O3 Labs

Essa página está em modo somente de leitura. Você pode visualizar a fonte, mas não alterá-la. Informe-se com o administrador do Wiki, caso você ache que isso está incorreto.
====== TP-Link XZ000-G7 (BR) V1.0 ======

{{description>Informações sobre a TP-Link XZ000-G7 (BR) V1.0 XPON ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.}}

===== Disclaimer =====

<WRAP center round important 80%>
Todas as informações, métodos, procedimentos, firmwares, aplicativos e material sobre modificações e configurações postadas neste wiki foram criados pelo O3 Labs (salvo menção em contrário) e disponibilizadas **GRATUITAMENTE** desde o dia de sua elaboração. Denuncie quando possível quaisquer tentativas de venda destes material.
</WRAP>

===== Hardware =====

{{:ont:tplink:tplink-xz000-g7-br-v1-front.jpg?direct&400 |}}
{{ :ont:tplink:tplink-xz000-g7-br-v1-back.jpg?direct&400|}}

----

^ SoC | Galachip GC1601A - CPU: 1x ARM FA626TE (ARMv5TE) @ 533 MHz |
^ RAM | 32 MB (embedded) |
^ Flash | 4 MB - EN25QH32B |
^ LAN | 1 Gbit/s |
^ USB | - |
^ Wireless 2.4 GHz| - |
^ Wireless 5 GHz| - |
^ Laser Driver/Transceiver | UX3320S |
^ Acoplamento fibra | SC/APC |
^ FXS | - |
^ HPNA | - |
^ Serial | Sim |
^ JTAG | - |
^ Alimentação | DC 9 V / 600 mA |
^ Credenciais padrão | - / (senha definida pelo usuário) |
^ IP LAN padrão | 192.168.1.1 |

==== GPON ====
^ Tipo | SFU (Ethernet UNI: 1 \ VEIP: 1) |
^ Vendor ID | TPLG |
^ Version | v1.0 |
^ Equipment ID | XZ000-G7 |
^ OMCC Version | 160 (0xA0) |
^ Software Version (Main, example) | V0.1.0-3.0.0 |
^ Software Version (Standby, example) | V0.2.0-3.0.0 |

===== Bootlog =====

++++ Clique aqui para visualizar|

<code>

BOOT MODE: SPI-NOR

Boot from Offset 0: Done.


ddr init done!
controller locked!
4

U-Boot V1.2.3 (Apr 21 2023 - 16:06:13 +0800)

CPU:   Galachip 1601
Model: GC1601
DRAM:  32 MiB
*** Warning - default environment, using default environment

OK
In:    serial
Out:   serial
Err:   serial
Net:   eth0
Hit any key to stop autoboot:  0
Start Multicast upgrade detect...
LAN init sucessfully
Detecting multicast upgrade packets,wait=3000ms
Multicast Listening done!
SF: Detected en25qh32b(id: 0x1c7016) with page size 256 Bytes, erase size 64 KiB, total 4 MiB
Fix Flash size to FLASH_SIZE
[board/galachip1601/galachip_spi.c] do_boot: 746 do_boot will call do_spi_flash_autoboot
[board/galachip1601/galachip_spi.c] do_spi_flash_autoboot: 149 argv[1] is  41000000 ...,argc is 2 
[board/galachip1601/galachip_spi.c] do_spi_flash_autoboot: 152 addr is  41000000 ...
[board/galachip1601/galachip_spi.c] do_spi_flash_autoboot: 161 spiFlash->size is  400000 ...
[board/galachip1601/galachip_spi.c] do_spi_flash_autoboot: 168 after addr map_physmem  buf is  41000000 ...
[board/galachip1601/galachip_spi.c] do_spi_flash_autoboot: 210  spi_flash_read IMAGE_TAG offset is 20000	
[board/galachip1601/galachip_spi.c] do_spi_flash_autoboot: 215 IMAGE_TAG.kernelLen + sizeof(IMAGE_TAG) is 1422776

[board/galachip1601/galachip_spi.c] do_spi_flash_autoboot: 219 env_cmd is console=ttyS0,115200n8 root=/dev/mtdblock3 mtdparts=a0000000.ftspi020:4096k@0x0(whole),128k@0x0(uboot),1472k@0x20000(kernel),2304k@0x190000(rootfs),128k@0x3d0000(misc),64k@0x3f0000(hwconfig) init=/sbinOK
[common/bootm.c] do_bootm_states: 554 do_bootm_states will callbootm_find_os,argv[0] is 0x41000200 
[common/bootm.c] do_bootm_states: 554 do_bootm_states will callbootm_find_os,argv[0] is 0x41000200 

Starting kernel ...

