Whirlpool

Hi, ive just connected to 02 and recieved the above router. I know you must be sick and tired of hearing this but can anyone tell me how i could change the super user account. I have the password and username but dont know what to do with it. Ive tried to run setup while router is under kernal but all the versions i have downloaded come up as no compatable.

Any Help would be very grateful

Kind Regards

v1xz writes...

but can anyone tell me how i could change the super user account.

I don't know why you would need to change the superuser account. If you have the username and password for it then you don't need to change it. If you don't have them you cannot.
And I don't think it will help you get past the locked firmware.

Look at Alex Kemp's posts. He is now the eggs spurt in this area.

Did you read this thread.
forum-replies.cfm?t=889382
That is as far as we have got.

Hello RPM, fellow group members,

I've recently baught a new O2 Wireless Router (st780wl) on ebay (for less than 12 dollars !). I'm currently living in Canada.

I'm sure it needs to be reflashed before I can use it here (I've not been able to turn it on yet ! As the accompanying power adapter was UK type (230v only) ).

I have experience in low-level windows programming, hardware, and firmware (mostly PIC and ARM). Realizing your precious work on earlier versions of ST Routers, I appreciate if you kindly answer my questions below.

1. If BOOTP is not disabled on O2 (or any other locked) router, it is theoretically possible to read the image without any jtag. We can simply put a FW that reads the flash and sends it to PC (with whatever method). Is that correct ?

2. Instead of overwriting the O2 bootloader (which needs an unlocked image from another similar router), I can modify the newest ST firmware so that O2 bootloader accepts it, and again no need to jtag. Am I right ?

3. Is there any Firmware Upgrade Software from O2 ? (I know that this is not the right forum to ask, but thought maybe somebody knows).

4. Is there any Firmware Image from an unlocked ST780WL (that includes the bootloader) ?

5. I have a PIC and also an ARM jtag debugger/programmer. I don't think that they are compatible with MIPS32. Am I correct ?

Moreover, everybody, please share all the information that you think is relevant. I'm planning to upgrade this router to the latest unlocked version, if I can do that I'll definitely share it with everyone.

Thank you very much in advance,

z25814 writes...

1. If BOOTP is not disabled on O2 (or any other locked) router, it is theoretically possible to read the image without any jtag. We can simply put a FW that reads the flash and sends it to PC (with whatever method). Is that correct ?

It isn't disabled. What will happen is the speedtouch will look for an ip from a bootp server. Then it will expect a firmware to be uploaded to it via tftp, loaded into ram and expanded or decompressed. Once the firmware gets there it is checked by the bootloader?? for the correct crc etc. Discovering it is wrong, due to the locked system it will simply wipe the firmware from RAM and never loads it.
At least that is my understanding.

Here is the sequence via the serial port.
Unzipping started
UNZIP DONE -> starting bootloader
Speedtouch initialization sequence started.
BOOTP reason : BLFLAG_SWSTART_FAIL
phy_bcm6348.c - ETHD: internal phy is used

Because I touch a key during boot (or if you power down before the boot is completed) the speedtouch automatically goes into bootp mode.

Since I couldn’t get it to work I used UPDATEST.exe to do the update. Following output during update.

