Theoryshare - The Broadband Experts

Haxorware is one of the most versitile diagnostic cable modem firmwares available. This manual documents page by page the all of the functions that that this firmware has to offer. In addition there is a brief review the different versions and builds currently available.

Versions and Builds

Current Revision: 1.1 R39
Compatibility: All BCM3349 chipset based modems (Including SB5101/E/i, SB5102/E/i, Webstar DPC2100R2, RCA DCM425, Ambit 250/255/256)
Versions: DIAG & LITE.

DIAG

• Might not perform optimally on a 8MB ram modem (16/32mb upgrade recommended).
• Based on sb5101u/n firmware (which includes diagnostic output, console and SPI support)
• Much more Verbose to troubleshoot issues.
• Standby button does not work
• Memory leak on SPI modems fixed in Rev39

LITE

• Based on sb5101e firmware
• Does not support SPI flash based modems.
• Crippled shell & much less diagnostic output in telnet/serial.
• Static ip option is missing because there is no ipconfig command in the shell anymore (and the entire /ip page is missing too).
• The standby button on a 5101 works in LITE

Changelog:

• R27 - Initial release of 1.1
• R30 - Fixed certgen
• R31 - Add Block Size support to TFTP client
• R32 - Add Ignore Timeouts option (Settings page), fix Config File page crash on long filenames
• R36: Fixed addresses for spoofs (MIPS address mangling), and added sysName spoof as well (uses Modem Model)
• R37: Finally fixed all spoofs. Added sysObjectID firmware version spoof. Added hardware and boot rev spoofs.
• R38: Erase function in file manager wasnt actually rebooting modem when it said it did. This is dangerous, the modem must be rebooted then.
• R39: Fixed serious memory leak concerning flash reads on SPI modems.

The DIAG build is based on SB5102-2.7.6.0-DIAG
The LITE build is based on SB5101E-2.7.5.0-LTSH

Status Panel

Once logged into the Haxorware modem At the top right of every page you will see the Haxorware title, the version, and the Revision number. You will also see:

Uptime: Lists how long the modem has been online

Memory: Current free memory/In use memory (Percent Free memory)

Status: Whether the modem is online and operational or other current status

DS: Downstream signal strength in dBmV / Downstream Signal to Noise Ratio indB US: upstream signal strength in dBmV

Status - Overview

HFC Parameters

Mode DHCP assigned address or Static
IP Address Your currently assigned IP address
Subnet Subnet mask applied to your IP address
TFTP Server "Provisioned" Config file name assigned by your isp
TFTP Filename “Provisioned" Config file name assigned by your isp
ToD Server "Provisioned" Time Of Day server IP assigned by your isp to synchronize against.
Configuration file Name "Actual" Config file name in use. when using one different from what was assigned by the ISP the filename shows here. Size Config file size 'Compliance ' DOCSIS version compliance of this config file.

Status - Signal

Downstream

Frequency This is the frequency your downstream channel is on
Status Whether the channel is locked or in process
Annex DOCSIS or EURODOCSIS
Modulation Modulation rate such as QAM256, QAM16, etc. Higher is faster.
Symbol Rate Number of symbols per second.
Receive Power Downstream channel signal strength measured in dBmV.
Signal to Noise ratio SNR measured in Decibles (Higher is better)

Upstream

Frequency This is the frequency your upstream channel is on
Channel ID Upstream channel number
Status Whether the channel is locked or in process
Mode TDMA or ATDMA. (ATDMA is faster)
Symbol Rate Number of symbols per second.
Transmit Power Broadcast signal strength to the head end at your ISP measured in dBmV

Status - Event Log

The event log displays modem events and errors during operation.

Configuration - Settings

Factory Mode This forces the modem to behave as if it was supplied by the ISP and bypasses customs settings.
Disable Firmware Upgrades This option will force Haxorware to ignore new modem firmware pushes from the ISP. Unchecking this could compromise your Haxorware install.
Force Network Access
Tftp Enforce Bypass If your ISP enforces Tftp config file this option will tell the modem to download the supplied config file at the right point - even if you are using another one.
Disable IP Filters on startup IP filters are used by some ISP's to block traffic of certain types on certain ports (such as if your ISP blocks port 80 to prevent you from hosting a web server). This option bypasses them entirely

Timeouts

Ignore T1 (No valid UCDs)
Ignore T2 (Ranging Opportunity)
Ignore T3 (Ranging Response)
Ignore T4 (Station Maintenance)

Administration

Control Panel IP Address Set a different IP than standard here if necessary
DHCP Server Check this to assign the IP to WAN on router or to PC. Uncheck this ONLY if you have it set manually.

WebGUI

Password protection enable or disable Password protecting the GUI from tampering.

Telnet Server

Current state Whether Telnet services are running
Run on startup Whether Telnet should start when the modem is booted, or only when manually enabled.

Configuration - Frequency

Annex - Choose DOCSIS or EURODOCSIS based on your region.
Plan Choose the type matching your region.
Preferred DS Freq 1, 2, & 3 is displayed in "Hz" not "mhz" (for example - 600mhz would actually be entered as 600000000) These are the frequencies checked first before scanning.

Upstream Channel This is the preferred upstream channel to try before scanning for available channels.