Booting Linux on physical CPU 0x0
Linux version 3.16.0 (root@313cb039605f) (gcc version 4.9.4 (crosstool-NG 1.24.0) ) #1 PREEMPT Fri Apr 21 16:06:37 CST 2023
CPU: FA626TE [66056263] revision 3 (ARMv5TE), cr=0000397f
CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
Machine model: GC1601
Memory policy: Data cache writeback
DT missing boot CPU MPIDR[23:0], fall back to default cpu_logical_map
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 7104
Kernel command line: console=ttyS0,115200n8 root=/dev/mtdblock3 mtdparts=a0000000.ftspi020:4096k@0x0(whole),128k@0x0(uboot),1472k@0x20000(kernel),2304k@0x190000(rootfs),128k@0x3d0000(misc),64k@0x3f0000(hwconfig) init=/sbin/init mem=32M bootv=V1.2.3(04/21/2023-16:06:13) rootwait user_debug=0xff
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 24236K/28672K available (2776K kernel code, 175K rwdata, 812K rodata, 126K init, 149K bss, 4436K reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xffc00000 - 0xffe00000   (2048 kB)
    vmalloc : 0xc2800000 - 0xff000000   ( 968 MB)
    lowmem  : 0xc0000000 - 0xc2000000   (  32 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0008000 - 0xc038940c   (3590 kB)
      .init : 0xc038a000 - 0xc03a9818   ( 127 kB)
      .data : 0xc03aa000 - 0xc03d5fc0   ( 176 kB)
       .bss : 0xc03d5fcc - 0xc03fb4cc   ( 150 kB)
Preemptible hierarchical RCU implementation.
NR_IRQS:256
faraday,enable dying gasp
CPU: 533 MHz, DDR MCLK: 400 MHz, ACLK: 133 MHz, PCLK: 133 MHz SPICLK: 200 MHz
sched_clock: 32 bits at 133MHz, resolution 7ns, wraps every 32212254712ns
Calibrating delay loop... 530.84 BogoMIPS (lpj=2654208)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
Setting up static identity map for 0x402a45c8 - 0x402a4610
devtmpfs: initialized
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
Switched to clocksource fttmr010_clksrc
NET: Registered protocol family 2
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP: reno registered
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
futex hash table entries: 256 (order: -1, 3072 bytes)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 47
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
ftgpio010 90900000.gpio: Start ftgpio010.
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
console [ttyS0] disabled
90400000.serial: ttyS0 at MMIO 0x90400000 (irq = 12, base_baud = 2062500) is a 16550A
console [ttyS0] enabled
ftspi020 a0000000.ftspi020: ctrl reg 0x00000081, icr reg 0x00003302
ftspi020 a0000000.ftspi020: reg base 0xc2810000, irq 14, tx fifo 64 rx fifo 64
ftspi020 a0000000.ftspi020: tx transfer 256, rx transfer 256
ftspi020 a0000000.ftspi020: found en25qh32b, expected at25fs010
ftspi020 a0000000.ftspi020: en25qh32b (id: 0x1c7016, 4096 Kbytes)
ftspi020 a0000000.ftspi020: mtd .name = a0000000.ftspi020, .size = 0x400000 (4MiB), .erasesize = 0x00001000 (4KiB) .numeraseregions = 0
6 cmdlinepart partitions found on MTD device a0000000.ftspi020
Creating 6 MTD partitions on "a0000000.ftspi020":
0x000000000000-0x000000400000 : "whole"
0x000000000000-0x000000020000 : "uboot"
0x000000020000-0x000000190000 : "kernel"
0x000000190000-0x0000003d0000 : "rootfs"
0x0000003d0000-0x0000003f0000 : "misc"
0x0000003f0000-0x000000400000 : "hwconfig"
input: soc:sys-buttons as /devices/soc/soc:sys-buttons/input/input0
i2c /dev entries driver
hs = 0  burst = 0
ftiic010 90600000.i2c0: irq 2, mapped at c2812000, clk 133333333
ftwdt010 90800000.wdt: clkrate = 133333333  timeout =10  counter = 0x4f790d52
ftwdt010 90800000.wdt: start watchdog timer
