How to extract certificates and keys from Puma 6 devices

How to extract certificates and keys from Puma 6 devices - Printable Version

+- Haxorware Forums (http://www.haxorware.com/forums)
+-- Forum: General (http://www.haxorware.com/forums/forumdisplay.php?fid=6)
+--- Forum: Modems (http://www.haxorware.com/forums/forumdisplay.php?fid=7)
+--- Thread: How to extract certificates and keys from Puma 6 devices (/showthread.php?tid=13308)

How to extract certificates and keys from Puma 6 devices - EngTester - 14-02-2025

Hi everyone!

New members of the forum. It's been a while since I actively participated. I am familiar with the extraction of certs and keys from SB5101 using CMNonVol but now we are in a different age.

I have a legit Puma 6 and I want to be able to extract its certs and keys to begin testing again but I have no clue how.

Does anyone have a guide on how to extract these from Puma 6 modems? You can share it via PM if you don't want to make it public. I'll really appreciate it.

My plan is to develop some tools for learning/testing on DOCSIS 3.0.

Take care!

RE: How to extract certificates and keys from Puma 6 devices - bipin775 - 05-06-2025

You're right—things have definitely evolved since the SB5101 and CMNonVol days. Puma 6 modems are a different beast entirely, with updated security measures and architecture.
As for extracting certs and keys from a Puma 6 device, it’s considerably more difficult due to:

Enforced secure boot
Encrypted/non-readable flash
Hardware-level protections

Unless you have access to the bootloader or JTAG/UART (and potentially a vulnerable firmware version), most attempts will be blocked. That said, some researchers have explored UART access combined with legacy firmware exploits, but details are scarce for good reason—many forums and communities now enforce strict rules regarding cable modem tampering due to its legal and ethical implications.
If your intention is purely educational and for DOCSIS 3.0 lab testing:

Look into public DOCSIS simulation tools or virtual CMTS environments.
Consider using open-source CM or emulation projects rather than relying on hardware extraction.

Also, be cautious about any private guides—ensure you’re operating within legal boundaries, especially with ISP-certified devices.
Suppose you're a Website developer in Bhayandar working on educational or tech documentation sites. In that case, I’d suggest building a blog to document your journey—it could benefit others and showcase your expertise responsibly. Let me know if you'd like help setting that up!