CGA2121 support

[eastfox77]

Is there any Infomation for this technicolor modem ? Looks similar to the CGA4233.
Is unverified boot possible (secureboot?)? any know vuls for root ? any firmware dump ?

I have the hardware to spare but haven't done any hardware hacking projects yet.

I would be grateful when you can point me to the right direction.

[jclehner]

Is unverified boot possible (secureboot?)?

According to deviwiki, it uses the BCM3384 chipset. Secure boot is only used by BCM3390-based modems.

any know vuls for root ?

Pre-BCM3390 devices use Linux only for providing things such as NAS capabilities using samba. The actual CM firmware is based on eCOS, running on a separate processor.

It might be possible to gain telnet access to the CM shell using SNMP, or a crafted GatewaySettings.bin file (if the web interface allows exporting that).

The device could also be affected by the Cable Haunt vulnerability.

Otherwise it's probably trivial to dump the NOR flash, and enable telnet using bcm2cfg. The flash chip should be located on the bottom side of the PCB (photos from FCC docs):

any firmware dump ?

Not yet.

I would be grateful when you can point me to the right direction.

There's quite a bit info in some closed issues, such as #26, #10 or #7, but check out others too.

[MightyFilipns]

Hi, I also have this router and can provide a GatewaySettings.bin file if it would be of any use.

[MightyFilipns]

I have been able to connect the UART ports. This is printed at boot until the console is disabled.
UART1:

07:30:24.899 Ecos memory map:
07:30:24.899 BLOCK    OWNER        MIPS      SIZE      MEM
07:30:24.902 Block 0: Owner: 0 - 0x00000000 0x06000000 0x00000000
07:30:24.906 Block 0: Owner: 0 - 0 MB 96 MB 0 MB
07:30:24.909 Block 1: Owner: 4 - 0x06000000 0x02000000 0x06000000
07:30:24.914 Block 1: Owner: 4 - 96 MB 32 MB 96 MB
07:30:24.918 Block 2: Owner: 2 - 0x00000000 0x06000000 0x08000000
07:30:24.922 Block 2: Owner: 2 - 0 MB 96 MB 128 MB
07:30:24.926 Block 3: Owner: 4 - 0x06000000 0x02000000 0x0e000000
07:30:24.931 Block 3: Owner: 4 - 96 MB 32 MB 224 MB
07:30:24.934 96MB (98304KB) remaining for eCos
07:30:24.937 BcmHeapInitialize starts
07:30:24.940 Init device '/dev/BrcmTelnetIoDriver'
07:30:24.943 Init device '/dev/ttydiag'
07:30:24.946 Init tty channel: 82284340
07:30:24.948 Init device '/dev/tty0'
07:30:24.950 Init tty channel: 82284360
07:30:24.953 Init device '/dev/haldiag'
07:30:24.955 HAL/diag SERIAL init
07:30:24.957 Init device '/dev/ser0'
07:30:24.960 BCM 33XX SERIAL init - dev: b4e00540.8
07:30:24.963 Set output buffer - buf: 0x82453918 len: 4096
07:30:24.967 Set input buffer - buf: 0x82454918 len: 4096
07:30:24.971 BCM 33XX SERIAL config
07:30:24.973 ^MInit device '/dev/ser1'
07:30:24.976 Init device '/dev/ser2'
07:30:24.978 SetProConfig(): (0x5a) RgConfig
07:30:25.009 InitBoard: MIPS frequency 1002100000
07:30:25.113 [00:00:00 01/01/1970] [tStartup] BcmBfcSystemFactory::NewBfcSystem:  BcmEpsSystem
07:30:25.119 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Loading BootloaderStore driver...
07:30:25.131  (GetProcConfig() & kRgConfig) 
07:30:25.134 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Loading NonVol driver...
07:30:25.144 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Storage drivers initialized successfully.
07:30:25.221 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions:  (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
07:30:25.235 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions:  (BFC Target) Device abstraction singletons created successfully.
07:30:25.248 
07:30:25.323 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.333 BcmCmVendorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.344 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.355 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.366 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.377 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.388 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.399 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.410 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.420 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.431 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.442 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.453 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.464 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.475 BcmCmDocsisNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.486 BcmEpsApplication::CreateAndRegisterNonVolSettings()
07:30:25.491 BcmCmVendorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.502 BcmCmVendorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
07:30:25.513 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.522 mtaNvCalcChecksum: checksum= 1273036263
07:30:25.526 Reading Permanent settings from non-vol...
07:30:25.530 Checksum for permanent settings:  0x6847e34d
07:30:25.534 Setting downstream calibration signature to '5.7.1mp3|die temperature:52.415degC^@^@^@^@^@|ext die temperature:60.100degC^@'
07:30:25.545 Setting downstream calibration signature to '5.7.1mp3|die temperature:52.415degC^@^@^@^@^@|ext die temperature:60.100degC^@'
07:30:25.555 Settings were read and verified.
07:30:25.558 
07:30:25.559 
07:30:25.559 Reading Dynamic settings from non-vol...
07:30:25.563 Checksum for dynamic settings:  0x76b2a154
07:30:25.566 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.576 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.586 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.596 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.606 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.616 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.626 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.636 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.646 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.656 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.666 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.676 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.686 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.696 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.706 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.716 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.726 BcmPcpClientServiceAppIf::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
07:30:25.736 Settings were read and verified.
07:30:25.739 
07:30:25.739 Console input has been disabled in non-vol.
07:30:25.743 Console output has been disabled in non-vol!  Goodbye...

