WiFo

Anyone have one for sale?

Thanks

I dont see why not. That would involved changing some routes. Anyone up for doing a simple tracert between two DirecWay boxes? I am guessing, it goes ALL THE WAY back to the NOC and turns around. We could modify it most likely, so that if the two units are on the same satellite, it can use it as a reflector Effectively cuting the lag down considerably.

Cheers

In my efforts to provide us with great control of our hardware, I am now able to provide shell access via telnet to the model 7000 unit. From this, you can browse the real time stats, even peruse the virtual file system.

I think i will focus on a simple PC App that allows for easy shell access to the modem. Perhapse with some usefull scripts, such as reading values, and making the LED's respond differently.

I am open to suggestions for applications, the sky is the limit with these units. We could even port some existing apps to RUN on these units.

Even though this seems funny, I am fairly certain we can dump raw data from A/V satellites and have it stream to a local ftp server, since we have full control of the radio, mind you when doin gthis the internet would be offline of course.

Cheers

Thank you for the offer, but I dont have DSL service where I live. Looking for any DirecWay modems

Anyone with any dusty old modems / "fried" units, I am up for paying the shipping. I will have a second dish soon, and need modems for hardware tests. Some will be sacrificed to JTAG / probe.

Ok, I have 20% of the firmware disassembled. I am going through, adding comments to the different regions. Good news, I can actually access the IO's easily enough, as well as compile some simple tcp utilities.

I really need to dump the root password, or find a way in to the shell with even greater permissions.

I have a script running now, checking port status at different stages, looking for holes.

So far port 87 is proving very useful.

Cheers

I was able to dump the backup firmware last night. I will spend some time dissasembling today, to make sure the ELF is valid. I might be able to get the image to start in a tornado emulator. More soon

Cheers

PM sent. Any donations greatly appreciated, and I canb provide proof of purchase. It will all be used for research. I have a 7000, and a 6000 coming. Adding a 4000, and any others (including dupes) could not hurt.

Tonight I will have some time to see about dumping the 7000 firmware.

Cheers

As soon as I get a 4000, I will RE it. I have a suspiscion about somethin, the boot config in particular. It seems to me certain things will be easily adjusted / reset once I get a little further with the 7000. I am sure the 4000 is less involved.

If anyone has a 4000 (or any system for that matter, dead or not), they want to get rid of, please let me know. It will go to great use. I just bought a complete 6000 system (used) locally, so I can JTAG it and atain root access. Looks like I may have to wire up a serial port on it to get console access.

I must also note, the 7000 does indeed use fttp/ftp to grab its radio side boot config (not firmware that i know of yet).

Cheers

On second look :

"No place else on Ebay can you find a complete system for only $9.95 (activation fee) that includes professional installation included. No upfront cost and a $100 mail in rebate. Yes, we dispatch out an installer to deliver the system to you and install it the very same day! The HN7000S Complete Satellite system comes with the following. "

I think he is selling the activation service only

Thats a great deal if it is real. Someone buy a couple, I will paypal you money if its legit

Thanks for the warm welcome. Since cable modem is no longer available, i will focus my efforts on DirecWay

The 4000 is the usb model correct? If so, it is still highly modifiable, however it takes a slightly different approach.

See these 6000 and 7000's run a RTOS (real time OS) called vxworks, much like the cable modems, some DSS receivers, and a few parts of most modern cars. This provides an enormous amount of flexibility. Because of where I work, I also have access to the WindRiver compilers to create custom builds of vxworks, and add-ons. I can also inject Assembly into empty code sections, to provide full access to these units. From there I can create .NET applications so anyone can easily manipulate settings, add features, etc.

Let me say this right off the bat. I am not an advocate of theft of service, but I am all for being able to do anything we want with the hardware we pay for.

You can expect a lot of info / development from me over the coming months.

I can / will only go so far with my subbed 7000 right now, as I need it for internet, and cant risk frying it. I have already found power user access to the shell, the next step is to gain access to the TWO firmware

Wow, they are cheap on ebay. I might just do that, However at this point, a 7000 would still be usefull as well.

Update : It looks like I may be able to have the unit send me the loaded and backup firmware images. Worst case I can inject raw ASM to get  some handy features working.

As a side note, I just realized it is running my old friend VxWorks Same as the surfBoards.

Anyone want to start a pool to buy a test 7000 modem ? I had one IM already offering. That or if someone can come up with one, that would work too.

Cheers

Upload # 1

:::.. Upload Stats ..:::

Upload Connection is:: 283 Kbps about 0.28 Mbps (tested with 579 kB)

Upload Speed is:: 35 kB/s

Tested From:: https://testmy.net/ (Server 1)

Test Time:: 2006/08/16 - 6:22pm

Bottom Line:: 5X faster than 56K 1MB Upload in 29.26 sec

Tested from a 579 kB file and took 16.75488 seconds to complete

Upload Diagnosis:: Awesome! 20% + : 188.78 % faster than the average for host (direcpc.com)

U-Validation Link:: https://testmy.net/stats/id-7ONSTY8LH

User Agent:: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser; Avant Browser; .NET CLR 1.1.4322; .NET CLR 2.0.50727) [!]

