Quantcast
Channel: General Randomness – john.geek.nz
Viewing all 42 articles
Browse latest View live
↧

WordPress Super Cache plugin – Performance Benchmarking

April 25, 2010, 6:24 am
$
0
0

I’ve been doing some performance tests on WordPress to see how much of a difference the WordPress Super Cache plugin made.

It turns out that the plugin makes a huge difference.

Resource usage comparison over two (highlighted) tests. Cache is OFF on the left, ON on the right.

I kept increasing the rate of requests until the Disk IO rate was the same for both tests. With the cache turned off, CPU usage went through the roof to 400% of my allocation while still only serving up pages at five megabits per second. With the cache enabled, CPU usage settled at 20% and the data rate peaked at over 45 Megabit/sec.

I’m very impressed with the results… It seems that with a moderate spec server, you’ll hit your disk and/or network limit before you run out of CPU or RAM.

↧
Search

Selective colour replacement with imagemagick

June 7, 2010, 4:31 pm
$
0
0

Selective colour replacement is easy from the command line with imagemagick.

You can download imagemagick from http://www.imagemagick.org/

The following will replace all red (#FF0000) pixels with blue (#0000FF)

convert sourceimage.png -fill "#FF0000" -opaque "#0000FF" destimage.png
↧
↧

Combining two images with ImageMagick

June 9, 2010, 4:39 pm
$
0
0

To combine two images of the same size with ImageMagick, you simply do the following:

The following will overlay overlay.png on top of output.png

mogrify -draw "image SrcOver 0,0 0,0 'overlay.png'" output.png

While this one will overlay overlay.png on top of input.png and save it as output.png

convert input.png -draw "image SrcOver 0,0 0,0 'overlay.png'" output.png

You can download imagemagick from http://www.imagemagick.org/

↧

Downloading routes from a GlobalSat DG-100 with gpsbabel on Linux

November 10, 2010, 3:07 pm
$
0
0

This is a GlobalSat DG-100

It’s an amazing piece of Kit, but the software that comes with it is absolutely rubbish.

You can download all of the routes (and delete them from the unit) in one simple command with gpsbabel.

gpsbabel -t -i dg-100,erase -o gpx /dev/ttyUSB0 outputfile2.gpx

You’ll still need to set up the times/distance for recording for the switch positions A,B & C. I have mine set to 1,5 and 10 seconds. Easiest way to set these up is on a windows machine with DG Manager.

↧

Stag hat with a difference

November 28, 2010, 2:53 pm
$
0
0

My brother recently got married and as per the rules of engagement, the lead up to the event included a Stag night.

For my Stag night, I was given a hard hat complete with a flashing LED light and plastic antlers.

I decided I wanted to make something special for my brother. Something minimalistic, but effective.

The result was this…..

Days, Hours, Minutes and Seconds remaining...

It was my first project using an Atmel AVR microcontroller. I’ve always planned on using an AVR, but normally settled for a simpler device such as a PIC or PICAXE, but this time I was determined to take the plunge and learn how to program the AVR.

To add difficulty to the project, I wanted to use a real time clock crystal too. This upped the ante a lot. It meant using the internal clock for the processor, external clock for the time counting and interrupts to decrement the displayed count.

I decided to use a pair of Red 4-digit 7-segment serial displays from SparkFun to simplify the display side of things. These turned out to be an excellent choice as they also support SPI control meaning I could send data to both displays with only four pins.

Here’s a sketch from my notebook of the schematic. It’s probably wise to add some capacitors to smooth the power supply. I was using batteries and the aim was small size and low weight.

Schematic of the hat circuit

The button is used to program the time remaining. I wrote some interesting code to de-bounce the input. The button is held in for about 5 seconds, then it goes into program mode where each single digit can be incremented and a two second hold jumps to the next digit. The programmed time is then stored into the EEPROM.

The Red LED on the top of the helmet is turned on at the start of each second for the period of time it takes to update the display (about 75ms) before it’s turned off and the microcontroller goes into a power saving sleep mode.

And, the most important part, here’s a photo of the helmet in use by Mr Pixel. This was 6 days, 18 hours, 18 minutes and 18 seconds before the wedding. I was unable to get a picture with the flashing LED lit up as it stays lit for such a brief period of time.

While we were out and about, people seemed to quickly work out what the numbers meant and were very interested to find out where to buy one from.

Overall, a successful endeavor.

↧
↧

Kiwicon Reminder

October 31, 2011, 6:05 pm
$
0
0

I’m off to Kiwicon V this coming weekend.

If you’re interested in computer security and haven’t got a ticket, I suggest you make some very last minute plans to get to Wellington for the 5th and 6th November.

↧

Update

June 1, 2012, 7:53 pm
$
0
0

OK, OK. I admit it.

I’ve been very slack updating my blog recently. I’ve had a few overseas trips with work and been inundated with other work.

I promise I’ll update my site soon!

↧

Reading data from a Sensirion SHT1x with a Raspberry Pi

August 13, 2012, 4:51 am
$
0
0

Note: An updated version of my code is available at http://www.john.geek.nz/2012/11/update-reading-data-from-a-sensirion-sht1x-with-a-raspberry-pi/

The Sensirion SHT1x range of sensors provide a rather convenient way to accurately measure Temperature and Relative Humidity.

They aren’t the cheapest sensors as they typically sell for around $40, but they seem very accurate. I obtained a Sensirion SHT11 a while back as a free sample. I’d managed to get it working with an AVR ATMEGA328P for a planned project to build an Incubator, but now I wanted to read data from it using the GPIO of a Raspberry Pi.

I decided to keep the SHT11 allocated to my Incubator and bought an SHT15 for my weather station. The sensors are very similar. The data sheet shows that the SHT11 has an accuracy of ±3% Relative Humidity and ±0.4° Centigrade while the SHT15 is slightly better at ±2%RH and ±0.3°C. The communication interface is identical so no problems changing sensors in the future.

Before you can use my code sample, you’ll need to get the latest BCM2835 Raspberry Pi GPIO Library from http://www.open.com.au/mikem/bcm2835/ and wire up the sensor to the Raspberry Pi GPIO port.

SHT1x Pin Connection
GND Connected to GPIO Port P1-06 (Ground)
DATA Connected via a 10k pullup resistor to GPIO Port P1-01 (3V3 Power)
DATA Connected to GPIO Port P1-18 (GPIO 24)
SCK Connected to GPIO Port P1-16 (GPIO 23)
VDD Connected to GPIO Port P1-01 (3V3 Power)

Note that if you’re using a Spark Fun SHT15 Breakout board, the breakout board already has pull up resistors, so you don’t need the one listed in the table above.

http://elinux.org/RPi_Low-level_peripherals is very useful if you need a pin diagram of the GPIO header or other information on the Raspberry Pi GPIO.

Here’s the source code you’re looking for: RaspberryPi_SHT1x.zip

Here’s the source of testSHT1x.c. (RPi_SHT1x.c and RPi_SHT1x.h can be found in RaspberryPi_SHT1x.zip)

// Compile with: gcc -o testSHT1x ./../bcm2835-1.3/src/bcm2835.c ./RPi_SHT1x.c testSHT1x.c

/*
Raspberry Pi SHT1x communication library.
By:      John Burns (www.john.geek.nz)
Date:    14 August 2012
License: CC BY-SA v3.0 - http://creativecommons.org/licenses/by-sa/3.0/

This is a derivative work based on
	Name: Nice Guy SHT11 library
	By: Daesung Kim
	Date: 04/04/2011
	Source: http://www.theniceguy.net/2722

Dependencies:
	BCM2835 Raspberry Pi GPIO Library - http://www.open.com.au/mikem/bcm2835/

Sensor:
	Sensirion SHT11 Temperature and Humidity Sensor interfaced to Raspberry Pi GPIO port

SHT pins:
	1. GND  - Connected to GPIO Port P1-06 (Ground)
	2. DATA - Connected via a 10k pullup resistor to GPIO Port P1-01 (3V3 Power)
	2. DATA - Connected to GPIO Port P1-18 (GPIO 24)
	3. SCK  - Connected to GPIO Port P1-16 (GPIO 23)
	4. VDD  - Connected to GPIO Port P1-01 (3V3 Power)

Note:
	GPIO Pins can be changed in the Defines of RPi_SHT1x.h
*/

#include <bcm2835.h>
#include <stdio.h>
#include "RPi_SHT1x.h"
#include <time.h>

void printTempAndHumidity(void)
{
	unsigned char noError = 1;  
	value humi_val,temp_val;
	
	
	// Wait at least 11ms after power-up (chapter 3.1)
	delay(20); 
	
	// Set up the SHT1x Data and Clock Pins
	SHT1x_InitPins();
	
	// Reset the SHT1x
	SHT1x_Reset();
	
	// Request Temperature measurement
	noError = SHT1x_Measure_Start( SHT1xMeaT );
	if (!noError) {
		return;
		}
		
	// Read Temperature measurement
	noError = SHT1x_Get_Measure_Value( (unsigned short int*) &temp_val.i );
	if (!noError) {
		return;
		}

	// Request Humidity Measurement
	noError = SHT1x_Measure_Start( SHT1xMeaRh );
	if (!noError) {
		return;
		}
		
	// Read Humidity measurement
	noError = SHT1x_Get_Measure_Value( (unsigned short int*) &humi_val.i );
	if (!noError) {
		return;
		}

	// Convert intergers to float and calculate true values
	temp_val.f = (float)temp_val.i;
	humi_val.f = (float)humi_val.i;
	
	// Calculate Temperature and Humidity
	SHT1x_Calc(&humi_val.f, &temp_val.f);

	//Print the Temperature to the console
	printf("Temperature: %0.2f%cC\n",temp_val.f,0x00B0);

	//Print the Humidity to the console
	printf("Humidity: %0.2f%%\n",humi_val.f);

}

int main ()
{
	//Initialise the Raspberry Pi GPIO
	if(!bcm2835_init())
		return 1;
	
	printTempAndHumidity();

	return 1;
}
↧
Search

Update – Reading data from a Sensirion SHT1x with a Raspberry Pi

October 31, 2012, 1:26 pm
$
0
0

After a few comments regarding my code to read data from a Sensirion SHT1x with a Raspberry Pi, I’ve got some updated code.

