Buenas,
Voy a intentar hacer cosas con el HG253s v2. Pude comprarlo de segunda mano por 7€ y quiero ver hasta donde se puede llegar con él.
El HW:
BCM63168 (400MHz)
16MB
128MB RAM
WiFi b/g/n
4+1 10/100/1000
https://wikidevi.com/wiki/Huawei_HG253s_v2Me gustaría obtener el firmware OEM de este cacharro, pero no lo encuentro en ningún lado. Seguramente me toque extraerlo del propio dispositivo....
He intentado acceder a la shell como root, pero por ahora sin éxito:
- Acceder por GUI como admin se puede con las siguiente credenciales:
admin:VF-EShg253- La placa parece tener JTAG (no comprobado), aunque los pines RX,TX y GND funcionan bien. Usa como bootloader
CFE version 1.0.38-114.174 for BCM96362 (32bit,SP,BE)Por desgracia, cuando arranca el firmware no admite ninguna entrada de teclado, asi que no puedo manejarme desde ahí tampoco.
- Si no me equivoco, CFE no permite cargar un firmware si no está firmado, así que esa vía también se descarta (corregidme si me equivoco).
- Es muy probable que se pueda activar SSH o Telnet desde los archivos de configuración, pero estos se cifran cuando haces el backup. Alguién ya consiguió obtener las claves (y poder desencriptar los backups de la config), pero el router que tengo está actualizado (V100R001C205B038SP05, y parece ser, con claves distintas).
https://github.com/jsenin/hg253sV2Solo se me ocurren dos formas de continuar:
1. Intentar hacer DUMP de la memoria a través de JTAG
2. Reemplazar el bootloader y arrancar una imagen genérica de OpenWrt en RAM.
Lo malo de la segunda forma es que perdería el bootloader original...
---------------------------------------
OEM bootlog:
HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
PHYE
DINT
LASY
USYN
MSYN
LMBE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
NAN1
BT00
0002
NAN9
BT00
0244
NAN9
NAN3
RFS2
NAN5
CFE version 1.0.38-114.174 for BCM96362 (32bit,SP,BE)
Build Date: Mon Jul 20 00:00:00 CST 2015 (root@localhost)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name Spansion S34ML01G1, id 0x01f1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM6362B0, MIPS: 400MHz, DDR: 333MHz, Bus: 166MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-11) : hg253s
Number of MAC Addresses (1-32) : 10
Base MAC Address : 02:10:18:01:00:01
PSI Size (1-64) KBytes : 0
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0
Boot :e=192.168.1.1:ffffff00 h=192.168.1.100 g= r=f f=vmlinux i=bcm963xx_fs_kernel d=1 p=0
*** Press any key to stop auto run (0 seconds) ***
Auto run second count down: 0
../../../cfe/arch/mips/board/bcm63xx_ram/src/bcm63xx_util.c 770 ATP_FLASHCBB_Read_With_ReservedBlock: blk_start = 0x000003F8, ulReservedBlockSize = 0x00000003
Boot from slave system!
../../../cfe/arch/mips/board/bcm63xx_ram/src/bcm63xx_util.c 770 ATP_FLASHCBB_Read_With_ReservedBlock: blk_start = 0x000003F8, ulReservedBlockSize = 0x00000003
SIGN CHK ALWAYLYS.
get bootflag = 2
../../../cfe/arch/mips/board/bcm63xx_ram/src/bcm63xx_cmd.c 3309 ATP_GetKernelTag: ulTagBlock = 239
../../../cfe/arch/mips/board/bcm63xx_ram/src/bcm63xx_util.c 770 ATP_FLASHCBB_Read_With_ReservedBlock: blk_start = 0x000000EF, ulReservedBlockSize = 0x00000004
check tag at block 239 crc ok
../../../cfe/arch/mips/board/bcm63xx_ram/src/bcm63xx_cmd.c 3800 hw_check_image: pBase = 0xB9E80000, size = 0x01180000
../../../cfe/arch/mips/board/bcm63xx_ram/src/bcm63xx_util.c 586 ATP_FLASHCBB_Read: start = 0xB9E80000, ulLen = 0x01180000
Check Image Crc Success
Power down external PHY port.
I have find vmlinux.lz at block 245
I have get vmlinux.lz size at block 259
Decompression OK!
Entry at 0x803bc830
Closing network.
no Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x803bc830
init started: BusyBox vv1.9.1 ()
starting pid 290, tty '': '/etc/init.d/rcS'
RCS DONE
starting pid 291, tty '': '/bin/sh'
BusyBox vv1.9.1 () built-in shell (ash)
Enter 'help' for a list of built-in commands.
boot start running profile...
rootdir=/
table='/etc/devicetable'
boot start running starbsp...
mount config success
mount coredump success
mount oldconfig success
boot running starbsp...
-/bin/sh: cannot create /proc/tty/mode: nonexistent directory
Loading drivers and kernel modules...
boot running mic...
INSMOD base START......
Start mic now ...
GlobeMac Init OK
load cfm ok.
retry xhci
retry xhci done
##sendmsg return 16, errno 0.
INSMOD base Done
read buffer:
MemTotal: 123456 kB
MemFree: 77788 kB
Buffers: 0 kB
Cached: 10032 kB
SwapCached: 0 kB
Active: 3488 kB
Inactive: 8596 kB
Active(anon): 2368 kB
Inactive(anon): 0 kB
Active(file): 1120 kB
Inactive(file): 8596 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 2112 kB
Mapped: 2200 kB
Slab: 26996 kB
SReclaimable: 152 kB
SUnreclaim: 26844 kB
PageTables: 152 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 61728 kB
Committed_AS: 3784 kB
VmallocTotal: 1032148 kB
VmallocUsed: 6052 kB
VmallocChunk: 1020016 kB
MemTotal: 123456; MemFree 77788
INSMOD wlan START......
ethcmdVportEnable--------SUPPORT_ATP_ETH_BCM_EXT_SWITCH_53125-----
ARL table flush done
MASK- ifconfig [eth0]**********
Write PhyId<0x18> reg<0x0> value<0x1140>
device eth0 is not a slave of br0
INSMOD wlan Done
[wlanschedule.c WlanTimeRuleSetup:828] WlanTimeRuleSetup. bRecSntpNotify=0,ulWlScheduleItemNum=0
LedcmswpsChgProc :9
clear all the autochannel timer
Setting SSID: "vodafone54F1"
WlanSetSsid: SSID=vodafone54F1
wlctl: Unsupported
wlancms: events/0 is running as Real Time process.
wlancms: events/1 is running as Real Time process.
wlctl: Unsupported
wlctl: Unsupported
begin WlanStartServices...
init auth client
init acct client
init das server
wlctl: wl driver adapter not found
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: scan in progress ...
acsd: selected channel spec: 0x1001
wlctl: wl driver adapter not found
wlan wps enabled...
begin WlanUpInterfaces...
atp: cur kernel version:[2.6.30]
ifconfig: SIOCSIFADDR: File exists
Radvd work on br0 is disableFILE[radvdcms.c] LINE[363]
Dhcp6s work on br0 is disableFILE[dhcp6scms.c] LINE[317]
lBridgeKey is 0
============GET Interface Failed
WAN:InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.WANPPPConnection.1 check not init.
10.8.57.0 -1
10.8.57.0 -1
10.8.58.0 -1
10.8.57.0 -1
10.8.58.0 -1
10.8.59.0 -1
10.8.57.0 -1
10.8.58.0 -1
10.8.59.0 -1
10.15.220.0 -1
10.8.57.0 -1
10.8.58.0 -1
10.8.59.0 -1
10.15.220.0 -1
10.179.32.0 -1
10.8.57.0 -1
10.8.58.0 -1
10.8.59.0 -1
10.15.220.0 -1
10.179.32.0 -1
127.100.0.1 -1
10.8.57.0 -1
10.8.58.0 -1
10.8.59.0 -1
10.15.220.0 -1
10.179.32.0 -1
127.100.0.1 -1
127.100.0.2 -1
10.8.57.0 -1
10.8.58.0 -1
10.8.59.0 -1
10.15.220.0 -1
10.179.32.0 -1
127.100.0.1 -1
127.100.0.2 -1
127.100.0.3 -1
iptables: No chain/target/match by that name
iptables v1.4.0: Couldn't find target `rule24'
Try `iptables -h' or 'iptables --help' for more information.
iptables: No chain/target/match by that name
ip6tables: No chain/target/match by that name
ip6tables v1.4.0: Couldn't find target `rule24'
Try `ip6tables -h' or 'ip6tables --help' for more information.
ip6tables: No chain/target/match by that name
Sorry, rule does not exist.
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
iptables: Bad rule (does a matching rule exist in that chain?)
cms dispatch now ...
[wlanschedule.c WlanTimeRuleSetup:828] WlanTimeRuleSetup. bRecSntpNotify=1,ulWlScheduleItemNum=0
[(debug)01:00:50.530 :1767:tapi tapi.c:2761]: TAPI CREATE Oper Succ![obj:0xffffffff, dev:24, chres:0, call:PSTN]
[(debug)01:00:50.531 :1767:tapi tapi.c:2516]: Alloc PSTN_UP 0 channel Succ. [dev=24, Chres = 0]
[(debug)01:00:50.531 :1767:tapi tapi.c:2761]: TAPI CREATE Oper Succ![obj:0xffffffff, dev:25, chres:1, call:ISDN]
[(debug)01:00:50.531 :1767:tapi tapi.c:2574]: Alloc ISDN_UP 0 channel Succ. [dev=25, Chres = 1]
[(debug)01:00:50.531 :1767:tapi tapi.c:2761]: TAPI CREATE Oper Succ![obj:0xffffffff, dev:26, chres:2, call:ISDN]
[(debug)01:00:50.532 :1767:tapi tapi.c:2574]: Alloc ISDN_UP 1 channel Succ. [dev=26, Chres = 2]
TAPI_AllocResource() OK!
[(debug)01:00:50.533 voice:1830:tapi tapi.c:793]: TAPI thread thread started with pid 1830BOS: Enter bosInit
bosTimerInit
Enter bosAppInit Exit bosAppInit BOS: Exit bosInit
Created message queue "HDSP", depth 40, id 1
[(debug)01:00:50.536 voice:1830:tapi tapi_cb.c:66]: Start TCB Succ!00:00:53 Endpoint Event task started with pid 1846...
------------- gwSipStartup OK! ------------
[(debug)01:00:53.727 voice:1853:tapi tapi_cms.c:656]: TAPI_CMS thread started with pid 1853
CS PCM_READ thread started with pid 1855Salu2
