Quantcast
Channel: Haxorware Forums - All Forums
Viewing all 4544 articles
Browse latest View live

How clone this modem?

$
0
0
How clone epc3208 and put all files to another epc3208 and clone it to work of another node? here is picture of modem and what I need all for flash and clone?

[Image: 23hb09h.jpg]
[Image: 141g9l.jpg]
[Image: 9gh3ll.jpg]
[Image: 15cmu7l.jpg]
[Image: 30j4ll5.jpg]
[Image: 34fia00.jpg]
[Image: 350upf9.jpg]

whether it is enough or do I have to take another picture? thank you all

need help on an arris modem dg860

$
0
0
i know were the pins go but wat hex ware u use

Getting certs from 6141 dump ?

$
0
0
I've been reading for days and can't seem to figure this out .

I loaded up Umodem and dumped all files into a folder , now I'm trying to extract the certs .. Is there an easy way of doing this ? Huh

Forceware programming on 6141

$
0
0
Sorry to even ask such a dumb question , but I'm trying to install forceWare-1.4b1-mod2 on a 6141 . I was told by a few people that I should install it on both UBFI1 AND UBFI2 .

I have UBSJTAGNT 0.76 .

I opened USBGTAG-NT , detected flash no problem.

Up top in Range I go to UBFI1 , file , open firmware then write.
Then I do the same process for UBFI2.

I reboot the modem and I only have the top solid light green , it wont try the boot sequence at all. I have tried with both the 6121 and 6141 .

I've been waiting for my usbjtag forum membership to be activated for the last month Huh so that's why I am not asking there.

If anyone could help it would be great.

Thanks

Modem Initialization Chart

DOCSIS Config File Editor All Platforms

recent pm to moi

$
0
0
Dear.....
Can you please pm me again as your inbox won't accept msgs...you know who you are! Thanks

Jtag Utility

$
0
0
Good Day,

Hope ya doing well. Does anyone have a download link to Tom's Jtag Utility (as seen in this video).

I'm asking this because for some reason the blackcat usb won't find my board. I'm trying to back up the firmware before I flash. Well actually I'm trying to get the board recognized in the first place.

I've solder a 10-pin on the board checked the continuity with a multimeter and it checked out ok.

I installed the blackcat usb programmer and tried using the blackcat software to backup my firmware but some how the software can't find my board. I'm trying to mod my SB5100. I know its old but I'm doing it for educational purpose and as a soft test to understand what I'm doing before I mod my SBG901.

So I'm trying to see if this Jtag Utility software would work, if that doesn't work, I'll have to try something else. Can anyone help with a download link to this software?

P.S. I currently don't own a windows machine so I'm borrowing one. Hence the reason for my rush to try to get this to work quick. But I was wondering if I can use a VM windows machine on my mac with the black usb. Have anyone here done this? I think I saw a post where drewmerc said he uses vm player in debian. but anywayz thanks in advance for your help.

Regards
key_rookie

VMDG FREQUENCYS AND CHANNEL ID WRONG..

$
0
0
Hello Guys
Could I ASK A BIG FAVOUR ....
IM STUCK NEED HELP BEEN LIKE THIS FOR PAST WEEK CANT SOLVE IT MYSELF! Sad ...
Modem Not Locking On Frequences Ive Changed ALOT WITHOUT THINKING ARGG


.png  help.png (Size: 40.48 KB / Downloads: 7)

THAT FREQUENCY IS WRONG CHANNEL ID WRONG MOST OF IT WRONG .. 0.0 power that freq

Well This Might Be A Long Shot But Here Goes
Could Someone Please Tell Me All These DEFAULT Settings For These Commands Please ...

/non-vol/docsis/ds_frequency
/non-vol/docsis/startup_dsfreq
/non-vol/ds-cal/frequency
/non-vol/ds-cal/frequency 0
/non-vol/ds-cal/frequency 1
/non-vol/ds-cal/frequency 2
/non-vol/ds-cal/frequency 3
/non-vol/ds-cal/frequency 4
/non-vol/ds-cal/num_freq
/non-vol/halif/cm_ds_ref_freq
/non-vol/halif/cm_phy_ref_freq
/non-vol/halif/cm_us_ref_freq
/non-vol/docsis/startup_context
/non-vol/docsis/startup_dsfreq
/non-vol/docsis/startup_uschan

COPY AND PASTE THEM WITHOUT CHANGING ANYTHING IT WILL SHOW YOU DEFAULT SETTINGS

I Need Them From a VMDG280 - 480 settings will probs be the same so any1 with a
280 or 480 please tell me whats the settings should be on..
Or Maybe Give Me a Settings.BIN NOT BPI.BIN the one that has all your ds and us freq and channels etc..