Please see my previous post for general information, but use the code here.

The list of changes are:

  • Added Dewpoint calculation from Page 9 of Datasheet
  • Updated Humidity calculation Coefficients to recommended (12 bit) figures from Page 8 of Datasheet
  • Updated Temperature calculation Coefficients to recommended (3.3 Volt Interpolated) figures from Page 9 of Datasheet

Any references to the datasheet refer to the Version 5, Dec 2011 datasheet found on Sensirions website.

Also note that the bcm2835 GPIO library has been updated and is now version 1.8 – Get the updated version from http://www.open.com.au/mikem/bcm2835/.

Here’s the source code you’re looking for: RaspberryPi_SHT1x_01November2012.zip

Here’s the source of testSHT1x.c. (RPi_SHT1x.c and RPi_SHT1x.h can be found in RaspberryPi_SHT1x_01November2012.zip)

// Compile with: gcc -lm -o testSHT1x ./../bcm2835-1.8/src/bcm2835.c ./RPi_SHT1x.c testSHT1x.c

/*
Raspberry Pi SHT1x communication library.
By:      John Burns (www.john.geek.nz)
Date:    01 November 2012
License: CC BY-SA v3.0 - http://creativecommons.org/licenses/by-sa/3.0/

This is a derivative work based on
	Name: Nice Guy SHT11 library
	By: Daesung Kim
	Date: 04/04/2011
	Source: http://www.theniceguy.net/2722
	License: Unknown - Attempts have been made to contact the author

Dependencies:
	BCM2835 Raspberry Pi GPIO Library - http://www.open.com.au/mikem/bcm2835/

Sensor:
	Sensirion SHT11 Temperature and Humidity Sensor interfaced to Raspberry Pi GPIO port

SHT pins:
	1. GND  - Connected to GPIO Port P1-06 (Ground)
	2. DATA - Connected via a 10k pullup resistor to GPIO Port P1-01 (3V3 Power)
	2. DATA - Connected to GPIO Port P1-18 (GPIO 24)
	3. SCK  - Connected to GPIO Port P1-16 (GPIO 23)
	4. VDD  - Connected to GPIO Port P1-01 (3V3 Power)

Note:
	GPIO Pins can be changed in the Defines of RPi_SHT1x.h
*/

#include <bcm2835.h>
#include <stdio.h>
#include "RPi_SHT1x.h"

void printTempAndHumidity(void)
{
	unsigned char noError = 1;  
	value humi_val,temp_val;
	
	
	// Wait at least 11ms after power-up (chapter 3.1)
	delay(20); 
	
	// Set up the SHT1x Data and Clock Pins
	SHT1x_InitPins();
	
	// Reset the SHT1x
	SHT1x_Reset();
	
	// Request Temperature measurement
	noError = SHT1x_Measure_Start( SHT1xMeaT );
	if (!noError) {
		return;
		}
		
	// Read Temperature measurement
	noError = SHT1x_Get_Measure_Value( (unsigned short int*) &temp_val.i );
	if (!noError) {
		return;
		}

	// Request Humidity Measurement
	noError = SHT1x_Measure_Start( SHT1xMeaRh );
	if (!noError) {
		return;
		}
		
	// Read Humidity measurement
	noError = SHT1x_Get_Measure_Value( (unsigned short int*) &humi_val.i );
	if (!noError) {
		return;
		}

	// Convert intergers to float and calculate true values
	temp_val.f = (float)temp_val.i;
	humi_val.f = (float)humi_val.i;
	
	// Calculate Temperature and Humidity
	SHT1x_Calc(&humi_val.f, &temp_val.f);

	//Print the Temperature to the console
	printf("Temperature: %0.2f%cC\n",temp_val.f,0x00B0);

	//Print the Humidity to the console
	printf("Humidity: %0.2f%%\n",humi_val.f);
	//Calculate and print the Dew Point
	float fDewPoint;
	SHT1x_CalcDewpoint(humi_val.f ,temp_val.f, &fDewPoint);
	printf("Dewpoint: %0.2f%cC\n",fDewPoint,0x00B0);

}

int main ()
{
	//Initialise the Raspberry Pi GPIO
	if(!bcm2835_init())
		return 1;
	
	printTempAndHumidity();

	return 1;
}
↧
↧

Migrating to new server

April 9, 2013, 2:25 pm
$
0
0

I’m in the middle of migrating to a new server.

If you have any problems on my site, please send an email to

↧

Now available in SSL

November 1, 2013, 1:26 am
↧

Yes, I’m still alive!

May 31, 2014, 4:32 pm
$
0
0

Wow, It’s June already!

Yes, I’m still alive, I’ve been busy, but I intend to start posting again soon.

↧

Huawei HG630B. Got Root?

June 7, 2014, 10:32 pm
$
0
0

Huawei HG630B. Got Root?

Telecom New Zealand are distributing the Huawei HG630B router as their ‘Home Gateway’ for residential customers. These routers are particularly interesting as they are Tri-Purpose. They have three WAN interfaces: an RJ11 socket for ADSL/VDSL, Ethernet for Fibre and USB for a USB cellular modem.
Telecom have been distributing these routers since at least the start of 2014, so a number of them are out in the wild.

The Telecom (Huawei) HG630B

The Telecom (Huawei) HG630B


One thing to note is that these routers are heavily branded and heavily locked down….. AND they leave (at least) two external ports open on the WAN side.

The two ports open on the WAN side are 22 (SSH) and 443 (HTTPS). If you try to use port 22 or 443 as an incoming port, these ‘Admin’ ports are incremented (ie: Admin port 22 is changed to 23). It appears impossible to disable the Admin incoming ports through the web interface.

The only way to change this behaviour is to somehow get root access to the device.

I first attempted the tried and tested ping hack on the device. The ping hack is a classic command injection hack where the device simply takes whatever address you want to ping and executes it as “ping address>/var/pingresultfile”. Changing the address to “;cat /etc/passwd” runs the command “ping ;cat /etc/password>/var/pingresultfile” and Voila, you have access to run whatever you want at (normally) full root priveleges. This failed, it seems that Huawei take note of security reports and harden their software.

Maybe I need to take a look around inside..

↧
↧

Huawei HG630B. Peeking inside

June 9, 2014, 3:21 am
$
0
0

Let me be the first to say, it is really hard to open up the HG630B without breaking anything. You have to get the foot off first, this can be done with a small flathead screwdriver and a lot of patience.

Once this is done, there are four screws to undo and a myriad of plastic clips holding the front and back together.

You need to be careful of the antenna as it is partially attached to the case – It’s held in place by some slots inside the case.

Rear side of the HG630B board - Click to zoom

Rear side of the HG630B board – Click to zoom

The rear of the board appears to have five pads in a row (upper right edge) which could be a serial/UART while the front of the board has a square pattern of pads (upper right edge) which could be a JTAG interface.

Front side of the HG630B board - Click to zoom

Front side of the HG630B board – Click to zoom

I’ll have to do some sniffing around these pads to see what they are.

↧

Huawei HG630B. Connecting to the UART

June 11, 2014, 3:24 am
$
0
0

In my previous post I guessed that a five pad header on the rear of the PCB could be a UART of some type.

I quickly soldered a header to the pads, connected my Saleae logic analyzer up, switched on the router and started my snooping.

After a few attempts at finding a suitable ground pin, it wasn’t long before I had data that looked like this.

There's definitely some data there

There’s definitely some data there



My old friend 8 bit ASCII. These logic analyzers are very good for the price - the software has decoded some of the data stream as 'found\r\n'

My old friend 8 bit ASCII. These logic analyzers are very good for the price – the software has decoded some of the data stream as ‘found\r\n’

The data is sent at 115.2 kbit/s with standard 8,N,1 settings. It took a little bit longer to find the RxD pin. Here is the HG630B serial port pinout.

HG630B Serial port pinout

HG630B Serial port pinout

The wire colors in the image are the standard colors for a TTL-232R USB to Serial adapter.

There are two pads which I have not labelled. One of them seems to be +Vcc while the other is just N/C. Either way, they are not required for serial communication.

Here is a full transcript of the serial port while the device boots:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419

HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
STRF
400H
PHYE
DDR2
SIZ4
SIZ3
SIZ2
SIZ1
DINT
USYN
LSYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
 
 
CFE version 1.0.38-114.174 for BCM963268 (32bit,SP,BE)
Build Date: Wed Apr  2 11:24:49 CST 2014 (sunhongyong@X3755-vhg)
Copyright (C) 2000-2011 Broadcom Corporation.
 
NAND flash device: name <not identified>, id 0x98d1 block 128KB size 131072KB
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000
 
Board IP address                  : 192.168.1.1:ffffff00
Host IP address                   : 192.168.1.100
Gateway IP address                :
Run from flash/host (f/h)         : f
Default host run file name        : vmlinux
Default host flash file name      : bcm963xx_fs_kernel
Boot delay (0-9 seconds)          : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-1)                    : 963268_hg630b
Number of MAC Addresses (1-32)    : 10
Base MAC Address                  : 02:10:18:01:00:01
PSI Size (1-64) KBytes            : 0
Enable Backup PSI [0|1]           : 0
System Log Size (0-256) KBytes    : 0
Main Thread Number [0|1]          : 0
 
 
 Boot :e=192.168.1.1:ffffff00 h=192.168.1.100 g= r=f f=vmlinux i=bcm963xx_fs_ker                      nel d=1 p=0
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Boot from slave system!
SIGN CHK ALWAYLYS.
get bootflag = 2
 check tag at block 6 crc ok
Check Image Crc Success
I have find vmlinux.lz at block 291
I have get vmlinux.lz size at block 304
Decompression OK!
Entry at 0x800146c0
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x800146c0
Linux version 2.6.30 (sunhongyong@X3755-vhg) (gcc version 4.4.2 (Buildroot 2010.                      02-git) ) #7 SMP PREEMPT Wed Apr 2 11:25:47 CST 2014
======== nand_flash_init =======
NAND flash device id 98d1 is not supported.
 
