求高手破解下RG100A-BA E8-B 电信宽带无线猫

zhjook

PS3PS4 发表于 2014-3-2 10:22
我要是买了TTL然后怎么弄呢，求教程或者如何具体操作呢，是否还得拆开天翼无线猫，谢谢~

是要拆开的，用杜邦线接在pcb的插针上，用超级终端，puty之类的中端软件可以通过ttl小板给cpu发送指令，用user 用户可以登录，然后用命令dumpcfg 就可以查看完整的配置文件，找到超级密码
Booting from only image (0xb8010000) ...

Code Address: 0x80010000, Entry Address: 0x80306000
Decompression OK!
Entry at 0x80306000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
22 buffers found.
Closing DMA Channels.
Starting program at 0x80306000
Linux version 2.6.21.5 (root@localhost.localdomain) (gcc version 4.2.3) #1 Wed Feb 1 17:23:28 CST 2012
HS Serial flash device: name MX25L12845E, id 0xc218 size 16384KB
96328Tavng prom init
CPU revision is: 0002a075
Determined physical RAM map:
memory: 03f00000 @ 00000000 (usable)
On node 0 totalpages: 16128
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 94 pages used for memmap
  Normal zone: 11938 pages, LIFO batch:1
Built 1 zonelists.  Total pages: 16002
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 32kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (21 instructions).
Synthesized TLB load handler fastpath (33 instructions).
Synthesized TLB store handler fastpath (33 instructions).
Synthesized TLB modify handler fastpath (32 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
Using 160.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 60508k/64512k available (2430k kernel code, 3988k reserved, 597k data, 100k init, 0k highmem)
KLOB Pool 1 Initialized: 1048576 bytes <0x80c00000 ... 0x80d00000>
Calibrating delay loop... 318.46 BogoMIPS (lpj=159232)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
Total Flash size: 16384K with 256 sectors
Flash not used for Auxillary File System
Blk# BlkOff Blks  MemLen Partition Name
   0   1408    1    1024 NVRAM
254      0    1   49152 Backup PSI
253      0    1   49152 Syslog
253  49152    1    8192 Scratch PAD
255  16384    1   49152 PSI
   0      0    0       0 JFFS_AUXFS
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI: Bridge: 0000:01:00.0
  IO window: disabled.
  MEM window: 10f00000-10ffffff
  PREFETCH window: disabled.
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v2.1 Initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
squashfs: version 3.4 (2008/08/26) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
JFFS2 version 2.2. (C) 2001-2006 Red Hat, Inc.
fuse init (API version 7.8)
io scheduler noop registered (default)
PPP generic driver version 2.4.2
NET: Registered protocol family 24
bcm963xx_mtd driver v2.0
File system address: 0xb8010100
Registered device mtd[BCM63XX RootFS] dev[0] Flash[0xb8010100,5259264]
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: irq 50, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
bus: 'usb': really_probe: bound device 1-0:1.0 to driver hub
bus: 'usb': really_probe: bound device usb1 to driver usb
bus: 'pci': really_probe: bound device 0000:00:0a.0 to driver ehci_hcd
ohci_hcd: 2006 August 04 USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 49, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
bus: 'usb': really_probe: bound device 2-0:1.0 to driver hub
bus: 'usb': really_probe: bound device usb2 to driver usb
bus: 'pci': really_probe: bound device 0000:00:09.0 to driver ohci_hcd
usbcore: registered new interface driver cdc_acm
drivers/usb/class/cdc-acm.c: v0.25:USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
drivers/usb/serial/usb-serial.c: USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x1 is enabled
SES: LED GPIO 0x800a is enabled
WLAN: Button Interrupt 0x2 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xb0000100 (irq = 36) is a BCM63XX
ttyS1 at MMIO 0xb0000120 (irq = 36) is a BCM63XX
bcmxtmrt: Broadcom BCM6328B0 ATM/PTM Network Device v0.3 Feb  1 2012 17:21:37
bus: 'platform': really_probe: bound device bcmhs_spi.1 to driver bcmhs_spi
bus: 'spi': really_probe: bound device spi1.0 to driver bcm_HSSpiDev0
Mirror/redirect action on
u32 classifier
    input device check on
    Actions configured
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
6WIND/LSIIT IPv6 multicast forwarding 0.1 plus PIM-SM/SSM with *BSD API
NET: Registered protocol family 17
NET: Registered protocol family 15
Initializing MCPD Module
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 100k freed
init started:  BusyBox v1.00 (2012.02.01-09:26+0000) multi-call binary





BCM96328 xDSL Router
Login: user

Password:

> ls

consoled:error:181.663:processInput:315:unrecognized command ls
> ?

?
help
logout
exit
quit
reboot
adsl
xtm
brctl
cat
loglevel
logdest
virtualserver
ddns
df
dumpcfg
dumpmdm
meminfo
syslog
psp
echo
ifconfig
kill
ping
ps
pwd
macaddr
sntp
sysinfo
tftp
wlctl
arp
defaultgateway
dhcpserver
dns
lan
lanhosts
passwd
ppp
restoredefault
route
save
swversion
wan
keyteston
keytestoff
allledon
allledoff
softversion
usbtest
> dempcfg

<?xml version="1.0"?>
<DslCpeConfig version="2.0">
  <InternetGatewayDevice>
    <LANDeviceNumberOfEntries>1</LANDeviceNumberOfEntries>
    <WANDeviceNumberOfEntries>1</WANDeviceNumberOfEntries>
    <DeviceInfo>
      <FirstUseDate>0001-01-01T00:00:00Z</FirstUseDate>
      <X_CU_TeleComAccount>
        <Password>8mCnC@bj</Password>
      </X_CU_TeleComAccount>
      <X_CT_COM_RemoteStatus>
        <InformStatus>3</InformStatus>
        <StatusMessage>2</StatusMessage>
      </X_CT_COM_RemoteStatus>
    </DeviceInfo>
    <X_BROADCOM_COM_WebUILanguage>

邪恶海盗

刷成Tenda???

YES东

请问如何无法连接wifi

如此

这个型号的没用过，不过应该大同小异吧
网络-宽带-81的那条，里面有开启路由模式，改成pppoe就好了，输账号密码
如果是我了解的光猫一个类型的话

YES东

PS3PS4 发表于 2014-3-1 11:57
RG100A-BA E8-B 我WIFI连接上了满格 但是无法上网呢,打10000，说要弄个PPPoe拨号软件或者出个30RMB请维修人 ...

你开了路由功能没有，你要开启内置路由功能拨号后手机无线连接上才可以直接上网。猫的开路由功能要搞对当地的vpi和vci就行了。

zhjook

别上来就刷腾达，对于小白风险太高，花5块钱买个ttl 破解超级密码就行了，ba 应该是6328的cpu，ttl 登录用user用户和密码在ttl里边登录，dumpcfg 就可以得到明文的配置文件，可以找到超级密码，开路由加拨号，

findwm11

不知道这位小伙破解了没有。如果电信的初始超级密码不行的话，那就用网上流传很久的方法：useradmin登录无线猫WEB界面，然后输入192.168.1.1/backupsettings.conf,（记住，不要用IE浏览器)然后会下载一个后缀为conf的文档，用TXT打开，寻找telecomadminxxxxxxxx。万一这样还是不行，找淘宝吧。淘宝上好多高手。