Haxorware Forums - Modems

How to extract certificates and keys from Puma 6 devices

Fri, 14 Feb 2025 16:01:07 +0100

Hi everyone!

New members of the forum. It's been a while since I actively participated. I am familiar with the extraction of certs and keys from SB5101 using CMNonVol but now we are in a different age.

I have a legit Puma 6 and I want to be able to extract its certs and keys to begin testing again but I have no clue how.

Does anyone have a guide on how to extract these from Puma 6 modems? You can share it via PM if you don't want to make it public. I'll really appreciate it.

My plan is to develop some tools for learning/testing on DOCSIS 3.0.

Take care!

What ECC algorithm is used in Arris TG1672G NAND ?

Sat, 28 Dec 2024 02:10:45 +0100

Hello,
I have multiple dumps from multiple devices, and I see that some dumps have 52 bytes in OOB (spare), some 56 and a gap with multiple FF in the middle... Unfortunately I was not able to verify ECC using different tools.
Does it use proprietary algorithm ?
I also tried to feed a dump with OOB removed to binwalk, it was not able to find anything there

AlphaMoD r0t83r

Mon, 02 Dec 2024 23:42:14 +0100

hello all of you, Happy holidays.
here it's my situation.... i got one modem sb6141 with firmware AlphaMoD rot83r
i need to change the certs but it has a password and of course i don't have the password, the guy who sold the modem to me change he's mobile number so i can't get in touch with him.
Can some one help me with the password ? please and Thank you in advance.

virgin media in the uk

Sun, 14 Jul 2024 20:05:00 +0200

been quite a while since i have been on here and how things have changed.
managed to log in to my discord and checked the group drewmerc set up and shit! its full of idiots posting edited porn!
anyways, just wondering if anything as progressed with uncapping and modding of the new vm superhubs?
any work arounds using the usbjtag nt on any of them? or is it still emmc card reader or something if i remember right?
is there anything i really should be reading up on before delving any deeper?
also a big shout out to the old skoolers if any are still on here from back in the sb101e days

many thanks to all who read this post

i used to hack the old Ambit 256 can virgin still be done ?

Tue, 09 Jan 2024 21:45:53 +0100

i used to hack the old Ambit 255 with the hax0ware back and the day and sniff macs etc.? what is the story with that these day can it still be done? maybe there is a new fibreware alphaware or something.. it must be 13 years ago now

Console command to check corrected/uncorrected errors

Wed, 20 Dec 2023 22:46:44 +0100

Is there a console command to check for corrected/uncorrected errors on DS/US channels using forceWare?
Thanks

coda45 dump

Thu, 23 Nov 2023 21:56:42 +0100

Can somebody upload a hitron coda45 emmc dump?

SB5101i question

Fri, 14 Jul 2023 22:08:20 +0200

Hi guys:

Someone in my building moved out and threw away a Motorola SB5101i. Do you know if haxorware will still work on it? Is the flashing method any different from the ones I found in the forum for SB5101 or is it different somehow?

ALPHAWARE

Sun, 19 Feb 2023 21:18:59 +0100

Hi

Do you know how to change the hfc mac in ALPHAWARE REV8?

BW Rotator 2022...1682...1670...1602...sbg10.etc

Thu, 29 Dec 2022 09:57:11 +0100

New Years!!!!!!!!! Gift!!!!!!!!!!!PM

stock firmware ??

Wed, 21 Dec 2022 20:24:27 +0100

Regards,

looking for firmware with the tech_support_cgi page
not matter version

arris tg862g

anyone?

Merry Chistmass

CODA-4582 Test Mode

Thu, 17 Nov 2022 23:46:51 +0100

Hello, I have a Hitron CODA-4582 that boots to a CLI, but from what I can tell the shell is running on the arm cpu and the atom cpu with the interesting stuff isn't accessible.

I was able mount some of the partitions on the nvram and it seems there's a program for interacting between the arm and atom, 'ncpu_exec', but it's not present in any of the bin directories. Any clues for next steps? I don't really have an end goal here, just poking around. Originally I wanted to be able to encrypt/decrypt the config for a separate modem, a coda-4680 and so I found the functions on this one for encrypting and decrypting but it doesn't seem to be the same for the 4680.

Some output:

Code:
>>>

Console, CLI version 1.0.0.5

Type 'help' for list of commands

mainMenu> help

Console Commands for this level:

 system               - Go to system Menu.

 logger               - Go to Logger Menu.

 eventm               - Go to Event Manager Menu.

 getManifest          - Prints manifest.

 version              - prints system version.

 docsis               - Go to DOCSIS Menu.

 help                 - Display menu commands, with optional , displays only matching commands.

 shortcuts            - Display key shortcuts help.

 exit                 - Exit this sub-menu, go to previous menu.

 shell                - Enter Linux shell []

         without parameters CLI stays running in the background.

 quit                 - Quit and terminate CLI.

 reboot               - Reboot the system.

 batch                - execute batch of CLI commands from file

          - the file may contain comment lines starting with # character

         [] - verbose commands printing.

 wait                 - wait for .

 / - '/' allows search of CLI Help for any command using grep like search.

mainMenu>

Code:
Cougar Mountain B0 - Boot Ram. 

Version: 0.3.3 (Apr 24 2017, 14:24:33)

Boot Param memory dump:

[0xFFFF3FFC] - 0x00030003

[0xFFFF3FF8] -FFF3FC0] - 0x00000000

[0xFFFF3FBC] - 0x00000001

[0xFFFF3FB8] - 0x00000007

[0xFFFF3FB4] - 0x00000000

[0xFFFF3FB0] - 0x0000000 done, booting the kernel.

systemd 216 running in system mode. (-PAM -AUDIT -SELINUX -IMA -APPARMOR -SMACK +SYSVINIT -LIBCRYPTSETUP -GCRYPT -GNUTLS -ACL -XZ -LZ4 -SECCOMP -BLKID -ELFUTILS -KMOD -IDN )[[32m  OK  [0m] Reached target Remote File Systems.

[[32m  OK  [0m] Reached target Paths.

[[32m  OK  [0m] Reached target[[32m  OK  [0m] Created slice Root Slice.

[[32m  OK  [0m] Listening on /dev/initctl Compatibility Named Pipe.

[[32m  OK  [0m] LPuma filesystem setup...

         Starting Remount Root and Kernel File Systems...

         Starting Adjusting Puma kernel set         Starting Apply Kernel Variables...

         Starting Create Static Device Nodes in /dev...

         Starting udev Coldplu Starting Journal Service...

[[32m  OK  [0m] Started Journal Service.

[[32m  OK  [0m] Reached target Slices.

         Mounting Temporary Directory...

[[32m  OK  [0m] Started Apply Kernel Variables.

[[32m  OK  [0m] Started Create Static Device Nodes in /dev.

[[32m  OK  [0m] Started Remount Root and Kernel File Systems.

[[32m  OK  [0m] Mounted Temporary Directory.

About to set realtime runtime...

[[32m  OK  [0m] Started udev Coldplug all Devices.

[[32m  OK  [0m] Reached target Loc         Starting udev Kernel Device Manager...

[[32m  OK  [0m] Started Adjusting Puma kernel settings.

[[32m  OK  [0m] Mounted /var/volatile.

[[32m  OK  [0m] Started udev Kernel Device Manager.

mount -t ext3 /dev/mmcblk0p16 /nvram -o data=journal -o barrier=1

/dev/mmcblk0p16 mounted successfuly to /nvram

[[32m  OK  [0m] Started Puma filesystem setup.

         Starting Bind mount volatile /var/lib...

         Starting Bind mount volatile /etc/passwd...

         Starting Bind mount volatile /etc/shadow...

[[32m  OK  [0m] Started Bind mount volatile /var/lib.

[[32m  OK  [0m] Started Bind mount volatile /etc/passwd.

[[32m  OK  [0m] Started Bind mount volatile /etc/shadow.

[[32m  OK  [0m] Reached target Local File Systems.

         Starting Trigger Flushing of Journal to Persistent Storage...

         Starting Create Volatile Files and Directories...

Directories.

         Starting Puma setup...

==========================================

Intel DGWSDK release SW_VERSION_SILICON.7.1.1.37

Build date: Thursday, April 29 202Copyright (c) 2011, Intel Corporation.

========================================================

[[32m  OK  [0m] Started Trigger Flushing of Journal to Persistent Storage.

[[32m  OK  [0m] Started Update UTMP about System Boot/Shutdown.

[[32m  OK  [0m] Reached target System Initialization.

[[32m  OK  [0m] Listening on D-Bus System Message Bus Socket.

[[32m  OK  [0m] Reached target Timers.

IMADISTRO_VERSION    = "3.1"

DISTRO_NAME       = "DOCSIS 3.1 Cable Modem"

TUNE_FEATURES     = "armv6 thumb bigendian arm1176jzs"

8c7"

meta-intelce-arm-common = "(nobranch):4ca5d296396942245b42581e6a573bb49506b454"

meta-intelce-arm  = "(nobranch):310afa97cProductionDb_Init:2214 (pid=123): Restoring production DB from NVRAM ... SUCCESS

ProductionDb_FrequencyPlanValidity:3081 (pid=1[[32m  OK  [0m] Started Puma setup.

         Starting Puma Packet Processor Driver init...

Setup memory config from file "/etc/sysctl_mem.conf" 

vm.panic_on_oom = 2

vm.swappiness = 0

vm.overcommit_memory = 2

vm.overcommit_ratio = 100

hil_drv should be running now ...

The PP Doesn't exist in this image ...

[[32m  OK  [0m[[32m  OK  [0m] Started Puma run validity checks.

         Starting Handshake...

Polling Atom Handshake Status...

Waiting for packet processor on Atom... (0)

Atom PP Initialization finished succussfully

[[32m  OK  [0m] Started Handshake.

         Starting Puma Start up...

[DEBUG] main:93 puma_startup_mode STARTUP_MODE_FULL

[DEBUG] HWMB_Start:563 Start. Socket type SOCK_COMMANDER

[DEBUG] HWMB_i HWMB_sendRecvMsg:427 Send-Recv message...

[DEBUG] HWMB_sendRecvMsg:429 Sending message... [msgSize=8]

[DEBUG] HWMB_sendMsg:28==

[DEBUG] HWMB_sendRecvMsg:446 Receiving reply message...

[DEBUG] HWMB_recvMsg:348 Receiving message...

[DEBUG] HWMB_recvMsgng received HW_MBox message 

[DEBUG] ParseAck:44 ACK received 

[DEBUG] main:102 Done sending startup mode to Atom via HW_MBox Using DOCSIS Initialization process parameters: -debug1option 43 -debug1option 50

pcd: (184): Starting TI Process Control Daemon.

[[32m  OK  [0m] Started Puma Start up.

[[32m  OK  [0m] Reached target Sockets.

[[32m  OK  [0m] Reached target Basic Syst[[32m  OK  [0m] Started D-Bus System Message Bus.

pcd: (184): Loaded 97 rules.

pcd: Initialization complete.

nsmod (Rule DOCSIS_SOCIFDRV).

pcd: (184): Starting process insmod (Rule DOCSIS_KINTR).

pcd: (184): Starting process insmod (Rue SYSTEM_GPTIMER).

pcd: (184): Starting process /usr/sbin/gim (Rule SYSTEM_GIM).

pcd: (184): Rule SYSTEM_WATCHDOG: Success (PrTI Watchdog-RT daemon started 

main:864 (pid=194): Initialized successfully

pcd: (184): Rule SYSTEM_GPTIMER: Success (Process /usr/sbin/gptimer (194)).

pcd: (184): Rule PUMA7SYSTEM_CRU_CTRL_MKNOD: Success (Process mknod (190)).

gim_init:133 (pid=195): GIM initializing...

gim_init:169 (pid=195): GIM initialization complete. GIM_MODULE=3087

pcd: (184): Rule SYSTEM_GIM: Success (Process /usr/sbin/gim (195)).

pcd: (184): Rule PUMA7SYSTEM_DATAPIPE_INSMOD: Success (Process insmod (189)).

pcd: (184): Rule DOCSIS_SOCIFDRV: Success (Process insmod (187)).

pcd: (184): Starting process mknod (Rule DOCSIS_MKNODSOCIFDRV).

pcd: (184): Rule DOCSIS_KINTR: Success (Process insmod (188)).

pcd: (184): Rule DOCSIS_MKNODSOCIFDRV: Success (Process mknod (212)).

[[32m  OK  [0m] Reached target Multi-User System.

