<username></username>
<password></password>
<filesize>0</filesize>
<targetfilename></targetfilename>
<starttime>0</starttime>
</entry>
</misc>
</tr069>
<cfm>
<enable>1</enable>
<md_index>md_name</md_index>
<md_level>0</md_level>
<ma_index>ma_name</ma_index>
<mep_index>1</mep_index>
<vlan_id>1</vlan_id>
<cfm_8021p>0</cfm_8021p>
<ccm_enable>0</ccm_enable>
<direct>up</direct>
<ccm_interval>10s</ccm_interval>
<lbm>
<distination_address></distination_address>
<number_of_lbm>1</number_of_lbm>
</lbm>
<ltm>
<target_address></target_address>
</ltm>
</cfm>
<proc>
<web>
<sessionum>8</sessionum>
<authnum>6</authnum>
</web>
</proc>
</lantiq_vr9_generic_asl56026>
$
$ dd if=ecinand8mb.bin skip=$((0x40000)) bs=1 | xxd -l $((0x125))
0000000: 5247 4346 4731 0000 0000 0000 0000 0000 RGCFG1..........
0000010: 0000 0080 0000 0126 0000 08a4 0004 3c62 .......&......<b
0000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000080: 6163 7469 7665 7265 6769 6f6e 3d32 0a63 activeregion=2.c
0000090: 6f75 6e74 7279 636f 6465 3d38 3430 0a68 ountrycode=840.h
00000a0: 7772 6576 3d41 310a 776c 616e 6d61 633d wrev=A1.wlanmac=
00000b0: 3543 3a33 333a 3845 3a38 343a 3839 3a44 5C:33:8E:84:89:D
00000c0: 420a 6c61 6e6d 6163 3d35 433a 3333 3a38 B.lanmac=5C:33:8
00000d0: 453a 3834 3a38 393a 4442 0a77 616e 6d61 E:84:89:DB.wanma
00000e0: 633d 3030 3a45 303a 3932 3a30 303a 3031 c=00:E0:92:00:01
00000f0: 3a34 300a 666c 6173 6873 7065 6564 3d36 :40.flashspeed=6
0000100: 3230 0a3d 3162 3635 6137 3232 3764 6565 20.=1b65a7227dee
0000110: 6561 3166 3763 6331 6433 6431 3234 6236 ea1f7cc1d3d124b6
0000120: 3162 3964 0a 1b9d.
asbokid@home:~/eci_bfocus_squashfs-root/usr/sbin$ strings rgbin
[...]
%s version %d (block size: 0x%x)
Usage: %s {operation} {OPTIONS}
operation -
dump show nvram information.
upgrade upgrade the nvram to the latest format.
get get config from nvram.
save save config to nvram.
getmac get MAC address.
setmac set MAC address.
setenv set env. variable.
getenv get the value of env. var.
delenv delete env. varialbes.
dumpenv dump env. variables.
options -
-h show this help message.
-v verbose mode.
-n {nvram} nvram (mtd block) device.
-c {config file} configuration file.
-i {index} index. (zero based)
-s {message} message to set.
-e {var=val} environment variable.
-m {mode} 0 -> 00:80:c8:ab:cd:ef (lower case, colon seperated)
1 -> 00:80:C8:AB:CD:EF (upper case, colon seperated)
2 -> 00.80.c8.ab.cd.ef (lower case, dot seperated)
3 -> 00.80.C8.AB.CD.ED (upper case, dot seperated)
-f calculate & set flash programming speed. (@ setenv only)
BlockOffset=%d(0x%x), MaxSize=%d(0x%x)
header in nvram is version %d
config size = 0x%x (%d)
config checksum = 0x%x (%d)
config offset = 0x%x (%d)
header in nvram is invalid !
PROFILE
RGCFG0
RGCFG1
%d %d %x
config data is corrupted ! (checksum = 0x%x, should be 0x%x)
Signature = RGCFG1
env size = %d (0x%x)
config size = %d (0x%x)
config checksum = 0x%x
Burning %d bytes to nvram (offset:0x%x) !
header size : %d
config offset : %d
config size : %d
config checksum : 0x%x
burn done !!!
unable to open config file!
no config file specified!
unable to open nvram!
no nvram specified!
[...]
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char **argv) {
FILE *fp;
int sz, csum = 0, i;
unsigned char *buf;
if(argc!=2) {
printf("usage: %s <filename>\n", argv[0]);
goto badexit;
}
if(!(fp=fopen(argv[1], "rb"))) {
printf("Error reading file %s\n", argv[1]);
goto badexit;
}
fseek(fp,0L,SEEK_END);
sz=ftell(fp);
fseek(fp,0L,SEEK_SET);
if(!(buf=malloc(sizeof(unsigned char) * sz))) {
printf("Memory allocation error\n");
goto badexit;
}
if(fread(buf, 1, sz, fp) != sz) {
printf("Error reading %d bytes from %s\n", sz, argv[1]);
goto badexit;
}
printf("Read %08x (%d) bytes from %s\n", sz, sz, argv[1]);
fclose(fp);
for(i=0;i<sz;i++)
csum += buf[i];
printf("checksum of %s = %08x\n", argv[1], csum);
free(buf);
return 0;
badexit:
if(fp)
fclose(fp);
if(buf)
free(buf);
return -1;
}
$ ./checksum eciconfig.gz
Read 000008a4 (2212) bytes from eciconfig.gz
checksum of eciconfig.gz = 00043c62
Tell me what to and I'll be happy to do it, especially if it means I get a pretty web interface and can help others in my situation. It'd also be nice to find a repair system for new firmware, if one exists...
Tell me what to and I'll be happy to do it, especially if it means I get a pretty web interface and can help others in my situation. It'd also be nice to find a repair system for new firmware, if one exists...
Hi again Ben..
Once you've gained a shell via the serial port.. your energies could be profitably focused on that tool for modifying the NVRAM configuration data of the modem..
It looks like you would need to modify one or two XML element values in the gzip'ed CPE MIB file that is found in the "RGCFG1" NVRAM board configuration partition of the flash.
Specifically, these are the element values which probably need changing..
<switch>
..
<lan_access_cpe_enable>0</lan_access_cpe_enable>
..
<port id="2">
<vid>102</vid>
<pri>7</pri>
<loopback>0</loopback>
<activate>0</activate>
<special_vlan>0</special_vlan>
</port>
</switch>
It may be that the XML MIB file needs to be gunzipped first.. bit of tinkering necessary there..
Usage: xmldbc version 2 [OPTIONS]
-h show this help message.
-H show version number.
-v verbose mode.
-a dump database include runtime and tmp.
-i ignore external function (like runtime).
-g {node path} get value from {node path}.
-s {node path} {value} set {value} in {node path}.
-d {node path} delete {node path}.
-l {XML file} reload XML file to database.
-f {XML file} set XML file to database.
-D {XML file} dump database to XML file.
-S {unix socket} specify unix socket name, default is /var/run/xmldb_sock
-A {ephp file} embeded php parse.
-V {name=value} variable for ephp.
-x {command} set extended get/set command.
-t {tag:sec:command} schedule a timer.
-k {tag} kill timers by tag.
Have RSA magic !!!
Image at B0051060:
Image Name: MIPS Linux-2.6.20
..
Have RSA magic !!!
Image at B03F1060:
Image Name: MIPS Linux-2.6.20
..
## Booting image from active region 2 at b03f0000 ...
Check RSA image magic--OK!
Please type [setenv rsa_check 1] !!!
..
RSA_CHECK: 0
Blackeagle: we are not there yet but making progress, judging by what we have found so far even if asbokid unlocks the firmware file I can not find any means for flashing the firmware without having access to the UART console, anyway work continues..
As an aside, I have found a source for the Dare DB120 but it would still need translating to english, which won't happen for a month or so.
Looks like Openreach have released code for the ECI
http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/superfastfibre.do
scroll down to Openreach Modems @ OTN's
Or here is the direct download link - http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/downloads/eci_alpha1B_VDSL_3048.zip
Frustratingly...the tarball (inside the zip) is corrupted, but hopefully someone at Openreach will soon remedy that.
QuoteFrustratingly...the tarball (inside the zip) is corrupted, but hopefully someone at Openreach will soon remedy that.
