Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[dazzsser]

Yes it's the same and if they have firm 16.3 and above they can be exploited...
And I would like to have a dump of that firmware
If someone could provide it...

Hi ansuel I have the TG799VAC as it is the provided modem by the ISP they also have a TG800 variant that is almost identical. I have followed steps to unlock both models and get SSH access using the crc.id.au guide posted and I am willing to perform a firmware dump if you can guide me on how to do that! And another information that you need

[shdf]

Hello,
it was confirmed by several users that the new TG800vac (Broadcom 63138 too, see spec here) can be rooted.
2 users here : http://forums.whirlpool.net.au/forum-replies.cfm?t=2650998&p=3&#r53
1 user here : https://www.crc.id.au/hacking-the-technicolor-tg799vac-and-unlocking-features/#comment-311794
At the moment there is no 17.x firmware version fixing the exploit on that modem/router.

A few are available on ebay.co.au: https://www.ebay.com.au/sch/i.html?_from=R40&_trksid=p2380057.m570.l1313.TR12.TRC2.A0.H0.Xtg800.TRS0&_nkw=tg800&_sacat=0

[Ansuel]

Hi ansuel I have the TG799VAC as it is the provided modem by the ISP they also have a TG800 variant that is almost identical. I have followed steps to unlock both models and get SSH access using the crc.id.au guide posted and I am willing to perform a firmware dump if you can guide me on how to do that! And another information that you need

sure i can give you the command...

pay attention to remove the file generated in tmp as it can crash the modem ...

dd if=/dev/mtd3 of=/tmp/bank_1
save the file in /tmp to desktop for example and remove it from /tmp
same things for this
dd if=/dev/mtd4 of=/tmp/bank_2

this will dump the 2 bank table... no sesitive information are in here....


my modified gui should work also for that

if something goes wrong i can fix it

[dazzsser]

Hi ansuel i have sent you a PM.

Its funny because the DGA4130 looks very similar to the TG799VAC
Front:

Back:

[dazzsser]

Also does anyone know how to set WPA-enterprise on these routers i.e. what do the config files look like for wpa enterprise /etc/config/wireless

[adslmax]

All you need now is a G.FAST line and use that Modem to make DSLstats G.Fast compatible 

I am consider of buying this. Thanks.

[adslmax]

Hello,
does anyone noticed this Modem/router based on Broadcom BCM63138 ?



Complete review in italian here : http://www.hwupgrade.it/forum/showthread.php?t=2817859
Datasheet here : https://www.callflow.co.uk/wp-content/uploads/2017/04/ultrfast-technicolor-router-spec-sheet.pdf

Support:
This modem/router comes from the italian ISP TIM, but can be unlocked to the original Technicolor Firmware.
How to easily Unlock the firmware for other ISP : https://www.ilpuntotecnicoeadsl.com/sblocco-smart-modem-evolution-dga4130-agtef/
This will enable FULL ROOT access to the device, SSH + Telnet !

The device can be found at a very low price and brand new on Ebay (40€ / £35 shipped) ! :
https://www.ebay.it/sch/i.html?_from=R40&_trksid=p2380057.m570.l1313.TR0.TRC0.H0.XDGA4130.TRS0&_nkw=DGA4130&_sacat=0




EDIT 10/10/2017:
How to root the modem, step by step:
http://forum.kitz.co.uk/index.php/topic,20343.msg356237.html#msg356237

How to install Transmission:
http://forum.kitz.co.uk/index.php/topic,20343.msg356335.html#msg356335

How to install Aria2:
http://forum.kitz.co.uk/index.php/topic,20343.msg356456.html#msg356456

Awesome very cheap! With G.Fast and new broadcom chip 63138. Thanks for sharing shdf

[surrealiz3]

JTAG anyone ? full mem dumps ?

vant-y  not working but dant-o is fine

https://github.com/pedro-n-rocha/bli223dcryptex

its the new version firmware based on LEDE ?

thanks

[Ansuel]

JTAG anyone ? full mem dumps ?

vant-y  not working but dant-o is fine

https://github.com/pedro-n-rocha/bli223dcryptex

its the new version firmware based on LEDE ?

thanks

Every modem have a code to decript firmware...

[surrealiz3]

Code: [Select]

********* fw fixed header decoding *********************************************************************

 [ptr :          ] filname           : dant-o_CRF685-16.1.7565-580-RC.rbi
 [ptr : 000      ] imagetype         : BLI223WE0
 [ptr : 006      ] FIACODE           : WE
 [ptr : 020      ] branding          : TE
 [ptr : 028      ] flag??            : 00000000
 [ptr : 032      ] version           :
 [ptr : 040      ] hdrlength         : 0x0000016a
 [ptr : 044      ] datalength        : 0x00fa521f
 [ptr : 048      ] crc32             : dbde8a01
 [ptr :          ] computedhash      : 7ccf3a95a0b9f5186ddb26bf44ef6aa69d8a845d
 [ptr :          ] decryptedhash     : 7ccf3a95a0b9f5186ddb26bf44ef6aa69d8a845d
 [ptr :          ] integritycheck    : True
 [ptr :          ] aeskey            : 3cf1488f7215e7f5364f4180fd4ba5985a6ed484a1d1e9221e9afe806f113919
 [prt : 0xfa5389 ] footer            :
 [ptr : 363      ] imagetype         : MUTE
 [ptr : 310      ] board             : DANT-O
 [ptr : 318      ] model1            : Technicolor TG797n v3
 [ptr : 341      ] model2            : TG797n v3
 [ptr : 352      ] flashaddr         : c1600000
 [ptr : 358      ]  undefined : 20cbbab4

********************************************************************************************************




[surrealiz3]

working on vant variant , if you have the tools from the router please provide bli... cwmp etc

thanks

[Ansuel]

working on vant variant , if you have the tools from the router please provide bli... cwmp etc

thanks

What do you mean working on vant variant?

[surrealiz3]

have you checked the repo : https://github.com/pedro-n-rocha/bli223dcryptex/blob/master/bli223dcryptex.py

do you have a complete flash dump of this router ? or some tools that were mentioned somewhere bli cwmp ?? if you have please provide , it seems the rsa key has changed and some offstets on rbi header and i can check to adapt the extractors

I am working on a rbi extractor and parser , already workin for other variants as dan-o 

[Ansuel]

We already created a tool to decript rbi file... Ilpuntotecnicoeadsl repo.... We need to create a repository for the osck code that depend on the modem of the router

[surrealiz3]

ok

can you share ?