Título: Livebox 6+ Arcadyan ERV33AX349B-LT ¿Es posible el acceso root del router? Publicado por: jouhrocha en 2 Mayo 2023, 05:17 am ¡Hola a todos!
Necesito vuestra ayuda. Como muchos sabréis, el router Livebox 6+ de Orange creado por Arcadyan en concreto el modelo es el ERV33AX349B-LT es uno de los más limitados de la historia. Incluso los registros están capados, lo que es una violación de la privacidad del usuario. La empresa Orange, que distribuye el dispositivo, no me ha proporcionado ningún dato para acceder a mi dispositivo. He intentado todas las vías que he encontrado en línea, pero me faltan conocimientos para recuperar los registros de mi router y por eso acudo a los grandes hackers que tenemos aquí y espero que me ayudeis a recuperar lo que es mio y de privacidad... He probado a soldar los pines UART en la placa para conectar el dispositivo a través de un USB-TTL y comprobando los voltajes para saber cual pin era el TX, RX Y GND finalmente conseguí ver en consola el puerto serial COMX, sin embargo, resultó ser el inicio de algún tipo memoria RAM o similar del sistema embebido, lo que me impide conseguir una shell por conexión serial y tira al traste esa vía o almenos esos pines por los que intenté acceder. Al final del post os pegare todo lo que consigo ver en el inicio del router a través de esta consola junto con los datos técnicos que he conseguido obtener del router. Mis preguntas son, dadas las circunstancias, las siguientes:
Agradezco cualquier ayuda que podáis proporcionar. ¡Gracias de antemano! Datos técnicos router PLACA P/N: 14133AX20016J R02
FOTOS DEL ROUTER: (https://bandaancha.eu/s/1myr/mn/router-1.jpg) (https://bandaancha.eu/s/1myp/18g/router-1.jpg) (https://bandaancha.eu/s/1myt/wj/router-2.jpg) (https://bandaancha.eu/s/1myv/xc/router-3.jpg) (https://bandaancha.eu/s/1myx/18g/router-4.jpg) (https://bandaancha.eu/s/1myz/xc/router-5.jpg) (https://bandaancha.eu/s/1mz1/xc/router-6.jpg) (https://bandaancha.eu/s/1mz5/99/router-8.jpg) (https://bandaancha.eu/s/1mz6/h1/router-9.jpg) Inicio de sesión en el puerto Serial UART PS C:\Users\?????\Desktop\router> python route.py ---- BTRM V1.0 R1.0 L1CD MMUI MMU9 DATA ZBBS MAIN OTP? REF? REFP RTF? RTFP OTPP FSBT NAND IMG? IMGL UHD? UHDP RLO? RLOP AHD? ROT? ROTA MID? MIDP AHDP SBI? SBIA SID? SIDP PASS ---- HELO 5.0207p1-1.0.38-163.243 CPU0 L1CD MMUI MMUC ZBBS MAIN XEND MemsysInit hpg0_generic_aarch64 3.5.1.1 20171009 DDR3 8262E7E8 80180000 801A0000 00000000 00000000 0020476E MCB rev=0x00000501 Ref ID=0x0476E Sub Bld=0x002 Dram Timing 11-11-11 Add/Ctl Alignment Coarse Adj=0x087 deg, cmd steps=0x0CA reg 0x801A0090 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A0094 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A0098 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A009C set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00A0 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00A4 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00A8 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00AC set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00B0 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00B4 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00B8 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00BC set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00C0 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00C4 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00C8 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00CC set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00D0 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00D4 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00D8 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00DC set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00E0 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00E4 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00E8 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00EC set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00F0 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00F4 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00F8 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A00FC set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A0100 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A0108 set to VDL 0x04D with Fine Adj=0x01 deg reg 0x801A010C set to VDL 0x04D with Fine Adj=0x01 deg HP RX TRIM itrim = 0x0 lstrim = 0x9 ZQ Cal HP PHY R in Ohm P: Finger=0x348 Term=0x78 Drv=0x28 N: Finger=0x300 Term=0x80 Drv=0x28 PLL Ref(Hz)=0x02FAF080 UI STEPS=0x065 DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x1849 CLK_VDL=0x020 SHMOO 28nm 801A0000 80180800 00000000 00020000 00000000 Shmoo WL One UI Steps : 0x72 auto-clk result = 00B (filter=0C steps) initial CLK shift = 020 final CLK shift = 00B 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111 000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 00 S-----------------------X----------------------------------------------------------------------------------------- 01 S------------------X---------------------------------------------------------------------------------------------- Shmoo RD En FORCED WR ODT = 0x00001800 DQSN DRIVE PAD CONTROL (from) (to) B0 00039AB3 00079AB3 B1 00039AB3 00079AB3 B0 RISE UI=1 VDL=20 PICK UI=2 VDL=20 B1 RISE UI=1 VDL=28 PICK UI=2 VDL=28 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111 000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 00 --S-----------------------------X+++++++++++++++------------------------------------------------------------------ 01 --S-------------------------------------X+++++++++++++++---------------------------------------------------------- Shmoo RD DQ NP DQS : B0 VDL=65 ok B1 VDL=65 ok 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111 000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 00 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++-------- 01 -------------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------- 02 ----------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++---------- 03 ---------------++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++------------- 04 ---------------------+++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++---------- 05 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++-------- 06 ------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++--------- 07 ----------------+++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++-------------- 08 ---------------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++-------- 09 -----------------------+++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++-------- 10 --------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++------- 11 ------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------ 12 ---------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++------ 13 --------------------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++----- 14 ---------------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++-------- 15 ---------------------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++---- Shmoo RD DQ P 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111 000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 00 ------------++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++-------- 01 ------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------- 02 ---------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++---------- 03 -------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------ 04 ------------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++--------- 05 -----------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------- 06 -------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++--------- 07 -------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------ 08 ---------------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++-------- 09 ---------------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++-------- 10 ------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------- 11 ------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------ 12 -----------+++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++---- 13 ------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------ 14 ----------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++------ 15 ------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++---- Shmoo RD DQ N 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111 000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 00 ------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------ 01 -------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++----- 02 -----------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++--------- 03 ----------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++------------- 04 --------------------+++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++---------- 05 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++-------- 06 -------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++-------- 07 ----------------+++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++-------------- 08 ----------------------++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++------- 09 -----------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++---- 10 --------------------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------ 11 ------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------ 12 ---------------------+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++------ 13 --------------------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++----- 14 --------------------++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++-------- 15 ---------------------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++--- RD DQS adjustments : BL0: Start: 0x65 Final: 0x65 BL1: Start: 0x65 Final: 0x65 Shmoo WR DQ 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111 000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 00 -------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++----------------- 01 --------++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++---------------- 02 -------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------------------ 03 --+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++--------------------- 04 ---------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++----------------- 05 -------+++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------------------- 06 -----++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------------------- 07 -----+++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++---------------------- 08 ---------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++---------------- 09 ---------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++-------------- 10 -------++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++------------------ 11 ------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++--------------- 12 --------+++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++-------------- 13 --------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++--------------- 14 -------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++-------------- 15 ----------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++------------- Shmoo WR DM WR DM 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111 000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111 012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 00 -----++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------------ 01 --------++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------ DERV RIPF FPS0 UBIF ---- PAR1 U:01 COM0 UBI# 03E9 BT01 0004 ---- PAR2 U:00 COM0 UBI# 03E8 BT00 0004 ---- TRY1 NAN3 UBI! BTLR ATH? PASS DECP NAN5 XEND CPU1 Fuentes de información: wrongbaud.github.io/posts/jtag-hdd |