Informaci?n DVI 3000

JTAG on DVI3000.
Locked
cipher
Junior Member
Posts: 381
Joined: Fri Oct 28, 2005 8:43 am

Post by cipher »

If you can telnet to the box this would likely indicate its a unix based implementation and you have an access password that appears to be a backdoor left in the firmware code. You can access the kernel! Yes it it limited but you can create files and code. Is there a shell available? What commands have you tried other than what you listed?

This password is probably used in many models that are like the DVI series.

Why would Motorola have left telnet access to the unit with a very secure userid and password? Something is in there thats important to the box.
andornot
Junior Member
Posts: 32
Joined: Wed Nov 01, 2006 7:34 am

Post by andornot »

no consigo conectar con telnet, el pc detecta la conexion a 10m, pero con telnet no me va. ayuda

with himself not to connect with telnet, the PC detects the connection to 10m, but with telnet it does not go to me. help
andornot
Junior Member
Posts: 32
Joined: Wed Nov 01, 2006 7:34 am

Post by andornot »

haute te puedes poner en contacto conmigo, eres espa?ol.

haute you can be put in contact with me, you are Spanish.
haute
Junior Member
Posts: 80
Joined: Mon Jan 09, 2006 9:31 am

Post by haute »

Tienes que intentar que el ordenador o el router de una ip al deco por dhcp.
En mi caso lo hace el router, dando una ip al ordenador (192.168.1.2) y otra al deco (192.168.1.3).
Esto lo puedes ver en el menu secreto del router, en la configuracion del Network.
Pero vamos mas sencillo es hacer un Telnet 192.168.1.3 y te respondera con Login: si esta todo correcto.
haute
Junior Member
Posts: 80
Joined: Mon Jan 09, 2006 9:31 am

Post by haute »

Here are the commands for a telnet session of dvi3000
Aqui estan los comandos para la conexion telnet con el dvi3000

Espero que report?is vuestros avances con ello.
I hope that you report your advances with it.

****************************************************
Comandos Telnet para el Decoder DVI3000 de Motorola.
****************************************************

Conexion por telnet:telnet (ip_decoder)
Login: agentsmith101
Password: v612qaY=dc7@42

Antes de nada activaremos el Modo supervisor con el comando 'enable'.

DVi>enable

Nos pedira un password.
Password: Serp@e:2RdF!SH
Despues podemos ver la lista de comandos con '?'.

DVi>?

show --Show system information
set --Set system parameter
clear --Clear system parameters and logs
enable --Enable supervisor mode
exit --Terminate connection
video --Video Diagnostics

Cada comando de estos tiene subcomandos que podremos ver poniendo una '?' despues de cada comando.

DVi>show ?

summary --Settop summary status
version --Software version information
currchan --Current channel information
cainfo --Conditional Access information
mcprov --MediaCipher provisioning information
firmware --Factory programmed firmware data
general --General configuration information
time --Time information
ib --Inband signal status
ibconfig --Inabnd configuration
oob --Out-of-band signal status
oobconfig --Out-of-band configuration
tcpip --Settop TCP/IP configuration
cmstatus --Cable Modem status
cmtcpip --Cable Modem TCP/IP configuration
downstream --Cable Modem downstream signal status
upstream --Cable Modem upstream signal status
usbdevice --USB Device list
starvue --StarVue configuration
syserror --SysError log
eventlog --Event log
exception --Exception log
dbgzone --Debug Zone settings
memdbg --Memory Debug settings
avstatus --Audio and Video status

Ejemplos: DVi>show version
DVi>show tcpip

DVi>set ?

dbgzone --Set Debug Zone


DVi>clear ?

syserror --Clear SysError log
eventlog --Clear Event log
exception --Clear Exception log
dbgzone --Clear Debug Zone


DVi>enable ?


Already in Supervisor mode


DVI>exit ? --Terminate connection



DVi>video ?

status --Read Video data and write to NVM
restart --Restart Video decoder
dumplog --Dump logged video data in NVM
clearlog --Clear logged video data in NVM
dumpraw --Dump Raw video log data in NVM
elkora
Junior Member
Posts: 245
Joined: Wed Jan 03, 2007 8:57 pm

Post by elkora »

simplemente genial haute espero sea el comienso de algo realmente fantastico para el testing... :shock:


Saludos.....
haute
Junior Member
Posts: 80
Joined: Mon Jan 09, 2006 9:31 am

Post by haute »

Somebody could help to find the checksum me of firmware of this BOX. Some idea of like looking for it or that type of checksum is?
I feel it, but I am not a good programmer.
thanks
usbbdm
Junior Member
Posts: 8962
Joined: Mon Jul 18, 2005 9:33 pm

Post by usbbdm »

I found the same table used to compute checksum for DCT2500 and DCT2000 is used in DVI3000. I will see if I can make it in ziptool or in a test.dll.
haute
Junior Member
Posts: 80
Joined: Mon Jan 09, 2006 9:31 am

Post by haute »

It is the great news, we do not know like thanking for the work to him that these making. This dvi3000 is a hard bone to nibble. A greeting.
andornot
Junior Member
Posts: 32
Joined: Wed Nov 01, 2006 7:34 am

Post by andornot »

haute, to be able to connect with telnet through router. direct with the PC I have still not obtained it. activate; Seth dbgzone 0, 1, 2 and when he activates zone 2, atravez of telnet me salia mensage taskmon: watchdog toggled. and when I made clear dbgzone 2 volvio to normal state.



haute, conseguir conectar con telnet atraves de un router. directo con el pc no lo he conseguido todavia.

active; set dbgzone 0 ,1, 2 y cuando active zone 2, atravez de telnet me salia
el mensage taskmon: watchdog toggled.
y cuando hice clear dbgzone 2 volvio a estado normal.
haute
Junior Member
Posts: 80
Joined: Mon Jan 09, 2006 9:31 am

Post by haute »

Si eso ya lo probe yo, pero realmente no funciona, osea no se desactiva el watchdog, o al menos a mi no me lo parecio, no se a que se refiere con eso.

El watchdog hay que desactivarlo por hardware.

Menos mal que hay alguien mas enredando con los comandos. A ver si damos con ello.

Saludos.
andornot
Junior Member
Posts: 32
Joined: Wed Nov 01, 2006 7:34 am

Post by andornot »

haute, te puedes poner en contacto, para intercambiar conocimientos
[email protected]
lobomalo70
Junior Member
Posts: 4
Joined: Mon Jan 15, 2007 12:42 am

Post by lobomalo70 »

Hola a tod@s, yo tambien ando investigando en esto, desentra?ando el dump de la flahs me he encontrado aon otro login:

login: motonet
pass: 6408D+mot*9

he estado haciendo pruebas pero nada de nada, a ver si entre todos le damos utilidad a este pass, igual no sirve para nada que igual sirve para activar el cm del deco.
haute
Junior Member
Posts: 80
Joined: Mon Jan 09, 2006 9:31 am

Post by haute »

Hola, podrias especificar en que offset del firmware esta este login y pass y de que version de firmware se trata?
Porque he buscado por todo el firmware y no veo nada parecido.
lobomalo70
Junior Member
Posts: 4
Joined: Mon Jan 15, 2007 12:42 am

Post by lobomalo70 »

Esta en la direccion 003B8530h, abierto el archivo .hex o el sin extension con el ultraedit-32.

Un saludo
Locked

Who is online

Users browsing this forum: No registered users and 9 guests