江苏无锡联通宽带SK-D740-C GPON/4+1 创维SK-D742-C光猫SK-D472 分享

moomin

江苏无锡联通宽带GPON/4+1 光猫SK-D472 C系统分享
---


管理员账户登录地址： http://192.168.1.1/cu.html
登录账户和密码CUAdmin
注意如果不会配置，建议不要折腾。
---标签上写SK-D472 ：登录进去发现里面写着 SK-D740-C
运营商 中国联通
设备型号 SK-D740-C
设备标识号 40679B-01FFFFFFFF010FFF34SKYWA017A270FF
硬件版本号 V01.00.0
软件版本号 V02.00.R1_0_0
---

U-Boot 2013.04-svn202189 (Jun 07 2022 - 11:33:12)

1000MHZ
CPU  : ZX279127S@A9,Board: ZXIC zx279127sevb
CONFIG_SYS_SDRAM_SIZE:=0x10000000
DRAM:  256 MiB
CONFIG_SYS_SDRAM_SIZE:=0x10000000
Flash: NAND
product_vid = 144
board_index = 59,vid=144-TBY06G
pass pinmux for flash
NAND:  NAND_special nand special:0

Manu ID: 0x98, Chip ID: 0xda (Toshiba NAND 256MiB 3,3V 8-bit)
256 MiB
<nand_read_skip_bad_,1302>!mtdpart=0x1,offset=0x0,mtdpartoffset=0x180000,mtdPartsize=0x80000,length=0x20000
In:    serial
Out:   serial
Err:   serial
clk_pll env is not setted, core clk won't change
Net:   enter ref_clk_set.. mode = 0 .
enter pll_cfg_fractional
ref_clk_set success!
gpon serdes init
innerGeLedPolarSet 1
innerGeLedPolarSet 1
innerGeLedPolarSet 1
innerGeLedPolarSet 1
eth0

Hit 1 to upgrade software version
Hit ENTER key to stop autoboot:  0

moomin

参考： https://jeza-chen.com/2023/01/23/Playing-with-Modem/
江苏无锡联通宽带账户和密码一样，管理员密码也不麻烦了，恢复出厂后，直接是CUAdmin。

Step 1：获取管理员密码
首先在浏览器打开 http://192.168.1.1/hidden_version_switch.html，然后勾选Telnet Enable选项，此时网页会闪烁刷新一下。页面刷新后Telnet Enable选项可能还是处于未选择状态，这时候不用理会，继续下一步。
Step 2: 尝试Telnet登录光猫
进入终端（or 命令提示符），输入telnet 192.168.1.1，观察是否出现“Connected to 192.168.1.1”，如有，则说明Telnet开启成功。此时关闭终端即可，不需要登录。
Step 3：通过FTP获取管理员密码
在文件管理器中输入 ftp://192.168.1.1，帐号和密码都是useradmin。登录成功后，进入/tmp目录，找到telnet_su_passwd文件，如下图所示：

moomin

moomin 发表于 2023-6-4 14:41
参考：https://jeza-chen.com/2023/01/23/Playing-with-Modem/
江苏无锡联通宽带账户和密码一样，管理员密 ...

Full Version:SK-D740_V02.00.R1_0_0_SVN209466_VID144_DQ200Svn Reversion:209466Svn Url:svn://svn01.sdt.com/sw08_szborqs/PON/ZTE/stable/cucc/20210818-r181831-dbus/Jiangsu_cucc_dbus_r205938_20220509Compile Time:2022-06-07 11:36:20Compile Script:sk_build_cu_tbyxx_pon_dbus_nowifi_general.shCurrent Version:JiangSu Version
Version Type:
=======================================================
LAN_UP Enable:       
Telnet Enable:               
          PONMAC[ID: 32769] is set to  40 67 9b d5 63 f4
         PONLOID[ID:  2180] is not set
       PONPASSWD[ID:  2181] is not set
          EPONSN[ID:  2182] is not set
        VENDORID[ID:  2176] is set to SKYW
          GPONSN[ID:  2177] is set to A017A270
         GPONPWD[ID:  2178] is not set
             OUI[ID:   768] is set to 40679B
              SN[ID:   512] is set to 01FFFFFFFF010FFF34SKYWA017A270FF
            MAC1[ID:   256] is set to  40 67 9b d5 63 f4
            MAC2[ID:   257] is set to  40 67 9b d5 63 f5
            MAC3[ID:   258] is set to  40 67 9b d5 63 f6
            MAC4[ID:   259] is set to  40 67 9b d5 63 f7
            MAC5[ID:   260] is set to  40 67 9b d5 63 f8
            MAC6[ID:   261] is set to  40 67 9b d5 63 f9
            MAC7[ID:   262] is set to  40 67 9b d5 63 fa
            MAC8[ID:   263] is set to  40 67 9b d5 63 fb
            MAC9[ID:   264] is not set
           SSID1[ID:  1024] is not set
         WEPKEY1[ID:  1280] is not set
         PSKKEY1[ID:  1312] is not set
           SSID2[ID:  1025] is not set
         WEPKEY2[ID:  1284] is not set
         PSKKEY2[ID:  1313] is not set
           SSID5[ID:  1028] is not set
         WEPKEY5[ID:  1296] is not set
         PSKKEY5[ID:  1316] is not set
        USERNAME[ID:  1537] is set to user
      USERPASSWD[ID:  1793] is set to rgerub3e
         MODELID[ID:  2183] is set to SK-D740
     VERSIONMODE[ID: 32770] is not set
         HLTMODE[ID:  2193] is not set
VoIPProtocolType[ID:  2054] is not set
     SKYShowVxxx[ID:  1001] is not set
  SKYSpecialType[ID:  1002] is not set
   SKYRegionCode[ID:  1003] is set to  c8 00 00 00

moomin

SecureCRT 登录 talnet
用户名root
密码CUAdmin

moomin

ftp://192.168.1.1/
ftp进去文件为空

moomin

关于IPv6地址的一些知识
IPv6 网段含义:

::1/128: 相当于IPv4中的127.0.0.1/8,回环地址,用于本机内部通信。
fe80::/10: 这些链路本地地址指明，这些地址只在区域连线中是合法的，这有点类似于IPv4中的169.254.0.0/16。
240e::/20: 电信公网网段
2409:8000::/20: 移动公网网段
2408:8000::/20: 联通公网网段
::ffff:x.x.x.x/96: IPv4地址转译过来的IPv6地址。

我这里江苏无锡联通 是2408开头

moomin

moomin 发表于 2023-6-4 14:42
Full Version:SK-D740_V02.00.R1_0_0_SVN209466_VID144_DQ200Svn Reversion:209466Svn Url:svn://svn01.s ...

{ "PONMAC": "40679bd563f4", "GPON_SN": "SKYWA017A270", "OUI": "40679B", "Device_SN": "01FFFFFFFF010FFF34SKYWA017A270FF", "MAC1": "40679bd563f4", "MAC2": "40679bd563f5", "MAC3": "40679bd563f6", "MAC4": "40679bd563f7", "MAC5": "40679bd563f8", "MAC6": "40679bd563f9", "MAC7": "40679bd563fa", "MAC8": "40679bd563fb", "MAC9": "", "2.4G_WiFi_SSID1": "", "2.4G_WiFi_Password1": "", "2.4G_WiFi_SSID2": "", "2.4G_WiFi_Password2": "", "5G_WiFi_SSID1": "", "5G_WiFi_Password1": "", "WEB_User_Name": "user", "WEB_User_Password": "rgerub3e", "Region_Code": "200", "WAN_ServiceName": "1_TR069_R_VID_45|2_INTERNET_R_VID_|3_VOICE_R_VID_42|4_IPTV_B_VID_43", "SoftWare_Version": "SK-D740_V02.00.R1_0_0_SVN209466_VID144_DQ200", "HardWare_Version": "V01.00.0", "Compile_Time": "2022-06-07 11:36:20", "Telnet_Status": "Close" }

moomin

拆开内部图片

moomin

江苏无锡联通宽带光猫：SK-D740-C

波特率：115200
TTL输出信息：
----------------------
Boot NAND
start read bootheader
start read secondboot
non secure boot
Jump
DDR3 16bit size 0x10000000
12


U-Boot 2013.04-svn202189 (Jun 07 2022 - 11:33:12)

1000MHZ
CPU  : ZX279127S@A9,Board: ZXIC zx279127sevb
CONFIG_SYS_SDRAM_SIZE:=0x10000000
DRAM:  256 MiB
CONFIG_SYS_SDRAM_SIZE:=0x10000000
Flash: NAND
product_vid = 144
board_index = 59,vid=144-TBY06G
pass pinmux for flash
NAND:  NAND_special nand special:0

Manu ID: 0x98, Chip ID: 0xda (Toshiba NAND 256MiB 3,3V 8-bit)
256 MiB
<nand_read_skip_bad_,1302>!mtdpart=0x1,offset=0x0,mtdpartoffset=0x180000,mtdPartsize=0x80000,length=0x20000
In:    serial
Out:   serial
Err:   serial
clk_pll env is not setted, core clk won't change
Net:   enter ref_clk_set.. mode = 0 .
enter pll_cfg_fractional
ref_clk_set success!
gpon serdes init
innerGeLedPolarSet 1
innerGeLedPolarSet 1
innerGeLedPolarSet 1
innerGeLedPolarSet 1
eth0

Hit 1 to upgrade software version
Hit ENTER key to stop autoboot:  0
do_mcupg function enter..
tm_pon_tm_init
after pon_tm_qmg_init
Using eth0 device

moomin

moomin 发表于 2023-6-4 15:59
江苏无锡联通宽带光猫：SK-D740-C

波特率：115200

根据ttl信息：
按数字1是升级软件系统
按enter是中断uboot
？

=> ?
?       - alias for 'help'
base    - print or set address offset
bdinfo  - print Board Info structure
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootk   - boot kernel
bootm   - boot application image from memory
bootz   - boot Linux zImage image from memory
cmp     - memory compare
coninfo - print console devices and information
cp      - memory copy
dhcp    - boot image via network using DHCP/TFTP protocol
downver - upgrade software downloaded from TFTP server
echo    - echo args to console
erase   - erase FLASH memory
fdt     - flattened device tree utility commands
flinfo  - print FLASH memory information
fr      - fpga read
fw      - fpga write
go      - start application at address 'addr'
gpiotest- gpiotest dir [num] [in/out]
gpiotest value [num] [1/0]
gpiotest gvalue [num]
help    - print command description/usage
imxtract- extract a part of a multi-image
itest   - return true/false on integer compare
mcupg   -  multicast upgrade
md      - memory display
mii     - MII utility commands
mtddebug- mtddebug operate
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sky_bakeup_info- sky bake up all the info
sleep   - delay execution for some time
snumber - Get or set serial number for zte boards
submpasswd- Set uboot menu password for safe boot mode
swsfmd  - Manually switch to safe boot mode
tftp    - boot image via network using TFTP protocol
version - print monitor, compiler and linker version
watchdog- watchdog reset && disable
xmodem  - xmodem
zx_i2c_read- mdio clock scan
zx_i2c_write- mdio clock scan

moomin

moomin 发表于 2023-6-4 16:11
根据ttl信息：
按数字1是升级软件系统
按enter是中断uboot

=> base
Base Address: 0x00000000
=> bdinfo
arch_number = 0x002A9767
boot_params = 0x40000100
DRAM bank   = 0x00000000
-> start    = 0x40000000
-> size     = 0x10000000
eth0name    = eth0
ethaddr     = 40:67:9B5:63:F4
current eth = eth0
ip_addr     = 192.168.1.1
baudrate    = 115200 bps
TLB addr    = 0x4FFF0000
relocaddr   = 0x4FF87000
reloc off   = 0x08087000
irq_sp      = 0x4F546F40
sp start    = 0x4F546F30

moomin

=> nand
nand - NAND sub-system

Usage:
nand info - show available NAND devices
nand device [dev] - show or set current device
nand read - addr off|partition size
nand write - addr off|partition size
    read/write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
nand read.raw - addr off|partition [count]
nand write.raw - addr off|partition [count]
    Use read.raw/write.raw to avoid ECC and access the flash as-is.
nand write.uboot - addr off size
    write uboot to nand with 4-bit-ecc, compatible with bootrom.
nand erase[.spread] [clean] off size - erase 'size' bytes from offset 'off'
    With '.spread', erase enough for given file size, otherwise,
    'size' includes skipped bad blocks.
nand erase.part [clean] partition - erase entire mtd partition'
nand erase.chip [clean] - erase entire chip'
nand erase.GN25L95_datas [clean] - erase GN25L95_datas in flash'
nand bad - show bad blocks
nand dump[.oob] off - dump page
nand scrub [-y] off size | scrub.part partition | scrub.chip
    really clean NAND erasing bad blocks (UNSAFE)
nand markbad off [...] - mark bad block(s) at offset (UNSAFE)
nand biterr off - make a bit error at offset (UNSAFE)

moomin

=> <INTERRUPT>
=> printenvprintenv
Unknown command 'printenvprintenv' - try 'help'
=> printenv
baudrate=115200
bootcmd=setenv bootargs console=$(console) ubi.mtd=8 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc ro mem=$(memsize);bootm 0x440001e0;
bootdelay=1
bootfile=uboot.bin
bootloaderfile=bootloader.bin
configfile=zxic_pubconfig.bcb
console=ttyAMA0,115200n8
ethact=eth0
ethaddr=40:67:9B5:63:F4
fullfile=upgrade.bin
fwmagic=d2b2201466a2e0c5aaca9ab571f31522
gatewayip=192.168.1.1
hostname=unknown
ipaddr=192.168.1.1
linuzfile=vmlinuz.bin
loadaddr=0x44000000
memsize=256M
netmask=255.255.255.0
netretry=5
serverip=192.168.1.101
stderr=serial
stdin=serial
stdout=serial
versioninfo=U-Boot 1.0.0 20220607113620 0x200000 0x0 0x83 0x82

Environment size: 691/131068 bytes
=>

moomin

=> version

U-Boot 2013.04-svn202189 (Jun 07 2022 - 11:33:12)
arm-buildroot-linux-gnueabi-gcc.br_real (Buildroot 2017.05-svn2186) 4.9.4
GNU ld (GNU Binutils) 2.27

moomin

文件系统：
Creating 15 MTD partitions on "denali-nand":
0x000000000000-0x000010000000 : "whole flash"
0x000000000000-0x000000200000 : "u-boot"
0x000001d00000-0x000002000000 : "parameter tags"
0x000000200000-0x000000800000 : "kernel0"
0x000000800000-0x000000e00000 : "kernel1"
0x000000e00000-0x000001800000 : "usercfg"
0x000001800000-0x000001900000 : "others"
0x000001900000-0x000001d00000 : "wlan"
0x000002000000-0x000004e00000 : "rootfs0"
0x000004e00000-0x000007c00000 : "rootfs1"
0x000008000000-0x000008200000 : "phoneapp"
0x000008200000-0x000008400000 : "phoneapp1"
0x000008400000-0x00000a200000 : "framework"