diff options
author | Simone Bortolin <simonebortolin@users.noreply.github.com> | 2022-08-04 19:50:30 +0200 |
---|---|---|
committer | Simone Bortolin <simonebortolin@users.noreply.github.com> | 2022-12-19 22:53:27 +0100 |
commit | 55a7e9286ad685d468e11c1212a3f3e5e9d98a81 (patch) | |
tree | 99061eeb8fb254b6ad3fad953920ac3b6006078e /ont-technicolor-afm0002.md | |
parent | fix user and psw (diff) | |
parent | Merge branch 'main' of github.com:hack-gpon/hack-gpon.github.io (diff) | |
download | hack-gpon.github.io-55a7e9286ad685d468e11c1212a3f3e5e9d98a81.tar hack-gpon.github.io-55a7e9286ad685d468e11c1212a3f3e5e9d98a81.tar.gz hack-gpon.github.io-55a7e9286ad685d468e11c1212a3f3e5e9d98a81.tar.bz2 hack-gpon.github.io-55a7e9286ad685d468e11c1212a3f3e5e9d98a81.tar.lz hack-gpon.github.io-55a7e9286ad685d468e11c1212a3f3e5e9d98a81.tar.xz hack-gpon.github.io-55a7e9286ad685d468e11c1212a3f3e5e9d98a81.tar.zst hack-gpon.github.io-55a7e9286ad685d468e11c1212a3f3e5e9d98a81.zip |
Diffstat (limited to '')
-rw-r--r-- | ont-technicolor-afm0002.md | 404 |
1 files changed, 208 insertions, 196 deletions
diff --git a/ont-technicolor-afm0002.md b/ont-technicolor-afm0002.md index de155c4..58f9788 100644 --- a/ont-technicolor-afm0002.md +++ b/ont-technicolor-afm0002.md @@ -1,196 +1,208 @@ ---- -title: Technicolor AFM0002 -has_children: false -parent: ONT ---- - -# Technicolor AFM0002TIM/FWB/WND - -## Hardware Specifications - -| | | -|-------------|-------------------------------------------------| -| Vendor | Technicolor | -| Model | AFM0002TIM/FWB/WND | -| Alias | | -| Chipset | Realtek RTL9601B | -| Flash | | -| RAM | | -| System | Linux (Luna SDK) | -| HSGMII | NO | -| Optics | | -| IP address | 192.168.2.1 | -| Web Gui | Can be enabled, user `admin`, password `system` | -| SSH | ✅ user `admin`, password `system` | -| Form Factor | miniONT SFP | - -## List of software versions -- V1_7_8_181123 -- V1_7_8_210928 -- V1_7_8_210412 - -## List of partitions - -| dev | size | erasesize | name | -|-------|----------|-----------|-----------------| -| mtd0 | 00040000 | 00001000 | "boot" | -| mtd1 | 00002000 | 00001000 | "env" | -| mtd2 | 00002000 | 00001000 | "env2" | -| mtd3 | 0003c000 | 00001000 | "config" | -| mtd4 | 00300000 | 00001000 | "k0" | -| mtd5 | 004c0000 | 00001000 | "r0" | -| mtd6 | 00300000 | 00001000 | "k1" | -| mtd7 | 004c0000 | 00001000 | "r1" | -| mtd8 | 00001000 | 00001000 | "Partition_008" | -| mtd9 | 00001000 | 00001000 | "Partition_009" | -| mtd10 | 00001000 | 00001000 | "Partition_010" | -| mtd11 | 00001000 | 00001000 | "Partition_011" | -| mtd12 | 00300000 | 00001000 | "linux" | -| mtd13 | 004c0000 | 00001000 | "rootfs" | - -This stick supports dual boot. - -`k0` and `r0` contains respectively the kernel and firmware of the first image, `k1` and `r1` of the second one - -## List of firmware and files -### Useful files -- `/var/config/lastgood.xml` - Contains the user portion of the configuration -- `/var/config/lastgood-hs.xml` - Contains the "hardware" configuration (i.e. that _should_ not be changed) -- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below) - -### Useful binaries -- `/etc/scripts/flash` - Used to manipulate the config files in a samewhat safe manner -- `xmlconfig` - Used to low-level manipulate the XML config files. Called by `flash` -- `nv` - Used to manipulate the nvram storage, including persistent config entries via `nv setenv`/`nv getenv` -- `omcicli` - Used to interact with the running OMCI daemon -- `omci_app` - The OMCI daemon -- `diag` - Used to run low-level diagnostics commands on the stick - -## Useful commands - -### Enable