Tabela de conteúdos

Nokia G-140W-H

Informações sobre o Alcatel-Lucent Nokia G-140W-H Oi ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.

Este modelo é fornecido pela Oi Fibra.

Disclaimer

A maioria destes dispositivos são fornecidos pelo seu ISP em regime de comodato como parte do serviço fornecido. Todas as informações divulgadas aqui são de caráter informativo e pesquisa, sendo de sua inteira responsabilidade quaisquer implicações, perdas ou danos ao utilizá-las.

Todas as informações, métodos, procedimentos, firmwares, aplicativos e material sobre modificações e configurações postadas neste wiki foram criados pelo O3 Labs (salvo menção em contrário) e disponibilizadas GRATUITAMENTE desde o dia de sua elaboração. Denuncie quando possível quaisquer tentativas de venda destes material.

Hardware

Álbum com todas as fotos.

SoC Broadcom BCM68461KRFBG - ARM Cortex A7 Dual Core @ 1000MHz
RAM Micron MT41K256M16TW-107 - 4Gbit (512 MB) DDR3L-1866 @ 800 MHz
Flash Micron 29F2G08ABAGA - 2 Gbit (256 MB) SLC NAND
Switch Integrado
USB 2 x 2.0
Wireless 2.4 GHz Broadcom BCM43217 2×2 802.11b/g/n
Wireless 5 GHz Broadcom BCM4352KMLG 3×3 802.11ac
GPON Transceiver GN25L98 BOSA
FXS 1 ( Intel/Lantiq PEF32001 SLIC )
HPNA Não
Serial Sim
JTAG Não

Bootlog

Visualizar

Serial

3,3V, baud 115200, 8 bits, no parity, 1 stop bit, idle 1.

Um shell/CLI limitado está disponível pela porta serial: 

user> help
Zebra VTY provides advanced help feature.  When you need help,
anytime at the command line please press '?'.

If nothing matches, the help list will be empty and you must backup
 until entering a '?' shows the available options.
Two styles of help are provided:
1. Full help is available when you are ready to enter a
command argument (e.g. 'show ?') and describes each possible
argument.
2. Partial help is provided when an abbreviated argument is entered
   and you want to know what arguments match the input
   (e.g. 'show me?'.)
   
user>
  enable  Turn on privileged mode command
  help    Description of the interactive help system
  list    Print command list
  show    Show running system information
  
user> show version
Zebra 0.95 (mips-linux).
Copyright 1996-2004, Kunihiro Ishiguro.

user> enable
user# ?
  configure   Configuration from vty interface
  disable     Turn off privileged mode command
  exit        Exit current mode and down to previous mode
  help        Description of the interactive help system
  list        Print command list
  logout      logout and byebye.
  nslookup    Query nameserver for the specified host
  ntp         Date and time in UTC that of the CPE when it sync with SNTP server.
  ping        Send echo messages
  shell       start shell, need to input the dynamic password
  show        Show information from vty interface
  tftp        Transfer syslog,omci,voice log to tftp server.
  traceroute  trace route about a host

user# list
  configure
  disable
  exit
  help
  list
  logout
  nslookup HOST [SERVER]
  ntp date
  ping [-c COUNT] [-s SIZE] [-I IFACE or ip] [-W SEC] [-w SEC] {hostname or ip} 
  shell
  show
  tftp (syslog|omci|voice) HOST
  traceroute [-m MAXTTL] [-p PORT] [-q NQUERIES] [-w WAIT_SEC] [-i IFACE] HOST [BYTES]

user(show)# ?
  arp            Displays system arp cache
  buildinfo      Display build info.
  cpu            Displays cpu utilization
  dns            Displays DNS info
  end            End current mode and down to previous mode
  exit           Exit current mode and down to previous mode
  help           Description of the interactive help system
  hspa           Displays hspa info
  hwversion      Displays the hardware version info
  igmp           Displays igmp information
  ip             Displays IPv4 information
  lan            Displays lan configuration
  list           Print command list
  logfile        Display the content of module log file.
  mem            Displays memory utilization
  nat            Displays NAT information
  network        Displays network information
  reboot         Displays cause of last reboot
  ridump         Display RI info.
  route          Displays kernel IPv4 and IPv6 routing tables
  serialnum      show serial number
  swversion      Displays the software version info info
  sysinfo        Displays system information
  sysmon         Displays active processes
  virtualserver  Show virtual server info
  voice          Displays voice information
  wan            Displays wan info
  wifi           Show wifi client list informationShow wifi client list information
  wlan           Displays WiFi paramters

