Extracted firmware of my SBG901 from MX Flash , now how can I extract CERTS?

[dssence]

thanks for the whole , I mean complete explanation , you know I used cmnonexp2mb to extract the certs but only got this, why is it ?

c:\>cmnonexp2mb -f extracted_nonvol.bin
cmnonexp (CableModem non-volatile explorer for BCM3348/BCM3349)
Version: 1.1.1 (Apr 20 2009 17:57:34)
©2008-2009 under GPLv3 by qingpu & raikol

Read 32768 bytes from file extracted_nonvol.bin

I also tried cmnonexpv1.1.1


By the way what I'm not sure is if the Firmware from a SB5101 will work here, cause remember mines an SBG 901 and has a different broadcomm cpu BCM3361 , so what do you think are memory addresses the same?

[drewmerc]

must be a 64k nonvol i guess


anyways my point of why i would do all this, extracting the nonvol the hard way as back in the past when the uk had multiple cable networks(the ntl network was docsis and telewest was eurodocsis) modem hacking was just starting off, a quick way to get a modem from one of network to work on a different one was to extract the nonvol and and flash it to the other modem.
helped loads when there was no shelled firmware,
so you have a sb901 which as far as i know there is no shelled firmware so if you want to change the certs and mac on that thing your fucked, but if you can get a usable nonvol from that modem you can flash it to a haxorware modem and use that to change the mac/certs and if your lucky activate factory mode then dump that nonvol (nice and easy from the haxorware gui) and reverse the process to put the nonvol back into the sb901

if any of this would work in this case is just me speculating, but i find it fun so whatever it interests me

[Bruiser]

feel the need to reply before i even look at the dump just to say that is fucking beautiful

Drewmerc, I was just reading about SBG900 stuff and I agree with you. Mr./Ms. Dssesce is a *real* engineer. A bogus character here, I'd say. Around here.

That is great work. Most folks here are so far in over their head. Not that guy.

Geez.