1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
|
---
title: Huawei HG8010H
has_children: false
layout: default
parent: Huawei
---
# Hardware Specifications
| | |
| ------------ | ---------------------------------------------------------------------------------------------- |
| Vendor/Brand | Huawei |
| Model | HG8010H |
| Chipset | HiSilicon SD5116 |
| Flash | 128MiB (SLC NAND DS35Q1GA-IB) |
| RAM | 256MiB |
| CPU | Hisilicon A9 dual core (ARMv7) |
| System | Dopra Linux |
| 2.5GBaseT | No |
| Optics | SC/APC and SC/UPC |
| IP address | 192.168.100.1 |
| Web Gui | ✅ user `root`, password `admin` or `adminHW` and user `telecomadmin`, password `admintelecom` |
| SSH | |
| Telnet | After Enabling user `root`, password `admin` or `adminHW` |
| Serial | |
| Form Factor | ONT |
{% include image.html file="hg8010h.jpg" alt="HG8010H" caption="HG8010H: Horizontal PON port (left, middle); vertical PON port (right)" %}
{% include image.html file="hg8010hvorr.jpg" alt="HG8010Hv3/4/5" caption="Bottom of the HG8010Hv3/4/5" %}
{% include image.html file="hg8010hv6.jpg" alt="HG8010Hv6" caption="Bottom of the HG8010Hv6" %}
## Enabling telnet
We need access to a specific shell and in order to get it we have to enable telnet. On the unit, the telnet server accepts connections but doesn't read any input, nor does it send anything.
To enable telnet we’ll use one of the web interface’s features: the configuration backup and restore page. The configuration can be downloaded as an XML, which contains a lot more options than the web interface and a couple of them can be modified to enable telnet access: under the `X_HW_CLITelnetAccess` node, set the `Access` attribute to `1` and in `AclServices`, `TELNETLanEnable` should also be set to `1`. I had to set both but your mileage may vary.
It is possible that this won't work/has been fixed in more recent versions.
Now that this is done, the modified configuration file can be uploaded via the web interface, the ONT will restart and telnet should be accessible on port 23.
## Hardware revisions
- v1: Horizontal PON port
- v2: Horizontal PON port
- v3: Vertical PON port
- v4: Vertical PON port
- v5: Vertical PON port
- v6: Vertical PON port
## List of software versions
- HWTCA31610003
- V3R013C10S112
- V3R015C10S106
- V3R016C10S003 (V300R016C10SPC003B010)
- V3R017C00S100
- V3R017C10S201 (V300R017C10SPC201B255)
- V5R020C10S020 (V500R020C10SPC020B014 - V500R020C10SPC020A2011020049)
- V5R020C10S024 (V500R020C10SPC024B001)
- V5R020C10S025 (V500R020C10SPC025B002)
- V5R020C10S115 (V500R020C10SPC115B270)
## List of partitions
0x000000000000-0x000000100000 : "bootcode" (1MiB)
0x000000100000-0x000008000000 : "ubilayer_v5" (127MiB)
## List of firmwares and files
## List of useful commands
> **Warning**
> All results need to be converted from HEX to ASCII
> [Converter](/ascii-hex)
- Get OLT information:
```
WAP>omcicmd mib show meid 131 instid 0
-------------------------------------------------------
Me(OLT-G), instance(0x0), instance size is 54
-------------------------------------------------------
Att1, AttSize = 0x4, AttContent: 48575443
Att2, AttSize = 0x14, AttContent: 00000000 00000000 00000000 00000000 00000000
Att3, AttSize = 0xe, AttContent: 31300000 00000000 00000000 0000
Att4, AttSize = 0xe, AttContent: 00000000 00000000 00000000 0000
-------------------------------------------------------
success!
```
*0x48575443* → *HWTC* (Huawei)
- Get SW Version 0 and 1:
```
WAP>omcicmd mib show meid 7 instid 0
-------------------------------------------------------
Me(Software Image), instance(0x0), instance size is 19
-------------------------------------------------------
Att1, AttSize = 0xe, AttContent: 56355230 32304331 30533131 3500
Att2, AttSize = 0x1, AttContent: 00
Att3, AttSize = 0x1, AttContent: 00
Att4, AttSize = 0x1, AttContent: 01
-------------------------------------------------------
success!
