Haxorware Forums

Full Version: CODA-4582 Test Mode
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Hello, I have a Hitron CODA-4582 that boots to a CLI, but from what I can tell the shell is running on the arm cpu and the atom cpu with the interesting stuff isn't accessible. 

I was able mount some of the partitions on the nvram and it seems there's a program for interacting between the arm and atom, 'ncpu_exec', but it's not present in any of the bin directories. Any clues for next steps? I don't really have an end goal here, just poking around. Originally I wanted to be able to encrypt/decrypt the config for a separate modem, a coda-4680 and so I found the functions on this one for encrypting and decrypting but it doesn't seem to be the same for the 4680.

Some output:

Console, CLI version
Type 'help' for list of commands

mainMenu> help
Console Commands for this level:
system               - Go to system Menu.
logger               - Go to Logger Menu.
eventm               - Go to Event Manager Menu.
getManifest          - Prints manifest.
version              - prints system version.
docsis               - Go to DOCSIS Menu.
help                 - Display menu commands, with optional <cmd>, displays only matching commands.
shortcuts            - Display key shortcuts help.
exit                 - Exit this sub-menu, go to previous menu.
shell                - Enter Linux shell [<Linux Command>]
        without parameters CLI stays running in the background.
quit                 - Quit and terminate CLI.
reboot               - Reboot the system.
batch                - execute batch of CLI commands from file
        <filename> - the file may contain comment lines starting with # character
        [<on/off>] - verbose commands printing.
wait                 - wait for <msec>.
/<search expression> - '/' allows search of CLI Help for any command using grep like search.

Cougar Mountain B0 - Boot Ram.
Version: 0.3.3 (Apr 24 2017, 14:24:33)
Boot Param memory dump:
[0xFFFF3FFC] - 0x00030003
[0xFFFF3FF8] -FFF3FC0] - 0x00000000
[0xFFFF3FBC] - 0x00000001
[0xFFFF3FB8] - 0x00000007
[0xFFFF3FB4] - 0x00000000
[0xFFFF3FB0] - 0x0000000 done, booting the kernel.
systemd 216 running in system mode. (-PAM -AUDIT -SELINUX -IMA -APPARMOR -SMACK +SYSVINIT -LIBCRYPTSETUP -GCRYPT -GNUTLS -ACL -XZ -LZ4 -SECCOMP -BLKID -ELFUTILS -KMOD -IDN )[  OK  ] Reached target Remote File Systems.
[  OK  ] Reached target Paths.
[  OK  ] Reached target[  OK  ] Created slice Root Slice.
[  OK  ] Listening on /dev/initctl Compatibility Named Pipe.
[  OK  ] LPuma filesystem setup...
        Starting Remount Root and Kernel File Systems...
        Starting Adjusting Puma kernel set         Starting Apply Kernel Variables...
        Starting Create Static Device Nodes in /dev...
        Starting udev Coldplu Starting Journal Service...
[  OK  ] Started Journal Service.
[  OK  ] Reached target Slices.
        Mounting Temporary Directory...
[  OK  ] Started Apply Kernel Variables.
[  OK  ] Started Create Static Device Nodes in /dev.
[  OK  ] Started Remount Root and Kernel File Systems.
[  OK  ] Mounted Temporary Directory.

About to set realtime runtime...

[  OK  ] Started udev Coldplug all Devices.
[  OK  ] Reached target Loc         Starting udev Kernel Device Manager...
[  OK  ] Started Adjusting Puma kernel settings.
[  OK  ] Mounted /var/volatile.
[  OK  ] Started udev Kernel Device Manager.
mount -t ext3 /dev/mmcblk0p16 /nvram -o data=journal -o barrier=1
/dev/mmcblk0p16 mounted successfuly to /nvram
[  OK  ] Started Puma filesystem setup.
        Starting Bind mount volatile /var/lib...
        Starting Bind mount volatile /etc/passwd...
        Starting Bind mount volatile /etc/shadow...
[  OK  ] Started Bind mount volatile /var/lib.
[  OK  ] Started Bind mount volatile /etc/passwd.
[  OK  ] Started Bind mount volatile /etc/shadow.
[  OK  ] Reached target Local File Systems.
        Starting Trigger Flushing of Journal to Persistent Storage...
        Starting Create Volatile Files and Directories...
        Starting Puma setup...
Build date: Thursday, April 29 202Copyright (c) 2011, Intel Corporation.

