Diferenças

Aqui você vê as diferenças entre duas revisões dessa página.

--- ont:g-140w-h [2021/04/16 23:42] – [Hardware] tripleoxygen
+++ ont:g-140w-h [2024/10/28 08:25] (atual) – tripleoxygen
@@ Linha 1: / Linha 1: @@
 ====== Nokia G-140W-H ======
-{{description>Informações sobre o Nokia G-140W-H Oi ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}}
+{{description>Informações sobre o Alcatel-Lucent Nokia G-140W-H Oi ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}}
 Este modelo é fornecido pela Oi Fibra.
@@ Linha 20: / Linha 20: @@
 {{ :ont:wdsc_0306.jpg?direct&400 |}}
+**[[https://photos.app.goo.gl/vS1BfsymCcLUFh3bA|Álbum com todas as fotos.]]**
 ^ SoC | Broadcom BCM68461KRFBG - ARM Cortex A7 Dual Core @ 1000MHz |
@@ Linha 29: / Linha 31: @@
 ^ Wireless 5 GHz| Broadcom BCM4352KMLG 3x3 802.11ac |
 ^ GPON Transceiver | GN25L98 BOSA |
-^ FXS | 1 ( Intel/Lantiq S034NN19 SLLU3  ) |
+^ FXS | 1 ( Intel/Lantiq PEF32001 SLIC ) |
 ^ HPNA | Não |
 ^ Serial | Sim |
@@ Linha 35: / Linha 37: @@
 ===== Bootlog =====
+++++ Visualizar|
 <code>
@@ Linha 2623: / Linha 2627: @@
 wl: Unsupported
 </code>
+++++
 ===== Serial =====
@@ Linha 2629: / Linha 2635: @@
 ,3V, baud 115200, 8 bits, no parity, 1 stop bit, idle 1.
+Um shell/CLI limitado está disponível pela porta serial:
+<code>
+user> help
+Zebra VTY provides advanced help feature.  When you need help,
+anytime at the command line please press '?'.
+If nothing matches, the help list will be empty and you must backup
+ until entering a '?' shows the available options.
+Two styles of help are provided:
+. Full help is available when you are ready to enter a
+command argument (e.g. 'show ?') and describes each possible
+argument.
+. Partial help is provided when an abbreviated argument is entered
+   and you want to know what arguments match the input
+   (e.g. 'show me?'.)
+user>
+  enable  Turn on privileged mode command
+  help    Description of the interactive help system
+  list    Print command list
+  show    Show running system information
+user> show version
+Zebra 0.95 (mips-linux).
+Copyright 1996-2004, Kunihiro Ishiguro.
+user> enable
+user# ?
+  configure   Configuration from vty interface
+  disable     Turn off privileged mode command
+  exit        Exit current mode and down to previous mode
+  help        Description of the interactive help system
+  list        Print command list
+  logout      logout and byebye.
+  nslookup    Query nameserver for the specified host
+  ntp         Date and time in UTC that of the CPE when it sync with SNTP server.
+  ping        Send echo messages
+  shell       start shell, need to input the dynamic password
+  show        Show information from vty interface
+  tftp        Transfer syslog,omci,voice log to tftp server.
+  traceroute  trace route about a host
+user# list
+  configure
+  disable
+  exit
+  help
+  list
+  logout
+  nslookup HOST [SERVER]
+  ntp date
+  ping [-c COUNT] [-s SIZE] [-I IFACE or ip] [-W SEC] [-w SEC] {hostname or ip}
+  shell
+  show
+  tftp (syslog|omci|voice) HOST
+  traceroute [-m MAXTTL] [-p PORT] [-q NQUERIES] [-w WAIT_SEC] [-i IFACE] HOST [BYTES]
+user(show)# ?
+  arp            Displays system arp cache
+  buildinfo      Display build info.
