The SBG6782

[odeyin]

    I am in the process of tearing the Arris/Motorola Surfboard SBG6782AC down. If there is interest I will post my findings and pictures.

Here are my initial findings:

-It has two mini pcie ports for its wireless connectivity. (One is for a/b/g/n and the other is ac)

-it has unused USB and FireWire ports(shown in the picture)

-the power supply is not integrated and is cabled.

I will get the information on the chip set soon.

My need is to see if I can shoehorn an WAN Ethernet port.

[drewmerc]

need more pictures

[teddyalmonds]

Already posted many pictures of the internals of the diagnostic version on sbh. It's bcm, 3383.

[odeyin]

Nice and thank you. I was unable to find them before as I was not a member of SBH. So my apologies teddyalmonds.

Upon review of the consumer model right in front of me and the DIAG model in your pics there is a ton of differences. The JTAG port on the consumer model is completely disabled.(meaning no chips U600/U601, inductance coil (L) a few capacitors and a diode.) Among other multiple places of the board.

I mislabeled the USB and firewire (ie there is no firewire it is a USB port, but again disabled by missing hardware) , and now I see that is is just a I/O using a phonoplug type connectors.

Are J3/J4 just serial connectors?

What my plan for now is to make a bill of materials and reflow them onto the board if I can. I would imagine I can get most of the resistors/diodes/capacitors from digikey and possibly some of the chips, I can always use either find chips or alibaba and order them direct from china too.

My stated end goal is: To add a Ethernet WAN port.

There seems to be two ways to go about this:

1. To purchase a mini-pcie WAN and a mini-pcie splitter but it probable would not be active until I was able to modify the firmware to activate it.

2. To find where the RF signal gets translated to ethernet and add a ethWAN port at that junction. But still need to modify the firmware to recognize this and pass it through as that.

I would also have to control the MAC address for this too work.

[odeyin]

I wonder if we can attack this modem at the M-PCIE port with something like this:

http://www.aliexpress.com/item/Mini-pcie...30582.html

[thadpg]

Did you ever make any progress with this modem? I just picked one up and was wanting to play with it.

[sb5101e]

I am in the process of tearing the Arris/Motorola Surfboard SBG6782AC down. If there is interest I will post my findings and pictures.

Here are my initial findings:

-It has two mini pcie ports for its wireless connectivity. (One is for a/b/g/n and the other is ac)

-it has unused USB and FireWire ports(shown in the picture)

-the power supply is not integrated and is cabled.

I will get the information on the chip set soon.

My need is to see if I can shoehorn an WAN Ethernet port.

USB_TTL Successfully modified MAC , Unfortunately, I did not send pictures permissions

---

I am in the process of tearing the Arris/Motorola Surfboard SBG6782AC down. If there is interest I will post my findings and pictures.

Here are my initial findings:

-It has two mini pcie ports for its wireless connectivity. (One is for a/b/g/n and the other is ac)

-it has unused USB and FireWire ports(shown in the picture)

-the power supply is not integrated and is cabled.

I will get the information on the chip set soon.

My need is to see if I can shoehorn an WAN Ethernet port.

I have a successful solution SBG6782AC CHANGE MAC
But DOCSIS TO EUORSDOCSIS failure

---

I am in the process of tearing the Arris/Motorola Surfboard SBG6782AC down. If there is interest I will post my findings and pictures.

Here are my initial findings:

-It has two mini pcie ports for its wireless connectivity. (One is for a/b/g/n and the other is ac)

-it has unused USB and FireWire ports(shown in the picture)

-the power supply is not integrated and is cabled.

I will get the information on the chip set soon.

My need is to see if I can shoehorn an WAN Ethernet port.

You the mail?

[sb5101e]

    我有sb6782完整固件

[sb5101e]

DOCSIS TO EURODOCSIS,
TTL console can log in,
cm_annex 0 or annex 0
command doesn't seem to work,
Would anyone like to help me, thank you.

[sb5101e]

This is local：

CM> dir

! ? REM call cd
dir find_command help history instances
ls man pwd sleep syntax
system_time usage
----
con_high cpuLoad cpuUtilization exit ipc_test
mbufShow memShow mutex_debug ping read_memory
reset routeShow run_app shell socket_debug
stackShow taskDelete taskInfo taskPrioritySet taskResume
taskShow taskSuspend taskSuspendAll taskTrace usfsShow
version write_memory zone
----
[80211_hal] [Console] [HeapManager] [HostDqm] [Moca] [avs] [cablemedea]
[cm_hal] [docsis_ctl] [dtp] [eRouter] [embedded_target] [enet_hal]
[event_log] [fam] [flash] [forwarder] [ftpLite] [ip_hal] [moca_hal] [msgLog]
[non-vol] [pingHelper] [power] [snmp] [snoop] [spectrum_analyzer]
CM>
---------------CM_read_memory--------------
CM> read_memory

COMMAND: read_memory

USAGE: read_memory [-p] [-c] [-s ElementSize{1..4}] [-n NumberOfBytes{1..16384
}] [StartAddress]

DESCRIPTION:
Displays the contents of memory (in hex and ASCII) to the console.