Init Flash Error iReturn = -1
63268hg622b prom init
CPU revision is: 0002a080 (Broadcom4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
 memory: 03ece000 @ 00000000 (usable)
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00003ece
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00003ece
On node 0 totalpages: 16078
free_area_init_node: node 0, pgdat 804b2c70, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 94 pages used for memmap
  Normal zone: 11888 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 15952
Kernel command line: root=mtd:rootfs ro rootfstype=jffs2 console=ttyS0,115200
wait instruction: enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:128
PID hash table entries: 256 (order: 8, 1024 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 58028k/64312k available (3735k kernel code, 6264k reserved, 1030k data,                       168k init, 0k highmem)
Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
Broadcom Logger v0.1 Apr  2 2014 11:00:39
CPU revision is: 0002a080 (Broadcom4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)
Brought up 2 CPUs
net_namespace: 1152 bytes
bhal: bhalInit entry
NET: Registered protocol family 16
Internal 1P2 VREG is forced to remain enabled
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: reg 10 32bit mmio: [0x10004000-0x10013fff]
pci 0000:00:00.0: reg 30 32bit mmio: [0x000000-0x0007ff]
pci 0000:00:00.0: supports D1 D2
pci 0000:00:00.0: PME# supported from D0 D3hot D3cold
pci 0000:00:00.0: PME# disabled
pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0:   IO window: disabled
pci 0000:01:00.0:   MEM window: disabled
pci 0000:01:00.0:   PREFETCH window: disabled
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Apr  2 2014 11:06:33 initialized
Broadcom GBPM v0.1 Apr  2 2014 11:06:33 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
fuse init (API version 7.11)
msgmni has been set to 113
io scheduler noop registered (default)
PCI: Setting latency timer of device 0000:01:00.0 to 64
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
NET: Registered protocol family 24
IMQ driver loaded successfully.
        Hooking IMQ after NAT on PREROUTING.
        Hooking IMQ before NAT on POSTROUTING.
Broadcom DSL NAND controller (128MB @00000000
brcmnand_scan: Done brcmnand_probe
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
100 CS=0, chip->ctrl->CS[0]=0
ECC level 15, threshold at 1 bits
reqEccLevel=1, eccLevel=15
190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010
brcmnand_scan 10
200 CS=0, chip->ctrl->CS[0]=0
200 chip->ecclevel=15, acc=f7ff1010
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
brcmnand_scan 220
Brcm NAND controller version = 4.0 NAND flash size 128MB @18000000
brcmnand_scan 230
brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000
brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0
ECC layout=brcmnand_oob_bch4_4k
brcmnand_scan:  mtd->oobsize=64
brcmnand_scan: oobavail=50, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3
300 CS=0, chip->ctrl->CS[0]=0
500 chip=83a5f190, CS=0, chip->ctrl->CS[0]=0
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_main_descr
Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0
Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0
brcmnandCET: Status -> Deferred
brcmnand_scan 99
Boot from slave system!
iBlkStart 123
 
=======iBlkStart:292=======
Creating 3 MTD partitions on "brcmnand.0":
0x000002460000-0x000004760000 : "rootfs"
0x000000160000-0x000002460000 : "rootfsbak"
0x0000070a0000-0x000007dc0000 : "config"
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
usbcore: registered new interface driver usbtest
MoniterInit entry
Serial: BCM63XX driver $Revision: 3.00 $
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 42) is a BCM63XX
adsl: adsl_init entry
bcmxtmcfg: bcmxtmcfg_init entry
bcmxtmrt: Broadcom BCM3168D0 ATM/PTM Network Device v0.4 Apr  2 2014 11:05:36
bcmPktDma_init: Broadcom Packet DMA Library initialized
Total # RxBds=1448
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized
 
GACT probability NOT on
Mirror/redirect action on
u32 classifier
    input device check on
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1004 buckets, 4016 max)
xt_time: kernel timezone is -0000
nf_nat_pt: no ports specified
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
802.1Q VLAN Support v1.8 Ben Greear <HIDDEN EMAIL>
All bugs added by David S. Miller <HIDDEN EMAIL>
VFS: Mounted root (jffs2 filesystem) readonly on device 31:0.
Freeing unused kernel memory: 168k freed
 
=file:drivers/usb/core/hub.c,line:3274,func:hub_events=eventCounts=1=
init started: BusyBox vv1.9.1 (2014-04-02 11:18:48 CST)
starting pid 265, tty '': '/etc/init.d/rcS'
RCS DONE
starting pid 267, tty '': '/bin/sh'
 
 
BusyBox vv1.9.1 (2014-04-02 11:18:48 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
 
-/bin/sh: usbdiagd: not found
Loading drivers and kernel modules...
bcm_ingqos: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Broadcom Ingress QoS Module  Char Driver v0.1 Apr  2 2014 11:04:45 Registered<243>
 
Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=67108864B (64MB), buf_mem_size=6710886B (6MB), num of buffers=3201, buf siz         e=2096
Broadcom BPM Module Char Driver v0.1 Apr  2 2014 11:04:44 Registered<244>
[NTC bpm] bpm_set_status: BPM status : enabled
 
NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache  Char Driver v2.2 Apr  2 2014 11:04:43 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
Constructed Broadcom Packet Flow Cache v2.2 Apr  2 2014 11:04:43
chipId 0x631680D0
Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Apr  2 2014 11:04:47 Registered <         241>
FAP Debug values at 0x00000010 0x00000010
Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Allocated FAP0 GSO Buffers (0xA2F1D124) : 1048576 bytes @ 0xA2800000
Allocated FAP1 GSO Buffers (0xA2F9D124) : 1048576 bytes @ 0xA2900000
[NTC fapProto] fapReset  : Reset FAP Protocol layer
[FAP0] DSPRAM : stack <0x80000000><1024>, global <0x80000400><7096>, free <72>, total<8192>
[FAP1] DSPRAM : stack <0x80000000><1024>, global <0x80000400><7096>, free <72>, total<8192>
[FAP0] PSM : addr<0x80002000>, used <24560>, free <16>, total <24576>
[FAP1] PSM : addr<0x80002000>, used <24560>, free <16>, total <24576>
[FAP0] Flows supported: 237 (dsp 60, psm 75, qsm 102)
[FAP1] Flows supported: 237 (dsp 60, psm 75, qsm 102)
[FAP0] DQM : availableMemory 14188 bytes, nextByteAddress 0xE0010894
[FAP1] DQM : availableMemory 14188 bytes, nextByteAddress 0xE0010894
[FAP0] GSO Buffer set to 0xA2800000
[FAP1] GSO Buffer set to 0xA2900000
[FAP0] FAP BPM Initialized.
[FAP1] FAP BPM Initialized.
bcmPktDma_bind: FAP Driver binding successfull
Broadcom BCM63168D0 Ethernet Network Device v0.1 Apr  2 2014 11:04:36
fapDrv_psmAlloc: fapIdx=0, size: 4000, offset=b08206f0 bytes remaining 7008
ETH Init: Ch:0 - 200 tx BDs at 0xb08206f0
fapDrv_psmAlloc: fapIdx=1, size: 4000, offset=b0a206f0 bytes remaining 7008
ETH Init: Ch:1 - 200 tx BDs at 0xb0a206f0
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0821690 bytes remaining 2192
ETH Init: Ch:0 - 600 rx BDs at 0xb0821690
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a21690 bytes remaining 2192
ETH Init: Ch:1 - 600 rx BDs at 0xb0a21690
eth0.3: MAC Address: FF:FF:FF:FF:FF:FF {Changed to protect the innocent}
eth0.5: MAC Address: FF:FF:FF:FF:FF:FF {Changed to protect the innocent}
eth0.4: MAC Address: FF:FF:FF:FF:FF:FF {Changed to protect the innocent}
eth0.2: MAC Address: FF:FF:FF:FF:FF:FF {Changed to protect the innocent}
nas0: MAC Address: FF:FF:FF:FF:FF:FF {Changed to protect the innocent}
 
=file:drivers/usb/core/hub.c,line:3274,func:hub_events=eventCounts=2=
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: high_wmark_tot=2080
PCI: Setting latency timer of device 0000:00:00.0 to 64
wl: passivemode=1
wl: napimode=0
wl0: allocskbmode=1 currallocskbsz=512
otp_read_pci: bad crc
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl:loading /etc/wlan/bcm6362_vars.bin
Failed to open srom image from '/etc/wlan/bcm6362_vars.bin'.
wl:loading /etc/wlan/bcm6362_map.bin
wl0: Broadcom BCM435f 802.11 Wireless Controller 5.100.138.2001.cpe.L.3
p8021ag: p8021ag_init entry
IRQ 8/BCM WATCHDOG: IRQF_DISABLED is not guaranteed on shared IRQs
BCM Hardware Watchdog Timer for BCM96361
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
Start mic now ...
magic number is 3e 00 65 b0.
Read from flash ok.
 
*****Start cfmUpgradeUpdateCfg()!*****
 
*****No need update config[2]*****
load cfm ok.
start log proc...
ifconfig: SIOCSIFNETMASK: Cannot assign requested address
br0: starting userspace STP failed, starting kernel STP
add group failed: Operation not supported
set group 0 mac learning disable in br0 failed: Operation not supported
BcmAdsl_Initialize=0x80232A70, g_pFnNotifyCallback=0x804A6694
lmemhdr[2]=0x100CE000, pAdslLMem[2]=0x100CE000
pSdramPHY=0xA3FFFFF8, 0x6FECFDAF 0x65BBFE4D
*** XfaceOffset: 0x5FF90 => 0x5FF90 ***
*** PhySdramSize got adjusted: 0xD9E68 => 0x110570 ***
AdslCoreSharedMemInit: shareMemAvailable=137840
AdslCoreHwReset:  pLocSbSta=82b88000 bkupThreshold=3072
AdslCoreHwReset:  AdslOemDataAddr = 0xA3F9AC2C
fapDrv_psmAlloc: fapIdx=1, size: 1600, offset=b0a22960 bytes remaining 592
XTM Init: Ch:0 - 200 rx BDs at 0xb0a22960
fapDrv_psmAlloc: fapIdx=1, size: 128, offset=b0a22fa0 bytes remaining 464
XTM Init: Ch:1 - 16 rx BDs at 0xb0a22fa0
Success
ARL table flush done
Success
Read Prsite on!
atp: cur kernel version:[2.6.30]
device eth0.2 entered promiscuous mode
device eth0.3 entered promiscuous mode
device eth0.4 entered promiscuous mode
device eth0.5 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth0.2: link is not ready
ADDRCONF(NETDEV_UP): eth0.3: link is not ready
ADDRCONF(NETDEV_UP): eth0.4: link is not ready
ADDRCONF(NETDEV_UP): eth0.5: link is not ready
device eth0 is not a slave of br0
arp uses obsolete (PF_INET,SOCK_PACKET)
 
bcmPktDma_init: Broadcom Packet DMA Library initialized
-------------------------------
-----Welcome to ATP Cli------
-------------------------------
 
Login:
The console is prohibited!
 
Login:
The console is prohibited!

Back in line 62, there is a 1 second countdown to press any key and enter an admin menu. I’m unsure what this does yet, as it looks like it could break things.

Once the router has booted up, any attempt to login results in the message “The console is prohibited!”. Oh well, I’ll need to look into another way to get root privileges on the device.

There are a number of useful pieces of information in the serial log though – Line 103 indicates the serial interface (or another interface is) is ttyS0. This is very useful as it means a blind attack could (potentially) output it’s result to /dev/ttys0

↧
Search

Huawei HG630B. Inspecting the firmware

June 22, 2014, 2:13 am
$
0
0

My previous posts on hacking the HG630B didn’t result in me getting root/console access to the router, so it’s time to look into the firmware.

I downloaded the latest version of the firmware. These are the details of the firmware I used:

Name: HG630bV100R001C55B017_upgrade_main.bin
Date: 25/06/2014
Size: 11 MB (12,322,608 bytes)
SHA-1: 375dbe5bc212840fbf7bf4216c76dc7dc08f571c
MD5: 62950060e08d4a357ea946f29dded3e5
CRC32: 5b4c5e27

Using the tool binwalk, I quickly discovered that the firmware file is not encrypted and is simply a JFFS2 filesystem.

I’ve mounted the filesystem and now it’s just a case of searching through it for clues.

It looks like all the .asp files are simply html and the ‘cgi’ is compiled into /bin/web. I think my next step is to inspect /bin/web for any ‘extra’ functionality.

