====== Technicolor TD5137 ====== {{description>Informações sobre o Technicolor TD5137 xDSL modem/router. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}} ===== Disclaimer ===== Modifique o dispositivo **somente** se for o proprietário. A maioria destes são fornecidos pelo seu ISP em regime de comodato como parte do serviço de internet. **Não** faça modificações caso o aparelho não seja seu. Todos os métodos de desbloqueio e material sobre modificações foram criados pelo O3 Labs e disponibilizados **GRATUITAMENTE** desde o dia de sua elaboração. Espalhem esta informação e ajudem a evitar que **PICARETAS** roubem e vendam estas informações por aí, seja no Mercado Livre ou por quaisquer outros meios. ===== Hardware ===== Clique na foto para abrir o álbum. [[https://goo.gl/photos/44rNNxYokmX6mHjWA |{{ https://www.tripleoxygen.net/files/devices/technicolor/td5137/cover.jpg }}]] ^ SoC | Realtek RTL8676S ( MIPS, 450 MHz? ) | ^ RAM | 32 MB (embutida no SoC) | ^ Flash | Macronix MX25L12835F - 128 Mbit (16 MB) | ^ Switch | 4 ports 10/100 - Integrado ao SoC | ^ USB | Não | ^ Wireless | Realtek RTL8192ER 2x2 802.11b/g/n / 2.4 GHz | ^ FXS | Não | ^ xDSL Line Driver | Realtek RTL8271B | ^ HPNA | Não | ^ Serial | Sim | ^ JTAG | ? | ===== Bootlog ===== Start to decompress! success! MitraStar RTL Platform BootLoader (jeff@sw1-tclinux) DRAM Size: 256 Mb Flash ID: 00C2:0020, Size: 128 Mb Version 01.19.01 | Nov 23 2015 15:44:02 Press 'ESC' to stop autoboot: 0 Wait receive MultiBoot packet... 0 Decompress file at 0xbd030080... SQUASHFSv4 ok! Linux version 2.6.30.9-svn10809 (jimchen@sw15-server) (gcc version 4.4.7 (Realtek RSDK-1.5.8p1 Build 1050) ) #278 Fri Nov 25 15:20:38 CST 2016 CPU revision is: 0000dc01 Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 mem=32M root=31:3 ro root_dev_setup line 184 root: 31:3 icache: 16kB/32B, dcache: 8kB/32B, scache: 0kB/0B NR_IRQS:128 PID hash table entries: 128 (order: 7, 512 bytes) Timer: Div=2, Data=1000000 console [ttyS0] enabled Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Memory: 23028k/32768k available (3936k kernel code, 9740k reserved, 1209k data, 124k init, 0k highmem) Calibrating delay loop... 448.92 BogoMIPS (lpj=2244608) Mount-cache hash table entries: 512 IMEM section size = 0xb754 net_namespace: 788 bytes NET: Registered protocol family 16 bio: create slab at 0 SCSI subsystem initialized Sangoma WANPIPE Router v1.1 (c) 1995-2000 Sangoma Technologies Inc. NET: Registered protocol family 8 NET: Registered protocol family 20 NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 Realtek GPIO Driver for Flash Reload Default netlog: listening on port 4660 squashfs: version 4.0 (2009/01/31) Phillip Lougher fuse init (API version 7.11) msgmni has been set to 44 alg: No test for stdrng (krng) io scheduler noop registered io scheduler deadline registered io scheduler cfq registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250: ttyS0 at MMIO 0x0 (irq = 13) is a 16550A Driver 'sd' needs updating - please use bus_type methods PPP generic driver version 2.4.2 NET: Registered protocol family 24 IMQ driver loaded successfully. Hooking IMQ after NAT on PREROUTING. Hooking IMQ before NAT on POSTROUTING. tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky Realtek WLAN driver - version 3.3 (2016-03-01)(SVN:11078) Adaptivity function - version 9.1 wlan0 (): not using net_device_ops yet ####################################################### SKB_BUF_SIZE=2408 MAX_SKB_NUM=256 ####################################################### wlan0-vap0 (): not using net_device_ops yet wlan0-vap1 (): not using net_device_ops yet wlan0-vap2 (): not using net_device_ops yet wlan0-vap3 (): not using net_device_ops yet pwlan0 (): not using net_device_ops yet Probing RTL8186 10/100 NIC-kenel stack size order[2]... chip name: 8196B, chip revid: 0 NOT YET Set threshould idx 0 Set threshould idx 1 eth0.2 (): not using net_device_ops yet eth0.2 added. vid=9 Member port 0x1... eth0.3 (): not using net_device_ops yet eth0.3 added. vid=9 Member port 0x2... eth0.4 (): not using net_device_ops yet eth0.4 added. vid=9 Member port 0x4... eth0.5 (): not using net_device_ops yet eth0.5 added. vid=9 Member port 0x8... flash device: 0x800000 at 0xbd000000 spi probe... ================================= luna SPI FLASH driver version 0.6 ================================= SFCR:0xb8001200 SFCSR:0xb8001208 SFDR:0xb800120c can not get SPI chip driver! MXIC matched!! i:1 DeviceSize:0x1000000 get SPI chip driver! Physically mapped flash: Found an alies 0x1000000 for the chip at 0x0, mxic device detect. Creating 10 MTD partitions on "Physically mapped flash": 0x000000000000-0x000000010000 : "boot" 0x000000010000-0x000000020000 : "config_hw" 0x000000020000-0x000000030000 : "config_cur" mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only 0x000000030080-0x00000055fc8d : "rootfs" mtd: partition "backupfs" extends beyond the end of device "Physically mapped flash" -- size truncated to 0x80ff80 mtd: partition "backupfs" doesn't start on an erase block boundary -- force read-only 0x0000007f0080-0x000001000000 : "backupfs" 0x000000030000-0x0000007f0000 : "image1" 0x0000007f0000-0x000000fb0000 : "image2" 0x000000fb0000-0x000000fd0000 : "config_bak" 0x000000fe0000-0x000000ff0000 : "cert" 0x000000ff0000-0x000001000000 : "temp" Mirror/redirect action on u32 classifier Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (512 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. ctnetlink v0.93: registering with nfnetlink. nf_conntrack_ipsec loaded NF_TPROXY: Transparent proxy support initialized, version 4.1.0 NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. xt_time: kernel timezone is -0000 nf_nat_rtsp v0.6.21 loading ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered Realtek SD2-FastPath v1.00beta_2.4.26-uc0 /proc/FastPath created /proc/FastPath_heavy_traffic_thres created Realtek MCast FastPath /proc/mc_FastPath created NET: Registered protocol family 10 lo: Disabled Privacy Extensions ip6_tables: (C) 2000-2006 Netfilter Core Team Realtek SD5-FastPath Realtek Ipv6FastPath-betaV0.01 /proc/Ip6FastPath created Realtek IPv6 MCast FastPath /proc/ip6mc_FastPath created IPv6 over IPv4 tunneling driver sit0: Disabled Privacy Extensions ip6tnl0: Disabled Privacy Extensions NET: Registered protocol family 17 br_initMldSnooping-1206:: mldSnoopEnabled:0 Bridge firewalling registered br_init-1432: init multicast snooping igmpInitFlag:0 Ebtables v2.0 registered ATM OAM F5 initialized. ATM OAM F4 initialized. Enable 8671G 1 function Enable 8671 0 function Enable 8672 function ratm: RTL8670 SAR v0.0.2 (Jun 17, 2003) /proc/AUTO_PVC_SEARCH created VFS: Mounted root (squashfs filesystem) readonly on device 31:3. Freeing unused kernel memory: 124k freed CS_BANK ok! (minsize=6699, varsize=17572) HS_BANK ok! (minsize=357, varsize=0) login: set_msgqueue_max_size:227> set msgqidds.msg_qbytes=24720 OK set_msgqueue_max_size:227> set msgqidds.msg_qbytes=24720 OK MIB chain descriptors checking (total 43) ok ! Check system parameters Update system parameters ..PVC Number = 2. Set Desc number per VC = 96 ========== Initiating Starting Script ============= sh: can't open /var/config/start_script ========== End Initiating Starting Script ============= set_msgqueue_max_size:227> set msgqidds.msg_qbytes=24720 OK error cmd device wlan0-vap0 entered promiscuous mode device eth0.2 entered promiscuous mode device eth0.3 entered promiscuous mode device eth0.4 entered promiscuous mode device eth0.5 entered promiscuous mode cp -f /var/tmp_radvd.conf /var/radvd.conf echo 0 > /proc/sys/net/ipv6/conf/br0/disable_nud echo 1 > /proc/sys/net/ipv6/conf/br0/disable_rs Monitord is running ... Monitord: Reset button event fixme atm_find_ci in sar_open! ratm(itf 0): open 0.16 echo '279' > /proc/monitordPid sh: can't create /proc/monitordPid: nonexistent directory [Debug] mssvaluestring:1452:1536 [Debug] buffer:1452 /var/config/mini_httpd.pem exist! /bin/ip6tables -A INPUT -p icmpv6 --icmpv6-type 130 -j ACCEPT /bin/ip6tables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu /bin/ip6tables -A FORWARD -d FF00::0/8 -j ACCEPT startup:debug:startConnection:5925:Enter item=1 fixme atm_find_ci in sar_open! ratm(itf 0): open 0.35 SarRecalPerVCNumber(3408): cnt=0, off=1 create: ch0 (0/35) 6000,0 sar_close ATM OAM F5 initialized. ATM OAM F4 initialized. Enable 8671G 1 function Enable 8671 0 function Enable 8672 function create: ch0 (0/35) 6000,0 applying workaround...done mpoactl set vc0 fgroup 65534 mpoactl set vc0 fgroup 65534 mpoactl set vc0 fgroup 65534 mpoactl set vc0 fgroup 65534 mpoactl set vc0 fgroup 65534 mpoactl set vc0 fgroup 65534 mpoactl set vc0 fgroup 65534 mpoactl set vc0 fgroup 0 mpoactl set vc0 fgroup 0 mpoactl set vc0 fgroup 0 mpoactl set vc0 fgroup 0 WAN MAC for vc0 [480033c30e8e] ADDRCONF(NETDEV_UP): vc0: link is not ready PPPoE pEntry->unnumberMode:0 PPP Connection (Continuous)... data: spppctl add 0 pppoe vc0 username xxxxxxxxxx@oivelox password xxxxxxxxxx gw 1 mru 1492 ippt 0 debug 0 ipt 0 ARP proxy is Disable add_ppp, unit = 0. create unit 0 data: spppctl katimer 10 echo 0 > /proc/sys/net/ipv6/conf/ppp0/disable_nud echo 0 > /proc/sys/net/ipv6/conf/ppp0/disable_rs startup:debug:startConnection:5925:Enter item=1 fixme atm_find_ci in sar_open! ratm(itf 0): open 0.42 SarRecalPerVCNumber(3408): cnt=1, off=1 create: ch1 (0/42) 6000,0 sar_close sar_close ATM OAM F5 initialized. ATM OAM F4 initialized. Enable 8671G 1 function Enable 8671 0 function Enable 8672 function create: ch0 (0/35) 6000,0 create: ch1 (0/42) 6000,0 applying workaround...done mpoactl set vc1 fgroup 65534 WAN MAC for vc1 [480033c30e8f] ADDRCONF(NETDEV_UP): vc1: link is not ready PPPoE pEntry->unnumberMode:0 PPP Connection (Manual)... data: spppctl new 1 pppoe vc1 username xxxxxxxxxx@oiwififon password xxxxxxxxxx gw 0 mru 1492 ippt 0 debug 0 ipt 2 disctime 30 ARP proxy is Disable echo 0 > /proc/sys/net/ipv6/conf/ppp1/disable_nud echo 0 > /proc/sys/net/ipv6/conf/ppp1/disable_rs start rip! /bin/ip6tables -F FW_GENERAL_INPUT_Technicolor /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor -i lo -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor -i br+ -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor -p udp --dport 520 -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p icmpv6 --icmpv6-type neighbor-solicitation -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p icmpv6 --icmpv6-type neighbor-advertisement -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p icmpv6 --icmpv6-type router-solicitation -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p icmpv6 --icmpv6-type router-advertisement -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p icmpv6 --icmpv6-type redirect -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p tcp --dport 546 -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p udp --dport 546 -j ACCEPT /bin/ip6tables -A FW_GENERAL_INPUT_Technicolor ! -i br+ -p udp --dport 547 -j ACCEPT /bin/iptables -F FW_GENERAL_FORWARD_Technicolor startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 iptables -A FW_GENERAL_FORWARD_Technicolor! -i br+! -o br+ -j RETURN Warning: weird character in interface `br+!' (No aliases, :, ! or *). iptables v1.4.3: chain name `FW_GENERAL_FORWARD_Technicolor!' too long (must be under 30 chars) Try `iptables -h' or 'iptables --help' for more information. /bin/ip6tables -F FW_GENERAL_FORWARD_Technicolor startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 /bin/iptables -F DEFAULT_INPUT_Technicolor /bin/iptables -F DEFAULT_FORWARD_Technicolor /bin/iptables -F DEFAULT_OUTPUT_Technicolor startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 /bin/iptables -A DEFAULT_INPUT_Technicolor -m state --state ESTABLISHED,RELATED -j ACCEPT /bin/iptables -A DEFAULT_FORWARD_Technicolor ! -i br+ -m state --state ESTABLISHED,RELATED -j ACCEPT /bin/ip6tables -F DEFAULT_INPUT_Technicolor /bin/ip6tables -F DEFAULT_FORWARD_Technicolor /bin/ip6tables -F DEFAULT_OUTPUT_Technicolor startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 /bin/ip6tables -A DEFAULT_INPUT_Technicolor -m state --state ESTABLISHED,RELATED -j ACCEPT /bin/ip6tables -A DEFAULT_FORWARD_Technicolor ! -i br+ -m state --state ESTABLISHED,RELATED -j ACCEPT ip6tables -A REMOTEMGMT_Technicolor ! -i br+ -p tcp --dport 23 -j DROP ip6tables -A REMOTEMGMT_Technicolor ! -i br+ -p udp --dport 23 -j DROP ip6tables -A REMOTEMGMT_Technicolor ! -i br+ -p tcp --dport 80 -j DROP ip6tables -A REMOTEMGMT_Technicolor ! -i br+ -p tcp --dport 443 -j DROP ip6tables -A REMOTEMGMT_Technicolor ! -i br+ -p udp --dport 22 -j DROP ip6tables -A REMOTEMGMT_Technicolor ! -i br+ -p tcp --dport 22 -j DROP /bin/iptables -F IP_FILTER_INPUT_Technicolor /bin/iptables -F IP_FILTER_FORWARD_Technicolor /bin/iptables -F IP_FILTER_OUTPUT_Technicolor /bin/ip6tables -F IP_FILTER_INPUT_Technicolor /bin/ip6tables -F IP_FILTER_FORWARD_Technicolor /bin/ip6tables -F IP_FILTER_OUTPUT_Technicolor startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 startup:debug:doDoSProtect:12136:Setting synflood rules... startup:debug:doDoSProtect:12143:Setting ip spoofing rules... startup:debug:doDoSProtect:12150:Setting land attack rules... startup:debug:doDoSProtect:12157:Setting land attack rules... startup:debug:doDoSProtect:12183:Setting port scan rules... startup:debug:doDoSProtect:12190:Setting furtive port scan rules... startup:debug:doDoSProtect:12197:Setting ping broadcast rules... startup:debug:doDoSProtect:12208:Setting icmp redirect attack rules... startup:debug:doDoSProtect:12221:Setting ping of death rules... startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 startup:debug:getGeneralFirewallStatus:44895:MIB_FW_GENERAL_ENABLE:1 startup:debug:doDoSProtect:12136:Setting synflood rules... startup:debug:doDoSProtect:12143:Setting ip spoofing rules... startup:debug:doDoSProtect:12150:Setting land attack rules... ifconfig ppp0 > /tmp/ifcfg_ppp0 startup:debug:getIpv6addr:11834:allipv6addr is :: ifconfig ppp1 > /tmp/ifcfg_ppp1 startup:debug:getIpv6addr:11834:allipv6addr is :: ifconfig vc2 > /tmp/ifcfg_vc2 ifconfig: vc2: error fetching interface information: Device not found startup:debug:getIpv6addr:11834:allipv6addr is :: ifconfig vc3 > /tmp/ifcfg_vc3 ifconfig: vc3: error fetching interface information: Device not found startup:debug:getIpv6addr:11834:allipv6addr is :: ifconfig vc4 > /tmp/ifcfg_vc4 ifconfig: vc4: error fetching interface information: Device not found startup:debug:getIpv6addr:11834:allipv6addr is :: ifconfig vc5 > /tmp/ifcfg_vc5 ifconfig: vc5: error fetching interface information: Device not found startup:debug:getIpv6addr:11834:allipv6addr is :: ifconfig vc6 > /tmp/ifcfg_vc6 ifconfig: vc6: error fetching interface information: Device not found startup:debug:getIpv6addr:11834:allipv6addr is :: ifconfig vc7 > /tmp/ifcfg_vc7 ifconfig: vc7: error fetching interface information: Device not found startup:debug:getIpv6addr:11834:allipv6addr is :: startup:debug:doDoSProtect:12157:Setting land attack rules... startup:debug:doDoSProtect:12183:Setting port scan rules... startup:debug:doDoSProtect:12190:Setting furtive port scan rules... startup:debug:doDoSProtect:12197:Setting ping broadcast rules... startup:debug:doDoSProtect:12208:Setting icmp redirect attack rules... startup:debug:doDoSProtect:12221:Setting ping of death rules... /bin/echo 2 > /proc/fastbridge clean rtk fast bridge table *****Enable ftp ALG function!***** *****Restart ftp ALG function with new port!***** *****Enable l2tp ALG function!***** *****Restart l2tp ALG function with new port!***** nf_conntrack_l2tp version 3.1 loaded *****Restart ipsec ALG function with new port!***** *****Enable pptp ALG function!***** *****Restart pptp ALG function with new port!***** cp -f /var/tmp_radvd.conf /var/radvd.conf startup:debug:addStaticRouteForDNS:31269:mode:1 startup:debug:createManualDNSResolveFile:31224:Enter startup:debug:addStaticRouteForDNS:31362:Exit upnpctrl(up): Start MINIUPNPD on ppp0 interface cfg_getVersion: invoke getVersion() Dec 31 21:00:35 miniupnpd[928]: HTTP listening on port 49152 ADDRCONF(NETDEV_UP): eth0.2: link is not ready ADDRCONF(NETDEV_UP): eth0.3: link is not ready ADDRCONF(NETDEV_UP): eth0.4: link is not ready ADDRCONF(NETDEV_UP): eth0.5: link is not ready /bin/slogd -n -s 16384 -l 6 ... Current Mode: xDSL Interface doesn't accept private ioctl... 89F1: Operation not permitted CMD ARGS: -start -c /var/wscd.conf -w wlan0 -fi /var/wscd-wlan0.fifo Writing file /var/wscd.conf... WiFi Simple Config v1.22 (2016.11.25-07:28+0000). Total WPA/WPA2 number is 1 iwcontrol RegisterPID to (wlan0) iptables: No chain/target/match by that name. Run `dmesg' for more information. iptables v1.4.3: Couldn't find target `lan_mark' Try `iptables -h' or 'iptables --help' for more information. udhcp server/relay (v0.9.9-pre) started Run Server and Relay functions. dhcpd server read configfile:poolname=default dhcpd server read configfile:poolname=STBs dhcpd server read configfile:poolname=FON /bin/echo 0 > /proc/rtl865x/portisolation Illegal target name 'portmapping'. Listening on Socket/fon0 Sending on Socket/fon0 Listening on Socket/br0 Sending on Socket/br0 RTNETLINK answers: No such file or directory RTNETLINK answers: No such file or directory RTNETLINK answers: No such file or directory RTNETLINK answers: No such file or directory cwmp_flag=30 Set No Debug Message! RTNETLINK answers: No such file or directory RTNETLINK answers: No such file or directory RTNETLINK answers: No such file or directory RTNETLINK answers: No such file or directory RTNETLINK answers: No such file or directory Error: argument "" is wrong: fwmark value is invalid Set No Debug Message[1] Set Delay! Set Delay[15] Set gNotifyBringAllWanIPinInform[1] Set gConReqAuthType[0] Set gReturn503[0] enter cwmp_main! Start cwmp_main() ! Error: argument " " is wrong: fwmark value is invalid Error: argument "-p ICMP" is wrong: fwmark value is invalid Error: argument "-p TCP" is wrong: fwmark value is invalid the itfGroup is 0x0. ifIndex is 0x0. ifname is ppp0 the itfGroup is 0x0. ifIndex is 0x101. ifname is ppp1 Init System OK for IPV6 startup:debug:startDnsRelay:24149:defIfIndex:0 INFO: get DNS from PPP startup:debug:startDnsRelay:24195:get DNS from PPP, Entry.ifIndex:0 cat /dev/null > /var/resolv.dnsmasq.conf startup:debug:GenerateDnsmasqFile:43354:Write to dnsmasq.conf Start. cat /dev/null > /var/dnsmasq.conf startup:debug:GenerateDnsmasqFile:43647:Write to dnsmasq.conf Exit. startup:debug:startDnsRelay:24379:Mapping DNS file:/etc/ppp/resolv_0.conf cat /var/resolv.v4.conf >> /var/resolv.dnsmasq.conf cat: can't open '/var/resolv.v4.conf': No such file or directory cat /var/resolv.v6.conf >> /var/resolv.dnsmasq.conf cat: can't open '/var/resolv.v6.conf': No such file or directory startup:debug:startDnsRelay:24405:Exit. ========== Initiating Ending Script ============= sh: can't open /var/config/end_script ========== End Initiating Ending Script ============= [1]:/bin/fon [2]:startUp udhcp server/relay (v0.9.9-pre) started Run Server and Relay functions. dhcpd server read configfile:poolname=default dhcpd server read configfile:poolname=STBs dhcpd server read configfile:poolname=FON Listening on Socket/fon0 Sending on Socket/fon0 Listening on Socket/br0 Sending on Socket/br0 cat /dev/null > /var/resolv.dnsmasq.conf cat /dev/null > /var/dnsmasq.conf cat /var/resolv.v4.conf >> /var/resolv.dnsmasq.conf cat: can't open '/var/resolv.v4.conf': No such file or directory cat /var/resolv.v6.conf >> /var/resolv.dnsmasq.conf cat: can't open '/var/resolv.v6.conf': No such file or directory /var/config/mini_httpd.pem exist! [Debug] [Debug] ifName:ppp0 DHCP Server ready, start to monitor is all bridges Pvcs ==== Extras ==== === Bootloader === ... Press 'ESC' to stop autoboot: DSL-100HNU-K1 v2>hello hello: command not found Supported commands: atbr restore to default configuration usage: atbr atbt enable/disable first block writable usage: atbt x (x=1:enable, others:disable) aten set debug flag usage: aten x y (x:[1|0], y:password) atgo run kernel image usage: atgo athe help usage: athe [cmd] atlc upload current/romd config file via xmodem usage: atlc file_type (file_type:[config|romd]) atmt reduce manufacture bootup time for wireless calibration usage: atmt x (x=1:enable, others:disable) atse show the seed of password generator usage: atse atsh dump manufacturer related data usage: atsh atsn write series number to flash usage: atsn sn (sn:ASCII serial number with 14 bytes length) atub xmodem upload bootloader to flash usage: atub atur xmodem upload firmware to flash usage: atur atwz write MAC addr, country code, debug flag, MAC quantity to flash usage: atwz mac [cc df mq] atfn show/write FON number usage: atfn [sn] (sn:ASCII serial number with 64 bytes length) atsr reboot device usage: atsr attp tftp upload usage: attp c_ip s_ip file_name file_type (file_type:[boot|ras|config|romd|cert]) atcr clear romd config usage: atcr atdm dump memory usage: atdm addr size atle leds test usage: atle [on|off] atht upload firmware via http usage: atht OK DSL-100HNU-K1 v2> DSL-100HNU-K1 v2>atsh FW Version : V1.00(WQQ.0)b13 FW Ext. Version : VOI_Fw_v6 Bootbase Version : V1.19 | 11/23/2015 15:44:01 Vender Name : MitraStar Technology, Inc. Product Name : DSL-100HNU-K1 v2 Serial Number : xxxxxxxxxxxxx First MAC Address : xxxxxxxxxxxxx Last MAC Address : xxxxxxxxxxxxx MAC Address Quantity : 02 Default Country Code : D0 Boot Module Debug Flag : 00 RootFS Checksum : 80BBE8B8 Kernel Checksum : C4807C51 RomFile Checksum : A7553DAB Feature Bits : 4D 53 20 02 20 02 00 00-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 OK === Misc === # cat /proc/cpuinfo system type : RTL8672 processor : 0 cpu model : 56321 BogoMIPS : 448.92 tlb_entries : 64 mips16 implemented : yes # cat /proc/version Linux version 2.6.30.9-svn10809 (jimchen@sw15-server) (gcc version 4.4.7 (Realtek RSDK-1.5.8p1 Build 1050) ) #278 Fri Nov 25 15:20:38 CST 2016 # cat /proc/mounts rootfs / rootfs rw 0 0 /dev/root / squashfs ro,relatime 0 0 proc /proc proc rw,relatime 0 0 ramfs /var ramfs rw,relatime 0 0 sysfs /sys sysfs rw,relatime 0 0 mdev /dev tmpfs rw,relatime 0 0 # cat /proc/cmdline console=ttyS0,115200 mem=32M root=31:3 ro # cat /proc/mtd dev: size erasesize name mtd0: 00010000 00001000 "boot" mtd1: 00010000 00001000 "config_hw" mtd2: 00010000 00001000 "config_cur" mtd3: 0052fc0d 00001000 "rootfs" mtd4: 0080ff80 00001000 "backupfs" mtd5: 007c0000 00001000 "image1" mtd6: 007c0000 00001000 "image2" mtd7: 00020000 00001000 "config_bak" mtd8: 00010000 00001000 "cert" mtd9: 00010000 00001000 "temp" # ps PID USER VSZ STAT COMMAND 1 tech 776 S /sbin/init 2 tech 0 SW< [kthreadd] 3 tech 0 SWN [ksoftirqd/0] 4 tech 0 SW< [watchdog/0] 5 tech 0 SW< [events/0] 6 tech 0 SW< [khelper] 9 tech 0 SW< [async/mgr] 68 tech 0 SW< [kblockd/0] 86 tech 0 SW [netlog] 91 tech 0 SW [khungtaskd] 92 tech 0 SW [pdflush] 93 tech 0 SW [pdflush] 94 tech 0 SW< [kswapd0] 96 tech 0 SW< [crypto/0] 133 tech 0 SW< [kNicEvt] 135 tech 0 SW< [mtdblockd] 199 tech 1852 S configd 201 tech 636 S /bin/inetd 202 tech 1928 S /bin/config -c -u tech 213 tech 1472 S /bin/proxyapid 261 tech 728 S /bin/radvd -C /var/radvd.conf 262 tech 780 S /bin/mpoad 263 tech 1848 S /bin/spppd 270 tech 1060 S /bin/sntp -t 1 -i 3600 -s a.ntp.br b.ntp.br 273 tech 992 S /bin/snmpd -p 161 -c ADSL -th 0.0.0.0 -te 1.3.6.1.4.1 281 tech 1460 S /bin/setupPortFWd 282 tech 1488 S /bin/monitord 283 tech 1480 S /bin/monitord 312 tech 3476 S /bin/mini_httpd -p 80 -C /etc_ro/mini_httpd.conf 961 tech 1036 S /bin/miniupnpd -i ppp0 -a 192.168.1.1 -p 49152 972 tech 636 S /bin/slogd -n -s 16384 -l 6 -L 976 tech 1708 D startup 977 tech 1708 D startup 1142 tech 1208 S /bin/wscd -start -c /var/wscd.conf -w wlan0 -fi /var/ 1150 tech 648 S /bin/iwcontrol wlan0 1151 tech 664 S /bin/mini_upnpd -wsc /tmp/wscd_config -igd /tmp/igd_c 1155 tech 6448 S /bin/cwmpClient 1214 tech 820 S /bin/udhcpd -B /var/udhcpd/udhcpd.conf 1225 tech 760 S /bin/dnsmasq 1226 tech 1472 S /bin/fon startUp 1229 tech 6448 S /bin/cwmpClient 1230 tech 6448 S /bin/cwmpClient 1242 tech 868 S /bin/sh 1311 tech 860 R ps ===== Firmware ===== Aos que quiserem dar uma olhada no conteúdo do firmware, aqui estão o bootloader e o rootfs da versão "OI_Fw_v6": [[https://www.tripleoxygen.net/files/devices/technicolor/td5137/firmware/]] == Agradecimentos == Pessoas envolvidas em discussões, dicas ou bate papo em geral. Lista em ordem alfabética.