中兴ZXV10 H618C超级密码破解全攻略
本帖最后由 dogb 于 2010-12-21 14:18 编辑前阵子玩坏了贝尔的RG200E，今天新到手的中兴捎带脚的给破了。参考了坛里的一些帖子
1，TTL线序 从下到上，第二个起，是地线，收，发。
2，当TTL显示信息如下：
00:01:XXRTCP thread started with pid 1009
Line 0: Setting egress: 0, ingress: 0
（按回车）
CONSOLED launched
Login: twsz（回车）
Password: twsz(回车，屏幕是没有回应的要盲打)
>restoredefault（回车，如想进Linux系统，sh 回车）
3，这时路由会自动恢复出厂设置并自动重启，等重启完成即可
4，IE下登陆路由：192.168.1.1用户名：telecomadmin 密码：nE7jA%5m
有点遗憾的是CFE的密码没搞定。。。感兴趣的兄弟们顶一把哈
这个要顶。 为什么 我的中兴h618C用TTL启动没有
00:01:XXRTCP thread started with pid 1009
Line 0: Setting egress: 0, ingress: 0
这几行呀？ 看看我这个的TTL启动信息
Linux version 2.6.8.1 (root@localhost.localdomain) (gcc version 3.4.2) #4 Thu Aug 5 08:38:21 CST 2010
Parallel flash device: name AM29LV320MT|S29GL128-A, id 0x2201, size 16384KB
fInfo.flash_rootfs_available_length = 16252928
96358VW2 prom init
CPU revision is: 0002a010
Determined physical RAM map:
memory: 01fa0000 @ 00000000 (usable)
On node 0 totalpages: 8096
DMA zone: 4096 pages, LIFO batch:1
Normal zone: 4000 pages, LIFO batch:1
HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 32kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 16kB 2-way, linesize 16 bytes.
PID hash table entries: 128 (order 7: 1024 bytes)
Using 150.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x8104ca80 SIZE=615168, INIT=0x0 SIZE=0
Memory: 28760k/32384k available (1897k kernel code, 3580k reserved, 498k data, 76k init, 0k highmem)
Calibrating delay loop... 299.00 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...unavailable.
NET: Registered protocol family 16
Total Flash size: 16384K with 128 sectors
Computing partition layout for flash of size sectors
Flash split 25% into RootFS+Kernel : AuxFS
Partition ROOTFS_KRN Blks[ 92: 1 ..92]
SubPartition Image 1 Blks[ 46: 1 ..46]
SubPartition Image 2 Blks[ 46:47 ..92]
Blk# BlkOff Blks BlkSize AvailSize MemStart MemLen Partition Name
0 1408 1131072 131072 0xbe000580 1024 BOOTLOADER
1 0 9213107212058624 0xbe020000 12058624 ROOTFS_KRN
93 0 32131072 4194304 0xbeba0000 4194304 JFFS_AUXFS
125 0 1131072 131072 0xbefa0000 131072 LOG_SCRPAD
126 106496 1131072 131072 0xbefda000 24576 TW_PERSISTMEM
127 106496 1131072 131072 0xbeffa000 24576 PERSISTMEM
Can't analyze prologue code at 801e8d94
SCSI subsystem initialized
usbcore: registered new driver hub
TC classifier action (bugs to netdev@oss.sgi.com cc hadi@cyberus.ca)
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
Initializing Cryptographic API
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v2.0
File system address: 0xbe5e0100
Registered device mtd dev Flash
Registered device mtd dev Flash
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: EHCI Host Controller
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: irq 18, pci mem c0050300
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
PCI: cache line size of 32 is not supported by device 0000:00:0a.0
ehci_hcd 0000:00:0a.0: USB f.f enabled, EHCI 1.00, driver 2004-May-10
PRODUCT=0/0/206 !
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
ohci_hcd: block sizes: ed 64 td 64
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: OHCI Host Controller
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: irq 13, pci mem c0052400
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
PRODUCT=0/0/206 !
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x2 is enabled
WIFI: Button Interrupt 0x3 is enabled
WIFI: map_external_irq begin
SES: LED GPIO 0x8019 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xfffe0100 (irq = 10) is a BCM63XX
ttyS1 at MMIO 0xfffe0120 (irq = 11) is a BCM63XX
u32 classifier
Perfomance counters on
OLD policer on
input device check on
Actions configured
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
Initializing IPsec netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 76k freed
init started:BusyBox v1.00 (2010.08.04-09:27+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
BusyBox v1.00 (2010.08.04-09:27+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
Loading drivers and kernel modules...
fuse init (API version 7.8)
fuse distribution version: 2.7.3
bcmprocfs: module license 'Proprietary' taints kernel.