StartAddress : the address to start displaying (can be memory, registers,
etc).
-s : sets the element size to be read (1, 2, or 4 bytes). Most useful for
registers; defaults to 1.
-n : sets the number of bytes to be read. Defaults to 16. Note that this
will always be padded out to a multiple of the element size.
-c : increments the start address by the number of bytes before reading.
This is most useful for continuing the previous read (with the same
parameters).
-p : prints the current options (which would be used if not otherwise
supplied).

If no parameters are specified, it will perform the last read again.

NOTE - the parameters are remembered from one read to the next; e.g. if you
set the element size to 4 bytes, then all subsequent reads will use this,
unless explicitly overridden.

WARNING - it may be possible to make the system hang or crash if you read
from an illegal address!

EXAMPLES:
read_memory -s 4 -n 64 0x80001234 -- Reads 64 bytes as 32-bit values.
read_memory -n 32 0x80001234 -- Reads 32 bytes starting with the
specified address.
read_memory -c -- Reads the next 32 bytes, continuing
from the previous read.

---------------------------CM_read_memory END -------------------------------

=====================================flash================================
CM/Flash> dir

! ? REM call cd
dir find_command help history instances
ls man pwd sleep syntax
system_time usage
----
autoTest cfi_show close configRegion deinit
erase init open read readDirect
show write writeArray
----

CM/Flash>

CM/Flash> autoTest

COMMAND: autoTest

USAGE: autoTest bootloader|image1|image2|perm|dyn [BlockNumber]

DESCRIPTION:
DESCRIPTION:
region) to ensure that all of the flash driver functions work correctly.
NOTE: any data in the specified block will be erased! Choose a block that
is not being used for anything important! Use the 'show' command to list the
blocks and how they are allocated.

If you omit the BlockNumber parameter, the test will be run over all blocks
in the region (destroying any data that is in the blocks).

In July 2004, we had to change the flash driver in order to support multiple
flash devices. As a result, you can no longer just specify the block number;
you must also specify the region that the block is in (the region maps to a
flash device, and the block number within that device will be tested). If
you specify a region that does not contain the block, then the test will
fail.

EXAMPLES:
autoTest image2 33 -- Performs the test suite on block 33 (which is in the
image2 region)
autoTest image2 -- Performs the test suite on all blocks in the image2
region
CM/Flash> cfi_show

COMMAND: cfi_show

USAGE: cfi_show bootloader|image1|image2|perm|dyn

DESCRIPTION:
Displays the CFI database for the flash device associated with the specified
region (if the device is CFI-compliant).

EXAMPLES:
cfi_show image2 -- Displays CFI info for the flash device associated with
image2

CM/Flash> close

COMMAND: close

USAGE: close

DESCRIPTION:
Closes the flash driver, allowing the rest of the application to use it.
Calling this more than once has no effect.

EXAMPLES:
close --

CM/Flash> configRegion

COMMAND: configRegion

USAGE: configRegion bootloader|image1|image2|perm|dyn SizeBytes

DESCRIPTION:
Configures the minimum acceptable size for a region. This takes effect the
next time the driver is initialzied. Specifying a size of 0 restores the
default built in to the driver.

EXAMPLES:
configRegion perm 65536 -- Configures Perm NonVol to require a minimum of
64k
CM/Flash> deinit

COMMAND: deinit

USAGE: deinit

DESCRIPTION:
Deinitializes the flash driver, making it release resouces. Note that the
flash device will be unusable after this, until you run the init command.

EXAMPLES:
deinit --

CM/Flash> erase

COMMAND: erase

USAGE: erase [-b BlockNumber] [-a Offset] [-r]

DESCRIPTION:
Erases the flash block specified by the block number (-b), address offset
(-a) or erases all blocks in the region (-r).

EXAMPLES:
erase -b 3 -- Erases block number 3 (the fourth block)

CM/Flash> init

COMMAND: init

USAGE: init

DESCRIPTION:
Initializes the flash driver, making it detect the flash device. This is
usually done for you at system startup, but may be needed if you deinit the
driver. This command has no effect if the driver is already initialized.

EXAMPLES:
init --

CM/Flash> open

COMMAND: open

USAGE: open bootloader|image1|image2|perm|dyn

DESCRIPTION:
Opens the flash driver for use by the console (locking out the rest of the
application!) so that you can use the read/write/erase commands. NOTE: If
you do something that would cause the driver to be opened again (write
nonvol, dload an image, etc), then the operation will be blocked until you
run the close command, or it may fail.

EXAMPLES:
open image2 -- Opens the image2 region for read/write/erase

CM/Flash> read

COMMAND: read

USAGE: read Size{1..4} Number{1..8192} Offset

DESCRIPTION:
Uses the read functions to access data in the flash device, printing to the
console. You must specify the size of the read (1, 2, or 4 bytes), the
number of bytes to read, and the offset into the region to start. The offset
should be aligned correctly for the size specified.

EXAMPLES:
read 1 4 0 -- Reads 4 bytes at the beginning of the region
read 4 8 1024 -- Reads 2 dwords at offset 1k in the region

CM/Flash> readDirect

COMMAND: readDirect

USAGE: readDirect Number{1..8192} Offset

DESCRIPTION:
Uses the read direct function to access the flash memory data directly,
printing to the console. You must specify the number of bytes to read and
the offset into the region to start.

EXAMPLES:
readDirect 128 0 -- Reads 128 bytes at the beginning of the region
CM/Flash> show
COMMAND: show
USAGE: show
DESCRIPTION:
Causes the flash driver to display its internal state.