the Web UI -```sh -# /bin/iptables -D INPUT -p tcp --dport 80 -j DROP -``` - -### Check the currently active image -```sh -# nv getenv sw_active -sw_activ=1 -# nv getenv sw_version0 -sw_version0=V1_7_8_210412 -# nv getenv sw_version1 -sw_version1=V1_7_8_210412 -``` - -### Boot to a different image -```sh -# nv setenv sw_commit 0|1 -# reboot -``` - -### Get/Set the ONT S/N -```sh -# /etc/scripts/bin flash get GPON_SN -GPON_SN=TMBB00000000 -# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D -``` - -### Get/Set the ONT PLOAM password -Note: the password is in ASCII format -```sh -# /etc/scripts/bin flash get GPON_PLOAM_PASSWD -GPON_PLOAM_PASSWD=AAAAAAAAAA -# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA -``` - -### Query a particular OMCI ME -```sh -# omcicli mib get MIB_IDX -``` - -## Low level modding -Note: this section is based on version `V1_7_8_210412` of the stick -### Trasnfer files from/to the stick -Works with binary files too, just run md5sum on source and destination to make sure you are not corrupting anything... -From the stick to the PC: -```sh -# ssh admin@192.168.2.1 "cat /tmp/omcilog" > omcilog.log -``` -From the PC to the stick -```sh -# cat lastgood.xml | ssh admin@192.168.2.1 "cat > /var/config/lastgood.xml" -``` -**Note:** on windows replace type with cat and run the commands from cmd (not powershell) -### Extract and repack the rootfs -```sh -# unsquashfs mtd5.bin -# mksquashfs squashfs-root rootfs -b 131072 -comp lzma -no-recovery -``` -### Flash a new rootfs -**Note: you can only flash the inactive image**. So mtd4/5 if you are on image1, mtd6/7 if you are on image0. - -The follwing examples flashes a new rootfs to image1 and boots to it -```sh -# flash_eraseall /dev/mtd7 -# cat /tmp/rootfs.new > /dev/mtd7 -# nv setenv sw_commit=1 -# reboot -``` -### Add support to configurable SW and HW versions, VENDOR ID and much more -We can patch `/etc/scripts/flash` in order to add support for some variables implemented in `omci_app` but removed from `xmlconfig`. The patch is below (change the values to suit your needs) -```patch ---- squashfs-root/etc/scripts/flash 2021-09-28 10:38:52.000000000 +0200 -+++ squashfs-root.new/etc/scripts/flash 2022-08-04 00:00:29.769605000 +0200 -@@ -62,7 +62,26 @@ - if [ `echo $para | egrep $specific_mib_patten` ]; then - /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" | sed -r "s/,+//g" - else -- /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" -+ case "$para" in -+ "OMCI_EQID") -+ echo "$para=MY_EQID" -+ ;; -+ "OMCI_VENDOR_ID") -+ echo "$para=MY_VENDOR" -+ ;; -+ "OMCI_SW_VER1") -+ echo "$para=MY_SW_VER1" -+ ;; -+ "OMCI_SW_VER2") -+ echo "$para=MY_SW_VER2" -+ ;; -+ "OMCI_ONT_VER") -+ echo "$para=MY_HW_VER" -+ ;; -+ *) -+ /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" -+ ;; -+ esac - fi - if [ "$?" = "0" ]; then - exit 0 -``` -### Increase the length of the software version from 13 to 14 characters -`omci_app` has an hard-coded limit of 13 characters for the software version, which is too low. We can binary patch it to increase it to 14 (or more, if you dare/need) -``` -JVhEWjAwNCUAAAAIAAgACAAAAAAAAAAAAAAAAAAAAABvbWNpX2FwcG9tY2lfYXBwH4sIAAAAAAAA -AwMAAAAAAAAAAAAfiwgAAAAAAAADY2BoYGZgYFjh9Uq/aNcZQdXsOh3R5ktr/fd0sTEwcuTnJmfG -JxYUYJVlZGAA0gCHsMK2QQAAAAAAAEQlWERaMDA0JQ== -``` -Save it as omci_app.xdelta.b64, then run: -```sh -# base64 -d omci_app.xdelta.base64 > omci_app.xdelta -# xdelta patch omci_app.xdelta bin/omci_app bin/omci_app.new -# mv bin/omci_app.new bin/omci_app -``` -For reference, the patch changes the follwing section of the omci_app: -```diff --00408c24 24 05 00 0e li a1,0xe -+00408c24 24 05 00 0f li a1,0xf --00408cf0 24 05 00 0f li a1,0xe -+00408cf0 24 05 00 0f li a1,0xf -``` -(It's inside the function referecing the string `OMCI_SW_VER1`) -## Miscellaneous Links - +---
