Arcadyan Aw1000 Manual

[Pernille Pennebaker]

Irecently got Telstra 5G Home Internet and along with that came an Arcadyan AW1000. I have noticed a few things about the modem and the service so I figured I would list what I have found so far. I would like to unlock some more features but I don't really know what I'm doing. My hope is that maybe people smarter than me may find some cool things to do with this modem.

1) If you can't order the service because Telstra says it's not available at your address, but you know you get fine 5G coverage, you may want to check addresses closer to your phone tower, if you find an eligible address you can then move there. As a side note, the online order form asks if you want a different billing/shipping address to the service address ;)

2) Telstra say the service is geo-locked, for me at least, this doesn't appear to be the case (yet). I was able to drive through multiple towns and have it work like any other 4G/5G service. The speeds I was getting were similar to what my iPhone could get.

3) It's 12v so it can be run from a battery easily. When testing it I have been running it from a USB-C power bank, I made a cable that plugs into the modem and has a USB-C PD spoof IC on the other end, the IC asks the power bank to provide 12v. In general, it uses about 1-2a @ 12v while I was using it for testing, as in not a house full of devices connected to it.

4) Serial console can be added with a little soldering and a 3.3v RS232 adapter. If you hit Esc while booting you get access to its boot menu. If you let it boot normally you get access to the console but it asks for an unknown username/password.

5) It has 2x SMA Female antenna jacks on the back. I have pulled the modem apart and looked at the cellular antennas / SMA jacks. The SMA jacks are connected inline with an internal antenna each, there is no way in software that I can think of for the modem to select between external and internal antennas. The modem has 6 internal cellular antennas. I think 3 are for 5G, 2 are for 4G and one of them I don't know what it does. My testing makes me think that the bottom SMA port is for 4G and the top port is for 5G, both need to be connected for it to work properly.

6) You are behind CGNAT but get IPv6, the modems Web-UI gives you the option of remotely accessing the Web-UI however the option is greyed out when using cellular. I was able to change my internet to ethernet, turn on the setting, and go back to cellular. I could then remotely access the Web-UI using IPv6.

7) You can backup settings, the backed-up settings are a .cfg file, this is really an archive. I was able to open it with 7-Zip. Inside the archive, there is an unencrypted file that can be opened in a text editor. This may be of some fun to look into.

8) 5G, in general, is super directional a lot of signal strength doesn't mean you're getting the fastest speed available. In a few tests, I found that having the modem (or my iPhone for that matter) in my car, parked out front of the phone tower can get around 300Mbps, moving about 20m down the road away from the tower I found a spot getting over 700mbps. At home, on the window sill, I gained over 100mbps by finding the best way to have the modem face.

-------------------Getting Root Access-------------------

Connect UART

During boot, the option for failsafe boot appears for about a second.

When seeing this option push [F] then hit [ENTER]

In the failsafe boot menu type the following commands

I have now come up with 2 methods to get root on the modem. One method requires just a Windows PC, the other requires UART access. Both methods will give SSH access, change the root password to root, and enable LuCI at :8080

The only way from now is to try to interrupt the boot process with F key or ESC or Ctrl + C to see if that can give you a shell without the need for a root password. If the bootloader is patched that does not have this vulnerability then the next step would be to dump the firmware to see the hashed password in shadow file located in /etc. then try to crack it. the chance will be slim to be able to crack it within a reasonable timeframe.

reboot the router, then in browser, access :3000

change dns port number to 54 as you set above in file dhcp

set up the password for AdGuardhome. keep going for next step as indicated.

all done

I haven't got very far with the lxc container yet. I am more familiar with docker. I still need to keep working on lxc.

will update later regarding progress.

what else could it be good for?

I already have AdGuardhome running. good enough for now I guess. aria2 downloader can be considered next.

you can install basic packages such as htop, nano, luci by opkg update && opkg install luci nano htop

but this openwrt version is a very basic one.

I personally recommend lean's version with more features and build in plugins and apps to run it as a virtual one-armed router to utilise it's functions.

Is there a way to setup QoS with this router natively? If not, is there a way to bridge the damn thing so I can use a competent router? We're able to manually access the bridging page, but it seems like it's hard locked to off in the firmware or something

Okay so I've actually looked into the interfaces screen, and there is straight up no interface for the LTE/5G WAN connection now. Maybe I'm missing something, but all I did was restart the modem! What the hell, Telstra?!

The firmware update probably updated both the router and the 5g modem firmware. I am assuming either the firmware update in the 5g modem failed so it went into diagnostic mode, or the router put the modem into diagnostics mode to do the firmware update and it didn't end up asking the modem to come out of it. Either way probably not a hell of a lot u can do except ask Telstra to replace it.

One thing that could work maybe (prob not) is to try letting the router half boot then quickly unplug and replug power, then let it half boot again then again unplug and replug. try doing that a few times, sometimes if a modem fails to boot it will load a backup firmware. so I guess it's worth a try to maybe kick the 5g modem back into a normal boot. This is the type of thing I'm trying to explain...

I gave the half boot method a crack (btw I love your succinct videos, your video taking the 5G modem apart was part of the reason I decided to give Telstra 5G a shot) and I reckon it might actually work, it's just hard without being able to see the serial of the boot activity.

Many many hours and a very helpful lady in a local Telstra call centre and they could only come up with cancelling my faulty service and recreating a new one for me. With 1 month free and free Disney plus. They of course then threatened me by billing me for the already returned faulty modem.

It seems like it's a new enough/small enough service to them that they're still having teething issues when it comes to support. Doesn't excuse it, but I can understand the frustration of the support people who rarely deal with 5G issues.

Unfortunately, I don't have any access to any firmware. You could try to get the serial console and have a look, however, because it is the serial of the router and not the 5G modem it may not be of any help. (you will need a device like this -compatible-usb-to-serial-adaptor-module/p/XC4464). Another temp option is to put the SIM card in another modem. For this to work you need to change the new modem IMEI to that of the Telstra 5G modem.

On another note, just thought I'd update regarding my situation for anyone in a similar boat. I called and called and called Telstra searching for a solution to my bricked device. I even went to a Telstra store and emailed the dev team at Telstra for a firmware. No responses, a bunch of empty promises, and no support.

So to anyone who has similar issues: do not freaking bother asking for a replacement. Telstra has basically no system in place to issue replacements or to send a tech to your house. Just order a new service completely and cancel your other one (returning the device when they tell you to). It's COMPLETELY backwards, but it's how it is.

For those of us who don't yet have this modem and are considering the Telstra 5G service which bundles this modem/router , would it be possible to post screen captures or PDF saves from every page listed above and post it in a public area online and are all of these links accessible using the default configuration shipped from Telstra or do you need to unlock the modem using the earlier described reverse engineering steps?

From my experience, these pages are accessible with the default configuration. However, I have not found much use for these pages as some of them don't even do anything. I can post screen captures in a few days when I'm not so busy, but I can tell you pages like " " load no problem, but changing any setting doesn't actually do anything with the router/modem.

What I would suggest anyone do is instead install the config uploaded by azzaboy18 in order to gain root access. From there you can tinker with the openWRT directly, which is way easier and better than these pages dumped from the firmware.

However my two CCTV cameras both worked fine within the wifi Lan created by the Telstra wifi modem and I could access them within the Lan or out and about on the mobile network away from the house. Similarly when I connected the cctv cameras to my portable 4G wifi modem, I could access them within and outside that portable 4G wifi modem, including being able to access them from with the Telstra 5G Arcadian wifi Lan.

Not really hacking but something interesting that isn't advertised:

Just thought I'd share my exciting findings for the Arcadyan AW1000 (Aka Telstra 5G Home Modem). I decided to trial 5G as a NBN replacement but was worried about the 5G modem not having the coverage. When mucking around bridging my Telstra Smart Modem Gen 3 I discovered that the AW1000 supports the EasyMesh Telstra Wifi Boosters Gen 3! Not advertised as supporting the boosters but seems to be working for me!

3a8082e126