In the mean time, here is a tree view of the filesystem running on the HG630B

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720

.
├── ./bin
│   ├── ./bin/acs_cli
│   ├── ./bin/acsd
│   ├── ./bin/ash -> busybox
│   ├── ./bin/atcmd
│   ├── ./bin/ated
│   ├── ./bin/atserver
│   ├── ./bin/bftpd
│   ├── ./bin/brctl
│   ├── ./bin/busybox
│   ├── ./bin/cat -> busybox
│   ├── ./bin/chmod -> busybox
│   ├── ./bin/cli
│   ├── ./bin/cmfctl
│   ├── ./bin/cms
│   ├── ./bin/console -> cli
│   ├── ./bin/cp -> busybox
│   ├── ./bin/cwmp
│   ├── ./bin/date -> busybox
│   ├── ./bin/ddnsc
│   ├── ./bin/df -> busybox
│   ├── ./bin/dhcp6c
│   ├── ./bin/dhcp6s
│   ├── ./bin/dhcpc
│   ├── ./bin/dhcps
│   ├── ./bin/dms
│   ├── ./bin/dns
│   ├── ./bin/dsldiagd
│   ├── ./bin/eapd
│   ├── ./bin/ebtables
│   ├── ./bin/echo -> busybox
│   ├── ./bin/equipcmd
│   ├── ./bin/ethcmd
│   ├── ./bin/ethswctl
│   ├── ./bin/fapctl
│   ├── ./bin/fcctl
│   ├── ./bin/igd
│   ├── ./bin/igmpproxy
│   ├── ./bin/ip
│   ├── ./bin/ip6tables
│   ├── ./bin/ipcheck
│   ├── ./bin/ipp
│   ├── ./bin/iptables
│   ├── ./bin/iwpriv
│   ├── ./bin/kill -> busybox
│   ├── ./bin/klog
│   ├── ./bin/lld2d
│   ├── ./bin/log
│   ├── ./bin/ls -> busybox
│   ├── ./bin/mic
│   ├── ./bin/mkdir -> busybox
│   ├── ./bin/mknod -> busybox
│   ├── ./bin/mldproxy
│   ├── ./bin/mount -> busybox
│   ├── ./bin/mv -> busybox
│   ├── ./bin/nas
│   ├── ./bin/nas4not -> ../bin/nas
│   ├── ./bin/netstat -> busybox
│   ├── ./bin/nmbd
│   ├── ./bin/ntfs-3g
│   ├── ./bin/nvram
│   ├── ./bin/ping -> busybox
│   ├── ./bin/ping6 -> busybox
│   ├── ./bin/pppc
│   ├── ./bin/ps -> busybox
│   ├── ./bin/radvd
│   ├── ./bin/radvdump
│   ├── ./bin/ripd
│   ├── ./bin/rm -> busybox
│   ├── ./bin/scanner
│   ├── ./bin/sh -> busybox
│   ├── ./bin/siproxd
│   ├── ./bin/smbd
│   ├── ./bin/smbpasswd
│   ├── ./bin/sntp
│   ├── ./bin/startbsp
│   ├── ./bin/swapdev
│   ├── ./bin/tc
│   ├── ./bin/telnetd
│   ├── ./bin/tr111
│   ├── ./bin/traceroute6 -> busybox
│   ├── ./bin/udpecho
│   ├── ./bin/umount -> busybox
│   ├── ./bin/upg
│   ├── ./bin/upnp
│   ├── ./bin/usbmount
│   ├── ./bin/VeriSignRoot.pem
│   ├── ./bin/web
│   ├── ./bin/wl -> wlctl
│   ├── ./bin/wlancmd
│   ├── ./bin/wlctl
│   ├── ./bin/wl_server -> wl_server_socket
│   ├── ./bin/wl_server_socket
│   ├── ./bin/wpsd
│   ├── ./bin/wps_monitor
│   ├── ./bin/xdslcmd
│   ├── ./bin/xdslctl
│   ├── ./bin/xtmcmd
│   └── ./bin/zebra
├── ./config
├── ./dev
│   ├── ./dev/console
│   ├── ./dev/fuse -> /var/fuse
│   ├── ./dev/misc
│   │   └── ./dev/misc/fuse -> /var/fuse
│   └── ./dev/null
├── ./etc
│   ├── ./etc/adsl
│   │   └── ./etc/adsl/adsl_phy.bin
│   ├── ./etc/bootfile.txt
│   ├── ./etc/certdefault.crt
│   ├── ./etc/create_db.sql
│   ├── ./etc/defaultcfg.xml
│   ├── ./etc/dhcps2.leases -> /var/dhcp/dhcps/leasesF
│   ├── ./etc/dhcps.conf -> /var/dhcp/dhcps/config
│   ├── ./etc/dhcps.leases -> /var/dhcp/dhcps/leases
│   ├── ./etc/dms
│   │   ├── ./etc/dms/DLNA120.jpg
│   │   ├── ./etc/dms/DLNA120.png
│   │   ├── ./etc/dms/DLNA48.jpg
│   │   └── ./etc/dms/DLNA48.png
│   ├── ./etc/ethertypes
│   ├── ./etc/fstab
│   ├── ./etc/group -> /var/group
│   ├── ./etc/inetd.conf
│   ├── ./etc/init.d
│   │   └── ./etc/init.d/rcS
│   ├── ./etc/inittab
│   ├── ./etc/jffs.img
│   ├── ./etc/mtab -> /var/mtab
│   ├── ./etc/passwd -> /var/passwd
│   ├── ./etc/printers.ini
│   ├── ./etc/profile
│   ├── ./etc/resolv.conf -> /var/dns/resolv.conf
│   ├── ./etc/root.pem
│   ├── ./etc/samba -> /var/samba
│   ├── ./etc/servercert.pem
│   ├── ./etc/serverkey.pem.gen
│   ├── ./etc/services
│   ├── ./etc/share.map
│   ├── ./etc/sysmsg -> /var/sysmsg
│   ├── ./etc/t_tree.xml
│   ├── ./etc/TZ -> /var/TZ
│   ├── ./etc/upnp
│   │   ├── ./etc/upnp/DevCfg.xml
│   │   ├── ./etc/upnp/devinfo.xml
│   │   ├── ./etc/upnp/IGDInfoScpd.xml
│   │   ├── ./etc/upnp/L3Fwd.xml
│   │   ├── ./etc/upnp/LanHostCfgMgmt.xml
│   │   ├── ./etc/upnp/LANSec.xml
│   │   ├── ./etc/upnp/UserItf.xml
│   │   ├── ./etc/upnp/WanCommonIfc1.xml
│   │   ├── ./etc/upnp/WanDslIfCfg.xml
│   │   ├── ./etc/upnp/WanDslLink.xml
│   │   ├── ./etc/upnp/WanEthConnMgt.xml
│   │   ├── ./etc/upnp/WanEthLinkCfg.xml
│   │   ├── ./etc/upnp/WanIpConn.xml
│   │   ├── ./etc/upnp/WanPppConn.xml
│   │   └── ./etc/upnp/WLANCfg.xml
│   ├── ./etc/wlan
│   │   ├── ./etc/wlan/bcm4306_map.bin
│   │   ├── ./etc/wlan/bcm43112_map.bin
│   │   ├── ./etc/wlan/bcm4313_map.bin
│   │   ├── ./etc/wlan/bcm4318_map.bin
│   │   ├── ./etc/wlan/bcm4321_map.bin
│   │   ├── ./etc/wlan/bcm43222_map.bin
│   │   ├── ./etc/wlan/bcm43224_map.bin
│   │   ├── ./etc/wlan/bcm43225_map.bin
│   │   ├── ./etc/wlan/bcm43226_map.bin
│   │   ├── ./etc/wlan/bcm43227_map.bin
│   │   ├── ./etc/wlan/bcm43228_map.bin
│   │   ├── ./etc/wlan/bcm4322_map.bin
│   │   ├── ./etc/wlan/bcm4331_map.bin
│   │   ├── ./etc/wlan/bcm4331_vars.bin
│   │   └── ./etc/wlan/bcm6362_map.bin
│   ├── ./etc/wrt54g.large.ico
│   └── ./etc/wrt54g.small.ico
├── ./html
│   ├── ./html/css
│   │   ├── ./html/css/contentstyle_arabic.css
│   │   ├── ./html/css/contentstyle.css
│   │   ├── ./html/css/jquery_treeview.css
│   │   ├── ./html/css/stylemain.css
│   │   └── ./html/css/thickbox.css
│   ├── ./html/html
│   │   ├── ./html/html/application
│   │   │   ├── ./html/html/application/alg.asp
│   │   │   ├── ./html/html/application/autosetup.asp
│   │   │   ├── ./html/html/application/ddns.asp
│   │   │   ├── ./html/html/application/dms.asp
│   │   │   ├── ./html/html/application/dms_list.asp
│   │   │   ├── ./html/html/application/dmz.asp
│   │   │   ├── ./html/html/application/ftp.asp
│   │   │   ├── ./html/html/application/ftpserver.asp
│   │   │   ├── ./html/html/application/igmpproxy.asp
│   │   │   ├── ./html/html/application/igmpsnooping.asp
│   │   │   ├── ./html/html/application/ipv6.asp
│   │   │   ├── ./html/html/application/lanname.asp
│   │   │   ├── ./html/html/application/mld.asp
│   │   │   ├── ./html/html/application/multinat.asp
│   │   │   ├── ./html/html/application/portmapping.asp
│   │   │   ├── ./html/html/application/porttrigger.asp
│   │   │   ├── ./html/html/application/PrintServer.asp
│   │   │   ├── ./html/html/application/samba.asp
│   │   │   ├── ./html/html/application/sharedir.asp
│   │   │   ├── ./html/html/application/staticdhcp.asp
│   │   │   └── ./html/html/application/upnp.asp
│   │   ├── ./html/html/content.asp
│   │   ├── ./html/html/copyright.html
│   │   ├── ./html/html/DslTestInfo.asp
│   │   ├── ./html/html/DslTestInfo_reboot.asp
│   │   ├── ./html/html/index.asp
│   │   ├── ./html/html/main
│   │   │   ├── ./html/html/main/footer.asp
│   │   │   ├── ./html/html/main/footer.html
│   │   │   ├── ./html/html/main/freshhelpwindow.asp
│   │   │   ├── ./html/html/main/logo.asp
│   │   │   ├── ./html/html/main/logo.html
│   │   │   ├── ./html/html/main/menu.asp
│   │   │   ├── ./html/html/main/quickmenu_arabic.asp
│   │   │   ├── ./html/html/main/quickmenu.asp
│   │   │   ├── ./html/html/main/refresh.asp
│   │   │   ├── ./html/html/main/tab_arabic.asp
│   │   │   └── ./html/html/main/tab.asp
│   │   ├── ./html/html/management
│   │   │   ├── ./html/html/management/account.asp
│   │   │   ├── ./html/html/management/cfgfile.asp
│   │   │   ├── ./html/html/management/diagnose.asp
│   │   │   ├── ./html/html/management/dslstatus.asp
│   │   │   ├── ./html/html/management/firmware.asp
│   │   │   ├── ./html/html/management/logcfg.asp
│   │   │   ├── ./html/html/management/logview.asp
│   │   │   ├── ./html/html/management/mirror.asp
│   │   │   ├── ./html/html/management/pingstatus.asp
│   │   │   ├── ./html/html/management/pppstatus.asp
│   │   │   ├── ./html/html/management/quickreset_arabic.asp
│   │   │   ├── ./html/html/management/quickreset.asp
│   │   │   ├── ./html/html/management/reset.asp
│   │   │   └── ./html/html/management/voicelogview.asp
│   │   ├── ./html/html/msgerrcode.asp
│   │   ├── ./html/html/network
│   │   │   ├── ./html/html/network/ipv6.asp
│   │   │   ├── ./html/html/network/qos.asp
│   │   │   ├── ./html/html/network/qosclass.asp
│   │   │   ├── ./html/html/network/qos_eth.asp
│   │   │   ├── ./html/html/network/qosindex.asp
│   │   │   ├── ./html/html/network/qosummary.asp
│   │   │   ├── ./html/html/network/rip.asp
│   │   │   ├── ./html/html/network/route6.asp
│   │   │   ├── ./html/html/network/route.asp
│   │   │   ├── ./html/html/network/tr069.asp
│   │   │   ├── ./html/html/network/tr111.asp
│   │   │   ├── ./html/html/network/umts.asp
│   │   │   └── ./html/html/network/uplink.asp
│   │   ├── ./html/html/ntwkall
│   │   │   ├── ./html/html/ntwkall/atm.asp
│   │   │   ├── ./html/html/ntwkall/dhcp6s.asp
│   │   │   ├── ./html/html/ntwkall/dhcp.asp
│   │   │   ├── ./html/html/ntwkall/dsl.asp
│   │   │   ├── ./html/html/ntwkall/dslinfo.asp
│   │   │   ├── ./html/html/ntwkall/ethenet.asp
│   │   │   ├── ./html/html/ntwkall/lanbind.asp
│   │   │   ├── ./html/html/ntwkall/ptm.asp
│   │   │   ├── ./html/html/ntwkall/radvd.asp
│   │   │   ├── ./html/html/ntwkall/sntp.asp
│   │   │   ├── ./html/html/ntwkall/umtsinfo.asp
