Legal, já tem coisas interessantes. Mandei vir um modem destes para poder fuçar e não ficar sem internet, quando chegar vou poder mexer a vontade. O hard dele me parece bom, afinal até o switch dele é Gb, o problema todo é o FW capado da GVT.
O que precisavamos é ter um FW alternativo, mesmo que fosse do modelo canadense ou frances. Não creio que este hardware seja exclusivo da GVT, tem um modelo xx64 que tem a mesma descrição e a mesma caixa deste, eu peguei num site há algum tempo mas perdi a referencia.
{}s
Sim, o hardware é baseado em outros. Pelo que vimos, o as imagens são assinadas, usando DSA. A primeira checagem é feita no u-boot, olhem um strings do second-stage dele, bignums everywhere 
:
swi_cmd_wait
wait_smi_not_busy
SAGEM Secure-boot SU2_2_3 fast_2764
Twait_not_busy
Pserial#
CPU: IKANOS %x Family
CPU: IKANOS Fusiv 160 Family
CPU: IKANOS Fusiv 200 Family
CPU: IKANOS Fusiv 150 Family
CPU: IKANOS Fusiv 180 Family
PCI: 66 MHz
PCI: 33 MHz
%s: busy out of time
Switch identifier 0x%03x is not supported !
6061
6161
6171
unknown PHY 0x%04x/0x%02x detected at smi@0x%02x
PHY 88e1119r detected at smi@0x%02x
no PHY detected at smi@0x%02x
switch 88e%s detected at smi@0x%02x
marvell initialization failed !
Permanent parameters are programmed and activated : use DSA signature
Permanent parameters are programmed but not activated : skip DSA signature
Permanent parameters are not programmed : skip DSA signature
Searching valid rescue firmware
Rescue Firmware validated at address %p
Rescue Firmware found with no key at address %p
No rescue firmware found
Searching valid operational firmware
Operational Firmware validated at address %p
Operational Firmware found with no key at address %p
No operational firmware found
FirmwareType is unknown
__FoRCe ReCoVeRy ReSCue__
soft recovery rescue
__FoRCe ReCoVeRy NeTWoRK_
soft recovery network
__FoRCe DeBuG__
alarmLEDMode(E_FLASH)!
alarmLEDMode(E_RESET)!
alarmLEDMode(E_LAN_RESCUE)!
alarmLEDMode(E_FLASH_RESCUE)!
alarmLEDMode(E_BOOT_FLASH_RESCUE)!
alarmLEDMode(E_RAM_RESCUE)!
alarmLEDMode(E_STOP)!
alarmLEDMode(E_LED_ALL_GREEEN)!
alarmLEDMode(uknown eLED_Mode)!
partition_addr
partition_size
moving partition
partition not moved
bootm
No potential firmware in flash
run mtest a0000000 a7f00000 (testing 127MB/128MB of RAM)
Hit Ctrl-C to stop
mtest
a0000000
a7f00000
force recovery bootp tftp
good regular firmware at @0x%08X with key @0x%08X
Launch regular code from flash
Bad regular firmware!
Fall down to recovery recovery code in flash tftp
Launch recovery code from ram
%s %s
default
No valid recovery firmware found
recovery firmware at @0x%08X with key @0x%08X is OK
Launch recovery code from flash
TFTP Boot failure ! no more try !
DRAM:
baudrate
### ERROR ### Please RESET the board ###
Flash:
%02x:%02x:%02x:%02x:%02x:%02x
ethaddr
No valid remote-inventory
Cannot update ethaddr
ipaddr
loadaddr
bootfile
Net:
## Warning: gatewayip needed but not set
netretry
once
%d.%d.%d.%d
bad length %d < %d
invalid RARP header
len bad %d < %d
checksum bad
ICMP Host Redirect to
none
gatewayip
netmask
vlan
nvlan
serverip
*** ERROR: `serverip' not set
*** ERROR: `ipaddr' not set
*** ERROR: `eth%daddr' not set
*** ERROR: No ethernet found.
*** ERROR: `ethaddr' not set
Abort
Bytes transferred = %ld (%lx hex)
filesize
fileaddr
%2ld
.%ld
%cB%s
0123456789abcdefghijklmnopqrstuvwxyz
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
<NULL>
resetting CPU...
ethmod
gmii
emac1
voxEmac_init: Cannot allocate eth_device
emac2
wrong emac number
%s: mii read timeout!
Load address: 0x%lx
Loading: *
octet
timeout
File too large
File has bad magic
%lu MB reveived
TFTP error: First block is not block 1 (%ld)
Starting again
done
TFTP error: '%s' (%d)
Starting again
Retry count exceeded; starting again
%02lX%02lX%02lX%02lX.img
*** Warning: no boot file name; using '%s'
Using %s device
TFTP from server
; our IP address is
; sending through gateway
Filename '%s'.
Size is 0x%x Bytes =
*** WARNING: %s is too long (%d - max: %d) - truncated
BOOTP broadcast %d
Retry count exceeded; aborting
*** Unhandled DHCP Option in OFFER/ACK: %d
Host Name
Root Path
DHCP: INVALID STATE
DHCP client bound to address
autoload
RARP broadcast %d
ethact
emac1
emac2
default to emac1, please config ethact to emac1 or emac2
No ethernet found.
ethprime
[PRIME]
eth%daddr
Warning: %s MAC addresses don't match:
Address in SROM is %02X:%02X:%02X:%02X:%02X:%02X
Address in environment is %02X:%02X:%02X:%02X:%02X:%02X
unknown
missing or unknown FLASH type
CFI conformant FLASH (%d x %d)
Size: %ld MB in %d Sectors
Erase timeout %ld ms, write timeout %ld ms, buffer write timeout %ld ms, buffer size %d
Sector Start Addresses:
(RO)
%08lX%s
Flash %s error at address %lx
Command Sequence Error.
Flash %s timeout at address %lx data %lx
Block Erase Error.
Locking Error
Block locked.
Vpp Low Error.
Can't erase unknown flash type - aborted
- no sectors to erase
- Warning: %d protected sectors will not be erased!
erase
done
%d erase regions found, only %d used
## Unknown FLASH on Bank %d - Size = 0x%08lx = %ld MB
write
pci_hose_phys_to_bus: %s
invalid hose
invalid physical address
pci_hose_bus_to_phys: %s
reset
reset - Perform RESET of the CPU
go - start application at address 'addr'
addr [arg ...]
- start application at address 'addr'
passing 'arg' as arguments
Usage:
## Starting application at 0x%08lX ...
## Application terminated, rc = 0x%lX
bootargs
## Transferring control to NetBSD stage-2 loader (at address %08lx) ...
## Transferring control to RTEMS (at address %08lx) ...
bootm - boot application image from memory
[addr [arg ...]]
- boot application image stored in memory
passing arguments 'arg ...'; when booting a Linux kernel,
'arg' can be the address of an initrd image
Image Name: %.*s
Created: %4d-%02d-%02d %2d:%02d:%02d UTC
Image Type:
Invalid OS
NetBSD
Linux
VxWorks
U-Boot
RTEMS
Unknown OS
Unknown Architecture
Invalid CPU
Alpha
Intel x86
IA64
MIPS
MIPS 64 Bit
PowerPC
IBM S390
SuperH
SPARC
SPARC 64 Bit
M68K
Microblaze
Nios
Nios-II
Unknown Image
Invalid Image
Standalone Program
Kernel Image
RAMDisk Image
Multi-File Image
Firmware
Script
gzip compressed
unknown compression
bzip2 compressed
uncompressed
lzma compressed
%s %s %s (%s)
Data Size: %d Bytes =
Load Address: %08x
Entry Point: %08x
Contents:
Image %d: %8ld Bytes =
Error: Bad gzipped data
Error: gunzip out of data in header
Error: inflateInit2() returned %d
Error: inflate() returned %d
Error: Output buffer too small.