Ctrl: BOOTP initiated.
Ctrl: BOOTP Reply received!
***** Own IP = 192.168.1.11 (BANT-J)
***** Server = 192.168.1.10 (ray)
***** Mask = 255.255.255.0
***** Filename = D:/downloads/ROUTER/alcatel/536/ZZ­ TXAA540E.bin
Ctrl: TFTP started (Rx:D:/downloads/ROUTER/alcatel/53­ 6/ZZTXAA540E.bin).
Ctrl: TFTP (SDRAM) finished (success).
*** New build received ***
[STARTADDRESS] : BFC40004
[BUILDLENGTH] : 3840 Kb
*** FlashProgram started, please be patient! ***
***3840Kb*** programmed
*** flashing finished --> rebooting modem ***
***Reseting the board***
Unzipping started
UNZIP DONE -> starting bootloader
Speedtouch initialization sequence started.
Secondary boot
Unzipping started
UNZIP DONE -> starting uncompressed file
Speedtouch initialization sequence started.
ÿ
[OSI2] File "/ZZTVAA5.40E": Format OSI2 compliant (offset=340, prodid="0", vari
d="0").
[SS] Device mounted (prodid="0", prodname="SpeedTouch 5x6", varid="0", varnam
e="").
[ıELF] Loading file "/ZZTVAA5.40E" ...
c
Speedtouch initialization sequence started.
For EMAC1 - select for single ethernet (single EMAC).
archfs opened /ZZTVAA5.40E offset 1369059
ADSL PHY version is A2pBT008_rc1_PPP1.d16f
ETH: Device registered: BCM6348-E#0.
ETH: Interface 0 assigned: BCM6348-E#0:0 [external].
ETH: Device registered: BCM5325#0.
ETH: Device registered: SBRIDGE#0.
ETH: Device registered: BCM6348-U#0.
ETH: Interface 1 assigned: BCM6348-U#0:0 [external].
--- REGISTERING STREAM : ROUTING ---
MFC routing init : alloc 31744 bytes.
--- REGISTERING CONNECTION : FW ---
--- REGISTERING CONNECTION : IDS ---
--- REGISTERING STREAM : LABEL ---
************* ERROR RECORD *************
time : 000000:00:00.000000
Application /ZZTVAA5.40E started after POWERON.
****************** END *****************
Username : Administrator
----------------------------------­ ----------------------------------­ ----
______ SpeedTouch 5x6
___/_____/\
/ /\ 5.4.0.14
_____/__ / \
_/ /\_____/___ \ Copyright (c) 1999-2005, THOMSON
// / \ /\ \
_______//_______/ \ / _\/______
/ / \ \ / / / /\
__/ / \ \ / / / / _\__
/ / / \_______\/ / / / / /\
/_/______/___________________/ /________/ /___/ \
\ \ \ ___________ \ \ \ \ \ /
\_\ \ / /\ \ \ \ \___\/
\ \/ / \ \ \ \ /
\_____/ / \ \ \________\/
/__________/ \ \ /
\ _____ \ /_____\/
\ / /\ \ /___\/
/____/ \ \ /
\ \ /___\/
\____\/
----------------------------------­ ----------------------------------­ ----
{Administrator}=>
At the end of the boot sequence, as per older speedtouch, the serial connection is a console for
cli. It requires password to get into.

Hello again,

Thanks for the fast reply !

I got that. The way you described, it looks like BOOTP is provided through the bootloader routine, and it is not a code being run from ROM (not flash). In the ARM world (that I'm most experienced with), there is a bootloader that is run from internal ROM of the processor (if certain conditions are met), then it's possible to program the internal flash, read, erase, ... By using this method, it is possible to program en empty chip even without a programmer (for example through USB or serial port, check AT91SAM7X family for example).

Bests,

z25814 writes...

it is theoretically possible to read the image without any jtag. We can simply put a FW that reads the flash and sends it to PC (with whatever method). Is that correct ?

If you say so. As far as I can see the thing has enough smarts to kill any firmware you upload because it doesn't meet whatever criteria it uses.

Why not use jtag. We now have some excellent help from cidi rome to do it and I have extracted cfe,nvram and kernel via jtag.
See forum-replies.cfm?t=8960...312093#r14312093
www.dslreports.com/forum...G-DeBrick-Access
They have descended into fighting about how to make jtag and if hacking is good.

The 780 might have also been sold as something else. Look at the BT modem info.
corz.org/comms/hardware/...ager.routers.php

Your problem is you need an unlocked one to swap the code. But perhaps you are smart enough to fix it with code from another one, like 585.

2. Instead of overwriting the O2 bootloader (which needs an unlocked image from another similar router), I can modify the newest ST firmware so that O2 bootloader accepts it, and again no need to jtag. Am I right ?

I am sure you are, if you know what the criteria is/are?? Sure as heck looks difficult to me.

4. Is there any Firmware Image from an unlocked ST780WL (that includes the bootloader) ?

No. It hasn't been looked at yet. Getting a hacked one is cheap. Getting a new, retail one is kinda expensive.

5. I have a PIC and also an ARM jtag debugger/programmer. I don't think that they are compatible with MIPS32. Am I correct ?

?? Some bits probably are, some aren't. In the speedtouch world cidi rome is the first and AFAIK only one to successfully do this.

Appeal for some nice hacker friendly person to build a jtag cable and get the firmware out of their 780. They don't sell them here and they are not legally allowed to be used. Not that it stops people doing what you have done and buying on ebay. The end result is they find they are locked and probably wonder what next.

Cheers

Hi RPM,

I just thought to give an update of my progress. I've managed to look into the images which were extracted using jtag (one was for an 585 and the other was a 516). The information look very promissing and I think I can reconstruct the exact algorithm that was used to compress/encrypt the FW Update files. I also have a few questions and appreciate if somebody could share that information with me:

1. Except those two images that I mentioned (585, 516), is there any other extracted image from either locked or unlocked rounter available ? (Preferrable 780, but all other versions even other 516s or 585s are welcome)

2. Is there a sample FW Upgrade file that is personalized for a locked FW (preferrably O2, but any other ISP is fine as well). By FW Upgrade file I mean an image that can be used in a successful upgrade process for a locked FW.

