diff --git a/_gpon/vendor.md b/_gpon/vendor.md index 54b0e763..59953e8d 100644 --- a/_gpon/vendor.md +++ b/_gpon/vendor.md @@ -19,8 +19,10 @@ Here is a list of the most popular Vendor IDs: | `ALLG` | `414c4c47` | ALLNET | | `AVMG` | `41564d47` | AVM (FRITZ!Box) | | `ASKY` | `41534b59` | Askey | +| `CDAT` | `43444154` | C-Data | | `CDKT` | `43444B54` | KingType | | `CIGG` | `43494747` | Cig | +| `CMDT` | `434d4454` | Comtrend | | `CXNK` | `43584e4b` | Calix | | `DDKT` | `44444b54` | DKT | | `DLNK` | `444c4e4b` | Dlink | @@ -53,6 +55,7 @@ Here is a list of the most popular Vendor IDs: | `SKYW` | `534b5957` | Skyworth | | `SMBS` | `534d4253` | Sagemcom | | `SPGA` | `53504741` | SourcePhotonics | +| `TDTC` | `54445443` | Tenda | | `TMBB` | `544d4242` | Technicolor | | `TPLG` | `54504c47` | TP-Link | | `UBNT` | `55424e54` | Ubiquiti | diff --git a/_ont/ont-comtrend-grg-4284.md b/_ont/ont-comtrend-grg-4284.md new file mode 100644 index 00000000..3d6579e8 --- /dev/null +++ b/_ont/ont-comtrend-grg-4284.md @@ -0,0 +1,107 @@ +--- +title: Comtrend GRG-4284 +has_children: false +layout: default +parent: Comtrend +--- + +| | | +| --------------- | -------------------------------------------------------------------------- | +| Vendor/Brand | Comtrend | +| Model | GRG-4284 | +| ODM | Unknown | +| CPU | Realtek RTL9601D | +| DRAM | 32 MB | +| Flash Size | 16 MB | +| CPU Arch | MIPSBE Realtek Lexra | +| CPU Clock | 300MHz | +| Bootloader | U-Boot RSDK 2011 | +| System | Linux 3.10 | +| Optics | SC/APC | +| IP address | 192.168.1.1/24 | +| Web Gui | ✅ | +| SSH | ✅ | +| Telnet | ✅ | +| FTP | ✅ | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +## Hardware Revisions + +- V1.0 +# External/Internal Photo + +{% include image.html file="comtrend_grg-4284_teardown_1.jpg" alt="Comtrend GRG-4284 PCB" caption="Comtrend GRG-4284 PCB" %} + +## List of software versions + +- CTN-1.0.2b51 (Cetin) +- CTN-1.1.4b6 (Cetin) + +{% include_relative ont-luna-sdk-useful-commands.md + flash='flash' + ploam='asciiAndHex' +%} + +## Unlocking full shell +Although the option to enter linux shell is displayed in help command, it silently fails until per-firmware password is provided. + +This string is stored plaintext and hardcoded into `/bin/cli` and can be easily dumped. + +```sh +# Example commands for firmware CTN-1.1.4b6 +version --debug 23KcykMddk +factorymode --password y0S4QbPhAD96GYp +shell +``` + +## Extracting and repacking the rootfs +{% include alert.html content="Make sure you run both commands as root, otherwise you might get a damaged rootfs image" alert="Warning" icon="svg-warning" color="red" %} + +```sh +# unsquashfs mtd5.bin +# mksquashfs squashfs-root rootfs -b 131072 -comp lzma -no-recovery +``` + +## Firmware patch +Simple change with a hex editor can be done to enable full shell, inside /lib/libmib.so, change `/bin/cli` to `/bin/ash` + +Then add /bin/ash to /etc/shells to enable normal shell. + +Binary patch is required to prevent `/bin/startup` from reseting ME 256 and 257 parameters on reboot. + +## Flashing new firmware + +U-Boot has working network and commands provided to load kernel and rootfs over TFTP. + +It's recommended you preserve old firmware with md.b, SPI base address and size can be found in env. + +TFTP requested filenames: +- uImage - U-Boot OS Kernel image +- rootfs - SquashFS root + + +```sh +# Update image0 +run upk;run upr; +# Update image1 +run upk1;run upr1 +``` + +Or from linux system + +```sh +# tftp +tftp> mode octet +tftp> get rootfs.img /tmp/rootfs.new +tftp> quit +# flash_eraseall /dev/mtd7 +# cat /tmp/rootfs.new > /dev/mtd7 +``` + +# Miscellaneous Links + +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) +- [Modded firmware for GRG4284](https://github.com/Troll338cz/CTN_GPON/tree/main/Comtrend_GRG-4284/) diff --git a/_ont/ont-comtrend.md b/_ont/ont-comtrend.md new file mode 100644 index 00000000..d0b40939 --- /dev/null +++ b/_ont/ont-comtrend.md @@ -0,0 +1,5 @@ +--- +title: Comtrend +has_children: true +layout: default +--- diff --git a/_ont/ont-sercomm-fg1000r.md b/_ont/ont-sercomm-fg1000r.md index 85a6b72d..96420466 100644 --- a/_ont/ont-sercomm-fg1000r.md +++ b/_ont/ont-sercomm-fg1000r.md @@ -7,29 +7,29 @@ parent: Sercomm # Hardware Specifications -| | | -| --------------- | ---------------------- | -| Vendor/Brand | Sercomm | -| Model | FG1000R | -| ODM | ✅ | -| Chipset | RTL9602C | -| Flash | | -| RAM | | -| CPU | | -| CPU Clock | | -| Bootloader | | -| Load addr | | -| 2.5GBaseT | ✅ | -| PHY Ethernet | | -| Optics | LC/APC | -| IP address | 192.168.1.1 | +| | | +| --------------- | ----------------------- | +| Vendor/Brand | Sercomm | +| Model | FG1000R | +| ODM | ✅ | +| Chipset | RTL9602C | +| Flash | 128MB (MXIC MX35LF1GE4AB) | +| RAM | 64MB | +| CPU | | +| CPU Clock | 625 MHz | +| Bootloader | U-Boot RSDK 2011.12.NA-svn5 | +| Load addr | | +| 2.5GBaseT | ✅ | +| PHY Ethernet | Realtek RTL8221B | +| Optics | LC/APC | +| IP address | 192.168.1.1/24 | | Web Gui | ✅, User: Tech Password: ftth@! | -| SSH | | -| Telnet | | -| Serial | ✅ | -| Serial baud | | -| Serial encoding | | -| Form Factor | ONT | +| SSH | | +| Telnet | | +| Serial | ✅, only TX | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | {% include image.html file="fg1000r_rear.jpg" alt="Sercomm FG1000R" caption="Sercomm FG1000R rear" %} diff --git a/_ont/ont-sercomm-fgs202.md b/_ont/ont-sercomm-fgs202.md index c06a896a..f976c72f 100644 --- a/_ont/ont-sercomm-fgs202.md +++ b/_ont/ont-sercomm-fgs202.md @@ -7,32 +7,50 @@ parent: Sercomm # Hardware Specifications -| | | -| ------------ | --------------------------------- | -| Vendor/Brand | Sercomm | -| Model | FGS202 | -| Chipset | Lantiq PEB98036 | -| Flash | 8 MB | -| RAM | 32 MB | -| System | eCos | -| HSGMII | Yes | -| Optics | SC/APC | -| IP address | 169.254.199.139 | -| Web Gui | No | -| SSH | No | -| Telnet | ✅ user `admin`, password `admin` | -| Serial | No | -| Form Factor | miniONT SFP | +| | | +| --------------- | --------------------------------- | +| Vendor/Brand | Sercomm | +| Model | FGS202 | +| Chipset | Lantiq PEB98036 | +| Flash | 8 MiB (MXIC MX25L6405D) | +| RAM | 1 MiB | +| System | eCos | +| HSGMII | Yes | +| Optics | SC/APC | +| IP address | 192.168.2.200/24 | +| Web Gui | No | +| SSH | No | +| Telnet | ✅ user `admin`, password `admin` | +| Serial | ✅ on SFP, only TX | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | miniONT SFP | {% include image.html file="fgs202.jpg" alt="Sercomm FGS202" caption="Sercomm FGS202" %} {% include image.html file="fgs202_teardown.jpg" alt="Sercomm FGS202 teardown" caption="Sercomm FGS202 teardown" %} +## Serial + +The stick has a TTL 3.3v UART console (configured as 115200 8-N-1) that can be accessed from the SFP connector. + +| USB TTL(UART) Adapter | SFP 20pins Molex connector | +| --------------------- | -------------------------- | +| 3.3V | pin #15 and #16 | +| TX | pin #3 | +| RX | pin #6 | +| GND | pin #14 and #10 | + ## Telnet Access -The stick has telnet available only on the PON side, the only way to access it is by using an OLT. +The stick has telnet available only on the PON side by default, the only way to access it is by using an OLT. + +eCos will request its IP via DHCP client once OMCI provisions IP-Host interface. + +Telnet access on LAN side can be unlocked by modifying factory environment variable `ft_flag` to 1. ## List of software versions +- SCOMFGS202112 (Orange France) - SCOMFGS202305 (TIM Italy) - SCOMFGS202304 (TIM Italy) @@ -110,6 +128,41 @@ Alarms = - Set command exectue successfully. ``` +## Getting ONU GPON PLOAM password +PLOAM Password at offset 0x1B8-0x1C1 + +```sh +FGS202:/# show i2c (ASCII view added for readability) +00000000: 0304 0100 0000 0000 0000 0003 0c00 14c8 ................ +00000010: 0000 0000 5345 5243 4f4d 4d20 2020 2020 ....SERCOMM +00000020: 2020 2020 0000 0000 4647 5332 3032 2020 ....FGS202 +00000030: 2020 2020 2020 2020 3030 3031 051e 00c1 0001.... +00000040: 001a 0000 5343 4f4d 4131 4232 4333 4434 ....SCOMA1B2C3D4 +00000050: 2020 2020 3137 3033 3238 2020 6cf0 0549 170328 l..I +00000060: 2020 2020 2020 2020 2020 2020 2020 2020 +00000070: 2020 2020 2020 2020 2020 2020 2020 2020 +00000080: 0000 0000 0000 0000 0000 0000 0000 0000 ................ +* +00000100: 5000 fb00 4b00 0000 8ca0 7530 878c 7a44 P...K.....u0..zD +00000110: 88b8 0000 7530 0000 9b82 22d0 7b86 2bd4 ....u0....\".{.+. +00000120: 07cb 000c 0630 000f 0000 0000 0000 0000 .....0.......... +00000130: 0000 0000 0000 0000 0000 0000 0000 0000 ................ +00000140: 0000 0000 3f80 0000 0000 0000 0100 0000 ....?........... +00000150: 0100 0000 0100 0000 0100 0000 0000 0012 ................ +00000160: 18d9 80e8 157f 0000 0000 0000 0000 0200 ................ +00000170: 0140 0000 0140 0000 0000 0000 0000 0000 .@...@.......... +00000180: 0000 0100 4647 5332 3032 2020 2020 2020 ....FGS202 +00000190: 2020 2020 2020 2020 5343 4f4d 4647 5332 SCOMFGS2 +000001a0: 3032 7631 2020 0100 0000 0000 18d9 0000 02v1 .......... +000001b0: 0000 0000 0000 0000 3938 3736 3534 3332 ........98765432 +000001c0: 3130 004f 5241 4e47 4553 434f 4d46 4753 10.ORANGESCOMFGS +000001d0: 3230 3231 3132 0000 5343 4f4d 4647 5332 202112..SCOMFGS2 +000001e0: 3032 3131 3200 ff00 0000 1000 0000 0000 02112........... +000001f0: 0000 0000 0000 0000 0000 0000 0000 0020 ............... + +It can also be read and written using an external I2C reader. +``` + # Advanced settings ## Showing live OMCI messages @@ -123,6 +176,56 @@ ploam ds|ff 01 20 00 00 aa ab 59 83 20 00 00 1970-01-01 02:34:53 ploam ds: onu id - 255 / UpstreamOverhead ``` +## Editing flash environment data +Simple U-Boot-style storage `key=value\0` padded by 0xFF, after modification, a new CRC32 checksum is required. + +```py +from zlib import crc32 +wholeflash = open("FGS202.bin", "rb").read() # Full SPI dump +ubootenv = wholeflash[262144:262144+65536] # 0x40000-0x5FFFF +factoryenv = wholeflash[327680:327680+65536] # 0x50000-0x6FFFF +ecosenv = wholeflash[393216:393216+65536] # 0x60000-0x7FFFF + +print(f'U-Boot\n| CRC: {ubootenv[0:4].hex()} | Version {ubootenv[4:5]} | New CRC: {crc32(ubootenv[5:]):08x} ') +print(f'Factory\n| CRC: {factoryenv[0:4].hex()} | Version {factoryenv[4:5]} | New