diff options
| -rw-r--r-- | _router_pon/free_iliad_box_pop.md | 104 |
1 files changed, 104 insertions, 0 deletions
diff --git a/_router_pon/free_iliad_box_pop.md b/_router_pon/free_iliad_box_pop.md new file mode 100644 index 0000000..f478258 --- /dev/null +++ b/_router_pon/free_iliad_box_pop.md @@ -0,0 +1,104 @@ +# Hardware Specifications + +| | | +| ---------------- | --------------------------------------- | +| Vendor/Brand | Free/Iliad | +| Model | | +| ODM | | +| ODM Product Code | | +| Chipset | | +| Flash | | +| RAM | | +| CPU | BCM63153 | +| CPU Clock | | +| Bootloader | | +| System | | +| Load addr | | +| HSGMII | | +| 2.5GBaseX | | +| 2.5GBaseT | Yes | +| XGMII/XSGMII | | +| 10GBaseX | | +| 10GBaseT | No | +| 2.5/5/10GBaseT | | +| Optics | SC/UPC | +| IP address | 192.168.1.254 | +| Web Gui | ✅ | +| SSH | ? | +| Telnet | ? | +| Serial | ? | +| Serial baud | 115200 | +| Serial encoding | 8-N-1 | +| Form Factor | ONT | + +## Serial + +The serial port is routed through the USB-C port used for power (which is PD compliant, tested with a notebook power supply). The pins are SBU1 and SBU2, reversal is handled using an open drain buffer (SN74LVC2G07) so a pull-up resistor on RX is needed. On the power daughter board TP7 is TX and TP8 is RX. +At the moment nothing more than a boot log is available. [^bcm61650hack] [^freeboxhack] + +## Firmware is interchangeable with + +## List of software versions + +## List of partitions + +# Userful files and binaries + +## Useful files + +## Useful binaries + +# GPON ONU status + +## Get the operational status of the ONU + +## Get information of the OLT vendor + +## Querying a particular OMCI ME + +## Getting/Setting Speed LAN Mode + +# GPON/OMCI settings + +## Getting/Setting ONU GPON Serial Number + +## Getting/Setting ONU GPON PLOAM password + +## Getting/Setting ONU GPON LOID and LOID password + +## Getting/Setting OMCI software version (ME 7) + +## Getting/Setting OMCI hardware version (ME 256) + +## Getting/Setting OMCI vendor ID (ME 256) + +## Getting/Setting OMCI equipment ID (ME 257) + +# Advanced settings + +## Setting management MAC + +## Setting management IP + +## Rebooting the ONU + +## Creating a new rootfs + +## Flashing a new rootfs + +# SFP EEPROM settings + +## Reading all EEPROM + +# EEPROM (I2C slave simulated EEPROM) + +## EEPROM0 layout + +## EEPROM1 layout + +# Known Bugs + +# Miscellaneous Links + +[^bcm61650hack]: *Pwning the bcm61650* https://blog.xilokar.info/pwning-the-bcm61650.html +[^freeboxhack]: *Firmware key extraction by gaining EL3* https://blog.xilokar.info/firmware-key-extraction-by-gaining-el3.html |