Check that CFG_BOOTM_LENis defined bigger than
uncompressed image in config(default value is 4 MB, current is %d bytes).
verify
## Booting image at %08lx ...
Bad Magic Number
Bad Header Checksum
Verifying Checksum ...
Bad Data CRC
Unsupported Architecture 0x%x
Wrong Image Type for %s command
Standalone Application
Uncompressing %s ...
XIP %s ...
GUNZIP ERROR - must RESET board to recover
LZMA: uncompress or overwrite error %d - must RESET board to recover
Unimplemented compression type %d
autostart
Can't boot image type %d
bootvx
bootvx - Boot vxWorks from an ELF image
[address] - load address of vxWorks ELF image.
bootelf
bootelf - Boot from an ELF image in memory
[address] - load address of ELF image.
## No elf image at address 0x%08lx
## Not a 32-bit elf image at address 0x%08lx
Load
Clear
%sing %s @ 0x%08lx (%ld bytes)
No load address provided
tftp
## Ethernet MAC address not copied to NV RAM
Automatic boot of VxWorks image at address 0x%08lx ...
bootaddr
No bootargs defined
## Not an ELF image, assuming binary
## Using bootline (@ 0x%lx): %s
## Starting vxWorks at 0x%08lx ...
## vxWorks terminated
## Starting application at 0x%08lx ...
## Application terminated, rc = 0x%lx
Total of %ld %s%s were the same
mtest - simple RAM test
[start [end [pattern]]]
- simple RAM read/write test
loop
loop - infinite loop on address range
[.b, .w, .l] address number_of_objects
- loop on a set of addresses
base
base - print or set address offset
- print address offset for memory commands
base off
- set address offset for memory commands to 'off'
crc32
crc32 - checksum calculation
address count [addr]
- compute CRC32 checksum [save at addr]
cmp - memory compare
[.b, .w, .l] addr1 addr2 count
- compare memory
cp - memory copy
[.b, .w, .l] source target count
- copy memory
mw - memory write (fill)
[.b, .w, .l] address value [count]
- write memory
nm - memory modify (constant address)
[.b, .w, .l] address
- memory modify, read and keep address
mm - memory modify (auto-incrementing)
[.b, .w, .l] address
- memory modify, auto increment address
md - memory display
[.b, .w, .l] address [# of objects]
- memory display
%08lx:
%08x
%04x
%02x
byte at 0x%08lx (0x%02x) != byte at 0x%08lx (0x%02x)
word at 0x%08lx (0x%08lx) != word at 0x%08lx (0x%08lx)
halfword at 0x%08lx (0x%04x) != halfword at 0x%08lx (0x%04x)
byte
halfword
Zero length ???
Copy to Flash...
done
Base Address: 0x%08lx
mtest ended with %u errors
mtest ended with no error
Pattern %08lX Writing...%12s
Reading...
Mem error #%u @ 0x%08X: found %08lX, expected %08lX
CRC32 for %08lx ... %08lx ==> %08lx
dhcp
dhcp - invoke DHCP client to obtain IP/boot params
rarpboot
rarpboot- boot image via network using RARP/TFTP protocol
[loadAddress] [bootfilename]
tftpboot
tftpboot- boot image via network using TFTP protocol
bootp
bootp - boot image via network using BootP/TFTP protocol
hostname
rootpath
dnsip
domain
Automatic boot of image at addr 0x%08lX ...
setenv
setenv - set environment variables
name value ...
- set environment variable 'name' to 'value ...'
setenv name
- delete environment variable 'name'
printenv
printenv- print environment variables
- print values of all environment variables
printenv name ...
- print value of environment variable 'name'
Environment size: %d/%d bytes
** Abort
## Error: "%s" not defined
ethaddr1
stdin
Can't overwrite "%s"
stdout
stderr
Can't delete "%s"
## Baudrate %d bps not supported
## Switch baudrate to %d bps and press ENTER ...
## Error: environment overflow, "%s" deleted
? - alias for 'help'
help
help - print online help
[command ...]