CRC: {crc32(factoryenv[5:]):08x} ') +print(f'eCos\n| CRC: {ecosenv[0:4].hex()} | Version {ecosenv[4:5]} | New CRC: {crc32(ecosenv[5:]):08x} ') +``` + +## Decrypting "encrypt_data" variable from flash + +PLOAM and telnet passwords are hidden inside encrypt_data container. + +Contents can be decrypted and encrypted by building a key from known device parameters. + +```py +import hashlib +from Crypto.Cipher import AES + +# from Factory environ +ethaddr = "78:94:B4:27:5F:2A" +nSerial = "SCOM21040A14" +# from Config environ +encrypt_data = bytes.fromhex("23cc5d5da799673708e443594e06272ffde3f449061bff7604c32cd50a186e19") + +alphabet = "93axcdz25efhiv87ykmuj46stpbw" +digest = hashlib.md5(f"{ethaddr}{nSerial}".encode()).digest().hex() +key = bytes(ord(alphabet[ord(c) % 28]) for c in digest) +cipher = AES.new(key[:16], AES.MODE_CBC, iv=b'\x00'*16) +print( cipher.decrypt(encrypt_data) ) +``` + +## Putting stick into firmware download mode +From telnet using hidden command `sercomm_download` will set environment variable `sc_dl` to 1 and reboot the stick. + +At boot time, this variable is read by the modified U-Boot and waits for [sercomm-recovery](https://github.com/danitool/sercomm-recovery) + +Due to an uninitialized SFP EEPROM, a simple SFP-to-Ethernet converter is required. + +The input for sercomm-recovery tool must be a complete dump of complete flash memory, the client writes only the Image0 and Image1 regions, and the rest is skipped (so a failed write will drop you back into recovery). + +It is not possible to exit this mode until the write operation completes or the environment settings are manually reset to 0. + + # Hardware Modding - Pin 7 GND → VCC [Fibra.Click - FAQ: 2.5Gbps su singolo dispositivo su Tim, Vodafone, Fastweb/JustSpeed](https://forum.fibra.click/d/27574-faq-25gbps-su-singolo-dispositivo-su-timvodafonefastwebjustspeed/18) @@ -132,7 +235,7 @@ ploam ds|ff 01 20 00 00 aa ab 59 83 20 00 00 - [Support for GPON SFP FGS202](https://forum.openwrt.org/t/support-for-gpon-sfp-fgs202/42641/60) - [SerComm FGS202](https://wikidevi.wi-cat.ru/SerComm_FGS202) - +- [Modding FGS202 firmware](https://github.com/Troll338cz/CTN_GPON/tree/main/Sercomm/FGS202/SCOMFGS202112-telnet) diff --git a/_ont/ont-tenda-hg1.md b/_ont/ont-tenda-hg1.md new file mode 100644 index 00000000..d6a87fbd --- /dev/null +++ b/_ont/ont-tenda-hg1.md @@ -0,0 +1,85 @@ +--- +title: Tenda HG1 +has_children: false +layout: default +parent: Tenda +--- + +| | | +| --------------- | -------------------------------------------------------------------------- | +| Vendor/Brand | Tenda | +| Model | HG1 | +| CPU | Realtek RTL9601D | +| DRAM | 32 MB | +| Flash Size | 8 MB | +| CPU Arch | MIPSBE Realtek Lexra | +| CPU Clock | 300MHz | +| Bootloader | U-Boot RSDK 2011 | +| System | Linux 2.6 | +| Optics | SC/APC | +| IP address | 192.168.1.1/24 | +| Web Gui | ✅ user `admin`, password `admin` | +| SSH | ❌ | +| Telnet | ✅ | +| FTP | ❌ | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +## Hardware Revisions + +- V2.0 (Black Case) +- V3.0 (White Case) + +# External/Internal Photo + +{% include image.html file="tenda_hg1_v3_case.jpg" alt="Tenda HG1 v3.1" caption="Tenda HG1 v3.1" %} +{% include image.html file="tenda_hg1_v3_pcb.jpg" alt="Tenda HG1 v3.1 PCB" caption="Tenda HG1 v3.1 PCB" %} + +## List of software versions + +- V1.7.1 + +# List of partitions + +| dev | size | erasesize | name | +| ----- | -------- | --------- | --------------- | +| mtd0 | 00040000 | 00001000 | "boot" | +| mtd1 | 00002000 | 00001000 | "env" | +| mtd2 | 00002000 | 00001000 | "env2" | +| mtd3 | 0002c000 | 00001000 | "config" | +| mtd4 | 00140000 | 00001000 | "k0" | +| mtd5 | 00288000 | 00001000 | "r0" | +| mtd6 | 00140000 | 00001000 | "k1" | +| mtd7 | 00288000 | 00001000 | "r1" | +| mtd8 | 00001000 | 00001000 | "Partition_008" | +| mtd9 | 00001000 | 00001000 | "Partition_009" | +| mtd10 | 00001000 | 00001000 | "Partition_010" | +| mtd11 | 00001000 | 00001000 | "Partition_011" | +| mtd12 | 00140000 | 00001000 | "linux" | +| mtd13 | 00288000 | 00001000 | "rootfs" | + +This ONT supports dual boot. + +`k0` and `r0` respectively contain kernel and firmware of the first image, while `k1` and `r1` contain kernel and firmware of the second one. + + +{% include_relative ont-luna-sdk-useful-commands.md + flash='flash' + ploam='asciiAndHex' +%} + +# Advanced Configuration + +## Enabling telnet +Default configuration restricts telnet to WAN interface only. To re-enable it new entry has to be added into `Admin -> ACL Configuration` or edited inside exported XML configuration by hand. + +## Hidden Web Gui config page +Device has a hidden page `http://192.168.1.1/tddeviceinfo.asp` for configuring OMCI parameters, MAC and XPON switch. + +OMCI equipment ID (ME 257) and OMCI hardware version (ME 256) are hardcoded into `/etc/version.sh` and `/bin/startup` requiring a firmware patch to change. + +# Miscellaneous Links + +- [Hacking RTL960x](https://github.com/Anime4000/RTL960x) diff --git a/_ont/ont-tenda.md b/_ont/ont-tenda.md new file mode 100644 index 00000000..06322a82 --- /dev/null +++ b/_ont/ont-tenda.md @@ -0,0 +1,5 @@ +--- +title: Tenda +has_children: true +layout: default +--- diff --git a/_ont/ont-zyxel-pmg5100-t0.md b/_ont/ont-zyxel-pmg5100-t0.md index 340b0ddf..b453d990 100644 --- a/_ont/ont-zyxel-pmg5100-t0.md +++ b/_ont/ont-zyxel-pmg5100-t0.md @@ -7,22 +7,22 @@ parent: Zyxel # Hardware Specifications -| | | -| ------------ | ------------------------ | -| Vendor/Brand | Zyxel | -| Model | PM5100-T0 | -| Chipset | MediaTek/EcoNet EN7523OT | -| Flash | | -| RAM | | -| System | | -| 2.5GBaseT | Yes | -| Optics | SC/APC | -| IP address | | -| Web Gui | ✅ | -| SSH | ✅ | -| Telnet | | -| Serial | | -| Form Factor | ONT | +| | | +| ------------ | -------------------------- | +| Vendor/Brand | Zyxel | +| Model | PM5100-T0 | +| Chipset | MediaTek/EcoNet EN7523OT | +| Flash | 128 MB (Macronix W25N01G) | +| RAM | 256 MB (Winbond W623GU6MB) | +| System | | +| 2.5GBaseT | Yes | +| Optics | SC/APC | +| IP address | 192.168.0.1/24 | +| Web Gui | ✅ | +| SSH | ✅ | +| Telnet | ✅ | +| Serial | ✅ | +| Form Factor | ONT | {% include image.html file="zyxel-pmg5100\front.jpg" alt="PM5100-T0" caption="PM5100-T0" %} diff --git a/_ont_xgs/ont-comtrend-grg-4362.md b/_ont_xgs/ont-comtrend-grg-4362.md new file mode 100644 index 00000000..e550f8da --- /dev/null +++ b/_ont_xgs/ont-comtrend-grg-4362.md @@ -0,0 +1,376 @@ +--- +title: Comtrend GRG-4362 +has_children: false +layout: default +parent: Comtrend +--- + +| | | +| --------------- | -------------------------------------------------------------------------- | +| Vendor/Brand | Comtrend | +| Model | GRG-4362 | +| Chipset | Realtek RTL9615C | +| Flash | SPI NAND 128MiB (Winbond W25N01GVZEIG) | +| RAM | 512MiB | +| CPU | Dualcore AArch64 A55 | +| CPU Clock | 1000MHz | +| Bootloader | U-Boot RSDK 2022.10 | +| System | Linux 5.10.70 (Realtek ASDK64-10.2.0 Build 3544) | +| 10GBaseT | Yes | +| PHY Ethernet | RTL8261B | +| Optics | SC/APC (SEMTECH GN28L96) | +| IP address | 192.168.1.1/24 | +| Web Gui | ✅ user `root`, password `root` | +| SSH | ✅ | +| Telnet | ✅ | +| FTP | ✅, Download only | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +# External/Internal Photo + +{% include image.html file="comtrend_grg-4362_teardown_1.jpg" alt="Comtrend GRG-4362 Top Cover" caption="Comtrend GRG-4362 Top Cover" %} +{% include image.html file="comtrend_grg-4362_teardown_2.jpg" alt="Comtrend GRG-4362 Bottom Cover" caption="Comtrend GRG-4362 Bottom Cover" %} +{% include image.html file="comtrend_grg-4362_teardown_3.jpg" alt="Comtrend GRG-4362 PCB" caption="Comtrend GRG-4362 PCB" %} + + +## Hardware Revisions +- V2.0 + +## List of software versions +- CTN-1.0.8b16 (Cetin) +- CTN-1.0.8b2 (Cetin) + +## List of partitions +`cat /proc/mtd` + +| dev | size | erasesize | name | +| ----- | -------- | --------- | ---------------- | +| mtd0 | 00200000 | 00020000 | "boot" | +| mtd1 | 00040000 | 00020000 | "env" | +| mtd2 | 00040000 | 00020000 | "env2" | +| mtd3 | 00040000 | 00020000 | "static_conf" | +| mtd4 | 07cc0000 | 00020000 | "ubi_device" | +| mtd5 | 00a0d000 | 0001f000 | "ubi_Config" | +| mtd5 | 0005d000 | 0001f000 | "ubi_DTB0" | +| mtd6 | 0060e000 | 0001f000 | "ubi_k0" | +| mtd7 | 02017000 | 0001f000 | "ubi_r0" | +| mtd8 | 0005d000 | 0001f000 | "ubi_DTB1" | +| mtd8 | 0060e000 | 0001f000 | "ubi_k1" | +| mtd9 | 02017000 | 0001f000 | "ubi_r1" | + +Only the first 4 partitions with erasesize 0x20000 should be manipulated using mtd devices, the fifth partition `ubi_device` contains the rest of the NAND and is to be manipulated using ubi volumes. + +## List of volumes (UBI) +`ubinfo -a` + +| dev | size | type | name | +| ------ | --------------- -------- | ------- | ---------------- | +| ubi0_0 | 10539008 bytes, 10.1 MiB | dynamic | "ubi_Config" | +| ubi0_1 | 380928 bytes, 372.0 KiB | dynamic | "ubi_DTB0" | +| ubi0_2 | 6348800 bytes, 6.1 MiB | dynamic | "ubi_k0" | +| ubi0_3 | 33648640 bytes, 32.1 MiB | dynamic | "ubi_r0" | +| ubi0_4 | 380928 bytes, 372.0 KiB | dynamic | "ubi_DTB1" | +| ubi0_5 | 6348800 bytes, 6.1 MiB | dynamic | "ubi_k1" | +| ubi0_6 | 33648640 bytes, 32.1 MiB | dynamic | "ubi_r1" | + +To back up a volume, `cat` or `dd` the appropriate `/dev/ubi0_X` device to a file or pipe, to restore a volume, use the `ubiupdatevol` utility + +This ONT supports dual boot. + +Volumes `ubi_k0`, `ubi_DTB0` and `ubi_r0` respectively contain kernel and rootfs of the first image, while `ubi_k1`, `ubi_DTB1` and `ubi_r1` contain kernel and rootfs of the second one. + +# Useful files and binaries + +## Useful files +- `/var/config/config.xml` - Contains the user portion of the configuration +- `/var/config/config_hs.xml` - Contains the "hardware" configuration (which _should not_ be changed) +- `/var/config/rtkbosa_k.bin` - Per-device laser driver calibration data +- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below) + +## Useful binaries +- `flash` - Used to manipulate the config files in a somewhat safe manner +- `nv` - Used to manipulate nvram storage, including persistent config entries via `nv setenv`/`nv getenv` +- `omcicli` - Used to interact with the running OMCI daemon +- `omci_app` - The OMCI daemon +- `diag` - Used to run low-level diagnostics commands on the onu +- `cli` - Comtrend cli. + +# GPON ONU status + +## Getting the operational status of the ONU + +```sh +# diag rt_gpon get onu-state +ONU state: Operation State:Associated(O5.1) +``` + +## Getting OLT vendor information +```sh +# omcicli mib get 131 +``` + +## Querying a particular OMCI ME +```sh +# omcicli mib get MIB_IDX +``` + +# GPON/OMCI settings + +## Getting/Setting ONU GPON Serial Number +```sh +# flash get GPON_SN +GPON_SN=CMTD33221100 +# flash set GPON_SN HWTC0A1B2C3D +``` + +## Getting/Setting ONU GPON PLOAM password + +```sh +# flash get GPON_PLOAM_PASSWD +GPON_PLOAM_PASSWD=3030303030 +# flash set GPON_PLOAM_PASSWD AAAAAAAAAA +``` + +## Getting/Setting ONU GPON LOID and LOID password +```sh +# flash get LOID +LOID=user +# flash set LOID user +# flash get LOID_PASSWD +LOID_PASSWD=user +# flash set LOID_PASSWD user +``` + +## Getting/Setting OMCI software version (ME 7) +```sh +# flash get OMCI_SW_VER1 +OMCI_SW_VER1=CTN-1.0.8b16 +# flash set OMCI_SW_VER1 V3R017C10S100 +# flash get OMCI_SW_VER2 +OMCI_SW_VER2=CTN-1.0.8b2 +# flash set OMCI_SW_VER2 V3R017C10S100 +``` + +## Getting/Setting OMCI hardware version (ME 256) +```sh +# flash get HW_HWVER +HW_HWVER=V2.0 +# flash set HW_HWVER BF9.A +``` + +## Getting/Setting OMCI vendor ID (ME 256) +```sh +# flash get PON_VENDOR_ID +PON_VENDOR_ID=CMTD +# flash set PON_VENDOR_ID HWTC +``` + +## Getting/Setting OMCI equipment ID (ME 257) +```sh +# flash get GPON_ONU_MODEL +GPON_ONU_MODEL=GRG-4362 +# flash set GPON_ONU_MODEL HG8240H +``` + +## Getting/Setting OMCI OLT Mode and Fake OMCI + +Configure how ONT handle OMCI from OLT: + +```sh +# flash get OMCI_OLT_MODE +OMCI_OLT_MODE=1 +# flash set OMCI_OLT_MODE 2 +``` + +| Value | Note | OMCI Information | +| ----- | --------------- | ------------------------------------------------------------------------------------------------------ | +| 0 | Default Mode | Stock setting, most values cannot be changed | +| 1 | Huawei OLT Mode | Huawei | +| 2 | ZTE OLT Mode | ZTE | +| 3 | Customized Mode | Custom Software/Hardware Version, OMCC, etc... | + +Some vendors/wholesale providers/ISPs have explicit LAN Port Number provisioning or proprietary OMCI that the cannot understand, this will make the reply OK to whatever the OLT sends it via OMCI. + +`0` = Disable, `1` = Enable, Default is 0 + +```sh +# flash get OMCI_FAKE_OK +OMCI_FAKE_OK=0 +# flash set OMCI_FAKE_OK 1 +``` + +# Advanced settings + +## Transferring files to/from the router +This ONT has a capability of sharing files using FTP, TFTP, and Netcat. + +Uploading any file to the FTP server will attempt to use it as a firmware update and fail. + + +## Setting management MAC +```sh +# flash get ELAN_MAC_ADDR +ELAN_MAC_ADDR=1c6499a1b1c3 +# flash set ELAN_MAC_ADDR 1c6499d4e5f6 +``` + +## Setting management IP +```sh +# flash get LAN_IP_ADDR +LAN_IP_ADDR=192.168.1.1 +# flash set LAN_IP_ADDR 192.168.2.1 +``` + +## Rebooting the ONU +```sh +reboot +``` + +## Getting the MTU of the L2 bridge + +```sh +# diag switch get max-pkt-len port all +Port Speed +---------- +0 9022 +1 9022 +2 9022 +3 9022 +4 9022 +5 9022 +6 12000 +7 12000 + +``` + +## Checking the currently active image info +```sh +# nv getenv sw_active +sw_active=0 +# nv getenv sw_version0 +sw_version0=CTN-1.0.8b16 +# nv getenv sw_version1 +sw_version1=CTN-1.0.8b2 +``` + +## Booting to a different image +```sh +# nv setenv sw_commit 0|1 +# reboot +``` + +## Disable multicast U-Boot update +Enabled by default in Realtek U-Boot, but 10G PHY does not work. + +This speeds up boot time by 10 seconds not waiting for a timeout. + +```sh +# nv setenv mupgrade_en 0 +``` + +## Unlocking shell access +Comtrend has written their own locked-down CLI shell, unlocking is possible with multiple methods. + +Although the option to enter linux shell is displayed in help command, it silently fails until per-firmware password is provided. + +This string is stored plaintext and hardcoded into `/bin/cli` and can be easily dumped. + +```sh +# Example commands for firmware CTN-1.0.8b16 +version --debug x4Wnhq2ReL +shell +``` + +## Maintenance root shell +By editing U-Boot ENV you can boot this device straight into a root shell. + +```sh +# Make sure to save your original variable content before re-writing. +TAURUS# setenv basicargs 'earlycon=serial,0xf43291b0 console=ttyS0,115200 init=/bin/bash' +TAURUS# saveenv +``` + +```sh +# Setup filesystems +mount -t proc proc /proc +mount -t sysfs sysfs /sys +mount -o size=64M -t tmpfs tmpfs /var/ +mkdir /var/run +mkdir /var/tmp +mkdir /var/config +mount -t ubifs ubi0:ubi_Config /var/config/ + +# Read device login +flash get SUSER_NAME +flash get SUSER_PASSWORD + +# Unblock ACL rules +flash set ACL_IP_TBL.0.any 0 +flash set ACL_IP_TBL.0.telnet 1 +flash set ACL_IP_TBL.0.web 1 +flash set ACL_IP_TBL.0.https 1 +flash set ACL_IP_TBL.0.ssh 1 +flash set ACL_IP_TBL.0.icmp 1 +flash set ACL_IP_TBL.1.ftp 0 +flash set ACL_IP_TBL.1.tftp 0 +flash set ACL_IP_TBL.1.web 0 +flash set ACL_IP_TBL.1.https 0 +flash set ACL_IP_TBL.1.ssh 0 +flash set ACL_IP_TBL.1.icmp 0 + +# Enable full shell instead of CLI +# This script runs too early in boot process, delay was needed to get /var into right state +cat < /var/config/run_customized_sdk.sh +#!/bin/sh +echo -en '\x1b[41;33m ===> run_customized_sdk.sh executed! <=== \x1b[0m\n' +sleep 60 && sed -i 's/\/bin\/cli/\/bin\/sh/g' /var/passwd && cat /var/passwd && echo -en '\x1b[42;30m ===> CLI Unlock success! <=== \x1b[0m\n' & +exit 0 + +EOF +``` + +## Extracting and repacking the rootfs +{% include alert.html content="Make sure you run both commands as root, otherwise you might get a damaged rootfs image" alert="Warning" icon="svg-warning" color="red" %} + +```sh +# unsquashfs -d rootfs_extracted/ rootfs.img +# mksquashfs rootfs_extracted/ rootfs_new.img -comp xz -b 131072 -always-use-fragments -no-recovery -noappend +``` + +## Firmware patch +Simple change with a hex editor can be done to enable full shell, inside /lib/libmib.so, change `/bin/cli` to `/bin/ash` + +Then add /bin/ash to /etc/shells to enable normal shell. + +Binary patch is required to prevent `/bin/startup` from reseting ME 256 and 257 parameters on reboot. + + +## Flashing new firmware +- U-Boot + +```sh +# Trigger Ymodem transfer from terminal client of your choice, wait about ~30 minutes +loady ${tftp_base} 115200 +setenv current_vol ubi_r0 +run check_vol +ubi write ${tftp_base} ubi_r0 ${filesize} +reset +``` + +- Linux + +```sh +# Transfer with tool of your choice, wget/nc +# Swap ubi0_6 with appropriate device for inactive image +md5sum /tmp/rootfs.img +ubiupdatevol ubi0_6 /tmp/rootfs.img +``` + +# Miscellaneous Links +- [Anime4000 Flash commands](https://github.com/Anime4000/RTL960x/blob/main/Docs/FLASH_GETSET_INFO.md) +- [Anime4000 OMCI MIB commands](https://github.com/Anime4000/RTL960x/blob/main/Docs/OMCI_CLI.md) +- [Anime4000 FW Modding](https://github.com/Anime4000/RTL960x/blob/main/Docs/Modify_Firmware.md) +- [Unlock guide and patched firmware](https://github.com/Troll338cz/Unlock-Comtrend-GRG-4362/) diff --git a/_ont_xgs/ont-comtrend.md b/_ont_xgs/ont-comtrend.md new file mode 100644 index 00000000..d0b40939 --- /dev/null +++ b/_ont_xgs/ont-comtrend.md @@ -0,0 +1,5 @@ +--- +title: Comtrend +has_children: true +layout: default +--- diff --git a/_ont_xgs/ont-iskratel-innboxX24.md b/_ont_xgs/ont-iskratel-innboxX24.md new file mode 100644 index 00000000..a2ff393b --- /dev/null +++ b/_ont_xgs/ont-iskratel-innboxX24.md @@ -0,0 +1,121 @@ +--- +title: Innbox X24 +has_children: false +layout: default +parent: Iskratel +--- + +| | | +| --------------- | -------------------------------------------------------------------------- | +| Vendor | Iskratel | +| Model | Innbox X24 | +| CPU | EcoNet EN7580 | +| DRAM | 256 MB | +| Flash Size | 128 MB (WINBOND W25N01G) | +| CPU Arch | MIPS interAptiv (multi) V2.12 - (2 Core, 4 Threads) | +| CPU Clock | 1.3 GHz | +| Bootloader | Econet free bootbase | +| System | Linux version 4.4.115 | +| 10GBaseT | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.1/24 | +| Web Gui | ✅ | +| SSH | ✅ user: `admin`, password: `c79@NkZ5LJgZ33+Lp6@%` | +| Telnet | ✅ | +| TFTP | ✅ | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +{% include image.html file="innbox_X24_teardown_1.jpg" alt="Innbox X24 PCB" caption="Innbox X24 PCB" %} + +## List of software versions +- 1.13.1507 (Cetin) +- 1.1.1680 (Iskratel) + +# GPON ONU status + +```sh +csmconf -g /InternetGatewayDevice/X_INNBOX_GPON/ONU/SerialNumber +csmconf -g /InternetGatewayDevice/X_INNBOX_GPON/ONU/VendorId +csmconf -g /InternetGatewayDevice/X_INNBOX_GPON/ONU/Password +csmconf -g /InternetGatewayDevice/X_INNBOX_GPON/ONU/VendorProCode +csmconf -g /InternetGatewayDevice/X_INNBOX_GPON/ONU/OMCCVersion +csmconf -g /InternetGatewayDevice/X_INNBOX_GPON/ONU/Version +/userfs/bin/tcapi show GPON_ONU +/userfs/bin/tcapi show SysInfo_Entry +``` + +# GPON/OMCI settings + +{% include alert.html content="Modify environment and XML variables with caution, if you enter an invalid value that causes the config daemon to crash, the device cannot be recovered without desoldering the SPI chip!" alert="Note" icon="svg-warning" color="yellow" %} + +## Getting/Setting ONU GPON Serial Number +Also sets OMCI vendor ID (ME 256) + +```sh +# fad config getenv serial_gpon +serial_gpon=ISKTA1B2C3D4 +# fad config setenv serial_gpon ISKTA1B2C3D4 +``` + +## Flash layout +``` +dev: size erasesize name +mtd0: 00040000 00020000 "bootloader" - Econet Bootbase +mtd1: 00040000 00020000 "romfile" +mtd2: 0027c77b 00020000 "kernel" +mtd3: 01320000 00020000 "rootfs" +mtd4: 03000000 00020000 "tclinux" - TRX Image A +mtd5: 03f80000 00020000 "kernel_slave" +mtd6: 00000000 00000000 "rootfs_slave" +mtd7: 03000000 00020000 "tclinux_slave" - TRX Image B +mtd8: 00100000 00020000 "config" - INNDACFG1 - encrypted XML +mtd9: 00100000 00020000 "Equip" - INNDAENV +mtd10: 00100000 00020000 "WlanE2pData" - Blank +mtd11: 00100000 00020000 "bootEnv" - INNDABOOT +mtd12: 00100000 00020000 "VoiceLog" - Blank +mtd13: 00100000 00020000 "SystemLog" - Custom syslog storage +mtd14: 00200000 00020000 "SaaS" - /var/SaaS/ - jffs2 +mtd15: 00240000 00020000 "reservearea" - Blank +``` + +# Environment partition contents +- INNDAENV +``` +passwd_gpon=0000000000 - PLOAM password +serial=3525123456789 - Iskratel serial number +hw_id=InnboxX24_SW2 - Device model +fwupgrade=0 - ? +mp_mode=OFF - ? +lanmac=48:55:41:AA:BB:CC - MAC address of first LAN port +customer_id=Cetin - ISP branding, reset to "Iskratel" for unbranded config. +wanmac=64:6E:EA:01:00:01 - MAC address of WAN port +usb_freset=off - ? +hwrev=V1.0 - HW revision +serial_gpon=ISKT23AABBCC - GPON SN +``` + +- INNDABOOT +``` +fw_slave_full_crc=340607dea7cc3a2f115164b5e9e3b571 +boot_full_crc=e72b2000da5e0bafdf983fc8e7daf0bf +fw_main_crc=db3ad7cdc9b1c2c116c5ee36cb3379f6 +Image1Commit=0 +Image1Active=0 +Image0Valid=1 +boot_flag=0 +Image0Active=1 +Image0Commit=1 +boot_crc=49d9eec2334e7a24d4c5b6254848b9c7 +fw_slave_crc=db3ad7cdc9b1c2c116c5ee36cb3379f6 +fw_main_full_crc=340607dea7cc3a2f115164b5e9e3b571 +BackUpFwVer=1.13.1507 +``` + + +## Usefull links +- [Econet Linux](https://econet-linux.pkt.wiki/en/bootloader) +- [Econet GPL code](https://github.com/cjdelisle/EN751221-Linux26/) +- [Innbox Decryption tools](https://github.com/Troll338cz/CTN_GPON/tree/main/Innbox_X24/utils) diff --git a/_ont_xgs/ont-iskratel.md b/_ont_xgs/ont-iskratel.md new file mode 100644 index 00000000..1f14c901 --- /dev/null +++ b/_ont_xgs/ont-iskratel.md @@ -0,0 +1,5 @@ +--- +title: Iskratel +has_children: true +layout: default +--- diff --git a/_ont_xgs/ont-kaon-pm1191.md b/_ont_xgs/ont-kaon-pm1191.md new file mode 100644 index 00000000..b421ee57 --- /dev/null +++ b/_ont_xgs/ont-kaon-pm1191.md @@ -0,0 +1,236 @@ +--- +title: KAON PM1191 +has_children: false +layout: default +parent: KAON +--- + +| | | +| --------------- | -------------------------------------------------------------------------- | +| Vendor | KAON | +| Model | PM1191 | +| CPU | Cortina CA8271A | +| DRAM | 256 MB | +| Flash Size | 128 MB (MICRON MT29F1G01ABAFD) | +| CPU Arch | Taroko V0.2 (MIPS) | +| CPU Clock | 666 MHz | +| Bootloader | U-Boot 2020.04 | +| System | Linux 4.14.275.saturn2-sfu-r2.2 | +| 10GBaseT | Yes | +| Optics | SC/APC | +| IP address | 192.168.1.1/24 | +| Web Gui | ✅ | +| SSH | ✅ | +| Telnet | ❌ (Cortina cli on localhost:2323) | +| FTP | ❌ | +| Serial | ✅ | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +# External/Internal Photo + +{% include image.html file="kaon_pm1191_teardown_1.jpg" alt="PM1191 PCB Top" caption="PM1191 PCB Top" %} +{% include image.html file="kaon_pm1191_teardown_2.jpg" alt="PM1191 PCB Bottom" caption="PM1191 PCB Bottom" %} + +## List of software versions +- 2.0.25 (T-Mobile CZ) +- 2.0.25_eng (T-Mobile CZ) + + + +# GPON ONU status +```sh +# telnet 127.0.0.1 2323 +Cortina> enable +Cortina# config +Cortina(config)# aal +Cortina(config-aal)# xgpon +Cortina(config-aal-xgpon)# show activation_state 0 +PON mode : 5(XGSPON) +VendorID : 0x4b414f4e(KAON) +VSSN : 0xa1b2c3d4 +TO1 : 80000(unit:125us) +TO2 : 8000(unit:125us) +S/W FSM current event : NONE +S/W FSM current state : O1.1 +S/W FSM previous state : O1.1 +S/W FSM running state : O1.1 +H/W FSM current state : O1.1 +H/W FSM previous state : O1.1 +Activated counter : 0 +ONU Dsync state : hunt +Registration ID: 0x00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +# telnet 127.0.0.1 2323 +Cortina> enable +Cortina# config +Cortina(config)# omci +Cortina(config-omci)# show info +omcc :0xa1 +ipv4Addr :0x7f000001 +ipv4Mask :0xffffff00 +ipv4Gw :0xffffff00 +ponNum :1 +geNum :0 +xgeNum :1 +iphostNum :1 +potsNum :0 +veipNum :0 +ponSlot :1 +geSlot :2 +xgeSlot :3 +iphostSlot :0 +potsSlot :0 +veipSlot :4 +oltType :COMMON +ponMacMode :5 +maxQ/Tc :8 +ispType :COMMON +batteryBak :1 +remoteDbg :0 +powerCsvMd :0 +ipv6Flag :0 +veipIdp :0 +todRspTime :35000 +loid : +passwd : +vendorId :KAON +sn :KAON-a1b2c3d4 +version :V1.0 +eqId :PM1191 +mac :98:39:10:03:13:37 +psk :0x0000000000000000 +``` + +# GPON/OMCI settings + +## Getting/Setting ONU GPON Serial Number +```sh +# fw_printenv serial_number +serial_number=KAONA1B1C3D4 +# fw_setenv serial_number HWTCA1B2C3D4 +``` + +## Getting/Setting ONU GPON PLOAM password + +```sh +# fw_printenv gpon_passwd +gpon_passwd=000000000000000000000000000000000000000000000000000000000000000000000000 +# fw_setenv gpon_passwd +``` + +## Getting/Setting ONU GPON LOID and LOID password +```sh +# fw_getenv loid +# fw_getenv loid_passwd +# fw_setenv loid LoidUser +# fw_setenv loid_passwd LoidPass +``` + +## Getting/Setting OMCI software version (ME 7) +```sh +# fw_printenv img_version0 +img_version0=2.0.25_eng +# fw_printenv img_version1 +img_version1=2.0.25 +# fw_setenv img_version1 2.0.25_eng +# fw_setenv img_version1 2.0.25_eng +``` + +# Useful files and binaries +- `/overlay/upper/etc/scfg/scfg.encrypt` - Encrypted device configuration +- `/overlay/upper/etc/.kaon_key2` - Device encryption key +- `/etc/.kaon_key` - Firmware encryption key +- `/sbin/encrypt` - Helper script for file encryption/decryption. Deletes input file when encrypting! + +## List of partitions +- MTD + +| dev | size | erasesize | name | +| ---- | -------- | --------- | ------------------ | +| mtd0 | 00400000 | 20000 | "ssb" | +| mtd1 | 00200000 | 20000 | "uboot-env" | + +- UbiFS layout when booting from Image0 + +| dev | size | erasesize | name | +| ----- | -------- | --------- | ----------------- | +| mtd2 | 00100000 | 20000 | "dtb0" | +| mtd3 | 00600000 | 20000 | "kernel0" | +| mtd4 | 02800000 | 20000 | "rootfs0" | +| mtd5 | 00100000 | 20000 | "dtb1" | +| mtd6 | 00600000 | 20000 | "kernel1" | +| mtd7 | 02800000 | 20000 | "rootfs1" | +| mtd8 | 01400000 | 20000 | "userdata" | +| mtd9 | 00800000 | 20000 | "logdata" | +| mtd10 | 01129000 | 1f000 | "squashfs_ubi" | +| mtd11 | 01078000 | 1f000 | "userdata" | + +- UbiFS layout when booting from Image1 + +| dev | size | erasesize | name | +| ----- | -------- | --------- | ----------------- | +| mtd2 | 00100000 | 20000 | "dtb1" | +| mtd3 | 00600000 | 20000 | "kernel1" | +| mtd4 | 02800000 | 20000 | "rootfs1" | +| mtd5 | 00100000 | 20000 | "dtb0" | +| mtd6 | 00600000 | 20000 | "kernel0" | +| mtd7 | 02800000 | 20000 | "rootfs0" | +| mtd8 | 01400000 | 20000 | "userdata" | +| mtd9 | 00800000 | 20000 | "logdata" | +| mtd10 | 01129000 | 1f000 | "squashfs_ubi" | +| mtd11 | 01078000 | 1f000 | "userdata" | + +This ONT supports dual boot. + +Volumes `dtb0`, `kernel0` and `rootfs0` respectively contain kernel and rootfs of the first image, while `dtb1`, `kernel1` and `rootfs1` contain kernel and rootfs of the second one. + +Image switching is done by changing volume names in cmdline from U-Boot. + +```sh +setpartlayout=setenv partitions ${flash_id}:4M@0x0(ssb),2M(uboot-env),1M(dtb${active_part}),6M(kernel${active_part}),40M(rootfs${active_part}),1M(dtb${standby_part}),6M(kernel${standby_part}),40M(rootfs${standby_part}),20M(userdata),8M(logdata) +``` + + +## Booting to a different image +```sh +Image 0 +# fw_setenv img_active 1 +# fw_setenv img_commit 1 +# reboot +Image 1 +# fw_setenv img_active 2 +# fw_setenv img_commit 2 +# reboot +``` + +## Flashing new firmware +Only inactive image volumes should be written to. + +```sh +# cd /tmp +# wget 192.168.1.100:9999/new_rootfs1.img +# flash_eraseall /dev/mtd7 +# flashcp -v new_rootfs1.img /dev/mtd7 +``` + +## Decrypting device configuration +Configuration `/overlay/upper/etc/scfg/scfg.encrypt` and user passwords in U-Boot environment are encrypted with key derived from device MAC address. + +This key can be easily generated. + +```py +import hashlib, sys +# Based on "/sbin/encrypt" script +# openssl enc ${ENCRYPT_OPTION} -aes-256-cbc -salt -pbkdf2 -in ${ENCRYPT_INPUT_FILE} -out ${ENCRYPT_OUTPUT_FILE} -pass file:kaon_key2 +mac = "98:39:10:aa:bb:cc" +mackey = hashlib.sha512( f"ethaddr={mac}\x0a".encode('utf-8') ).hexdigest() +mackey = f"{mackey[1:33]}\n" +f = open("kaon_key2", "w") +f.write(mackey) +f.close() +``` + +# Miscellaneous Links +- [Hacking Cortina XGS-PON devices](https://github.com/YuukiJapanTech/CA8271x) diff --git a/_ont_xgs/ont-kaon.md b/_ont_xgs/ont-kaon.md new file mode 100644 index 00000000..b683125f --- /dev/null +++ b/_ont_xgs/ont-kaon.md @@ -0,0 +1,5 @@ +--- +title: KAON +has_children: true +layout: default +--- \ No newline at end of file diff --git a/assets/img/comtrend_grg-4284_teardown_1.jpg b/assets/img/comtrend_grg-4284_teardown_1.jpg new file mode 100644 index 00000000..93d1ec70 Binary files /dev/null and b/assets/img/comtrend_grg-4284_teardown_1.jpg differ diff --git a/assets/img/comtrend_grg-4362_teardown_1.jpg b/assets/img/comtrend_grg-4362_teardown_1.jpg new file mode 100644 index 00000000..025b6316 Binary files /dev/null and b/assets/img/comtrend_grg-4362_teardown_1.jpg differ diff --git a/assets/img/comtrend_grg-4362_teardown_2.jpg b/assets/img/comtrend_grg-4362_teardown_2.jpg new file mode 100644 index 00000000..d5ab5412 Binary files /dev/null and b/assets/img/comtrend_grg-4362_teardown_2.jpg differ diff --git a/assets/img/comtrend_grg-4362_teardown_3.jpg b/assets/img/comtrend_grg-4362_teardown_3.jpg new file mode 100644 index 00000000..5a9b1424 Binary files /dev/null and b/assets/img/comtrend_grg-4362_teardown_3.jpg differ diff --git a/assets/img/innbox_X24_teardown_1.jpg b/assets/img/innbox_X24_teardown_1.jpg new file mode 100644 index 00000000..7e4a9f73 Binary files /dev/null and b/assets/img/innbox_X24_teardown_1.jpg differ diff --git a/assets/img/kaon_pm1191_teardown_1.jpg b/assets/img/kaon_pm1191_teardown_1.jpg new file mode 100644 index 00000000..8961081b Binary files /dev/null and b/assets/img/kaon_pm1191_teardown_1.jpg differ diff --git a/assets/img/kaon_pm1191_teardown_2.jpg b/assets/img/kaon_pm1191_teardown_2.jpg new file mode 100644 index 00000000..78393778 Binary files /dev/null and b/assets/img/kaon_pm1191_teardown_2.jpg differ diff --git a/assets/img/tenda_hg1_v3_case.jpg b/assets/img/tenda_hg1_v3_case.jpg new file mode 100644 index 00000000..d7e9af3b Binary files /dev/null and b/assets/img/tenda_hg1_v3_case.jpg differ diff --git a/assets/img/tenda_hg1_v3_pcb.jpg b/assets/img/tenda_hg1_v3_pcb.jpg new file mode 100644 index 00000000..9a6e62cb Binary files /dev/null and b/assets/img/tenda_hg1_v3_pcb.jpg differ