I'll update my progress every once in a while, but the problem is that I'm extremely busy these days (two deadlines in the next week, and one in a month), and my available time to spare is less than 1-2 hour a day, as a result it might take a while before an actual outcome.

Cheers,

z25814 writes...

1. Except those two images

Not to my knowledge!

2. Is there a sample FW Upgrade file

Not to my knowledge!

Send me a 780 and I will extract it for you.

I would say O2 can remotely manage the box. Although you might not be able to get in to the remote manage they may have it turned on permanently.

Are you able to save the configuration file to your pc. That might give you a hint.
Do you have access via the gui to the remote management to turn it on? If so, you might be able to get a friend to externally login and do something.
As I said we don't get locked ones in Australia so I have never had a chance to really study the way it is locked.

Hi again,

Thanks for the info. Please don't get me wrong. I don't have any problem using my own (commercial product and presumably safe) jtag (which as I checked can support MIPS). But as I said, I really don't think it is required.

Regarding your questions, to be honest with you, I've not found any time to go and buy a power adapter, so I've not even turned on the router yet ! What I did was checking the extracted images (specially the CFE part).

Bests,

z25814 writes...

buy a power adapter

Power adapter if it follows the new 536, 585 uses a large dc connector. 3.1mm which is available but far from standard. You will not find it easy to get one commercially made up that way. Also it uses 18V dc I believe as with all the latest equipment. That means a 22-24v dc supply will also work fine. 24v regulated dc supply should be easier to find. You don't want 24v unregulated as the voltage output will be too high. 24v is used for lots of things and should be readily available. Chop the wire off the existing plugpack and throw it away. Solder the old wire onto the new plugpack cable. You could do it nicely with an inline 2.5mm dc connector. To join together.

Hi RPM,

Thanks a lot for your info. I finally managed to find a suitable adapter for approximately the same price (14$) as what I paid for the router !

Can somebody please confirm the polarity on their adapter ? The hole in the middle is positive and the metal in the outside is negative ? This is probably more common, but strangely on the adapter that I've got it is reversed, so I just wanted to make sure.

Thanks in advance,

As it is AC, there is no polarity.

You can connect it regardless of DC power supply as the first component in the router's internal power supply is the diode bridge.

Best Regards

If the original box has an AC adapter it won't matter which way around it is. Look at the original plugpack. All the newer ones are 18v AC. Before that they were 15v AC, which should still work. AC doesn't have + and - fixed.

If the original is dc you must follow that exactly. Although it should be protected... you cannot trust that without opening it.

Hi again,

Thanks for the answer. Are you sure that the adapter is 18V AC ? I automatically assumed that it's a DC adapter (couldn't tell much from the uk adapter). Could you please confirm ?

I guess I should find another adapter.

Thanks,

Normally, for 516 and 585, here the adapter is AC 18V and differs one to another in the potency, one is 600mA and other is 1A and all are marked correctly on it's sticker.

On the tests I use one of 1A (ST585) for all.

Hi z25814...

The UK power supply I have with my 780WL is model no AA-181AD
input: 230V ~ 50 Hz 140mA
output: 18V ~ 1A

Does that help.

Cheers
Pete H

Hi everybody,

Thanks a lot for your comments, unfortunately I think you are all correct, I have to return the one that I baught and find an AC adapter.

BTW, now that it is an AC adapter, I have a 15V AC, 1A adapter, do you think that it works with ST780 ? The box clearly states that it should be 18V, but I noticed that you said the old versions were working with 15V adapters. Do you think it's safe to use the 15V AC adapter for a little while, before getting an 18V ? I guess, the worst thing that might happen would be the router not turning on.

Bests,

Probably you wont have any problem using that power adapter 15VAC.

But the other one you have 18VDC should not be enough because when you rectify 18VAC you will get more than 20VDC (don't know exactly maybe close to 25VDC), and that should be the needed value for a DC power supply.

Assuming you ST780WL has the same internal power as the ST585 supply it should be ok to use that 15VDC. Good luck.

Anyway if you backup your router's flash I would like to take a look on it. I'm collecting information about Speedtouch Routers and firmwares.
It will be a long shot, but I hope some day we can have personalized firmwares like the WR54G users have.

Best Regards.

Hi Cidi Rome,

Thanks for the info. I'll give it a try with the 15V adapter.

