O2 Surf@Home Router V1

Der von O2 vertriebene UMTS Router wird von der Firma Novatel unter dem Namen „Ovation MCU1001“ vertrieben, verbaut ist eine 166MHz Mips32 CPU.

Die Firmware und Dokumentation ist bei O2 zu finden:

• Dokumentation: http://www.o2online.de/nw/support/downloads/bedienung/surfhome/index.html
• Firmware: (2045)http://www.o2online.de/nw/assets/blobs/software/o2-surfathome-softwareupdate.zip

unzip o2-surfathome-softwareupdate_2045.img

Archive: o2-surfathome-softwareupdate_2045.img
warning [o2-surfathome-softwareupdate_2045.img]:  512 extra bytes at beginning or within zipfile
  (attempting to process anyway)
  inflating: novatel.bin

Noch nicht erfolgreich

Mit http://192.168.0.1/setup.cgi?next_file=admin.htm einloggen, danach kann mit folgenden Beispielen Daten ausgelesen werden.

/etc/

1. http://192.168.0.1/setup.cgi?next_file=/etc/rc (Startdatei)
2. http://192.168.0.1/setup.cgi?next_file=/etc/passwd (Benutzerdaten/Passwörter)
3. http://192.168.0.1/setup.cgi?next_file=/etc/mounts (Gemountete Dateisysteme)
4. http://192.168.0.1/setup.cgi?next_file=/etc/syslog.conf (Syslog Config)

/proc/

1. http://192.168.0.1/setup.cgi?next_file=/proc/cpuinfo (CPU INFO)
2. http://192.168.0.1/setup.cgi?next_file=/proc/meminfo (RAM INFO)
3. http://192.168.0.1/setup.cgi?next_file=/proc/modules (Module)
4. http://192.168.0.1/setup.cgi?next_file=/proc/version (Kernel Version)
5. http://192.168.0.1/setup.cgi?next_file=/proc/devices (Devices)
6. http://192.168.0.1/setup.cgi?next_file=/proc/cmdline (Kernel Startparameter)

/var/

1. http://192.168.0.1/setup.cgi?next_file=/var/run/stab (Serialport)

/usr/ - http://192.168.0.1/setup.cgi?next_file=/usr/stunnel.pem (Keys für FW Update)

Um das Gerät über die serielle Konsole Ansprechen zu können müssen von der Vorderansicht (der Netzwerkanschluss in Körper Richtung) die 4 Pins wie folgt belegt werden.

Bauratteneinstellungen: 57600 8N1, Bei angeschlossenen Serialwandler bootet die Box nicht komplett, kurz abziehen und wieder anstecken löst das Problem, zusätzlich werden zum Text eine ganze mänge Steuerzeichen gesendet, nach dem Booten und kurzzeitigen entfernen des Serialcabels taucht ein Login auf dieser lässt sich aber nicht bedienen es hat den Anschein als wen der UART wehrend des Bootprozesses auf die UMTS/CDMA Karte gemapt wird.

UART initialized

Copyright (c) 2001,2002 BRECIS Communications Corporation80001dbc
now in boot.c: C_Entry  GetNVFromFlash copied data
 SIGN_OFFSET=be3ffff8
have eRcOmM
UART initialized

Copyright (c) 2001,2002 BRECIS Communications Corporation0200000080b519b0in initLcd()dLSize=00474a17***

LINUX started...
Clock rate set to 166666667
SYS_PCI_REG (BC00001C) (A)  = 0000001A
no reset for pci!
CPU revision is: 0001830a
Primary instruction cache 16kb, linesize 16 bytes (4 ways)
Primary data cache 16kb, linesize 16 bytes (4 ways)