+  cpu            Displays cpu utilization
+  dns            Displays DNS info
+  end            End current mode and down to previous mode
+  exit           Exit current mode and down to previous mode
+  help           Description of the interactive help system
+  hspa           Displays hspa info
+  hwversion      Displays the hardware version info
+  igmp           Displays igmp information
+  ip             Displays IPv4 information
+  lan            Displays lan configuration
+  list           Print command list
+  logfile        Display the content of module log file.
+  mem            Displays memory utilization
+  nat            Displays NAT information
+  network        Displays network information
+  reboot         Displays cause of last reboot
+  ridump         Display RI info.
+  route          Displays kernel IPv4 and IPv6 routing tables
+  serialnum      show serial number
+  swversion      Displays the software version info info
+  sysinfo        Displays system information
+  sysmon         Displays active processes
+  virtualserver  Show virtual server info
+  voice          Displays voice information
+  wan            Displays wan info
+  wifi           Show wifi client list informationShow wifi client list information
+  wlan           Displays WiFi paramters
+user(show)# list
+  arp
+  buildinfo
+  cpu
+  dns
+  end
+  exit
+  help
+  hspa modem
+  hwversion
+  igmp
+  ip default-gateway
+  ip route
+  lan ip dhcp
+  lan ip hosts
+  lan ipv6 dhcp
+  lan ipv6 hosts
+  lan stats
+  list
+  logfile (syslog|omci|voice)
+  mem
+  nat count [A.B.C.D]
+  nat entries [A.B.C.D]
+  nat rules
+  network interface (IFNAME|all)
+  reboot
+  ridump
+  route
+  serialnum
+  swversion
+  sysinfo
+  sysmon
+  virtualserver
+  voice port
+  voice status
+  wan (WAN1|WAN2|WAN3|WAN4|WAN5|WAN6|WAN7|WAN8|all) statistics
+  wan (WAN1|WAN2|WAN3|WAN4|WAN5|WAN6|WAN7|WAN8|all) status
+  wan (WAN1|WAN2|WAN3|WAN4|WAN5|WAN6|WAN7|WAN8|all) uptime
+  wifi client list
+  wlan
+user(show)# sysmon
+  PID  PPID USER     STAT   VSZ %MEM CPU %CPU COMMAND
+     1 root     S     204m 42.8   1  2.2 ./voip
+11598 root     R     4288  0.8   0  2.2 top -b -n1
+ ...
+     2 root     SW       0  0.0   0  0.0 [kworker/0:29]
+     2 root     SW       0  0.0   1  0.0 [kworker/1:18]
+     2 root     SW<      0  0.0   1  0.0 [kworker/1:1H]
+user(config)# ?
+  end      End current mode and down to previous mode
+  exit     Exit current mode and down to previous mode
+  help     Description of the interactive help system
+  list     Print command list
+  logsrv   set SFTP value to DB for uploading logs
+  rsyslog  Configure rsyslog file size and beacon log level.
+  syslog   Configure syslog file number and file size.
+user(config)# list
+  end
+  exit
+  help
+  list
+  logsrv  ENABLE SRVIP  SFTPUSERNAME SFTPPW RPATH ULTYPE MINUTE_STIME HOUR_STIME DAY_STIME MONTH_STIME WEEK_STIME
+  rsyslog [rgw_fs INT] [rgw_lv INT] [beacon_fs INT] [beacon_lv INT] [remote_ip A.B.C.D] [persistent FLAG]
+  syslog filenum <1-5> filesize <1-5> [persistent FLAG]
+user# shell
+Password:
+Password:
+Password:
+login will be forbidden about 300s because of the continuous authentication failure (over 3 times)
+</code>
+Esta senha é dinâmica e calculada a partir do serial ("G984Serial"), portanto única para cada dispositivo. Caso o prompt que apareça solicitando a senha seja "Password:", é possível gerá-la com os algoritmos conhecidos. Caso seja "Password2:", não é possível.
