The Belgacom Box 2 (BBOX2) is a router used by Belgacom, the most popular Internet Service Provider (ISP) of Belgium, to provide access to thousands of subscribers in the country. Statistics says that there are more then 300.000 of those boxes in circulation. It runs a modified version of Linux by default (OpenRG), and has 1 USB2.0 ports that allows people to modify it, and extend its features.
A dump of the 16M flash (via dd=/dev/mtdblock0 of=/tmp/16M) in /tmp allows you to backup the complete flash, but also to reflash the flash chip with the dd command. I tested it on a bbox2, rebooted it, and it works fine.
Toolchain
Thomson has a Microsoft Word file (Google HTML copy) where they explain the procedure to get a copy of the toolchain Sources-toolchain-3.2.2.tar:
Anyone may obtain from us a copy of the source code for the free software packages listed above. The source packages for these programs are available for download at http://www.thomson.net/open-software. Those individuals without Internet access may request that a CD-ROM or DVD containing the source code be sent to them by mail. To reimburse the expenses incurred by creation, handling and postage, we will charge a €12 fee. To request a CD ROM or DVD of the source code, send an e-mail to ten.nosmoht|terttoc.eivlys#ten.nosmoht|terttoc.eivlys or mail the request, with payment, to Thomson Sylvie Cottret – Open Software Source Code Request, 46 Quai Alphonse Le Gallo 92100 Boulogne-Billancourt, France.
The box has a TFTP client which you can use to download some software. I have setuped a TFTP server with dnsmasq (my dnsmasq.conf is here) and created a /tftproot directory where I have put the static busybox. Now you can telnet to your bbox2 and download the static busybox (your bbox2 has to be connected to the internet):
zoobab@buzek /home/zoobab/tmp2 [9]$ telnet 192.168.1.1
Trying 192.168.1.1...
Connected to 192.168.1.1.
Escape character is '^]'.
login: admin
Password: ********
[admin @ home]$ shell
BusyBox v1.01 (2010.01.26-12:11+0100) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
#
# tftp -g -r busybox -l /tmp/busybox zoobab.dyndns.org
(NOTE: it takes a while before giving you a shell back...)
# ls -lh /tmp/busybox
-rwxr-xr-x 1 0 0 974.0k Apr 5 18:12 /tmp/busybox
You can create all symlinks to busybox in one command:
/tmp # for i in `./busybox --help | ./grep 'Currently defined functions:' -A30 | ./grep '\s.*,'`; do ln -s busybox `echo $i | ./sed -e 's/,//g'`; done
/*
mp.c
David Rowe 17 May 2009
Mesh Potato kernel mode driver for the Si Labs 3215 FXS chipset. A
bit bashed SPI interface is constructed using the Atheros AR2317
(aka AR5315) SoC GPIO pins. The SPI port is used for
initialisation and signalling of the FXS port, the TDM speech data
is transferred through the SoC RS232 port (via a hacked version of
8250.c driver).
Credits: lots of SPI code and Si labs init code borrowed from
Zaptel wcfxs.c driver (Wildcard TDM400P TDM FXS/FXO Interface
Driver) written by Mark Spencer and Matthew Fredrickson.
*/
JTAG
Pinout
This is the one of a Philips MIPS 2x10 pins:
TRST
1
2
GND
TDI
3
4
GND
TDO
5
6
GND
TMS
7
8
GND
TCK
9
10
GND
SRESET
11
12
GND
NC
13
14
GND
NC
15
16
GND
NC
17
18
GND
NC
19
20
GND
Urjtag
UrJTAG 0.10 #1864
Copyright (C) 2002, 2003 ETC s.r.o.
Copyright (C) 2007, 2008, 2009 Kolja Waschk and the respective authors
UrJTAG is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
There is absolutely no warranty for UrJTAG.
jtag.c:518 main() Warning: UrJTAG may damage your hardware!
Type "quit" to exit, "help" for help.
jtag> cable JTAGkey
Connected to libftdi driver.
