电信光猫HG EP800S怎么破解？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？
按照网上唯一一个教程，
第一，用useradmin登陆猫
第二，打开http://192.168.1.1/backupsettings.conf 提示下载 并保存到桌面
用软件，就可以解密了
那个连接根本打不开，
通过23端口telnet 光猫ip 该端口被关闭了，
通过TTL线连接光猫主板TX TX GND接口读光猫启动信息，后，出现login password 试过了电信光猫常用的root admin 都不对，究竟是啥账号密码 啊，就能进路由器操作系统了，打一些命令 或者查看文件就能知道超级用户密码了
但是可以终止启动进cfe，但cfe是刷机清nvram 啥的别的干不了
下面是开机启动信息：
HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
STRF
400H
PHYE
DINT
LASY
USYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
NAN0
BT00
0001
NAN9
STOP
NAN9
NAN3
RFS1
NAN5
CFE version 1.0.38-114.20 for BCM96828 (32bit,SP,BE)
Build Date: Thu Nov 28 10:14:28 CST 2013 (wangwei@TWSH-EoC)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name Esmt F59L1G81A, id 0x0092f1 block 128KB size 131072KB
init spare blks start=0 end=1024
e1016e1021e1022
Chip ID: BCM6821A0, MIPS: 400MHz, DDR: 800MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host/ramdisk(f/h/r): f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Board Id (0-13) : 96828HGU_2FE
Number of MAC Addresses (1-32) : 11
Base MAC Address : c4:09:38:27:b8:27
PSI Size (1-64) KBytes : 48
Enable Backup PSI [0|1] : 1
System Log Size (0-256) KBytes : 0
Flash Block Size (1-128) in KBytes: 64
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
Product codeClass : 0x00000000
Product codeHwInfo : 0x00000000
Product codePortMap : 0x00000000
Product codeExtend : 0x00000000
Voice Board Configuration (0-0) : LE9530
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
seq1=0 seq2=-1 find 1 img
Booting from only image (0xb8020000) ...
Decompression OK!
Entry at 0x80329000
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x80329000
Linux version 2.6.30 (wangwei@TWSH-EoC) (gcc version 4.4.2 (Buildroot 2010.02-git) )
PREEMPT
BCM Flash API. Flash device is not found.
96828HGU_2FE prom init
Linux TP ID = 0
CPU revision is: 0002a080 (Broadcom4350)
Determined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat 80413db0, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 96 pages used for memmap
Normal zone: 12192 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: root=mtd:rootfs ro rootfstype=jffs2 console=ttyS0,115200
wait instruction: enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:128
PID hash table entries: 256 (order: 8, 1024 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x8108c740 SIZE=1907072, INIT=0x8125e0c0 SIZE=44
Memory: 58596k/65536k available (3199k kernel code, 6920k reserved, 917k data, 144k init, 0k highmem)
Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
Mount-cache hash table entries: 512
--Kernel Config--
SMP=0
PREEMPT=1
DEBUG_SPINLOCK=0
DEBUG_MUTEXES=0
net_namespace: 1128 bytes
NET: Registered protocol family 16
Total Flash size: 0K with -1 sectors
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0: IO window: disabled
pci 0000:01:00.0: MEM window: disabled
pci 0000:01:00.0: PREFETCH window: disabled
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS initialized
Broadcom GBPM initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
JFFS2 version 2.2. (NAND) 漏 2001-2006 Red Hat, Inc.
fuse init (API version 7.11)
msgmni has been set to 114
io scheduler noop registered (default)
pcieport-driver 0000:01:00.0: device [14e4:6828] has invalid IRQ; check vendor BIOS
PCI: Setting latency timer of device 0000:01:00.0 to 64
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
bcm963xx_mtd driver v2.0
Failed to read image tag from flash
Broadcom DSL NAND controller (BrcmNand Controller)
-->brcmnand_scan: CS=0, numchips=1, csi=0
mtd->oobsize=0, mtd->eccOobSize=0
NAND_CS_NAND_XOR=00000000
Disabling XOR on CS#0
brcmnand_scan: Calling brcmnand_probe for CS=0
B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0
brcmnand_read_id: CS0: dev_id=92f18095
After: NandSelect=40000001, nandConfig=15142200
DevId 92f18095 may not be supported. Will use config info
Spare Area Size = 16B/512B
Block size=00020000, erase shift=17
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 6574845b
timing2 not adjusted: 00001e96
brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7ff1010
ECC level changed to 15
OOB size changed to 16
BrcmNAND mfg 0 0 UNSUPPORTED NAND CHIP 128MB on CS0
Found NAND on CS0: ACC=f7ff1010, cfg=15142200, flashId=92f18095, tim1=6574845b, tim2=00001e96
BrcmNAND version = 0x80000500 128MB @00000000
brcmnand_scan: Done brcmnand_probe
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
100 CS=0, chip->ctrl->CS[0]=0
ECC level 15, threshold at 1 bits
reqEccLevel=0, eccLevel=15
190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010
brcmnand_scan 10
200 CS=0, chip->ctrl->CS[0]=0
200 chip->ecclevel=15, acc=f7ff1010
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
brcmnand_scan 220
Brcm NAND controller version = 5.0 NAND flash size 128MB @18000000
brcmnand_scan 230
brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000
brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0
ECC layout=brcmnand_oob_bch4_4k
brcmnand_scan: mtd->oobsize=64
brcmnand_scan: oobavail=50, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3
300 CS=0, chip->ctrl->CS[0]=0
500 chip=8389ad80, CS=0, chip->ctrl->CS[0]=0
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_main_descr
Bad block table Bbt0 not found for chip on CS0
Bad block table 1tbB not found for chip on CS0
Scanning device for bad blocks, options=00004000
Bad eraseblock 1023 at 0x07fe0000
-->brcmnand_isbad_raw(offs=7fc0000
e1022<7>Bad block table written to 0x07fc0000, version 0x01
-->brcmnand_isbad_raw(offs=7fa0000
e1021<7>Bad block table written to 0x07fa0000, version 0x01
brcmnandCET: Did not find CET, recreating
e1016<6>brcmnandCET: Status -> Deferred
brcmnand_scan 99
Creating 5 MTD partitions on "brcmnand.0":
0x000000020000-0x000003d80000 : "rootfs"
0x000003d80000-0x000007ae0000 : "rootfs_update"
0x000007b00000-0x000007c00000 : "data"
0x000000000000-0x000000020000 : "nvram"
0x000007c00000-0x000007f00000 : "middleware"
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x0 is enabled
SES: LED GPIO 0x8012 is enabled
WIFI: Button Interrupt 0x2 is enabled
PCIe: No device found - Powering down
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 43) is a BCM63XX
Total # RxBds=1300
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
|
/1 
粤公网安备44152102000001号 
发表于 2015-1-7 21:33:10