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6358A1 Ethernet Network Device v0.3 Aug4 2010 17:19:06
Config Internal PHY Through MDIO
BCM63xx_ENET: Auto-negotiation timed-out
BCM63xx_ENET: 10 MB Half-Duplex (assumed)
kerSysGetMacAddress:ulId=2
eth0: MAC Address: 08:18:1A:81:7B:1F
Broadcom BCM6358A1 Ethernet Network Device v0.3 Aug4 2010 17:19:06
Config Ethernet Switch Through MDIO Pseudo PHY Interface
dgasp: kerSysRegisterDyingGaspHandler: eth1 registered
kerSysGetMacAddress:ulId=3
eth1: MAC Address: 08:18:1A:81:7B:1F
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
kerSysGetMacAddress:ulId=2003566592
wl0: wlc_attach: use mac addr from the system pool by id: 0x776c0000
wl0: MAC Address: 08:18:1A:81:7B:20
wl0: Broadcom BCM4318 802.11 Wireless Controller 4.150.10.15.cpe2.2
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
Boot Address 0xbe000000
Initializing Arena.
Initializing Devices.
Parallel flash device: name AM29LV320MT|S29GL128-A, id 0x2201, size 16384KB
Flash Layout: Boot Kern
AuxFS Misc PSI
Flash RootFS Partition Length: 12058624
CPU type 0x2A010: 300MHz, Bus: 133MHz, Ref: 64MHz
CPU running TP0
Total memory: 33554432 bytes (32MB)
Total memory used by CFE:0x80401000 - 0x805293E0 (1213408)
Initialized Data: 0x8041E5B0 - 0x80420BF0 (9792)
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-8) : 96358VW2
Number of MAC Addresses (1-32) : 11
Base MAC Address : 08:18:1a:81:7b:1f
PSI Size (1-64) KBytes : 24
Flash Block Size (1-128) in KBytes: 128
Auxillary File System Size Percent: 25
Main Thread Number : 0
udp_send finished
No answer .auto boot ...
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from latest image (0xbe5e0000) ...
Code Address: 0x80010000, Entry Address: 0x80268018
Decompression OK!
Entry at 0x80268018
Closing network.
Starting program at 0x80268018
Linux version 2.6.8.1 (root@localhost.localdomain) (gcc version 3.4.2) #4 Thu Aug 5 08:38:21 CST 2010
Parallel flash device: name AM29LV320MT|S29GL128-A, id 0x2201, size 16384KB
fInfo.flash_rootfs_available_length = 16252928
96358VW2 prom init
CPU revision is: 0002a010
Determined physical RAM map:
memory: 01fa0000 @ 00000000 (usable)
On node 0 totalpages: 8096
DMA zone: 4096 pages, LIFO batch:1
Normal zone: 4000 pages, LIFO batch:1
HighMem zone: 0 pages, LIFO batch:1
Built 1 zonelists
Kernel command line: root=31:0 ro noinitrd console=ttyS0,115200
brcm mips: enabling icache and dcache...
Primary instruction cache 32kB, physically tagged, 2-way, linesize 16 bytes.
Primary data cache 16kB 2-way, linesize 16 bytes.
PID hash table entries: 128 (order 7: 1024 bytes)
Using 150.000 MHz high precision timer.
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x8104ca80 SIZE=615168, INIT=0x0 SIZE=0
Memory: 28760k/32384k available (1897k kernel code, 3580k reserved, 498k data, 76k init, 0k highmem)
Calibrating delay loop... 299.00 BogoMIPS
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Checking for 'wait' instruction...unavailable.
NET: Registered protocol family 16
Total Flash size: 16384K with 128 sectors
Computing partition layout for flash of size sectors
Flash split 25% into RootFS+Kernel : AuxFS
Partition ROOTFS_KRN Blks[ 92: 1 ..92]
SubPartition Image 1 Blks[ 46: 1 ..46]
SubPartition Image 2 Blks[ 46:47 ..92]
Blk# BlkOff Blks BlkSize AvailSize MemStart MemLen Partition Name
0 1408 1131072 131072 0xbe000580 1024 BOOTLOADER
1 0 9213107212058624 0xbe020000 12058624 ROOTFS_KRN
93 0 32131072 4194304 0xbeba0000 4194304 JFFS_AUXFS
125 0 1131072 131072 0xbefa0000 131072 LOG_SCRPAD
126 106496 1131072 131072 0xbefda000 24576 TW_PERSISTMEM
127 106496 1131072 131072 0xbeffa000 24576 PERSISTMEM
Can't analyze prologue code at 801e8d94
SCSI subsystem initialized
usbcore: registered new driver hub
TC classifier action (bugs to netdev@oss.sgi.com cc hadi@cyberus.ca)
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
Initializing Cryptographic API
PPP generic driver version 2.4.2
NET: Registered protocol family 24
Using noop io scheduler
bcm963xx_mtd driver v2.0
File system address: 0xbe5e0100
Registered device mtd dev Flash
Registered device mtd dev Flash
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: EHCI Host Controller
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: irq 18, pci mem c0050300
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
PCI: cache line size of 32 is not supported by device 0000:00:0a.0
ehci_hcd 0000:00:0a.0: USB f.f enabled, EHCI 1.00, driver 2004-May-10
PRODUCT=0/0/206 !
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: 2004 Feb 02 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI)
ohci_hcd: block sizes: ed 64 td 64
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: OHCI Host Controller
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: irq 13, pci mem c0052400
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
PRODUCT=0/0/206 !
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x2 is enabled
WIFI: Button Interrupt 0x3 is enabled
WIFI: map_external_irq begin
SES: LED GPIO 0x8019 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xfffe0100 (irq = 10) is a BCM63XX
ttyS1 at MMIO 0xfffe0120 (irq = 11) is a BCM63XX
u32 classifier
Perfomance counters on
OLD policer on
input device check on
Actions configured
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
Initializing IPsec netlink socket
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 76k freed
init started:BusyBox v1.00 (2010.08.04-09:27+0000) multi-call binary
Algorithmics/MIPS FPU Emulator v1.5
BusyBox v1.00 (2010.08.04-09:27+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.
Loading drivers and kernel modules...
fuse init (API version 7.8)
fuse distribution version: 2.7.3
bcmprocfs: module license 'Proprietary' taints kernel.
Broadcom BCMPROCFS v1.0 initialized
Broadcom BCM6358A1 Ethernet Network Device v0.3 Aug4 2010 17:19:06
Config Internal PHY Through MDIO
BCM63xx_ENET: Auto-negotiation timed-out
BCM63xx_ENET: 10 MB Half-Duplex (assumed)
kerSysGetMacAddress:ulId=2
eth0: MAC Address: 08:18:1A:81:7B:1F
Broadcom BCM6358A1 Ethernet Network Device v0.3 Aug4 2010 17:19:06
Config Ethernet Switch Through MDIO Pseudo PHY Interface
dgasp: kerSysRegisterDyingGaspHandler: eth1 registered
kerSysGetMacAddress:ulId=3
eth1: MAC Address: 08:18:1A:81:7B:1F
PCI: Setting latency timer of device 0000:00:01.0 to 64
PCI: Enabling device 0000:00:01.0 (0004 -> 0006)
wl: srom not detected, using main memory mapped srom info (wombo board)
kerSysGetMacAddress:ulId=2003566592
wl0: wlc_attach: use mac addr from the system pool by id: 0x776c0000
wl0: MAC Address: 08:18:1A:81:7B:20
wl0: Broadcom BCM4318 802.11 Wireless Controller 4.150.10.15.cpe2.2
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
DSP Driver: DSP init stub
Endpoint: endpoint_init entry
BOS: Enter bosInit
Enter bosAppInit
Exit bosAppInit
BOS: Exit bosInit
Endpoint: endpoint_init COMPLETED
eth1 Link UP.
usbback enable:1
##no usb device22
xmlEndUserInfoAttr(calling cfm to get appName SystemInfo, objName userInfo
xmlEndUserInfoAttr(calling cfm to get appName SystemInfo, objName userInfo
xmlEndUserInfoAttr(calling cfm to get appName SystemInfo, objName userInfo
BcmDb_setPMapInfo: id=2
BcmDb_setPMapInfo: id=5
-----BcmDb_setWanInfo, 1453, maxmtu=1466
BcmDb_setWanInfo: vlanMuxId= 46 pWanInfo->conName=1_TR069_VOIP_R_VID_46
-----BcmDb_setWanInfo, 1463, maxmtu=1466
BcmDb_updateWanInfo: vlanMuxId= 46
ip_tables: (C) 2000-2002 Netfilter core team
ip_conntrack version 2.1 (253 buckets, 0 max) - 392 bytes per conntrack
ip_conntrack_pptp version 2.1 loaded
ip_nat_pptp version 2.0 loaded
ip_ct_h323: init success
ip_nat_h323: init success
ipt_time loading
ip_nat_irc: Unknown symbol needs_ip_conntrack_irc
insmod: cannot insert `/lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/ip_nat_irc.ko': Success (2): Success
ip_nat_rtsp: Unknown symbol needs_ip_conntrack_rtsp
insmod: cannot insert `/lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/ip_nat_rtsp.ko': Success (2): Success
ip_conntrack_devicectl: load success
ip_syslog_out_ops: load success
IPP2P v0.99.16 loading
ip_conntrack_rtsp v0.01 loading
##################
ip_url_filter_ops: load success
get qos queue policy type error
Enable = 0
iptables: Bad rule (does a matching rule exist in that chain?)
==> Bcm963xx Software Version: ZXV10 H618CV1.2.20T00_1E_GX <==
BcmNtwk_initLan BcmNtwk_initIPv4
BcmNtwk_initLan BcmNtwk_setBridgeName
BcmNtwk_initLan bcmStoreDeviceInfoToProcFile
BcmNtwk_initLan HPNA
BcmNtwk_initLan USB
BcmNtwk_initLan Ethernet
device eth0 entered promiscuous mode
BcmNtwk_initLan LAN2
BcmNtwk_initLan BcmNtwk_initLan
BcmNtwk_initLan BcmNtwk_initFirewall
BcmNtwk_initLan BcmNtwk_initDosProtect
BcmNtwk_initLan BcmNtwk_initAlg
BcmNtwk_initLan BcmNtwk_initFactoryMode
buffer=2.6.8.1
ip_conntrack_devicectl: unload
ip_conntrack_devicectl: unload success
-----insmod=insmod /lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/ip_conntrack_devicectl.ko ip_begin=3232235777 ip_end=3232236030mode=1 maxTotalNumber=4 maxComputerNumber=1 maxStbNumber=0 maxCameraNumber=1 computerStatus=0 stbStatus=0 cameraStatus=0
ip_conntrack_devicectl: load success
BcmNtwk_initLan BcmNtwk_loadDeviceModule
BcmNtwk_initLan BcmWl_Init_All
ses_led_off_ex I want
ctlstate = 0x0
recv action = 0
recv event = 0x0
blinktype=0, event=0, status=0
Setting SSID "ChinaNet-AwYs"
Setting SSID "ChinaNet-Guest2"
Setting SSID "ChinaNet-Guest3"
Setting SSID "ChinaNet-Guest4"
Setting country code using abbreviation: "ALL"
enable wmf wlctl -i wl0 wmf_bss_enable 1
enable wmf wlctl -i wl0.1 wmf_bss_enable 1
enable wmf wlctl -i wl0.2 wmf_bss_enable 1
enable wmf wlctl -i wl0.3 wmf_bss_enable 1
channel 1 selected
device wl0 entered promiscuous mode
device wl0.1 entered promiscuous mode
device wl0.2 entered promiscuous mode
device wl0.3 entered promiscuous mode
startWsc@3984 cfg_state= wsc_mode=enabled
WlMngr::startWsc: client-pbc mode
*********************************************
Wi-Fi Simple Config Application - Intel Corp.
Version: Build 1.0.5, November 19 2006
*********************************************
Created @ Dec7 2007 11:50:33
Initializing stack...button monitor start...!
OK
Now starting stack
get mac = 08 18 1A 81 7B 20
NvramMapping: akm=psk2mix
NvramMapping: auth_mode=none
BcmNtwk_initLan BcmWl_Init_All 2
BcmNtwk_initLan BcmNtwk_initWan
mii register 0 is 0x1000
eth0.46: Setting MAC address to08 18 1a 81 7b 23.
eth0.46: dev_set_promiscuity(master, 1)
BcmIPoWan_init: DHCP client enabled
BcmNtwk_initLan BcmRcm_init
BcmNtwk_initLan BcmPMcm_init
eth1.2: MAC Address: 08:18:1A:81:7B:1F
eth1.3: MAC Address: 08:18:1A:81:7B:1F
eth1.4: MAC Address: 08:18:1A:81:7B:1F
eth1.5: MAC Address: 08:18:1A:81:7B:1F
SIOCSIFFLAGS: Network is down
SIOCSIFFLAGS: Network is down
SIOCSIFFLAGS: Network is down
SIOCSIFFLAGS: Network is down
device wl0 left promiscuous mode
device wl0.1 left promiscuous mode
device wl0.2 left promiscuous mode
device wl0.3 left promiscuous mode
device wl0 entered promiscuous mode
device eth1.2 entered promiscuous mode
device eth1.3 entered promiscuous mode
device eth1.4 entered promiscuous mode
device eth1.5 entered promiscuous mode
device wl0.1 entered promiscuous mode
device wl0.2 entered promiscuous mode
device wl0.3 entered promiscuous mode
BcmNtwk_initLan BcmPMcm_init 2
BcmNtwk_initLan BcmWl_startService
ses_led_off_ex I want
ctlstate = 0x0
recv action = 0
recv event = 0x0
blinktype=0, event=0, status=0
startWsc@3984 cfg_state= wsc_mode=enabled
WlMngr::startWsc: client-pbc mode
*********************************************
Wi-Fi Simple Config Application - Intel Corp.
Version: Build 1.0.5, November 19 2006
*********************************************
Created @ Dec7 2007 11:50:33
Initializing stack...button monitor start...!
OK
Now starting stack
get mac = 08 18 1A 81 7B 20
NvramMapping: akm=psk2mix
NvramMapping: auth_mode=none
set_bind_entries 128
del all 222222
set_bind_entries 128
del all 222222
BcmNtwk_initLan SUPPORT_CERT
BcmNtwk_initLan BcmNtwk_initSysLog
BcmNtwk_initLan BcmNtwk_initDns
BcmNtwk_initLan SUPPORT_DDNSD
BcmNtwk_initLan SUPPORT_SNTP
BcmNtwk_initLan BcmNtwk_initIgmpSnp
BcmNtwk_initLan BcmNtwk_initMacFilter
sntp: host not found
BcmDb_updateVoipwaninterface: oldifbuf eth0.46
BcmDb_updateVoipwaninterface: voip wan interface is eth0.46
Voice application will be started once the WAN interface goes up.
BcmNtwk_initLan PORT_MIRRORING
BcmNtwk_initLan BcmCfm_init
-----BcmDb_setWanInfo, 1453, maxmtu=1466
BcmDb_setWanInfo: vlanMuxId= 46 pWanInfo->conName=1_TR069_VOIP_R_VID_46
-----BcmDb_setWanInfo, 1463, maxmtu=1466
BcmDb_updateWanInfo: vlanMuxId= 46
wsc_del_ie: no valid ie was saved, len = -1
******* MODE: AP with built-in Registrar and UPnP Proxy *******
wsc_del_ie: no valid ie was saved, len = -1
WSC: Build-in Registrar, wait for start command....
BcmNtwk_initLan BcmNtwk_initPppSessions
BcmNtwk_initLan SUPPORT_RTPROXY
BcmNtwk_initLan CT_MIDDLEWARE
algname: h323 enable
ip_nat_rtsp v0.01 loading
algname: rtsp enable
BRCTL_SET_COMPULSORYPORT_STATE:1
SIOCSIFFLAGS: Cannot assign requested address
Can not open /var/dnsspoof_pid
initialize_notifytovoip_socket notifytovoipfd 3
insmod: cannot open module `/lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/ip_conntrack_l2tp.ko': No such file or directory
insmod: cannot open module `/lib/modules/2.6.8.1/kernel/net/ipv4/netfilter/ip_nat_l2tp.ko': No such file or directory
algname: l2tp enable
algname: ipsec enable
algname: ftp enable
XXXX httpid = 868
ip_syslog_out_ops: unload
ip_syslog_out_ops: unload success
ip_syslog_out_ops: load success 回复 wei16888 的帖子
硬件没改造过的话，和我那个一样呀，有什么问题么？ 这个信息跳到什么地方按回车可以停住？进入linux 设置？ 回复 wei16888 的帖子
看到你的留言了，没有响应估计是TTL线的问题，或者你换台电脑试试 这个的TTL启动信息
学习了,谢谢版主. 回复 gyz6563 的帖子
应该是楼主不是版主吧，呵呵
PS：该机已经刷机成功openwrt，除了wan指示灯和reset按钮不好使，其他全部功能正常
并且可以脱机下载了
CFE 用户名和密码都是telecomadmin
附上固件