Regarding 18V-DC I have to disagree, it's been a long time since my college years, but as far as I remember, the 18V-AC can be rectified to 36/pi V-DC which is less than 12V-DC. However, if the board has a switching diode bridge, and an 18V-DC adapter is connected to it, it will most probably damage the diodes as two of them will be always on and the other two will be off and they are not designed to work in that way (specially if the current is in 1A range).

Regarding the image, I'll post my progress here, for whoever is interested. But for now, I'm more interested in checking the bootloader in detail (from the two images that I've found in your thread in dslreports forum. BTW, you've done a very nice and informative work, thanks a lot !

I asked a few questions earlier in this thread and appreciate if you let me know your suggestions about them as you have much more experience in this area.

Also please let me know if you have seen an image or a program that updates the Firmware for any speedtouch locked router.

Thanks again,

z25814 writes...

Regarding 18V-DC I have to disagree, it's been a long time since my college years, but as far as I remember, the 18V-AC can be rectified to 36/pi V-DC which is less than 12V-DC. However, if the board has a switching diode bridge, and an 18V-DC adapter is connected to it, it will most probably damage the diodes as two of them will be always on and the other two will be off and they are not designed to work in that way (specially if the current is in 1A range).

The later 585 are rated at 18v AC or 22V DC. But 15v ac should be enough, it just won't work as efficiently. ie it will need to draw more current. Due to new rules against the use of plugpacks using transformers as they draw more current in standby they are being phased out in Australia and I'm sure Europe and many places in the world. I have a 24v DC power supply for the 585 and it works perfectly.

Current through the diode is exactly the same no matter if it is AC or DC. Remember peak current in AC is far higher than the RMS value. All diodes designed for 1A AC are actually passing up to 3-4A at the peak of the cycle. Overall RMS value has to be the same. 18V ac should rectify to a peak of about 25-26V but under load will be sq-root 2 ie 1.414 x voltage = 25V -1.4v drop through the diodes. =23.6v So as you can see a 22v nominal dc supply is a correct and indeed recommended substitute once AC plugpacks are banned for more efficient switch mode dc-dc supplies.

If you permanently are running the speedtouch on a DC supply you can open it up and bridge the bridge so to speak. That saves one watt of power.

Hi RPM,

Thanks a lot for your explanation. I think you are correct, I used 18v as the peak value and I guess that was the mistake I made, 18v is the RMS value.

The store that I baught the previous adapter didn't have what I needed in stock, they ordered it and I'll receive it in the next few days.

The images in the upgrade programs, are compressed with a personalized deflate method and there is an additive checksum over the whole image, I think that's the only checksum. I couldn't write a code for decompressing the image yet, but it will be the next step.

Do you have the memory map for the processor on the board ?

"CFE", 0x1FC00000, 0x40000
"KERNEL", 0x1FC40000, 0x3B0000
"NVRAM", 0x1FFF0000, 0x10000

Am I right about the values above ? What about RAM ? I know that its address should start from 0x80000000, but I can't be sure and also I don't know about its size. Do you know how much total RAM the board has ?

Thanks in advance,

z25814 writes...

Do you have the memory map for the processor on the board ?

"CFE", 0x1FC00000, 0x40000
"KERNEL", 0x1FC40000, 0x3B0000
"NVRAM", 0x1FFF0000, 0x10000

No I don't have it, but I will pay more careful attention when I do the next jtag.

I know the board has 4MB Flash and 16MB of RAM. That is the 5x6 and 585. Some of the lower models have less. The 780WL I don't know. It should come today and I will have much more info for you.

Ok the info with JTAG is as follows,

- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 1fc00000
- Selected Area Length ....... : 00040000

*** You Selected to Backup the CFE.BIN ***

- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 1fff0000
- Selected Area Length ....... : 00010000

*** You Selected to Backup the NVRAM.BIN ***
- Flash Chip Window Start .... : 1fc00000
- Flash Chip Window Length ... : 00400000
- Selected Area Start ........ : 1fc40000
- Selected Area Length ....... : 003b0000

*** You Selected to Backup the KERNEL.BIN ***

I had to remake the jtag cable much more carefully as I noticed it was throwing up stray values in the midst of the blank sections. Used resistors at each end of the cable with total value around 112ohm. That worked much better. Also double shielded USB cable instead of ribbon.

The modem section of the 780 is almost identical to the 585. So it is just the addition of the voip gear that make it different.

Hi RPM,

Thanks a lot for the info. I was able to partially simulate the bootloader, but I got lost in the middle of zlib routines. I guess, I've missed a few relocations (I've converted the boot image into an executable file which can be run in a mips environment, so relocations are necessary). Hopefully I can work on it during the weekend.