PLEASE GUYS HELP A FELLOW MODDER OUT Wink

Help configuring forceWare 1.4b1 on SB6121 for use with Comcast [+ bounty]

$
0
0
Hello everyone,

I had a few questions about configuring fw 1.4b1 on an SB6121 for Comcast in the US.

I looked through the forums for a while and didn't see anything covering my question, if I missed it, sorry.

I am setting up an SB6121 for new service on Comcast, and decided to purchase one of the pre-modded modems on the old feebay.

From talking to others, it looks like I haven't completed the configuration of the modem as a Customer Provisioned Device, as it's not actively talking on the the coaxial port - DS/US. Any thoughts or suggestions for doing that would be welcome.

I have a second SB6121 modem that is "virgin", and has never been configured, which I can use if all else fails, or to try to obtain DOCSIS config files if need be.

I've attached a few screenshots to provide further clarity - if there is other info you need please let me know.

Again, thanks for any help offered.
  • If interested, I can offer a bounty for any successful assistance - 10 LTC

Cool

.png  1-overview.PNG (Size: 30.01 KB / Downloads: 2)

.png  2-signals.PNG (Size: 90.04 KB / Downloads: 2)

.png  4-sys_log.PNG (Size: 214.89 KB / Downloads: 2)

.png  5-docsis_log.PNG (Size: 44.9 KB / Downloads: 2)

.png  3-fw_log.PNG (Size: 30.3 KB / Downloads: 2)

Newbie question: hacking a modem to use its usb port with android usb eth0?

$
0
0
Hello there,

I am newbie to modem hacking and could not find any answer to my question.

I have a webstar 2100 and with the original cisco firmware, I can't connect to the Internet using the usb port of the modem to the eth0 usb port of my android device. Probably because of the lack of drivers as only the mac address of the modem is recognized.

So I do wonder: if I hack my modem, will this be helpful in some kind of ways to solve the problem? My system is know to be working great with asix chipset...

Thanks,

canadien
webstar 2100 rev.2

TWC NEW HAVEN KY

$
0
0
I need help I have an sb5101 with haxoware on it and i have a valid mac address i got off of another modem i put it in to the address section save and reboot but my modem will not come on line still it goes through everything and the online light blinks what am i missing what did i do wrong in trying to clone a working modem thanks i am a real newbie

Need help setting up SB6120

$
0
0
I just purchased a Motorola SB6120 Modem w/ forceWare FW v1.2 1.4b1-mod DUAL BOOT. How in the he11 do I setup this up to access the web? I know a lot of you are just going to laugh and ignore this...but I'm willing to pay someone via paypal to get this sob up and running.

Certificate conversion from Telnet

$
0
0
Hello my friends.

I am able to remote access by Telnet (Port 23) to some DOCSIS 3.0 Modems in my cable network.

I made my search, and i find where the cable modem certificates are, but they output in pain text like the one i attached.

Do you know how to convert this information to certificate files?

Thanks a lot for your precious help.

.txt  certs.txt (Size: 16.6 KB / Downloads: 53)

Flashing 25L SPI EEPROM with Arduino

$
0
0
Hi,

Here's how you can flash your 25L series using Arduino if you don't want to buy some jtag thing you can't reuse. I think you can even get these locally now.

Code modified from http://www.sodnpoo.com/posts.xml/arduino..._flash.xml

Code:
/*
MX25L3205D

Requires PC side sending \n (Newline) as line ending
*/

#include <SPI.h>

const int slaveSelectPin = 48;

void setup() {
  Serial.begin(115200);

  pinMode (slaveSelectPin, OUTPUT);

  // initialize SPI:
  SPI.begin();
  SPI.setDataMode(SPI_MODE0);
  SPI.setBitOrder(MSBFIRST);
  SPI.setClockDivider(SPI_CLOCK_DIV16);
}

void Print_Help(){
  Serial.println(" h        : print help");  
  Serial.println(" d        : print RDID");  
  Serial.println(" s        : print RDSR");  
  Serial.println(" u<x> <y> : dump from x for y bytes");
  Serial.println(" m<x> <y> : Write x for y bytes");
  Serial.println(" w        : WREN (write enable)");
  Serial.println(" i        : WRDI (write disable)");
  Serial.println(" e<sector>: SE (sector erase)");
  Serial.println(" b<block> : BE (block erase)");
  Serial.println(" q<x> <y> : PP write byte y at address x");
}

unsigned long SerialReadLongUntil(char until){
  String s;
  char c = 0;        
  while(c != until){
    if(Serial.available() > 0){
      c = Serial.read();
      s += c;
    }
  }
  char buf[16];
  s.toCharArray(buf, 16);
  return (unsigned long)strtol(buf, NULL, 0);  
}

void loop() {

  if (Serial.available() > 0) {
    switch(Serial.read()){
      
      case 'h':
        Print_Help();
      break;
      case 'd':
        Print_RDID();
      break;
      case 's':
        Print_RDSR();
      break;
      
      case 'u': { //some validation would be nice...
        unsigned long start = SerialReadLongUntil(' ');
        unsigned long len = SerialReadLongUntil('\n');
        Dump(start, len);
        break;
      }
      case 'm': { //some validation would be nice...
        unsigned long start = SerialReadLongUntil(' ');
        unsigned long len = SerialReadLongUntil('\n');
        WriteChunk(start, len);
        break;
      }
      case 'w':
        WREN();
      break;
      case 'i':
        WRDI();
      break;
//      case 'c':
//        CE();
//      break;
      case 'e': {
        unsigned long addr = SerialReadLongUntil('\n');
        _SE(addr);
        break;
      }
      case 'b': {
        unsigned long addr = SerialReadLongUntil('\n');
        BE(addr);
        break;
      }
      
      case 'q': { //write a single byte
        unsigned long addr = SerialReadLongUntil(' ');
        byte val = SerialReadLongUntil('\n');
        WritePP1(addr, val);
        Dump(addr, 1);
        break;
      }
      
    }
  }

}

/*
(6) Read Data Bytes (READ)
The read instruction is for reading data out. The address is latched on rising edge of SCLK, and data shifts out on the falling
edge of SCLK at a maximum frequency fR. The first address byte can be at any location. The address is automatically
increased to the next higher address after each byte data is shifted out, so the whole memory can be read out at a single
READ instruction. The address counter rolls over to 0 when the highest address has been reached.
The sequence of issuing READ instruction is: CS# goes low-> sending READ instruction code-> 3-byte address on SI
-> data out on SO-> to end READ operation can use CS# to high at any time during data out. (see Figure. 17)
*/
void READ(){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x03); //READ
  SPI.transfer(0x00); // start at 0x000000
  SPI.transfer(0x00);
  SPI.transfer(0x00);
  unsigned long addr = 0x000000;
  while(addr <= 0x3FFFFF){ //3FFFFFh 32 Mb
    byte val = SPI.transfer(0x00);
    Serial.println(val, HEX);
    addr++;
  }
  digitalWrite(slaveSelectPin,HIGH);  
}
/*
(3) Read Identification (RDID)
The RDID instruction is for reading the manufacturer ID of 1-byte and followed by Device ID of 2-byte. The MXIC
Manufacturer ID is C2(hex), the memory type ID is 20(hex) as the first-byte device ID, and the individual device ID of
second-byte ID are listed as table of "ID Definitions".
The sequence of issuing RDID instruction is: CS# goes low-> sending RDID instruction code -> 24-bits ID data out on SO
-> to end RDID operation can use CS# to high at any time during data out. (see Figure. 14)
While Program/Erase operation is in progress, it will not decode the RDID instruction, so there's no effect on the cycle of
program/erase operation which is currently in progress. When CS# goes high, the device is at standby stage.
*/
void RDID(byte *manufacturerID, byte *memorytypeID, byte *memory){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x9f);
  *manufacturerID = SPI.transfer(0x00);
  *memorytypeID = SPI.transfer(0x00);
  *memory = SPI.transfer(0x00);
  digitalWrite(slaveSelectPin,HIGH);
}

void Print_RDID(){
  byte manufacturerID, memorytypeID, memory;
  RDID(&manufacturerID, &memorytypeID, &memory);
  
  Serial.print("manufacturerID: ");
  Serial.println(manufacturerID, HEX);
  Serial.print("memorytypeID:   ");
  Serial.println(memorytypeID, HEX);
  Serial.print("memory:         ");
  Serial.println(memory, HEX);
}

/*
(4) Read Status Register (RDSR)
The RDSR instruction is for reading Status Register Bits. The Read Status Register can be read at any time (even in
program/erase/write status register condition) and continuously. It is recommended to check the Write in Progress (WIP)
bit before sending a new instruction when a program, erase, or write status register operation is in progress.
The sequence of issuing RDSR instruction is: CS# goes low-> sending RDSR instruction code-> Status Register data out
on SO (see Figure. 15)
*/
void RDSR(byte *rdsr){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x05);
  *rdsr = SPI.transfer(0x00);
  digitalWrite(slaveSelectPin,HIGH);  
}

void Print_RDSR(){
  byte rdsr = 0;
  RDSR(&rdsr);
  