│   │   │   ├── ./html/html/ntwkall/wan.asp
│   │   │   ├── ./html/html/ntwkall/waneth.asp
│   │   │   ├── ./html/html/ntwkall/wanumts.asp
│   │   │   ├── ./html/html/ntwkall/wlan.asp
│   │   │   ├── ./html/html/ntwkall/wlaninfo.asp
│   │   │   ├── ./html/html/ntwkall/wlbridge.asp
│   │   │   ├── ./html/html/ntwkall/wlmacflt.asp
│   │   │   └── ./html/html/ntwkall/wlwds.asp
│   │   ├── ./html/html/pin
│   │   │   ├── ./html/html/pin/pin.asp
│   │   │   ├── ./html/html/pin/pinerrcode.asp
│   │   │   ├── ./html/html/pin/pinlock.asp
│   │   │   └── ./html/html/pin/puk.asp
│   │   ├── ./html/html/privacypolicy.html
│   │   ├── ./html/html/pubinfo.asp
│   │   ├── ./html/html/quickcontent_arabic.asp
│   │   ├── ./html/html/quickcontent.asp
│   │   ├── ./html/html/relocation.asp
│   │   ├── ./html/html/security
│   │   │   ├── ./html/html/security/acl.asp
│   │   │   ├── ./html/html/security/appfilter.asp
│   │   │   ├── ./html/html/security/dosattack.asp
│   │   │   ├── ./html/html/security/firewall.asp
│   │   │   ├── ./html/html/security/ipfilter.asp
│   │   │   ├── ./html/html/security/macfilter.asp
│   │   │   └── ./html/html/security/urlfilter.asp
│   │   ├── ./html/html/status
│   │   │   ├── ./html/html/status/deviceinfo.asp
│   │   │   ├── ./html/html/status/dslinfo.asp
│   │   │   ├── ./html/html/status/ethenet.asp
│   │   │   ├── ./html/html/status/ethinfo.asp
│   │   │   ├── ./html/html/status/getStatus.asp
│   │   │   ├── ./html/html/status/internet.asp
│   │   │   ├── ./html/html/status/internetstatus.asp
│   │   │   ├── ./html/html/status/quickdeviceinfo.asp
│   │   │   ├── ./html/html/status/quickdslinfo.asp
│   │   │   ├── ./html/html/status/quickethenet.asp
│   │   │   ├── ./html/html/status/quickethinfo.asp
│   │   │   ├── ./html/html/status/quickinternet.asp
│   │   │   ├── ./html/html/status/quickinternetstatus.asp
│   │   │   ├── ./html/html/status/quickumtsinfo.asp
│   │   │   ├── ./html/html/status/quickvoiceaccount.asp
│   │   │   ├── ./html/html/status/quickwlaninfo.asp
│   │   │   ├── ./html/html/status/umtsinfo.asp
│   │   │   └── ./html/html/status/wlaninfo.asp
│   │   └── ./html/html/wizard
│   │       ├── ./html/html/wizard/dslworkstate.asp
│   │       ├── ./html/html/wizard/quickdeviceinfo_arabic.asp
│   │       ├── ./html/html/wizard/quickdeviceinfo.asp
│   │       ├── ./html/html/wizard/quickstart.asp
│   │       ├── ./html/html/wizard/quickwan_arabic.asp
│   │       ├── ./html/html/wizard/quickwlan_arabic.asp
│   │       ├── ./html/html/wizard/quickwlan.asp
│   │       ├── ./html/html/wizard/scontent.asp
│   │       ├── ./html/html/wizard/sumgeneral.asp
│   │       ├── ./html/html/wizard/wizard_3G.asp
│   │       ├── ./html/html/wizard/wizard.asp
│   │       ├── ./html/html/wizard/wizard_bind.asp
│   │       ├── ./html/html/wizard/wizard_finish.asp
│   │       ├── ./html/html/wizard/wizard_guide.asp
│   │       ├── ./html/html/wizard/wizard_IPv6.asp
│   │       └── ./html/html/wizard/wizard_WiFi.asp
│   ├── ./html/images
│   │   ├── ./html/images/absent.gif
│   │   ├── ./html/images/advance.gif
│   │   ├── ./html/images/basic.gif
│   │   ├── ./html/images/bg_bottom.gif
│   │   ├── ./html/images/bg_middle.gif
│   │   ├── ./html/images/bg_top.gif
│   │   ├── ./html/images/btnclick.gif
│   │   ├── ./html/images/btnheadactive.gif
│   │   ├── ./html/images/btnheadclick.gif
│   │   ├── ./html/images/btnheadinit.gif
│   │   ├── ./html/images/btninit.gif
│   │   ├── ./html/images/cancel.gif
│   │   ├── ./html/images/clicktableft.gif
│   │   ├── ./html/images/clicktabmid.gif
│   │   ├── ./html/images/clicktabright.gif
│   │   ├── ./html/images/collapsemenu.gif
│   │   ├── ./html/images/expandmenu.gif
│   │   ├── ./html/images/favicon.ico
│   │   ├── ./html/images/file.gif
│   │   ├── ./html/images/firstmenu.gif
│   │   ├── ./html/images/folder_closed.gif
│   │   ├── ./html/images/folder-closed.gif
│   │   ├── ./html/images/helpclick.gif
│   │   ├── ./html/images/helpinit.gif
│   │   ├── ./html/images/helpmain.gif
│   │   ├── ./html/images/helpover.gif
│   │   ├── ./html/images/huaweidevice.gif
│   │   ├── ./html/images/info.gif
│   │   ├── ./html/images/inithelp.gif
│   │   ├── ./html/images/inittableft.gif
│   │   ├── ./html/images/inittabmid.gif
│   │   ├── ./html/images/inittabright.gif
│   │   ├── ./html/images/ipv6.gif
│   │   ├── ./html/images/key.png
│   │   ├── ./html/images/language.gif
│   │   ├── ./html/images/leftblock.gif
│   │   ├── ./html/images/loadingAnimation.gif
│   │   ├── ./html/images/logclickleft.gif
│   │   ├── ./html/images/logclickmid.gif
│   │   ├── ./html/images/logclickright.gif
│   │   ├── ./html/images/loginbackground.gif
│   │   ├── ./html/images/loginclicktableft.gif
│   │   ├── ./html/images/loginclicktabmid.gif
│   │   ├── ./html/images/loginclicktabright.gif
│   │   ├── ./html/images/login.gif
│   │   ├── ./html/images/logininittableft.gif
│   │   ├── ./html/images/logininittabmid.gif
│   │   ├── ./html/images/logininittabright.gif
│   │   ├── ./html/images/loginitleftt.gif
│   │   ├── ./html/images/loginitright.gif
│   │   ├── ./html/images/loginleft.gif
│   │   ├── ./html/images/loginmid.gif
│   │   ├── ./html/images/loginmovetableft.gif
│   │   ├── ./html/images/loginmovetabmid.gif
│   │   ├── ./html/images/loginmovetabright.gif
│   │   ├── ./html/images/loginright.gif
│   │   ├── ./html/images/logleft.gif
│   │   ├── ./html/images/logmid.gif
│   │   ├── ./html/images/lognitmid.gif
│   │   ├── ./html/images/logoback.gif
│   │   ├── ./html/images/logofoot_arabic.gif
│   │   ├── ./html/images/logofoot.gif
│   │   ├── ./html/images/logo.gif
│   │   ├── ./html/images/LOGO.png
│   │   ├── ./html/images/logotop.gif
│   │   ├── ./html/images/logout.gif
│   │   ├── ./html/images/logright.gif
│   │   ├── ./html/images/maintain.gif
│   │   ├── ./html/images/midblock.gif
│   │   ├── ./html/images/minus.gif
│   │   ├── ./html/images/OnLine.gif
│   │   ├── ./html/images/password_1.gif
│   │   ├── ./html/images/password_2.gif
│   │   ├── ./html/images/password_3.gif
│   │   ├── ./html/images/password.gif
│   │   ├── ./html/images/pic_t_disk.gif
│   │   ├── ./html/images/plus.gif
│   │   ├── ./html/images/portbind.gif
│   │   ├── ./html/images/ppppassword.png
│   │   ├── ./html/images/pppusername.png
│   │   ├── ./html/images/progress2M.gif
│   │   ├── ./html/images/rightblock.gif
│   │   ├── ./html/images/Sample.jpg
│   │   ├── ./html/images/SetupWizard.gif
│   │   ├── ./html/images/sigh.gif
│   │   ├── ./html/images/signal_01.gif
│   │   ├── ./html/images/signal_02.gif
│   │   ├── ./html/images/signal_03.gif
│   │   ├── ./html/images/signal_04.gif
│   │   ├── ./html/images/signal_05.gif
│   │   ├── ./html/images/signal_06.gif
│   │   ├── ./html/images/tabbar.gif
│   │   ├── ./html/images/top_bg.gif
│   │   ├── ./html/images/username.gif
│   │   ├── ./html/images/waiting.gif
│   │   ├── ./html/images/warn.gif
│   │   ├── ./html/images/Warning.png
│   │   └── ./html/images/wlanssid.png
│   ├── ./html/js
│   │   ├── ./html/js/adminmenu.js
│   │   ├── ./html/js/jquery_mini.js
│   │   ├── ./html/js/jquery_treeview.js
│   │   ├── ./html/js/menutree.js
│   │   ├── ./html/js/quickmenu_arabic.js
│   │   ├── ./html/js/quickmenu.js
│   │   ├── ./html/js/quickmenutree_arabic.js
│   │   ├── ./html/js/quickmenutree.js
│   │   ├── ./html/js/tabinfo.js
│   │   ├── ./html/js/tabinfo_user.js
│   │   ├── ./html/js/thickbox.js
│   │   ├── ./html/js/usermenu.js
│   │   └── ./html/js/util.js
│   ├── ./html/lang
│   │   ├── ./html/lang/en
│   │   │   ├── ./html/lang/en/account.res
│   │   │   ├── ./html/lang/en/acl.res
│   │   │   ├── ./html/lang/en/alg.res
│   │   │   ├── ./html/lang/en/appfilter.res
│   │   │   ├── ./html/lang/en/atm.res
│   │   │   ├── ./html/lang/en/cfgfile.res
│   │   │   ├── ./html/lang/en/ddns.res
│   │   │   ├── ./html/lang/en/device.res
│   │   │   ├── ./html/lang/en/dhcp6s.res
│   │   │   ├── ./html/lang/en/dhcp.res
│   │   │   ├── ./html/lang/en/diagnose.res
│   │   │   ├── ./html/lang/en/dms_list.res
│   │   │   ├── ./html/lang/en/dms.res
│   │   │   ├── ./html/lang/en/dmz.res
│   │   │   ├── ./html/lang/en/dosattack.res
│   │   │   ├── ./html/lang/en/dslinfo.res
│   │   │   ├── ./html/lang/en/dsl.res
│   │   │   ├── ./html/lang/en/ethenet.res
│   │   │   ├── ./html/lang/en/ethinfo.res
│   │   │   ├── ./html/lang/en/firewall.res
│   │   │   ├── ./html/lang/en/firmware.res
│   │   │   ├── ./html/lang/en/footer.res
│   │   │   ├── ./html/lang/en/ftp.res
│   │   │   ├── ./html/lang/en/ftpserver.res
│   │   │   ├── ./html/lang/en/help_content.html
│   │   │   ├── ./html/lang/en/help_content_user.html
│   │   │   ├── ./html/lang/en/igmpproxy.res
│   │   │   ├── ./html/lang/en/igmpsnooping.res
│   │   │   ├── ./html/lang/en/internet.res
│   │   │   ├── ./html/lang/en/internetstatus.res
│   │   │   ├── ./html/lang/en/ipfilter.res
│   │   │   ├── ./html/lang/en/ipv6.res
│   │   │   ├── ./html/lang/en/lanname.res
│   │   │   ├── ./html/lang/en/logcfg.res
│   │   │   ├── ./html/lang/en/logo.res
│   │   │   ├── ./html/lang/en/logview.res
│   │   │   ├── ./html/lang/en/macfilter.res