user(show)# list
  arp
  buildinfo
  cpu
  dns
  end
  exit
  help
  hspa modem
  hwversion
  igmp
  ip default-gateway
  ip route
  lan ip dhcp
  lan ip hosts
  lan ipv6 dhcp
  lan ipv6 hosts
  lan stats
  list
  logfile (syslog|omci|voice)
  mem
  nat count [A.B.C.D]
  nat entries [A.B.C.D]
  nat rules
  network interface (IFNAME|all)
  reboot
  ridump
  route
  serialnum
  swversion
  sysinfo
  sysmon
  virtualserver
  voice port
  voice status
  wan (WAN1|WAN2|WAN3|WAN4|WAN5|WAN6|WAN7|WAN8|all) statistics
  wan (WAN1|WAN2|WAN3|WAN4|WAN5|WAN6|WAN7|WAN8|all) status
  wan (WAN1|WAN2|WAN3|WAN4|WAN5|WAN6|WAN7|WAN8|all) uptime
  wifi client list
  wlan

user(show)# sysmon
  PID  PPID USER     STAT   VSZ %MEM CPU %CPU COMMAND
 1957     1 root     S     204m 42.8   1  2.2 ./voip
11599 11598 root     R     4288  0.8   0  2.2 top -b -n1
 ...
 2268     2 root     SW       0  0.0   0  0.0 [kworker/0:29]
 2275     2 root     SW       0  0.0   1  0.0 [kworker/1:18]
 2284     2 root     SW<      0  0.0   1  0.0 [kworker/1:1H]

user(config)# ?
  end      End current mode and down to previous mode
  exit     Exit current mode and down to previous mode
  help     Description of the interactive help system
  list     Print command list
  logsrv   set SFTP value to DB for uploading logs
  rsyslog  Configure rsyslog file size and beacon log level.
  syslog   Configure syslog file number and file size.

user(config)# list
  end
  exit
  help
  list
  logsrv  ENABLE SRVIP  SFTPUSERNAME SFTPPW RPATH ULTYPE MINUTE_STIME HOUR_STIME DAY_STIME MONTH_STIME WEEK_STIME
  rsyslog [rgw_fs INT] [rgw_lv INT] [beacon_fs INT] [beacon_lv INT] [remote_ip A.B.C.D] [persistent FLAG]
  syslog filenum <1-5> filesize <1-5> [persistent FLAG]
 
user# shell
Password:
Password:
Password:

login will be forbidden about 300s because of the continuous authentication failure (over 3 times)

Esta senha é dinâmica e calculada a partir do serial (“G984Serial”), portanto única para cada dispositivo. Caso o prompt que apareça solicitando a senha seja “Password:”, é possível gerá-la com os algoritmos conhecidos. Caso seja “Password2:”, não é possível.

É possível parar o U-Boot (bootloader) pressionando alguma tecla no momento correto. Ao fazer isto, nenhuma mensagem é exibida, mas o G-140W-H na verdade está esperando login (3 tentativas permitidas antes de um reboot): 

...
Voice Board Configuration (0-33)  : LE9652_ZSI_IB  
Partition 1 Size (MB)             :   
Partition 2 Size (MB)             :   
Partition 3 Size (MB)             :   
Partition 4 Size (MB) (Data)      : 4MB  

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0

login without authorization.

login without authorization.

login without authorization.

Resetting board in 0 seconds...----
BTRM
V1.1
MEMP
CACH
....

Esta senha também é calculada a partir do serial.

SSH & Telnet

Os serviços estão rodando e escutando nas portas padrões, mas estão bloqueados pelo firewall do aparelho. Para ativa-los, é necessário acessar o menu “Access Control”, disponível apenas após login com usuário privilegiado (AdminGPON).

Serial GPON

Atenção: caso o aparelho permaneça configurado em algum OperatorID cujas senhas sejam baseadas no serial, ao troca-lo e realizar um factory reset no aparelho, elas serão recalculadas! Portanto, deverão ser geradas novamente como fez da primeira vez para retornar o acesso.

