Hitron CGNM-2250: Difference between revisions
From Leo's Notes
This page was last edited on 17 December 2023, at 23:56.
Created page with "The Hitron CGNM-2250 is a DOCSIS 3.0 modem that was used with Shaw. We used it sometime between 2017 through to 2023. == Hardware == More info on Wireless Cat: * https://wikidevi.wi-cat.ru/Hitron_CGNM The Hitron CGNM uses a Intel Atom CPU with 512MB of DDR3 memory. There is a 128MB NAND flash module. == Hacking == There are 2 4-pin headers on the main board. Both are 3.3v serial connectors at 115200 baud. The one closest to the CPU seems to be a secondary serial conne..." |
No edit summary |
||
| Line 8: | Line 8: | ||
== Hacking == | == Hacking == | ||
There are | There are two 4-pin headers on the main board. Both are 3.3v serial connectors at 115200 baud. The one closest to the CPU seems to be a secondary serial connector with only brief messages about the kernel extracting and booting on power up. The other serial header seems to be the primary serial device since there are POST messages when the system boots. | ||
The default Shaw firmware seems to be locked down. | The default Shaw firmware seems to be locked down as there's no way to interact with the bootloader on startup. The only messages printed is this: | ||
{{Highlight | |||
| code = Fail to enable battery: temperature safety violation | |||
AC_BOOT | |||
POST: 0xb03 | |||
wdt: reset type = 0, reset reason = 0 | |||
POST: 0xc02 | |||
cefdk_rom_base_addr: 0x00280800 | |||
POST: 0xc1f | |||
wdt: acboot win2 end, counter=1121868 | |||
POST: 0xf02cs =0, jedec=ffffff | |||
Warning: No device found in chip select 0 | |||
Spi Flash Init Failed and disable SPI Fl | |||
Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK) | |||
Copyright (C) 1999-2012 Intel Corporation. All rights reserved. | |||
Build Time (Aug 18 2015,20:31:26). | |||
POST: 0xf07 | |||
Set flash layout to Intel 128MB layout Rev 1 | |||
WARNING: Ancient bootloader, some functionality may be limited! | |||
| lang = text | |||
}} | |||
=== Root access === | === Root access === | ||
The only way to get root access on the device is to hold down the button nearest the serial connector (not the reset button) when powering on the device. This makes the system boot Linux using partition 6 as root. I tried to hold down the enter key and space key during the booting process but it did not allow changing the boot option. Holding down the enter key during the booting process does result in the BIOS printing "please input your password" but nothing else. | The only way to get root access on the device is to hold down the button nearest the serial connector (not the reset button) when powering on the device. This makes the system boot Linux using partition 6 as root. I tried to hold down the enter key and space key during the booting process but it did not allow changing the boot option. Holding down the enter key during the booting process does result in the BIOS printing "<code>please input your password</code>" but nothing else. | ||
{{Highlight | |||
| code = Fail to enable battery: temperature safety violation | |||
AC_BOOT | |||
POST: 0xb03 | |||
wdt: reset type = 0, reset reason = 0 | |||
POST: 0xc02 | |||
cefdk_rom_base_addr: 0x00280800 | |||
POST: 0xc1f | |||
wdt: acboot win2 end, counter=1075261 | |||
POST: 0xf02cs =0, jedec=ffffff | |||
Warning: No device found in chip select 0 | |||
Spi Flash Init Failed and disable SPI Fl | |||
Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK) | |||
Copyright (C) 1999-2012 Intel Corporation. All rights reserved. | |||
Build Time (Aug 18 2015,20:31:26). | |||
POST: 0xf07 | |||
Set flash layout to Intel 128MB layout Rev 1 | |||
WARNING: Ancient bootloader, some functionality may be limited! | |||
[MFG] nonpcpu found, start test mode... | |||
ADDRCONF(NETDEV_UP): eth0: link is not ready | |||
e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX | |||
8021q: adding VLAN 0 to HW filter on device eth0 | |||
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready | |||
168c0030 168c003c | |||
killall: nart.out: no process killed | |||
rmmod: can't unload 'art': unknown symbol in module, or unknown parameter | |||
killall: hostapd_booster: no process killed | |||
killall: hostapd: no process killed | |||
NUMRADIO_PCI 2 | |||
NUMRADIO = (2) | |||
DEFAULT_GW: | |||
AP_STARTMODE=multi, do multi VAP | |||
my_vaps ('' _2 _3 _4 _5 _6 _7 _8 _9 _10 _11 _12 _13 _14 _15 _16) | |||
num_2: 1 num_5:1 | |||
0 ITER_VAP_COUNT = 1 | |||
interface:ath0 | |||
makeVAP ap-wds Hitron_ATH_2G 0:RF:6:11NGHT40PLUS 100 0 :::1 | |||