ftwdt010 90800000.wdt: irq 13, mapped at c2814000, clk 133333333
ftwdt010 90800000.wdt: creat /proc/watchdog/gcwdt_status ok
ftwdt010 90800000.wdt: watchdog active, reset enabled, irq enabled
softdog: Software Watchdog Timer: 0.08 initialized. soft_noboot=0 soft_margin=60 sec soft_panic=0 (nowayout=0)
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (378 buckets, 1512 max)
ctnetlink v0.93: registering with nfnetlink.
nf_tables: (c) 2007-2009 Patrick McHardy <kaber@trash.net>
nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
xt_time: kernel timezone is -0000
ip_tables: (C) 2000-2006 Netfilter Core Team
arp_tables: (C) 2002 David S. Miller
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
8021q: 802.1Q VLAN Support v1.8
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
devtmpfs: mounted
Freeing unused kernel memory: 124K (c038a000 - c03a9000)
Register flash device: flash0
cp: can't stat '/usr/etc': No such file or directory
rcS (31): drop_caches: 3
ifconfig: SIOCSIFADDR: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: SIOCSIFMTU: No such device
/etc/init.d/rcS: /etc/init.d/rcS.galachip: line 12: can't create /proc/tso_lan/rule: nonexistent directory
interface eth0 does not exist!
interface eth1 does not exist!
interface pon does not exist!
ifconfig: SIOCSIFMTU: No such device
ifconfig: SIOCSIFMTU: No such device
ifconfig: SIOCSIFMTU: No such device
ifconfig: SIOCSIFMTU: No such device
ifconfig: SIOCSIFMTU: No such device
ifconfig: SIOCSIFMTU: No such device
ifconfig: SIOCSIFMTU: Invalid argument
drop_caches 3 
rcS (31): drop_caches: 3
change for  kernel panic reboot time
/etc/init.d/rcS: /etc/init.d/rcS.galachip: line 41: can't create /proc/sys/kernel/watchdog_thresh: nonexistent directory
rcS.sdk init done!
creat_domain_proc  ok
tp_domain init ok
cp: can't stat '/etc/cloud/cloud_service.cfg': No such file or directory
rcS init done!
==================gc rcs=====================
mount: mounting /proc on /proc failed: Device or resource busy
mount: mounting /sys on /sys failed: Device or resource busy
cp: can't stat '/opt/www/css': No such file or directory
mount: mounting tmpfs on /opt/www/css failed: No such file or directory
cp: can't stat '/tmp/css/*': No such file or directory
cp: can't stat '/opt/www/image': No such file or directory
mount: mounting tmpfs on /opt/www/image failed: No such file or directory
cp: can't stat '/tmp/image/*': No such file or directory
Run init.d/rcS!
[libgc Error][src/libgc_sys_api.c:120][libgc_sys_readMtdData]:Error open mtd 
[libgc Error][src/libgc_sys_api.c:413][libgc_sys_getImageHeader]:Read rootfs header fail
sys load success
bob:BOSA Chip Type: UX3320S.
bob:read data from /var/gc_bob.bin
mkdir: can't create directory '/dev/pts': File exists
mount: mounting devpts on /dev/pts failed: Device or resource busy
random: nonblocking pool is initialized
xpon_sdk 90c00000.xpon_sdk: register io begin 90c00000, with size 16777216
xpon_sdk 90c00000.xpon_sdk: map source to c3000000
xpon_sdk 90c00000.xpon_sdk: register io(mdio) begin 90c00000, with size 16777216
xpon_sdk 90c00000.xpon_sdk: map source to c2836000
xpon_sdk 90c00000.xpon_sdk: get platform irq 20
xpon_sdk 90c00000.xpon_sdk: get platform irq 18
xpon_sdk 90c00000.xpon_sdk: get platform irq 19
xpon_sdk 90c00000.xpon_sdk: get platform irq 21
xpon_sdk 90c00000.xpon_sdk: get platform irq 22
xpon_sdk 90c00000.xpon_sdk: get platform irq 23
xpon_sdk 90c00000.xpon_sdk: driver initialized with version 20012
xpon_sdk 90c00000.xpon_sdk: chip id 1
try to auto detect wan mode!