É possível alterar o serial GPON através do shell privilegiado. Supondo que queira definir o novo serial para XYWZAABBCCDD:

1. Obtenha uma cópia dos dados permanentes do seu aparelho e anote em algum lugar: 

# ritool dump

2. Altere o serial GPON conforme desejado, onde “aabbccdd” são os últimos 8 dígitos, em minúsculo, e “XYWZAABBCCDD” o serial completo. 

# ritool set OperatorID 0000
# ritool set MfrID XYWZ
# ritool set G984Serial aabbccdd
# ritool set YPSerialNum XYWZAABBCCDD

3. Retorne o OperatorID para o original do aparelho, obtido no dump do primeiro passo (substitua os ????): 

# ritool set OperatorID ????

Para referência, o OperatorID da Oi é BRZL.

Logs e informações

# cat /proc/cpuinfo 
processor       : 0
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 100.00
Features        : half thumb fastmult edsp tls idiva idivt lpae 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

processor       : 1
model name      : ARMv7 Processor rev 5 (v7l)
BogoMIPS        : 100.00
Features        : half thumb fastmult edsp tls idiva idivt lpae 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x0
CPU part        : 0xc07
CPU revision    : 5

Hardware        : BCM96846
Revision        : 0000
Serial          : 0000000000000000


# cat /proc/version 
Linux version 4.1.45 (buildmgr@AONT26) (gcc version 5.3.0 (Buildroot 2016.02) ) #1 SMP PREEMPT Tue Mar 31 23:13:58 CST 2020


# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00080000 00020000 "boot"
mtd1: 00080000 00020000 "nvram"
mtd2: 02800000 00020000 "image0"
mtd3: 02800000 00020000 "image1"
mtd4: 00f00000 00020000 "logfs"
mtd5: 00800000 00020000 "cfgfs"
mtd6: 00600000 00020000 "extfs"
mtd7: 01200000 00020000 "diagfs"
mtd8: 08000000 00020000 "datafs"
mtd9: 02226000 0001f000 "rootfs_ubifs"
mtd10: 0001f000 0001f000 "METADATA"
mtd11: 0001f000 0001f000 "METADATACOPY"
mtd12: 002ee647 0001f000 "filestruct_full.bin"
mtd13: 00d90000 0001f000 "0"
mtd14: 006c8000 0001f000 "1"
mtd15: 07918000 0001f000 "0"


# cat /proc/mounts 
/dev/root / squashfs ro,relatime 0 0
devtmpfs /dev devtmpfs rw,relatime,size=243872k,nr_inodes=60968,mode=755 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
tmpfs /dev tmpfs rw,relatime 0 0
tmpfs /etc tmpfs rw,relatime,size=32768k 0 0
devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0
tmpfs /dev/shm tmpfs rw,relatime 0 0
/mnt /mnt tmpfs rw,relatime,size=1024k,mode=755 0 0
/var /var tmpfs rw,nosuid,nodev,noexec,relatime 0 0
none /tmp tmpfs rw,nosuid,nodev,noexec,relatime 0 0
/dev/ubi4_0 /logs ubifs rw,relatime 0 0
/dev/ubi5_0 /configs ubifs rw,relatime 0 0
/dev/ubi8_0 /flash ubifs rw,relatime 0 0
/dev/sda2 /mnt/usb1_2 vfat rw,relatime,uid=111,fmask=0000,dmask=0000,allow_utime=0022,codepage=936,iocharset=cp936,shortname=mixed,errors=remount-ro 0 0


