+- Haxorware Forums (http://www.haxorware.com/forums)
+-- Forum: General (http://www.haxorware.com/forums/forumdisplay.php?fid=6)
+--- Forum: Modems (http://www.haxorware.com/forums/forumdisplay.php?fid=7)
+--- Thread: sb5101e (/showthread.php?tid=2685)
sb5101e - shocky - 29-07-2013
hi all,gota a couple of questions for some of the experts here:
1: i have 5101e on diag took a telnet log then i tried to set auto console in putty back to 0 and says unrecognised command??
2:i put the same modem back to lite took a telnet log,both of which i have included, on the diag i noticed cvcs are invalid so i put it back to v media stock dump or should say the teleepest dump i saved before i flashed it connected to coax booted it up and i went to 192 gui and clicked adresses tab and it says serial number dead01
hfc mac address says 00:20:40:de:ad:01
and cpe us address says 00:20:40:de:ad:09
no matter what mac i change it to it goes back to that i have just wrote any one no why??
i also want to no how can i activate telnet on this stock dump iff some kind person would point me i right direction??? thanks
by way here is my software version :
Software Version: SB5101-2.4.1.6-SCM02-NOSH
Hardware Version: 1
MIB Version: II
GUI Version: 1.0
and here are both telnet logs from diag and lite
forgot to mention i can get online with this modem but it as a 76byte config instead of a 428byte so only getting half meg dl speed so my thoughts were to try and obtain the cvcs that were invalid,thanks for reading
diag log:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.07.25 21:10:24 =~=~=~=~=~=~=~=~=~=~=~=
Haxorware integrated telnet daemon
Username: SHAKEY
Password: ******
Welcome.
CM>
CM> run
CM>
CM> run_app
Running the system...
Beginning Cable Modem operation...
0x0001e38e [Scan Downstream Thread] BcmVendorCmDownstreamScanThread::ThreadMain: (Scan Downstream Thread) Scanning for a Downstream Channel...
mot_scanList: Setting override freq @ 0
Favorite[0].freq = 339000000
Attempting Downstream FEC lock @ freq= 339000000 Hz, QAM64/256
CM> Found energy at frequency 339000000Hz! Publishing event kEventEnergyDetected...
0x0001e78a [CmDocsisCtlThread] BcmCmDocsisCtlThread::StartUsInit: (CmDocsisCtlThread) Locked on the downstream. Waiting for UCDs...
******************************************
DOWNSTREAM STATUS
******************************************
Tuner Frequency = 339000000 Hz
Carrier Offset = 9 Hz
Symbol rate = 5360537 sym/sec
SNR = 38 dB
QAM Mode = QAM256
Tuner AGC = 0xfff00000
IF AGC = 0x157d9b64
Power Level = -1 dB
QAM = LOCKED
FEC = LOCKED
******************************************
CM> Selecting UCD for Us Channel 3
0x000205e4 [CmDocsisCtlThread] BcmCmDocsisCtlThread::TestAndLaunchDsTimeSync: (CmDocsisCtlThread) starting ds time sync acquisition...
0x0002085a [CmDocsisCtlThread] BcmCmDocsisCtlThread::SyncDsSyncOk: (CmDocsisCtlThread) downstream time sync acquired...
0x0002085a [CmDocsisCtlThread] BcmCmDocsisCtlThread:
sSyncOkResumeUsInit: (CmDocsisCtlThread) pre-REG upstream target case...starting initial ranging.Beginning initial ranging...
Using stored initial upstream power = 40.0 dBmV
0x0002085a [CmDocsisCtlThread] BcmCmDocsisCtlThread::SyncDsSyncOk: (CmDocsisCtlThread) rx unexpected kDsSyncOk indication...
Not logging event ID 2307948724, control for level 7 is 0.
RNG-RSP Adj: tim=2456 power=0 freq=0 Stat=Continue
CM>
RNG-RSP Adj: tim=0 power=0 freq=0 Stat=Success
******************************************
UPSTREAM STATUS
******************************************
Upstream Status = UP
Upstream Channel = 3
Upstream Frequency = 18800000 Hz
Upstream Power = 40 dBmV
Ranging SID = 0xceb
Upstream Symbol Rate = 2560000 sym/sec
******************************************
Calculating maximum number of IP filters:
Each IP filter consumes 1848 bytes of RAM.
Current free RAM is 465136 bytes.
Max heap reserved for IP filters (25%) = 116284
We can support 62 IP filters.
Calculating maximum number of LLC filters:
Each LLC filter consumes 720 bytes of RAM.
Current free RAM is 465116 bytes.
Max heap reserved for LLC filters (25%) = 116279
We can support 161 LLC filters.
Starting IP Initialization with DHCP...
DHCPc: Waiting 1 seconds before sending Discover; client id htype=1, value=00:11:e6:69:xx:xx
Not logging event ID 2307948624, control for level 7 is 0.
CM> DHCPc: Sending Discover packet; client id htype=1, value=00:11:e6:69:xx:xx
DHCPc: Received an Offer from DHCP server 00:21:1b:bf:5c:01 (10.50.104.1); lease client id htype=1, value=00:11:e6:69:xx:xx
CM> DHCPc: Timed out waiting for offers for lease with client id htype=1, value=00:11:e6:69:xx:xx
DHCPc: Sending Request packet; client id htype=1, value=00:11:e6:69:xx:xx
DHCPc: Received an Ack from DHCP server 00:21:1b:bf:5c:01 (10.50.104.1); lease client id htype=1, value=00:11:e6:69:xx:xx
Current IP address is default 0.0.0.0.
0x00021912 [DHCP Client Thread] BcmEcosIpHalIf::ConfigureLeaseImpl: (IP Stack1 HalIf)
Configuring IP stack 1:
IP Address = 10.50.109.41 (primary IP address)
Subnet Mask = 255.255.248.0
Router = 10.50.104.1
IsPrimaryInterface = 1
Logging event: DHCP WARNING - Non-critical field invalid in response.
ARPing for default GW IP = 10.50.104.1
MAC = 00:21:1b:bf:5c:01
DHCP completed successfully!
DHCP Settings:
Client Id = htype=1, value=00:11:e6:69:xx:xx
State = Renewing (5)
Static Lease = 0
AutoConfig Mode = IP, Subnet and Router
XID = 0x2761c1ea
Number of Tries = 0
Max Discover Tries = 6
Max Request Tries = 6
DHCP server MAC addr = 00:21:1b:bf:5c:01
Ignore NAKs = 0
My offered IP address = 10.50.109.41 (primary IP address)
(1) Subnet Mask = 255.255.248.0
(3) Router IP address = 10.50.104.1
(54) DHCP Server IP address = 62.253.131.161
(82) Relay Agent IP address = 10.50.104.1
TFTP Server IP address = 10.50.104.1
CM Configuration file = 'UBsgvca69834ncxv9873'
(2) UTC Time Offset = 0 seconds
(4) Time Server IP address = 10.137.103.1
(6) Domain Name Server =
(7) Log Server IP address =
(51) Lease time = 604798 seconds
(58) T1 (renew) = 302399 seconds
(59) T2 (rebind) = 529198 seconds
Lease is infinite = 0
SB5102 CM Agent w/ BRCM Factory Support IpStackEvent: Ip=10.50.109.41, Subnet=255.255.248.0, Gateway=10.50.104.1
CmSnmpAgent::IpAddressAcquiredEvent for SB5102 CM Agent w/ BRCM Factory Support
IP addr = 10.50.109.41
Starting Time Of Day...
0x0002199e [CmDocsisIpThread] BcmDocsisTimeOfDayThread::SetTodServerIpAddress: (Time Of Day Thread) ToD servers: 10.137.103.1
Connecting to ToD server 10.137.103.1...
Sending UDP ToD request to server...
SNMP Agent Binding to 10.50.109.41:225
Not logging event ID 2291949724, control for level 7 is 0.
CM> UTC returned by ToD server 3583771866; UTC offset 0
Current system time -> Thu Jul 25 20:11:06 2013
System start time -> Thu Jul 25 20:08:49 2013
Starting Tftp of configuration file...
Opening file 'UBsgvca69834ncxv9873' on 10.50.104.1 for reading...
tftp-enforce bypass is using 10.50.104.1:UBsgvca69834ncxv9873
Initiating fake TFTP Get (tftp-enforce bypass)
Bypass succeeded.File was 76 bytes
Storing received cfg of size 76 to memory
Tftp transfer complete!
TFTP Settings:
Stack Interface = 1
Server Ip Address = 10.50.104.1
Server Port Number = 69
Total Blocks Read = 1
Total Bytes Read = 76
Config file was read! IP Initialization completed...
MAX CPE per CM is being set to 32
Time Of Day completed...
DefaultSnmpAgentClass::SystemTimeChangeEvent for SB5102 CM Agent w/ BRCM Factory Support
Sending a REG-REQ to the CMTS...
Not logging event ID 2291949524, control for level 7 is 0.
Not logging event ID 2291949324, control for level 7 is 0.
Received a REG-RSP message from the CMTS...
0x00021b7e [CmDocsisCtlThread] BcmCmDocsisCtlThread::RegRspMsgEvent: (CmDocsisCtlThread) We registered with a DOCSIS 1.0 config file!
Adding DOCSIS 1.0 CoS Settings for SID 0xceb
Class Of Service Settings:
SID = 0xceb
Max Us Burst = 1600 bytes
Max Us Rate = 542000 bits per second
Max Bucket size = 24288 bits
Bits In Bucket = 24288
Last Bucket Update Time = 139112 ms
Last Bucket Flush Time = 139112 ms
Packet Delay Time = 0 ms
Global CONCAT has been enabled for all upstream queues.
The CONCAT threshold is set to 2 packets (128 packets max).
Fragmentation is ENABLED in DOCSIS 1.0 mode!
Registration complete!
Process CVC
0x00021b88 [CmDocsisCtlThread] CmSecureDownload:
rocessConfigFileManufAndCosignerCvcs: (Secure Software Download) WARNING - No CVC included in config file; software upgrade can't be performed!0x00021b88 [CmDocsisCtlThread] BcmCmDocsisCtlThread:
rocessCVC: (CmDocsisCtlThread) ERROR - Config file does not include a valid CVC!DOCSIS CoS/QoS rate shaping enable is now 1
CmSnmpAgent::CmOperationalEvent for SB5102 CM Agent w/ BRCM Factory Support
CmSnmpAgent operating in 1.0 mode, including docsBpi, excluding docsQos
+++ No DH kickstart profiles or snmpCommunityTable entries installed.
We will operate in NMACCESS mode.
SB5102 CM Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessView
SB5102 CM Agent w/ BRCM Factory Support enabling management.
SB5102 CM Agent w/ BRCM Factory Support sending deferred traps...
Done w/ deferred traps.
SB5102 CPE Agent w/ BRCM Factory Support setting V1/V2 view to docsisNmAccessView
0x00021b92 [CmDocsisCtlThread] BcmCmDocsisCtlThread::TestAndLaunchBpkm: (CmDocsisCtlThread) BPKM disabled via provisioned config file setting.
Enabling network access for all CPE ports.
mot_scanList: Writing to Flash!
0x00021bba [CmDocsisCtlThread] BcmDocsisCmHalIf::ConfigOperational: (DOCSIS CableModem HalIf) Running IGMP in DOCSIS 1.0 mode!
BcmCmDocsisStatusEventCodes::kCmIsOperational
0x00021bba [CmDocsisCtlThread] BcmVendorCmApplication::StopDhcpServer: (VendorExtension CmApp) Shutting down DHCP Server...
0x00021bba [CmDocsisCtlThread] BcmStandbySwitchThread::CmIsOperational: (Motorola Standby Switch Thread) Simulating a press of the standby switch to get the state configured properly.
0x00021bc4 [IGMP Thread] BcmIgmpThread::Starting Igmp Thread...: (IGMP Thread)
0x00021bc4 [Motorola Standby Switch Thread] BcmStandbySwitchThread::ThreadMain: (Motorola Standby Switch Thread) Standby switch was pressed!
0x00021bce [Motorola Standby Switch Thread] BcmStandbySwitchThread:
rocessSwitchEvent: (Motorola Standby Switch Thread) Leaving standby mode; restoring previous NACO and DHCP server states, and changing the LEDs.0x00021bce [Motorola Standby Switch Thread] BcmVendorCmApplication::StopDhcpServer: (VendorExtension CmApp) Shutting down DHCP Server...
SB5102 CM Event Log w/ BRCM Factory Support sending deferred async messages...
Done w/ deferred msgs
Not logging event ID 2296948624, control for level 7 is 0.
Not logging event ID 2300955525, control for level 7 is 0.
CM>
here is my lite log:
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.07.28 17:31:02 =~=~=~=~=~=~=~=~=~=~=~=
Haxorware integrated telnet daemon
Username: SHAKEY
Password: ******
Welcome.
CM>
CM> run
CM>
CM> run_app
Running the system...
BcmCmDocsisStatusEventCodes::kCmIsNotOperational
CamDeleteAddress: Deleted address from cam segment 0
CM> Non-Vol Settings successfully written to the device.
@@@@@ In ResetRngState, fRemainingInitRngPowerSteps 17
mot_scanList: Setting override freq @ 7000000
Scanning DS Channel at 7000000 Hz... (Initial target freq)
mot_scanList: Setting override freq @ 0
Favorite[1].freq = 331000000
Attempting Downstream FEC lock @ freq= 331000000 Hz, QAM64/256
Go back to 1st favorite
Attempting Downstream FEC lock @ freq= 90000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 98000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 106000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 114000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 122000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 130000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 138000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 146000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 154000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 162000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 170000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 178000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 186000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 194000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 202000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 210000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 218000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 226000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 234000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 242000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 250000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 258000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 266000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 274000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 282000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 290000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 298000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 306000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 314000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 322000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 330000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 338000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 346000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 354000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 362000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 370000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 378000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 386000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 394000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 402000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 410000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 418000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 426000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 434000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 442000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 450000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 458000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 466000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 474000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 482000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 490000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 498000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 506000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 514000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 522000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 530000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 538000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 546000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 554000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 562000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 570000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 578000000 Hz, QAM64
Attempting Downstream FEC lock @ freq= 586000000 Hz, QAM64
Favorite[0].freq = 339000000
Attempting Downstream FEC lock @ freq= 339000000 Hz, QAM64/256
******************************************
DOWNSTREAM STATUS
******************************************
Tuner Frequency = 339000000 Hz
Carrier Offset = 9 Hz
Symbol rate = 5360537 sym/sec
SNR = 35 dB
QAM Mode = QAM256
Tuner AGC = 0xfff00000
IF AGC = 0x155cd6c8
Power Level = 0 dB
QAM = LOCKED
FEC = LOCKED
******************************************
CM> Selecting UCD for Us Channel 3
RNG-RSP Adj: tim=2453 power=0 freq=0 Stat=Continue
RNG-RSP Adj: tim=0 power=0 freq=0 Stat=Success
******************************************
UPSTREAM STATUS
******************************************
Upstream Status = UP
Upstream Channel = 3
Upstream Frequency = 18800000 Hz
Upstream Power = 40 dBmV
Ranging SID = 0xceb
Upstream Symbol Rate = 2560000 sym/sec
******************************************
Starting IP Initialization with DHCP...
CM> ARPing for default GW IP = 10.50.104.1
MAC = 00:21:1b:bf:5c:01
DHCP completed successfully!
DHCP: IP address = 10.50.109.41
Starting Time Of Day...
SNMP Agent Binding to 10.50.109.41:225
Current system time -> Sun Jul 28 16:32:06 2013
System start time -> Sun Jul 28 16:29:41 2013
Starting Tftp of configuration file...
tftp-enforce bypass is using 10.50.104.1:gvca69834ncxv9873254
Initiating fake TFTP Get (tftp-enforce bypass)
Bypass succeeded.File was 76 bytes
Storing received cfg of size 76 to memory
Time Of Day completed...
Enabling network access for all CPE ports.
mot_scanList: Writing to Flash!
BcmCmDocsisStatusEventCodes::kCmIsOperational
RE: sb5101e - ABMJR - 30-07-2013
TELNET isnt allowed.
Your Firmware is NOSH
NOSH=No Shell=No TELNET
NO TELNET = NO CLI Interface
Kapisch?
I am a fucking Genius
RE: sb5101e - shocky - 30-07-2013
i get it,what iff i flashed a original dump of 5101efatsh?
will i get telnet access? iff not is there a way of accessing it using original firmware?
RE: sb5101e - ABMJR - 30-07-2013
Yes, then you have a shelll
FATSH
is Diag ver of Shell
RE: sb5101e - shocky - 30-07-2013
Thanks for confirmation, didnt want to brick it so safe than sorry