│   │   │   ├── ./html/lang/en/mirror.res
│   │   │   ├── ./html/lang/en/msgerrcode.res
│   │   │   ├── ./html/lang/en/multinat.res
│   │   │   ├── ./html/lang/en/pinerrcode.res
│   │   │   ├── ./html/lang/en/pinlock.res
│   │   │   ├── ./html/lang/en/pin.res
│   │   │   ├── ./html/lang/en/portmapping.res
│   │   │   ├── ./html/lang/en/porttrigger.res
│   │   │   ├── ./html/lang/en/PrintServer.res
│   │   │   ├── ./html/lang/en/ptm.res
│   │   │   ├── ./html/lang/en/pubinfo.res
│   │   │   ├── ./html/lang/en/pubStr.res
│   │   │   ├── ./html/lang/en/puk.res
│   │   │   ├── ./html/lang/en/qosclass.res
│   │   │   ├── ./html/lang/en/qos.res
│   │   │   ├── ./html/lang/en/qosummary.res
│   │   │   ├── ./html/lang/en/quickdeviceinfo.res
│   │   │   ├── ./html/lang/en/quickmenu.res
│   │   │   ├── ./html/lang/en/quickreset.res
│   │   │   ├── ./html/lang/en/quickstart.res
│   │   │   ├── ./html/lang/en/quickwlan.res
│   │   │   ├── ./html/lang/en/radvd.res
│   │   │   ├── ./html/lang/en/reset.res
│   │   │   ├── ./html/lang/en/rip.res
│   │   │   ├── ./html/lang/en/route6.res
│   │   │   ├── ./html/lang/en/route.res
│   │   │   ├── ./html/lang/en/samba.res
│   │   │   ├── ./html/lang/en/sharedir.res
│   │   │   ├── ./html/lang/en/sntp.res
│   │   │   ├── ./html/lang/en/staticdhcp.res
│   │   │   ├── ./html/lang/en/tr069.res
│   │   │   ├── ./html/lang/en/tr111.res
│   │   │   ├── ./html/lang/en/umtsinfo.res
│   │   │   ├── ./html/lang/en/umts.res
│   │   │   ├── ./html/lang/en/uplink.res
│   │   │   ├── ./html/lang/en/upnp.res
│   │   │   ├── ./html/lang/en/urlfilter.res
│   │   │   ├── ./html/lang/en/waneth.res
│   │   │   ├── ./html/lang/en/wan.res
│   │   │   ├── ./html/lang/en/wanumts.res
│   │   │   ├── ./html/lang/en/wizard.res
│   │   │   ├── ./html/lang/en/wlaninfo.res
│   │   │   ├── ./html/lang/en/wlan.res
│   │   │   ├── ./html/lang/en/wlbridge.res
│   │   │   ├── ./html/lang/en/wlmacflt.res
│   │   │   └── ./html/lang/en/wlwds.res
│   │   └── ./html/lang/zh
│   │       ├── ./html/lang/zh/account.res
│   │       ├── ./html/lang/zh/acl.res
│   │       ├── ./html/lang/zh/alg.res
│   │       ├── ./html/lang/zh/appfilter.res
│   │       ├── ./html/lang/zh/atm.res
│   │       ├── ./html/lang/zh/cfgfile.res
│   │       ├── ./html/lang/zh/ddns.res
│   │       ├── ./html/lang/zh/device.res
│   │       ├── ./html/lang/zh/dhcp6s.res
│   │       ├── ./html/lang/zh/dhcp.res
│   │       ├── ./html/lang/zh/diagnose.res
│   │       ├── ./html/lang/zh/dmz.res
│   │       ├── ./html/lang/zh/dosattack.res
│   │       ├── ./html/lang/zh/dslinfo.res
│   │       ├── ./html/lang/zh/ethenet.res
│   │       ├── ./html/lang/zh/ethinfo.res
│   │       ├── ./html/lang/zh/firewall.res
│   │       ├── ./html/lang/zh/firmware.res
│   │       ├── ./html/lang/zh/footer.res
│   │       ├── ./html/lang/zh/ftp.res
│   │       ├── ./html/lang/zh/ftpserver.res
│   │       ├── ./html/lang/zh/help_content.html
│   │       ├── ./html/lang/zh/igmpproxy.res
│   │       ├── ./html/lang/zh/igmpsnooping.res
│   │       ├── ./html/lang/zh/internet.res
│   │       ├── ./html/lang/zh/internetstatus.res
│   │       ├── ./html/lang/zh/ipfilter.res
│   │       ├── ./html/lang/zh/lanname.res
│   │       ├── ./html/lang/zh/logcfg.res
│   │       ├── ./html/lang/zh/logo.res
│   │       ├── ./html/lang/zh/logview.res
│   │       ├── ./html/lang/zh/macfilter.res
│   │       ├── ./html/lang/zh/mirror.res
│   │       ├── ./html/lang/zh/msgerrcode.res
│   │       ├── ./html/lang/zh/multinat.res
│   │       ├── ./html/lang/zh/pinerrcode.res
│   │       ├── ./html/lang/zh/pinlock.res
│   │       ├── ./html/lang/zh/pin.res
│   │       ├── ./html/lang/zh/portmapping.res
│   │       ├── ./html/lang/zh/porttrigger.res
│   │       ├── ./html/lang/zh/PrintServer.res
│   │       ├── ./html/lang/zh/ptm.res
│   │       ├── ./html/lang/zh/pubinfo.res
│   │       ├── ./html/lang/zh/pubStr.res
│   │       ├── ./html/lang/zh/puk.res
│   │       ├── ./html/lang/zh/qosclass.res
│   │       ├── ./html/lang/zh/qos.res
│   │       ├── ./html/lang/zh/quickdeviceinfo.res
│   │       ├── ./html/lang/zh/quickmenu.res
│   │       ├── ./html/lang/zh/quickreset.res
│   │       ├── ./html/lang/zh/quickwlan.res
│   │       ├── ./html/lang/zh/radvd.res
│   │       ├── ./html/lang/zh/reset.res
│   │       ├── ./html/lang/zh/rip.res
│   │       ├── ./html/lang/zh/route6.res
│   │       ├── ./html/lang/zh/route.res
│   │       ├── ./html/lang/zh/samba.res
│   │       ├── ./html/lang/zh/sharedir.res
│   │       ├── ./html/lang/zh/sntp.res
│   │       ├── ./html/lang/zh/staticdhcp.res
│   │       ├── ./html/lang/zh/tr069.res
│   │       ├── ./html/lang/zh/tr111.res
│   │       ├── ./html/lang/zh/umtsinfo.res
│   │       ├── ./html/lang/zh/umts.res
│   │       ├── ./html/lang/zh/uplink.res
│   │       ├── ./html/lang/zh/upnp.res
│   │       ├── ./html/lang/zh/urlfilter.res
│   │       ├── ./html/lang/zh/waneth.res
│   │       ├── ./html/lang/zh/wan.res
│   │       ├── ./html/lang/zh/wanumts.res
│   │       ├── ./html/lang/zh/wizard.res
│   │       ├── ./html/lang/zh/wlaninfo.res
│   │       ├── ./html/lang/zh/wlan.res
│   │       ├── ./html/lang/zh/wlmacflt.res
│   │       └── ./html/lang/zh/wlwds.res
│   └── ./html/webfilterparam.h
├── ./lib
│   ├── ./lib/codepages
│   ├── ./lib/extra
│   │   ├── ./lib/extra/bcm_bpm.ko
│   │   ├── ./lib/extra/bcm_enet.ko
│   │   ├── ./lib/extra/bcmfap.ko
│   │   ├── ./lib/extra/bcm_ingqos.ko
│   │   ├── ./lib/extra/p8021ag.ko
│   │   ├── ./lib/extra/pktflow.ko
│   │   └── ./lib/extra/wl.ko
│   ├── ./lib/kernel
│   │   ├── ./lib/kernel/crypto
│   │   │   ├── ./lib/kernel/crypto/ecb.ko
│   │   │   └── ./lib/kernel/crypto/pcbc.ko
│   │   ├── ./lib/kernel/drivers
│   │   │   ├── ./lib/kernel/drivers/scsi
│   │   │   │   └── ./lib/kernel/drivers/scsi/scsi_wait_scan.ko
│   │   │   ├── ./lib/kernel/drivers/usb
│   │   │   │   └── ./lib/kernel/drivers/usb/serial
│   │   │   │       └── ./lib/kernel/drivers/usb/serial/option.ko
│   │   │   └── ./lib/kernel/drivers/watchdog
│   │   │       └── ./lib/kernel/drivers/watchdog/bcmdog.ko
│   │   └── ./lib/kernel/net
│   │       └── ./lib/kernel/net/ipv4
│   │           └── ./lib/kernel/net/ipv4/netfilter
│   │               └── ./lib/kernel/net/ipv4/netfilter/ipt_REJECT.ko
│   ├── ./lib/ld-uClibc.so.0
│   ├── ./lib/libatputil.so
│   ├── ./lib/libatshared.so
│   ├── ./lib/libavcodec.so -> libavcodec.so.52
│   ├── ./lib/libavcodec.so.52
│   ├── ./lib/libavformat.so -> libavformat.so.52
│   ├── ./lib/libavformat.so.52
│   ├── ./lib/libavutil.so -> libavutil.so.49
│   ├── ./lib/libavutil.so.49
│   ├── ./lib/libbhalapi.so
│   ├── ./lib/libcfmapi.so
│   ├── ./lib/libcrypto.so
│   ├── ./lib/libcrypt.so.0
│   ├── ./lib/libc.so.0
│   ├── ./lib/libdhcpoptionsapi.so
│   ├── ./lib/libdhcpstackapi.so
│   ├── ./lib/libdlna.so
│   ├── ./lib/libdl.so.0
│   ├── ./lib/libethswctl.so
│   ├── ./lib/libfcctl.so
│   ├── ./lib/libgcc_s.so.1
│   ├── ./lib/libgplutil.so
│   ├── ./lib/libhttpapi.so
│   ├── ./lib/libiconv.so -> libiconv.so.2.5.0
│   ├── ./lib/libiconv.so.2 -> libiconv.so.2.5.0
│   ├── ./lib/libiconv.so.2.5.0
│   ├── ./lib/libiupnp.so
│   ├── ./lib/libiw.so.29
│   ├── ./lib/libixml.so
│   ├── ./lib/libmdbapi.so
│   ├── ./lib/libmsgapi.so
│   ├── ./lib/libm.so.0
│   ├── ./lib/libnsl.so.0
│   ├── ./lib/libntfs-3g.so.73
│   ├── ./lib/libntfs-3g.so.79
│   ├── ./lib/libnvram.so
│   ├── ./lib/libpthread.so.0
│   ├── ./lib/libresolv.so.0
│   ├── ./lib/librsa.so
│   ├── ./lib/librt.so.0
│   ├── ./lib/libsqlite.so
│   ├── ./lib/libssl.so -> libcrypto.so
│   ├── ./lib/libstuncapir.so
│   ├── ./lib/libthread_db.so.1
│   ├── ./lib/libthreadutil.so
│   ├── ./lib/libutil.so.0
│   ├── ./lib/libwlbcmcrypto.so
│   ├── ./lib/libwlbcmshared.so
│   ├── ./lib/libwlctl.so
│   ├── ./lib/libwl_server_socket.so
│   ├── ./lib/libwlupnp.so
│   ├── ./lib/libwps.so
│   ├── ./lib/libxmlapi.so
│   ├── ./lib/libz.so
│   ├── ./lib/libz.so.1 -> libz.so
│   └── ./lib/modules
├── ./linuxrc -> bin/busybox
├── ./mnt
├── ./proc
├── ./sbin
│   ├── ./sbin/arp -> ../bin/busybox
│   ├── ./sbin/fdisk -> ../bin/busybox
│   ├── ./sbin/flash_eraseall -> ../bin/busybox
│   ├── ./sbin/halt -> ../bin/busybox
│   ├── ./sbin/ifconfig -> ../bin/busybox
│   ├── ./sbin/init -> ../bin/busybox
│   ├── ./sbin/insmod -> ../bin/busybox
│   ├── ./sbin/iwpriv
│   ├── ./sbin/poweroff -> ../bin/busybox
│   ├── ./sbin/reboot -> ../bin/busybox
│   ├── ./sbin/route -> ../bin/busybox
│   ├── ./sbin/smuxctl -> ../bin/busybox
│   ├── ./sbin/vconfig -> ../bin/busybox
│   └── ./sbin/zcip -> ../bin/busybox
├── ./tmp
├── ./usr
│   └── ./usr/bin
│       ├── ./usr/bin/[ -> ../../bin/busybox
│       ├── ./usr/bin/[[ -> ../../bin/busybox
│       ├── ./usr/bin/ftpget -> ../../bin/busybox
│       ├── ./usr/bin/ftpput -> ../../bin/busybox
│       ├── ./usr/bin/killall -> ../../bin/busybox
│       ├── ./usr/bin/test -> ../../bin/busybox
│       ├── ./usr/bin/top -> ../../bin/busybox
│       ├── ./usr/bin/traceroute -> ../../bin/busybox
│       └── ./usr/bin/wget -> ../../bin/busybox
├── ./var
└── ./vmlinux.lz
 
