blob: f47825886cfdea74679aaa97c7f069c9b591ce7d (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
# Hardware Specifications
| | |
| ---------------- | --------------------------------------- |
| Vendor/Brand | Free/Iliad |
| Model | |
| ODM | |
| ODM Product Code | |
| Chipset | |
| Flash | |
| RAM | |
| CPU | BCM63153 |
| CPU Clock | |
| Bootloader | |
| System | |
| Load addr | |
| HSGMII | |
| 2.5GBaseX | |
| 2.5GBaseT | Yes |
| XGMII/XSGMII | |
| 10GBaseX | |
| 10GBaseT | No |
| 2.5/5/10GBaseT | |
| Optics | SC/UPC |
| IP address | 192.168.1.254 |
| Web Gui | ✅ |
| SSH | ? |
| Telnet | ? |
| Serial | ? |
| Serial baud | 115200 |
| Serial encoding | 8-N-1 |
| Form Factor | ONT |
## Serial
The serial port is routed through the USB-C port used for power (which is PD compliant, tested with a notebook power supply). The pins are SBU1 and SBU2, reversal is handled using an open drain buffer (SN74LVC2G07) so a pull-up resistor on RX is needed. On the power daughter board TP7 is TX and TP8 is RX.
At the moment nothing more than a boot log is available. [^bcm61650hack] [^freeboxhack]
## Firmware is interchangeable with
## List of software versions
## List of partitions
# Userful files and binaries
## Useful files
## Useful binaries
# GPON ONU status
## Get the operational status of the ONU
## Get information of the OLT vendor
## Querying a particular OMCI ME
## Getting/Setting Speed LAN Mode
# GPON/OMCI settings
## Getting/Setting ONU GPON Serial Number
## Getting/Setting ONU GPON PLOAM password
## Getting/Setting ONU GPON LOID and LOID password
## Getting/Setting OMCI software version (ME 7)
## Getting/Setting OMCI hardware version (ME 256)
## Getting/Setting OMCI vendor ID (ME 256)
## Getting/Setting OMCI equipment ID (ME 257)
# Advanced settings
## Setting management MAC
## Setting management IP
## Rebooting the ONU
## Creating a new rootfs
## Flashing a new rootfs
# SFP EEPROM settings
## Reading all EEPROM
# EEPROM (I2C slave simulated EEPROM)
## EEPROM0 layout
## EEPROM1 layout
# Known Bugs
# Miscellaneous Links
[^bcm61650hack]: *Pwning the bcm61650* https://blog.xilokar.info/pwning-the-bcm61650.html
[^freeboxhack]: *Firmware key extraction by gaining EL3* https://blog.xilokar.info/firmware-key-extraction-by-gaining-el3.html
|