jtag> detect
discovery.c:117 urj_tap_detect_register_size() Warning: TDO seems to be stuck at 0
Error: parse.c:208 urj_parse_file() no error: Cannot open file '/home/zoobab/.jtag/rc' to parse
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000010011111010011000111001011 (0x027D31CB)
Manufacturer: Analog Devices, Inc. (0x1CB)
Unknown part! (0010011111010011) (/usr/local/share/urjtag/analog/PARTS)
jtag> detect
IR length: 5
Chain length: 1
Device Id: 00000010011111010011000111001011 (0x027D31CB)
Manufacturer: Analog Devices, Inc. (0x1CB)
Unknown part! (0010011111010011) (/usr/local/share/urjtag/analog/PARTS)
jtag>
> jtag> discovery
> Detecting IR length ... 5
> Detecting DR length for IR 11111 ... 1
> Detecting DR length for IR 00000 ... 1
> Detecting DR length for IR 00001 ... 671
> Detecting DR length for IR 00010 ... 32
> Detecting DR length for IR 00011 ... 671
> Detecting DR length for IR 00100 ... 1
> Detecting DR length for IR 00101 ... 1
> Detecting DR length for IR 00110 ... 1
> Detecting DR length for IR 00111 ... 306
> Detecting DR length for IR 01000 ... 1
> Detecting DR length for IR 01001 ... 1
> Detecting DR length for IR 01010 ... 1
> Detecting DR length for IR 01011 ... 1
> Detecting DR length for IR 01100 ... 1
> Detecting DR length for IR 01101 ... 1
> Detecting DR length for IR 01110 ... 1
> Detecting DR length for IR 01111 ... 1
> Detecting DR length for IR 10000 ... 1
> Detecting DR length for IR 10001 ... 1
> Detecting DR length for IR 10010 ... 1
> Detecting DR length for IR 10011 ... 1
> Detecting DR length for IR 10100 ... 1
> Detecting DR length for IR 10101 ... 1
> Detecting DR length for IR 10110 ... 1
> Detecting DR length for IR 10111 ... 1
> Detecting DR length for IR 11000 ... 1
> Detecting DR length for IR 11001 ... 1
> Detecting DR length for IR 11010 ... 1
> Detecting DR length for IR 11011 ... 1
> Detecting DR length for IR 11100 ... 1
> Detecting DR length for IR 11101 ... 1
> Detecting DR length for IR 11110 ... 1
> jtag>
> jtag> initbus ejtag_dma
> Initialized bus 1, active bus 0
> jtag> print
> No. Manufacturer Part Stepping Instruction Register
> 0 (none) (none)
>
> Active bus:
> *0: EJTAG compatible bus driver via DMA (JTAG part No. 0)
> start: 0x00000000, length: 0x1E000000, data width: 32 bit, (USEG : User addresses)
> start: 0x1E000000, length: 0x02000000, data width: 16 bit, (FLASH : Addresses in flash (boot=0x1FC000000))
> start: 0x20000000, length: 0x60000000, data width: 32 bit, (USEG : User addresses)
> start: 0x80000000, length: 0x20000000, data width: 32 bit, (KSEG0: Kernel Unmapped Cached)
> start: 0xA0000000, length: 0x20000000, data width: 32 bit, (KSEG1: Kernel Unmapped Uncached)
> start: 0xC0000000, length: 0x20000000, data width: 32 bit, (SSEG : Supervisor Mapped)
> start: 0xE0000000, length: 0x20000000, data width: 32 bit, (KSEG3: Kernel Mapped)
> jtag> readmem 0x1FC000000 0x02000000 out.bin
> address: 0xFFFFFFFC
> length: 0x02000000
> reading:
> chain.c(149) Part 0 without active instruction
> Segmentation fault
> root@buzek /home/zoobab [5]#
USB key speed test
I plugged into the USB slot a USB key formatted in vfat, it seems to be a USB2 port, I have a speed of 2.5MO:
root@buzek /tmp [2]# while true; do wget http://192.168.1.1:631/sda1/10m; done
--2010-03-18 20:10:05-- http://192.168.1.1:631/sda1/10m
Connecting to 192.168.1.1:631... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10485760 (10M) [application/octet-stream]
Saving to: `10m.4'
100%[================================================>] 10,485,760 2.51M/s in 4.0s
2010-03-18 20:10:09 (2.50 MB/s) - `10m.4' saved [10485760/10485760]
--2010-03-18 20:10:09-- http://192.168.1.1:631/sda1/10m
Connecting to 192.168.1.1:631... connected.
HTTP request sent, awaiting response... 200 OK
Length: 10485760 (10M) [application/octet-stream]
Saving to: `10m.5'
100%[================================================>] 10,485,760 2.54M/s in 4.0s
2010-03-18 20:10:13 (2.53 MB/s) - `10m.5' saved [10485760/10485760]
Hackito Ergo Sum: http://hackitoergosum.org/program/
Title: Hacking the Belgacom Box 2
Abstract: The Belgacom Box 2 is one of the most popular box in
Belgium, which is used by the main internet service provider Belgacom.
It is one of the first router with a VDSL2 interface, VoIP and an
atheros card. It runs Linux by default (OpenRG), but no sources are
available. This talk will provide technical details on how to add
additional software to the device via cross-compilation with the
OpenWRT framework, JTAG access, bootloader replacement and experience
with a widespread GPL violation.
Web: http://www.zoobab.com/bbox2
Hello, do you have success to compile a new firmware non proprietary for belgacom b-box2? I'm interested because I want to do WDS and wifi 802.11.n with my bbox2.
To have those features, I would need to compile kernel modules for the box, and there are no kernel sources available from Belgacom. I am gonna write them a letter now.
here [url]http://forum.adsl-bc.org/viewtopic.php?t=49846[/url] you can find a person who already wrote to belgacom, without success.
I missunderstand because actually I bought the sagem modem and there is some GPL source code inside, which has been modded, but Belgacom do not publish sources and refuse to deliver them when we ask.
I think they re in total violation of the GPL Licence, but it's a big company, and nothing happen…
Could you post some pictures of your serial pinouts 'cos i'm very interrested to test if it's possible to bypass the "init" and give /bin/bash" at the kernel by the bootloader. I would be happy to set up the wds with freeradius on bbox and develop some others features.
Toolchain available from Livebox-floss.com:
http://www.livebox-floss.com/Products/LiveBox/LiveBox2/vFAST3XXX_6813E2/toolchain-mips-linux-uclibc-prebuilt.tar.bz2
zoobab@buzek /home/zoobab/soft/bbox2/mips-linux-uclibc [57]$ grep lx4 -R *
[…]
bin/mips-linux-gccbug:configured with: /home/floss/FLOSS/orange-floss/Products/LiveBox/LiveBox2/Sagem/.tmp.28720/toolchain-mips-linux-uclibc/toolchain_build_mips_nofpu/gcc-3.4.3/configure —prefix=/home/floss/FLOSS/orange-floss/Products/LiveBox/LiveBox2/Sagem/.tmp.28720/toolchain-mips-linux-uclibc/build_mips_nofpu/staging_dir —build=i386-pc-linux-gnu —host=i386-pc-linux-gnu —target=mips-linux-uclibc —enable-languages=c,c++ —enable-shared —disable-__cxa_atexit —enable-target-optspace —with-gnu-ld —disable-nls —enable-multilib —with-float=soft —with-arch=lx4189
The sources are there:
http://www.livebox-floss.com/Products/LiveBox/LiveBox2/vFAST3XXX_6813E2/toolchain-mips-linux-uclibc.tar.bz2
does this provide the drivers for the components (VDSL, ethernet, wifi) ?
As far as I know, there are no open source drivers for the VDSL2 module.
But for the Wifi, the Atheros chipset is well supported by Linux, ethernet I have no idea, but probably yes.
I am trying to solder a JTAG, and I will request the complete sources to Belgacom soon.
This is great work. Hope you succeed with the jtag.
Thx from a Bbox2 user.
Zwintje
Hackito Ergo Sum: http://hackitoergosum.org/program/
Title: Hacking the Belgacom Box 2
Abstract: The Belgacom Box 2 is one of the most popular box in
Belgium, which is used by the main internet service provider Belgacom.
It is one of the first router with a VDSL2 interface, VoIP and an
atheros card. It runs Linux by default (OpenRG), but no sources are
available. This talk will provide technical details on how to add
additional software to the device via cross-compilation with the
OpenWRT framework, JTAG access, bootloader replacement and experience
with a widespread GPL violation.
Web: http://www.zoobab.com/bbox2
The Alice Gate VoIP 2 Plus Wi-Fi is also based on the same chip:
http://www.ilpuntotecnicoeadsl.com/wiki/index.php?title=Alice_Gate_VoIP_2_Plus_Wi-Fi_(Industrie_Dial_Face)
or http://ur1.ca/23i8x
There are some GPL sources here:
http://www.pirellibroadband.com/web/support-area/gpl-code/default.page
Hello, do you have success to compile a new firmware non proprietary for belgacom b-box2? I'm interested because I want to do WDS and wifi 802.11.n with my bbox2.
Thanks
@Robin
To have those features, I would need to compile kernel modules for the box, and there are no kernel sources available from Belgacom. I am gonna write them a letter now.
Hello zoobab,
Anything new about this ?
Thanks!
Hi,
here [url]http://forum.adsl-bc.org/viewtopic.php?t=49846[/url] you can find a person who already wrote to belgacom, without success.
I missunderstand because actually I bought the sagem modem and there is some GPL source code inside, which has been modded, but Belgacom do not publish sources and refuse to deliver them when we ask.
I think they re in total violation of the GPL Licence, but it's a big company, and nothing happen…
Regards
Hello,
Could you post some pictures of your serial pinouts 'cos i'm very interrested to test if it's possible to bypass the "init" and give /bin/bash" at the kernel by the bootloader. I would be happy to set up the wds with freeradius on bbox and develop some others features.
Good Job !
Thanks
You just could have asked to use my photo's, that would have been nicher…
Qless
arnoraps.tweakblogs.com
Post preview:
Close preview