1->ap-wds 2->Hitron_ATH_2G 3->0:RF:6:11NGHT40PLUS 4->100 5->0 6->:::1 7-> 8-> 9-> 10-> | |||
CFGINDEX=0 | |||
DTIMPERIOD= | |||
FRAG= | |||
RTS= | |||
Args: 1 | |||
mem_manager: module license 'unspecified' taints kernel. | |||
Disabling lock debugging due to kernel taint | |||
ath_dfs: Version 2.0.0 | |||
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved | |||
... lots of stuff ... | |||
### Start /etc/rc3.d/iwevent | |||
iwevent SUCCESS | |||
/bin/init_man: init_man.sh: svc_get failed for icepm_gateway: No such file or directory | |||
/bin/init_man: init_man.sh: service icepm_gateway not found, cannot delete | |||
/bin/init_man: init_man.sh: svc_get failed for runtime_pm: No such file or directory | |||
/bin/init_man: init_man.sh: service runtime_pm not found, cannot delete | |||
##### Starting Scripts Complete ###### | |||
Please press Enter to activate this console. | |||
starting pid 3909, tty '': '-/bin/sh' | |||
# | |||
| lang = text | |||
}} | |||
Once you're on the router as root, you can change its default IP address. This mode seems to always bring up the device as 192.168.0.245, but changing this using the usual ip command works fine. Once you have networking working, you can mount NFS and telnet onto the system (login as 'root' with the password 'root'). | Once you're on the router as root, you can change its default IP address. This mode seems to always bring up the device as 192.168.0.245, but changing this using the usual <code>ip</code> command works fine. Once you have networking working, you can mount NFS and telnet onto the system (login as 'root' with the password 'root'). | ||
Exploring the partitions, we see that there are 13 partitions in mmcblk0. The first partition seems to contain the BIOS for the Intel Atom as it contains binaries that are used by the BIOS as it boots | Exploring the partitions, we see that there are 13 partitions in <code>mmcblk0</code>. The first partition seems to contain the BIOS for the Intel Atom as it contains binaries that are used by the BIOS as it boots. | ||
The router.cfg file contains all the options set by the Hitron web interface. There are 4 accounts (1 of which is an admin) as defined by this file: | The <code>router.cfg</code> file contains all the options set by the Hitron web interface. There are 4 accounts (1 of which is an admin) as defined by this file: | ||
{{highlight|lang=text|code= | {{highlight|lang=text|code= | ||
um_auth_account_name admin mso | um_auth_account_name admin mso | ||
| Line 35: | Line 129: | ||
}} | }} | ||
You typically login as cusadmin. That's typically set to 'password' out of the box. The mso account is the only admin account. The password is 'msopassword' but is locked out by default. | You typically login as <code>cusadmin</code>. That's typically set to '<code>password</code>' out of the box. The <code>mso</code> account is the only admin account. The password is '<code>msopassword</code>' but is locked out by default. | ||
I tried to change router.cfg but it seemed to revert to factory settings on the next reboot. There's something checking the file somewhere which I've yet to figure out. | I tried to change <code>router.cfg</code> but it seemed to revert to factory settings on the next reboot. There's something checking the file somewhere which I've yet to figure out. | ||
Revision as of 23:56, 17 December 2023
The Hitron CGNM-2250 is a DOCSIS 3.0 modem that was used with Shaw. We used it sometime between 2017 through to 2023.
Hardware
More info on Wireless Cat:
The Hitron CGNM uses a Intel Atom CPU with 512MB of DDR3 memory. There is a 128MB NAND flash module.
Hacking
There are two 4-pin headers on the main board. Both are 3.3v serial connectors at 115200 baud. The one closest to the CPU seems to be a secondary serial connector with only brief messages about the kernel extracting and booting on power up. The other serial header seems to be the primary serial device since there are POST messages when the system boots.
The default Shaw firmware seems to be locked down as there's no way to interact with the bootloader on startup. The only messages printed is this:
Fail to enable battery: temperature safety violation
AC_BOOT
POST: 0xb03
wdt: reset type = 0, reset reason = 0
POST: 0xc02
cefdk_rom_base_addr: 0x00280800
POST: 0xc1f
wdt: acboot win2 end, counter=1121868
POST: 0xf02cs =0, jedec=ffffff
Warning: No device found in chip select 0
Spi Flash Init Failed and disable SPI Fl
Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK)
Copyright (C) 1999-2012 Intel Corporation. All rights reserved.
