Katılım
3 Aralık 2023
Mesajlar
15.077
Makaleler
104
Çözümler
1.590
Beğeniler
45.768
Yer
İstanbul
Türk Telekom'un VDSL müşterilerine verdiği AC1200 Wireless Dual Band VDSL/ ADSL Modem Router oluyor kendisi. Kullanıcı adı ve şifreyi öğrenmeye çalışacağız bakalım.
  • Yazılım Versiyonu: VC220-G3u-v2.0_241120
  • Donanım Versiyonu: VC220-G3u v2 00000001
  • Serigrafi: “MK-BD-1650” / “2011500393”
    Bileşenler:
    • ESMT F50L1G41LB 128 MiB NAND Flash
    • EcoNet EN751221 SoC
    • Yakınında 2.4 GHz / 5 GHz Wi-Fi yongaları (U.FL konnektörleri ile)
  • SoC (Sistem Çipi): MT7621AT
  • Flash: ESMT F59L1G81MA (NAND)
  • RAM (Bellek): ESMT M14D5121632A
60D739A7-174D-44BC-B91E-1FD5C3628D94.webp


Kod:
BGA IC
Xtal:1
DDR3 init.
DRAMC init done.
Calculate size.
DRAM size=128MB
Set new TRFC.
ddr-1066

7512DRAMC V1.2.2 (0)
Set SPI Flash Clock to 25 Mhz


EN751221 at Fri Mar 19 05:35:52 UTC 2021 version 1.1 free bootbase

Memory size 128MB

Set SPI Flash Clock to 25 Mhz
spi_nand_probe: mfr_id=0xc8, dev_id=0x1
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_F50L1G41LB, Flash Size=0x8000000
bmt pool size: 81
BMT & BBT Init Success

Press any key in 1 secs to enter boot command mode.
............


Invalid Power GPIO, just return and don't turn on Power LED
not find tclinux_slave partition
flash_base=0,flash_tclinux_start=80000,TCLINUX_SLAVE_FLASH_START=fff80000

>>>> CTC: boot_flag_addr: 120000; flag: 30

==> boot flag = 0g_kernel_tag_start = 1e0000
the tag fsLen is 0xe88000, fsAddr is 0x200000, kernelLen is 0x1576a3, kernelAddr is 0x200

==> startAddr = 0x80006530
Decompress to 80002000 free_mem_ptr=80E00000 free_mem_ptr_end=80780000
75xx: 0x0
Uncompressing [LZMA] ...  done.
==> jumpAddr = 0x80006530
Linux version 2.6.36 (root@af68b6d08a32) (gcc version 4.3.6 (Buildroot 2012.05) ) #74 SMP Wed Nov 20 02:02:23 UTC 2024
ISPRAM0: PA=00330000,Size=00010000,enabled
memsize:128MB
EcoNet EN751221 SOC prom init
bootconsole [early0] enabled
CPU revision is: 00019558 (MIPS 34Kc)
Determined physical RAM map:
 memory: 07fe0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Zone PFN ranges:
  Normal   0x00000020 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000020 -> 0x00008000
3 available secondary CPU TC(s)
PERCPU: Embedded 7 pages/cpu @81103000 s7264 r8192 d13216 u65536
pcpu-alloc: s7264 r8192 d13216 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32480
Kernel command line:  es=1
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00061f0e
Readback ErrCtl register=00061f0e
nmi base is 8115c200
Memory: 125224k/130944k available (3288k kernel code, 5720k reserved, 669k data, 208k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
        RCU-based detection of stalled CPUs is disabled.
        Verbose stalled-CPUs detection is disabled.
NR_IRQS:64
CPU frequency 900.00 MHz
 Using 199.968 MHz high precision timer.
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
34K sync es set to 1.
Config7: 0x80080500
Limit of 4 TCs set
TLB of 64 entry pairs shared by 2 VPEs
VPE 0: TC 0 1 2, VPE 1: TC 3
IPI buffer pool of 16 buffers
CPU revision is: 00019558 ((null))
TC 1 going on-line as CPU 1
CPU revision is: 00019558 ((null))
TC 2 going on-line as CPU 2
CPU revision is: 00019558 ((null))
TC 3 going on-line as CPU 3
Brought up 4 CPUs
kworker/u:0 used greatest stack depth: 14864 bytes left
NET: Registered protocol family 16
MT7512_pcie_init
check pcie link up status:
isRC0_LINKUP=1
isRC1_LINKUP=1
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20100000-0x202fffff]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  disabled]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem pref disabled]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20100000-0x201fffff 64bit pref]
pci 0000:02:00.0: BAR 0: set to [mem 0x20100000-0x201fffff 64bit pref] (PCI address [0x20100000-0x201fffff]
pci 0000:02:00.0: BAR 2: assigned [mem 0x20200000-0x20203fff 64bit pref]
pci 0000:02:00.0: BAR 2: set to [mem 0x20200000-0x20203fff 64bit pref] (PCI address [0x20200000-0x20203fff]
pci 0000:02:00.0: BAR 4: assigned [mem 0x20204000-0x20204fff 64bit pref]
pci 0000:02:00.0: BAR 4: set to [mem 0x20204000-0x20204fff 64bit pref] (PCI address [0x20204000-0x20204fff]
pci 0000:00:01.0: PCI bridge to [bus 02-02]
pci 0000:00:01.0:   bridge window [io  disabled]
pci 0000:00:01.0:   bridge window [mem 0x20100000-0x202fffff]
pci 0000:00:01.0:   bridge window [mem pref disabled]
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1

 mt7512_pcie_fixup: 0x1438 = 20000014
 mt7512_pcie_fixup: 0x3438 = 20100015
 mt7512_pcie_rc1_retrain: 80 = 0147dc12 80 = 01608c12
RC1 Link Traing Result: 10120008
TC3162 hardware watchdog module loaded.
kworker/u:0 used greatest stack depth: 14860 bytes left
squashfs: version 4.0 (2009/01/31) Phillip Lougher
fuse init (API version 7.15)
msgmni has been set to 244
io scheduler noop registered (default)
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
brd: module loaded

SPI Flash Init Start
Found no SPI flash device
Register flash device:flash0
IS_SPIFLASH=0x0, IS_NANDFLASH=0x2, (0xBFA10114)=0x6)
SPI_NAND_Flash_init: before init, mtx_mode_tog=0xl9, manaul_en=0x1
spi_nand_probe: mfr_id=0xc8, dev_id=0x1
Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_F50L1G41LB, Flash Size=0x8000000
Support SPI NAND erase statistic.
MAX_ERASE_CNT_START_OFFSET:52, MAX_ERASE_CNT_START_OFFSET_MAPPING:16
spi nand flash
tc3162: flash device 0x01000000 at 0x1c000000
EN7512 mtd init: spi nand probe enter
[spi_nand_setup] : Enter
NAND device: Manufacturer ID: 0xc8, Chip ID: 0x01 (Unknown _SPI_NAND_DEVICE_ID_F50L1G41LB)
nand_scan_ident ok
[spi_nand_setup]: chip size =  0x8000000, erase_shift=0x11
calc_bmt_pool_size : need_valid_block_num=0x51, total_block=0x400
File:drivers/mtd/chips/spi_nand_flash.c===>Function:spi_nand_setup Line:4846 bmt_pool_size=81
bmt pool size: 81
Init bmt table, size: 81
bmt count: 81, system count: 943
begin to search BMT from block 1023
Match bmt signature @ block: 1023
Valid BMT, version v1
bmt found at block: 1023, mapped block: 0
Load bmt data success @ block 1023
BMT v1.total 0 mapping
recover_bmt, block index: 0
recover_bmt, BMT table[-1]: bad_index=0, mapped_index=64
Match bbt signature
BBT Checksum is: 0x1
Valid BBT, version v1
bbt found, bad block count: 0
Load bbt data success
BMT & BBT Init Success
Creating 11 MTD partitions on "EN7512-SPI_NAND":
0x000000000000-0x000000020000 : "boot"
0x000000020000-0x0000000a0000 : "romfile"
0x0000000a0000-0x0000001a0000 : "config"
0x0000001a0000-0x0000001e0000 : "radio"
0x0000001e0000-0x0000003e0000 : "kernel"
0x0000003e0000-0x0000023e0000 : "rootfs"
0x0000001e0000-0x0000023e0000 : "ker_rofs"
0x0000023e0000-0x0000025e0000 : "kernel_2"
0x0000025e0000-0x0000045e0000 : "rootfs_2"
0x0000023e0000-0x0000045e0000 : "ker_rofs_2"
0x0000045e0000-0x000007300000 : "reserve_area"
---------spiflash_ioctl_read, addr:120000------
mtd[config]: map address 00120000 to offset 00080000