+title: Technicolor AFM0002
+has_children: false
+parent: ONT
+---
+
+# Technicolor AFM0002TIM/FWB/WND
+
+## Hardware Specifications
+
+| | |
+|-------------|-------------------------------------------------|
+| Vendor | Technicolor |
+| Model | AFM0002TIM/FWB/WND |
+| Alias | |
+| Chipset | Realtek RTL9601B |
+| Flash | |
+| RAM | |
+| System | Linux (Luna SDK) |
+| HSGMII | NO |
+| Optics | |
+| IP address | 192.168.2.1 |
+| Web Gui | Can be enabled, user `admin`, password `system` |
+| SSH | ✅ user `admin`, password `system` |
+| Form Factor | miniONT SFP |
+
+## List of software versions
+- V1_7_8_181123
+- V1_7_8_210928
+- V1_7_8_210412
+
+## List of partitions
+
+| dev | size | erasesize | name |
+|-------|----------|-----------|-----------------|
+| mtd0 | 00040000 | 00001000 | "boot" |
+| mtd1 | 00002000 | 00001000 | "env" |
+| mtd2 | 00002000 | 00001000 | "env2" |
+| mtd3 | 0003c000 | 00001000 | "config" |
+| mtd4 | 00300000 | 00001000 | "k0" |
+| mtd5 | 004c0000 | 00001000 | "r0" |
+| mtd6 | 00300000 | 00001000 | "k1" |
+| mtd7 | 004c0000 | 00001000 | "r1" |
+| mtd8 | 00001000 | 00001000 | "Partition_008" |
+| mtd9 | 00001000 | 00001000 | "Partition_009" |
+| mtd10 | 00001000 | 00001000 | "Partition_010" |
+| mtd11 | 00001000 | 00001000 | "Partition_011" |
+| mtd12 | 00300000 | 00001000 | "linux" |
+| mtd13 | 004c0000 | 00001000 | "rootfs" |
+
+This stick supports dual boot.
+
+`k0` and `r0` contains respectively the kernel and firmware of the first image, `k1` and `r1` of the second one
+
+## List of firmware and files
+### Useful files
+- `/var/config/lastgood.xml` - Contains the user portion of the configuration
+- `/var/config/lastgood-hs.xml` - Contains the "hardware" configuration (i.e. that _should_ not be changed)
+- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below)
+
+### Useful binaries
+- `/etc/scripts/flash` - Used to manipulate the config files in a samewhat safe manner
+- `xmlconfig` - Used to low-level manipulate the XML config files. Called by `flash`
+- `nv` - Used to manipulate the nvram storage, including persistent config entries via `nv setenv`/`nv getenv`
+- `omcicli` - Used to interact with the running OMCI daemon
+- `omci_app` - The OMCI daemon
+- `diag` - Used to run low-level diagnostics commands on the stick
+
+## Useful commands
+
+### Enable the Web UI
+```sh
+# /bin/iptables -D INPUT -p tcp --dport 80 -j DROP
+```
+
+### Check the currently active image
+```sh
+# nv getenv sw_active
+sw_activ=1
+# nv getenv sw_version0
+sw_version0=V1_7_8_210412
+# nv getenv sw_version1
+sw_version1=V1_7_8_210412
+```
+
+### Boot to a different image
+```sh
+# nv setenv sw_commit 0|1
+# reboot
+```
+
+### Get/Set the ONT S/N
+```sh
+# /etc/scripts/bin flash get GPON_SN
+GPON_SN=TMBB00000000
+# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D
+```
+
+### Get/Set the ONT PLOAM password
+Note: the password is in ASCII format
+```sh
+# /etc/scripts/bin flash get GPON_PLOAM_PASSWD
+GPON_PLOAM_PASSWD=AAAAAAAAAA
+# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA
+```
+
+### Query a particular OMCI ME
+```sh
+# omcicli mib get MIB_IDX
+```
+
+## Low level modding
+Note: this section is based on version `V1_7_8_210412` of the stick
+### Trasnfer files from/to the stick
+Works with binary files too, just run md5sum on source and destination to make sure you are not corrupting anything...
