blob: 72133e0ebfeaa2d8a3015e5ee817b862859efb96 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
---
title: FreeBox Pop/IliadBox
has_children: false
layout: default
parent: Free/Iliad
---
# Hardware Specifications
| | |
| ---------------- | ------------------------------------ |
| Vendor/Brand | Free/Iliad |
| Model | |
| ODM | |
| ODM Product Code | |
| Chipset | BCM63153 |
| Flash | 4GB eMMC 5.1 KLM4G1FETE-B041 |
| RAM | 2x 512MB DDR3L-1866 NT5CC128M16JR-EK |
| CPU | |
| CPU Clock | |
| Bootloader | |
| System | |
| Load addr | |
| HSGMII | ✅ (Only AFM0003ILD) |
| XGMII/XSGMII | Yes |
| 10GBaseX | Yes |
| Optics | SC/UPC |
| IP address | 192.168.1.254 |
| Web Gui | ✅ |
| SSH | |
| Telnet | |
| Serial | |
| Serial baud | 115200 |
| Serial encoding | 8-N-1 |
| Form Factor | CPE with SFP w/o MAC support |
## Serial
The serial port is routed through the USB-C port used for power (which is PD compliant, tested with a notebook power supply). The pins are SBU1 and SBU2, reversal is handled using an open drain buffer (SN74LVC2G07) so a pull-up resistor on RX is needed. On the power daughter board TP7 is TX and TP8 is RX. There is also a USB differential pair routed through the USB-C connector but there is no use for it yet.
At the moment nothing more than a boot log is available. [^bcm61650hack] [^freeboxhack]
## SFP Whitelist
- WTD RTXM166-401-C13 (EPON w/o MAC)
- WTD RTXM166-401-C11 (EPON w/o MAC)
- Hisense LTF7215-BH+ (EPON w/o MAC)
- [Technicolor AFM0003](/ont-technicolor-afm0003) (GPON with MAC)
- SFP Copper 10Gtek (1 and 10 Gbps)
# Miscellaneous Links
[^bcm61650hack]: *Pwning the bcm61650* https://blog.xilokar.info/pwning-the-bcm61650.html
[^freeboxhack]: *Firmware key extraction by gaining EL3* https://blog.xilokar.info/firmware-key-extraction-by-gaining-el3.html
|