Upload #2

:::.. Upload Stats ..:::

Upload Connection is:: 283 Kbps about 0.28 Mbps (tested with 579 kB)

Upload Speed is:: 35 kB/s

Tested From:: https://testmy.net/ (Server 1)

Test Time:: 2006/08/16 - 6:26pm

Bottom Line:: 5X faster than 56K 1MB Upload in 29.26 sec

Tested from a 579 kB file and took 16.75488 seconds to complete

Upload Diagnosis:: Awesome! 20% + : 188.78 % faster than the average for host (direcpc.com)

U-Validation Link:: https://testmy.net/stats/id-G4R90MOPX

User Agent:: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser; Avant Browser; .NET CLR 1.1.4322; .NET CLR 2.0.50727) [!]

Upload #3

:::.. Upload Stats ..:::

Upload Connection is:: 287 Kbps about 0.29 Mbps (tested with 579 kB)

Upload Speed is:: 35 kB/s

Tested From:: http://s2.testmy.net

Test Time:: 2006/08/16 - 6:27pm

Bottom Line:: 5X faster than 56K 1MB Upload in 29.26 sec

Tested from a 579 kB file and took 16.51488 seconds to complete

Upload Diagnosis:: Awesome! 20% + : 192.86 % faster than the average for host (direcpc.com)

U-Validation Link:: https://testmy.net/stats/id-SKZBLQYIV

User Agent:: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser; Avant Browser; .NET CLR 1.1.4322; .NET CLR 2.0.50727) [!]

Download #1

:::.. Download Stats ..:::

Download Connection is:: 1345 Kbps about 1.35 Mbps (tested with 5248 kB)

Download Speed is:: 164 kB/s

Tested From:: http://www.timpawlak.isaf.us/downloads

Test Time:: 2006/08/16 - 6:31pm

Bottom Line:: 23X faster than 56K 1MB Download in 6.24 sec

Tested from a 5248 kB file and took 31.969 seconds to complete

Download Diagnosis:: Awesome! 20% + : 28.71 % faster than the average for host (direcpc.com)

D-Validation Link:: https://testmy.net/stats/id-FGN5VUW9K

User Agent:: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser; Avant Browser; .NET CLR 1.1.4322; .NET CLR 2.0.50727) [!]

Download #2

:::.. Download Stats ..:::

Download Connection is:: 1478 Kbps about 1.48 Mbps (tested with 5248 kB)

Download Speed is:: 180 kB/s

Tested From:: http://s1.testmy.net

Test Time:: 2006/08/16 - 6:34pm

Bottom Line:: 26X faster than 56K 1MB Download in 5.69 sec

Tested from a 5248 kB file and took 29.094 seconds to complete

Download Diagnosis:: Awesome! 20% + : 41.44 % faster than the average for host (direcpc.com)

D-Validation Link:: https://testmy.net/stats/id-F3XR08DVL

User Agent:: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser; Avant Browser; .NET CLR 1.1.4322; .NET CLR 2.0.50727) [!]

Download #3

:::.. Download Stats ..:::

Download Connection is:: 1293 Kbps about 1.29 Mbps (tested with 5248 kB)

Download Speed is:: 158 kB/s

Tested From:: http://eebobb.com

Test Time:: 2006/08/16 - 6:35pm

Bottom Line:: 23X faster than 56K 1MB Download in 6.48 sec

Tested from a 5248 kB file and took 33.25 seconds to complete

Download Diagnosis:: Awesome! 20% + : 23.73 % faster than the average for host (direcpc.com)

D-Validation Link:: https://testmy.net/stats/id-RD2LV709G

User Agent:: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Avant Browser; Avant Browser; .NET CLR 1.1.4322; .NET CLR 2.0.50727) [!]

Overall I am pleased. I noticed though, that I can actually upload at 50-60KB/s via ftp to most sites.

Are these decent results for the 7000 unit?

I have a signal 80 +- during these tests.I have the .98 Dish.

Thanks!

I have one, I just do not want to JTAG my subbed unit, one error and its dead. If I could get a dead unit with an intact firmware I can do this safely.

Yep, I found that one. I need even more detail, particularly the other side, so I can check a few ideas I had on the trace paths. Thanks!

I found an image of the board.

Looks like I can easily add a serial port to the 7000.

Also looks like a simple JTAG to dump the DWAY firmware.

I have yet to find any good schematics, or hi res close ups of the mainboard.

Anyone have a dead 7000 laying around? That could be put to very good use.

Cheers

Oh also, if the 6000 or 7000 has SNMP available, we could easily walk the MIBS to get the info. If not, good ol' winpcap

Are you still working on this project? Seems like a snap to do. I can help out (providing you are using C# / C++).

Cheers

I have done alot of work on "customizing" motorola cable modems, adding features, etc (changing MAC adress, removing filters, adding a better internal firewall). Having been an application developer for over 8 years, I have plenty of experience in embedded MCU's.

Does anyone have any schematics of the 7000 or 6000 units?

My first goals are to able to dump the firmware, and run it through IDA . I can easily enough write some ASM, and inject it where needed to acheive the desired results.

After that, I would like to be able to dump the data from the RF side of the unit in real time, that should give us some insight on what can be improved.

Oh, and this is a great site you have here