Linux version 2.4.20-br20 (root@isg_1_server) (gcc version 3.2 20030304 (uClinux 2.4.20-br20 BRECIS Release 2.0)) #45 Thu May 19 14:59:50 CST 2005
Determined physical RAM map:
 memory: 00001000 @ 00000000 (reserved)
 memory: 000ff000 @ 00001000 (ROM data)
 memory: 00802000 @ 00100000 (reserved)
 memory: 016d4d00 @ 00902000 (usable)
On node 0 totalpages: 8150
zone(0): 8150 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: ip=192.168.1.100::::Brecis:eth0:none:an ip=192.168.2.100:::::eth1:none:100fs console=ttyS0,57600
calculating r4koff... 000cb735(833333)
CPU frequency 166.66 MHz
Calibrating delay loop... 166.29 BogoMIPS
Memory: 23016k/23376k available (1235k kernel code, 360k reserved, 207k data, 80k init)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
pcibios_init: assign resources, Autoconfig PCI channel 0x80280c68
Scanning bus 00, I/O 0x00000000:0x00001000, Mem 0xb9010000:0xbc000000
00:10.0 Class 0607: 104c:ac55 (rev 01)
        Mem at 0xb9010000 [size=0x1000]
00:10.1 Class 0607: 104c:ac55 (rev 01)
        Mem at 0xb9011000 [size=0x1000]
00:12.0 Class 0200: 168c:001a (rev 01)
        Mem at 0xb9020000 [size=0x10000]
scan the buses.
Scanning bus 00
Found 00:80 [104c/ac55] 000607 02
Found 00:81 [104c/ac55] 000607 02
Found 00:90 [168c/001a] 000200 00
Fixups for bus 00
Scanning behind PCI bridge 00:10.0, config 000000, pass 0
Scanning behind PCI bridge 00:10.1, config 000000, pass 0
Scanning behind PCI bridge 00:10.0, config 000000, pass 1
Scanning behind PCI bridge 00:10.1, config 000000, pass 1
Bus scan for 00 returning with max=08
snow:dev->bus->number=0,dev->name=Texas Instruments PCI1520 PC card Cardbus Controller
snow:slot=16,func=0,pin=1
snow:slot=16,dev->irq=0,pin=1
snow:dev->irq=0
snow:dev->bus->number=0,dev->name=Texas Instruments PCI1520 PC card Cardbus Controller (#2)
snow:slot=16,func=1,pin=2
snow:slot=16,dev->irq=1,pin=2
snow:dev->irq=1
snow:dev->bus->number=0,dev->name=PCI device 168c:001a
snow:slot=18,func=0,pin=1
snow:slot=18,dev->irq=2,pin=1
snow:dev->irq=2
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
get major 60 for LCD device
DevID(bc000000) = 00122002
LCD device LCD Version 1.00 init:
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0xbc000100 (irq = 19) is a 16550A
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 80281000-808D43FF [VIRTUAL A0281000-A08D43FF] (RO)
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
PPP generic driver version 2.4.2
Copy engine driver installed
Begin in init_b_flash
b_flash flash device: 400000 at bfc00000
b_flash flash device: 400000 at be000000
0: offset=0x0,size=0x20000,blocks=64
Using buffer write method
Creating 3 MTD partitions on "FLASH_PART0":
0x00000000-0x00020000 : "boot partition"
0x00020000-0x00040000 : "system configuration"
0x00040000-0x00400000 : "kernel & filesystem 0"
0: offset=0x0,size=0x20000,blocks=64
Using buffer write method
Creating 1 MTD partitions on "FLASH_PART1":
0x00000000-0x00400000 : "kernel & filesystem 1"
Linux PCMCIA Card Services 3.2.1
  kernel build: 2.4.20-br20 #7 SMP 4 17 10:23:53 CST 2003
  options:  [pci]
i82365.c 1.352 2002/06/29 06:23:09 (David Hinds)
Intel ISA/PCI/CardBus PCIC probe:
  TI 1520 rev 01 PCI-to-CardBus at slot 00:10, mem 0xb9010000
    host opts [0]: [pci only] [pci irq 0] [lat 128/176] [bus 1/4]
    host opts [1]: [pci only] [pci irq 1] [lat 128/176] [bus 5/8]
    PCI irq 1 test failed
    *NO* card interrupts, polling interval = 1000 ms
serial_cs.c 1.136 2002/06/29 06:27:37 (David Hinds)
ds: register_pccard_driver('serial_cs')
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP, IGMP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 2048)
IP-Config: Guessing netmask for interface 0: 255.255.255.0
IP-Config: Complete:
     device=eth0, addr=192.168.1.100, mask=255.255.255.0, gw=255.255.255.255,
     host=Brecis, domain=, nis-domain=(none),
     bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=

UNASSIGNED device=eth1, addr=192.168.2.100, mask=255.255.255.255, gw=255.255.255.255,
     host=Brecis, domain=, nis-domain=(none),
     bootserver=255.255.255.255, rootserver=255.255.255.255, rootpath=
ip_conntrack version 2.1 (254 buckets, 2032 max) - 312 bytes per conntrack
ip_tables: (C) 2000-2002 Netfilter core team
netfilter PSD loaded - (c) astaro AG
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
ds.c 1.114 2002/06/29 06:23:09 (David Hinds)
VFS: Mounted root (romfs filesystem) readonly.
Freeing prom memory: 1020kb freed
Freeing unused kernel memory: 80k freed [80238000-8024c000]
kenneth:rs_open 2
Algorithmics/MIPS FPU Emulator v1.5
ttyS: 1 input overrun(s)
Algorithmics/MIPttyS: 1 input ovAlgorithmics/MIP
ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc
ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc

ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc

ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc

ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc

ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc

ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc

ttyS: 1 input ovAlgorithmics/MIP

Starting /etc/rc

ttyS: 1 input ovAlgorithmics/MIP

Establish file system

Starting /etc/rc
ttyS: 1 input ovAlgorithmics/MIP
Establish file system
Starting /etc/rc
Expand the ramdisk
ttyS: 1 input ovAlgorithmics/MIP
Mount ramdisk as /var
Mount /proc
start button
#MAC#: 0, NO LINK DETECTED, STILL SETTING DRIVER...
ttyS: 2 input overrun(s)
#Create something in /var/
Copy fifo file to /var
cp: /sbin/cmd_agent: No such file or directory
Setup network
Enabling IP forwarding
#ds_open(socket 0)
ds_open(socket 1)
ttyS: 2 input overrun(s)
ds_open(socket 2)
ds_open(socket 2)
#Starting inetd
cardmgr[37]: watching 2 sockets
#Nov 30 00:00:09 cardmgr[39]: starting, version is 3.2.1
Nov 30 00:00:09 cardmgr[39]: calling write_pid
Nov 30 00:00:09 cardmgr[39]: calling write_stab
Nov 30 00:00:09 cardmgr[39]: opening stabfile (/var/run/stab)
Nov 30 00:00:09 cardmgr[39]: event=4
Nov 30 00:00:15 cardmgr[39]: ret=0, has_cis=1, errno=134
Nov 30 00:00:15 cardmgr[39]: called get_tuple, socket 0, code 33
Nov 30 00:00:15 cardmgr[39]: get_tuple of CISTPL_FUNCID returned 0
Nov 30 00:00:15 cardmgr[39]: called get_tuple, socket 0, code 32
Nov 30 00:00:15 cardmgr[39]: called get_tuple, socket 0, code 21
Nov 30 00:00:15 cardmgr[39]: socket 0: Novatel
serial_attach()
serial_config(0x81fba200)
snow:getTuple:tuple.TupleData=c7.01.99.69.55.1d.f6.32
snow:cf->index=7,cf->io.win[0].base=3f8,cf->io.nwin=1,cf->io.win[0].len=8,io->flags=a3
snow:RequestIO result i=0
ttyS01 at port 0x03f8 (irq = 0) is a 16550A
serial_attach()
serial_config(0x81fba600)
snow:getTuple:tuple.TupleData=c7.01.99.69.55.1d.f6.32
Nov 30 00:0snow:cf->index=7,cf->io.win[0].base=2f8,cf->io.nwin=1,cf->io.win[0].len=8,io->flags=a3
0:15 cardmgr[39]snow:RequestIO result i=0
: lookup_card(0) returns 0x1e07220
ttyS02 at port 0x02f8 (irq = 0) is a 16550A
Nov 30 00:00:15 cardmgr[39]: opening stabfile (/var/run/stab)
Nov 30 00:00:16 cardmgr[39]: opening stabfile (/var/run/stab)
Nov 30 00:00:16 cardmgr[39]: executing: './serial start ttyS1'
Nov 30 00:00:17 cardmgr[39]: + syntax error
Nov 30 00:00:17 cardmgr[39]: start cmd exited with status 255
Nov 30 00:00:17 cardmgr[39]: executing: './serial start ttyS2'
Nov 30 00:00:19 cardmgr[39]: + syntax error
Nov 30 00:00:19 cardmgr[39]: start cmd exited with status 255
start_lan...
device eth0 entered promiscuous mode
ttyS: 15 input overrun(s)
br0: port 1(eth0) entering listening state
ttyS: 2 input overrun(s)
start_wifi
create wlan config
wifi start:apcfg=(31289344),strlen(ap_cfg)=(3458)
      #Warning: loading /sbin/ath_ap_mips.o will taint the kernel: non-GPL license - Proprietary

ttyS: 5 input overrun(s)
***************************************************************
* Loading Vytek Access Point Driver for Atheros AR5211/AR5212 *
* Compiled: Feb  2 2005 18:13:57                              *
* Big Endian mode                                             *
***************************************************************
get Mac address:00c002e7c90a
   set cache line size by me!
ttyS: 17 input overrun(s)
don't change PCI_TIMEOUT_REGISTER of atheros!
  get Mac address:0x000xc00x020xe70xc90x0a
wlan0: Hardware Address = 00:c0:02:e7:c9:0a
create from vportCreateAllBss devno= 0
  #device vpa0 entered promiscuous mode
ttyS: 13 input overrun(s)
br0: port 2(vpa0) entering listening state
dot1xTask: Starting Task
ttyS: 5 input overrun(s)
evice
 eth0 is already a member of a bridge; can't enslave it to bridge br0.
start_dhcp_server...
 start http...
br0: port 1(eth0) entering learning state
ttyS: 3 input overrun(s)
syslog ...
killall: syslogd: no process killed
 conf_path==/etc/syslog.conf
#start ntp...

