The Belgacom Box 2 (BBOX2) is a router used by Belgacom, the most popular Internet Service Provider (ISP) of Belgium, to provide access to thousands of subscribers in the country. Statistics says that there are more then 300.000 of those boxes in circulation. It runs a modified version of Linux by default (OpenRG), and has 1 USB2.0 ports that allows people to modify it, and extend its features. News. 25 Mar 2014: I am looking for brave people to take good pictures of the PCB of the BBOX3, contact me at zoobab at gmail.com if you own one. 01 Sep 2013:, see also. 04 Jun 2013:.
Salve a tutti i membri di ilpuntotecnico.com, ho da qualche giorno acquistato su ebay un ALICE GATE VoIP 2 Plus Wi-Fi Dial Face, che voglio modificare. Dec 11, 2017 - High-speed Internet with VDSL/ADSL and impressive throughput rates • WLAN N with up to 300 Mbit/s in the 2.4 GHz band • Telephone system.
20 Apr 2012:. 20 Apr 2012:. 20 Apr 2012: moved from to. Public TFTP server still needs to be migrated.
22 Feb 2012:. 28 Dec 2011:. 14 Nov 2011:. 29 Oct 2011: and. 29 Oct 2011:. 29 Oct 2011:. 19 Oct 2011:.
01 Oct 2011:. 09 Feb 2011: runs on Ikanos vx180, with uboot+linux2.6.18,. 07 Feb 2011: is a hacked by guys (Italy), with normal U-boot (without encryption) and OpenWRT packages, for the kernel, Openwrt forum. 23 Jan 2011: installed a public TFTP server on. 24 Oct 2010: first with the livebox sources Hardware. 1 USB2.
2 FXS. 1 switch 4 ports. 1 serial. 1 wifi atheros. VDSL2.
Flash 16MB. RAM 64MB. 1 JTAG Pictures. Watchdog process control started. Devifad68xxadslstatuspoll: case 0 SAGEM Secure-boot v2.4.8 for ADI chipset CPU: ADI Fusiv 160 Family DRAM: 64 MB Flash: 16 MB Using default environment In: serial Out: serial Err: serial voxEmac PORT0PHYCTRLREG=12288good regular firmware partition not moved Launch regular code from flash ## Booting image at bf960140.
Image Name: FAST34646000G0 Created: 2008-07-09 14:59:33 UTC Image Type: MIPS Linux Kernel Image (gzip compressed) Data Size: 6770449 Bytes = 6.5 MB Load Address: 80010000 Entry Point: 80261000 Verifying Checksum. OK Uncompressing Kernel Image. OK Starting kernel. Linux version 2.6.15 #34 Wed Jul 9 16:59:28 CEST 2008 SDRAM size: 64Mb FLASH size: 16Mb CPU revision is: 6836c400 Init USB Host Determined physical RAM map: memory: 04000000 @ 00000000 (usable) memory: 01000000 @ 1f000000 (ROM data) Built 1 zonelists Kernel command line: console=ttyS0,57600 Primary instruction cache 16kB, linesize 32 bytes. Primary data cache 8kB, linesize 32 bytes.
Synthesized TLB refill handler (17 instructions). Synthesized TLB load handler fastpath (31 instructions).
Synthesized TLB store handler fastpath (31 instructions). Synthesized TLB modify handler fastpath (25 instructions). PID hash table entries: 512 (order: 9, 8192 bytes) Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 55972k/65536k available (2065k kernel code, 9500k reserved, 306k data, 104k init, 0k highmem) Mount-cache hash table entries: 512 Checking for 'wait' instruction. NET: Registered protocol family 16 Fusiv PCI: starting. SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub GPIO Initialisation (led/buttons/relays) JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
Zoobab@buzek /home/zoobab/tmp2 9$ telnet 192.168.1.1 Trying 192.168.1.1. Connected to 192.168.1.1. Escape character is '^'. Login: admin Password:. admin @ home$ shell BusyBox v1.01 (2010.01.26-) Built-in shell (ash) Enter 'help' for a list of built-in commands.
# # tftp -g -r busybox -l /tmp/busybox zoobab.dyndns.org (NOTE: it takes a while before giving you a shell back.) # ls -lh /tmp/busybox -rwxr-xr-x 1 0 0 974.0k Apr 5 18:12 /tmp/busybox You can create all symlinks to busybox in one command. /tmp # for i in `./busybox -help./grep 'Currently defined functions:' -A30./grep ' s.,'`; do ln -s busybox `echo $i./sed -e 's/,//g'`; done Kernel sources There seems to be some kernel sources here: It contains some adifusiv directory: linux-2.6.12.zip#uzip/linux-2.6/arch/mips/adifusiv There seems to be also an interesting patch here: Trying to find the sources to which the patch relates to FXS interface The seems to use the same kind of FXS chip (Si3215 instead of the Si3216 inside the bbox2). /. mp.c David Rowe 17 May 2009 Mesh Potato kernel mode driver for the Si Labs 3215 FXS chipset.
