CODA-4582 Test Mode

[Rolph_Asudio]

Hello, I have a Hitron CODA-4582 that boots to a CLI, but from what I can tell the shell is running on the arm cpu and the atom cpu with the interesting stuff isn't accessible. 

I was able mount some of the partitions on the nvram and it seems there's a program for interacting between the arm and atom, 'ncpu_exec', but it's not present in any of the bin directories. Any clues for next steps? I don't really have an end goal here, just poking around. Originally I wanted to be able to encrypt/decrypt the config for a separate modem, a coda-4680 and so I found the functions on this one for encrypting and decrypting but it doesn't seem to be the same for the 4680.

Some output:

Code:

>>>
Console, CLI version 1.0.0.5
Type 'help' for list of commands

mainMenu> help
Console Commands for this level:
system               - Go to system Menu.
logger               - Go to Logger Menu.
eventm               - Go to Event Manager Menu.
getManifest          - Prints manifest.
version              - prints system version.
docsis               - Go to DOCSIS Menu.
help                 - Display menu commands, with optional <cmd>, displays only matching commands.
shortcuts            - Display key shortcuts help.
exit                 - Exit this sub-menu, go to previous menu.
shell                - Enter Linux shell [<Linux Command>]
        without parameters CLI stays running in the background.
quit                 - Quit and terminate CLI.
reboot               - Reboot the system.
batch                - execute batch of CLI commands from file
        <filename> - the file may contain comment lines starting with # character
        [<on/off>] - verbose commands printing.
wait                 - wait for <msec>.
/<search expression> - '/' allows search of CLI Help for any command using grep like search.
mainMenu>

Code:

Cougar Mountain B0 - Boot Ram.
Version: 0.3.3 (Apr 24 2017, 14:24:33)
Boot Param memory dump:
[0xFFFF3FFC] - 0x00030003
[0xFFFF3FF8] -FFF3FC0] - 0x00000000
[0xFFFF3FBC] - 0x00000001
[0xFFFF3FB8] - 0x00000007
[0xFFFF3FB4] - 0x00000000
[0xFFFF3FB0] - 0x0000000 done, booting the kernel.
systemd 216 running in system mode. (-PAM -AUDIT -SELINUX -IMA -APPARMOR -SMACK +SYSVINIT -LIBCRYPTSETUP -GCRYPT -GNUTLS -ACL -XZ -LZ4 -SECCOMP -BLKID -ELFUTILS -KMOD -IDN )[  OK  ] Reached target Remote File Systems.
[  OK  ] Reached target Paths.
[  OK  ] Reached target[  OK  ] Created slice Root Slice.
[  OK  ] Listening on /dev/initctl Compatibility Named Pipe.
[  OK  ] LPuma filesystem setup...
        Starting Remount Root and Kernel File Systems...
        Starting Adjusting Puma kernel set         Starting Apply Kernel Variables...
        Starting Create Static Device Nodes in /dev...
        Starting udev Coldplu Starting Journal Service...
[  OK  ] Started Journal Service.
[  OK  ] Reached target Slices.
        Mounting Temporary Directory...
[  OK  ] Started Apply Kernel Variables.
[  OK  ] Started Create Static Device Nodes in /dev.
[  OK  ] Started Remount Root and Kernel File Systems.
[  OK  ] Mounted Temporary Directory.

About to set realtime runtime...

[  OK  ] Started udev Coldplug all Devices.
[  OK  ] Reached target Loc         Starting udev Kernel Device Manager...
[  OK  ] Started Adjusting Puma kernel settings.
[  OK  ] Mounted /var/volatile.
[  OK  ] Started udev Kernel Device Manager.
mount -t ext3 /dev/mmcblk0p16 /nvram -o data=journal -o barrier=1
/dev/mmcblk0p16 mounted successfuly to /nvram
[  OK  ] Started Puma filesystem setup.
        Starting Bind mount volatile /var/lib...
        Starting Bind mount volatile /etc/passwd...
        Starting Bind mount volatile /etc/shadow...
[  OK  ] Started Bind mount volatile /var/lib.
[  OK  ] Started Bind mount volatile /etc/passwd.
[  OK  ] Started Bind mount volatile /etc/shadow.
[  OK  ] Reached target Local File Systems.
        Starting Trigger Flushing of Journal to Persistent Storage...
        Starting Create Volatile Files and Directories...
Directories.
        Starting Puma setup...
==========================================
Intel DGWSDK release SW_VERSION_SILICON.7.1.1.37
Build date: Thursday, April 29 202Copyright (c) 2011, Intel Corporation.
========================================================


[  OK  ] Started Trigger Flushing of Journal to Persistent Storage.
[  OK  ] Started Update UTMP about System Boot/Shutdown.
[  OK  ] Reached target System Initialization.
[  OK  ] Listening on D-Bus System Message Bus Socket.
[  OK  ] Reached target Timers.
IMADISTRO_VERSION    = "3.1"
DISTRO_NAME       = "DOCSIS 3.1 Cable Modem"
TUNE_FEATURES     = "armv6 thumb bigendian arm1176jzs"
8c7"
meta-intelce-arm-common = "(nobranch):4ca5d296396942245b42581e6a573bb49506b454"
meta-intelce-arm  = "(nobranch):310afa97cProductionDb_Init:2214 (pid=123): Restoring production DB from NVRAM ... SUCCESS
ProductionDb_FrequencyPlanValidity:3081 (pid=1[  OK  ] Started Puma setup.
        Starting Puma Packet Processor Driver init...
Setup memory config from file "/etc/sysctl_mem.conf"
vm.panic_on_oom = 2
vm.swappiness = 0
vm.overcommit_memory = 2
vm.overcommit_ratio = 100

hil_drv should be running now ...


The PP Doesn't exist in this image ...

[  OK  [  OK  ] Started Puma run validity checks.
        Starting Handshake...

Polling Atom Handshake Status...
Waiting for packet processor on Atom... (0)



Atom PP Initialization finished succussfully
[  OK  ] Started Handshake.
        Starting Puma Start up...
[DEBUG] main:93 puma_startup_mode STARTUP_MODE_FULL

[DEBUG] HWMB_Start:563 Start. Socket type SOCK_COMMANDER
[DEBUG] HWMB_i HWMB_sendRecvMsg:427 Send-Recv message...
[DEBUG] HWMB_sendRecvMsg:429 Sending message... [msgSize=8]
[DEBUG] HWMB_sendMsg:28==
[DEBUG] HWMB_sendRecvMsg:446 Receiving reply message...
[DEBUG] HWMB_recvMsg:348 Receiving message...
[DEBUG] HWMB_recvMsgng received HW_MBox message
[DEBUG] ParseAck:44 ACK received
[DEBUG] main:102 Done sending startup mode to Atom via HW_MBox Using DOCSIS Initialization process parameters: -debug1option 43 -debug1option 50

pcd: (184): Starting TI Process Control Daemon.
[  OK  ] Started Puma Start up.
[  OK  ] Reached target Sockets.
[  OK  ] Reached target Basic Syst[  OK  ] Started D-Bus System Message Bus.
pcd: (184): Loaded 97 rules.
pcd: Initialization complete.
nsmod (Rule DOCSIS_SOCIFDRV).
pcd: (184): Starting process insmod (Rule DOCSIS_KINTR).
pcd: (184): Starting process insmod (Rue SYSTEM_GPTIMER).
pcd: (184): Starting process /usr/sbin/gim (Rule SYSTEM_GIM).
pcd: (184): Rule SYSTEM_WATCHDOG: Success (PrTI Watchdog-RT daemon started <kick interval = 10 seconds>
main:864 (pid=194): Initialized successfully