- show help information (for 'command')
'help' prints online help for the monitor commands.
Without arguments, it prints a short usage message for all commands.
To get detailed help information for specific commands you can type
'help' with one or more command names as arguments.
exit
exit - exit script
- exit functionality
test
test - minimal test like /bin/sh
[args..]
- test functionality
echo
echo - echo args to console
[args..]
- echo args to console; \c suppresses newline
version
version - print monitor version
- No help available.
Unknown command '%s' - try 'help' without arguments for list of all known commands
In:
No input devices available!
Out:
No output devices available!
Err:
No error devices available!
Cannot initialize the list of devices!
serial
Using default environment
%s[%d] FIXME: rc=%d
flash.c
Timeout writing to Flash
Flash not Erased
Can't write to protected Flash sectors
Outside available Flash
Start and/or end address not on sector boundary
Unknown Vendor of Flash
Unknown Type of Flash
General Flash Programming Error
miiphy_register: non unique device name '%s'
miiphy_register: cannot allocate memory for '%s'
No such device: %s
NULL device name!
MII devices:
'%s'
Current device: '%s'
PHY reset timed out
PHY 1000BT Status read failed
PHY speed read failed, assuming 10bT
PHY AN speed read failed, assuming 10bT
PHY duplex read failed, assuming half duplex
PHY AN duplex read failed, assuming half duplex
sb - secure boot
No bootloader arg
bootloader args too long
no command executed
going to execute following bootloader commands :
a bootloader command went wrong
bootloader commands done !
image_addr=0x%X
kernel args too long
No kernel arg changed
updating kernel args
bootargs
kernel args update done
*** bad partition Dsa Signature ***
half-flash parsed !
Potential firmware found at address : %p
Found %d firmwares !
SHA-1 test #%d:
passed
HMAC-SHA-1 test #%d:
failed
%02X
EFE021C2645FD1DC586E69184AF4A31ED5F53E93B5F123FA41680867BA110131944FE7952E2517337780CB0DB80E61AAE7C8DDC6C5C6AADEB34EB38A2F40D5E6
B2E7EFD37075B9F03FF989C7C5051C2034D2A323810251127E7BF8625A4F49A5F3E27F4DA8BD59C47D6DAABA4C8127BD5B5C25763222FEFCCFC38B832366C29E
0066A198186C18C10B2F5ED9B522752A9830B69916E535C8F047518A889A43A594B6BED27A168D31D4A52F88925AA8F5
602AB7ECA597A3D6B56FF9829A5E8B859E857EA95A03512E2BAE7391688D264AA5663B0341DB9CCFD2C4C5F421FEC8148001B72E848A38CAE1C65F78E56ABDEFE12D3C039B8A02D6BE593F0BBBDA56F1ECF677152EF804370C1A305CAF3B5BF130879B56C61DE584A0F53A2447A51E
MPI test #1 (mul_mpi):
256567336059E52CAE22925474705F39A94
6613F26162223DF488E9CD48CC132C7A0AC93C701B001B092E4E5B9F73BCD27B9EE50D0657C77F374E903CDFA4C642
MPI test #2 (div_mpi):
36E139AEA55215609D2816998ED020BBBD96C37890F65171D948E9BC7CBAA4D9325D24D6A3C12710F10A09FA08AB87
MPI test #3 (exp_mod):
003A0AAEDD7E784FC07D8F9EC6E3BFD5C3DBA76456363A10869622EAC2DD84ECC5B8A74DAC4D09E03B5E0BE779F2DF61
MPI test #4 (inv_mod):
MPI test #5 (simple gcd):
failed at %d
Unexpected error, return code = %08X
preboot
bootdelay
bootcmd
Hit any key to stop autoboot: %2d
%2d
## Command too long!
** Too many args (max. %d) **
Unknown command '%s' - try 'help'
then
elif
else
while
until
done
syntax error
fast_2764 #
ERROR: There is a global environment variable with the same name.
%s: readonly variable
ERROR : memory not allocated
HUSH_VERSION
0.01
Unknown command '%s' - try 'help' or use 'run' command
exit not allowed from main input shell.