sdk_reserve_ddr_init(141) ddr buffer use 4079616
sdk_reserve_ddr_init(160) phys c4800000(virt 41c00000) map to dma 44800000
gpon move from O1 to O1

local_gpon_los_state_report(302) sdk_nl_send_event failed ret -22!
sdk_config_wandev_op(95) dev not exist!
chipset_epon_stack_sta_change(46) epon stack move from init to init
faraday_phy_init(257) got phy_dbg_reg 91400008
libphy: gala_mdio: probed
SC PLL lock as gpon!
Serdes PHY Ready!
local_gpon_los_state_report(302) sdk_nl_send_event failed ret -22!
wan_state_change_notify(69) sdk_nl_send_event failed ret -22!
wan_state_change_notify(72) report wan state changed!
gcnet: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Net Device 1.0.0 Init
Net Device Init Success!
Pon Mapping 1.0.0 Init
Pon Mapping 1.0.0 Init Success!
==================S10ethernet=====================
device br0 already exists; can't create bridge with the same name
device eth0 entered promiscuous mode
device eth0.0 entered promiscuous mode
device pon0 entered promiscuous mode
device pon0.0 entered promiscuous mode
br0: port 2(pon0.0) entered forwarding state
br0: port 2(pon0.0) entered forwarding state
br0: port 1(eth0.0) entered forwarding state
br0: port 1(eth0.0) entered forwarding state
==================for omci/oam=====================
bind to group 0!
br0: port 1(eth0.0) entered disabled state
/etc/init.d/rcS: line 269: mini_httpd: not found
=================cos init after sdk init=====
=================disable button func in gcs=====
sys button success

Please press Enter to activate this console. insmod: can't insert '/lib/modules/3.16.0/extra/gcponmap.ko': File exists
killall: gcwatchdog: no process killed
killall: gchwdog: no process killed
/bin/sh: gcwatchdog: not found
/bin/sh: igmpd: not found
hello world! This is gc_omcid.
skip_fdb_ageing=0
set ageing time=300s
[libgc Error][src/libgc_switch_api.c:33][libgc_switch_ioctl]:ioctl fail cmd = 1074024964  subCmd=2 ret=-1
/bin/sh: ip: not found
add wan info index 0
/bin/sh: /sbin/dnsmasq: not found
Interface name length cannot exceed 15 characters.
[ dm_readFile ] 2308 - ERROR:  can not open xml file /var/tmp/pc/reduced_data_model.xml!, about to open file /etc/reduced_data_model.xml
[ dm_postHook ] 942 - ERROR:  X_TP_ConfigVersion 5a000002, X_TP_DMVersion 5a000002
[ cos_init ] 498 - ERROR:  Disable gpon driver before true SN set

/bin/sh: can't create /proc/gpon/debug: nonexistent directory
[ waitOmciInit ] 239 - ERROR:  COS wait for OMCI init...

[ cos_init ] 535 - ERROR:  ======no will kill some app============

[ cos_init ] 574 - ERROR:  ======no will kill some app2============

[ oal_sys_readMacFlash ] 5060 - ERROR:  pMac is XX:XX:XX:XX:XX:XX

[ rsl_initDevInfo ] 1517:  === softwareVersion 0.1.0 3.0.0 v6099.0 Build 230421 Rel.58646n ===
[ rsl_initDevInfo ] 1544:  === hardwareVersion XZ000-G7 v1.0 00000000 ===
[ oal_sys_readMacFlash ] 5060 - ERROR:  pMac is XX:XX:XX:XX:XX:XX