# cat /proc/modules 
xt_mac 631 0 - Live 0xbffaf000
xt_NFQUEUE 1971 0 - Live 0xbffab000
nfnetlink_queue 7894 1 - Live 0xbffa6000
koffload 4102 0 - Live 0xbffa1000 (O)
xt_statistic 833 18 - Live 0xbff9d000
xt_multiport 1281 2 - Live 0xbff99000
xt_hashlimit 6271 12 - Live 0xbff94000
xt_mark 702 9 - Live 0xbff90000
nf_nat_pptp 1764 0 - Live 0xbff8c000
nf_nat_proto_gre 825 1 nf_nat_pptp, Live 0xbff88000
nf_conntrack_pptp 3266 1 nf_nat_pptp, Live 0xbff84000
nf_conntrack_proto_gre 3115 1 nf_conntrack_pptp, Live 0xbff80000
nf_nat_rtsp 3078 0 - Live 0xbff7c000
nf_conntrack_rtsp 6643 1 nf_nat_rtsp, Live 0xbff77000
nf_nat_sip 7240 0 - Live 0xbff72000
nf_conntrack_sip 17635 1 nf_nat_sip, Live 0xbff6a000
nf_nat_h323 5434 0 - Live 0xbff65000
nf_nat_tftp 603 0 - Live 0xbff61000
nf_conntrack_tftp 2788 1 nf_nat_tftp, Live 0xbff5d000
nf_nat_ftp 1243 0 - Live 0xbff59000
nf_conntrack_netlink 17107 0 - Live 0xbff51000
xt_TCPMSS 2593 6 - Live 0xbff4d000
xt_DSCP 1459 1 - Live 0xbff49000
ip6t_REJECT 1266 12 - Live 0xbff45000
nf_reject_ipv6 1964 1 ip6t_REJECT, Live 0xbff41000
ipt_REJECT 930 12 - Live 0xbff39000
nf_reject_ipv4 1720 1 ipt_REJECT, Live 0xbff35000
nf_conntrack_ipv6 6828 20 - Live 0xbff2b000
nf_defrag_ipv6 13626 1 nf_conntrack_ipv6, Live 0xbff23000
nf_log_ipv6 3564 10 - Live 0xbff1f000
nf_log_ipv4 3156 13 - Live 0xbff1b000
nf_log_common 2212 2 nf_log_ipv6,nf_log_ipv4, Live 0xbff17000
xt_conntrack 2419 46 - Live 0xbff13000
xt_state 765 0 - Live 0xbff0f000
xt_LOG 817 23 - Live 0xbff0b000
usb_storage 38839 1 - Live 0xbfef8000
xt_SKIPLOG 519 2 - Live 0xbfef4000
dsphal 51083 3 - Live 0xbfee1000
dhcpdrv 2352 1 - Live 0xbfedd000 (O)
kigmp 277804 0 - Live 0xbfe89000 (O)
ipip 3633 0 - Live 0xbfe85000
ip_gre 7324 0 - Live 0xbfe80000
gre 3007 1 ip_gre, Live 0xbfe7c000
dying_gasp 2668 0 - Live 0xbfe78000 (PO)
wl 4306432 0 - Live 0xbf9ef000 (P)
wlemf 68036 1 wl, Live 0xbf9d6000 (P)
wfd 15164 1 wl, Live 0xbf9ce000
bcmmcast 49370 2 wlemf,wfd, Live 0xbf9bb000
bcmhook 5487 3 koffload,kigmp,wl, Live 0xbf9b6000 (O)
bcm_usb 932 0 - Live 0xbf9ac000
ohci_platform 3424 0 - Live 0xbf9a8000
ohci_hcd 22965 1 ohci_platform, Live 0xbf99e000
ehci_platform 3927 0 - Live 0xbf99a000
ehci_pci 2766 0 - Live 0xbf996000
ehci_hcd 32203 2 ehci_platform,ehci_pci, Live 0xbf98a000
ip6table_raw 622 0 - Live 0xbf986000
ip6table_mangle 970 1 - Live 0xbf982000
ip6table_filter 650 1 - Live 0xbf97e000
ip6_tables 9321 3 ip6table_raw,ip6table_mangle,ip6table_filter, Live 0xbf978000
iptable_nat 894 1 - Live 0xbf974000
nf_nat_ipv4 3653 1 iptable_nat, Live 0xbf970000
nf_conntrack_ipv4 11560 35 - Live 0xbf969000
nf_defrag_ipv4 850 1 nf_conntrack_ipv4, Live 0xbf965000
nf_conntrack_h323 35558 1 nf_nat_h323, Live 0xbf956000