+From the stick to the PC:
+```sh
+# ssh admin@192.168.2.1 "cat /tmp/omcilog" > omcilog.log
+```
+From the PC to the stick
+```sh
+# cat lastgood.xml | ssh admin@192.168.2.1 "cat > /var/config/lastgood.xml"
+```
+**Note:** on windows replace type with cat and run the commands from cmd (not powershell)
+### Extract and repack the rootfs
+```sh
+# unsquashfs mtd5.bin
+# mksquashfs squashfs-root rootfs -b 131072 -comp lzma -no-recovery
+```
+### Flash a new rootfs
+**Note: you can only flash the inactive image**. So mtd4/5 if you are on image1, mtd6/7 if you are on image0.
+
+The follwing examples flashes a new rootfs to image1 and boots to it
+```sh
+# flash_eraseall /dev/mtd7
+# cat /tmp/rootfs.new > /dev/mtd7
+# nv setenv sw_commit=1
+# reboot
+```
+### Add support to configurable SW and HW versions, VENDOR ID and much more
+We can patch `/etc/scripts/flash` in order to add support for some variables implemented in `omci_app` but removed from `xmlconfig`. The patch is below (change the values to suit your needs)
+```patch
+--- squashfs-root/etc/scripts/flash 2021-09-28 10:38:52.000000000 +0200
++++ squashfs-root.new/etc/scripts/flash 2022-08-04 00:00:29.769605000 +0200
+@@ -62,7 +62,26 @@
+ if [ `echo $para | egrep $specific_mib_patten` ]; then
+ /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" | sed -r "s/,+//g"
+ else
+- /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g"
++ case "$para" in
++ "OMCI_EQID")
++ echo "$para=MY_EQID"
++ ;;
++ "OMCI_VENDOR_ID")
++ echo "$para=MY_VENDOR"
++ ;;
++ "OMCI_SW_VER1")
++ echo "$para=MY_SW_VER1"
++ ;;
++ "OMCI_SW_VER2")
++ echo "$para=MY_SW_VER2"
++ ;;
++ "OMCI_ONT_VER")
++ echo "$para=MY_HW_VER"
++ ;;
++ *)
++ /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g"
++ ;;
++ esac
+ fi
+ if [ "$?" = "0" ]; then
+ exit 0
+```
+### Increase the length of the software version from 13 to 14 characters
+`omci_app` has an hard-coded limit of 13 characters for the software version, which is too low. We can binary patch it to increase it to 14 (or more, if you dare/need)
+```
+JVhEWjAwNCUAAAAIAAgACAAAAAAAAAAAAAAAAAAAAABvbWNpX2FwcG9tY2lfYXBwH4sIAAAAAAAA
+AwMAAAAAAAAAAAAfiwgAAAAAAAADY2BoYGZgYFjh9Uq/aNcZQdXsOh3R5ktr/fd0sTEwcuTnJmfG
+JxYUYJVlZGAA0gCHsMK2QQAAAAAAAEQlWERaMDA0JQ==
+```
+Save it as omci_app.xdelta.b64, then run:
+```sh
+# base64 -d omci_app.xdelta.base64 > omci_app.xdelta
+# xdelta patch omci_app.xdelta bin/omci_app bin/omci_app.new
+# mv bin/omci_app.new bin/omci_app
+```
+For reference, the patch changes the follwing section of the omci_app:
+```diff
+-00408c24 24 05 00 0e li a1,0xe
++00408c24 24 05 00 0f li a1,0xf
+-00408cf0 24 05 00 0f li a1,0xe
++00408cf0 24 05 00 0f li a1,0xf
+```
+(It's inside the function referecing the string `OMCI_SW_VER1`)
+
+### Enable PLOAM logging
+```sh
+/etc/scripts/bin flash set OMCI_DBGLVL 1
+/etc/scripts/bin flash set OMCI_DBGLOGFILE 1
+reboot
+/bin/omcicli set logfile 1 ffffffff
+```
+1. The binary log will be placed inside: `/tmp/omcilog`
+2. You can convert it into .pcap using https://github.com/ADeltaX/omcilog2pcap
+3. You can then open it into wireshark by installing the OMCI plugin from https://wiki.wireshark.org/Contrib.md
+
+If you want to log everything since the stick boots, you can create a custom rootfs. Place the last command inside `etc/runomci.sh` as the last line of the file
+## Miscellaneous Links
\ No newline at end of file |