Theoryshare - The Broadband Experts

This tutorial outlines the process of modifying your RCA DCM425 cable modem to run a modified firmware (in this case Haxorware 1.1Rev31), through the use of the cable modem's console access.

Whats Required:

Theoryshare USB TTL Console Kit - Click here for more info

Or

DCM425 Cable Modem with Compatible Firmware

Teraterm Download Here - http://ttssh2.sourceforge.jp/

Modified BCM3349 Firmware Image (Available in the Theoryshare Downloads Section)

TFTPD32 Download Here - http://tftpd32.jounin.net/

Step 1. Check Firmware Compatibility

To be hackable your DCM425 must have a compatible firmware, the only firmwares which can be modified on this unit are the ST.52.03.XX series firmwares. You can check your firmware version at: http://192.168.100.1/diagnostics_page.asp a compatible firmware is pictured below.

Step 2. Configure your USB TTL Device

Before attempting to connect to the console port on your DCM425 you must first configure the device in two locations. First open the device manager from the control panel and setup the properties of your USB TTL Cable as pictured below.

Part 1. Locate your USB TTL device and take note of the COM port Number it was assigned we will need this later.

Part 2. Configure the properties of your USB TTL to those required for communicating with the DCM425

Step 3. Install and Configure Teraterm

After installing Teraterm from the link above instruct it to connect via serial port to the COM port you noted earlier in the device manager. Once this is done we need to update some settings in Teraterm for use with the DCM425.

Part 1. Select the Serial Port Configuration

Part 2. Copy the correct settings for communication with your modem

Step 4. Connect your USB TTL to the Modem

Below are the pinouts for both the modem and the USB TTL Device, used the enclosed cables to connect your device. When doing so note that only 3 leds need be connected to the modem. It is advisable to connect the 3.3v led vertically therefore only connecting to the 3.3v motherboard connector, however to do this you may have to break a small piece of the white plastic connector off the modem motherboard. This is recommended and will not impede future modifications or performance. This is pictured below in addition to the pinout information.

USB TTL Pinout

RCA DCM425 Pinout

Assuming the connector closest to the back of the modem is pin 1 the pinout is as follows.

Pin 1. RX

Pin 2. TX

Pin 3. Ground

Pin 4. 3.3v

RCA DCM425 Connected to a USB TTL

Step 5. Configure your IP Address and Activate the TFTP Server

Part 1. In the control panel under network connections change the IP settings on your network adapter to those shown below:

Once these settings are applied continue to part 2.

Part 2. TFTPD32 Configuration

Before the booting over network can take place TFTPD32 must be started, and when using Vista it must be run as an administrator as shown below.

Once TFTPD32 has started point the server directory to the location where your Hackware image file is located using the browse function. After this is complete click showdir to confirm that the file is being served by tftpd. In this tutorial our hackware image file is named 1131hackware.bin, the name of your image file will vary. This step completed successfully is illustrated below.

Step 6. Capturing the Console Output and Disabling DS Scanning

Part 1. Connect your modem directly to your computer via ethernet if you have not done so already, and connect the modem's console port to your computer as shown in step 4. Power the modem up, and you should immediately see activity in Teraterm if your USBTTL is configured correctly. If you are not seeing data you need to tweak with your USB TTL. The connections on this cable can sometimes be weak and the configuration of the software can be frustrating, but given the proper time and attention the connection will be successful. Assuming you are successful wait until the modem begins its DS Scan before continuing to part 2.

Part 2. Good job getting this far you are now nearly finished. Before we can upgrade the modem firmware we must stop the scanning from blocking our console output. To do this enter the next two commands carefully.

cd /d

scan_stop

Despite the continual bombardment of messages you can type these as slow as you need to get them right. If you are successful your will get a screen like this.

Step 7. Firmware Upgrade

Once you have reached the CM/DocsisCtl> prompt all you must do is issue the upgrade command and the modification will be complete. Enter the following command to upgrade your DCM425. When entering the command, keep in mind that 1131haxorware.bin is used as an example and you should specify the name of your firmware image. Alternatively you can rename your image 1131haxorware.bin for congruity. It is as follows

dload -i 1 -l -f 192.168.100.10 1131haxorware.bin

A few seconds after the command is issued your firmware should be downloaded from TFTPD32. A successful result looks like this:

Once the file has been transfered your modem will reboot to your new Firmware.

Pictured below the output from the DCM425 used to make this tutorial:

Terms of Use:

THIS TUTORIAL IS INTENDED FOR THEORETICAL USE ONLY, USE ON PRODUCTION SYSTEMS MAY VIOLATE YOUR ISP's TERMS OF SERVICE. THEORYSHARE TAKES NO RESPONSIBILITY FOR YOUR ACTIONS. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THIS SOFTWARE IS INTENDED FOR EDUCATIONAL USE ONLY AND MAY BE ILLEGAL IF USED IMPROPORLY. USERS ASSUME FULL RESPONSIBILITY FOR THEIR ACTIONS.