A bit bashed SPI interface is constructed using the Atheros AR2317 (aka AR5315) SoC GPIO pins. The SPI port is used for initialisation and signalling of the FXS port, the TDM speech data is transferred through the SoC RS232 port (via a hacked version of 8250.c driver). Credits: lots of SPI code and Si labs init code borrowed from Zaptel wcfxs.c driver (Wildcard TDM400P TDM FXS/FXO Interface Driver) written by Mark Spencer and Matthew Fredrickson. UrJTAG 0.10 #1864 Copyright (C) 2002, 2003 ETC s.r.o. Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors UrJTAG is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. There is absolutely no warranty for UrJTAG. Jtag.c:518 main Warning: UrJTAG may damage your hardware!
Type 'quit' to exit, 'help' for help. Jtag cable JTAGkey Connected to libftdi driver. Jtag detect discovery.c:117 urjtapdetectregistersize Warning: TDO seems to be stuck at 0 Error: parse.c:208 urjparsefile no error: Cannot open file '/home/zoobab/.jtag/rc' to parse jtag detect IR length: 5 Chain length: 1 Device Id: 11 (0x027D31CB) Manufacturer: Analog Devices, Inc.
(0x1CB) Unknown part! (010011) (/usr/local/share/urjtag/analog/PARTS) jtag detect IR length: 5 Chain length: 1 Device Id: 11 (0x027D31CB) Manufacturer: Analog Devices, Inc. (0x1CB) Unknown part! (010011) (/usr/local/share/urjtag/analog/PARTS) jtag jtag discovery Detecting IR length. 5 Detecting DR length for IR 11111. 1 Detecting DR length for IR 00000.
1 Detecting DR length for IR 00001. 671 Detecting DR length for IR 00010. 32 Detecting DR length for IR 00011. 671 Detecting DR length for IR 00100. 1 Detecting DR length for IR 00101.
1 Detecting DR length for IR 00110. 1 Detecting DR length for IR 00111. 306 Detecting DR length for IR 01000. 1 Detecting DR length for IR 01001. 1 Detecting DR length for IR 01010.
1 Detecting DR length for IR 01011. 1 Detecting DR length for IR 01100. 1 Detecting DR length for IR 01101. 1 Detecting DR length for IR 01110. 1 Detecting DR length for IR 01111. 1 Detecting DR length for IR 10000.
1 Detecting DR length for IR 10001. 1 Detecting DR length for IR 10010. 1 Detecting DR length for IR 10011. 1 Detecting DR length for IR 10100. 1 Detecting DR length for IR 10101.
1 Detecting DR length for IR 10110. 1 Detecting DR length for IR 10111. 1 Detecting DR length for IR 11000.
1 Detecting DR length for IR 11001. 1 Detecting DR length for IR 11010. 1 Detecting DR length for IR 11011. 1 Detecting DR length for IR 11100.
1 Detecting DR length for IR 11101. 1 Detecting DR length for IR 11110.
1 jtag jtag initbus ejtagdma Initialized bus 1, active bus 0 jtag print No. Manufacturer Part Stepping Instruction Register 0 (none) (none) Active bus:.0: EJTAG compatible bus driver via DMA (JTAG part No.
Root@buzek /tmp 2# while true; do wget done -2010-03-18 20:10:05- Connecting to 192.168.1.1:631. HTTP request sent, awaiting response. 200 OK Length: 10485760 (10M) application/octet-stream Saving to: `10m.4' 100% 10,485,760 2.51M/s in 4.0s 2010-03-18 20:10:09 (2.50 MB/s) - `10m.4' saved 1045760 -2010-03-18 20:10:09- Connecting to 192.168.1.1:631. HTTP request sent, awaiting response. 200 OK Length: 10485760 (10M) application/octet-stream Saving to: `10m.5' 100% 10,485,760 2.54M/s in 4.0s 2010-03-18 20:10:13 (2.53 MB/s) - `10m.5' saved 1045760 Files are accessible on hte web interface at port 631.
Presentation at Hackito Ergo Sum 2010 Slides Videos Links. ). Comments. Hackito Ergo Sum: Title: Hacking the Belgacom Box 2 Abstract: The Belgacom Box 2 is one of the most popular box in Belgium, which is used by the main internet service provider Belgacom. It is one of the first router with a VDSL2 interface, VoIP and an atheros card. It runs Linux by default (OpenRG), but no sources are available. This talk will provide technical details on how to add additional software to the device via cross-compilation with the OpenWRT framework, JTAG access, bootloader replacement and experience with a widespread GPL violation.