/bin/sh: ntpc: not found
[ dm_shmInit ] 101 - ERROR:  shared memory already exist.
/bin/sh: dnsProxy: not found
killall: dnsmasq: no process killed
/bin/sh: dnsmasq: not found
tx omci too small 
 ptr:c155f700:
72 65 67 69 73 74 65 72 

bind to group 0!
[ rsl_time_ntpStart ] 417:  Current dns svr: 
[ oal_sys_getOldTZInfo ] 2443 - ERROR:  Open TZ file error!
[ rsl_time_ntpStart ] 417:  Current dns svr: 
/bin/sh: dhcpc: not found
device br0 already exists; can't create bridge with the same name
iptables: Bad rule (does a matching rule exist in that chain?).
[ oal_sys_readMacFlash ] 5060 - ERROR:  pMac is XX:XX:XX:XX:XX:XX

before send out event 677, gcs_task gcs_task, msqid 163845, pid227=============================
/bin/sh: radvd: not found
[ rsl_setUpDev2BridgePortObj ] 796:  eth0.0 isWanConn=0 moveIntfToBr0=0 br0
device eth0.0 is already a member of a bridge; can't enslave it to bridge br0.
[ util_getObjFromFullpath ] 1327 - ERROR:  Failed to get object from fullPath, because oid is not equal.
[ ethLink_isLowLayerWithSameIfname ] 394:  perror:1
[libgc Error][src/libgc_sys_api.c:120][libgc_sys_readMtdData]:Error open mtd 
[libgc Error][src/libgc_sys_api.c:413][libgc_sys_getImageHeader]:Read rootfs header fail
[1451606425.689]gcomci: wrapperInitUpgradeFile()#196 omci upgrade file is not exist

[1451606425.689]gcomci: wrapperInitUpgradeFile()#199 create file fail
[1451606425.689]gcomci: gcOmciMe_callback_autoCreat_softwareimage()#357 Init Upgrade File Fail
[1451606425.691]gcomci: gcOmciMe_callback_autoCreat_softwareimage()#367 activeImage:0,commitImage:0,version:V0.1.0-3.0.0

[ dm_getParamValue ] 1298 - ERROR:  Get instance description failed. object name = Interface
[ rsl_buildAdtWanMapList ] 8443:  perror:9805
[ rsl_adt_syncWanObj ] 9362:  perror:9805
[ rsl_adt_syncObj ] 498 - ERROR:  Failed to sync DEV2_ADT_WAN
[ oal_util_setProcLanAddr ] 312 - ERROR:  ip_conntrack module is not loaded, or we did not open the CONFIG_NF_CT_LOCAL_LIMIT_ENTRY

[ stat_setsockopt ] 217 - ERROR:  statSetsockopt: 262 opt error

[ oal_stat_addNetInfo ] 768 - ERROR:  Failed to call stat_setsockopt
[ oal_ip6_getIntfAddr ] 398 - ERROR:  Can't find interface: br0
iptables: Bad rule (does a matching rule exist in that chain?).
/bin/sh: radvd: not found
sendto: No such file or directory
line(593) Msg.type(2030) pid(232) errno(2) ret(-1)
sendto: No such file or directory
line(593) Msg.type(2030) pid(232) errno(2) ret(-1)
[1451606426.897]gcomci: main()#414 ready to receive omci message!!!

iptables: Bad rule (does a matching rule exist in that chain?).
[ dm_getObj ] 743 - ERROR:  Get instance description failed. object name = Interface
[ dm_getObj ] 744:  1#6
[ rsl_getObj ] 1315:  perror:9805
[ rsl_intfStack_getIfNameFromLoLayers ] 559:  perror:9805
[ ethLink_createParam ] 609 - ERROR:  Failed to get intfName from lowerLayer(Device.Ethernet.Interface.6.) path, ret(9805).
[ rsl_initDev2EthLinkObj ] 1676 - ERROR:  Failed to create the parameter for EthLink obj, ret(9805).
[ dm_getObj ] 743 - ERROR:  Get instance description failed. object name = Interface
[ dm_getObj ] 744:  1#6
[ rsl_getObj ] 1315:  perror:9805
[ rsl_intfStack_getIfNameFromLoLayers ] 559:  perror:9805
[ ethLink_createParam ] 609 - ERROR:  Failed to get intfName from lowerLayer(Device.Ethernet.Interface.6.) path, ret(9805).
[ rsl_initDev2EthLinkObj ] 1676 - ERROR:  Failed to create the parameter for EthLink obj, ret(9805).
[ rsl_initDev2GponAuthCtc ] 1064 - ERROR:  Init loid tplink passwd tplink