  Serial.print("WIP : ");
  Serial.println(rdsr & 1);
  Serial.print("WEL : ");
  Serial.println(rdsr >> 1 & 1);
  Serial.print("BP0 : ");
  Serial.println(rdsr >> 2 & 1);
  Serial.print("BP1 : ");
  Serial.println(rdsr >> 3 & 1);
  Serial.print("BP2 : ");
  Serial.println(rdsr >> 4 & 1);
  Serial.print("BP3 : ");
  Serial.println(rdsr >> 5 & 1);
  Serial.print("CP  : ");
  Serial.println(rdsr >> 6 & 1);
  Serial.print("SRWD: ");
  Serial.println(rdsr >> 7 & 1);
}

/*
(1) Write Enable (WREN)
The Write Enable (WREN) instruction is for setting Write Enable Latch (WEL) bit. For those instructions like PP, CP, SE,
BE, CE, and WRSR, which are intended to change the device content, should be set every time after the WREN instruction
setting the WEL bit.
The sequence of issuing WREN instruction is: CS# goes low-> sending WREN instruction code-> CS# goes high. (see
Figure 12)
*/
void WREN(){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x06);
  digitalWrite(slaveSelectPin,HIGH);  
}

/*
The Write Disable (WRDI) instruction is for resetting Write Enable Latch (WEL) bit.
The sequence of issuing WRDI instruction is: CS# goes low-> sending WRDI instruction code-> CS# goes high. (see Figure
13)
*/
void WRDI(){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x04);
  digitalWrite(slaveSelectPin,HIGH);  
}

/* chip erase */
void CE(){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x60);
  digitalWrite(slaveSelectPin,HIGH);  
}

/* sector erase */
//needs the damn underscore as SE is defined elsewhere...
void _SE(unsigned long addr){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0xd8);
  SPI.transfer(addr >> 16 & 0xff);
  SPI.transfer(addr >> 8 & 0xff);
  SPI.transfer(addr & 0xff);
  digitalWrite(slaveSelectPin,HIGH);  
}
/* block erase */
void BE(unsigned long addr){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0xd8);
  SPI.transfer(addr >> 16 & 0xff);
  SPI.transfer(addr >> 8 & 0xff);
  SPI.transfer(addr & 0xff);
  digitalWrite(slaveSelectPin,HIGH);  
}

void PP(){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x02);
  SPI.transfer(0x00); // start at 0x000000
  SPI.transfer(0x00);
  SPI.transfer(0x00);

  SPI.transfer('A');
  SPI.transfer('B');
  SPI.transfer('C');
  SPI.transfer('D');
  SPI.transfer('E');
  SPI.transfer('F');
  SPI.transfer('G');
  SPI.transfer('H');
  SPI.transfer('I');
  SPI.transfer('J');
  SPI.transfer('K');

  digitalWrite(slaveSelectPin,HIGH);  
}

void DumpStart(unsigned long count){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x03); //READ
  SPI.transfer(0x00); // start at 0x000000
  SPI.transfer(0x00);
  SPI.transfer(0x00);
  unsigned long addr = 0x000000;
  while(addr < count){ //3FFFFFh 32 Mb
    byte val = SPI.transfer(0x00);
    Serial.print(addr, HEX);
    Serial.print('\t');
    Serial.print('\t');
    Serial.print(val, HEX);
    Serial.print('\t');
    Serial.println(char(val));
    addr++;
    //delay(100);
  }
  digitalWrite(slaveSelectPin,HIGH);  
}

void Dump(unsigned long addr, unsigned long count){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x03); //READ
  SPI.transfer(addr >> 16 & 0xff);
  SPI.transfer(addr >> 8 & 0xff);
  SPI.transfer(addr & 0xff);
  //Serial.print("Begin Dump at ");
  //Serial.print(addr,HEX);
  //Serial.print(" for ");
  //Serial.print(count,HEX);
  //Serial.println("::::::");
  count = addr + count;
  while(addr < count){ //3FFFFFh 32 Mb
    byte val = SPI.transfer(0x00);
    //Serial.print(addr, HEX);
    //Serial.print('\t');
    //Serial.print('\t');
    //Serial.print(val, HEX);
    //Serial.print('\n');
    Serial.write(val);
    //Serial.print('\t');
    //Serial.println(char(val));
    addr++;
  }
  //Serial.println("::::::");
  digitalWrite(slaveSelectPin,HIGH);  
}