There only seems to be one header file missing: vr.3048/boards/lantiq_vr9/bootcode/include/asm-mips/arch-mips
All the rest is recoverable from the archive.
asbokid@l502x:~/eci_gpl$ wget http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/downloads/eci_alpha1B_VDSL_3048.zip
--2012-04-10 17:02:34-- http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/downloads/eci_alpha1B_VDSL_3048.zip
Resolving www.openreach.co.uk (www.openreach.co.uk)... 217.140.45.11
Connecting to www.openreach.co.uk (www.openreach.co.uk)|217.140.45.11|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 22016583 (21M) [application/zip]
Saving to: `eci_alpha1B_VDSL_3048.zip'
100%[===============================================================================================>] 22,016,583 1.39M/s in 20s
2012-04-10 17:02:55 (1.04 MB/s) - `eci_alpha1B_VDSL_3048.zip' saved [22016583/22016583]
asbokid@l502x:~/eci_gpl$ md5sum eci_alpha1B_VDSL_3048.zip
2016cacd7b7bd67da645f6dac57cd970 eci_alpha1B_VDSL_3048.zip
asbokid@l502x:~/eci_gpl$ unzip -v eci_alpha1B_VDSL_3048.zip
Archive: eci_alpha1B_VDSL_3048.zip
Length Method Size Cmpr Date Time CRC-32 Name
-------- ------ ------- ---- ---------- ----- -------- ----
89684840 Defl:N 22016395 76% 2012-03-16 08:08 7a4f3ff3 ECI ALPHA1B_VDSL_3048_Mar_2012.tar.gz
-------- ------- --- -------
89684840 22016395 76% 1 file
asbokid@l502x:~/eci_gpl$ unzip -t eci_alpha1B_VDSL_3048.zip
Archive: eci_alpha1B_VDSL_3048.zip
testing: ECI ALPHA1B_VDSL_3048_Mar_2012.tar.gz OK
No errors detected in compressed data of eci_alpha1B_VDSL_3048.zip.
asbokid@l502x:~/eci_gpl$ unzip eci_alpha1B_VDSL_3048.zip
Archive: eci_alpha1B_VDSL_3048.zip
inflating: ECI ALPHA1B_VDSL_3048_Mar_2012.tar.gz
asbokid@l502x:~/eci_gpl$ ls -l
total 109088
-rw-r--r-- 1 asbokid asbokid 89684840 Mar 16 08:08 ECIALPHA1B_VDSL_3048_Mar_2012.tar.gz
-rw-r--r-- 1 asbokid asbokid 22016583 Mar 20 08:02 eci_alpha1B_VDSL_3048.zip
asbokid@l502x:~/eci_gpl$ md5sum ECI\ ALPHA1B_VDSL_3048_Mar_2012.tar.gz
2cfa0976bd4318125200a7115c28380e ECI ALPHA1B_VDSL_3048_Mar_2012.tar.gz
asbokid@l502x:~/eci_gpl$ gunzip -t ECI\ ALPHA1B_VDSL_3048_Mar_2012.tar.gz
gzip: ECI ALPHA1B_VDSL_3048_Mar_2012.tar.gz: unexpected end of file
asbokid@l502x:~/eci_gpl$ dd bs=1 skip=$((0x14fff00)) if=ECI\ ALPHA1B_VDSL_3048_Mar_2012.tar.gz | xxd -l $((0x200))
0000000: 2004 72b1 c063 21ec 88c4 65f3 222e 053b .r..c!...e."..;
0000010: a63b 1817 5974 cb38 212f 3728 8c3c 156d .;..Yt.8!/7(.<.m
0000020: cfec eff1 7df5 7bda 4b04 8dd3 ee22 d2e6 ....}.{.K...."..
0000030: 04c4 9a37 2d8a cf48 cb7a de7a 81cb ea34 ...7-..H.z.z...4
0000040: b2ed efc1 db0c 73e9 dee4 e379 3100 7665 ......s....y1.ve
0000050: 3a1f b183 a2c9 3aaf 4920 c678 2f8f e1a6 :.....:.I .x/...
0000060: a6b0 06b9 4dae 00f7 6d37 2b0a f23f 54ff ....M...m7+..?T.
0000070: 458e 760e b7ee e759 3a1d dc7d ce77 30b2 E.v....Y:..}.w0.
0000080: 219a bf29 9514 13d4 7360 24d4 0806 cc19 !..)....s`$.....
0000090: 1035 4c05 83ed 74c7 c38e e037 47e8 f484 .5L...t....7G...
00000a0: dd24 3411 75ad a016 e0fb 4077 87e2 c988 .$4.u.....@w....
00000b0: 0c00 1aae baf3 017e 19ab e55d 24cc 0cee .......~...]$...
00000c0: 4ecd 1013 f489 6852 0bec 648b 9908 a6d9 N.....hR..d.....
00000d0: 6683 d985 3a88 d61c a807 f139 f0cb 2d33 f...:......9..-3
00000e0: 74c0 994c d3e2 1ad3 7971 3a0b 3e90 9858 t..L....yq:.>..X
00000f0: 181a e9ce 807d 81af f6c6 6839 933c 9709 .....}....h9.<..
0000100: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000110: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000120: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000130: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000140: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000150: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000160: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000170: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000180: 0000 0000 0000 0000 0000 0000 0000 0000 ................
0000190: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
00001f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
...
p.s. uklad asked me to report that we've successfully unlocked his ECI via the UART. All credit to uklad for breaking the camel's back :)
Seems my serial adapter will be just for my benefit, unless there is still something I could help with. Nice work none the less.
Great work guys ;)
Would it be possible to unlock the modem via the second Lan port?
Great work guys ;)
Would it be possible to unlock the modem via the second Lan port?
@ asbokid,
I think you've just invented a reason for somebody to develop a conducting glue to be dispensed from a hypodermic type of applicator.
Kind regards,
Walter
Right so, got myself a uart connection, YAY. I've modded the config file as per the wordpress guide (you missed gzipping the config file btw) but I can't work out how to connect to the web interface...
Hmm, well what I've done has given me the web interface on lan 1....
The test_agent executable is interesting too... test_agent config seems to reveal the tr-069 url, maybe we could fake the server by running a dns server locally and "fool" the modem into taking our commands?
(you missed gzipping the config file btw)
is there any way to get like stats? I haven't found any xdsl binary.
There are references regarding TR-069 "out there" (sorry, I don't have any links to hand) but each Empire can implement the technique in its own way. The concept of the technique is clearly defined, the precise details are proprietary.
Alpha # dsl_cpe_control -h
DSL_CPE: Welcome to DSL CPI API control application
DSL_CPE: usage: [options]
DSL_CPE: following options are available:
DSL_CPE: --help (-h) - help screen
DSL_CPE: --version (-v) - display version
DSL_CPE: --init (-i) - init device w/ <xtu> Bits seperated by undersc
ore (e.g. -i05_01_04_00_04_01_00_00)
DSL_CPE: --low_cfg (-l) - low level configuration file
DSL_CPE: --console (-c) - start console
DSL_CPE: --event_cnf (-e) - configure instance activation handling <enable
/disable>[_mask] (e.g. -e1_1)
DSL_CPE: --msg_dump (-m) - enable message dump
DSL_CPE: --auto_scr_1 (-a) - autoboot start script for ADSL (empty by defau
lt)
DSL_CPE: --auto_scr_2 (-A) - autoboot start script for VDSL (empty by defau
lt)
DSL_CPE: --firmware1 (-f) - firmware file, default /opt/ifx/firmware/xcpe_
hw.bin
DSL_CPE: --notif (-n) - notification script name, default ./xdslrc.sh
DSL_CPE: --tcpmsg (-t) - enable dbgtool, listen only on <ipaddr> (optio
nal, e.g. -t0.0.0.0)
DSL_CPE: --multimode (-M) - set multimode config -M<NextMode>_<AdslSubPref
> (e.g. -M1_1)
DSL_CPE: --tc-layer (-T) - set TC-Layer options -T<TcLayer>_<TcConfigUs>_
<TcConfigDs> (e.g. -T2_0x3_0x1)http://www.broadband-forum.org/technical/download/TR-069_Amendment-2.pdf (http://www.broadband-forum.org/technical/download/TR-069_Amendment-2.pdf)
Code: [Select]Alpha # dsl_cpe_control -h
DSL_CPE: Welcome to DSL CPI API control application
DSL_CPE: usage: [options]
DSL_CPE: following options are available:
DSL_CPE: --help (-h) - help screen
DSL_CPE: --version (-v) - display version
DSL_CPE: --init (-i) - init device w/ <xtu> Bits seperated by underscore (e.g. -i05_01_04_00_04_01_00_00)
DSL_CPE: --low_cfg (-l) - low level configuration file
DSL_CPE: --console (-c) - start console
DSL_CPE: --event_cnf (-e) - configure instance activation handling <enable/disable>[_mask] (e.g. -e1_1)
DSL_CPE: --msg_dump (-m) - enable message dump
DSL_CPE: --auto_scr_1 (-a) - autoboot start script for ADSL (empty by default)
DSL_CPE: --auto_scr_2 (-A) - autoboot start script for VDSL (empty by default)
DSL_CPE: --firmware1 (-f) - firmware file, default /opt/ifx/firmware/xcpe_hw.bin
DSL_CPE: --notif (-n) - notification script name, default ./xdslrc.sh
DSL_CPE: --tcpmsg (-t) - enable dbgtool, listen only on <ipaddr> (optional, e.g. -t0.0.0.0)
DSL_CPE: --multimode (-M) - set multimode config -M<NextMode>_<AdslSubPref> (e.g. -M1_1)
DSL_CPE: --tc-layer (-T) - set TC-Layer options -T<TcLayer>_<TcConfigUs>_<TcConfigDs> (e.g. -T2_0x3_0x1)
This may be of interest http://pastebin.com/2D4NW2HR . In addition, if you look through /www/ there are a lot of hidden web pages, unfortunately none have any statistics.
..
var StLineAttenuation = new Array();
..
/* Line Attenuation*/
StLineAttenuation[0] = <?ConfigGetArray(/runtime/vdsl2/line/band:0/,lnatten/up,lnatten/down)?>;
xmldbc -g /runtime/vdsl2/line/band:0/lnatten/down
http://svn.dd-wrt.com:8000/browser/src/router/dsl_cpe_control/src/dsl_cpe_control.c?rev=15977 seems to give us source for the dsl_cpe_control utility.
Alpha # echo "g997lsg 1 1" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=1 nDeltDataType=1 LATN=231 SATN=178 SNR=64 ATTNDR=42533120
ACTPS=-901 ACTATP=55for example. Still a sucky way to interface, but at least it does work :) From this we SHOULD be able to make our own shell script to get data.Alpha # echo "g997csg 0 1" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nChannel=0 nDirection=1 ActualDataRate=39992000 PreviousDataRate=0 ActualInterleaveDelay=0 ActualImpulseNoiseProtection=0
Alpha # echo "g997csg 0 0" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nChannel=0 nDirection=0 ActualDataRate=8448000 PreviousDataRate=0 ActualInterleaveDelay=0 ActualImpulseNoiseProtection=0
Alpha # echo "g997lsg 1 1" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=1 nDeltDataType=1 LATN=231 SATN=177 SNR=65 ATTNDR=42428544 ACTPS=-901 ACTATP=55
Alpha # echo "g997lsg 0 1" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=0 nDeltDataType=1 LATN=0 SATN=0 SNR=62 ATTNDR=8650125 ACTPS=-901 ACTATP=109
http://pastie.org/private/andzysdm8hhmse2groohw
xmldbc -D /tmp/db.xml -a
As you can tell a lot of data is missing for some reason. However that pipe works PERFECTLY. The command set is listed with the command "help". http://pastie.org/private/uxkq541nllsply2evizxw and it seems to work much the same as the DSL version :DCode: [Select]Alpha # echo "g997lsg 1 1" > /tmp/pipe/dsl_cpe0_cmdfor example. Still a sucky way to interface, but at least it does work :) From this we SHOULD be able to make our own shell script to get data.
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=1 nDeltDataType=1 LATN=231 SATN=178 SNR=64 ATTNDR=42533120
ACTPS=-901 ACTATP=55
After reading through that script more all the line stats need dividing by ten, that gives me a downstream attenuation of 23.1db and SNR of 6.5db, and an upstream attenuation of 0db? and 6.2db snr.. Is that good or bad for FTTC? I'm not really convinced of that SNR, it seems really bad for the speeds I get..
I can provide an ssh tunnel to my home server which has telnet access to my modem if it's really necessary..
I can make mine available to you again just it cannot be live on DSL at the same time.. but the offer of a loan still stands..
QuoteAfter reading through that script more all the line stats need dividing by ten, that gives me a downstream attenuation of 23.1db and SNR of 6.5db, and an upstream attenuation of 0db? and 6.2db snr.. Is that good or bad for FTTC? I'm not really convinced of that SNR, it seems really bad for the speeds I get..
God knows! It doesn't sound very good though. Paul (Bald_Eagle) is the man with the answers. He has officially studied more VDSL2 connection stats than the rest of us have had hot dinners!
QuoteAfter reading through that script more all the line stats need dividing by ten, that gives me a downstream attenuation of 23.1db and SNR of 6.5db, and an upstream attenuation of 0db? and 6.2db snr.. Is that good or bad for FTTC? I'm not really convinced of that SNR, it seems really bad for the speeds I get..
God knows! It doesn't sound very good though. Paul (Bald_Eagle) is the man with the answers. He has officially studied more VDSL2 connection stats than the rest of us have had hot dinners!
The Huawei HG612 splits attenuation/SNR etc. across the band plans & reports 0dB in its GUI where a value would be expected.
Is the ESI stats snippet posted (LATN=231 SATN=178 SNR=64 ) the only combined value shown for all the downstream band plans?
If so, I THINK it seems to report the stats in a similar way to the FritzBox! 3930.
I THINK the FritzBox! also reports 0dB for upstream attenuation.
What sync speeds are being achieved & how do they compare against Attainable Rates?
If there is not much difference between them, that COULD explain the low(ish) SNR values (assuming it really means SNR Margin).
High Attainable speed connections, still capped at 40Mb show SNRM values of up to 30dB or so.
My connection that struggles to achieve more than 30Mb (sync & attainable) has a value usually of 6dB (quite often less).
Alpha # echo "g997lspbg 1" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=0 LATN[0]=176 LATN[1]=459 LATN[2]=641 LATN[3]=-32768 LATN[4]=-32768 SATN[0]=153 SATN[1]=448 SATN[2]=609 SATN[3]=-32768 SATN[4]=-32768 SNR[0]=65 SNR[1]=62 SNR[2]=71 SNR[3]=-32768 SNR[4]=-32768
Alpha # echo "g997lspbg 0" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=0 LATN[0]=30 LATN[1]=320 LATN[2]=516 LATN[3]=-32768 LATN[4]=-32768 SATN[0]=32 SATN[1]=319 SATN[2]=520 SATN[3]=-32768 SATN[4]=-32768 SNR[0]=60 SNR[1]=60 SNR[2]=63 SNR[3]=-32768 SNR[4]=-32768
The GUI also displays 0 for all values like the Huawei,
DSL_uint8_t gain/tone [0..4095 (linear) represented as multiple of 1/512: 20*log(gain/512)]
If I know what that means I should be able to get the gain, whatever it shows. Anyway, making progress on my eDMT tool (ECI DSL modem tool). Should be totally crossplatform on Mono too for those on Linux and Mac :D
Alpha # echo "g997listrg 1" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=1 G994VendorID=IFTN SystemVendorID=ECI tele VersionNumber=
SerialNumber=7035490556 SelfTestResult=0 XTSECapabilities=(00,00,00,00,00,00,00,
00)
Are we any closer to unlocking the modem without the need for any soldering etc?
I've personally got a little distracted... Not quite sure the best way to display the other stats..Should I just have text or should I use some of the graphics DMT and vDMT use.
Boom, DSLAM data:Code: [Select]Alpha # echo "g997listrg 1" > /tmp/pipe/dsl_cpe0_cmd
Alpha # cat /tmp/pipe/dsl_cpe0_ack
nReturn=0 nDirection=1 G994VendorID=IFTN SystemVendorID=ECI tele VersionNumber=SerialNumber=7035490556 SelfTestResult=0 XTSECapabilities=(00,00,00,00,00,00,00,00)
Hey, finished by eDMT to the point it's now usable. Make sure you ok the messageboxes otherwise it will NOT progress. To switch modems (if you happen to have multiple) just change the IP and hit login again. Make sure to report any bugs you experience, I'll need to know what you were doing, what messages had been shown, and preferably a screenshot. I also threw in eGrapher that will give you a .bmp copy of the 3 graphs. Source code will follow shortly. Please do not mirror the link, my dropbox only has very limited traffic.
http://dl.dropbox.com/u/11197643/eDMT.zip
Sure, also it will work just fine on Linux and OSX with Mono(http://www.mono-project.com/Main_Page). I noticed a bug, I was just throwing away precision. http://dl.dropbox.com/u/11197643/eDMT_r1.zip fixes it. I've also uploaded a screenshot of each page since you don't have an ECI modem or a VDSL2 connection.
Is there anywhere hidden away in the HG612 firmware to report an overall attenuation value.
I know it has been discussed previously, but as the ECI can do it.............?
PL2303HX converter finally arrived >:D
Is there any need to further document the hardware hack?
asbokid did we ever manage to get a working open source tarball ?
Well I have gone ahead with DKU5 cable. I added the header pins. A 1mm drill seemed essential but it is very easy to do with one to hand. I followed the permanent change instructions in the wordpress pages and now have all access working on 192.168.168.168 which seems to be the device default.
The final stage of the instructions where the changes are checked did not work for me. The command "rgcfg get -n /dev/mtdblock/3 -c /var/tmp/newreadrgdb.xml.gz" gave a blank return as I think it should but "gunzip newreadrgdb.xml.gz" gave file not found. I can't see a typo.
$ rgcfg get -n /dev/mtdblock/3 -c /var/tmp/newreadrgdb.xml.gz
$ cd /var/tmp
$ gunzip newreadrgdb.xml.gz
The web interface seems to allows the access IP to be changed. Is the change to 192.168.1.55 just to get you back to the normal IP range?
and is the web interface an OK way to change it permanently? If not what extra is needed on the command line to change it permanently?
Please can someone can advise!
Great news guys,
Looks like Openreach got there act together!
They have put all source codes out the the VDSL Modems on their site.
http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/superfastfibre.do
Cheers,
Josh
Link to ECI: http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/downloads/eci_alpha1B_VDSL_3048.zip
Hi All
I just skimmed through all the posts, I just don't get it lol.
How can I get to the GUI?
Is their just an IP address?
I am currently on Windows 7.
Is their just a simple how2guide to get to the GUI?
Or is this just all beyond me?
Thanks for looking!
To get to the ECI's GUI you need to open it, solder some pins to the board and then follow the guide here (http://hackingecibfocusv2fubirevb.wordpress.com/).
TBH, if you have read all the posts here and still don't follow what to do, I would respectfully suggest that this is not an avenue that you should be exploring.
I've fixed the GUI as per your suggestions, all values now have units and unused bands report N/A. http://dl.dropbox.com/u/11197643/eDMT_r2.zip
Great news guys,
Looks like Openreach got there act together!
They have put all source codes out the the VDSL Modems on their site.
http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/superfastfibre.do
Cheers,
Josh
Link to ECI: http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/downloads/eci_alpha1B_VDSL_3048.zip
Hi Josh!
Thanks for the interest.
Unfortunately, the file on the Openreach website holding the source code for the ECI modem is corrupted (and has been since April):
See: http://hackingecibfocusv2fubirevb.wordpress.com/2012/04/11/bt-openreach-releases-gpled-code-for-eci-vdsl2-modem/
The file is a gzip'ed tar archive (common to Unix), contained within a ZIP. The ZIP file uncompresses without errors. However the gzipped tar archive within it is truncated.
cheers, a
Great news guys,
Looks like Openreach got their act together!
They have put all source codes out for the VDSL Modems on their site.
http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/super-fastfibreaccess/landrgnu.do (new URL)
Cheers,
Josh
Seems like there's a new link up on their site for the source code. It's now a RAR inside a ZIP and the modified date shows it's fairly recent at 2012-06-29.
http://www.mediafire.com/?813x7gvev81vtwk
Great news guys,
Looks like Openreach got their act together!
They have put all source codes out for the VDSL Modems on their site.
http://www.openreach.co.uk/orpg/home/products/super-fastfibreaccess/super-fastfibreaccess/landrgnu.do (new URL)
Cheers,
Josh
Seems like there's a new link up on their site for the source code. It's now a RAR inside a ZIP and the modified date shows it's fairly recent at 2012-06-29.
Way-hay! Thank you for the info, Orbixx!
Thank you as well to Openreach for supplying the source code :)
cheers, a
Is this one corrupt ?
Adhesive tape isn't strong enough to hold the header pins onto the PCB pads.
But Dolly the clothes peg proved just the job! She is electrostatic-safe, too :D(https://forum.kitz.co.uk/proxy.php?request=http%3A%2F%2Fwww4.picturepush.com%2Fphoto%2Fa%2F8966982%2F480%2FECI-B-FOCuS-VDSL2-modem---solderless-UART-connection%2FDSC-0657.jpg&hash=7b4bbd77b4de7a893b71913dd6ce102296405830)
(click for full size) (http://picturepush.com/public/8966982)
..
No matter how things were tried, no continuity could be obtained from the PCB solder pads to the ends of the fly-leads. :(
Tiny dimples were gently made in the solder infesting the pads.
..
Offering up the header pins into the dimples was finally achieved.
...
Still no continuity.
..
No continuity? As in no electrical continuity, according to a multimeter?
does the pl2303 adaptor definitely work? I've had two or three which were duffs.
[bcat@Duo2 ~]$ find /lib/modules -name pl2303.ko | sort
/lib/modules/2.6.32-220.23.1.el6.x86_64/kernel/drivers/usb/serial/pl2303.ko
/lib/modules/2.6.32-279.5.2.el6.x86_64/kernel/drivers/usb/serial/pl2303.ko
/lib/modules/3.5.4-1.el6.elrepo.x86_64/kernel/drivers/usb/serial/pl2303.ko
happy to solder-in the pins if you dare entrust Royal Mail* with it?!
The tails of the right-angled header pins were facing inwards (away from the nearest PCB edge)?
And a good quality peg was used? Definitely the correct model? Type A rather than the Type B?!
I thought a pl2303 adaptor required usage of BGW?
Sep 25 22:58:26 l502x kernel: [353464.425850] usb 2-2: New USB device found, idVendor=067b, idProduct=2303
Sep 25 22:58:26 l502x kernel: [353464.425855] usb 2-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0
Sep 25 22:58:26 l502x kernel: [353464.425858] usb 2-2: Product: USB-Serial Controller
Sep 25 22:58:26 l502x kernel: [353464.425861] usb 2-2: Manufacturer: Prolific Technology Inc.
Sep 25 22:58:26 l502x kernel: [353464.427931] pl2303 2-2:1.0: pl2303 converter detected
Sep 25 22:58:26 l502x kernel: [353464.456013] usb 2-2: pl2303 converter now attached to ttyUSB0
$ minicom -D /dev/ttyUSB0
Yes, a Type A of plastic rather than wooden construction. You don't think that is the cause, do you? :-\
[bcat@Duo2 ~]$ telnet 192.168.168.168
Trying 192.168.168.168...
Connected to 192.168.168.168.
Escape character is '^]'.
login as: admin
password:
BusyBox v1.00 (2011.08.09-03:28+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
Alpha # help
Built-in commands:
-------------------
. : break cd continue eval exec exit export help login newgrp
read readonly set shift times trap umask wait
Alpha # echo $PATH
/usr/bin:/bin:/usr/sbin:/sbin
Alpha # ls /usr/bin
yes pcaccess_disable.sh
wget pcaccess.sh
wc mpstat
uptime loopback_stop
update_upgrade.sh loopback_start
update_uboot.sh logger
tr killall
top free
tftp expr
test_agent dirname
test cut
stopqos.sh cusb_modem_switch_loopback_disable.sh
startqos.sh cusb_modem_switch_loopback.sh
port2_enable cusb_modem_switch.sh
port2_disable cusb_modem_ppe.sh
port1_enable basename
port1_disable [
Alpha # ls /bin
zcat rm login df
usleep pwd logcmd dd
uname ps ln date
umount ping kill cp
true mv gzip chmod
touch msh gunzip cat
switch_utility mount grep busybox
spy more fgrep alpha_flash_cmd
sleep mknod false alphaLogd
sh mkdir egrep alphaHousekeeper
sed ls echo alphaFlashAgent
Alpha # ls /usr/sbin
xmldbc submit mfc cabletest:5
xmldb stats mem cabletest:4
wan scut in.tftpd cabletest:3
vconfig rgdb ifx_util cabletest:2
usockc rgcfg ifx_gpio cabletest:1
upgrade rgbin dsl_cpe_control brctl
udhcpr read_img diap alpha_tantos
udhcpd ppacmd diagnostic alpha_macaddr
udhcpc pmcu dayconvert alpha_inventory
time pfile chnet alpha_gen_submac
telnetd ntpclient check alpha_bdtool
syslog next_macaddr cfmctl
sys mknod_util cfm
Alpha # ls /sbin
thttpd swapon rmmod mdev insmod getty
syslogd swapoff reboot lsmod init
sysctl route modprobe klogd ifconfig
Alpha # ps
PID Uid VmSize Stat Command
1 0 172 S init
2 0 SWN [ksoftirqd/0]
3 0 SW [watchdog/0]
4 0 SW< [events/0]
5 0 SW< [khelper]
6 0 SW< [kthread]
24 0 SW< [kblockd/0]
37 0 SW [pdflush]
38 0 SW [pdflush]
39 0 SW< [kswapd0]
40 0 SW< [aio/0]
74 0 SW [mtdblockd]
227 0 SWN [jffs2_gcd_mtd6]
240 0 596 S xmldb -n lantiq_vr9_generic_asl56026 -t
505 0 260 S syslogd -F sysact -F attack -F notice
508 0 188 S klogd -l br0
605 0 664 S /usr/sbin/dsl_cpe_control -i -f /ifx/vdsl2/xcpe_hw.bi
608 0 664 S /usr/sbin/dsl_cpe_control -i -f /ifx/vdsl2/xcpe_hw.bi
609 0 664 S /usr/sbin/dsl_cpe_control -i -f /ifx/vdsl2/xcpe_hw.bi
610 0 664 S /usr/sbin/dsl_cpe_control -i -f /ifx/vdsl2/xcpe_hw.bi
612 0 664 S /usr/sbin/dsl_cpe_control -i -f /ifx/vdsl2/xcpe_hw.bi
613 0 664 S /usr/sbin/dsl_cpe_control -i -f /ifx/vdsl2/xcpe_hw.bi
614 0 664 S /usr/sbin/dsl_cpe_control -i -f /ifx/vdsl2/xcpe_hw.bi
693 0 472 S /usr/sbin/cfm ptm0 eth0
696 0 472 S /usr/sbin/cfm ptm0 eth0
697 0 472 S /usr/sbin/cfm ptm0 eth0
698 0 472 S /usr/sbin/cfm ptm0 eth0
712 0 SW [autbtex]
713 0 SW [pmex_ne]
714 0 SW [pmex_fe]
755 0 404 S /usr/sbin/diap
764 0 596 S /sbin/thttpd -d /www
778 0 264 R telnetd
793 0 336 S /bin/alphaLogd
806 0 432 S alphaFlashAgent
810 0 216 S /bin/sh /BTAgent/ro/start
815 0 740 S ./btagent
817 0 740 S ./btagent
820 0 740 S ./btagent
821 0 740 S ./btagent
841 0 392 S /bin/alphaHousekeeper
1073 0 164 S /sbin/getty -L ttyS0 115200 vt102
1280 0 252 S /bin/sh
1961 0 196 R ps
Alpha # kill 810
Alpha # killall btagent
Alpha # ps
PID Uid VmSize Stat Command
1 0 172 S init
<snip>
764 0 596 S /sbin/thttpd -d /www
778 0 264 S telnetd
793 0 336 S /bin/alphaLogd
806 0 432 S alphaFlashAgent
841 0 392 S /bin/alphaHousekeeper
1073 0 164 S /sbin/getty -L ttyS0 115200 vt102
1280 0 252 S /bin/sh
2055 0 196 R ps
Alpha # mount
/dev/mtdblock2 on / type squashfs (ro)
sysfs on /sys type sysfs (rw)
tmpfs on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw)
none on /proc type proc (rw)
ramfs on /var type ramfs (rw)
/dev/mtdblock6 on /BTAgent/rw type jffs2 (rw)
Alpha # umount /BTAgent/rw
Alpha # mount
/dev/mtdblock2 on / type squashfs (ro)
sysfs on /sys type sysfs (rw)
tmpfs on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw)
none on /proc type proc (rw)
ramfs on /var type ramfs (rw)
Alpha # exit
Connection closed by foreign host.
[bcat@Duo2 ~]$
Has anyone determined if the device's IP address can be permanently changed via telnet access?
so can I just hook the modem straight up to the com port on my asrock z68 extreme4 gen3 mobo?
^-^ Welcome to the Kitz forum, Liam.Quoteso can I just hook the modem straight up to the com port on my asrock z68 extreme4 gen3 mobo?
The truthful answer is no. You will still need to use an adaptor, otherwise either the modem or your computer will suffer damage. Keeping things simple, I'll say that there is a voltage and protocol difference . . .
I used this RS232 to TTL Converter Cable (http://www.ebay.co.uk/itm/221120584720) (based on the ST micro ST3232EC chip) for the task.
Thanks! I think I will have to grab a cheapo off ebay to get this done then, what program can I use on windows 8 to talk to the box and send the needed commands?
Thanks! I think I will have to grab a cheapo off ebay to get this done then, what program can I use on windows 8 to talk to the box and send the needed commands?
I just installed hyper terminal following this guide here (http://www.windowsitpro.com/article/windows-7/hyperterminal-windows-7-142183) on Windows 7, may well work on 8. (you'll need an XP cd)
Channel Status Upstream Downstream
Actual Net Data Rate 20000000 kbps 78308000 kbps
Actual Interleave Delay 0 ms 0 ms
Actual INP 0 Symbols 0 Symbols
Attainable Net Data Rate 27444204 kbps 78355520 kbps
Transmit Power 138 dBm 50 dBm
Many thanks to the B*Cat, I now have an unlocked ECI modem :) (Simply used Putty in a WinXP VM I have for such things on my MacBook).
Some of you may be aware of my current setup - the modem and router are located in separate rooms, with just one cable linking the two. Not good when you're attempting to get stats... or even web gui access!
But, also playing around with the ECI modem, I dug out an old gigabit switch. So I've connected the feed from the modem, and also hooked it upto the router. Router still has access to the net, along with all other devices (as you'd expect). What I did find interesting though, is if I hook another patch lead into the switch and connect that to my laptop. If I correctly set a static IP address, I can also access the web gui of the ECI this way - whilst all other devices in the house still have access to the net!
I never actually tried this setup with the HG612, but I know that refused all access to the web gui from LAN1. When I unlocked the ECI, I could access the gui from LAN1 or LAN2 - so maybe this is something specific to the ECI?
Anyway... just because I can... I'd estimate my E side is around 350m:QuoteChannel Status Upstream Downstream
Actual Net Data Rate 20000000 kbps 78308000 kbps
Actual Interleave Delay 0 ms 0 ms
Actual INP 0 Symbols 0 Symbols
Attainable Net Data Rate 27444204 kbps 78355520 kbps
Transmit Power 138 dBm 50 dBm
Upstream Downstream
Actual Net Data Rate 19996000 kbps 59996000 kbps
Actual Interleave Delay 0 ms 0 ms
Actual INP 0 Symbols 0 Symbols
Attainable Net Data Rat.19851744 kbps 82172688 kbps
Transmit Power 103 dBm -1 dBmMany thanks to the B*Cat, I now have an unlocked ECI modem :)
But, also playing around with the ECI modem, I dug out an old gigabit switch. So I've connected the feed from the modem, and also hooked it upto the router. Router still has access to the net, along with all other devices (as you'd expect). What I did find interesting though, is if I hook another patch lead into the switch and connect that to my laptop. If I correctly set a static IP address, I can also access the web gui of the ECI this way - whilst all other devices in the house still have access to the net!
I'd estimate my E side is around 350m
. . . my E-side (cable length from house to cab yes?)
I wonder if that's the start of the bubble where vdsl drops off?
...
Whoooops, that is why I am still very much a beginner to all this stuff! Can't even sort my terminology out!
:no: No. That is the D-side. (Distribution side.) The E-side (Exchange side) is thus from the exchange to the PCP.
My connection from master socket to modem is about 20cm. I found a 4 core, non-twisted pair cable lying around which I cut down and crimped new RJ11 plugs on either end.
Our Bald_Eagle1 has a good knowledge on such line characteristics and should readily be able to provide some figures.
Oh dear. That doesn't read too good. :o
To the best of my knowledge, there are now two variants of the ECI B-FOCuS modem in the wild. I have unlocked two of (what I call) the 'type 1' devices by following the definitive guide (http://hackingecibfocusv2fubirevb.wordpress.com/2012/09/23/bare-instructions-to-unlock-eci-vdsl2-modem/). A 'type 1' has four rubber feet on its base which, when removed, expose the four screws which hold the case together.
I understand that a 'type 2' device -- as of yet unseen in The Cattery -- only has two rubber feet and two plastic domes on its base. If I remember correctly, Ronski was having trouble establishing communication via the console serial header pins on a 'type 2' device. :-\
Mine is the B-FOCuS V-2FUb/I Rev.B, from your description the Type 1 as it has 4 rubber feet with 4 screws under them...
If it helps following some other guides I have found the modem is reporting cpe_enable 1 and is reporting its ip is 192.168.1.55 so it seems as though it has worked but I still don't have telnet or web access...
Mine is the B-FOCuS V-2FUb/I Rev.B, from your description the Type 1 as it has 4 rubber feet with 4 screws under them...
If it helps following some other guides I have found the modem is reporting cpe_enable 1 and is reporting its ip is 192.168.1.55 so it seems as though it has worked but I still don't have telnet or web access...
Have you tried powering it up and with no device(s) connected to it, pressing and holding the reset button for ten seconds? Wait for the modem to re-boot and become stable, then connect a computer to the LAN1 port. Configure the computer to use a dynamic address and invoke it. Interrogate the computer for its default route and make a note of that IP address. It is that address which you should use to connect using telnet or put into your browser for GUI access.
Failing that, perform an nmap scan of IP addresses 192.168.1.55, 192.168.1.254, 192.168.168.168 and that of the default route, above.
Mine is the B-FOCuS V-2FUb/I Rev.B, from your description the Type 1 as it has 4 rubber feet with 4 screws under them...
If it helps following some other guides I have found the modem is reporting cpe_enable 1 and is reporting its ip is 192.168.1.55 so it seems as though it has worked but I still don't have telnet or web access...
IM IN!!
Turns out that I was trying to set the wrong ip
I was settings 192.168.1.xx thinking the modem was at 192.168.1.55 but actually its still at 192.168.168.168 so simply settings my ip manually to 192.168.168.170 I got in :-D
lan 1 needs to be connected to your wan port for internet access, lan 2 needs to be connected to a lan port on your router to allow you to access the modem, there's no way to do it via a single cable.
lan 1 needs to be connected to your wan port for internet access, lan 2 needs to be connected to a lan port on your router to allow you to access the modem, there's no way to do it via a single cable.
I've no idea, in the end I gave up and bought an older type already unlocked.
[bcat@Duo2 ECI]$ telnet 192.168.1.254
Trying 192.168.1.254...
Connected to 192.168.1.254.
Escape character is '^]'.
login as: admin
password:
BusyBox v1.00 (2011.08.09-03:28+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
Alpha # echo help > /var/tmp/pipe/dsl_cpe0_cmd
Alpha # cat /var/tmp/pipe/dsl_cpe0_ack
acog, AutobootConfigOptionGet
acos, AutobootConfigOptionSet
acs, AutobootControlSet
alf, AutobootLoadFirmware
asecg, AutobootScriptExecuteConfigGet
asecs, AutobootScriptExecuteConfigSet
asg, AutobootStatusGet
aufg, AutobootUsedFirmwareGet
alig, AuxLineInventoryGet
bbsg, BandBorderStatusGet
bpstg, BandPlanSTatusGet
bpsg, BandPlanSupportGet
dbgmlg, DBG_ModuleLevelGet
dbgmls, DBG_ModuleLevelSet
dms, DeviceMessageSend
esmcg, EventStatusMaskConfigGet
esmcs, EventStatusMaskConfigSet
fpsg, FramingParameterStatusGet
g997amdpfcg, G997_AlarmMaskDataPathFailuresConfigGet
g997amdpfcs, G997_AlarmMaskDataPathFailuresConfigSet
g997amlfcg, G997_AlarmMaskLineFailuresConfigGet
g997amlfcs, G997_AlarmMaskLineFailuresConfigSet
g997bang, G997_BitAllocationNscGet
g997bansg, G997_BitAllocationNscShortGet
g997cdrtcg, G997_ChannelDataRateThresholdConfigGet
g997cdrtcs, G997_ChannelDataRateThresholdConfigSet
g997csg, G997_ChannelStatusGet
g997dpfsg, G997_DataPathFailuresStatusGet
g997dfr, G997_DeltFreeResources
g997dhling, G997_DeltHLINGet
g997dhlinsg, G997_DeltHLINScaleGet
g997dhlogg, G997_DeltHLOGGet
g997dqlng, G997_DeltQLNGet
g997dsnrg, G997_DeltSNRGet
g997fpsg, G997_FramingParameterStatusGet
g997gang, G997_GainAllocationNscGet
g997gansg, G997_GainAllocationNscShortGet
g997lstg, G997_LastStateTransmittedGet
g997lacg, G997_LineActivateConfigGet
g997lacs, G997_LineActivateConfigSet
g997lfsg, G997_LineFailureStatusGet
g997lisg, G997_LineInitStatusGet
g997lig, G997_LineInventoryGet
g997listrg, G997_LineInventorySTRingGet
g997lis, G997_LineInventorySet
g997lsg, G997_LineStatusGet
g997lspbg, G997_LineStatusPerBandGet
g997ltsg, G997_LineTransmissionStatusGet
g997pmsft, G997_PowerManagementStateForcedTrigger
g997pmsg, G997_PowerManagementStatusGet
g997racg, G997_RateAdaptationConfigGet
g997racs, G997_RateAdaptationConfigSet
g997sang, G997_SnrAllocationNscGet
g997sansg, G997_SnrAllocationNscShortGet
g997xtusecg, G997_XTUSystemEnablingConfigGet
g997xtusecs, G997_XTUSystemEnablingConfigSet
g997xtusesg, G997_XTUSystemEnablingStatusGet
help, Help
ics, InstanceControlSet
isg, InstanceStatusGet
lecg, LastExceptionCodesGet
lfcg, LineFeatureConfigGet
lfcs, LineFeatureConfigSet
lfsg, LineFeatureStatusGet
locg, LineOptionsConfigGet
locs, LineOptionsConfigSet
lsg, LineStateGet
llcg, LowLevelConfigurationGet
llcs, LowLevelConfigurationSet
mlsg, MiscLineStatusGet
mfcg, MultimodeFsmConfigGet
mfcs, MultimodeFsmConfigSet
mfsg, MultimodeFsmStatusGet
nsecg, NotificationScriptExecuteConfigGet
nsecs, NotificationScriptExecuteConfigSet
pm15meet, PM_15MinElapsedExtTrigger
pmbms, PM_BurninModeSet
pmcc15mg, PM_ChannelCounters15MinGet
pmcc1dg, PM_ChannelCounters1DayGet
pmccsg, PM_ChannelCountersShowtimeGet
pmcctg, PM_ChannelCountersTotalGet
pmchs15mg, PM_ChannelHistoryStats15MinGet
pmchs1dg, PM_ChannelHistoryStats1DayGet
pmct15mg, PM_ChannelThresholds15MinGet
pmct15ms, PM_ChannelThresholds15MinSet
pmct1dg, PM_ChannelThresholds1DayGet
pmct1ds, PM_ChannelThresholds1DaySet
pmcg, PM_ConfigGet
pmcs, PM_ConfigSet
pmdpc15mg, PM_DataPathCounters15MinGet
pmdpc1dg, PM_DataPathCounters1DayGet
pmdpcsg, PM_DataPathCountersShowtimeGet
pmdpctg, PM_DataPathCountersTotalGet
pmdpfc15mg, PM_DataPathFailureCounters15MinGet
pmdpfc1dg, PM_DataPathFailureCounters1DayGet
pmdpfcsg, PM_DataPathFailureCountersShowtimeGet
pmdpfctg, PM_DataPathFailureCountersTotalGet
pmdpfhs15mg, PM_DataPathFailureHistoryStats15MinGet
pmdpfhs1dg, PM_DataPathFailureHistoryStats1DayGet
pmdphs15mg, PM_DataPathHistoryStats15MinGet
pmdphs1dg, PM_DataPathHistoryStats1DayGet
pmdpt15mg, PM_DataPathThresholds15MinGet
pmdpt15ms, PM_DataPathThresholds15MinSet
pmdpt1dg, PM_DataPathThresholds1DayGet
pmdpt1ds, PM_DataPathThresholds1DaySet
pmetr, PM_ElapsedTimeReset
pmlesc15mg, PM_LineEventShowtimeCounters15MinGet
pmlesc1dg, PM_LineEventShowtimeCounters1DayGet
pmlescsg, PM_LineEventShowtimeCountersShowtimeGet
pmlesctg, PM_LineEventShowtimeCountersTotalGet
pmleshs15mg, PM_LineEventShowtimeHistoryStats15MinGet
pmleshs1dg, PM_LineEventShowtimeHistoryStats1DayGet
pmlfc15mg, PM_LineFailureCounters15MinGet
pmlfc1dg, PM_LineFailureCounters1DayGet
pmlfcsg, PM_LineFailureCountersShowtimeGet
pmlfctg, PM_LineFailureCountersTotalGet
pmlfhs15mg, PM_LineFailureHistoryStats15MinGet
pmlfhs1dg, PM_LineFailureHistoryStats1DayGet
pmlic15mg, PM_LineInitCounters15MinGet
pmlic1dg, PM_LineInitCounters1DayGet
pmlicsg, PM_LineInitCountersShowtimeGet
pmlictg, PM_LineInitCountersTotalGet
pmlihs15mg, PM_LineInitHistoryStats15MinGet
pmlihs1dg, PM_LineInitHistoryStats1DayGet
pmlit15mg, PM_LineInitThresholds15MinGet
pmlit15ms, PM_LineInitThresholds15MinSet
pmlit1dg, PM_LineInitThresholds1DayGet
pmlit1ds, PM_LineInitThresholds1DaySet
pmlsc15mg, PM_LineSecCounters15MinGet
pmlsc1dg, PM_LineSecCounters1DayGet
pmlscsg, PM_LineSecCountersShowtimeGet
pmlsctg, PM_LineSecCountersTotalGet
pmlshs15mg, PM_LineSecHistoryStats15MinGet
pmlshs1dg, PM_LineSecHistoryStats1DayGet
pmlst15mg, PM_LineSecThresholds15MinGet
pmlst15ms, PM_LineSecThresholds15MinSet
pmlst1dg, PM_LineSecThresholds1DayGet
pmlst1ds, PM_LineSecThresholds1DaySet
pmrtc15mg, PM_ReTxCounters15MinGet
pmrtc1dg, PM_ReTxCounters1DayGet
pmrtcsg, PM_ReTxCountersShowtimeGet
pmrtctg, PM_ReTxCountersTotalGet
pmrths15mg, PM_ReTxHistoryStats15MinGet
pmrths1dg, PM_ReTxHistoryStats1DayGet
pmrtt15mg, PM_ReTxThresholds15MinGet
pmrtt15ms, PM_ReTxThresholds15MinSet
pmrtt1dg, PM_ReTxThresholds1DayGet
pmrtt1ds, PM_ReTxThresholds1DaySet
pmr, PM_Reset
pmsmg, PM_SyncModeGet
pmsms, PM_SyncModeSet
ptsg, PilotTonesStatusGet
quit, Quit