48 directories, 669 files
↧

AVR – Detecting loss of power and writing to EEPROM

July 9, 2014, 3:41 am
$
0
0

As part of a recent AVR project, I wanted a way to increment a counter and store it even if the power was lost. This could be done with an external flash memory device, but I wanted to use the internal EEPROM of the AVR.

The internal EEPROM is limited to around 100,000 writes. Independent tests have shown this can be doubled, but 100k writes is only about 27 hours if saved once every second, so not practical for a device I wanted to last at least five years.

It takes a maximum of 34ms (8448us per byte) to write a 32 bit (4 byte) integer to EEPROM. Due to the low power requirements of an AVR, I was confident that a decent sized (say 2200uF) capacitor would allow an AVR plenty of running time to complete EEPROM writes/saves before power is totally lost.

I decided to use the Analog Comparator on an AVR. The analog comparator works by comparing the voltage presented to AIN1 and AIN0. A “falling edge” event is the point where the voltage at AIN1 drops below the voltage at AIN0. This allows me to fire an interrupt on loss of power. I had a spare ATMEGA328P to use, but provided your application doesn’t require the extra I/O, even an ATTINY85 has the necessary analog comparator to do this.

I first tried a very basic circuit where the AVR was powered off a 2200uF capacitor which was charged through a Schottky diode – the diode is to prevent the capacitor’s charge going back into the supply on loss of power. AIN0 was connected to the capacitor +ve while AIN1 was connected direct to the supply voltage. Adding the diode is a double edged sword as it means the AVR is now running off a supply a diode voltage drop (~0.3v for a Schottky diode) lower than usual, reducing the running time off the capacitor, but it also means that the analog comparator shouldn’t be noisy due to the generous 0.3v difference.

This circuit worked for total loss of power such as a broken supply wire, but when the supply was simply turned off it didn’t work. My oscilloscope showed this was due to the large capacitors in the power supply causing the voltage to drop too slowly meaning that the supply voltage never dropped below the capacitor voltage – both voltages simply dropped in unison. A solution to this could be to add more capacitors to the circuit, but I decided to increase my supply voltage to 12 volts and use a 5 volt linear regulator. This would allow me to detect power failure while the regulator is still outputting a clean 5 volts.

Here is my circuit:

AVR voltage loss detection circuit

AVR voltage loss detection circuit

An LM7805 regulator outputs a stable 5 volts provided the input voltage is above 8 volts. It will continue to work (with a bit of output voltage ripple) down to 7 volts, and is unreliable below 7 volts. The regulator shouldn’t even need a heatsink as we’re drawing well under 50mA of power – With a 7 volt difference between vIn and vOut, this is only 350mW (The LM7805 temperature will typically rise approx 50 degrees C per watt dissipated).

I’m aiming for my circult to detect a supply voltage below ~8v as a loss of power.

This circuit provides a ~2.5 volt reference voltage to AIN0 by dividing the 5v from the regulator via R4 (10K) and R5 (10K).

The supply voltage is dropped around 0.3v through a Schottky diode and then divided at a 10:32 ratio (~1/3) via R1 (22K) and R2 (10K) and presented to AIN1.

For the capacitor C1, I suggest a the largest electrolytic capacitor you can get (within reason). My local electronics store (Jaycar) sells 16 volt, 4700uF electrolytic caps for a reasonable ($2.50) price so I went with one of these.

Here is some source code demonstrating how to enable and use the Analog comparator interrupt. This code is for an ATMega328, but should work on most other devices with minimal changes.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

#include <avr/io.h>
#include <util/delay.h>
#include <avr/interrupt.h>  
#include <avr/eeprom.h>
 
void init() {
    cli();
 
    //SET UP THE ANALOG COMPARATOR INTERRUPT
    ACSR =
        (0<<ACD)|               //Comparator ON
        (1<ACI)|                //Stop interrupt being called immediately
        (1<<ACIE)|              //Enable Comparator Interrupt
        (1<<ACIS1)|(0<<ACIS0);  //Comparator Interrupt on Falling Output Edge.
 
    //ENABLE INTERRUPTS
    ACSR |= (1<ACI);
}
 
int main (void) {
    init();
    sei();                      //Set the global interrupt flag
 
    while(1)
    {
                                //Main program loop
    }
 
    return 1;
}
 
// Interrupt handler for Analog Comparator ANA_COMP_vect
ISR(ANALOG_COMP_vect) {
    //Power loss has been detected!!!!
    //saveImportantValue();
}
↧
↧

This website is now exclusively SSL

August 11, 2014, 12:02 pm
$
0
0

Google have announced (Ironically via a non SSL website) that they will now take into account whether sites use secure, encrypted connections as a component of their ranking algorithm.

On this announcement I’ve switched my website to exclusively use SSL. It will now silently (but forcefully, like a Ninja) redirect you to the https version.

↧

Pulsecounter PCB’s have arrived

August 12, 2014, 2:56 am
$
0
0

I posted recently about detecting power loss in an AVR and quickly writing values to EEPROM before power is lost completely and have since received the PCB’s I ordered from oshpark.

This is the first time I have ever ordered professionally made PCBs. I’ve made many using photo resist or toner transfer, but at US$5.00 per square inch for three boards (including worldwide postage) I decided to give it a go. It took a total of three weeks from placing the order to arriving in New Zealand.

This is OshParks render of what the Top was meant to look like

This is OshParks render of what the Top was meant to look like



...and the bottom

…and the bottom

And this is what they arrived looking like.

And this is what they arrived looking like.

I don’t think I’ll ever make a board by hand again (provided I can wait the manufacture and delivery time). This order came to US$9.10 for three boards…

↧

dump1090 binary built for Raspberry Pi / Arm

August 25, 2014, 10:41 am
$
0
0

If you’re after a binary of dump1090 for the Raspberry Pi without having to build it, here’s a compiled binary for you.

I built it on Arch linux, but it also works on Raspbian, or likely any other Arm processor as well.

It’s version 1.09.0608.14 of the MalcolmRobb fork

You can download it from here:
https://www.john.geek.nz/wp-content/uploads/2014/08/dump1090.tar.bz2

It requires rtl-sdr which is available for raspian (apt-get install rtl-sdr) or Arch (pacman -Sy rtl-sdr).

If you’re using Arch and unsure…

1
2
3
4
5
6
7
8
9

pacman -Sy rtl-sdr
cd /
mkdir ADS-B
cd ADS-B
wget https://www.john.geek.nz/wp-content/uploads/2014/08/dump1090.tar.bz2
tar -jxvf dump1090.tar.bz2
rm dump1090.tar.bz2
cd dump1090
./dump1090 --help

Here’s a service file for dump1090 so you can control it using systemctl. Thsi enables the network interface on the default of port 30003

1
2
3
4
5
6
7
8
9
10

[Unit]
Description=dump1090
 
[Service]
WorkingDirectory=/ADS-B/dump1090/
ExecStart=/ADS-B/dump1090/dump1090 --quiet --enable-agc --aggressive --net
Restart=on-failure
 
[Install]
WantedBy=multi-user.target

If you’re using Arch, this will install, enable and start the dump1090 service.

1
2
3
4
5

cd /etc/systemd/system
wget https://www.john.geek.nz/wp-content/uploads/2014/08/dump1090.service
systemctl enable dump1090.service
systemctl start dump1090.service
systemctl status dump1090.service
↧
Viewing all 42 articles
Browse latest View live
Search