3

I was searching through my routers admin page some time ago and I've noticed that it doesn't support firmware updates by the user(it's an ISP's speedport entry 2i router(zte variant)). So long story short, after searching through tons of forum comments about that particular model, I've figured that I could probably reverse engineer its firmware(that "they"[isp guys] for some reason have available for download at their website) and check how the updates are delivered, a way to disable tr 069 etc.

Having no experience with reverse engineering I've used google to find some kind of tutorial that would get me started and I kinda did.

So after reading a few things about every tool referred there I figured I could probably do it. But my firmware wasn't like the one at the example(not sure if it's easier or harder though) so after trying some other things that I thought might work I hit a dead end. Here is a link with all the files I've got so far in case someone want to check them out and maybe point me to the right direction or even try it him/her-self. I would also love any pro-tip in general.

Binwalk gives me the following output this so after I found a way to extract the lzma archive I got these 2 files that I don't know how to approach (.7z file is an lzma archive but I've tried unpacking it with binwalk without any luck). I am probably missing something due to the lack of knowledge on the subject, so if any of you out there can help me, please do.

Thank you in advance for your time :)

Improve this question
8
  • 1
    The file called "240" is the extracted version of the 240.7z, but it seems that some part of the firmware is missing. Otherwise, you cannot update the firmware, because it contains an IPS specific firmware. Generally, the ISP owns the router and reserve the right to update the router.
    – ebux
    Sep 7 '17 at 9:03
  • So if I get this straight, basically the firmware that they have for download is incomplete and thus useless(?)... Therefore I should probably find a way to dump the firmware directly from my router and continue from there. I am not sure how though but I'll figure something out.Isn't there anything more to find out? I don't want to be defeated just yet. Even if I don't find a way to update the firmware myself, I just want to have a look at it and check how it works. Anyway, thanks for the help :)
    – Nikolas Efthimiadis
    Sep 7 '17 at 19:06
  • Try to find a serial port or a command injection vulnerability :)
    – ebux
    Sep 8 '17 at 8:15
  • @Nikolas Efthimiadis If you can spare $30-$40, buy yourself a bus pirate and a SOIC clip. You can probably pull the firmware straight from the flash chip.
    – Gogeta70
    Sep 14 '17 at 18:07
  • @NikolasEfthimiadis have you ever managed to find how to unpack this 240 files the proper way, since from 17MB compressed I get 5MB uncompressed... seems something is missing...
    – Bojan Vukasovic
    Aug 23 '19 at 13:47
3

@J91321 Been struggling with config file decryption for a while, without success.

You can download a firmware image from this site. Newer version available here. Latest version here. After extraction with binwalk you should get a file with suffix jffs2 (filename.jffs2). If you are going to mount it on a x86 machine change endianness from big to little. For endian conversion you can use jffs2dump. Then mount using mtdram. Listing of mounted jffs2 image (root directory):

backcfg/  bin/  defcfg/  dev/  env/  etc/  home/  lib/  linuxrc@
log/  mnt/  proc/  root/  sbin/  sys/  usercfg/  usr/  var/

File cspd is located under /bin.

Improve this answer
2
  • Can you upload the firmware file? The site is no longer available. Thanks for your help though
    – Nikolas Efthimiadis
    Jul 15 '18 at 13:49
  • That worked like a charm. Thanks a lot for your help :)
    – Nikolas Efthimiadis
    Jul 27 '18 at 19:08
2

I have been reverse engineering ZTE Speedport Entry 2i for some time. Mostly trying to decode config (in ZTE encrypted backup config file) Honestly I didn't manage to find any firmware image on the Internet. This device is sold only as CPE to ISPs so I would really like to know where did you find that binary blob.

I checked your files, didn't manage to get anything from them unfortunately. My guess (and it's really just a guess) is that it may contain filesystem but since it's Chinese device the FS may be something proprietary.