+É possível parar o U-Boot (bootloader) pressionando alguma tecla no momento correto. Ao fazer isto, nenhuma mensagem é exibida, mas o G-140W-H na verdade está esperando login (3 tentativas permitidas antes de um reboot):
+<code>
+...
+Voice Board Configuration (0-33)  : LE9652_ZSI_IB
+Partition 1 Size (MB)             :
+Partition 2 Size (MB)             :
+Partition 3 Size (MB)             :
+Partition 4 Size (MB) (Data)      : 4MB
+*** Press any key to stop auto run (1 seconds) ***
+Auto run second count down: 0
+login without authorization.
+login without authorization.
+login without authorization.
+Resetting board in 0 seconds...----
+BTRM
+V1.1
+MEMP
+CACH
+....
+</code>
+Esta senha também é calculada a partir do serial.
+===== SSH & Telnet =====
+Os serviços estão rodando e escutando nas portas padrões, mas estão bloqueados pelo firewall do aparelho. Para ativa-los, é necessário acessar o menu "Access Control", disponível apenas após login com usuário privilegiado (AdminGPON).
+===== Serial GPON =====
+<WRAP center round important 80%>
+Atenção: caso o aparelho permaneça configurado em algum //OperatorID// cujas senhas sejam baseadas no serial, ao troca-lo e realizar um //factory reset// no aparelho, elas serão recalculadas! Portanto, deverão ser geradas novamente como fez da primeira vez para retornar o acesso.
+</WRAP>
+É possível alterar o serial GPON através do shell privilegiado. Supondo que queira definir o novo serial para XYWZAABBCCDD:
+. Obtenha uma cópia dos dados permanentes do seu aparelho e anote em algum lugar:
+<code>
+# ritool dump
+</code>
+. Altere o serial GPON conforme desejado, onde "aabbccdd" são os últimos 8 dígitos, em minúsculo, e "XYWZAABBCCDD" o serial completo.
+<code>
+# ritool set OperatorID 0000
+# ritool set MfrID XYWZ
+# ritool set G984Serial aabbccdd
+# ritool set YPSerialNum XYWZAABBCCDD
+</code>
+. Retorne o OperatorID para o original do aparelho, obtido no dump do primeiro passo (substitua os ????):
+<code>
+# ritool set OperatorID ????
+</code>
+Para referência, o OperatorID da Oi é BRZL.
+===== Logs e informações =====
+<code>
+# cat /proc/cpuinfo
+processor       : 0
+model name      : ARMv7 Processor rev 5 (v7l)
+BogoMIPS        : 100.00
+Features        : half thumb fastmult edsp tls idiva idivt lpae
+CPU implementer : 0x41
+CPU architecture: 7
+CPU variant     : 0x0
+CPU part        : 0xc07
+CPU revision    : 5
+processor       : 1
+model name      : ARMv7 Processor rev 5 (v7l)
+BogoMIPS        : 100.00
+Features        : half thumb fastmult edsp tls idiva idivt lpae
+CPU implementer : 0x41
+CPU architecture: 7
+CPU variant     : 0x0
+CPU part        : 0xc07
+CPU revision    : 5
+Hardware        : BCM96846
+Revision        : 0000
+Serial          : 0000000000000000
+# cat /proc/version
+Linux version 4.1.45 (buildmgr@AONT26) (gcc version 5.3.0 (Buildroot 2016.02) ) #1 SMP PREEMPT Tue Mar 31 23:13:58 CST 2020
+# cat /proc/mtd
+dev:    size   erasesize  name
+mtd0: 00080000 00020000 "boot"
+mtd1: 00080000 00020000 "nvram"
+mtd2: 02800000 00020000 "image0"
+mtd3: 02800000 00020000 "image1"
+mtd4: 00f00000 00020000 "logfs"
+mtd5: 00800000 00020000 "cfgfs"
+mtd6: 00600000 00020000 "extfs"
+mtd7: 01200000 00020000 "diagfs"
+mtd8: 08000000 00020000 "datafs"
+mtd9: 02226000 0001f000 "rootfs_ubifs"
+mtd10: 0001f000 0001f000 "METADATA"
+mtd11: 0001f000 0001f000 "METADATACOPY"
+mtd12: 002ee647 0001f000 "filestruct_full.bin"
+mtd13: 00d90000 0001f000 "0"
+mtd14: 006c8000 0001f000 "1"
+mtd15: 07918000 0001f000 "0"
+# cat /proc/mounts
+/dev/root / squashfs ro,relatime 0 0
+devtmpfs /dev devtmpfs rw,relatime,size=243872k,nr_inodes=60968,mode=755 0 0
+proc /proc proc rw,relatime 0 0
+sysfs /sys sysfs rw,relatime 0 0
+tmpfs /dev tmpfs rw,relatime 0 0
+tmpfs /etc tmpfs rw,relatime,size=32768k 0 0
+devpts /dev/pts devpts rw,relatime,gid=5,mode=620 0 0
+tmpfs /dev/shm tmpfs rw,relatime 0 0
+/mnt /mnt tmpfs rw,relatime,size=1024k,mode=755 0 0
+/var /var tmpfs rw,nosuid,nodev,noexec,relatime 0 0
+none /tmp tmpfs rw,nosuid,nodev,noexec,relatime 0 0
+/dev/ubi4_0 /logs ubifs rw,relatime 0 0
+/dev/ubi5_0 /configs ubifs rw,relatime 0 0
+/dev/ubi8_0 /flash ubifs rw,relatime 0 0
+/dev/sda2 /mnt/usb1_2 vfat rw,relatime,uid=111,fmask=0000,dmask=0000,allow_utime=0022,codepage=936,iocharset=cp936,shortname=mixed,errors=remount-ro 0 0
+# cat /proc/modules
+xt_mac 631 0 - Live 0xbffaf000
+xt_NFQUEUE 1971 0 - Live 0xbffab000
+nfnetlink_queue 7894 1 - Live 0xbffa6000
+koffload 4102 0 - Live 0xbffa1000 (O)
+xt_statistic 833 18 - Live 0xbff9d000
+xt_multiport 1281 2 - Live 0xbff99000
+xt_hashlimit 6271 12 - Live 0xbff94000
+xt_mark 702 9 - Live 0xbff90000
+nf_nat_pptp 1764 0 - Live 0xbff8c000
+nf_nat_proto_gre 825 1 nf_nat_pptp, Live 0xbff88000
+nf_conntrack_pptp 3266 1 nf_nat_pptp, Live 0xbff84000
+nf_conntrack_proto_gre 3115 1 nf_conntrack_pptp, Live 0xbff80000
+nf_nat_rtsp 3078 0 - Live 0xbff7c000
+nf_conntrack_rtsp 6643 1 nf_nat_rtsp, Live 0xbff77000
+nf_nat_sip 7240 0 - Live 0xbff72000
+nf_conntrack_sip 17635 1 nf_nat_sip, Live 0xbff6a000
+nf_nat_h323 5434 0 - Live 0xbff65000
+nf_nat_tftp 603 0 - Live 0xbff61000
+nf_conntrack_tftp 2788 1 nf_nat_tftp, Live 0xbff5d000
+nf_nat_ftp 1243 0 - Live 0xbff59000
+nf_conntrack_netlink 17107 0 - Live 0xbff51000
+xt_TCPMSS 2593 6 - Live 0xbff4d000
+xt_DSCP 1459 1 - Live 0xbff49000
+ip6t_REJECT 1266 12 - Live 0xbff45000
+nf_reject_ipv6 1964 1 ip6t_REJECT, Live 0xbff41000
+ipt_REJECT 930 12 - Live 0xbff39000
+nf_reject_ipv4 1720 1 ipt_REJECT, Live 0xbff35000
+nf_conntrack_ipv6 6828 20 - Live 0xbff2b000
+nf_defrag_ipv6 13626 1 nf_conntrack_ipv6, Live 0xbff23000
+nf_log_ipv6 3564 10 - Live 0xbff1f000
+nf_log_ipv4 3156 13 - Live 0xbff1b000
+nf_log_common 2212 2 nf_log_ipv6,nf_log_ipv4, Live 0xbff17000
+xt_conntrack 2419 46 - Live 0xbff13000
+xt_state 765 0 - Live 0xbff0f000
+xt_LOG 817 23 - Live 0xbff0b000
+usb_storage 38839 1 - Live 0xbfef8000
+xt_SKIPLOG 519 2 - Live 0xbfef4000
+dsphal 51083 3 - Live 0xbfee1000
+dhcpdrv 2352 1 - Live 0xbfedd000 (O)
+kigmp 277804 0 - Live 0xbfe89000 (O)
+ipip 3633 0 - Live 0xbfe85000
+ip_gre 7324 0 - Live 0xbfe80000
+gre 3007 1 ip_gre, Live 0xbfe7c000
+dying_gasp 2668 0 - Live 0xbfe78000 (PO)
+wl 4306432 0 - Live 0xbf9ef000 (P)
+wlemf 68036 1 wl, Live 0xbf9d6000 (P)
+wfd 15164 1 wl, Live 0xbf9ce000
+bcmmcast 49370 2 wlemf,wfd, Live 0xbf9bb000
+bcmhook 5487 3 koffload,kigmp,wl, Live 0xbf9b6000 (O)
+bcm_usb 932 0 - Live 0xbf9ac000
+ohci_platform 3424 0 - Live 0xbf9a8000
+ohci_hcd 22965 1 ohci_platform, Live 0xbf99e000
+ehci_platform 3927 0 - Live 0xbf99a000
+ehci_pci 2766 0 - Live 0xbf996000
+ehci_hcd 32203 2 ehci_platform,ehci_pci, Live 0xbf98a000
+ip6table_raw 622 0 - Live 0xbf986000
+ip6table_mangle 970 1 - Live 0xbf982000
+ip6table_filter 650 1 - Live 0xbf97e000
+ip6_tables 9321 3 ip6table_raw,ip6table_mangle,ip6table_filter, Live 0xbf978000
+iptable_nat 894 1 - Live 0xbf974000
+nf_nat_ipv4 3653 1 iptable_nat, Live 0xbf970000
+nf_conntrack_ipv4 11560 35 - Live 0xbf969000
+nf_defrag_ipv4 850 1 nf_conntrack_ipv4, Live 0xbf965000
+nf_conntrack_h323 35558 1 nf_nat_h323, Live 0xbf956000
+nf_conntrack_ftp 5671 1 nf_nat_ftp, Live 0xbf951000
+nfnetlink 4096 3 nfnetlink_queue,nf_conntrack_netlink, Live 0xbf94d000
+xt_nat 1171 0 - Live 0xbf949000
+nf_nat 10081 9 nf_nat_pptp,nf_nat_proto_gre,nf_nat_rtsp,nf_nat_sip,nf_nat_h323,nf_nat_tftp,nf_nat_ftp,nf_nat_ipv4,xt_nat, Live 0xbf942000
+iptable_mangle 850 1 - Live 0xbf93e000