/bin/sh: upnpd: not found
[ stat_setsockopt ] 217 - ERROR:  statSetsockopt: 257 opt error

[ rsl_setObj ] 1476:  perror:4510
[ rsl_initDev2StatCfgObj ] 208:  perror:4510
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_ftp.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_nat_ftp.ko': No such file or directory
iptables: Bad rule (does a matching rule exist in that chain?).
insmod: can't insert '/lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_proto_gre.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_pptp.ko': No such file or directory
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_tftp.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_nat_tftp.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_h323.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_h323.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_rtsp.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/ipv4/netfilter/nf_nat_rtsp.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_conntrack_sip.ko': No such file or directory
insmod: can't insert '/lib/modules/kmdir/kernel/net/netfilter/nf_nat_sip.ko': No such file or directory
ip6tables: Too many links.
iptables: Bad rule (does a matching rule exist in that chain?).
killall: gcwatchdog: no process killed
killall: gchwdog: no process killed
/bin/sh: gcwatchdog: not found
xmlShm init success.
gcloop_detect_debug=0x4
[main:671]: xmlShm init success.

destMac Broadcast, etherType 0x880a, interv time: 1000, closing time 60,loopBackEnable 1, alarmEnable 1, portDisloopEnable 1,vlanTag untagged
iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
[ dm_getObj ] 743 - ERROR:  Get instance description failed. object name = Chain
[ dm_getObj ] 744:  1#4
[ refreshChainRules ] 915 - ERROR:  get chain from dm failed. errno 9805.
[ rsl_initDev2FirewallObj ] 2477 - ERROR:  init port filtering failed. errno 9805.
[ rdp_init ] 462 - ERROR:  ======rsl_initEnd no will kill some app============

killall: upnpd: no process killed
killall: igmpd: no process killed
killall: ntpc: no process killed
killall: dnsProxy: no process killed
sh (806): drop_caches: 3
[ rdp_init ] 476 - ERROR:  ======kill end ============

/bin/sh: can't create /proc/tplink/eth_forward: nonexistent directory
/bin/sh: ethphxcmd: not found
/bin/sh: ethphxcmd: not found
/bin/sh: ethphxcmd: not found
/bin/sh: ethphxcmd: not found
/bin/sh: ethphxcmd: not found
/bin/sh: ethphxcmd: not found
[ cos_init ] 579 - ERROR:  ======no will kill some app3============

/bin/sh: can't create /proc/pon_phy/debug: nonexistent directory
/bin/sh: can't create /proc/ux3320s/debug: nonexistent directory
sh: write error: Invalid argument
sh: write error: Invalid argument
sh: write error: Invalid argument
sh: write error: Invalid argument
sh: write error: Invalid argument
</code>

++++

===== Configurações =====

<WRAP center round important 80%>
É de sua total responsabilidade o uso e implicações que utilizar equipamentos não fornecidos ou homologados pelo ISP podem causar.
</WRAP>

==== Superadmin ====

Há a possibilidade de criar um usuário "superadmin" com acesso a alguns (poucos) itens extras na configuração via web e um nível de acesso acima no CLI via //telnet// (que também é bastante limitado).

Para criá-lo, a senha inicial para o usuário normal **não** pode ter sido criada ainda, que é normalmente solicitada ao ligar o aparelho pela primeira vez ou realizar um //factory reset// e acessar a interface web pelo IP padrão.

Portanto:

  * Realize um //factory reset// (pressione o botão //reset// traseiro por alguns segundos)
  * Acesse a interface web através da seguinte URL:
    * http://192.168.1.1/superadmin
  * Defina a senha do //superadmin// e confirme.

Agora, basta visitar a URL raiz ( http://192.168.1.1 ) para definir a senha do usuário normal. Caso esteja logado como //superadmin//, será necessário fazer //Logout// primeiro.

