17-11-2022, 11:46 PM
Hello, I have a Hitron CODA-4582 that boots to a CLI, but from what I can tell the shell is running on the arm cpu and the atom cpu with the interesting stuff isn't accessible.
I was able mount some of the partitions on the nvram and it seems there's a program for interacting between the arm and atom, 'ncpu_exec', but it's not present in any of the bin directories. Any clues for next steps? I don't really have an end goal here, just poking around. Originally I wanted to be able to encrypt/decrypt the config for a separate modem, a coda-4680 and so I found the functions on this one for encrypting and decrypting but it doesn't seem to be the same for the 4680.
Some output:
Thanks!
I was able mount some of the partitions on the nvram and it seems there's a program for interacting between the arm and atom, 'ncpu_exec', but it's not present in any of the bin directories. Any clues for next steps? I don't really have an end goal here, just poking around. Originally I wanted to be able to encrypt/decrypt the config for a separate modem, a coda-4680 and so I found the functions on this one for encrypting and decrypting but it doesn't seem to be the same for the 4680.
Some output:
Code:
>>>
Console, CLI version 1.0.0.5
Type 'help' for list of commands
mainMenu> help
Console Commands for this level:
system - Go to system Menu.
logger - Go to Logger Menu.
eventm - Go to Event Manager Menu.
getManifest - Prints manifest.
version - prints system version.
docsis - Go to DOCSIS Menu.
help - Display menu commands, with optional <cmd>, displays only matching commands.
shortcuts - Display key shortcuts help.
exit - Exit this sub-menu, go to previous menu.
shell - Enter Linux shell [<Linux Command>]
without parameters CLI stays running in the background.
quit - Quit and terminate CLI.
reboot - Reboot the system.
batch - execute batch of CLI commands from file
<filename> - the file may contain comment lines starting with # character
[<on/off>] - verbose commands printing.
wait - wait for <msec>.
/<search expression> - '/' allows search of CLI Help for any command using grep like search.
mainMenu>Code:
Cougar Mountain B0 - Boot Ram.
Version: 0.3.3 (Apr 24 2017, 14:24:33)
Boot Param memory dump:
[0xFFFF3FFC] - 0x00030003
[0xFFFF3FF8] -FFF3FC0] - 0x00000000
[0xFFFF3FBC] - 0x00000001
[0xFFFF3FB8] - 0x00000007
[0xFFFF3FB4] - 0x00000000
[0xFFFF3FB0] - 0x0000000 done, booting the kernel.
systemd 216 running in system mode. (-PAM -AUDIT -SELINUX -IMA -APPARMOR -SMACK +SYSVINIT -LIBCRYPTSETUP -GCRYPT -GNUTLS -ACL -XZ -LZ4 -SECCOMP -BLKID -ELFUTILS -KMOD -IDN )[[32m OK [0m] Reached target Remote File Systems.
[[32m OK [0m] Reached target Paths.
[[32m OK [0m] Reached target[[32m OK [0m] Created slice Root Slice.
[[32m OK [0m] Listening on /dev/initctl Compatibility Named Pipe.
[[32m OK [0m] LPuma filesystem setup...
Starting Remount Root and Kernel File Systems...
Starting Adjusting Puma kernel set Starting Apply Kernel Variables...
Starting Create Static Device Nodes in /dev...
Starting udev Coldplu Starting Journal Service...
[[32m OK [0m] Started Journal Service.
[[32m OK [0m] Reached target Slices.
Mounting Temporary Directory...
[[32m OK [0m] Started Apply Kernel Variables.
[[32m OK [0m] Started Create Static Device Nodes in /dev.
[[32m OK [0m] Started Remount Root and Kernel File Systems.
[[32m OK [0m] Mounted Temporary Directory.
About to set realtime runtime...
[[32m OK [0m] Started udev Coldplug all Devices.
[[32m OK [0m] Reached target Loc Starting udev Kernel Device Manager...
[[32m OK [0m] Started Adjusting Puma kernel settings.
[[32m OK [0m] Mounted /var/volatile.
[[32m OK [0m] Started udev Kernel Device Manager.
mount -t ext3 /dev/mmcblk0p16 /nvram -o data=journal -o barrier=1
/dev/mmcblk0p16 mounted successfuly to /nvram
[[32m OK [0m] Started Puma filesystem setup.
Starting Bind mount volatile /var/lib...
Starting Bind mount volatile /etc/passwd...
Starting Bind mount volatile /etc/shadow...
[[32m OK [0m] Started Bind mount volatile /var/lib.
[[32m OK [0m] Started Bind mount volatile /etc/passwd.
[[32m OK [0m] Started Bind mount volatile /etc/shadow.
[[32m OK [0m] Reached target Local File Systems.
Starting Trigger Flushing of Journal to Persistent Storage...
Starting Create Volatile Files and Directories...
Directories.
Starting Puma setup...
==========================================
Intel DGWSDK release SW_VERSION_SILICON.7.1.1.37
Build date: Thursday, April 29 202Copyright (c) 2011, Intel Corporation.
========================================================
[[32m OK [0m] Started Trigger Flushing of Journal to Persistent Storage.
[[32m OK [0m] Started Update UTMP about System Boot/Shutdown.
[[32m OK [0m] Reached target System Initialization.
[[32m OK [0m] Listening on D-Bus System Message Bus Socket.
[[32m OK [0m] Reached target Timers.
IMADISTRO_VERSION = "3.1"
DISTRO_NAME = "DOCSIS 3.1 Cable Modem"
TUNE_FEATURES = "armv6 thumb bigendian arm1176jzs"
8c7"
meta-intelce-arm-common = "(nobranch):4ca5d296396942245b42581e6a573bb49506b454"
meta-intelce-arm = "(nobranch):310afa97cProductionDb_Init:2214 (pid=123): Restoring production DB from NVRAM ... SUCCESS
ProductionDb_FrequencyPlanValidity:3081 (pid=1[[32m OK [0m] Started Puma setup.
Starting Puma Packet Processor Driver init...
Setup memory config from file "/etc/sysctl_mem.conf"
vm.panic_on_oom = 2
vm.swappiness = 0
vm.overcommit_memory = 2
vm.overcommit_ratio = 100
hil_drv should be running now ...
The PP Doesn't exist in this image ...
[[32m OK [0m[[32m OK [0m] Started Puma run validity checks.
Starting Handshake...
Polling Atom Handshake Status...
Waiting for packet processor on Atom... (0)
Atom PP Initialization finished succussfully
[[32m OK [0m] Started Handshake.
Starting Puma Start up...
[DEBUG] main:93 puma_startup_mode STARTUP_MODE_FULL
[DEBUG] HWMB_Start:563 Start. Socket type SOCK_COMMANDER
[DEBUG] HWMB_i HWMB_sendRecvMsg:427 Send-Recv message...
[DEBUG] HWMB_sendRecvMsg:429 Sending message... [msgSize=8]
[DEBUG] HWMB_sendMsg:28==
[DEBUG] HWMB_sendRecvMsg:446 Receiving reply message...
[DEBUG] HWMB_recvMsg:348 Receiving message...
[DEBUG] HWMB_recvMsgng received HW_MBox message
[DEBUG] ParseAck:44 ACK received
[DEBUG] main:102 Done sending startup mode to Atom via HW_MBox Using DOCSIS Initialization process parameters: -debug1option 43 -debug1option 50
pcd: (184): Starting TI Process Control Daemon.
[[32m OK [0m] Started Puma Start up.
[[32m OK [0m] Reached target Sockets.
[[32m OK [0m] Reached target Basic Syst[[32m OK [0m] Started D-Bus System Message Bus.
pcd: (184): Loaded 97 rules.
pcd: Initialization complete.
nsmod (Rule DOCSIS_SOCIFDRV).
pcd: (184): Starting process insmod (Rule DOCSIS_KINTR).
pcd: (184): Starting process insmod (Rue SYSTEM_GPTIMER).
pcd: (184): Starting process /usr/sbin/gim (Rule SYSTEM_GIM).
pcd: (184): Rule SYSTEM_WATCHDOG: Success (PrTI Watchdog-RT daemon started <kick interval = 10 seconds>
main:864 (pid=194): Initialized successfully
pcd: (184): Rule SYSTEM_GPTIMER: Success (Process /usr/sbin/gptimer (194)).
pcd: (184): Rule PUMA7SYSTEM_CRU_CTRL_MKNOD: Success (Process mknod (190)).
gim_init:133 (pid=195): GIM initializing...
gim_init:169 (pid=195): GIM initialization complete. GIM_MODULE=3087
pcd: (184): Rule SYSTEM_GIM: Success (Process /usr/sbin/gim (195)).
pcd: (184): Rule PUMA7SYSTEM_DATAPIPE_INSMOD: Success (Process insmod (189)).
pcd: (184): Rule DOCSIS_SOCIFDRV: Success (Process insmod (187)).
pcd: (184): Starting process mknod (Rule DOCSIS_MKNODSOCIFDRV).
pcd: (184): Rule DOCSIS_KINTR: Success (Process insmod (188)).
pcd: (184): Rule DOCSIS_MKNODSOCIFDRV: Success (Process mknod (212)).
[[32m OK [0m] Reached target Multi-User System.
Starting Update UTMP about System Runlevel Changes...
[[32m OK [0m] Started Update UTMP about System Runlevel Chan
TI Logger: Init complete
pcd: (184): Rule SYSTEM_LOGGER: Success (Process /usr/sbin/logger (193)).
pcd: (184): Starting process /usr/sbin/hw_mbox_app (Rpcd: (184): Rule PUMA7SYSTEM_HW_MBOX_APP: Success (Process /usr/sbin/hw_mbox_app (222)).
pcd: (184): Starting process /usr/sbinpcd: (184): Rule PUMASYSTEM_LASTRULE: Success.
iniparser: cannot open /var/tmp/lsddb_rt.ini
pcd: (184): Rule SYSTEM_SHMDBINIT: Success (Process /usr/sbin/shmdb_init_app (223)).
pcd: (184): Starting process /usr/sbin/halpcpcd: (184): Rule PM_INIT_APP: Success (Process /usr/sbin/pm_init_app (247)).
Can't open /proc/sys/kernel/printk: No such file or directory
Failed to get printk console log levelCode:
GPT fdisk (gdisk) version 1.0.1
Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present
Found valid GPT with protective MBR; using GPT.
Disk /dev/mmcblk0: 1925120 sectors, 940.0 MiB
Logical sector size: 512 bytes
Disk identifier (GUID): 21126DBA-B4FF-4D7C-B8EF-64585FD41F3D
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1894366
Partitions will be aligned on 256-sector boundaries
Total free space is 222 sectors (111.0 KiB)
Number Start (sector) End (sector) Size Code Name
3 256 511 128.0 KiB 8300 SIGBLOCK0
4 512 18943 9.0 MiB EF00 APP_CPU_KERNEL0
5 18944 207359 92.0 MiB 8300 APP_CPU_ROOTFS0
6 207360 217599 5.0 MiB 8300 NP_CPU_KERNEL0
7 217600 250367 16.0 MiB 8300 NP_CPU_ROOTFS0
8 250368 332287 40.0 MiB 8300 GW_FS0
9 332288 332543 128.0 KiB 8300 SIGBLOCK1
10 332544 350975 9.0 MiB EF00 APP_CPU_KERNEL1
11 350976 539391 92.0 MiB 8300 APP_CPU_ROOTFS1
12 539392 549631 5.0 MiB 8300 NP_CPU_KERNEL1
13 549632 582399 16.0 MiB 8300 NP_CPU_ROOTFS1
14 582400 664319 40.0 MiB 8300 GW_FS1
15 664320 758527 46.0 MiB 8300 APP_CPU_NVRAM
16 758528 875263 57.0 MiB 8300 NP_CPU_NVRAM
17 875264 916223 20.0 MiB 8300 APP_CPU_LOG
18 916224 957183 20.0 MiB 8300 NP_CPU_LOG
19 957184 1894366 457.6 MiB 8300 THIRD_PARTY_FSThanks!