br0: port 2(vpa0) entering learning state
ttyS: 2 input overrun(s)
start rip...
put MAC C into reset -- allow gpio to use mac C io pins
ttyS: 2 input overrun(s)
Open LCD panel Success!
Open eth0 Success!
lcdd:try to connect dmatd,csock=6
lcdd:connect refused!

TZ=GMT-1
0:0
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
ttyS: 2 input overrun(s)
lcdd:try to connect dmatd,csock=6
lcdd:connect dmatd successfully
Unknown cmd :1008385988--
Starting firewall   initializing firewall 0.13
Set policy
Set kernel configuration
br0: port 2(vpa0) entering forwarding state
br0: topology change detected, propagating
ttyS: 6 input overrun(s)
 ------ [   Creating  Default  Chains   ] -------------------
 ------ [   Special   Port   Handling   ] -------------------
 -------- [ ICMP Policy ] -----------------------------------
 --------- [ TCPMSS Fix for broken providers ] --------------
 --------- [ NAT ] ------------------------------------------
192.168.0.1/255.255.255.0 authorized for NAT
ptables v1.2.8: host/network `(null)' not found
Try `iptables -h' or 'iptables --help' for more information.
------ [ HTTP Redirect   ] -----------------------------------
http redirect
 ------ [ Auto Reconnect Rule  ] -----------------------------------
dod rule add
#iptables: Bad rule (does a matching rule exist in that chain?)
tyS: 5 input overrun(s)
------ [ DOS & Port Scan ] ---------------------------------
DOS enabled
Create SCAN chain
Create DOS attack chain
Enable Port Scan and DOS Attack
ttyS: 2 input overrun(s)
UDP-flood protection
ttyS: 2 input overrun(s)
#Syn-flood protection
Ping of death
 ------ [ Content Filters ] ---------------------------------
------ [ Response to Ping ] ----------------------------------
ttyS: 2 input overrun(s)
VPN passthrough OFF
 ------ [ Remote Control ] ------------------------------------
ttyS: 2 input overrun(s)
  ------ [ Applying Rules ] -----------------------------------
 ------ [ Applications   ] -----------------------------------
ttyS: 3 input overrun(s)
MSN messenager
Yahoo messenager
ICQ
Netmeeting
ttyS: 2 input overrun(s)
------ [ DMZ'd machines ] -----------------------------------
------ [ Statefull connection tracking ] -------------------
ttyS: 2 input overrun(s)
killall: /sbin/ez-ipupdate: no process killed
Tue Nov 30 00:06:16 UTC 1999

Restarting system.

UART initialized

Copyright (c) 2001,2002 BRECIS Communications Corporation80001dbc
now in boot.c: C_Entry  GetNVFromFlash copied data  after PushButton
MSP_ETH_DEBUG is NOT DEFINED  RELEASE 018b  MSPEthEndInitParse: MAC0 IVec = 65, PHY = 3, Duplex = 2. PhyId = 0
DMA Burst = 64

Reading MAC Registers for MAC #  0
  ------------------------------------------------  Configuration Information for MAC: 0
rxBdCount       = 150
txBdCount       = 150
FDAPtr          = 0xa03f3040
FDAPtrCur       = 0xa03f3040
BLFrmPtr        = 0xa03f2b80
TxFrmPtr        = 0xa03e9ee0
TxFrmPtrCur     = 0xa03e9ee0
TxFrmPtrFreeBuf = 0xa03e9ee0
-------------------------------------------------  pDrvCtrl->phyType:3
entry to download

br0: port 2(vpa0) entering disabled state
ttyS: 2 input overrun(s)
*************************************************************
* Exiting Vytek Access Point Driver Module                  *
ttyS: 2 input overrun(s)
*************************************************************
br0: port 2(vpa0) entering disabled state
device vpa0 left promiscuous mode
ttyS: 4 input overrun(s)
ERROR, munmap of non-mmaped memory by process 476 (upgrade_flash.c): 0004d000
ttyS: 3 input overrun(s)
Restarting system.