<INTERRUPT>
file error
stream error
data error
insufficient memory
buffer error
stream end
0.95P
unknown compression method
invalid window size
invalid reserved bit
incorrect header check
invalid stored block lengths
invalid block type
too many length or distance symbols
oversubscribed dynamic bit lengths tree
incomplete dynamic bit lengths tree
invalid bit length repeat
oversubscribed literal/length tree
incomplete literal/length tree
invalid distance code
invalid literal/length code
incorrect data check
## Loading Ramdisk Image at %08lx ...
No Linux MIPS Ramdisk Image
memsize
0x%08X
initrd_start
0x%X
initrd_size
flash_start
flash_size
Starting kernel ...
mchavva_16:22_25Apr07
bootargs=root=/dev/mtdblock3 rw rootfstype=jffs2 myfs_start=0xbe000000 console=ttyS0,115200
bootcmd=bootm bf080000
ramboot=setenv bootargs root=/dev/ram rw console=$consoledev,$baudrate $othbootargs;tftp $ramdiskaddr $ramdiskfile;tftp $loadaddr $bootfile;bootm $loadaddr $ramdiskaddr
nfsboot=setenv bootargs root=/dev/nfs rw nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip:$gatewayip:$netmask:$hostname:$netdev:off console=$consoledev,$baudrate $othbootargs;tftp $loadaddr $bootfile;bootm $loadaddr
bootdelay=5
baudrate=115200
ethaddr=00:60:4c:99:99:99
ethact=emac1
ethmod=gmii
ipaddr=192.168.1.1
serverip=192.168.1.10
preboot=echo;echo Type "h" for HELP. Have fun!;echo
nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=${serverip}:${rootpath}
ramargs=setenv bootargs root=/dev/ram rw
othbootargs=myfs_start=0xbe000000
addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}:${hostname}:${netdev}:off
addmisc=setenv bootargs ${bootargs} console=ttyS0,${baudrate} ethaddr=${ethaddr} panic=1 ${othbootargs}
flash_nfs=run nfsargs addip addmisc;bootm ${kernel_addr}
flash_self=run ramargs addip addmisc;bootm ${kernel_addr} ${ramdisk_addr}
net_nfs=tftp 80400000 ${bootfile};run nfsargs addip addmisc;bootm
rootpath=/tftpboot/root
bootfile=/tftpboot/kernel.img
kernel_addr=bf080000
ramdisk_addr=b0100000
uboot_file=u-boot.bin
kernel_file=kernel.img
jffs_file=root_fs_mips_nofpu.jffs2
load_uboot=tftp 80400000 ${uboot_file}
load_kernel=tftp 80400000 ${kernel_file}
load_jffs=tftp 80400000 ${jffs_file}
update_uboot=run load_uboot && protect off bf000000 bf03ffff && erase bf000000 bf03ffff && cp.b 80400000 bf000000 ${filesize}
update_kernel=run load_kernel && erase bf080000 bf2fffff && cp.b 80400000 ${kernel_addr} ${filesize}
update_jffs=run load_jffs && erase be000000 beffffff && cp.b 80400000 be000000 ${filesize}
initenv=protect off bf040000 bf07ffff;erase bf040000 bf07ffff
netdev=eth1
consoledev=ttyS0
Hi There
what do ya want for nothing?
Test With Truncation
Test Using Larger Than Block-Size Key - Hash Key First
Test Using Larger Than Block-Size Key and Larger Than One Block-Size Data
Jefe
abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq
Hi There
what do ya want for nothing?
Um port limpo do u-boot permitiria rodar firmwares custom no aparelho. Estou em contato com alguém que possui um Sagemcom no Canada, talvez consiga imagens do aparelho para estudos.
, pelo que intendi ta solicitando senha mas nao me deixa digitar nada, ja tentei digitar e dei enter e responde (curl: <6> could not resolve host: 192.168.25.1replace_rg_conf.cgi; invalid arguments
:
