Arris TG2492 (VM Super hub 3)

[danman]

You can probably use Windows too but I have no idea what tool you need to use.

more photos

It's the same chip as on my board PS8211-0 . It's possible that it will have the same pinout as mine:


31 - CMD
22 - CLK
25 - DAT0
26 - DAT1
24 - DAT2
33 - VCC

[eltremendo]

You can probably use Windows too but I have no idea what tool you need to use.

more photos

It's the same chip as on my board PS8211-0 . It's possible that it will have the same pinout as mine:


31 - CMD
22 - CLK
25 - DAT0
26 - DAT1
24 - DAT2
33 - VCC

wao thanks for the info . i can just tap those pins of the phiston chip with a pong

[eltremendo]

You can probably use Windows too but I have no idea what tool you need to use.

more photos

It's the same chip as on my board PS8211-0 . It's possible that it will have the same pinout as mine:


31 - CMD
22 - CLK
25 - DAT0
26 - DAT1
24 - DAT2
33 - VCC

what about this version with phiston chip

[danman]

You can probably use Windows too but I have no idea what tool you need to use.

more photos

It's the same chip as on my board PS8211-0 . It's possible that it will have the same pinout as mine:


31 - CMD
22 - CLK
25 - DAT0
26 - DAT1
24 - DAT2
33 - VCC

what about this version with phiston chip

no idea...

[eltremendo]

You can probably use Windows too but I have no idea what tool you need to use.

more photos

It's the same chip as on my board PS8211-0 . It's possible that it will have the same pinout as mine:


31 - CMD
22 - CLK
25 - DAT0
26 - DAT1
24 - DAT2
33 - VCC

what about this version with phiston chip

no idea...

Hey what voltage should i feed the vcc with?

[elbarto]

Hi guys, I'm working on very similar device CH7465 with NOSH firmware.
I was able to make a full dump and have convenient way to modify the internal eMMC.
My device doesn't display almost any messages on its console (just a few messages from bootloader) so no shell access is available.
I was also able to order another device from ebay and after clonning eMMC also the copy works Ok for accessing my internet connection.

I'd like to enable telnet/ssh access on this device. Did you make any progress with this?

Telnet and ssh can be activated, changing 0 by 1 in addresses  0x2A and 0x203 of /nvram/6/1 for TG862.
if nvram DB keeps same it can works. With breakout board taking, edit and get back file /6/1 in nvram partion and add or remplace rules with iptables.

Does anyone have the 9.1.116.608 firmware, or a mechanism to log in to this release? I can login to 9.1.116V using the mechanism from the NCC blog and I'm sure there must be other vulnerabilities to allow local login still. I looked at the two UARTs and only get output though someone mentioned the possibility of causing some sort of crash. Also from another site, it seems JTAG is disabled, so not going to try that route.

I got same problem, bucsay's mechanism is not longer work in new firms. Getting image of new firm from upgrade server and scraping file system. i hope find out to way to get acess.

[emantec]

Decrypted 9.1.116 firmware for those interested.

https://mega.nz/#!opVmiILY!xr4En9nFS-6y5...-yJDITiMws

[blacklisted]

now for someone to build firmware

[ricktendo]

Nice, binwalk extracted it successfully!

[emantec]

Adding to elbarto's post on enabling telnet you can do the following to bypass the pwod by setting the 'client' password (assuming the client is actually Virgin Media in this case).

In /nvram/6/1 set the following at address 0x1F7

BC AE 6A 68 38 32 4B 18

This will set the password to 'pwned' giving you access to the higher privileged shell (still need to work out how to break into busybox).