         Starting Update UTMP about System Runlevel Changes...

[[32m  OK  [0m] Started Update UTMP about System Runlevel Chan

TI Logger: Init complete

pcd: (184): Rule SYSTEM_LOGGER: Success (Process /usr/sbin/logger (193)).

pcd: (184): Starting process /usr/sbin/hw_mbox_app (Rpcd: (184): Rule PUMA7SYSTEM_HW_MBOX_APP: Success (Process /usr/sbin/hw_mbox_app (222)).

pcd: (184): Starting process /usr/sbinpcd: (184): Rule PUMASYSTEM_LASTRULE: Success.

iniparser: cannot open /var/tmp/lsddb_rt.ini

pcd: (184): Rule SYSTEM_SHMDBINIT: Success (Process /usr/sbin/shmdb_init_app (223)).

pcd: (184): Starting process /usr/sbin/halpcpcd: (184): Rule PM_INIT_APP: Success (Process /usr/sbin/pm_init_app (247)).

Can't open /proc/sys/kernel/printk: No such file or directory

Failed to get printk console log level

Code:
GPT fdisk (gdisk) version 1.0.1

Partition table scan:

  MBR: protective

  BSD: not present

  APM: not present

  GPT: present

Found valid GPT with protective MBR; using GPT.

Disk /dev/mmcblk0: 1925120 sectors, 940.0 MiB

Logical sector size: 512 bytes

Disk identifier (GUID): 21126DBA-B4FF-4D7C-B8EF-64585FD41F3D

Partition table holds up to 128 entries

First usable sector is 34, last usable sector is 1894366

Partitions will be aligned on 256-sector boundaries

Total free space is 222 sectors (111.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name

   3             256             511   128.0 KiB   8300  SIGBLOCK0

   4             512           18943   9.0 MiB     EF00  APP_CPU_KERNEL0

   5           18944          207359   92.0 MiB    8300  APP_CPU_ROOTFS0

   6          207360          217599   5.0 MiB     8300  NP_CPU_KERNEL0

   7          217600          250367   16.0 MiB    8300  NP_CPU_ROOTFS0

   8          250368          332287   40.0 MiB    8300  GW_FS0

   9          332288          332543   128.0 KiB   8300  SIGBLOCK1

  10          332544          350975   9.0 MiB     EF00  APP_CPU_KERNEL1

  11          350976          539391   92.0 MiB    8300  APP_CPU_ROOTFS1

  12          539392          549631   5.0 MiB     8300  NP_CPU_KERNEL1

  13          549632          582399   16.0 MiB    8300  NP_CPU_ROOTFS1

  14          582400          664319   40.0 MiB    8300  GW_FS1

  15          664320          758527   46.0 MiB    8300  APP_CPU_NVRAM

  16          758528          875263   57.0 MiB    8300  NP_CPU_NVRAM

  17          875264          916223   20.0 MiB    8300  APP_CPU_LOG

  18          916224          957183   20.0 MiB    8300  NP_CPU_LOG

  19          957184         1894366   457.6 MiB   8300  THIRD_PARTY_FS

Thanks!

forcing config on arris shelled firmware?

Fri, 29 Jul 2022 04:34:42 +0200

Regards,

as subjet says.. i was able to clone a TG862A to a TG862G

the isp i'm using allow to auto server and/or force the config file as long is not edited, i got plemty of them with different speed,
Haxorware does a great job forcing the config, someone from other forum told me to emulate the way haxor or forceware do it...i have no idea..
where to start, some other told me to change the firmware, i want to test and keep it original/virgin for a while
i'm looking for other alternatives...
is there a way to force the modem reading other config file / tftp server, or maybe just the config file ?

i have shell access from telnet..

any help or tips are welcome!!

My Best Regards

Anyone has 6121,6141, or 1602 new firmware???

Sun, 03 Jul 2022 07:22:11 +0200

Anyone has the new firmware!????

how to flash a SVG6582? need help finding the connection points

Sun, 29 May 2022 01:26:28 +0200

hi all, anyone have some material on how to flash a SVG6582?

the spansion chip has no legs, the clip is useless here

where would the connection points be?

trying to open telnet but the oids are not working

the current firm is SVG6x82-6.5.2.1-GA-00-06-LTSH it's shelled, but no cake so far

thank you