rootfs
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
RT3xxx EHCI/OHCI init.
TP-LINK Kernel Monitor Initializing...
Mirror/redirect action on
u32 classifier
    Actions configured
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1956 buckets, 51200 max)
ctnetlink v0.93: registering with nfnetlink.
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
---------spiflash_ioctl_read, addr:ff48------
mtd[boot]: map address 0000ff48 to offset 0000ff48
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
802.1Q VLAN Support v1.8 Ben Greear <[email protected]>
All bugs added by David S. Miller <[email protected]>
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing unused kernel memory: 208k freed
starting pid 307, tty '': '/etc/init.d/rcS'
mount used greatest stack depth: 14832 bytes left
cp used greatest stack depth: 14192 bytes left
hotplug used greatest stack depth: 13840 bytes left
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
BGA USB PHY config
port 0 u2_slew_rate_calibration
FM_OUT value = 152(0x00000098)
SR calibration value = 4
port 1 u2_slew_rate_calibration
FM_OUT value = 149(0x00000095)
SR calibration value = 4
USB driver version: 751221.2.20160516
xhc_mtk xhc_mtk: xHCI Host Controller
xhc_mtk xhc_mtk: new USB bus registered, assigned bus number 1
xhc_mtk xhc_mtk: irq 18, io mem 0x1fb90000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
xhc_mtk xhc_mtk: xHCI Host Controller
xhc_mtk xhc_mtk: new USB bus registered, assigned bus number 2
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver usblp
module_sel: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
TC3162 LED Manager 0.1 init
 
Son düzenleme:
Herhangi bir yardım veya test edilmesi gereken bir şey olursa buradayım 🫡. Su Allah'ın belası modemin kısıtlamalarından kurtar bizi. Bu arada elimde ZTE ZXHN H168A V2.0 modeli var normalde bu modemi kullanıyorum fakat sürekli internet kopması yaşıyorum o yüzden bu lanet modeme mahkûmum. 2.1 için root şifresi var fakat 2.0 için bulunmuyor. QOS bile ayarlayamıyoruz...😂
 
Ben de PPPoE şifremi merak ediyorum, bir yerlerde yazıyor olmalı ama bulamıyorum. Telekom'u aramak istemiyorum, başka routere geçeceğim.

Config decryption ile uğraşmak yerine web arayüzündeki yıldızları kaldırmak işe yarar mı acaba? Yani data gerçekten o arayüzde mi?

TP-Link 9970 routerlar için bir decrypter var, içinde Des keyi değiştirerek bu modemin Config'ini de decrypt edebiliriz belki ama bu key nerede, burada bir key var ama önceki modemin keyi 4 byte'Ti. Bu biraz daha büyük, aradığımız şey değil sanırım.
 
Son düzenleyen: Moderatör:
Data modemin arayüzünde yok maalesef. İlgilenmek isterseniz burada devam ediyoruz:

 
SMS ile 6606'ya SIFRE yazarak boşluk bıraktıktan sonra Ttnet hizmet numarasını yazınca gelen kullanıcı adı ve şifreden mi bahsediyoruz?
 
SMS ile 6606'ya SIFRE yazarak boşluk bıraktıktan sonra Ttnet hizmet numarasını yazınca gelen kullanıcı adı ve şifreden mi bahsediyoruz?
Evet. Hat sahibiyseniz gelen şifre.

Tabi bu şifreyi almanız modemde diğer ayarları yapabildiğiniz anlamına gelmiyor. DNS adresinizi değiştirmeyi denediniz mi?
 
Evet. Hat sahibiyseniz gelen şifre.

Tabii bu şifreyi almanız modemde diğer ayarları yapabildiğiniz anlamına gelmiyor. DNS adresinizi değiştirmeyi denediniz mi?

Hayır denemedim. OpenWrt baktım ama buna uygun bir dosya yok diyordu sitesinde. Wi-Fi kapatıp Bridge moduna alıp sadece modem olarak kullandığım için ekstra bir araştırmaya girmemiştim açıkçası.
 
Son düzenleyen: Moderatör: