Skip to content

Instantly share code, notes, and snippets.

@rettichschnidi

rettichschnidi/gist:cc92fee8f8076cd97b699817f14eb7cb

Created January 11, 2020 01:29
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save rettichschnidi/cc92fee8f8076cd97b699817f14eb7cb to your computer and use it in GitHub Desktop.
Save rettichschnidi/cc92fee8f8076cd97b699817f14eb7cb to your computer and use it in GitHub Desktop.
Download ZIP
Startup log of the Swisscom Internet-Box Light
Raw
gistfile1.txt
D%G----
BTL1
V1.1
CPUI
L1CI
PMCI
PMCS
AFEL
PWRZ
MEML
PMCD
CPUI
L1CI
ZBSS
CODE
DATA
L12F
MAIN
OTP?
MFGZ
OTPP
USBT
SNAN
PASS
----
HELO
CPUI
L1CI
4.1602-1.0.38-116.118
PMCI
PMCM
DRAM
----
PHYS
PHYE
DDR1
400H
SIZ4
SIZ3
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
FPS0
BT04
0025
BT03
0464
NAN3
RFS1
NAN5
Base: 4.16_02A
Starlink Bootloader Version 00.03.07
CFE version 1.0.38-116.140 for BCM963381 (32bit,SP,BE)
Build Date: Wed Jul 1 18:47:07 CST 2015 (root@ubuntu)
Copyright (C) 2000-2013 Broadcom Corporation.
Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 400MHz, Bus: 300MHz
Main Thread: TP0
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
SPI NAND flash device: GigaDevice GD5F1GQ4UB, id 0xc8d1 block 128KB size 131072KB
pmc_init:PMC using DQM mode
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host/tftp (f/h/c) : f
Default host run file name : vmlinux
Default host flash file name : Starlink_FW.img
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Default host ramdisk file name :
Default ramdisk store address :
Board Id (0-8) : RTV1900VW
Number of MAC Addresses (1-32) : 10
Base MAC Address : d8:fb:5e:07:b4:27
PSI Size (1-64) KBytes : 64
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Auxillary File System Size Percent: 0
Main Thread Number [0|1] : 0
WLan Feature : 0x00
Voice Board Configuration (0-1) : SI32176_DCX81
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from latest image (address 0xb8320000, flash offset 0x00320000) ...
Decompression OK!
Entry at 0x8038c510
Starting program at 0x8038c510
Linux version 3.4.11-rt19 (jenkins@sahwbld04) (gcc version 4.6.2 (SoftAtHome 1.0.1) ) #1 SMP PREEMPT Wed Oct 11 18:59:08 CEST 2017
RTV1900VW prom init
CPU revision is: 0002a081 (Broadcom BMIPS4350)
DSL SDRAM reserved: 0x132000
RAMOOPS reserved: 0x8000
Determined physical RAM map:
memory: 03ec6000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x00003ec6
Movable zone start PFN for each node
Early memory PFN ranges
0: 0x00000000 -> 0x00003ec6
On node 0 totalpages: 16070
free_area_init_node: node 0, pgdat 80462020, node_mem_map 81000000
DMA zone: 32 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 4064 pages, LIFO batch:0
Normal zone: 94 pages used for memmap
Normal zone: 11880 pages, LIFO batch:1
PERCPU: Embedded 7 pages/cpu @81083000 s5376 r8192 d15104 u32768
pcpu-alloc: s5376 r8192 d15104 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 15944
Kernel command line: ro noinitrd irqaffinity=0
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 58688k/64280k available (3625k kernel code, 5592k reserved, 800k data, 232k init, 0k highmem)
Preemptible hierarchical RCU implementation.
NR_IRQS:128
console [ttyS0] enabled
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
Calibrating delay loop... 598.01 BogoMIPS (lpj=299008)
pid_max: default: 4096 minimum: 301
Mount-cache hash table entries: 512
--Kernel Config--
SMP=1
PREEMPT=1
DEBUG_SPINLOCK=0
DEBUG_MUTEXES=0
Broadcom Logger v0.1 Oct 11 2017 18:56:28
CPU revision is: 0002a081 (Broadcom BMIPS4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Brought up 2 CPUs
NET: Registered protocol family 16
pmc_init:PMC using DQM mode
registering PCI controller with io_map_base unset
bcm63xx_pcie: setting resistor calibration value to 0x0
bcm63xx_pcie: applying serdes parameters
CONFIG_PCIE_SSC: Enabled SSC
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x10600000-0x106fffff]
pci_bus 0000:00: root bus resource [io 0x11700000-0x1170ffff]
pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
pci 0000:00:09.0: reg 10: [mem 0x1000c400-0x1000c4ff]
pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
pci 0000:00:0a.0: reg 10: [mem 0x1000c300-0x1000c3ff]
PCI host bridge to bus 0000:01
pci_bus 0000:01: root bus resource [mem 0xa0000000-0xbfffffff]
pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:01:00.0: [14e4:6338] type 01 class 0x060400
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PCI bridge to [bus 02-02]
bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
skbFreeTask created successfully
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Oct 11 2017 18:59:01 initialized
Broadcom GBPM v0.1 Oct 11 2017 18:59:01 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP: reno registered
NET: Registered protocol family 1
PCI: CLS 16 bytes, default 16
init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c
bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0)
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 114
io scheduler noop registered (default)
ramoops: attached 0x8000@0x3ec6000 (2x0x4000)
brd: module loaded
loop: module loaded
SPI NAND Device Linux Registration
SPI NAND Linux Registration
SPI NAND device reset
Found SPI NAND device GigaDevice GD5F1GQ4UB
SPI NAND device GigaDevice GD5F1GQ4UB
device id = 0xc8d1
page size = 0x800
block size = 0x20000
total blocks = 0x400
total size = 0x8000000
NAND device: Manufacturer ID: 0xc8, Chip ID: 0xd1 (Gigadevice NAND 128MiB 3,3V 8-bit)
NAND_ECC_NONE selected by board driver. This is not recommended!
***** Found UBIFS Marker at 0x0063ff00
***** Found UBIFS Marker at 0x03d1ff00
Creating 12 MTD partitions on "GigaDevice GD5F1GQ4UB":
0x000000640000-0x000003a00000 : "rootfs"
Bad Block 0x153 found (address 0x2a60000)
0x000003d20000-0x0000070e0000 : "rootfs_update"
Bad Block 0x300 found (address 0x6000000)
0x0000070e0000-0x000007500000 : "user"
0x000000000000-0x000000020000 : "nvram"
0x000000020000-0x0000000a0000 : "rip_ro"
0x0000000a0000-0x0000002a0000 : "boot_opt"
0x0000002a0000-0x000000320000 : "rip_rw"
0x000007500000-0x000007f00000 : "ext"
0x000000320000-0x000003a00000 : "image"
Bad Block 0x153 found (address 0x2a60000)
0x000003a00000-0x0000070e0000 : "image_update"
Bad Block 0x300 found (address 0x6000000)
0x000000320000-0x000000640000 : "bootfs"
0x000003a00000-0x000003d20000 : "bootfs_update"
UBI: attaching mtd0 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
Bad Block 0x153 found (address 0x2a60000)
UBI: max. sequence number: 2
UBI: attached mtd0 to ubi0
UBI: MTD device name: "rootfs"
UBI: MTD device size: 51 MiB
UBI: number of good PEBs: 413
UBI: number of bad PEBs: 1
UBI: number of corrupted PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 1
UBI: available PEBs: 0
UBI: total number of reserved PEBs: 413
UBI: number of PEBs reserved for bad PEB handling: 4
UBI: max/mean erase counter: 1/0
UBI: image sequence number: 0
UBI: background thread "ubi_bgt0d" started, PID 262
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
PPP generic driver version 2.4.2
NET: Registered protocol family 24
hso: drivers/net/usb/hso.c: Option Wireless
usbcore: registered new interface driver hso
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver cdc_ncm
usbcore: registered new interface driver qmi_wwan
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
ehci_hcd 0000:00:0a.0: setting latency timer to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 113, io mem 0x1000c300
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
ohci_hcd 0000:00:09.0: setting latency timer to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 112, io mem 0x1000c400
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver usblp
usbcore: registered new interface driver cdc_wdm
usbcore: registered new interface driver usbserial
usbcore: registered new interface driver usbserial_generic
USB Serial support registered for generic
usbserial: USB Serial Driver core
usbcore: registered new interface driver option
USB Serial support registered for GSM modem (1-port)
i2c /dev entries driver
SoftAtHome Button driver has been initialized
brcmboard: brcm_board_init entry
DYING GASP IRQ initialized
Registered led device: led_0
Registered led device: led_1
Registered led device: led_2
Registered led device: led_3
Registered led device: led_4
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xb0000280 (irq = 8) is a BCM63XX
ttyS1 at MMIO 0xb00002a0 (irq = 9) is a BCM63XX
Total # RxBds=833
WARNING: # of RXBDs > (buffers*2/3)
WARNING: less buffers available for BPM
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
u32 classifier
input device check on
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (917 buckets, 3668 max)
ctnetlink v0.93: registering with nfnetlink.
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Initializing MCPD Module
Ebtables v2.0 registered
8021q: 802.1Q VLAN Support v1.8
UBIFS: mounted UBI device 0, volume 0, name "rootfs_ubifs"
UBIFS: mounted read-only
UBIFS: file system size: 50028544 bytes (48856 KiB, 47 MiB, 394 LEBs)
UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format: w4/r0 (latest is w4/r0)
UBIFS: default compressor: zlib
UBIFS: reserved for root: 0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem) readonly on device 0:10.
Freeing unused kernel memory: 232k freed
init started: BusyBox v1.13.3 (2017-10-11 19:20:16 CEST)
starting pid 311, tty '': '/etc/init.d/sysinit'
SYSINIT
SoftAtHome HGW version: SCCHSS08.04.26#00
Compiled on sahwbld04.be.softathome.com, Wed, 11 Oct 2017 19:28:08 +0200
With toolchain gcc version: mips-unknown-linux-uclibc-gcc (SoftAtHome 1.0.1) 4.6.2
Mounting tmpfs filesystem (/tmp) ...
UBI: attaching mtd7 to ubi1
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: max. sequence number: 74
UBI: attached mtd7 to ubi1
UBI: MTD device name: "ext"
UBI: MTD device size: 10 MiB
UBI: number of good PEBs: 80
UBI: number of bad PEBs: 0
UBI: number of corrupted PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 1
UBI: available PEBs: 0
UBI: total number of reserved PEBs: 80
UBI: number of PEBs reserved for bad PEB handling: 2
UBI: max/mean erase counter: 3/1
UBI: image sequence number: -298777425
UBI: background thread "ubi_bgt1d" started, PID 577
UBI device number 1, total 80 LEBs (10158080 bytes, 9.7 MiB), available 0 LEBs (0 bytes), LEB size 126976 bytes (124.0 KiB)
mount: mounting ubi0:ext on /ext failed: No such device
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 1, volume 0, name "ext"
UBIFS: file system size: 8253440 bytes (8060 KiB, 7 MiB, 65 LEBs)
UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format: w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root: 389830 bytes (380 KiB)
panic_on_page_allocation_failure flag is not present in this kernel release...
wlctl: wl driver adapter not found
ifconfig: SIOCSIFHWADDR: No such device
wlctl: wl driver adapter not found
Note: Loading 6300 MDK (default) driver for 63381 chip
Switch MDK: num_switches = 1
Switch MDK: unit = 0; phy_pbmp = 0x3; config_pbmp = 0x3
Switch MDK link poll thread: unit=0; phypbmp=0x3 config_pbmp=0x3
upgrade_lib_HardCo hco_upgrade_init
/bin/wlctl: wl driver adapter not found
/bin/wlctl: wl driver adapter not found
upgrade_lib_HardCo hco_upgrade_init
wlctl: wl driver adapter not found
internetbox login: Loading gmap modules ...
Starting gmap module processes ...
gMap started.
Starting system message bus
Starting cwmpd
find: /usr/lib/debug/: No such file or directory
upgrade_lib_HardCo hco_upgrade_init
chown: unknown user/group figaro:pcb_users
Stopping system message bus
@rettichschnidi
Copy link
Author

Accessing the serial port (RX/TX) works via J2:

              J2
++++++++++++++++++
+ RX + TX + ? + GND +
++++++++++++++++++

During startup, it is possible to access enter the bootloader:

BTL1
V1.1
CPUI
L1CI
PMCI
PMCS
AFEL
PWRZ
MEML
PMCD
CPUI
L1CI
ZBSS
CODE
DATA
L12F
MAIN
OTP?
MFGZ
OTPP
USBT
SNAN
PASS
----
HELO
CPUI
L1CI
4.1602-1.0.38-116.118
PMCI
PMCM
DRAM
----
PHYS
PHYE
DDR1
400H
SIZ4
SIZ3
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
FPS0
BT04
0025
BT03
0464
NAN3
RFS1
NAN5


Base: 4.16_02A
Starlink Bootloader Version 00.03.07
CFE version 1.0.38-116.140 for BCM963381 (32bit,SP,BE)
Build Date: Wed Jul  1 18:47:07 CST 2015 (root@ubuntu)
Copyright (C) 2000-2013 Broadcom Corporation.

Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 400MHz, Bus: 300MHz
Main Thread: TP0
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

SPI NAND flash device: GigaDevice GD5F1GQ4UB, id 0xc8d1 block 128KB size 131072KB
pmc_init:PMC using DQM mode
Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f  
Default host run file name        : vmlinux  
Default host flash file name      : Starlink_FW.img  
Boot delay (0-9 seconds)          : 1  
Boot image (0=latest, 1=previous) : 0  
Default host ramdisk file name    :   
Default ramdisk store address     :   
Board Id (0-8)                    : RTV1900VW  
Number of MAC Addresses (1-32)    : 10  
Base MAC Address                  : d8:fb:5e:07:b4:27  
PSI Size (1-64) KBytes            : 64  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 0  
Main Thread Number [0|1]          : 0  
WLan Feature                      : 0x00  
Voice Board Configuration (0-1)   : SI32176_DCX81  

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
web info: Waiting for connection on socket 0.
CFE> help
Available commands:

fb                  Find NAND bad blocks
dn                  Dump NAND contents along with spare area
phy                 Set memory or registers.
otpr                Read btrm otp bits
sm                  Set memory or registers.
dm                  Dump memory or registers.
db                  Dump bytes.
dh                  Dump half-words.
dw                  Dump words.
w                   Write the whole image start from beginning of the flash
e                   Erase NAND flash
ws                  Write whole image (priviously loaded by kermit) to flash .
r                   Run program from flash image or from host depend on [f/h] flag
p                   Print boot line and board parameter info
c                   Change booline parameters
i                   Erase persistent storage data
a                   Change board AFE ID
b                   Change board parameters
reset               Reset the board
pmdio               Pseudo MDIO access for external switches.
spi                 Legacy SPI access of external switch.
force               override chipid check for images.
help                Obtain help for CFE commands

For more information about a command, enter 'help command-name'
*** command status = 0

@rettichschnidi
Copy link
Author

Hash of the root password (entry in shadow):

root:$6$CqTkaVBj$TB711.hqveZhaXHD3iQyt.4rds91G/Hb0y6YJUycoLFZMRv/cWQ2SOndd/CnTdwCaZCkDDRqnBGfOG9jYPOdv/:::::::

@loicloic
Copy link

@rettichschnidi, I can confirm from a firmware analysis that the root password Hash in the same for the Internet-Box plus.

As well in the second firmware "Application" (Current application firmware for Internet-Box plus (November 2019)) There's the following user and hashed password (SHA256):

serial:$5$tWttWXTLD4q6NUg$fLdXm8JZSTWKYu/rdSli9FniIjgIMv94SHmrpY4ca03:::::::

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment