Help : How to install Haxorware on Cisco DPQ2160

[dvrocks7]

Hello Everybody, I got a new cable modem of Cisco (DPQ2160) brand from my ISP. Is there any ways to install the Haxorware firmware in it.

Please give some advice.

Thanks

[diegofpk]

i was wondering the same. but seems to be impossible. ;x

[drewmerc]

never heard of it, what kind of cpu has it got

[diegofpk]

CPU is bcm3349 (same as sb5101) and flash is winbond w9864g6jh-6
and it has 8-pin jtag connection

i was wondering if it possible to install haxorware by parallel jtag with this scheme:



the first is motorola layout, but the second is the scientific atlanta layuot (cisco have bought scientific atlanta few years ago)
so maybe we can flash with this cable

[diegofpk]

searching and searching around i found this, but, itss in spanish



Hola amigos,algo logre con este modem, activar la consola entrando a http://192.168.100.1/_consoleport.asp Login: admin - Password: W2402, despues conecte por serial pin1(pin que tiene el cuadrado)=RX - pin2=TX - pin3=GND - pin4=VCC , al abrir HyperTerminal me sale lo siguiente sin poder escribir en la consola:

Broadcom SPI Bootloader
Cache initialized


SA BootLoader Version: 2.1.7l_R4(S) Release Gnu spiboot reduced DDR drive
Build Date: Dec 26 2008
Build Time: 19:39:54
SPI flash ID 0xc22015, size 2MB, block size 64KB, write buffer 256, busy bit 1


eCos - hal_diag_init
Init device '/dev/ttydiag'
Init tty channel: 80385128
Init device '/dev/tty0'
Init tty channel: 80385148
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 0x803b59e0 len: 2048
Set input buffer - buf: 0x803b61e0 len: 2048
BCM 33XX SERIAL config


Reading Permanent settings from non-vol...
Checksum for permanent settings: 0xf6cd0df3
Settings were read and verified.




Reading Dynamic settings from non-vol...
Checksum for dynamic settings: 0x8670ce93
Settings were read and verified.




vvv Interface creation and driver startup beginning vvv


-> Begin DOCSIS CM WAN interface
Creating HAL object for the DOCSIS CableModem interface
Registering DOCSIS CableModem driver
BcmMacInit: advMapRunAheadTimeMin = 5120 (0x00001400) 10.24 MHz ticks, 500 usec
-> End DOCSIS CM WAN interface


-> Begin Ethernet LAN interfaces
Creating HAL object for the Ethernet interface
Registering Ethernet driver
-> End Ethernet LAN interfaces


-> Begin USB LAN interface
Creating HAL object for the USB 1.1 interface
Registering USB driver
-> End USB LAN interface


-> Begin IP Stack interfaces
-> Starting BFC DHCP Client subsystem...
-> Starting BFC DHCPv6 Client subsystem...
-> Setting default DUID using IP1 MAC address (you can override this if necessar
y)...
Creating HAL object for IP Stack1 (MAC Addr=xx:xx:xx:xx:xx:xx)
Registering IP Stack1 driver
Tcpip NI: Init - RegisteredStackCount = 1


Creating HAL object for IP Stack2 (MAC Addr=xx:xx:xx:xx:xx:xx)
Registering IP Stack2 driver
Tcpip NI: Init - RegisteredStackCount = 2


IP Stack3 not enabled or failed to create and start interface; no other
stacks will be loaded.
-> End IP Stack interfaces


^^^ Interface creation and driver startup complete ^^^


bcm: ifid: xx:xx:xx:xx:xx:xx:xx:xx
Propane version: 2.0.1 (28 Oct 2002)
Creating SNMP agent cablemodem agent
Creating SNMP agent CPE diag agent
BcmSnmpThread starting thread operation.
Initializing Net-SNMP transport for IPv4
Initializing Net-SNMP transport for IPv6
IPv6 - register netsnmp_brcmV6_ctor to get our brcm V6 UDP domain
IPv6 init_bcmV2SessionAndTransport: Open a session and hook our callbacks
Setting DS cal singleton instance to 0
SAHttpCacheVariables::GetSingletonInstance: WARNING - the singleton instance is
NULL, and someone is accessing it!
Setting up the SAHttpCacheVariables singleton pointer.


+-------------------------------------------------------------------+
| |
| ********** * |
| ********** *** |
| ** ** ** ** |
| ** ** ** ** |
| **** ** ** |
| **** ** ** |
| ** ** ** |
| ** ** ** |
| **** ********** |
| **** ********** |
| ** ** ** ** |
| ** ** ** ** |
| ********** ** ** |
| ********** ** ** |
| |
| Cisco is a trademark of Cisco. |
| Cisco and the Cisco logo are registered trademarks of Cisco. |
| ©2008 Cisco. All rights reserved. |
| ©2008 Broadcom Corporation. All rights reserved. |
| CM ( v4.4.2 ) |
| |
+-------------------------------------------------------------------+


Revision : dpq2160-v202r12811-091020as
Build Date: Oct 21 2009
Build Time: 10:32:31
Built By: Carlos




Running the system...


===================>>> Try LKF first!!!!!!!!
567000000 Hz...

Saludos!








aja el teraterm. Configura el baud a 115200. Cuando termine la carga del SO, presiona enter. Si no pasa nada mandale el comando break varias veces. Si funciona, puede que el router confirme un crash y se reinicie. Si no pasa nada, en una de esas tienes problemas con el TX en el puerto consola, o esta capado vía firmware...ya estas cerca.

[drewmerc]

interesting, if your trying the jtag method, first i'd check for the ground pins with a continuity tester if its using the webstar or moto standard
if you playing with the console try snmp method (may be as simple as the 1 click flasher working) or crashing the bootloader to see if you get a prompt

[diegofpk]

i've made the parallel cable using webstar layout (8-pin jtag) but when i turned on the modem, all the lights stand on
and in Tom's JTAG Utility returned this:

JTAG communication failure, check connection, JTAG interface, target power etc.

already verified all connections and all fine

and Schwarze Katze returns this:

Jtag Engine initiated Successfully

BlackCat plugin services started.....
0: NULL plugin created
loading plugins from C:\Arquivos de programas\TCNiSO\Blackcat\plugins\
2:8192: [EJTAG] loaded from C:\Arquivos de programas\TCNiSO\Blackcat\plugins\ejtag.dll
3:655360: [FlashPlugin] loaded from C:\Arquivos de programas\TCNiSO\Blackcat\plugins\flashpi.dll
4:16384: [PCPARPORT] loaded from C:\Arquivos de programas\TCNiSO\Blackcat\plugins\pcparport_win32.dll
5:4096: [JTAG] loaded from C:\Arquivos de programas\TCNiSO\Blackcat\plugins\pptap1.dll
Bad Device Path or Not Found:paralleljtag
/paralleljtag/link 1 /JTAG: unrecognized command
Link Success /BlackCat/JTAG:1<->/BlackCat/PCPARPORT
Link Success /BlackCat/FlashPlugin:1<->/BlackCat/MEMORY
6 plugins loaded
0xffffffff = -1
Cannot find manufacturer (Manu 7ff, Part 7fff)


any idea ?

[drewmerc]

well the webstar pinout is correct, maybe the flashchip, try PM'ing maxsteel http://www.haxorware.com/forums/showthread.php?tid=2819
see if he managed it

[diegofpk]

thnxx pm sent, w8ing 4 response... i will post here if he knows something

[dvrocks7]

I guess the only solution to flash it with Hax0rware is to buy and use a Blackcat usb jtag which contains a reprogramming chip to modify such script coded modem flash chip. It's just a suggestion. Gonna try it if I get one soon