Build Time (Aug 18 2015,20:31:26).
POST: 0xf07
Set flash layout to Intel 128MB layout Rev 1
WARNING: Ancient bootloader, some functionality may be limited!
Root access
The only way to get root access on the device is to hold down the button nearest the serial connector (not the reset button) when powering on the device. This makes the system boot Linux using partition 6 as root. I tried to hold down the enter key and space key during the booting process but it did not allow changing the boot option. Holding down the enter key during the booting process does result in the BIOS printing "please input your password" but nothing else.
Fail to enable battery: temperature safety violation
AC_BOOT
POST: 0xb03
wdt: reset type = 0, reset reason = 0
POST: 0xc02
cefdk_rom_base_addr: 0x00280800
POST: 0xc1f
wdt: acboot win2 end, counter=1075261
POST: 0xf02cs =0, jedec=ffffff
Warning: No device found in chip select 0
Spi Flash Init Failed and disable SPI Fl
Intel(R) Consumer Electronics Firmware Development Kit (Intel(R) CEFDK)
Copyright (C) 1999-2012 Intel Corporation. All rights reserved.
Build Time (Aug 18 2015,20:31:26).
POST: 0xf07
Set flash layout to Intel 128MB layout Rev 1
WARNING: Ancient bootloader, some functionality may be limited!
[MFG] nonpcpu found, start test mode...
ADDRCONF(NETDEV_UP): eth0: link is not ready
e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
8021q: adding VLAN 0 to HW filter on device eth0
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
168c0030 168c003c
killall: nart.out: no process killed
rmmod: can't unload 'art': unknown symbol in module, or unknown parameter
killall: hostapd_booster: no process killed
killall: hostapd: no process killed
NUMRADIO_PCI 2
NUMRADIO = (2)
DEFAULT_GW:
AP_STARTMODE=multi, do multi VAP
my_vaps ('' _2 _3 _4 _5 _6 _7 _8 _9 _10 _11 _12 _13 _14 _15 _16)
num_2: 1 num_5:1
0 ITER_VAP_COUNT = 1
interface:ath0
makeVAP ap-wds Hitron_ATH_2G 0:RF:6:11NGHT40PLUS 100 0 :::1
1->ap-wds 2->Hitron_ATH_2G 3->0:RF:6:11NGHT40PLUS 4->100 5->0 6->:::1 7-> 8-> 9-> 10->
CFGINDEX=0
DTIMPERIOD=
FRAG=
RTS=
Args: 1
mem_manager: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
... lots of stuff ...
### Start /etc/rc3.d/iwevent
iwevent SUCCESS
/bin/init_man: init_man.sh: svc_get failed for icepm_gateway: No such file or directory
/bin/init_man: init_man.sh: service icepm_gateway not found, cannot delete
/bin/init_man: init_man.sh: svc_get failed for runtime_pm: No such file or directory
/bin/init_man: init_man.sh: service runtime_pm not found, cannot delete
##### Starting Scripts Complete ######
Please press Enter to activate this console.
starting pid 3909, tty '': '-/bin/sh'
#
Once you're on the router as root, you can change its default IP address. This mode seems to always bring up the device as 192.168.0.245, but changing this using the usual ip command works fine. Once you have networking working, you can mount NFS and telnet onto the system (login as 'root' with the password 'root').
Exploring the partitions, we see that there are 13 partitions in mmcblk0. The first partition seems to contain the BIOS for the Intel Atom as it contains binaries that are used by the BIOS as it boots.
The router.cfg file contains all the options set by the Hitron web interface. There are 4 accounts (1 of which is an admin) as defined by this file:
um_auth_account_name admin mso
um_auth_account_password admin $1$Qw/d/uIf$lkYLZEhpxY46CQPYpUxqB1
um_auth_account_enable admin true
um_auth_account_name user1 cusadmin
um_auth_account_password user1 $1$Qw/d/uIf$pcaWzKv6eY1lD4txqoQKq1
um_auth_account_enable user1 true
um_auth_account_name user2 comadmin
um_auth_account_password user2 $1$Qw/d/uIf$xfah7wBUOSdTayBZmDtMs/
um_auth_account_enable user2 false
um_auth_account_name user3 admin
um_auth_account_password user3 $1$Qw/d/uIf$QoCnlC1SkZRyUcdSMKvKF.
um_auth_account_enable user3 false
You typically login as cusadmin. That's typically set to 'password' out of the box. The mso account is the only admin account. The password is 'msopassword' but is locked out by default.
I tried to change router.cfg but it seemed to revert to factory settings on the next reboot. There's something checking the file somewhere which I've yet to figure out.