[  OK  ] Started Trigger Flushing of Journal to Persistent Storage.
[  OK  ] Started Update UTMP about System Boot/Shutdown.
[  OK  ] Reached target System Initialization.
[  OK  ] Listening on D-Bus System Message Bus Socket.
[  OK  ] Reached target Timers.
DISTRO_NAME       = "DOCSIS 3.1 Cable Modem"
TUNE_FEATURES     = "armv6 thumb bigendian arm1176jzs"
meta-intelce-arm-common = "(nobranch):4ca5d296396942245b42581e6a573bb49506b454"
meta-intelce-arm  = "(nobranch):310afa97cProductionDb_Init:2214 (pid=123): Restoring production DB from NVRAM ... SUCCESS
ProductionDb_FrequencyPlanValidity:3081 (pid=1[  OK  ] Started Puma setup.
        Starting Puma Packet Processor Driver init...
Setup memory config from file "/etc/sysctl_mem.conf"
vm.panic_on_oom = 2
vm.swappiness = 0
vm.overcommit_memory = 2
vm.overcommit_ratio = 100

hil_drv should be running now ...

The PP Doesn't exist in this image ...

[  OK  [  OK  ] Started Puma run validity checks.
        Starting Handshake...

Polling Atom Handshake Status...
Waiting for packet processor on Atom... (0)

Atom PP Initialization finished succussfully
[  OK  ] Started Handshake.
        Starting Puma Start up...
[DEBUG] main:93 puma_startup_mode STARTUP_MODE_FULL

[DEBUG] HWMB_Start:563 Start. Socket type SOCK_COMMANDER
[DEBUG] HWMB_i HWMB_sendRecvMsg:427 Send-Recv message...
[DEBUG] HWMB_sendRecvMsg:429 Sending message... [msgSize=8]
[DEBUG] HWMB_sendMsg:28==
[DEBUG] HWMB_sendRecvMsg:446 Receiving reply message...
[DEBUG] HWMB_recvMsg:348 Receiving message...
[DEBUG] HWMB_recvMsgng received HW_MBox message
[DEBUG] ParseAck:44 ACK received
[DEBUG] main:102 Done sending startup mode to Atom via HW_MBox Using DOCSIS Initialization process parameters: -debug1option 43 -debug1option 50

pcd: (184): Starting TI Process Control Daemon.
[  OK  ] Started Puma Start up.
[  OK  ] Reached target Sockets.
[  OK  ] Reached target Basic Syst[  OK  ] Started D-Bus System Message Bus.
pcd: (184): Loaded 97 rules.
pcd: Initialization complete.
pcd: (184): Starting process insmod (Rule DOCSIS_KINTR).
pcd: (184): Starting process insmod (Rue SYSTEM_GPTIMER).
pcd: (184): Starting process /usr/sbin/gim (Rule SYSTEM_GIM).
pcd: (184): Rule SYSTEM_WATCHDOG: Success (PrTI Watchdog-RT daemon started <kick interval = 10 seconds>
main:864 (pid=194): Initialized successfully

pcd: (184): Rule SYSTEM_GPTIMER: Success (Process /usr/sbin/gptimer (194)).
pcd: (184): Rule PUMA7SYSTEM_CRU_CTRL_MKNOD: Success (Process mknod (190)).
gim_init:133 (pid=195): GIM initializing...
gim_init:169 (pid=195): GIM initialization complete. GIM_MODULE=3087
pcd: (184): Rule SYSTEM_GIM: Success (Process /usr/sbin/gim (195)).
pcd: (184): Rule PUMA7SYSTEM_DATAPIPE_INSMOD: Success (Process insmod (189)).
pcd: (184): Rule DOCSIS_SOCIFDRV: Success (Process insmod (187)).
pcd: (184): Starting process mknod (Rule DOCSIS_MKNODSOCIFDRV).