Utilize as URL específicas com suas respectivas senhas criadas anteriormente para acessar a interface como cada usuário.
  * Normal///user// - http://192.168.1.1
  * //Superadmin// - http://192.168.1.1/superadmin

===== Bugs, dicas e notas =====

  * Alguns dos utilitários mais importantes para configurar o aparelho via //telnet/shell// são:
    * gccli
    * gc_omcicli
    * gcsUtil
  * Por padrão, a saída de vários comandos (como o gc_omcicli) é direcionada para a UART/serial do aparelho. Para redirecionar a saída para a sessão atual - telnet, por exemplo - execute antes:

  gccli consoleRedir on

  * Após o comando acima, algumas consultas úteis podem ser feitas, ex:

  gc_omcicli mib get 84
  gc_omcicli mib get 171
  gc_omcicli stats dump

  * Curiosidade: o aparelho aparentemente suporta as (algumas?) extensões proprietárias da Huawei, portanto ele deve funcionar em locais com OLT Huawei que exigem estas extensões. Veja:

  gc_omcicli mib get 350
  gc_omcicli mib get 370
  gc_omcicli mib get 373



===== Firmwares =====

==== Stock ====

Versões oficiais e não modificadas para o aparelho. São de propriedade do fabricante - que detém todos os direitos sobre elas - e mantidas aqui apenas em caráter de arquivamento e espelhamento, podendo ser removidas caso solicitado pelos representantes oficiais da empresa.

Para versões mais recentes ou não listadas aqui, consultar o site oficial: [[https://anon.to/?https://www.tp-link.com/br/support/download/xz000-g7/v1/|TP-Link]]
==== Custom ====

<WRAP center round important 80%>
Todas as versões custom são testadas localmente ao máximo possível, porém seu uso e possíveis implicações são de total responsabilidade do proprietário do aparelho. Não atualize o aparelho sem necessidade; só atualize o aparelho para as versões custom se confirmado que precise das alterações listadas.

Os arquivos produzidos pelo O3 Labs são assinados para garantir sua integridade e procedência. Para instruções de como validar as assinaturas, [[about:signing|acesse aqui]].
</WRAP>

Versões modificadas com correções e/ou melhorias, baseadas em //releases// oficiais/stock. As versões são cumulativas, ou seja, a mais recente sempre contém também todas as modificações das versões anteriores.

É possível atualizar entre versões custom ou stock sem nenhum problema. Note que saltos na versão base podem incluir ou remover parâmetros de configuração, portanto é aconselhável um //factory reset// após realizar tais atualizações. Adicionalmente, efetue estes procedimentos com a fibra **desconectada** do aparelho.

Caso a versão base continue a mesma de uma versão custom para a outra, não é necessário o //factory reset//, salvo se solicitado explicitamente na descrição.

=== 1.0 ===

  * Baseada no release oficial XZ000-G7(BR)_V1_Build 230927
  * Substitui o utilitário restrito //cli// pelo shell //sh// quando o aparelho é acessado via //telnet//. O utilitário pode ser acessado novamente se necessário executando "//cli//" a partir do shell, logando com a senha cadastrada via web (do //admin// ou //superadmin//, dependendo de qual tenha criado). Para as credenciais via //telnet//, agora são:
    * root / root
  * Em [[#bugs_dicas_e_notas|Bugs, dicas e notas]] há alguns comandos agora disponíveis com o acesso //shell//.

[[https://tripleoxygen.net/files/devices/tplink/xz000-g7-br-v1/firmware/custom/XZ000-G7_UP_BOOT_2023-09-27_09.09.37_v1.0.bin|XZ000-G7_UP_BOOT_2023-09-27_09.09.37_v1.0.bin]]\\ [[https://tripleoxygen.net/files/devices/tplink/xz000-g7-br-v1/firmware/custom/XZ000-G7_UP_BOOT_2023-09-27_09.09.37_v1.0.bin.minisig|XZ000-G7_UP_BOOT_2023-09-27_09.09.37_v1.0.bin.minisig]]
===== Agradecimentos =====

Pessoas envolvidas em arquivos, discussões, dicas, doações ou bate papo em geral. Lista em ordem alfabética.

<code>skullao</code>