Cheers,

Hi, I'm trying to connect the speedtouch 780WL router to my bigpond motorola modem but am having trouble. the router seems to only want a DSL connection and will not pick up the connection to the modem. any ideas of where i have gone wrong or what i can do? cheers

ST780WL is an ADSL Router...used with ADSL broadband, its not designed for Cable. You would be better off just getting a router to connect to your cable modem. PM me is you want to sell the 780WL.

Revs...your too slow...hang on, you still have mine yet. LOL

Pete H

This is an adsl modem router not a cable router. It is possible to route following these instructions.

network.wiki.xs4all.nl/i..._your_SpeedTouch

I have no idea if you can then route voip out though the cable connection.
Basically you are using the wrong equipment. Sell off the 780WL and buy a billion 6404 or Draytek 2900vg or something of the sort.

Thanks to our local court jester. LOL!! Pete H. Rubbing in I pulled apart his 780WL for testing purposes.

And yes you can use your speedtouch as a cable router, though I agree it isn't the best idea.

Thanks for that. clearly the guy who recomended it didnt know squat! is there a thomson router you can recomend as the best to use to connect with bigpond cable?

ronimoon writes...

Thanks for that. clearly the guy who recomended it didnt know squat! is there a thomson router you can recomend as the best to use to connect with bigpond cable?

Thomson AFAIK do not make routers without adsl. Now their product range is much much larger than we get in the antipodes but I still don't think they make one. Why would you want one.

If you want voip, either the Billion 6404 or the Draytek 2900 series (much more expensive than billion) will suit very well. Or you can get a plain router very cheaply. Our favourite is Linksys WRT54GL and variations thereon which use dd-wrt firmware. Plus an ATA if you want voip.

Sell off the 780WL as it really will be a pain. Especially routing voip out the port used for cable. Not saying it is impossible as the speedtouch are excellent with cli allowing you to set far more than general soho router can do. But buying the right equipment is so much easier.

ok cheers :)

ok cheers :)

cheers :)

Revs Per Min writes...

Ok the info with JTAG is as follows

Hello Revs

Will you mail me those dumps, please? And the Wizard dump, just as with the 585. Let's see if there is any extra to be squeezed out of this baby!

Hi,
I too have an O2 780WL (UK) and just tried flashing the 7.4.1.7 (generic) firmware via the bootp method.

I can get the modem to attempt to boot, but it appears to get into a cycle

Mar 14 01:14:27 snowdon kernel: 0000:00:1c.0: eth1: 10/100 speed: disabling TSO
Mar 14 01:14:28 snowdon dhcpd: BOOTREQUEST from 00:18:f6:70:b2:eb via eth1
Mar 14 01:14:28 snowdon dhcpd: BOOTREPLY for 192.168.1.254 to thomson (00:18:f6:
70:b2:eb) via eth1
Mar 14 01:14:28 snowdon kernel: 0000:00:1c.0: eth1: Link is Down
Mar 14 01:14:38 snowdon kernel: 0000:00:1c.0: eth1: Link is Up 100 Mbps Full Dup
lex, Flow Control: RX
Mar 14 01:14:38 snowdon kernel: 0000:00:1c.0: eth1: 10/100 speed: disabling TSO
Mar 14 01:14:38 snowdon dhcpd: BOOTREQUEST from 00:18:f6:70:b2:eb via eth1
Mar 14 01:14:38 snowdon dhcpd: BOOTREPLY for 192.168.1.254 to thomson (00:18:f6:
70:b2:eb) via eth1
Mar 14 01:14:39 snowdon kernel: 0000:00:1c.0: eth1: Link is Down
Mar 14 01:14:48 snowdon kernel: 0000:00:1c.0: eth1: Link is Up 100 Mbps Full Dup
lex, Flow Control: RX
Mar 14 01:14:48 snowdon kernel: 0000:00:1c.0: eth1: 10/100 speed: disabling TSO
Mar 14 01:14:49 snowdon dhcpd: BOOTREQUEST from 00:18:f6:70:b2:eb via eth1
Mar 14 01:14:49 snowdon dhcpd: BOOTREPLY for 192.168.1.254 to thomson (00:18:f6:
70:b2:eb) via eth1
Mar 14 01:14:49 snowdon kernel: 0000:00:1c.0: eth1: Link

I hadn't realised, but am guessing this is as the O2 router is locked, in that it will not accept generic fw - correct?

if so I'll give up for now :-(

planetf1 writes...

I hadn't realised, but am guessing this is as the O2 router is locked, in that it will not accept generic fw - correct?

It is locked. You need to jtag it out of locked state.

I took a look at fw files which I posted at /forum-replies.cfm?t=972967 before coming back to this thread.

...