pcd: (184): Rule DOCSIS_KINTR: Success (Process insmod (188)).
pcd: (184): Rule DOCSIS_MKNODSOCIFDRV: Success (Process mknod (212)).

[  OK  ] Reached target Multi-User System.
        Starting Update UTMP about System Runlevel Changes...
[  OK  ] Started Update UTMP about System Runlevel Chan
TI Logger: Init complete
pcd: (184): Rule SYSTEM_LOGGER: Success (Process /usr/sbin/logger (193)).
pcd: (184): Starting process /usr/sbin/hw_mbox_app (Rpcd: (184): Rule PUMA7SYSTEM_HW_MBOX_APP: Success (Process /usr/sbin/hw_mbox_app (222)).
pcd: (184): Starting process /usr/sbinpcd: (184): Rule PUMASYSTEM_LASTRULE: Success.

iniparser: cannot open /var/tmp/lsddb_rt.ini
pcd: (184): Rule SYSTEM_SHMDBINIT: Success (Process /usr/sbin/shmdb_init_app (223)).
pcd: (184): Starting process /usr/sbin/halpcpcd: (184): Rule PM_INIT_APP: Success (Process /usr/sbin/pm_init_app (247)).
Can't open /proc/sys/kernel/printk: No such file or directory
Failed to get printk console log level

GPT fdisk (gdisk) version 1.0.1

Partition table scan:
 MBR: protective
 BSD: not present
 APM: not present
 GPT: present

Found valid GPT with protective MBR; using GPT.
Disk /dev/mmcblk0: 1925120 sectors, 940.0 MiB
Logical sector size: 512 bytes
Disk identifier (GUID): 21126DBA-B4FF-4D7C-B8EF-64585FD41F3D
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1894366
Partitions will be aligned on 256-sector boundaries
Total free space is 222 sectors (111.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
  3             256             511   128.0 KiB   8300  SIGBLOCK0
  4             512           18943   9.0 MiB     EF00  APP_CPU_KERNEL0
  5           18944          207359   92.0 MiB    8300  APP_CPU_ROOTFS0
  6          207360          217599   5.0 MiB     8300  NP_CPU_KERNEL0
  7          217600          250367   16.0 MiB    8300  NP_CPU_ROOTFS0
  8          250368          332287   40.0 MiB    8300  GW_FS0
  9          332288          332543   128.0 KiB   8300  SIGBLOCK1
 10          332544          350975   9.0 MiB     EF00  APP_CPU_KERNEL1
 11          350976          539391   92.0 MiB    8300  APP_CPU_ROOTFS1
 12          539392          549631   5.0 MiB     8300  NP_CPU_KERNEL1
 13          549632          582399   16.0 MiB    8300  NP_CPU_ROOTFS1
 14          582400          664319   40.0 MiB    8300  GW_FS1
 15          664320          758527   46.0 MiB    8300  APP_CPU_NVRAM
 16          758528          875263   57.0 MiB    8300  NP_CPU_NVRAM
 17          875264          916223   20.0 MiB    8300  APP_CPU_LOG
 18          916224          957183   20.0 MiB    8300  NP_CPU_LOG
 19          957184         1894366   457.6 MiB   8300  THIRD_PARTY_FS

I was able to get to the atom interface via the other UART connection, it allows root login when in testmode but none of the network interfaces are loaded. I'm trying some of the systemctl services to see if they start that service