nf_conntrack_ftp 5671 1 nf_nat_ftp, Live 0xbf951000
nfnetlink 4096 3 nfnetlink_queue,nf_conntrack_netlink, Live 0xbf94d000
xt_nat 1171 0 - Live 0xbf949000
nf_nat 10081 9 nf_nat_pptp,nf_nat_proto_gre,nf_nat_rtsp,nf_nat_sip,nf_nat_h323,nf_nat_tftp,nf_nat_ftp,nf_nat_ipv4,xt_nat, Live 0xbf942000
iptable_mangle 850 1 - Live 0xbf93e000
iptable_filter 706 1 - Live 0xbf93a000
ip_tables 9041 3 iptable_nat,iptable_mangle,iptable_filter, Live 0xbf934000
pktrunner 806950 0 - Live 0xbf869000 (P)
bcmbrfp 5805 0 - Live 0xbf864000
bcmdrv 212094 8 koffload,dhcpdrv,kigmp,dying_gasp,bcmhook, Live 0xbf816000 (PO)
phyadpt 12913 1 dying_gasp, Live 0xbf80e000 (O)
dp_rm 2552 2 - Live 0xbf80a000 (O)
bcmgpon 156320 1 bcmdrv, Live 0xbf7d7000 (P)
gponstack 459050 4 bcmdrv,bcmgpon, Live 0xbf73d000 (P)
bcmvlan 109496 0 - Live 0xbf718000 (P)
bcm_enet 64133 5 wl,bcmdrv,phyadpt,bcmgpon,bcmvlan, Live 0xbf6ff000
rdpa_mw 32608 3 pktrunner,bcmbrfp,bcmvlan, Live 0xbf6f1000
usblp 8696 0 - Live 0xbf6eb000
pmd 47100 2 bcmgpon,gponstack, Live 0xbf6d9000 (P)
bcm_bpm 8293 0 [permanent], Live 0xbf6d3000 (P)
pktflow 161326 2 pktrunner,bcmdrv, Live 0xbf6a3000 (P)
rdpa 4068071 1 bcmgpon, Live 0xbf23f000 (P)
rdpa_gpl_ext 891 2 bcmdrv,bcmgpon, Live 0xbf23b000
rdpa_gpl 15641 9 kigmp,wfd,pktrunner,bcmbrfp,bcmdrv,bcmgpon,bcm_enet,rdpa_mw,rdpa, Live 0xbf22d000
bcm_pondrv 189991 5 bcmdrv,bcmgpon,gponstack,rdpa_mw,pmd, Live 0xbf1f0000 (P)
bdmf 1238066 11 kigmp,wfd,pktrunner,bcmbrfp,bcmdrv,bcmgpon,gponstack,bcm_enet,rdpa_mw,rdpa,rdpa_gpl, Live 0xbf0b0000
bcm_pcie_hcd 18223 0 - Live 0xbf0a7000
wlcsm 5541 3 wl,wlemf,bcm_pcie_hcd, Live 0xbf0a2000 (P)
pwrmngtd 1895 0 - Live 0xbf09e000 (P)
button_driver 11528 0 - Live 0xbf097000 (O)
drv_dxs 85627 1 - Live 0xbf07c000 (O)
drv_tapi 159703 3 drv_dxs, Live 0xbf04c000 (O)
drv_ifxos 14705 2 drv_dxs,drv_tapi, Live 0xbf042000 (O)
bosa_semetech 17241 2 bcmdrv,gponstack, Live 0xbf039000 (O)
led_drv 19319 3 usb_storage,dying_gasp,bcm_enet, Live 0xbf029000 (O)
netlinkmsg 13634 5 usb_storage,bcmdrv,button_driver,bosa_semetech, Live 0xbf022000 (O)
gpio_mgr 6937 5 dying_gasp,button_driver,drv_dxs,bosa_semetech,led_drv, Live 0xbf017000 (O)
hcfg 2236 9 kigmp,dying_gasp,bcmdrv,bcmvlan,button_driver,bosa_semetech,led_drv,netlinkmsg,gpio_mgr, Live 0xbf013000 (O)
scfg 18972 5 kigmp,bcmdrv,bosa_semetech,gpio_mgr,hcfg, Live 0xbf00a000 (O)
extfs 9515 2 bosa_semetech,scfg, Live 0xbf004000 (O)
nand_drv 2688 1 extfs, Live 0xbf000000 (O)


# cat /proc/cmdline 
coherent_pool=2M cpuidle_sysfs_switch pci=pcie_bus_safe bootversion=Mar-31-2020--23:07:20


# cat /proc/socinfo 
SoC Name        :BCM68461
Revision        :A1
Agradecimentos

Pessoas envolvidas em discussões, dicas ou bate papo em geral. Lista em ordem alfabética. 

T1AGO