pcd: (184): Rule SYSTEM_GPTIMER: Success (Process /usr/sbin/gptimer (194)).
pcd: (184): Rule PUMA7SYSTEM_CRU_CTRL_MKNOD: Success (Process mknod (190)).
gim_init:133 (pid=195): GIM initializing...
gim_init:169 (pid=195): GIM initialization complete. GIM_MODULE=3087
pcd: (184): Rule SYSTEM_GIM: Success (Process /usr/sbin/gim (195)).
pcd: (184): Rule PUMA7SYSTEM_DATAPIPE_INSMOD: Success (Process insmod (189)).
pcd: (184): Rule DOCSIS_SOCIFDRV: Success (Process insmod (187)).
pcd: (184): Starting process mknod (Rule DOCSIS_MKNODSOCIFDRV).

pcd: (184): Rule DOCSIS_KINTR: Success (Process insmod (188)).
pcd: (184): Rule DOCSIS_MKNODSOCIFDRV: Success (Process mknod (212)).

[  OK  ] Reached target Multi-User System.
        Starting Update UTMP about System Runlevel Changes...
[  OK  ] Started Update UTMP about System Runlevel Chan
TI Logger: Init complete
pcd: (184): Rule SYSTEM_LOGGER: Success (Process /usr/sbin/logger (193)).
pcd: (184): Starting process /usr/sbin/hw_mbox_app (Rpcd: (184): Rule PUMA7SYSTEM_HW_MBOX_APP: Success (Process /usr/sbin/hw_mbox_app (222)).
pcd: (184): Starting process /usr/sbinpcd: (184): Rule PUMASYSTEM_LASTRULE: Success.


iniparser: cannot open /var/tmp/lsddb_rt.ini
pcd: (184): Rule SYSTEM_SHMDBINIT: Success (Process /usr/sbin/shmdb_init_app (223)).
pcd: (184): Starting process /usr/sbin/halpcpcd: (184): Rule PM_INIT_APP: Success (Process /usr/sbin/pm_init_app (247)).
Can't open /proc/sys/kernel/printk: No such file or directory
Failed to get printk console log level

Code:

GPT fdisk (gdisk) version 1.0.1

Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present

Found valid GPT with protective MBR; using GPT.
Disk /dev/mmcblk0: 1925120 sectors, 940.0 MiB
Logical sector size: 512 bytes
Disk identifier (GUID): 21126DBA-B4FF-4D7C-B8EF-64585FD41F3D
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1894366
Partitions will be aligned on 256-sector boundaries
Total free space is 222 sectors (111.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
  3             256             511   128.0 KiB   8300  SIGBLOCK0
  4             512           18943   9.0 MiB     EF00  APP_CPU_KERNEL0
  5           18944          207359   92.0 MiB    8300  APP_CPU_ROOTFS0
  6          207360          217599   5.0 MiB     8300  NP_CPU_KERNEL0
  7          217600          250367   16.0 MiB    8300  NP_CPU_ROOTFS0
  8          250368          332287   40.0 MiB    8300  GW_FS0
  9          332288          332543   128.0 KiB   8300  SIGBLOCK1
 10          332544          350975   9.0 MiB     EF00  APP_CPU_KERNEL1
 11          350976          539391   92.0 MiB    8300  APP_CPU_ROOTFS1
 12          539392          549631   5.0 MiB     8300  NP_CPU_KERNEL1
 13          549632          582399   16.0 MiB    8300  NP_CPU_ROOTFS1
 14          582400          664319   40.0 MiB    8300  GW_FS1
 15          664320          758527   46.0 MiB    8300  APP_CPU_NVRAM
 16          758528          875263   57.0 MiB    8300  NP_CPU_NVRAM
 17          875264          916223   20.0 MiB    8300  APP_CPU_LOG
 18          916224          957183   20.0 MiB    8300  NP_CPU_LOG
 19          957184         1894366   457.6 MiB   8300  THIRD_PARTY_FS

Thanks!