rccg, RebootCriteriaConfigGet
rccs, RebootCriteriaConfigSet
rusg, ResourceUsageStatisticsGet
se, ScriptExecute
sicg, SystemInterfaceConfigGet
sics, SystemInterfaceConfigSet
sisg, SystemInterfaceStatusGet
tmcs, TestModeControlSet
tmsg, TestModeStatusGet
vig, VersionInformationGet
Alpha # echo help > /var/tmp/pipe/dsl_cpe1_cmd
Alpha # cat /var/tmp/pipe/dsl_cpe1_ack
acog, AutobootConfigOptionGet
acos, AutobootConfigOptionSet
acs, AutobootControlSet
alf, AutobootLoadFirmware
asecg, AutobootScriptExecuteConfigGet
asecs, AutobootScriptExecuteConfigSet
asg, AutobootStatusGet
aufg, AutobootUsedFirmwareGet
alig, AuxLineInventoryGet
bbsg, BandBorderStatusGet
bpstg, BandPlanSTatusGet
bpsg, BandPlanSupportGet
dbgmlg, DBG_ModuleLevelGet
dbgmls, DBG_ModuleLevelSet
dms, DeviceMessageSend
esmcg, EventStatusMaskConfigGet
esmcs, EventStatusMaskConfigSet
fpsg, FramingParameterStatusGet
g997amdpfcg, G997_AlarmMaskDataPathFailuresConfigGet
g997amdpfcs, G997_AlarmMaskDataPathFailuresConfigSet
g997amlfcg, G997_AlarmMaskLineFailuresConfigGet
g997amlfcs, G997_AlarmMaskLineFailuresConfigSet
g997bang, G997_BitAllocationNscGet
g997bansg, G997_BitAllocationNscShortGet
g997cdrtcg, G997_ChannelDataRateThresholdConfigGet
g997cdrtcs, G997_ChannelDataRateThresholdConfigSet
g997csg, G997_ChannelStatusGet
g997dpfsg, G997_DataPathFailuresStatusGet
g997dfr, G997_DeltFreeResources
g997dhling, G997_DeltHLINGet
g997dhlinsg, G997_DeltHLINScaleGet
g997dhlogg, G997_DeltHLOGGet
g997dqlng, G997_DeltQLNGet
g997dsnrg, G997_DeltSNRGet
g997fpsg, G997_FramingParameterStatusGet
g997gang, G997_GainAllocationNscGet
g997gansg, G997_GainAllocationNscShortGet
g997lstg, G997_LastStateTransmittedGet
g997lacg, G997_LineActivateConfigGet
g997lacs, G997_LineActivateConfigSet
g997lfsg, G997_LineFailureStatusGet
g997lisg, G997_LineInitStatusGet
g997lig, G997_LineInventoryGet
g997listrg, G997_LineInventorySTRingGet
g997lis, G997_LineInventorySet
g997lsg, G997_LineStatusGet
g997lspbg, G997_LineStatusPerBandGet
g997ltsg, G997_LineTransmissionStatusGet
g997pmsft, G997_PowerManagementStateForcedTrigger
g997pmsg, G997_PowerManagementStatusGet
g997racg, G997_RateAdaptationConfigGet
g997racs, G997_RateAdaptationConfigSet
g997sang, G997_SnrAllocationNscGet
g997sansg, G997_SnrAllocationNscShortGet
g997xtusecg, G997_XTUSystemEnablingConfigGet
g997xtusecs, G997_XTUSystemEnablingConfigSet
g997xtusesg, G997_XTUSystemEnablingStatusGet
help, Help
ics, InstanceControlSet
isg, InstanceStatusGet
lecg, LastExceptionCodesGet
lfcg, LineFeatureConfigGet
lfcs, LineFeatureConfigSet
lfsg, LineFeatureStatusGet
locg, LineOptionsConfigGet
locs, LineOptionsConfigSet
lsg, LineStateGet
llcg, LowLevelConfigurationGet
llcs, LowLevelConfigurationSet
mlsg, MiscLineStatusGet
mfcg, MultimodeFsmConfigGet
mfcs, MultimodeFsmConfigSet
mfsg, MultimodeFsmStatusGet
nsecg, NotificationScriptExecuteConfigGet
nsecs, NotificationScriptExecuteConfigSet
pm15meet, PM_15MinElapsedExtTrigger
pmbms, PM_BurninModeSet
pmcc15mg, PM_ChannelCounters15MinGet
pmcc1dg, PM_ChannelCounters1DayGet
pmccsg, PM_ChannelCountersShowtimeGet
pmcctg, PM_ChannelCountersTotalGet
pmchs15mg, PM_ChannelHistoryStats15MinGet
pmchs1dg, PM_ChannelHistoryStats1DayGet
pmct15mg, PM_ChannelThresholds15MinGet
pmct15ms, PM_ChannelThresholds15MinSet
pmct1dg, PM_ChannelThresholds1DayGet
pmct1ds, PM_ChannelThresholds1DaySet
pmcg, PM_ConfigGet
pmcs, PM_ConfigSet
pmdpc15mg, PM_DataPathCounters15MinGet
pmdpc1dg, PM_DataPathCounters1DayGet
pmdpcsg, PM_DataPathCountersShowtimeGet
pmdpctg, PM_DataPathCountersTotalGet
pmdpfc15mg, PM_DataPathFailureCounters15MinGet
pmdpfc1dg, PM_DataPathFailureCounters1DayGet
pmdpfcsg, PM_DataPathFailureCountersShowtimeGet
pmdpfctg, PM_DataPathFailureCountersTotalGet
pmdpfhs15mg, PM_DataPathFailureHistoryStats15MinGet
pmdpfhs1dg, PM_DataPathFailureHistoryStats1DayGet
pmdphs15mg, PM_DataPathHistoryStats15MinGet
pmdphs1dg, PM_DataPathHistoryStats1DayGet
pmdpt15mg, PM_DataPathThresholds15MinGet
pmdpt15ms, PM_DataPathThresholds15MinSet
pmdpt1dg, PM_DataPathThresholds1DayGet
pmdpt1ds, PM_DataPathThresholds1DaySet
pmetr, PM_ElapsedTimeReset
pmlesc15mg, PM_LineEventShowtimeCounters15MinGet
pmlesc1dg, PM_LineEventShowtimeCounters1DayGet
pmlescsg, PM_LineEventShowtimeCountersShowtimeGet
pmlesctg, PM_LineEventShowtimeCountersTotalGet
pmleshs15mg, PM_LineEventShowtimeHistoryStats15MinGet
pmleshs1dg, PM_LineEventShowtimeHistoryStats1DayGet
pmlfc15mg, PM_LineFailureCounters15MinGet
pmlfc1dg, PM_LineFailureCounters1DayGet
pmlfcsg, PM_LineFailureCountersShowtimeGet
pmlfctg, PM_LineFailureCountersTotalGet
pmlfhs15mg, PM_LineFailureHistoryStats15MinGet
pmlfhs1dg, PM_LineFailureHistoryStats1DayGet
pmlic15mg, PM_LineInitCounters15MinGet
pmlic1dg, PM_LineInitCounters1DayGet
pmlicsg, PM_LineInitCountersShowtimeGet
pmlictg, PM_LineInitCountersTotalGet
pmlihs15mg, PM_LineInitHistoryStats15MinGet
pmlihs1dg, PM_LineInitHistoryStats1DayGet
pmlit15mg, PM_LineInitThresholds15MinGet
pmlit15ms, PM_LineInitThresholds15MinSet
pmlit1dg, PM_LineInitThresholds1DayGet
pmlit1ds, PM_LineInitThresholds1DaySet
pmlsc15mg, PM_LineSecCounters15MinGet
pmlsc1dg, PM_LineSecCounters1DayGet
pmlscsg, PM_LineSecCountersShowtimeGet
pmlsctg, PM_LineSecCountersTotalGet
pmlshs15mg, PM_LineSecHistoryStats15MinGet
pmlshs1dg, PM_LineSecHistoryStats1DayGet
pmlst15mg, PM_LineSecThresholds15MinGet
pmlst15ms, PM_LineSecThresholds15MinSet
pmlst1dg, PM_LineSecThresholds1DayGet
pmlst1ds, PM_LineSecThresholds1DaySet
pmrtc15mg, PM_ReTxCounters15MinGet
pmrtc1dg, PM_ReTxCounters1DayGet
pmrtcsg, PM_ReTxCountersShowtimeGet
pmrtctg, PM_ReTxCountersTotalGet
pmrths15mg, PM_ReTxHistoryStats15MinGet
pmrths1dg, PM_ReTxHistoryStats1DayGet
pmrtt15mg, PM_ReTxThresholds15MinGet
pmrtt15ms, PM_ReTxThresholds15MinSet
pmrtt1dg, PM_ReTxThresholds1DayGet
pmrtt1ds, PM_ReTxThresholds1DaySet
pmr, PM_Reset
pmsmg, PM_SyncModeGet
pmsms, PM_SyncModeSet
ptsg, PilotTonesStatusGet
quit, Quit
rccg, RebootCriteriaConfigGet
rccs, RebootCriteriaConfigSet
rusg, ResourceUsageStatisticsGet
se, ScriptExecute
sicg, SystemInterfaceConfigGet
sics, SystemInterfaceConfigSet
sisg, SystemInterfaceStatusGet
tmcs, TestModeControlSet
tmsg, TestModeStatusGet
vig, VersionInformationGet
Alpha # exit
Connection closed by foreign host.
[bcat@Duo2 ECI]$
I am not sure if that 'help' list is identical to the one discovered by asbokid for the 'newer' type ECI device, the V-2FUb/r, but if it is, Bald_Eagle1 will be able to (eventually) support both ECI device types. ;)
is there a simple way for a newbie how to unlock this modem .
Gigabit Switch (5 Port)
^ ^ ^ ^ ^
x x | | |
| | -> ECI Modem
| |
| --- > Router WAN
|
------ > Router LAN
Has anyone managed to be able to have the Lan1 port going to the WAN port on a router, and have the Lan2 going into the router switch to be able to access the GUI and get the line stats etc??
I have my Lan2 set up as 192.168.1.240 and it works fine as long as the Wan port is not connected - As soon as I plug in the Wan port I lose the ability to access the GUI and get my stats :(
I presume that as I cant connect to the Lan2 port whilst running, I wont be able to run eDMT?
Any assistance very much appreciated :)
Andy
I could only connect to one of the device (modem and router) until you removed the IP from your computer and allowed it to auto-assign now I can access both.
You have been more than helpful :)
<snip>
Thanks again burakkucat for lending a hand :)
HuaweiHG612Hacking by asbokid is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License.
echo " bpstg" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " bbsg 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " bbsg 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " fpsg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " fpsg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997amlfcg 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997amlfcg 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997fpsg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997fpsg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997lig 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997lig 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997listrg 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997listrg 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997lsg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997lsg 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997lspbg 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " g997lspbg 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " lfcg 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " lfcg 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " llcg" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc15mg 0 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc15mg 0 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc15mg 0 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc15mg 0 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc15mg 0 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc15mg 0 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc1dg 0 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc1dg 0 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc1dg 0 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc1dg 0 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc1dg 0 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcc1dg 0 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmccsg 0 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmccsg 0 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmccsg 0 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmccsg 0 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmccsg 0 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmccsg 0 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcctg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmcctg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc15mg 0 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc15mg 0 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc15mg 0 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc15mg 0 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc15mg 0 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc15mg 0 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc1dg 0 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc1dg 0 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc1dg 0 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc1dg 0 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc1dg 0 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpc1dg 0 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpcsg 0 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpcsg 0 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpcsg 0 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpcsg 0 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpcsg 0 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpcsg 0 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpctg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpctg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpfc15mg 0 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpfc15mg 0 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpfc15mg 0 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpfc15mg 0 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpfc15mg 0 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmdpfc15mg 0 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesc15mg 0 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesc15mg 0 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesc15mg 0 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesc15mg 1 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesc15mg 1 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesc15mg 1 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo "pmlesc1dg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo "pmlesc1dg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo "pmlesc1dg 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo "pmlesc1dg 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo "pmlesc1dg 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo "pmlesc1dg 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlescsg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlescsg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlescsg 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlescsg 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlescsg 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlescsg 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesctg 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlesctg 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc15mg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc15mg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc15mg 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc15mg 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc15mg 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc15mg 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc1dg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc1dg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc1dg 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc1dg 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc1dg 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfc1dg 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfcsg 0 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfcsg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfcsg 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfcsg 1 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfcsg 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfcsg 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfctg 0" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlfctg 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc15mg 0 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc15mg 0 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc15mg 0 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc15mg 1 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc15mg 1 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc15mg 1 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc1dg 0 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc1dg 0 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc1dg 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc1dg 1 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc1dg 1 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsc1dg 1 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlscsg 0 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlscsg 0 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlscsg 0 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlscsg 1 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlscsg 1 1" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlscsg 1 2" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsctg 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmlsctg 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtc15mg 0 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtc15mg 0 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtc15mg 0 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtc1dg 0 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtc1dg 0 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtc1dg 0 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtcsg 0 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtcsg 0 1 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtcsg 0 2 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " pmrtctg 0 " > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " rusg" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
echo " vig" > /tmp/pipe/dsl_cpe0_cmd
cat /tmp/pipe/dsl_cpe0_ack
I'd like to confirm that telnet and the gui remain accessible if another router acting as a switch inbetween the modem and normal router is used.
My findings are that errors such as CRC, FEC and ES are reported although probably not always accurately.c) Is this via the GUI or telnet ? Also, what leads you to believe they are not always accurate ?
a) Is that absolutely necessary ? I have a spare switch I could use, but I will probably be breaking t&c's by doing so!I can't access the modem with WAN connected unless i use the above method.
b) Am I likely to get locked out again by a firmware upgrade, as with the HG612?Possibly but i'd wait for someone more qualified to answer
c) Is this via the GUI or telnet ? Also, what leads you to believe they are not always accurate ?The FEC errors on both sometimes show a figure of about 49,000,0000 or something which is probably the threshold. I also have only seen HEC at 0.
Check serial terminal emulator is set to 115,200 baud, no flow control, no parity.