Vodafone EasyBox 904 xDSL

From Random Projects
Jump to: navigation, search

This page collects some infomation on the Vodafone EasyBox 904 xDSL VDSL/ADSL router.

Overview

Hardware

System info

See Vodafon EasyBox 904 xDSL/Sysinfo for a lot of (software and hardware) details about the device, including /proc/cpuinfo, /proc/mtd, lsmod, uboot_env --list, and so on.

PCB photos

Getting access

UART

There is a populated 4-pin header on the board, which allows easy access to the UART of the SoC. In order to do that, connect a 3.3V TTL USB-to-serial adapter/cable to the RX, TX, and GND pins. Do not connect anything to the VCC pin!

Pin Description
1 VCC (3.3V)
2 RX
3 TX
4 GND

JTAG

TODO.

Telnet

The telnetd binary is removed (Firmware 3.07 and newer)

SSH

TODO.

Backups

NAND flash

In order to create a backup of the NAND flash contents you can use a simple script like this (using ssh):

$ cat easybox_904_xdsl_nand_backup
P=easybox_904_xdsl_mtd
S=root@192.168.2.1
for i in `seq 0 14`; do
  ssh $S "dd if=/dev/mtd$i" | dd of=$P$i.dd
  ssh $S "/usr/sbin/nanddump -n -o /dev/mtd$i" | dd of="$P$i"_no.nanddump
  ssh $S "/usr/sbin/nanddump -n /dev/mtd$i" | dd of="$P$i"_n.nanddump
done

Vendor Firmware

  • U-Boot "for Infineon UEIP project" (modified)
  • Linux 2.6.32.32 (modified)
  • OpenWRT Backfire 10.03_r26799_20110504 (modified)
    • Target System: Lantiq CPE
    • Subtarget: VR9 Family
    • Target Profile: 904dsl Profile

Download (official Vodafone firmware update binary):

Vendor source code

Overview

The device is sold to (or given for free to) Vodafone (e.g. VDSL or ADSL) customers.

It seems to be manufactured / maintained by Arcadyan or a related company named Astoria Networks, where tarball source code releases are available:

Firmware MD5 sum
AT904X-02.01_source_20140306.tar.gz c6c2b664907ee6d69019efb8575e23db
AT904X-02.02_source_20140306.tar.gz cf92038e6357b5c9962648a06cf15753
AT904X-02.03_source_20140306.tar.gz b318a8202f0b6f15211aff47fa08e570
AT904X-02.05_source_20140220.tar.gz b02ff118013ef2041b6c56c968c7660e
AT904X-02.06_source_20140306.tar.gz ee180bdda0bcc9e49e297784ab5fe255
AT904X-03.05_source_20140310.tar.gz 5205861f3cdbc3bd347f7f2156ae63c5
AT904X-03.07_source_20140310.tar.gz 8c034a7786cad18a79fc82604f73a880
AT904X-03.10_source_20140310.tar.gz e0c45c5ae97a8025c369edbaaa4eb9d6

Note: Not all possible firmware numbers are available, e.g. no "v02.04". It is unknown whether such versions have ever existed or have been shipped to customers.

I have put those tarball releases into git (extracted) for easier manageability and for comparison purposes:

https://github.com/uwehermann/easybox-904-xdsl-firmware

Analysis

Most of the files in the dl/ subdirectory are exact copies of the respective upstream tarballs (the MD5 sums match).

The following files are either modified and/or cannot be found elsewhere apparently:

File Comments
dl/compat-wireless-2011-04-19.tar.bz2 TODO, probably unmodified upstream.
dl/drv_dsl_cpe_api_vrx-4.11.11.tar.gz DSL CPE API driver. Lantiq/Infineon code, dual license (GPL / 2-clause BSD).
dl/drv_mei_cpe-1.2.1.tar.gz MEI CPE driver. Lantiq/Infineon code, dual license (GPL / 2-clause BSD).
dl/dsl_cpe_control_vrx-4.11.11.tar.gz DSL CPE control application. Lantiq/Infineon code, dual license (GPL / 2-clause BSD).
dl/dsl_vr9_firmware_xdsl-05.05.01.07.01.06_05.05.03.03.01.02.tar.gz Contains only the binary file xcpe_551716_553312.bin.
dl/ifx_config_common_features-1.1.0.tar.gz
dl/ifx_dect-3.2.0.9.tar.gz
dl/ifx_IFXAPIs-2.0.1.39.tar.gz
dl/ifx_nfappcfg-1.0.0.4.tar.gz
dl/ifx_oam-1.1.0.6.tar.gz
dl/ifx_utilities-1.2.0.56.tar.gz
dl/ifx_voip_common-2.3.1.8.tar.gz
dl/lib_dti-1.1.0.tar.gz Debug and Trace Interface. Lantiq/Infineon code, dual license (LGPL / 3-clause BSD).
dl/linux-2.6.32.32.tar.bz2 Empty file (0 bytes in size), the modified Linux kernel code is in the linux/ directory, though.
dl/lq_coc_app_pm-2.0.5.0.tar.gz Power Management Utility. Lantiq/Infineon code, dual license (GPL / 2-clause BSD).
dl/lq_coc_app_pmd-1.0.3.0.tar.gz Power Management Daemon. Lantiq/Infineon code, dual license (GPL / 2-clause BSD).
dl/microwin-full-0.92.tar.bz2
dl/tapidemo-5.1.1.0.tar.gz Apparently a newer file than what is available on downloads.openwrt.org/sources.
dl/yaffs2_android-2008-12-18.tar.bz2 TODO, probably unmodified upstream.

Random facts

  • Web frontend IP address: 192.168.2.1 (see also)
  • The default username / password for the web frontend: root / 123456 (see also)
  • TFTP server IP address (for firmware upgrades): 192.168.2.100
  • Telnet default username / password: root / 123456
  • SSH: Disabled by default. Also, password logins are disabled by default (you need to give the dropbear server running on the box your public SSH key).
  • U-Boot SHA1 Key: 25b4e03c08bc9b4003316c7c47e9f3f88dd7f3d1

Resources

Vendor stuff

OpenWRT

Code examples