+iptable_filter 706 1 - Live 0xbf93a000
+ip_tables 9041 3 iptable_nat,iptable_mangle,iptable_filter, Live 0xbf934000
+pktrunner 806950 0 - Live 0xbf869000 (P)
+bcmbrfp 5805 0 - Live 0xbf864000
+bcmdrv 212094 8 koffload,dhcpdrv,kigmp,dying_gasp,bcmhook, Live 0xbf816000 (PO)
+phyadpt 12913 1 dying_gasp, Live 0xbf80e000 (O)
+dp_rm 2552 2 - Live 0xbf80a000 (O)
+bcmgpon 156320 1 bcmdrv, Live 0xbf7d7000 (P)
+gponstack 459050 4 bcmdrv,bcmgpon, Live 0xbf73d000 (P)
+bcmvlan 109496 0 - Live 0xbf718000 (P)
+bcm_enet 64133 5 wl,bcmdrv,phyadpt,bcmgpon,bcmvlan, Live 0xbf6ff000
+rdpa_mw 32608 3 pktrunner,bcmbrfp,bcmvlan, Live 0xbf6f1000
+usblp 8696 0 - Live 0xbf6eb000
+pmd 47100 2 bcmgpon,gponstack, Live 0xbf6d9000 (P)
+bcm_bpm 8293 0 [permanent], Live 0xbf6d3000 (P)
+pktflow 161326 2 pktrunner,bcmdrv, Live 0xbf6a3000 (P)
+rdpa 4068071 1 bcmgpon, Live 0xbf23f000 (P)
+rdpa_gpl_ext 891 2 bcmdrv,bcmgpon, Live 0xbf23b000
+rdpa_gpl 15641 9 kigmp,wfd,pktrunner,bcmbrfp,bcmdrv,bcmgpon,bcm_enet,rdpa_mw,rdpa, Live 0xbf22d000
+bcm_pondrv 189991 5 bcmdrv,bcmgpon,gponstack,rdpa_mw,pmd, Live 0xbf1f0000 (P)
+bdmf 1238066 11 kigmp,wfd,pktrunner,bcmbrfp,bcmdrv,bcmgpon,gponstack,bcm_enet,rdpa_mw,rdpa,rdpa_gpl, Live 0xbf0b0000
+bcm_pcie_hcd 18223 0 - Live 0xbf0a7000
+wlcsm 5541 3 wl,wlemf,bcm_pcie_hcd, Live 0xbf0a2000 (P)
+pwrmngtd 1895 0 - Live 0xbf09e000 (P)
+button_driver 11528 0 - Live 0xbf097000 (O)
+drv_dxs 85627 1 - Live 0xbf07c000 (O)
+drv_tapi 159703 3 drv_dxs, Live 0xbf04c000 (O)
+drv_ifxos 14705 2 drv_dxs,drv_tapi, Live 0xbf042000 (O)
+bosa_semetech 17241 2 bcmdrv,gponstack, Live 0xbf039000 (O)
+led_drv 19319 3 usb_storage,dying_gasp,bcm_enet, Live 0xbf029000 (O)
+netlinkmsg 13634 5 usb_storage,bcmdrv,button_driver,bosa_semetech, Live 0xbf022000 (O)
+gpio_mgr 6937 5 dying_gasp,button_driver,drv_dxs,bosa_semetech,led_drv, Live 0xbf017000 (O)
+hcfg 2236 9 kigmp,dying_gasp,bcmdrv,bcmvlan,button_driver,bosa_semetech,led_drv,netlinkmsg,gpio_mgr, Live 0xbf013000 (O)
+scfg 18972 5 kigmp,bcmdrv,bosa_semetech,gpio_mgr,hcfg, Live 0xbf00a000 (O)
+extfs 9515 2 bosa_semetech,scfg, Live 0xbf004000 (O)
+nand_drv 2688 1 extfs, Live 0xbf000000 (O)
+# cat /proc/cmdline
+coherent_pool=2M cpuidle_sysfs_switch pci=pcie_bus_safe bootversion=Mar-31-2020--23:07:20
+# cat /proc/socinfo
+SoC Name        :BCM68461
+Revision        :A1
+</code>
 == Agradecimentos ==
 Pessoas envolvidas em discussões, dicas ou bate papo em geral. Lista em ordem alfabética.
+<code>T1AGO</code>