summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--_router_pon/free_iliad_box_pop.md104
1 files changed, 104 insertions, 0 deletions
diff --git a/_router_pon/free_iliad_box_pop.md b/_router_pon/free_iliad_box_pop.md
new file mode 100644
index 0000000..f478258
--- /dev/null
+++ b/_router_pon/free_iliad_box_pop.md
@@ -0,0 +1,104 @@
+# Hardware Specifications
+
+| | |
+| ---------------- | --------------------------------------- |
+| Vendor/Brand | Free/Iliad |
+| Model | |
+| ODM | |
+| ODM Product Code | |
+| Chipset | |
+| Flash | |
+| RAM | |
+| CPU | BCM63153 |
+| CPU Clock | |
+| Bootloader | |
+| System | |
+| Load addr | |
+| HSGMII | |
+| 2.5GBaseX | |
+| 2.5GBaseT | Yes |
+| XGMII/XSGMII | |
+| 10GBaseX | |
+| 10GBaseT | No |
+| 2.5/5/10GBaseT | |
+| Optics | SC/UPC |
+| IP address | 192.168.1.254 |
+| Web Gui | ✅ |
+| SSH | ? |
+| Telnet | ? |
+| Serial | ? |
+| Serial baud | 115200 |
+| Serial encoding | 8-N-1 |
+| Form Factor | ONT |
+
+## Serial
+
+The serial port is routed through the USB-C port used for power (which is PD compliant, tested with a notebook power supply). The pins are SBU1 and SBU2, reversal is handled using an open drain buffer (SN74LVC2G07) so a pull-up resistor on RX is needed. On the power daughter board TP7 is TX and TP8 is RX.
+At the moment nothing more than a boot log is available. [^bcm61650hack] [^freeboxhack]
+
+## Firmware is interchangeable with
+
+## List of software versions
+
+## List of partitions
+
+# Userful files and binaries
+
+## Useful files
+
+## Useful binaries
+
+# GPON ONU status
+
+## Get the operational status of the ONU
+
+## Get information of the OLT vendor
+
+## Querying a particular OMCI ME
+
+## Getting/Setting Speed LAN Mode
+
+# GPON/OMCI settings
+
+## Getting/Setting ONU GPON Serial Number
+
+## Getting/Setting ONU GPON PLOAM password
+
+## Getting/Setting ONU GPON LOID and LOID password
+
+## Getting/Setting OMCI software version (ME 7)
+
+## Getting/Setting OMCI hardware version (ME 256)
+
+## Getting/Setting OMCI vendor ID (ME 256)
+
+## Getting/Setting OMCI equipment ID (ME 257)
+
+# Advanced settings
+
+## Setting management MAC
+
+## Setting management IP
+
+## Rebooting the ONU
+
+## Creating a new rootfs
+
+## Flashing a new rootfs
+
+# SFP EEPROM settings
+
+## Reading all EEPROM
+
+# EEPROM (I2C slave simulated EEPROM)
+
+## EEPROM0 layout
+
+## EEPROM1 layout
+
+# Known Bugs
+
+# Miscellaneous Links
+
+[^bcm61650hack]: *Pwning the bcm61650* https://blog.xilokar.info/pwning-the-bcm61650.html
+[^freeboxhack]: *Firmware key extraction by gaining EL3* https://blog.xilokar.info/firmware-key-extraction-by-gaining-el3.html