Configuration - Addresses

Addresses

HFC MAC This is the Mac address your ISP will see for this modem. Changing this to a number that does not have factory certificates loaded will generate a self signed certificate. Most ISP's do not accept self signed certificate in BPI+ docsis 1.1 mode. Click copy from certificate to change back to mac for current certificate.
Ethernet MAC This is the mac address your computer or router sees when querying the modem via ethernet
USB MAC This is the mac address your computer or router sees when querying the modem via usb
Serial Number This is the Serial number for the modem presented upon query

Certificate generation

Certificate type When generating certificates this is the type of certificate preferred

Configuration - Config File

Force Config File

Server IP This is the IP address of the TFTP server hosting the config file you want to run.
File name This is the filename of the config file you want to pull from the above IP

Autoserve

Autoserve Config File Disabled until new config is uploaded. Some ISP's can be tricked to allow you online using a config file saved directly to your modem instead.
Store new config Where you upload a stored config file.

Configuration - Baseline Privacy

Baseline Privacy

BPI Baseline privacy version running. BPI 1.1 must be enabled to use docsis 1.1 config files with valid certificates. Bypass must be enabled to use 1.1 configs with self signed certificates but will not work on all providers

Backup/Restore

Backup Backup your current certificate set
Restore from filesystem Restore uploaded or previously backed up certificate sets
Restore from file

Certificate Download

CertificateDownload individual certificates

Certificate Upload

Upload individual certificates here

Advanced - Static IP

Force Static IP Check this to force your modem to override any DHCP assigned Information to the contents below. Note that this does not stop your provider from assigning your IP to another user since you did not pull from their pool.
Suppress DHCP Requests Check this to ignore any requests from the provider to provide your modem with a DHCP lease
IP Address Enter your desired IP Address here
Subnet Mask Enter the applicable subnet mask here
Gateway Enter the appropriate gateway here
TFTP IP Enter your desired TFTP server IP address here
TFTP Filename Enter the Configuration filename on the TFTP server provided you wish to run
ToD IP Enter your desired Time Of Day server address here. This is generally the same as the TFTP server IP

Advanced - Stealth

This page is where you enter basic information for your modems behavior when the ISP SNMP scans your modem or you request a DHCP lease. The modem can tell the ISP it is anything you want and these are the fields you would enter this in. Many times ISP's check for specific information when querying a modem to determine whether it gets allowed online, a firmware update, etc. Many ISP's will not allow your modem online if it believes you are running an outdated firmware so be sure to enter the most current information on this page.

Modem Identifiers

Vendor Enter the manufacturer you want to emulate or tell the ISP you are running (such as "Motorola", etc)
Model This is where you enter the Model number information you want to supply
Software Version This is where you enter the firmware version you want to supply
Override Hardware Version Check this to supply a different hardware version to the vendor other than what it is.
Hardware Version Enter the hardware version you want to supply here
Override Bootloader Revision Check this to override the default bootloader revision sent to your ISP
Bootloader Revision Enter revision information here

SNMP Agent

Server Port Port number for snmp scans
Disable SNMP Agent after registration Check this to disable snmp probe requests from your isp after initial registration when the modem goes online (recommended)
Redirect SNMP Traps When SNMP requests are sent redirect them to another device and port (such as another modem on the network)
IP IP address to redirect to
Port Destination port at redirected IP

Advanced - Downloader

This page allows you to download config files from your ISP's TFTP server to examine them with programs such as vultureware or autoserve them from the modem.

The IP address and Filename may be entered here, and clicking download will prompt you with a file save dialog box.

Advanced - File Manager

Free Space

Before Defragmentation Size in KB before a defragmentation is performed
After Defragmentation Size in KB after a defragmentation is performed

Haxorware Configuration

Config File This allows you to Download or Delete the existing config file stored in the modem
File Size Filesize of config file in Bytes
Entries Number of entries in the config file

Restore From File

'Files' Previous backup files or uploaded files are shown here which can be downloaded or deleted in the following format:

CMXXXXXXXXXXXX.tar (size in bytes) (option)Download Delete

Upload New File

Choose file dialog prompted when this is clicked. Click upload after picking file to upload

Web Shell

The webshell allows console access via the web GUI. Any Shell commands can be entered here. These are generally commands you might use when at a file system shell (such as telnet) without having to open an actual session.

Factory Defaults

This option clears all dynamic settings such as preferred downstream frequencies, upstream channel IDs and their power levels.

Backup and Restore

Here you can Backup either your nonvol information, or do a FULL firmware backup (2MB) to a file. When you click backup you get prompted with a file save dialog.
You also can restore a previously backed up Nonvol here in case of issues

Firmware Update

Firmware upgrade

Firmware Image Pick the file you want to upload. Be sure to pick the right one. Haxorware DOES however have provisions to prevent drastically wrong choices (such as accidentally picking a 10kb text file)

Bootloader upgrade

Bootloader Image Update the bootloader only (such as if you need to load the noisy bootloader to diagnose issues)

About

Information about Haxorware

Reboot

Reboot your modem with this option

Haxorware is copyright ©2008-2010 Rajkosto & SBHacker.

Terms of Use:

THIS TUTORIAL IS INTENDED FOR THEORETICAL USE ONLY, USE ON PRODUCTION SYSTEMS MAY VIOLATE YOUR ISP's TERMS OF SERVICE. THEORYSHARE TAKES NO RESPONSIBILITY FOR YOUR ACTIONS. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THIS SOFTWARE IS INTENDED FOR EDUCATIONAL USE ONLY AND MAY BE ILLEGAL IF USED IMPROPORLY. USERS ASSUME FULL RESPONSIBILITY FOR THEIR ACTIONS.