The device has Broadcom BCM6338 so it's MIPS architecture. On the board you can notice 4 not mounted pins. You'll have to solder the pins there probably. I assumed this is UART, unfortunately it doesn't seem to work, when I connected to it before powering up, the device won't even start. If connected when powered up, nothing gets transmitted. The pins are connected to pins marked as TEST on the PCB. As Gogeta70 mentioned, using bus pirate with SPI sniffer it's possible to read FW from Flash. Device has GD5F1GQ4UAYIG NAND Flash memory (at least mine has). I'll update when my bus pirate arrives.

Here is picture of the PCB, for anyone interested. Speedport Entry 2i PCB

Improve this answer
3
  • Well I totally forgot about this due to the fact that my bus pirate didn't arrive at all(Damn you Ebay :P ). I've just ordered a v4 variant from a local shop but it might take a while to arrive. I know it's probably late to ask but have you managed to do anything with it ?
    – Nikolas Efthimiadis
    Jul 15 '18 at 9:48
  • There was was activity in the question I mentioned in my answer. Somebody managed to extract the firmware. But I haven't had time to take a closer look at it.
    – J91321
    Jul 15 '18 at 10:48
  • @J91321, did you get anywhere with this?
    – mkst
    Jun 15 '20 at 15:01
1

I also took a look in this router. The serial port works fine, yet the cfe bootloaded seems locked (while is booting dosen't give you the opportunity to stop the process). After the boot process they did provide a shell but they ask for login credentials. Which still don't know. I took a look at the firmware update. Extracting from the jffs2 partition didn't work very well for me. I see the formal linux structure (etc, root, bin ..) yet the only folder having files is the /bin which is not particular useful. Did anyone had any success extracting the /etc folder ? My guess at this point is that a nand flash dump is the way to proceed or a exploit in the web ui that can give us root and continue for there.

that the boot log:

----
BTL1
V1.1
CPUI
L1CI
PMCI
PMCS
AFEL
PWRZ
MEML
PMCD
CPUI
L1CI
ZBSS
CODE
DATA
L12F
MAIN
OTP?
MFGZ
OTPP
USBT
SNAN
PASS
----
HELO
CPUI
L1CI
4.1602-1.0.38-116.118
PMCI
PMCM
DRAM
----
PHYS
PHYE
DDR1
400H
SIZ4
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
MGIC
RAM1


Base: 4.16_02
CFE version 1.0.38-116.118 for BCM963381 (32bit,SP,BE)
Build Date: Thu Nov 16 19:47:34 CST 2017 (xialei@localhost.localdomain)
Copyright (C) 2000-2013 Broadcom Corporation.

Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 400MHz, Bus: 300MHz
Main Thread: TP0
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000

SPI NAND flash device: Winbond W25N01GV, id 0xefaa block 128KB size 131072KB
pmc_init:PMC using DQM mode
board_device_init, set not used GPIO to 0 OK!
Info: get a version head, the integrality is OK!
Info: start_block:[120],kernel_magic_head at :[120], i:[257],ver_blocks:[137]
Info: get a version head, the integrality is OK!
Info: start_block:[288],kernel_magic_head at :[288], i:[425],ver_blocks:[137]

Entering norm mode ...
Info: start_block:120
Info: bad blocks before fs:0
Info: pL->dwFsStartPhyAddr:10a0000
Info: pL->fs_len:f80000
para->BootParaCksum=0001e693
Decompression OK!
Entry at 0x803976c0
Starting program at 0x803976c0
Linux version 3.4.11-rt19 (xialei@localhost.localdomain) (gcc version 4.6.2 (Buildroot 2011.11) ) #1 SMP PREEMPT Mon Mar 19 17:38:03 CST 2018
963381REF2 prom init
Check boot para cksum...
boot para cksum OK!
********************BOOT INFO**************************
version_sum:             :      2
version_nummax:          :      2
dwCurrVersionIndex:      :      0
dwBackVersionIndex:      :      1

dwVersionStartPhyAddr   0:      f00000
dwHeadRealPhyAddr       0:      2020000
dwIsCurrentVersion      0:      1
dwVersionIsBad          0:      0

