ECCO come fare l'HARDWARE RESET di un modem IPM DATACOM SPEEDWEB ADSL ETHERNET, FINALMENTE

176 visualizzazioni
Passa al primo messaggio da leggere

asbesto

da leggere,
6 nov 2003, 13:08:0506/11/03
a
POETRY MINI-HOWTO - SPEEDWEB HACK version 0.2 - nov 6 18:01:27 UTC 2003


COME RESETTARE VIA HARDWARE UN MODEM/ROUTER ADSL IPM DATACOM SPEEDWEB
ADSL ETHERNET, ALTRIMENTI CONOSCIUTO COME SOLWISE SAR-110

(this document is in spaghetti-english language :)

HOW TO HARDWARE RESET A LOCKED/BROKEN IPM DATACOM SPEEDWEB ADSL ETHERNET,
ALSO KNOWN AS SOLWISE SAR-110

by asbesto of FreakNet MediaLab
asbesto AT freaknet DOT org
http://www.freaknet.org
========================================================================

The IPM DATACOM SPEEDWEB ADSL Ethernet it's an ADSL modem/router
normally shipped with Telecom Italia Alice ADSL. I have purchased
one of these, to try as a modem/router for cheap, on Ebay; it's
know as SOLWISE SAR-110, as the one we have here. It's identical :)

This modem is a little delicate - especially when playing with some
console commands. So i did, obtaining a locked modem!!!

I just added a Routing command forwarding packet from LOCAL interface
to itself. As a result, the modem will be UNUSABLE; i obtained ALL
LED ON (PWR, ADSL, PC, TX/RX and DIAG). Connecting to console
will give the modem booting normally, with checksum ok, but the modem
will FROZE ITSELF printing the "***********" of the "Welcome to Titanium"
greeting.

No way to recover ! I wasn't able to reach it by web admin interface,
nor via console.

SO, i searched the web for a way to hardware-reset my adsl modem/router,
but i find NOTHING but messages of other people searching the same kind
of information.

The SOLWISE documentation say clearly:

----------------------------------------------------------------------
Please Note: Incorrect usage of CLI commands can seriously damage the
firmware settings and configuration of your router to the extent where you
might be unable to reset/restore to an operable state.
We reserve the right to charge for any faulty router
returned for repair which has user corrupted firmware or settings.
----------------------------------------------------------------------

It seem evident that the only traditional solution to this problem
is to return the device back to Solwise, so they can "restore" it.

That's mean, you have to pay MONEY, MONEY, MONEY.

So, we have another zyxel router; ok, i will try to open the
IPM DATACOM/SOLWISE and try to reset by myself.

... and i was WINNER !!! :))))

Here is the complete procedure for our modem.

----------------------------------------------------------------------
PLEASE NOTE THAT I'M NOT RESPONSIBLE FOR FAULTS, DAMAGES OR ANYTHING
OCCURRING IF YOU FOLLOW THIS PROCEDURE. DON'T DO IT, IT'S A RISK. I WARNED
YOU. PROBABLY, IF YOU OBTAINED YOUR ADSL MODEM FROM YOUR ISP, YOU *CAN'T*
OPEN IT; JUST RETURN IT TO YOUR ISP AND THEY WILL CHANGE IT FOR FREE (ALL
MAJOR ISP CHANGE FOR FREE THE ADSL MODEM THEY GIVE)
----------------------------------------------------------------------

Open the router. On the board, you can see a connector named J1; an ascii
image will follow; We're particulary interested in pin 2 and 3 of this
connector :)))

SEMPLIFIED ASCII IMAGE of the CIRCUIT BOARD:
(i omitted chips and connector. this is the board seen from top,
component side)


| 6 . |
| 5 . |
| 4 . |
| 3 . |
| 2 . |
| 1 . |
| j1 |
| o o o o o |
------------------------------------------------------------
pwr adsl pc tx/rx diag


j1: I don't remember if there are 6 or 5 pin, but, who care? we're
interested only in pin 2 and 3. I started numbering pins from the
front of the circuit, so pin 1 it the pin near the led side, and
pin 6 is the led near the back side of the board, where the
connectors are located.


Set your serial port to 38400 bps, 8n1, and connect a cable to the
console port of the router.

NOW, turning on the unit, you have to jumper the 2 and the 3 pin on the
connector EXACTLY when you see "Testing APPCODE Checksum" on the serial
console. This will start the "EMAC Driver" that enable the TFTP upload
of a new firmware, as you can see here:

--------------------------------------------------
Starting POST - V1.9
SDRAM ... Passed
Loader Checksum ... Passed
Loader (V1.96) Self-Extracting ... Done
Decompressing UMON (V1.5) ... Done/Activated
Flash AT45DB161 (Capacity=2112K, PageSize=528, TotalPages=4096)
Testing FILESYS Checksum ... Passed
Testing DSLCODE Checksum ... Passed
Testing APPCODE Checksum ... Failed (expected=AF47A286, actual=FB8509BD) ...
EMAC Driver 1.7 (AutoNego...100BT) MAC Address: FF-FF-FF-FF-FF-FF
TFTP/GMON Server Started ... Load image/code to 192.168.1.1
--------------------------------------------------

the "Failed" will be printed on terminal when you put the jumper
on pin 2 and 3. Some led on the modem/router will start flashing
(i don't remember what, sorry :)

OK - now you can use your favourite TFTP client, to upload the
binary image and give a new life to your router :)

You can find ROM images here: http://ipmethernet4all.tk/

You have to connect an ethernet cable between your computer and the
IPM router; set your ethernet interface to any address different from
192.168.1.1 (for example, set it to 192.168.1.22). Now you can put
the new binary image to the IPM router, with your tftp client:

----example using linux and BSD tftp port---------
asbesto@gemini ipm $ tftp
tftp> connect 192.168.1.1
tftp> bin
tftp> put TEImage.bin
Sent 1799424 bytes in 59.5 seconds
tftp> quit
asbesto@gemini ipm $
--------------------------------------------------

after a minute, you will see in the terminal console something like this:

--------------------------------------------------
TFTP Server is loading "TEImage.bin" ... Done.
--------------------------------------------------

When the transfer has finished, the LINK, TX/RX and DIAG led will
flash slowly. Now, turn OFF and ON your router, so it can
restart with the new binary flashed image, as in the example
that follow (in this example, we have flashed the latest Solwise
version dated 17-06-03):

----------------------------------------------------------------
Starting POST - V1.9
SDRAM ... Passed
Loader Checksum ... Passed
Loader (V1.96) Self-Extracting ... Done
Decompressing UMON (V1.5) ... Done/Activated
Flash AT45DB161 (Capacity=2112K, PageSize=528, TotalPages=4096)
First time boot up, verifying flash device checksums ...
CFG1: 49632 : Checksum Passed (00000323) ...
CFG2: 49632 : Checksum Passed (000002F8) ...
ALRM: 8448 : Checksum Passed (000002F6) ...
DHCP: 66000 : Checksum Passed (00000356) ...
FACT: 16384 : Checksum Passed (0007F6D5) ...
MANU: 4096 : Checksum Passed (000044D9) ...
BOOT: 4096 : Checksum Passed (E55263D6) ...
LOAD: 76032 : Checksum Passed (02AE3271) ...
FILE: 232848 : Checksum Passed (01BDC7DC) ...
DSLC: 70224 : Checksum Passed (212F4DB2) ...
APPC: 1145232 : Checksum Passed (8A590054) ...
PASSED ...

Decompressing "TEAppl.gsz" (1144122->3277768) ... Done

Text Segment Size = 3018112 bytes
Data Segment Size = 259656 bytes
Bss Segment Size = 1913000 bytes
System Stack Size = 16536 bytes
HISR Stack Size = 16536 bytes
NetBuffer Pool Size= 710512 bytes
System Memory Size = 2104248 bytes
Start of DSPText = 207aa8d0 bytes
Decompressing "TEDSL.gsz" (68991->154832) ... Done
UnTar File System
....\..\.\.\..\..\.\....................\..........\......\..

Config size = 94, DHCP size = 125
Normal Execution Mode

CfgInit: System Coming up from Default Configuration
*******************
Welcome to Titanium
*******************

GlobespanVirata Inc., Software Release VIK-1.38.030331e
Copyright (c) 2001-2002 by GlobespanVirata, Inc.

$
Thu Jan 01 00:00:03 1970 : STATUS ALARM : System Up

$
-----------------------------------------------------------------

THAT'S ALL, FOLKS! :)))

Note: a more complete version of this document, with images and
a mirror of all needed files and PDF manuals, will come shortly.
Check on http://www.freaknet.org/research for it ! :)

Tnx to: r4m / morpheus / google groups / _lobo / freaknet

[ it's a FREAKNET MEDIALAB PRODUCTION! http://www.freaknet.org ]

Marco d'Itri

da leggere,
6 nov 2003, 16:28:0506/11/03
a
asb...@mail.ru wrote:

>Decompressing "TEDSL.gsz" (68991->154832) ... Done
>UnTar File System
>....\..\.\.\..\..\.\....................\..........\......\..

Bel lavoro... ma vorrai dirmi che non hai ancora cercado di estrarre il
file system dall'immagine del firmware? :-)

--
ciao,
Marco

Giacomo D'Orsogna [Giako]

da leggere,
6 nov 2003, 17:52:4106/11/03
a

"asbesto" <asb...@mail.ru> ha scritto nel messaggio
news:e1853eb3.03110...@posting.google.com...

> POETRY MINI-HOWTO - SPEEDWEB HACK version 0.2 - nov 6 18:01:27 UTC 2003
>
>
> COME RESETTARE VIA HARDWARE UN MODEM/ROUTER ADSL IPM DATACOM SPEEDWEB
> ADSL ETHERNET, ALTRIMENTI CONOSCIUTO COME SOLWISE SAR-110

Esiste una procedura software per entrare nella "modalità di attesa
firmware". Cmq, affinchè si sappia quei 6 pin (che diventano 7
sull'ericsson) dovrebbero servire per effettuare (devo capire ancora come)
un upgrade via parallela...in questo caso la conditio sine equa non è
semplicemente che il router si accenda....non si necessita di indirizzi,
settaggi e madonne varie. Appena avrò tempo, quindi non prima di fine mese
mi dedicherò a questa sperimentazione. Se qualcuno intanto ha
un'illuminazione ne possiamo parlare.

Il problema del cortocircuitare i pin è che NON tutti i router fritti
arrivano a riconoscere un errore di checksum, o generico nel firmware, e in
quel caso la seriale resta muta....e non so se sia possibile upgradare o
meno. Sarebbe carino provare....


--
---
Giacomo D'Orsogna
E-Mail: dors...@iol.it
Web: www.dorsogna.tk
Icq#: 36225050


Barts

da leggere,
7 nov 2003, 11:24:0207/11/03
a
Vuoi dirmi che posso resettare il mio hm210dp fritto a causa di una errato
aggiornamento del firmware???

--

questo articolo e` stato inviato via web dal servizio gratuito
http://www.newsland.it/news segnala gli abusi ad ab...@newsland.it


Rispondi a tutti
Rispondi all'autore
Inoltra
0 nuovi messaggi