UART2:

01:40:27.206 BCM338498 0002A080 AVSThresholds low: ro_h = 4814, ro_s = 6062
01:40:28.531 AVSThresholds high: ro_h = 4877, ro_s = 6128
01:40:28.543 memsysad800x16 2p5bld1
01:40:28.626 ^M
01:40:28.626 SHMOO VER 1.17^M
01:40:28.628 MCB^M
01:40:28.628 ^M
01:40:28.628 PKID 20131007  050B6000  050B0000  04B4103E  00001C00  ^M
01:40:28.633 ^M
01:40:28.633 S3000019B  ^M
01:40:28.634 00001010  ^M
01:40:28.636 +00000004  >00000101  ^M
01:40:28.638 t0000001F  0000003C  ^M
01:40:28.641 @000000B4  ^0000001A  ^M
01:40:28.645 ^M
01:40:28.645 RDEN W0 00000020  00000005  00000000  ^M
01:40:28.647 ^M
01:40:28.649 ^M
01:40:28.649 RDLY W0 00000003  ^M
01:40:28.652 ^M
01:40:28.654 RDQS W0 ^M
01:40:28.654 ^M
01:40:28.654     0000000000111111111122222222223333333333444444444455555555556666^M
01:40:28.660     0123456789012345678901234567890123456789012345678901234567890123^M
01:40:28.666  00 -----++++++++++++++++++++++X++++++++++++++++++++++--------------^M
01:40:28.673  01 ------++++++++++++++++++++++X+++++++++++++++++++++--------------^M
01:40:28.679  02 --------++++++++++++++++++++++X+++++++++++++++++++++------------^M
01:40:28.685  03 ------++++++++++++++++++++++X+++++++++++++++++++++--------------^M
01:40:28.692  04 --++++++++++++++++++++++X+++++++++++++++++++++------------------^M
01:40:28.698  05 ----+++++++++++++++++++++++X++++++++++++++++++++++--------------^M
01:40:28.704  06 ----+++++++++++++++++++++X+++++++++++++++++++++-----------------^M
01:40:28.711  07 --------++++++++++++++++++++++X+++++++++++++++++++++------------^M
01:40:28.717  08 -----+++++++++++++++++++++X++++++++++++++++++++-----------------^M
01:40:28.723  09 ---------+++++++++++++++++++X+++++++++++++++++++----------------^M
01:40:28.730  10 -------++++++++++++++++++++X++++++++++++++++++++----------------^M
01:40:28.736  11 --------++++++++++++++++++++X++++++++++++++++++++---------------^M
01:40:28.742  12 -----+++++++++++++++++++++X+++++++++++++++++++++----------------^M
01:40:28.748  13 ------+++++++++++++++++++++X++++++++++++++++++++----------------^M
01:40:28.755  14 --------++++++++++++++++++++X++++++++++++++++++++---------------^M
01:40:28.761  15 ------------++++++++++++++++++++X+++++++++++++++++++------------^M
01:40:28.767 ^M
01:40:28.769 ^M
01:40:28.770 P^@^@^@ W0 ^M
01:40:28.771 ^M
01:40:28.771     0000000000111111111122222222223333333333444444444455555555556666^M
01:40:28.777     0123456789012345678901234567890123456789012345678901234567890123^M
01:40:28.784  00 -----++++++++++++++++++++++X++++++++++++++++++++++--------------^M
01:40:28.790  01 ------++++++++++++++++++++++X+++++++++++++++++++++--------------^M
01:40:28.796  02 -------++++++++++++++++++++++X++++++++++++++++++++++------------^M
01:40:28.803  03 ------++++++++++++++++++++++X++++++++++++++++++++++-------------^M
01:40:28.809  04 --++++++++++++++++++++++X++++++++++++++++++++++-----------------^M
01:40:28.815  05 -----++++++++++++++++++++++X++++++++++++++++++++++--------------^M
01:40:28.822  06 ---++++++++++++++++++++++X+++++++++++++++++++++-----------------^M
01:40:28.828  07 --------++++++++++++++++++++++X+++++++++++++++++++++------------^M
01:40:28.835  08 -----++++++++++++++++++++++X+++++++++++++++++++++---------------^M
01:40:28.841  09 ----------++++++++++++++++++++X+++++++++++++++++++--------------^M
01:40:28.847  10 -------+++++++++++++++++++++X++++++++++++++++++++---------------^M
01:40:28.853  11 -------+-+++++++++++++++++++++X++++++++++++++++++++-------------^M
01:40:28.859  12 -----++++++++++++++++++++++X+++++++++++++++++++++---------------^M
01:40:28.866  13 ------+++++++++++++++++++++X+++++++++++++++++++++---------------^M
01:40:28.872  14 -------+++++++++++++++++++++X++++++++++++++++++++---------------^M
01:40:28.879  15 -------------++++++++++++++++++++X++++++++++++++++++++----------^M
01:40:28.885 ^M
01:40:28.887 ^M
01:40:28.887 N^@^@^@ W0 ^M
01:40:28.888 ^M
01:40:28.888     0000000000111111111122222222223333333333444444444455555555556666^M
01:40:28.895     0123456789012345678901234567890123456789012345678901234567890123^M
01:40:28.901  00 ---++++++++++++++++++++++++X+++++++++++++++++++++++-------------^M
01:40:28.907  01 --++++++++++++++++++++++++X+++++++++++++++++++++++--------------^M
01:40:28.915  02 -----++++++++++++++++++++++++X+++++++++++++++++++++++-----------^M
01:40:28.921  03 ---++++++++++++++++++++++++X+++++++++++++++++++++++-------------^M
01:40:28.926  04 +++++++++++++++++++++++X++++++++++++++++++++++------------------^M
01:40:28.932  05 --++++++++++++++++++++++++X+++++++++++++++++++++++--------------^M
01:40:28.940  06 --+++++++++++++++++++++++X++++++++++++++++++++++----------------^M