WAP>omcicmd mib show meid 7 instid 1
-------------------------------------------------------
Me(Software Image), instance(0x1), instance size is 19
-------------------------------------------------------
Att1, AttSize = 0xe, AttContent: 56355230 32304331 30533131 3500
Att2, AttSize = 0x1, AttContent: 01
Att3, AttSize = 0x1, AttContent: 01
Att4, AttSize = 0x1, AttContent: 01
-------------------------------------------------------
success!
```
*0x56355230 32304331 30533131 3500* → *V5R020C10S115*
- Get ONT Vendor ID and HW Version:
```
WAP>omcicmd mib show meid 256 instid 0
-------------------------------------------------------
Me(ONT-G), instance(0x0), instance size is 73
-------------------------------------------------------
Att1, AttSize = 0x4, AttContent: 48575443
Att2, AttSize = 0xe, AttContent: 32343046 2e410000 00000000 0000
Att3, AttSize = 0x8, AttContent: 2a2a2a2a 2a2a2a2a
Att4, AttSize = 0x1, AttContent: 00
Att5, AttSize = 0x1, AttContent: 00
Att6, AttSize = 0x1, AttContent: 00
Att7, AttSize = 0x1, AttContent: 00
Att8, AttSize = 0x1, AttContent: 00
Att9, AttSize = 0x1, AttContent: 00
Att10, AttSize = 0x18, AttContent: 2a2a2a2a 2a2a2a2a 2a2a2a2a 2a2a2a2a 2a2a2a2a 2a2a2a2a
Att11, AttSize = 0xc, AttContent: 2a2a2a2a 2a2a2a2a 2a2a2a2a
Att12, AttSize = 0x1, AttContent: 00
Att13, AttSize = 0x2, AttContent: 0001
-------------------------------------------------------
success!
```
*0x48575443* → *HWTC*
*0x32343046 2e41* → *240F.A*
- Get ONT Equipment ID:
```
WAP>omcicmd mib show meid 257 instid 0
-------------------------------------------------------
Me(ONT2-G), instance(0x0), instance size is 44
-------------------------------------------------------
Att1, AttSize = 0x14, AttContent: 48473830 31304876 36000000 00000000 00000000
Att2, AttSize = 0x1, AttContent: b0
Att3, AttSize = 0x2, AttContent: 0240
Att4, AttSize = 0x1, AttContent: 01
Att5, AttSize = 0x1, AttContent: 01
Att6, AttSize = 0x2, AttContent: 0040
Att7, AttSize = 0x1, AttContent: 02
Att8, AttSize = 0x1, AttContent: 01
Att9, AttSize = 0x2, AttContent: 0020
Att10, AttSize = 0x4, AttContent: 00000000
Att11, AttSize = 0x2, AttContent: 007d
Att12, AttSize = 0x1, AttContent: 00
Att13, AttSize = 0x2, AttContent: 0018
Att14, AttSize = 0x2, AttContent: 0001
-------------------------------------------------------
success!
```
*0x48473830 31304876 36* → *HG8010Hv6*
# Known Bugs
# Miscellaneous Links
- [Exploring the Huawei HG8010H GPON ONT](https://www.linux.it/~md/text/gpon-sha2017.pdf)
- [Unlock HG8010Hv3 softmode](https://lafibre.info/orange-installation/unlock-hg8010gv3-softmode/)
- [Notes on a Huawei HG810H (N.B. SSL error)](https://umbriel.fr/blog/Notes_on_a_Huawei_HG8010H.html)
- [Encrypt/Decrypt configuration file of most HuaWei HG routers](https://github.com/clippit/huawei-hg)
# Teardown and other photos
## v1-2
{% include image.html file="hg8010h_teardown_1.jpg" alt="HG8010Hv1/2 Teardown" caption="HG8010Hv1/2: Teardown" %}
{% include image.html file="hg8010h_teardown_2.jpg" alt="HG8010Hv1/2 Teardown" caption="HG8010Hv1/2: Teardown" %}
## v6
{% include image.html file="hg8010h_teardown_1_v6.jpg" alt="HG8010Hv6 Teardown" caption="HG8010Hv6: Teardown" %}
{% include image.html file="hg8010h_teardown_2_v6.jpg" alt="HG8010Hv6 Teardown" caption="HG8010Hv6: Teardown" %}
|