dwVersionStartPhyAddr:  1:      2400000
dwHeadRealPhyAddr:      1:      3520000
dwIsCurrentVersion:     1:      0
dwVersionIsBad          1:      0
******************************************************
pdt_verinfo_init: tcVerInfo->RunMode[3]
bootPara.bootWhichImg=0
bootPara.img_info_tbl[0].flashOffset=0x       0
sHardVersion=V1.0
bootPara.runmode=3
CPU revision is: 0002a081 (Broadcom BMIPS4350)
DSL SDRAM reserved: 0x132000
Determined physical RAM map:
 memory: 07ece000 @ 00000000 (usable)
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00007ece
Movable zone start PFN for each node
Early memory PFN ranges
    0: 0x00000000 -> 0x00007ece
On node 0 totalpages: 32462
free_area_init_node: node 0, pgdat 804b1750, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 222 pages used for memmap
  Normal zone: 28144 pages, LIFO batch:7
PERCPU: Embedded 7 pages/cpu @81103000 s5632 r8192 d14848 u32768
pcpu-alloc: s5632 r8192 d14848 u32768 alloc=8*4096
pcpu-alloc: [0] 0 [0] 1 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32208
Kernel command line: root=31:9 ro rootfstype=jffs2  irqaffinity=0
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Memory: 122200k/129848k available (3668k kernel code, 7648k reserved, 1076k data, 240k init, 0k highmem)
Preemptible hierarchical RCU implementation.
NR_IRQS:128
console [ttyS0] enabled
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
Calibrating delay loop... 598.01 BogoMIPS (lpj=299008)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
Broadcom Logger v0.1 Mar 19 2018 17:37:42
CPU revision is: 0002a081 (Broadcom BMIPS4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Brought up 2 CPUs
NET: Registered protocol family 16
pmc_init:PMC using DQM mode
1192:57:47 [Klogctl][Info] [(562)LogCtlInit] LogCtlInit begin
1192:57:47 [Klogctl][Info] [(579)LogCtlInit] LogCtlInit end
1192:57:47 [Kern][Notice] [monitor.c(938)MonitorInit]  cspmonitor init... !  
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom GBPM v0.1 Mar 19 2018 17:37:43 initialized
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x10600000-0x106fffff]
pci_bus 0000:00: root bus resource [io  0x11700000-0x1170ffff]
pci 0000:00:09.0: [14e4:6300] type 00 class 0x0c0310
pci 0000:00:09.0: reg 10: [mem 0x1000c400-0x1000c4ff]
pci 0000:00:0a.0: [14e4:6300] type 00 class 0x0c0320
pci 0000:00:0a.0: reg 10: [mem 0x1000c300-0x1000c3ff]
PCI host bridge to bus 0000:01
pci_bus 0000:01: root bus resource [mem 0xa0000000-0xbfffffff]
pci_bus 0000:01: root bus resource [??? 0x00000000 flags 0x0]
pci 0000:01:00.0: [14e4:6338] type 01 class 0x060400
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:02:00.0: [14e4:a8db] type 00 class 0x028000
pci 0000:02:00.0: reg 10: [mem 0x00000000-0x00007fff 64bit]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: BAR 8: assigned [mem 0xa0000000-0xa00fffff]
pci 0000:02:00.0: BAR 0: assigned [mem 0xa0000000-0xa0007fff 64bit]
pci 0000:01:00.0: PCI bridge to [bus 02-02]
pci 0000:01:00.0:   bridge window [mem 0xa0000000-0xa00fffff]
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
bcmhs_spi bcmhs_spi.1: master is unqueued, this is deprecated
skbFreeTask created successfully
NET: Registered protocol family 8
NET: Registered protocol family 20
1192:57:47 [Kern][Info] [qos.c(5055)CSPKernel_QoS_I] Qos module init
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
PCI: CLS 16 bytes, default 16
init_bcm_tstamp: unhandled mips_hpt_freq=300000000, adjust constants in bcm_tstamp.c
bcm_tstamp initialized, (hpt_freq=300000000 2us_div=300 2ns_mult=0 2ns_shift=0)
jffs2: version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
msgmni has been set to 238
io scheduler noop registered (default)
brd: module loaded
loop: module loaded
SPI NAND Device Linux Registration
SPI NAND Linux Registration
SPI NAND device reset
Found SPI NAND device Winbond W25N01GV
SPI NAND device Winbond W25N01GV
   device id    = 0xefaa
   page size    = 0x800
   block size   = 0x20000
   total blocks = 0x400
   total size   = 0x8000000
NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Winbond NAND 128MiB 1,8V 8-bit)
NAND_ECC_NONE selected by board driver. This is not recommended!
Creating 10 MTD partitions on "Winbond W25N01GV":
0x000000000000-0x000000220000 : "boot"
0x000000220000-0x000000320000 : "tag"
0x000000320000-0x0000004a0000 : "userconfig"
0x0000004a0000-0x000000620000 : "backconfig"
0x000000620000-0x0000007a0000 : "defconfig"
0x0000007a0000-0x000000920000 : "log"
0x000000920000-0x000000aa0000 : "env"
0x000000f00000-0x000002400000 : "rootfs1"
0x000002400000-0x000003900000 : "rootfs2"
0x0000010a0000-0x000002020000 : "filesystem"
brcmboard: brcm_board_init entry
Failed to create a netlink socket for monitor
DYING GASP IRQ initialized 
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq with Auxilliary trigger char enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb0000280 (irq = 8) is a BCM63XX
ttyS1 at MMIO 0xb00002a0 (irq = 9) is a BCM63XX
Total # RxBds=5154
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized

BPM: tot_mem_size=134217728B (128MB), buf_mem_size <15%> =20132655B (19MB), num of buffers=9679, buf size=2080
Broadcom BPM Module Char Driver v0.1 Mar 19 2018 17:37:47 Registered<244>
Info:zte_watchdog_init, errorEPC = 0f7e7716
pktgen: Packet Generator for packet performance testing. Version: 2.74
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1909 buckets, 7636 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
1192:57:48 [Kern][Info] [br_com_special_(109)arp_stolen_init] arp_stolen firewalling registered
Bridge firewalling registered
Ebtables v2.0 registered
L2TP core driver, V2.0
PPPoL2TP kernel driver, V2.0
PPP generic driver version 2.4.2
NET: Registered protocol family 24
1192:57:48 [Kern][Info] [ver_info_nand.c(457)ver_info_init] ver_info_init
1192:57:48 [Kern][Notice] [csp_ifinfo.c(219)csp_ifinfo_init] Initializing CSP IFinfo...
1192:57:48 [Kern][Notice] [sweth_core.c(2760)sweth_init] SW&ETH HAL driver initing!
1192:57:48 [Kern][Notice] [sweth_core.c(140)CreateSwEthObjs] Create SW & ETH objects
1192:57:48 [Kern][Notice] [sweth_core.c(156)CreateSwEthObjs] Failed to get SWITCH attr, iRet=-2
1192:57:48 [Kern][Info] [sweth_core.c(163)CreateSwEthObjs] nEmac = 1, nSw = 0, nEth=4.
1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj0: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 1
1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj1: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 2
1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj2: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 3
1192:57:48 [Kern][Warn] [sweth_core.c(310)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
1192:57:48 [Kern][Info] [sweth_core.c(322)CreateSwEthObjs] ETH obj3: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 4
Jiffies_test Driver Init Successfully 
logger: created 1024K log 'logger_main' major '99'
: success register character device for /dev/monitor
1192:57:48 [Kern][Notice] [cspmirror.c(1245)mirror_init] ***********mirror_init************
systools version:v0.7.0
errorEPC = 0f7e7716
1192:57:48 [Kern][Info] [br_multicast_se(7234)br_mcparam_init] info init!
1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(stb)
1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(srtc)
1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(trtc)
1192:57:48 [Kern][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(hard)
1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(null)
1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(drop)
1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_mark)
1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(vlan_prio_mark)
1192:57:48 [Kern][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_vlan_prio_mark)
child_dev_init start
child_dev_ioctl_set set[80393d20]
#######begin FDB_Notify Reg
#######after FDB_Notify Reg
#######begin FDB_Notify Reg
Shouldn't be in WHILE
#######after FDB_Notify Reg
1192:57:48 [Kern][Error] [ledkey_callback(26)keycallback_ini] Install WPS KEY Callback Failed!
VFS: Mounted root (jffs2 filesystem) readonly on device 31:9.
Freeing unused kernel memory: 240k freed
init normal mode!!!

Loading drivers and kernel modules... 

jffs2: notice: (269) check_node_data: wrong data CRC in data node at 0x00161318: read 0x90074d32, calculated 0xe9fe5f3a.
mkdir: can't create directory '/defcfg/chain1': File exists
mkdir: can't create directory '/defcfg/chain2': File exists
chipinfo: module license 'proprietary' taints kernel.
Disabling lock debugging due to kernel taint
brcmchipinfo: brcm_chipinfo_init entry
bcmxtmrt: Broadcom BCM3381B0 ATM/PTM Network Device v0.6 Mar 19 2018 17:43:20
bcmxtmcfg: bcmxtmcfg_init entry
adsl: adsl_init entry
Broadcom BCM63381B0 Ethernet Network Device v0.1 Mar 19 2018 17:43:02
ETH Init: Ch:0 - 200 tx BDs at 0xa639c000
ETH Init: Ch:0 - 3871 rx BDs at 0xa5d18000
vport_cnt=4, consolidated_portmap=0xF
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered 
vport_id=0x1, logical_port=0x0
vnet_dev[vport_id=1]=eth0
ETH0-->eth0
eth0: <Int sw port: 0> <Logical : 00> PHY_ID <0x00000001 : 0x01> MAC : 00:D0:D0:00:00:01
vport_id=0x2, logical_port=0x1
vnet_dev[vport_id=2]=eth1
ETH1-->eth1
eth1: <Int sw port: 1> <Logical : 01> PHY_ID <0x00000002 : 0x02> MAC : 00:D0:D0:00:00:01
vport_id=0x3, logical_port=0x2
vnet_dev[vport_id=3]=eth2
ETH2-->eth2
eth2: <Int sw port: 2> <Logical : 02> PHY_ID <0x00000003 : 0x03> MAC : 00:D0:D0:00:00:01
vport_id=0x4, logical_port=0x3
vnet_dev[vport_id=4]=eth3
ETH3-->eth3
eth3: <Int sw port: 3> <Logical : 03> PHY_ID <0x00000004 : 0x04> MAC : 00:D0:D0:00:00:01
Ethernet Auto Power Down and Sleep: Enabled
Energy Efficient Ethernet: Enabled
#######begin FDB_Notify Reg
Shouldn't be in WHILE
Shouldn't be in WHILE
#######after FDB_Notify Reg
#######begin FDB_Notify Reg
Shouldn't be in WHILE
Shouldn't be in WHILE
Shouldn't be in WHILE
#######after FDB_Notify Reg
1192:58:01 [Kern][Notice] [bcm_emac_adapte(663)Register_bcm_em] Register BCM EMAC driver
1192:58:01 [Kern][Notice] [sweth_core.c(588)RegisterEmacDrv] Register EMAC driver
1192:58:01 [Kern][Notice] [sweth_core.c(429)InitSwEthObjs] Initialise SW & ETH objects
1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!
1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!
1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!
1192:58:01 [Kern][Warn] [sweth_core.c(1762)hal_set_port_ma] Driver do not support set MAC address!
NComm TMS V6.80 Kernel Module loaded.
Loading PCM shim driver

Endpoint: endpoint_init entry
BOS: Enter bosInit 
BOS: Exit bosInit 
fxsnum 2,fx0 num 0 ,dect 0Endpoint: endpoint_init COMPLETED
Broadcom 802.1Q VLAN Interface, v0.1
ADDRCONF(NETDEV_UP): eth0: link is not ready
device eth0 entered promiscuous mode
Host MIPS Clock divider pwrsaving is enabled
/etc/init.norm: line 120: hostname: not found
sched_setaffinity cpu 0 (ret = 0)
1192:57:55 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock2  mount point is /usercfg/
1192:57:55 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd2 size=1572864, erasesize=131072 bad block count 0 
1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock2  at dir /usercfg/  success
1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock3  mount point is /backcfg/
1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd3 size=1572864, erasesize=131072 bad block count 0 
1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock3  at dir /backcfg/  success
1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock4  mount point is /defcfg/
1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd4 size=1572864, erasesize=131072 bad block count 0 
1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock4  at dir /defcfg/  success
1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock5  mount point is /log/
1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd5 size=1572864, erasesize=131072 bad block count 0 
1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock5  at dir /log/  success
1192:57:56 [User][Info] [mount_jffs2.c(37)main] mount dev is  /dev/mtdblock6  mount point is /env/
1192:57:56 [User][Info] [mount_jffs2.c(99)main] mtdInfo: /dev/mtd6 size=1572864, erasesize=131072 bad block count 0 
1192:57:56 [User][Info] [mount_jffs2.c(161)main] mount dev  /dev/mtdblock6  at dir /env/  success
1192:58:04 [User][Warn] [ifconfig.c(957)ifconfig] Ioctl failed!SIOCSIFADDR
1192:58:04 [OSS][Notice] [pc.c(1907)initPCFd] open /dev/ptyp0 success.

(none) 
PID:  344

1192:58:09 [User][Info] [db_shm_mgr.c(109)DBShmSrvInit] iShmId:32769
1192:58:09 [User][Info] [db_shm_mgr.c(124)DBShmSrvInit] pShmBuf:60000000
[log_file.c(1704)ProcLogConf] Set LOG_FILE_CONF_SET_PDTCONF.
[log_file.c(1768)ProcLogConf] Set cAutoSave = 1
[log_filesave.c(176)CheckLogConfFile] File not exist: filename(/log/flag_usrfs), Cnt=40
1192:58:10 [dhcps][Info] [dhcps.c(160)DHCPSInit] module init success!dhcp server
1192:58:10 [dhcp4c][Warn] [dhcp4c_inst.c(4402)_dhcp4cRegSendO] Send code[60]fun[0x58fbf4] is replaced by fun[0x594d60]
1192:58:10 [monitor][Info] [cspd_monitor.c(422)MonitorMain] monitor init success
1192:58:10 [PingTracert_mgr][Info] [tracert_mgr.c(1107)tracertInit] module init success!tracert mgr
1192:58:10 [ethlinkvlan][Info] [ifs_ethlinkvlan(2313)linkifMain] IfsMain recv event(4352) msgptr((nil)) len(0)
1192:58:10 [ethlinkvlan][Info] [ifs_ethlinkvlan(2181)linkifAsynmsg] lpMsg == NULL
1192:58:10 [ppp_mgr][Info] [ppp_mgr.c(6398)PPPInit] module init success!
1192:58:10 [ipif_mgr][Info] [ifs_ipif.c(2102)ifsIPIFMain] IfsMain recv event(0x1100) msgptr((nil)) len(0)
1192:58:10 [ipif_mgr][Info] [ipv4_addr_mgr.c(1294)ipv4AddrInit] [ipv4AddrInit] success
1192:58:10 [ipif_mgr][Info] [ifs_ipif.c(2085)ifsIPIFInit] [ifsIPIFInit] success
1192:58:10 [ipif_mgr][Info] [ifs_ipif.c(1910)ifsAsynmsg] unknown ASynMsg!msg id = 4352
1192:58:10 [addr6_mgr][Info] [addr6_mgr.c(3429)Addr6Main] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
1192:58:10 [prefix_mgr][Info] [prefix_mgr.c(3223)prefixInit] Prefix Init Success!
1192:58:10 [bridge][Info] [bridge.c(2161)bridgeInit] module init success!(bridge_mgr)
1192:58:10 [eth_mgr][Info] [eth_mgr.c(1847)ethInit] module init success!ethernet mgr
1192:58:10 [htat_mgr][Info] [htat_mgr.c(2075)htatInit] module init success!htat_mgr init
1192:58:10 [dsl_mgr][Info] [dsl_mgr.c(3468)dsl_init] dsl init ok
1192:58:10 [xtm_mgr][Info] [xtm_mgr.c(4252)xtmInit] [xtmInit] start
1192:58:10 [xtm_mgr][Info] [xtm_mgr.c(4278)xtmInit] xtm init ok
1192:58:10 [xtm_mgr][Info] [xtm_mgr.c(4280)xtmInit] xtm support dynamic add/del interface
1192:58:10 [ptry_mgr][Info] [ptry_mgr.c(478)ptryMgrInit] module init success!(PTry mgr)
1192:58:10 [route_mgr][Info] [policy_route.c(1646)policyRtTableIn] policyRtTableInit ok
1192:58:10 [route_mgr][Info] [policy_route.c(1561)defPolicyRtChai] defPolicyRtChainInit ok
1192:58:10 [route_mgr][Info] [rip_mgr.c(39)RIPInit] Common Info: rip init
1192:58:10 [route_mgr][Info] [ripng_mgr.c(39)RIPngInit] Common Info: ripng init
1192:58:10 [route_mgr][Info] [route_mgr.c(802)routeInit] SubScribPublish DefGW Service OK
1192:58:10 [binding_mgr][Info] [binding_mgr.c(1666)bindingInit] [bindingInit] end
1192:58:10 [qos_mgr][Info] [qos_default_qdi(2246)RegisterDefault] RegisterDefaultIFQdisc. IF WAN&DEV.BRIDGING.BR1.BRPORT, Qdisc CSPDefSPWRRWFQ
1192:58:10 [qos_mgr][Info] [interface_api.c(1560)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[3] Handle[0x4c42dc]
1192:58:10 [qos_mgr][Info] [interface_api.c(1603)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[3], pHandle[0x4c42dc], Event[6]
1192:58:10 [qos_mgr][Info] [interface_api.c(1560)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.PTM.LINK1] WanLan[3] Handle[0x4c4088]
1192:58:10 [qos_mgr][Info] [interface_api.c(1573)RegisterNetIFNo] IF_ID Not Null[DEV.PTM.LINK1]
1192:58:10 [qos_mgr][Info] [interface_api.c(1603)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.PTM.LINK1], WanLan[3], pHandle[0x4c4088], Event[6]
1192:58:10 [sntp_mgr][Info] [time_policy.c(101)TpInit] module init success!3
1192:58:10 [sntp_mgr][Info] [sntp_mgr.c(1694)sntpInit] module init success!SNTP mgr
1192:58:10 [ddns_mgr][Info] [ddns_mgr.c(1539)ddnsInit] module init success!ddns_mgr
1192:58:10 [dns_mgr][Info] [dns_mgr.c(437)dnsInit] SubScribPublish NetIF Service OK
1192:58:10 [dns_mgr][Info] [comp_dns_mgr.c(76)CompDnsInit] Init Comp_Dns_Mgr Success!
1192:58:10 [fm_mgr][Info] [fm_mgr.c(2641)fmServerInit] module init success!Enter FmServer Init!
1192:58:10 [fm_mgr][Info] [fm_mgr.c(4236)fmMgrInit] module init success!fm mgr
1192:58:10 [tr143_mgr][Info] [tr143_mgr.c(547)tr143Init] module init success!tr143 mgr
1192:58:10 [ipv6_tunl_mgr][Info] [ipv6_tunl_mgr.c(416)IPv6TunlMgrMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
1192:58:10 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1851)TunnelMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
1192:58:10 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1617)TunnelMgrInit] [TunnelMgrInit] start
1192:58:10 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1622)TunnelMgrInit] [TunnelMgrInit] OK
1192:58:10 [ipv6_tunl_mgr][Info] [tunl64_mgr.c(1826)Tunl64Main] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
1192:58:10 [fon_mgr][Info] [fon_mgr.c(3915)FonMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
1192:58:10 [ipif_mgr][Info] [ifs_netif.c(2579)interfaceNotify] [interfaceNotifyHook] start, to pid[10103]
1192:58:10 [ipif_mgr][Info] [ifs_netif.c(2579)interfaceNotify] [interfaceNotifyHook] start, to pid[10103]
1192:58:10 [DB][Error] [dbc_mgr_tbl.c(494)dbCreateDomainN] create table fail (ParentControlUser) domain(FilterMode) error default value
1192:58:10 [DB][Info] [dbc_tbl_wol_inf(18)dbCreateWolInfo] call dbCreateWolInfoTbl
1192:58:10 [DB][Error] [dbc_def_dev_inf(176)setVerNumFromFi] /etc/ver_num_des file open error!
1192:58:10 [DB][Warn] [dbc_mgr_tbl.c(1662)dbSetValComm] not find domain table(WLANBase) domain(AutoChannelFrom)
1192:58:10 [DB][Warn] [dbc_mgr_tbl.c(1662)dbSetValComm] not find domain table(WLANBase) domain(AutoChannelTo)
1192:58:10 [DB][Error] [dbc_mgr_def.c(79)dbMgrStaticSetI] not find table (PDTWLANWAPI)
1192:58:10 [DB][Info] [dbc_def_wol_inf(22)dbDefWolInfo] call dbDefWolInfo
1192:58:10 [DB][Info] [dbc_init_pdt_in(2485)dbCheckSingleCf] DB Decry cfg end (iRet: 0)
1192:58:10 [DB][Warn] [dbc_mgr_file_xm(1688)_dbXMLTblChk] load database failed table(L2BAvailIF) cut or exceed max row or unequal row.
1192:58:10 [DB][Warn] [dbc_mgr_file_xm(1688)_dbXMLTblChk] load database failed table(BrFilter) cut or exceed max row or unequal row.
1192:58:11 [DB][Info] [dbc_person_teln(66)dbPersonInitTel] set password
1192:58:11 [DB][Info] [dbc_mgr_file.c(1250)dbFileLoadCfg] find file /var/tmp/db_Decry_cfg.xml
1192:58:15 [DB][Info] [dbc_mgr_file.c(2290)dbInitSignVal] szCfgSignVal= Speedport Entry 2i,iRet:0
1192:58:15 [DB][Info] [dbc_init_pdt_in(1636)_PdtDBTransferC] [_PdtDBTransferCfg] dwFlagVerNum=12, dwFlagVerNumExt=5
1192:58:15 [DB][Info] [dbc_core.c(1249)dbEndTm] (ALL) end, use 455 tick
1192:58:15 [OSS][Warn] [oss_sche.c(868)RunProcess] RunProcess process[DB] Event[0x1100] dwUsedTicks[483]
----------------------------------------------[log_file.c(1444)ProcLogConf] Set SaveEnable=1
1192:58:15 [dhcp6s][Info] [ipif_api.c(2190)RegAddr6Notify] RegAddr6Notify start, event[3] IF_ID[] WanLan[2] Handle[0x59cdc8]
1192:58:15 [PingTracert_mgr][Info] [tracert_mgr.c(1134)tracertStart] module start success!tracert mgr
1192:58:15 [srm_mgr][Info] [srm_mgr.c(228)SrmInit] module init success!use SRM_DBVIEW data
1192:58:15 [adev_mgr][Info] [extend_options.(121)CspAddParseOptP]
Improve this answer
1
  • 1
    While this post does not provide an answer it contains potentially valuable information for the inquirer and future visitors. However, it is too long to be converted to a comment, so it got converted to a community wiki.
    – 0xC0000022L ♦
    Nov 5 '18 at 15:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.