01:40:28.946  07 -----++++++++++++++++++++++++X+++++++++++++++++++++++-----------^M
01:40:28.951  08 -+++++++++++++++++++++++X++++++++++++++++++++++-----------------^M
01:40:28.958  09 -----+++++++++++++++++++++X+++++++++++++++++++++----------------^M
01:40:28.964  10 --+++++++++++++++++++++++X++++++++++++++++++++++----------------^M
01:40:28.970  11 ---+++++++++++++++++++++++X++++++++++++++++++++++---------------^M
01:40:28.978  12 --+++++++++++++++++++++++X++++++++++++++++++++++----------------^M
01:40:28.984  13 --+++++++++++++++++++++++X++++++++++++++++++++++----------------^M
01:40:28.989  14 ----+++++++++++++++++++++++X++++++++++++++++++++++--------------^M
01:40:28.996  15 --------++++++++++++++++++++++X+++++++++++++++++++++------------^M
01:40:29.002 ^M
01:40:29.004 ^M
01:40:29.005 WRDQ W0 ^M
01:40:29.005 ^M
01:40:29.005     0000000000111111111122222222223333333333444444444455555555556666^M
01:40:29.013     0123456789012345678901234567890123456789012345678901234567890123^M
01:40:29.018  00 ++++++++++++++++++++X+++++++++++++++++++---------+++++++++++++++^M
01:40:29.025  01 +++++++++++++++++++X+++++++++++++++++++----------+++++++++++++++^M
01:40:29.031  02 +++++++++++++++++++++X++++++++++++++++++++-------+++++++++++++++^M
01:40:29.038  03 ++++++++++++++++++++X+++++++++++++++++++---------+++++++++++++++^M
01:40:29.044  04 ++++++++++++++++++X+++++++++++++++++--------------++++++++++++++^M
01:40:29.050  05 +++++++++++++++++++X++++++++++++++++++-----------+++++++++++++++^M
01:40:29.056  06 ++++++++++++++++++X++++++++++++++++++------------+++++++++++++++^M
01:40:29.062  07 ++++++++++++++++++++X+++++++++++++++++++---------+++++++++++++++^M
01:40:29.069  08 ++++++++++++++++++++X+++++++++++++++++++-----------+++++++++++++^M
01:40:29.076  09 ++++++++++++++++++++X++++++++++++++++++++-----------++++++++++++^M
01:40:29.082  10 ++++++++++++++++++++X++++++++++++++++++++----------+++++++++++++^M
01:40:29.088  11 ++++++++++++++++++++X++++++++++++++++++++-----------++++++++++++^M
01:40:29.094  12 +++++++++++++++++++X+++++++++++++++++++----------+++++++++++++++^M
01:40:29.101  13 +++++++++++++++++++X+++++++++++++++++++-----------++++++++++++++^M
01:40:29.106  14 +++++++++++++++++++X+++++++++++++++++++-----------++++++++++++++^M
01:40:29.113  15 -++++++++++++++++++++X+++++++++++++++++++--------------+++++++++^M
01:40:29.119 ^M
01:40:29.119 ^M
01:40:29.120 WRDM W0 00000013  ^M
01:40:29.122 WRDM W0 00000013  ^M
01:40:29.123 ^M
01:40:29.140 ^M
01:40:29.141 ADDR ^M
01:40:29.142 ^M
01:40:29.142     0000000000111111111122222222223333333333444444444455555555556666^M
01:40:29.149     0123456789012345678901234567890123456789012345678901234567890123^M
01:40:29.154  00 ++++++++++++++++++++++++++++++SX++++++++++++++++++++++++++++++++^M
01:40:29.160 ^M
01:40:29.161 
01:40:29.161 Sync: 0 
01:40:29.191 Detected watchdog reset...
01:40:29.194 ^MMemSize:            256 M
01:40:29.199 ^MChip ID:     BCM3384ZU-B0
01:40:29.201 
01:40:29.201 ^MBootLoader Version: 2.5.0beta9 root spiboot dual-flash nandflash avs linux ssc newflashmap
01:40:29.209 ^MBootLoader Version ODM: 1.00.01
01:40:29.212 ^MBuild Date: May  3 2018
01:40:29.215 ^MBuild Time: 20:25:38
01:40:29.216 ^MSPI flash ID 0xc22014, size 1MB, block size 64KB, write buffer 256, flags 0x0
01:40:29.223 ^MStrapBus address b4e00194, value e3fd7ffe
01:40:29.227 ^MNAND flash: Device size 256 MB, Block size 128 KB, Page size 2048 B
01:40:29.233 ^MCust key size 128
01:40:29.236 ^MSuccessfully restored flash map from SPI flash!
01:40:29.240 
01:40:29.296 ^MSignature/PID: f004
01:40:29.297 
01:40:29.297 ^MNandFlashRead: Reading offset 0x4a80000, length 0x5c
01:40:29.302 
01:40:29.302 ^MFound image 1 at offset 4b80000
01:40:29.305 ^MNandFlashRead: Reading offset 0x5780000, length 0x5c
01:40:29.310 ^MNandFlashRead: Reading offset 0x6480000, length 0x5c
01:40:29.316 
01:40:29.316 ^MFound image 3 at offset 6580000
01:40:29.318 
01:40:29.318 ^MNandFlashRead: Reading offset 0x6480000, length 0x200
01:40:29.323 ^MNandFlashRead: Reading offset 0x6480200, length 0x16fe00
01:40:29.328 ^MNandFlashRead: 1 errors reading buffer at offset 64b1200
01:40:29.388 ^MNandFlashRead: 1 errors reading buffer at offset 64cf000
01:40:29.425 ^MNandFlashRead: 1 errors reading buffer at offset 64f9800
01:40:29.477 ^MNandFlashRead: 1 errors reading buffer at offset 6530800
01:40:29.543 ^MNandFlashRead: 1 errors reading buffer at offset 6551800
01:40:29.587 ^MNandFlashRead: 1 errors reading buffer at offset 656b800
01:40:29.617 ^MNandFlashRead: 1 errors reading buffer at offset 6578400
01:40:29.635 ^MNandFlashRead: 1 errors reading buffer at offset 6579400
01:40:29.642 ^MNandFlashRead: 1 errors reading buffer at offset 6591c00
01:40:29.673 ^MNandFlashRead: 1 errors reading buffer at offset 65c8600
01:40:29.738 ^MNandFlashRead: 1 errors reading buffer at offset 65d6a00
01:40:29.758 ^MPerforming CRC on Image 3...
01:40:29.790 ^MCRC time = 164975943
01:40:29.816 ^MDetected LZMA compressed image... decompressing... 
01:40:29.821 ^MTarget Address: 0x8E000000
01:40:29.823 ^MdecompressSpace is 0x8000000
01:40:29.826 ^MElapsed time 735682030
01:40:31.981 ^MDecompressed length: 6243088
01:40:31.982 ^MDone Copying Root File System...
01:40:31.985 
01:40:31.985 ^MNandFlashRead: Reading offset 0x4a80000, length 0x200
01:40:31.990 ^MNandFlashRead: Reading offset 0x4a80200, length 0x68a89f
01:40:31.994 ^MNandFlashRead: 1 errors reading buffer at offset 4abf200
01:40:32.069 ^MNandFlashRead: 1 errors reading buffer at offset 4ad9a00
01:40:32.103 ^MNandFlashRead: 1 errors reading buffer at offset 4af5200
01:40:32.138 ^MNandFlashRead: 1 errors reading buffer at offset 4b32c00
01:40:32.211 ^MNandFlashRead: 1 errors reading buffer at offset 4b34200
01:40:32.217 ^MNandFlashRead: 1 errors reading buffer at offset 4b41200
01:40:32.236 ^MNandFlashRead: 1 errors reading buffer at offset 4bc1600
01:40:32.383 ^MNandFlashRead: 1 errors reading buffer at offset 4bf9000
01:40:32.450 ^MNandFlashRead: 1 errors reading buffer at offset 4bfe000
01:40:32.460 ^MNandFlashRead: 1 errors reading buffer at offset 4bfe200
01:40:32.466 ^MNandFlashRead: 1 errors reading buffer at offset 4c34e00
01:40:32.530 ^MNandFlashRead: 1 errors reading buffer at offset 4c4be00
01:40:32.561 ^MNandFlashRead: 1 errors reading buffer at offset 4c51a00
01:40:32.571 ^MNandFlashRead: 1 errors reading buffer at offset 4c5d600
01:40:32.588 ^MNandFlashRead: 1 errors reading buffer at offset 4c66800
01:40:32.603 ^MNandFlashRead: 1 errors reading buffer at offset 4c97600
01:40:32.664 ^MNandFlashRead: 1 errors reading buffer at offset 4cc4400
01:40:32.716 ^MNandFlashRead: 1 errors reading buffer at offset 4cc5200
01:40:32.722 ^MNandFlashRead: 1 errors reading buffer at offset 4cf8c00
01:40:32.785 ^MNandFlashRead: 1 errors reading buffer at offset 4d51600
01:40:32.887 ^MNandFlashRead: 1 errors reading buffer at offset 4d58200
01:40:32.899 ^MNandFlashRead: 1 errors reading buffer at offset 4da5a00
01:40:32.991 ^MNandFlashRead: 1 errors reading buffer at offset 4dc4000
01:40:33.030 ^MNandFlashRead: 1 errors reading buffer at offset 4ddd000
01:40:33.063 ^MNandFlashRead: 1 errors reading buffer at offset 4e0a400
01:40:33.115 ^MNandFlashRead: 1 errors reading buffer at offset 4e12600
01:40:33.128 ^MNandFlashRead: 1 errors reading buffer at offset 4e30a00
01:40:33.168 ^MNandFlashRead: 1 errors reading buffer at offset 4e3d000
01:40:33.185 ^MNandFlashRead: 1 errors reading buffer at offset 4e3f800
01:40:33.192 ^MNandFlashRead: 1 errors reading buffer at offset 4e44800
01:40:33.202 ^MNandFlashRead: 1 errors reading buffer at offset 4e45a00
01:40:33.208 ^MNandFlashRead: 1 errors reading buffer at offset 4e7a200
01:40:33.272 ^MNandFlashRead: 1 errors reading buffer at offset 4e8a800
01:40:33.293 ^MNandFlashRead: 1 errors reading buffer at offset 4e8b600
01:40:33.299 ^MNandFlashRead: 1 errors reading buffer at offset 4ea7800
01:40:33.335 ^MNandFlashRead: 1 errors reading buffer at offset 4eeb800
01:40:33.416 ^MNandFlashRead: 1 errors reading buffer at offset 4ef3800
01:40:33.428 ^MNandFlashRead: 1 errors reading buffer at offset 4f0f200
01:40:33.464 ^MNandFlashRead: 1 errors reading buffer at offset 4f0fc00
01:40:33.469 ^MNandFlashRead: 1 errors reading buffer at offset 4f39000
01:40:33.521 ^MNandFlashRead: 1 errors reading buffer at offset 4f53200
01:40:33.552 ^MNandFlashRead: 1 errors reading buffer at offset 4f59a00
01:40:33.564 ^MNandFlashRead: 1 errors reading buffer at offset 4fc2e00
01:40:33.688 ^MNandFlashRead: 1 errors reading buffer at offset 4fca000
01:40:33.698 ^MNandFlashRead: 1 errors reading buffer at offset 4fe9600
01:40:33.738 ^MNandFlashRead: 1 errors reading buffer at offset 4fea800
01:40:33.743 ^MNandFlashRead: 1 errors reading buffer at offset 5081800
01:40:33.918 ^MNandFlashRead: 1 errors reading buffer at offset 5093000
01:40:33.940 ^MNandFlashRead: 1 errors reading buffer at offset 50a8400
01:40:33.968 ^MNandFlashRead: 1 errors reading buffer at offset 50ccc00
01:40:34.013 ^MNandFlashRead: 1 errors reading buffer at offset 5104c00
01:40:34.082 ^MPerforming CRC on Image 1...
01:40:34.088 ^MCRC time = 337869119
01:40:34.621 ^MDetected LZMA compressed image... decompressing... 
01:40:34.626 ^MTarget Address: 0x80004000
01:40:34.629 ^MdecompressSpace is 0x8000000
01:40:34.631 ^MElapsed time 190887360
01:40:44.288 ^MDecompressed length: 36178596
01:40:44.288 ^MCopying partition table to 0x83fffc04 280
01:40:44.293 ^MCopying partition table to 0x80000904 280
01:40:44.296 
01:40:44.296 ^MExecuting Image 1...
01:40:44.298 
01:40:44.298 
01:40:44.298 ^MSetting number of flash partitions to 14
01:40:44.302 ^MCreating dummy boot nonvol...
01:40:44.303 ^M eCos - hal_diag_init
01:40:44.637 Ecos memory map:
01:40:44.637 BLOCK    OWNER        MIPS      SIZE      MEM
01:40:44.640 Block 0: Owner: 0 - 0x00000000 0x06000000 0x00000000
01:40:44.644 Block 0: Owner: 0 - 0 MB 96 MB 0 MB
01:40:44.647 Block 1: Owner: 4 - 0x06000000 0x02000000 0x06000000
01:40:44.653 Block 1: Owner: 4 - 96 MB 32 MB 96 MB
01:40:44.655 Block 2: Owner: 2 - 0x00000000 0x06000000 0x08000000
01:40:44.661 Block 2: Owner: 2 - 0 MB 96 MB 128 MB
01:40:44.664 Block 3: Owner: 4 - 0x06000000 0x02000000 0x0e000000
01:40:44.668 Block 3: Owner: 4 - 96 MB 32 MB 224 MB
01:40:44.672 96MB (98304KB) remaining for eCos
01:40:44.675 BcmHeapInitialize starts
01:40:44.677 Init device '/dev/BrcmTelnetIoDriver'
01:40:44.681 Init device '/dev/ttydiag'
01:40:44.684 Init tty channel: 82284340
01:40:44.686 Init device '/dev/tty0'
01:40:44.688 Init tty channel: 82284360
01:40:44.691 Init device '/dev/haldiag'
01:40:44.693 HAL/diag SERIAL init
01:40:44.695 Init device '/dev/ser0'
01:40:44.697 BCM 33XX SERIAL init - dev: b4e00500.1
01:40:44.701 Set output buffer - buf: 0x82453918 len: 4096
01:40:44.705 Set input buffer - buf: 0x82454918 len: 4096
01:40:44.709 BCM 33XX SERIAL config
01:40:44.711 ^MInit device '/dev/ser1'
01:40:44.713 BCM 33XX SERIAL init - dev: b4e00520.2
01:40:44.717 Set output buffer - buf: 0x82455918 len: 4096
01:40:44.721 Set input buffer - buf: 0x82456918 len: 4096
01:40:44.725 BCM 33XX SERIAL config
01:40:44.727 
01:40:44.728 Init device '/dev/ser2'
01:40:44.731 SetProConfig(): (0xa0) DocsisConfig
01:40:44.764 InitBoard: MIPS frequency 637500000
01:40:44.767 InitBoard: Switching APM Clock to SYSPLL.
01:40:44.774 ApmClockSelect ClockSource = 0
01:40:44.973 Clock select completed successfully!
01:40:44.994 InitBoard: Setting LCPLL to 2.6GHz.
01:40:45.257 InitBoard: Updated LC PLL Lock status: OK
01:40:45.530 [00:00:00 01/01/1970] [tStartup] BcmBfcSystemFactory::NewBfcSystem:  BcmEmtaCmDocsisSystem
01:40:45.536 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Configuring/Loading Flash driver...
01:40:45.548 [00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash:  (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xc22014
01:40:45.561 Waited 3 iterations after device ID read
01:40:45.564 NAND flash: Device size 256 MB, Block size 128 KB, Page size 2048 B
01:40:45.571 [00:00:00 01/01/1970] [tStartup] BcmNandFlashDevice::DetectNandFlash:  (NAND Flash Device Factory) WARNING - Detected NAND flash with JEDEC ID =0x2cda9095
01:40:45.584 Found bootloader flash map at 0x80000904.
01:40:45.588 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:  (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
01:40:45.603 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:  (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
01:40:45.619 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:  (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
01:40:45.634 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:  (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
01:40:45.682 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:  (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
01:40:45.707 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:  (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
01:40:45.732 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Loading BootloaderStore driver...
01:40:45.761 flashSize:0x100
01:40:45.762 image1Partition:0xd0
01:40:45.764 image1Size:0x4b8
01:40:45.766 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Loading ProgramStore driver...
01:40:45.777 ProgramStoreDeviceDriver::ProgramStoreDriverInit:  INFO - Initializing...
01:40:45.784 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Loading NonVol driver...
01:40:45.795 NonVolDevice Driver::NonVolDriverInit:  Running on Viper and supporting split mode operations...
01:40:45.803 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:  (BFC Target) Storage drivers initialized successfully.
01:40:45.865 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions:  (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
01:40:45.880 Detecting the next image number that we will store to by default...
01:40:45.886 Bootloader indicates we are running image 1
01:40:45.890 By default, we will dload to image number 2!
01:40:45.894 
01:40:45.894 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions:  (BFC Target) Device abstraction singletons created successfully.
01:40:45.908 
01:40:45.978 BcmeRouterMsgPipe::GetSingletonInstance:  WARNING - the singleton is NULL, and someone is accessing it!
01:40:45.987 AVS Thread Constructor....
01:40:45.991 PMC AVS Thread Constructor....
01:40:45.993 LoadPMCCode:
01:40:45.995     codesize  = 11040
01:40:45.996     allocated = 32768
01:40:45.998     buffAddr  = 0x85f17f84
01:40:46.001     alignMask = 0xffffc000
01:40:46.003     codeAddr  = 0x85f18000
01:40:46.006 PMC AVS Thread:: Releasing B0 run-time code...
01:40:46.010     waiting on pmc to accept or reject image
01:40:46.014     PMC indicates run_state = 7 (Running)
01:40:46.018     AVS is enabled (state = 0)
01:40:46.021 Scratch register = 0x1020000
01:40:46.023 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.034 BcmCmVendorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.045 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.056 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.067 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.078 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.089 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.100 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.111 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.122 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.133 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.143 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.154 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.166 CbtCompositeNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.176 BcmCmDocsisNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.187 [00:00:00 01/01/1970] [tStartup] BcmCmBpiNonVolSettings::BcmCmBpiNonVolSettings:  (Euro-Docsis CM BPI NonVol Settings) WARNING - Singleton pointer is not NULL!  There are multiple instances!  Leaving the singleton pointer alone...
01:40:46.208 BcmCmVendorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.218 
01:40:46.219 ChipId = 33840098
01:40:46.220 Error reading from 31xx: NO ACK
01:40:46.223 **>Probed external QAMLink Chip with I2C(0x68) return 0xdead012c
01:40:46.229 Error reading from 31xx: NO ACK
01:40:46.232 **>Probed external QAMLink Chip with I2C(0x69) return 0xdead012c
01:40:46.238 Error reading from 31xx: NO ACK
01:40:46.241 **>Probed external QAMLink Chip with I2C(0x6a) return 0xdead012c
01:40:46.247 Error reading from 31xx: NO ACK
01:40:46.250 **>Probed external QAMLink Chip with I2C(0x6b) return 0xdead012c
01:40:46.257 ************************************************************************
01:40:46.262 *    Detecting external QAMLink Chip with I2C(0x6c) return 0x31280200  *
01:40:46.269 ************************************************************************
01:40:46.275 **External Bcm3128C0 Present @I2C(0x6c)**
01:40:46.279 **Total DS channels is now 24, Ext Channel start from ch number 16
01:40:46.286 
01:40:46.286 BcmCmVendorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
01:40:46.296 mtaNvCalcChecksum: checksum= 1273036263
01:40:46.300 Reading Permanent settings from non-vol...
01:40:46.304 Checksum for permanent settings:  0x6847e34d
01:40:46.308 Setting downstream calibration signature to '5.7.1mp3|die temperature:52.415degC^@^@^@^@^@|ext die temperature:60.100degC^@'
01:40:46.318 Setting downstream calibration signature to '5.7.1mp3|die temperature:52.415degC^@^@^@^@^@|ext die temperature:60.100degC^@'
01:40:46.329 Setting downstream calibration signature to '5.7.1mp3|die temperature:52.415degC^@^@^@^@^@|ext die temperature:60.100degC^@'
01:40:46.340 Settings were read and verified.
01:40:46.343 
01:40:46.343 
01:40:46.343 Reading Dynamic settings from non-vol...
01:40:46.347 Checksum for dynamic settings:  0xab486406
01:40:46.351 [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom:  (BFC App Composite Nonvol Settings) WARNING - Read an unrecognized settings group from the buffer (magic number 0x73656375 'secu'); storing in raw form for compatibility...
01:40:46.373 Settings were read and verified.
01:40:46.376 
01:40:46.376 Console input has been disabled in non-vol.
01:40:46.380 Console output has been disabled in non-vol!  Goodbye...
01:40:46.387 [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent:  (Reset/Standby Switch Thread) Reset switch released; resetting...
01:40:46.401 [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent:  (Reset/Standby Switch Thread) Cant Reset pfCmDocsisCtlThread==NULL...

[MightyFilipns]

The device could also be affected by the Cable Haunt vulnerability.

While my device is on the list of vulnerable devices, I haven't been able to exploit the vulnerability, so it appears to be patched.

[MightyFilipns]

Removing the coax cable, resetting to factory default and disabling all settings in the firewall section in the web interface enables an SNMP interface on 192.168.100.1.
But I haven't been able to do much with it.
No telnet access. Trying 192.168.0.1 or 192.168.100.1 gives Connection Refused.
Trying to enable the serial console using SNMP gives this

$ snmpset -v2c -c private 192.168.100.1 1.3.6.1.4.1.4413.2.2.2.1.9.1.2.1.0 i 0
Error in packet.
Reason: noAccess
Failed object: SNMPv2-SMI::enterprises.4413.2.2.2.1.9.1.2.1.0


$  snmpset -v1 -c private 192.168.100.1 1.3.6.1.4.1.4413.2.2.2.1.9.1.2.1.0 i 0
Error in packet.
Reason: (noSuchName) There is no such variable name in this MIB.
Failed object: SNMPv2-SMI::enterprises.4413.2.2.2.1.9.1.2.1.0

Is there another way to enable the serial console using SNMP?
Can telnet be enabled using SNMP?

[boskostan]

@jclehner

There is an older version of the firmware at https://github.com/waszi/docsistftp/blob/master/tftpboot/firmware/CGA2121-1.0/CGA2121E-ES-13-E1332-c7410r5713-180213.p7b. I stripped out the certificates part, extracted it with ProgramStore, loaded it into Ghidra and reverse engineered the following:

The AES-256 encryption key of GatewaySettings.bin is a SHA-256 hash of the CM MAC in its colon convention (XX:XX:XX:XX:XX:XX). The checksum salt is 2Pslc;u(egmd0-'x (bytes 3250736c633b752865676d64302d2778, i.e. the generic salt).

I verified this and decrypted with my own (Go) code, as I couldn't get the bcm2cfg -k <key> decrypt <input> <output> to work (it would output the same file without decryption). After decrypting, bcm2cfg read it nicely and I was able to change the userif.telnet_ipstacks and userif.remote_acc_methods. Then I encrypted the file back with my own code, taking into account the needed adjustments to the checksum and size header. After loading it in device UI, it gave me telnet access.

su password is brcm

However, the commands (in both regular and su mode) don't have read_memory (or write) or any variation of it. There's no call either for call func. Firmware also doesn't reference them anywhere so it's not like it's hidden. So unless there is some other method I'm not aware of, this will not be of any use to bcm2dump.

@MightyFilipns even if the Cable Haunt wasn't patched, you would have no use of the public exploit as the ROP chain used is specific to a device and firmware they used in their research, as it needs exact addresses of gadgets as well as function addresses for socket, connect, recv, etc. So you would need access to firmware anyhow.

[MightyFilipns]

@boskostan, can you please share your code for decrypting the GatewaySettings.bin?

[boskostan]

cgacfg.zip

Sure @MightyFilipns , Go code is attached, I refactored it to be a bit more user friendly.

Example usage for decrypt:

go run cgacfg.go -d -mac 58:96:30:3e:4c:cc -i GatewaySettings.bin -o GatewaySettings_decrypted.bin

Then you can do:

bcm2cfg -P generic set GatewaySettings_decrypted.bin userif.remote_acc_methods telnet
bcm2cfg -P generic set GatewaySettings_decrypted.bin userif.telnet_ipstacks IP2

Encrypt:

go run cgacfg.go -e -mac 58:96:30:3e:4c:cc -i GatewaySettings_decrypted.bin -o GatewaySettings_encrypted.bin

Make sure that you take your CM MAC exactly as it is shown in http://192.168.0.1/st_gateway.html. Don't capitalize the characters.

And you'll have telnet on 192.168.100.1. You can also set the remote_acc_user and remote_acc_pass, but as you are from Serbia same as me, you'll most likely have the standard SBB provisioned ones already, you'll see what they are when you read the config ;). You have my email in the code for any further questions related to my code in order not to create noise in this thread.

[MightyFilipns]

I have tinkered with telnet, most of the commands are read-only; you can't change much, even in su.
I have also managed to enable SSH. But it leads to the same console. It looks like SSH is disabled when connecting to the ISP. Getting SSH to work was quite difficult. As it required me to enable DH-SHA1 as KexAlgorithm, 3DES-CBC as cypher suite and SSH-DSS as host key algorithm. SSH-DSS was problematic because support for it was dropped in OpenSSH 9.8, so I had to downgrade it.

[MightyFilipns]

After reversing the old firmware, I found a single string referencing the read_memory command, indicating that the commands were once present but intentionally removed. Some commands present on this old firmware aren't on the router itself. One of those commands is 'snmp_set'. Which I wanted to use to enable the Serial Console.

Also, in the CM console, in the SNMP command subtable, snmp debug logs can be enabled with debug 9.
When enabled, we can see that the SNMP requests sent to 192.168.100.1 are processed, been tho no Response is sent to the client. But they just fail either with
error 105, no Access or error 104, no Access.

It looks like 104 means the community string is bad.
105 means the community string is correct, but the request isn't from the ISP. My ISP occasionally queries SNMP, so I have been able to see the community string they used in the logs. While their request goes through with NO_ERROR, when I use the same community string, I get error 105, no Access. Meaning the router somehow differentiates requests between the ISP and me.

[boskostan]

@MightyFilipns Not sure what you're trying to achieve with the serial console access if you're going to end up in the same console as the telnet one, but the ISP provisioning has the docsDevNmAccessIp IPs that are allowed to make the SNMP requests for three different community strings that you might have seen there. They are specific to our ISP. If you're doing some sort of research contact me and I'll share the information. I feel if it's not about improving bcm2utils this thread might not be the appropriate place for a discussion.

I'll read the latest firmware (for SBB) off NAND in a couple of days from now.

[MightyFilipns]

@boskostan I wanted to achieve SNMP access in the hope of enabling the physical serial console, hoping it would be a Linux root shell. I've given up on that as it looks like it won't happen. Currently, I am trying to exploit the FTP client functionality in the telnet console to get the router to upload the firmware files.
Also, how are you planning on dumping the NAND chip? Are you desodering it?
I wanted to dump the NOR chip in the centre of the board because I suspected it contains the bootloader. So I could figure out how to unlock it.

[boskostan]

@MightyFilipns there's no Linux shell for RG and CM, this is running on eCos RTOS. The only Linux there might be a media server, on a separate processor.

Yes, I plan on desoldering NAND. I already desoldered and dumped NOR if you need the bootloader. However, you will need to patch non-vol settings to enable console access and flash it, so you might as well read your own.

[MightyFilipns]

@boskostan It is possible to flash the NOR chip without desoldering it, or will as soon as I connect the Vcc and GND pins on the chip the whole board be powered? I wanted to at least read the NOR flash by using a logic analyser to intercept the SPI traffic and extract the bootloader.

[boskostan]

For me, with CH341A and a SPI clip it powered the board. Buy an extra device on KupujemProdajem in case you brick something :)