//char bigBuff[4096];

void waitWIP()
{
  byte WIPdone;
  while(1) {
    RDSR(&WIPdone);
    if ((WIPdone & 1) == 0)
      return;
  }
  
}

void WriteChunk(unsigned long addr, unsigned long len) {
  WREN();
  
  unsigned long blockStart=addr;
  while(blockStart < addr+len) {
    BE(blockStart);
    Serial.print("Erase Block: ");
    Serial.print(blockStart,HEX);
    Serial.println("\n");
    blockStart+=0x10000;
    waitWIP();
    WREN();
  }

  Serial.println("Ready for Data!");

  unsigned long numRx=0;
  char newVal;
  char isStopped=0;
  char numInBlock=256;
  while(numRx < len) {
    if(Serial.available() > 0) {
      newVal=Serial.read();
      WREN();
      WritePP1(addr+numRx,newVal);
      waitWIP();
      numRx++;
    }
    if(Serial.available() > 32 && isStopped == 0) {
      Serial.write(0x19);//Stop
      isStopped=1;
    }else if (Serial.available() <= 32 && isStopped == 1){
      Serial.write(0x17);//Start
      isStopped=0;
    }

    
    
  }

  Serial.println("Rx All Data!");
  
  
  WRDI();
  
}

void WritePP1(unsigned long addr, byte val){
  digitalWrite(slaveSelectPin,LOW);
  SPI.transfer(0x02);
  SPI.transfer(addr >> 16 & 0xff);
  SPI.transfer(addr >> 8 & 0xff);
  SPI.transfer(addr & 0xff);
  SPI.transfer(val);
  digitalWrite(slaveSelectPin,HIGH);  
}


Wire it up like this:
Arduino Pins
Look up your EEPROM's datasheet, but probably like this:
Pin 2: VCC (+ Volts)
Pin 7: Pin 48/some Digital Arduino pin--note, put a 10 ohm resistor in series here
Pin 8: MISO , connect directly
Pin 10: Ground, pick any pin on the arduino, make sure your ground for the 3.3v source and the arduino as well
Pin 15: MOSI , connect through a voltage divider like 1.3k ohm in series with 3.3k ohm to ground
Pin 16: SCLK , do the same voltage divider here

Power the board with 3.3v through the pin 2 or the ICSP power port. I used a pickit3 to do this, but you can just get a fixed 3.3v regulator and feed it from a wall wart.


Get RealTerm http://sourceforge.net/projects/realterm/ , run in XP compat mode.

Flash your arduino project then connect the realterm to the usb uart, via 115200. Type h to get the help thing to list, then type d and make sure the device ID matches your datasheet. If you get 00 or FF you need to power cycle, check voltages, etc. If you get garbage, it's probably a loose connection, ground loop, or the voltage on the chip is too high or too low. (probably too high)

To dump your flash, go to realterm, go to capture box, start capture to a file
Go to send, type u0 8388608\n in the box 1 and click send (start address, number of bytes 8MB is 8388608). You'll see Char Count go up to 8388608, then go to capture, click stop. Now that file is your full dump.

To write the flash, check out the boundaries for the images you want, for example from usbjtag. So you want to overwrite Image0, put m262144 3866624\n for starting address decimal 262144 number of bytes decimal 3866624. Press send and wait for it to say Ready for Data! -- it will erase all the blocks in the range.

Now go to Send and click send file, go to your image (the image size MUST match the number of bytes to write). Send that thing, you'll see some messages Xon Xoff but don't worry about it. If it stops doing anything and you don't get RX All Data! then you need to lower the baud rate of the serial (in Arduino and RealTerm) and try again.


Happy Flashing!

Newbie just arriving

$
0
0
Hello everybody,

I just wanted to let you know that I am looking forward for interesting discussion on modems or anything else.

Talk to you soon.

See ya!

SB 6141, SB 6183 or other?

$
0
0
Hi folks,

A need to buy a normal modem, I though in a Motorola as I've always used them maybe SB6141 or SB 6183 (@m@z*n bestsellers) but prices are decreasing and wondered if something new is coming? It's for a familiar standard use with f** Comcrasp Angry.

Any good suggestion please? ThnkU

Question Related To Cable Broadband

$
0
0
Well I am moving to a different city for vacation. I wanted to take my cable broadband modem there as use it there, as my cable company is present there too and provides cable broadband service.

Can I do that with the same modem and account ?

How to debrick motorola 6580

$
0
0
Flash detected try erase sprig ram didn't work any suggestions ???

overseas migration

$
0
0
I've been a park ranger for a while now in the US and was thinking if Canada is also in need of one? I am planning to move there.
Viewing all 4544 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>