Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[dmcdonnell]

Kitizens,

Vodafone Ireland have started to supply the HG658c, aka HG658BZV Ver. A, as part of their fibre roll out. It is based on the BCM63168 SoC. They claim a recent firmware update enables vectoring. See https://wikidevi.com/wiki/Huawei_HG658 and https://community.vodafone.ie/t5/Services-at-Home/Changelog-for-new-HG658-Firmware-B214-Vodafone-NGA-Vectoring/m-p/146781/highlight/true#M9637

Recent Huawei modem/routers, eg HG556a, are well supported in OpenWRT (apart from xDSL). Huawei say they will supply the gpl source for US$20.

Regards,

Dermot

Pics here:
http://www.4shared.com/download/abEAbGY6ce/IMG_20140322_162443.jpg?lgfp=3000
http://www.4shared.com/download/dg0XLz4tba/IMG_20140322_162509.jpg?lgfp=3000

[dmcdonnell]

HG658c boot log is here: http://www.4shared.com/file/K2PqKQrJba/hg658c_boot.html

[HighBeta]

Thanks always useful ! 

[dmcdonnell]

I have put it on paste.bin for ease of access: http://pastebin.com/YxkiEtZn

[les-70]

   I assume that you have identified serial port connections on the board to to get the boot log.  Looking at the photo there seem to be a few possible options, can you say where the connections are.?

   Also can you say what the firmware version is shown by the HG658?  If not the command "xdslcmd --version" should give it if you log in via telnet or on the serial port.   It may also be shown on the start page of the web gui.

[dmcdonnell]

   I assume that you have identified serial port connections on the board to to get the boot log.  Looking at the photo there seem to be a few possible options, can you say where the connections are.?

~1cm above "HG658BZV Ver. A" in the photo you can see the 5 pin header, with the bar code sticker to the right. From left, Tx, Gnd, 3.3v, N/A, Rx. Serial settings: 115200baud, 8bits, 1stop bit, no parity.

Also can you say what the firmware version is shown by the HG658?  If not the command "xdslcmd --version" should give it if you log in via telnet or on the serial port.   It may also be shown on the start page of the web gui.

Telnet does not appear to be running. The status page of the gui:

Product type             HG658c 
Device ID                  F83DFF-Q8Y7NA9382600371
Hardware version    HG658BZV VER.A
Software version     V100R001C172B211
Batch number          BC172P0.211.A2pv6F037g.d24b1
MAC Address          00:66:4B:32:CE:08 
System up time       0 days 0 hours 1 minutes 43 seconds


I googled "CFE version 1.0.38-" and found information that indicated the bootloader is locked, i.e. it will not flash unsigned images. See http://unlocka1.wordpress.com/prg_av/

Regards,

Dermot.

[dmcdonnell]

I managed to capture a Vodafone firmware update to the HG658c using a man in the middle. See https://forum.openwrt.org/viewtopic.php?pid=228756#p228756

The new boot log is here: http://pastebin.com/1JaF3dPr

[kitz]

It is based on the BCM63168 SoC. They claim a recent firmware update enables vectoring

For info

Ive just got my mitts on a new Zyxel VMG8324 which is also based on the BCM63168.  The configs show support for vectoring.

What is interesting, whilst playing I happened to spy a Huawei graphic. 

[dmcdonnell]

It is based on the BCM63168 SoC. They claim a recent firmware update enables vectoring

For info

Ive just got my mitts on a new Zyxel VMG8324 which is also based on the BCM63168.  The configs show support for vectoring.

What is interesting, whilst playing I happened to spy a Huawei graphic. 

Very interesting. I'd guess Huawei are the OEM of most of these router boards. Is it locked? Can you rip the firmware?

[dmcdonnell]

The latest Vodafone firmware for the HG658c is here: https://drive.google.com/file/d/0B8w9evGfsK03MVpMTlVBTDY3WlE/edit?usp=sharing

It includes a new bootloader (CFE).

I tested it by flashed using the stock interface. Boots fine.

The boot log is here: http://pastebin.com/1JaF3dPr

[les-70]

   I tried firmware mod kit (fmk) on that firmware but like the zytel it is a jffs2 file system that is not supported in the standard fmk build.  It looks like it might be if the current fmk source is rebuilt as support for jffs2 is added in the source code.    I doubt my linux is up such a rebuild.

  Separately I assume that you can access the file system via the serial if you can login when the gateway is fully booted up.

   Please might you be able to extract the Broadcom Binary Large Object BLOB from the file system?    I am separately wondering if kitz can access the zytel one, that may or amy not be the same one.

  This is often very easy on routers with a usb.  If you plug in a usb memory you will  probably find it mounted in the file system and any file can then be copied to it.  In the Hg612 the file is in /etc/adsl and called adsl_phy.bin. If the usb approach fails then tftp will also allow it if (tftp) if present in the file system. If you could make that file available it will be possible to try dynamically swapping it into an HG612.  I am up to that, but so far building new firmware has proved too much for my linux skills. There are however others who seem good at that. It would be interesting

[dmcdonnell]

Separately I assume that you can access the file system via the serial if you can login when the gateway is fully booted up.
Please might you be able to extract the Broadcom Binary Large Object BLOB from the file system?    I am separately wondering if kitz can access the zytel one, that may or amy not be the same one.

Afraid not, When the box is booting, or booted, attempts to access via serial produce "The console is prohibited!" messages. As I said earlier, telnetd does not appear to be running.

[kitz]

Very interesting.
1) I'd guess Huawei are the OEM of most of these router boards.
2) Is it locked?
3) Can you rip the firmware?

1)  Thats what I thought at first too but Im now not so sure.  I cant find the graphic again, and Im beginning to wonder if it was cached somewhere by my browser from the HG612 since they both use the same IP address.
2) No
3) Im trying to, but dont really know what Im doing :/  - here

[dmcdonnell]

Very interesting.
1) I'd guess Huawei are the OEM of most of these router boards.
2) Is it locked?
3) Can you rip the firmware?

1)  Thats what I thought at first too but Im now not so sure.  I cant find the graphic again, and Im beginning to wonder if it was cached somewhere by my browser from the HG612 since they both use the same IP address.
2) No
3) Im trying to, but dont really know what Im doing :/  - here

Take a look at the model number in the pic you posted with the Huawei logo.

admin1234 may be the default password, it is on the Vodafone HG658c. It's worth a try on yours, but I guess you have root access. Do you have telnet?

TJ runs a series of commands on his blog to extract information. If you get cli, could you copy the mtd partitions to usb, please? It would great to binwalk them.

TIA

[kitz]

>> Take a look at the model number in the pic you posted with the Huawei logo.

Yep, the text said Welcome to VMG8324-B10A Same page now shows the Zyxel logo. - See attached.   
Looking at the page, the image name is simply "logo.gif" at the url http://192.168.1.1/images/logo.gif which is why I now suspect a caching issue from having used the Huawei modem on the same IP.

>> admin1234 may be the default password, it is on the Vodafone HG658c. It's worth a try on yours, but I guess you have root access. Do you have telnet?

Yes admin 1234 was the default but it nags you so much that I changed it.
Yes I have root access and telnet. - See other thread

>> If you get cli, could you copy the mtd partitions to usb, please? It would great to binwalk them.

Certainly.  Trying to do that
http://forum.kitz.co.uk/index.php?topic=13769.15

--------------------

ETA

Done..  you should have a copy.