D-Link DSL380T

ASDL2+-Modem/Router, default IP-address 192.168.1.1, Linux-based, 2MB NOR-Flash (Spansion S29AL016D 901F102), 8MB SDRAM (Hynix HY57V641620ETP-H), ti ADSL2+ System on a Chip (TNETD7300EZDW). Serial port and JTAG headers are present and pinout is known.

5 unpopulated LEDs! (Enough for an SD-Card interface :)), unpopulated USB header. Board is marked as DSL-500T (which is supposed to have 4MB flash + 16MB RAM).

Login is possible using telnet:

BusyBox on (none) login: admin

Password:

BusyBox v0.61.pre (2007.04.30-09:59+0000) Built-in shell (ash)

Enter 'help' for a list of built-in commands.

# free

total used free shared buffers

Mem: 6372 6120 252 0 508

Swap: 0 0 0

Total: 6372 6120 252

# df

Filesystem 1k-blocks Used Available Use% Mounted on

/dev/mtdblock/0 1376 1376 0 100% /

# cat /proc/version

Linux version 2.4.17_mvl21-malta-mips_fp_le (root@David.localdomain) (gcc version 2.95.3 20010315 (release/MontaVista)) #2 4 30 18:07:10 CST 2007

# cat /proc/cpuinfo

processor : 0

cpu model : MIPS 4KEc V4.8

BogoMIPS : 211.35

wait instruction : no

microsecond timers : yes

extra interrupt vector : yes

hardware watchpoint : yes

VCED exceptions : not available

VCEI exceptions : not available

Listens on ports 21 (ftp), 22 (ssh, but no daemon running), 23 (utelnetd) and 80 (thttpd):

Starting Nmap 4.20 ( http://insecure.org ) at 2007-10-28 21:12 CET

Interesting ports on **********:

Not shown: 1693 closed ports

PORT STATE SERVICE

21/tcp open ftp

22/tcp open ssh

23/tcp open telnet

80/tcp open http

Userspace is driven by a proprietary ti solution (cm == cfgmgr?), which handles practically everything from booting up to starting services and the web configuration interface. Using telnet one can access the practically undocumented cmdline interface (cm_cli):

# echo 'fdb:settings/service/ssh/state' | cm_cli -l

1 fdb:settings/service/ssh/state=2

# echo 'fdb:settings/service/ssh/state=1' | cm_cli

# echo 'fdb:settings/service/ssh/state' | cm_cli -l

1 fdb:settings/service/ssh/state=2

# echo 'begin;fdb:settings/service/ssh/state=1;end' | cm_cli

# echo 'fdb:settings/service/ssh/state' | cm_cli -l

1 fdb:settings/service/ssh/state=1

# echo 'lan0:static:settings/ip' | cm_cli -l

1 static-103:settings/ip=xxx.xxx.xxx.xxx

# echo 'lan0:static:settings/gateway' | cm_cli -l

error: error_code=-1, err_msg=Bad key 'settings/gateway' in 'static-103'

# echo 'lan0:static:settings/defaultgateway' | cm_cli -l

error: error_code=-1, err_msg=Bad key 'settings/defaultgateway' in 'static-103'

# echo 'lan0:static:settings/defaultroute' | cm_cli -l

# echo 'sar:status/dsl_carrier_state' | cm_cli -l

1 sar:status/dsl_carrier_state=2

# echo 'sar:status/dsl_ds_rate' | cm_cli -l

1 sar:status/dsl_ds_rate=18637

# echo 'sar:status/dsl_us_rate' | cm_cli -l

1 sar:status/dsl_us_rate=1263

# echo 'sar:status/dsl_us_attenuation' | cm_cli -l

1 sar:status/dsl_us_attenuation=10

# echo 'sar:status/dsl_ds_attenuation' | cm_cli -l

1 sar:status/dsl_ds_attenuation=23

Changes can be saved to flash using

# echo 'begin;logic:command/save;end' | cm_cli

cm_cli builtin help:

cm_cli -h

Usage: cm_cli [OPTIONS]

OPTIONS:

-t : assign the time out value in second

-l : output results in long format

-v : verbose mode

-h : this help message

EXAMPLE:

echo "logger:status/log" | cm_cli

echo "begin;logger:settings/loglevel=debug;end" | cm_cli

or

cm_cli <<-EOF

>begin

>logger:command/clear_log

>end

>EOF

NOTE: "set" or "command" requires a transaction with "begin" & "end"

The default config is kept in xml files, the userchanges are kept somewhere in an mtd partition (probably).

# ls /etc/*.xml

/etc/config.xml

/etc/progdefs.xml

/etc/strings.xml

/etc/sysdef.xml

The basic structure of cm_cli commands seem to be

<module>:(settings|status|command|valid_settings|temp)/<key>[=<value>]

Valid modules: (Found using 'strings /usr/bin/cm_logic | grep register' and trial+error):

strings bin/cm_logic | grep register:

container_register

event_global_register

time_register

system_register

eth_register

static_register

resolver_register

route_register

filter_register

hostname_register

upnp_register

bridge_register

usb_register

pppoa_register

pppoe_register

sar_register

pvc_register

rfc2684_register

clip_register

dhcpc_register

dhcps_register

service_register

routed_register

dhcpfwd_register

fwan_register

flan_register

fdb_register

igmpproxy_register

bfilter_register

snmp_register

webui_register

qos_register

wbridge_register

sntp_register

# echo 'time:xxx' | cm_cli

# echo 'abc:xxx' | cm_cli

error: error_code=-1, err_msg=There is no module 'abc'

# echo 'system:xxx' | cm_cli

error: error_code=-1, err_msg=Bad key 'xxx' in 'system'

Valid Modules:

time

logic

lan0

lan1

lanbridge0

lanbridge1

lanfilter0

lanfilter1

fdb

system

resolver

route

filter

upnp

sar

fdb

webui

sntp

snmpd

snmpcm

Some more commands:

# echo 'snmpcm:settings/community/entry' | cm_cli -l

1 snmpcm:settings/community/entry=public ro

2 snmpcm:settings/community/entry=

3 snmpcm:settings/community/entry=

# echo 'snmpcm:settings/system/sysname' | cm_cli -l

1 snmpcm:settings/system/sysname=DSL-380T

# echo 'lanfilter0:settings/activated' | cm_cli -l

1 lanfilter0:settings/activated=0

# echo 'lanfilter0:settings/protocol/proto1' | cm_cli -l

1 lanfilter0:settings/protocol/proto1=0x0800

# echo 'lanfilter0:settings/protocol/proto2' | cm_cli -l

1 lanfilter0:settings/protocol/proto2=0x86DD

# echo 'lanfilter0:settings/bf_mng_port' | cm_cli -l

1 lanfilter0:settings/bf_mng_port=0

# echo 'landhcps0:settings/state' | cm_cli -l

1 landhcps0:settings/state=0

# echo 'landhcps0:settings/dns1' | cm_cli -l

1 landhcps0:settings/dns1=192.168.1.1

# echo 'landhcps0:settings/pc1/ip' | cm_cli -l

1 landhcps0:settings/pc1/ip=192.168.8.1

# echo 'landhcps0:settings/pc1/mac' | cm_cli -l

1 landhcps0:settings/pc1/mac=00:00:00:00:00:00

# echo 'landhcps0:settings/pc1/hname' | cm_cli -l

1 landhcps0:settings/pc1/hname=router

# echo 'landhcpfwd0:settings/ip' | cm_cli -l

1 landhcpfwd0:settings/ip=0.0.0.0

# echo 'resolver:settings/nameserver1' | cm_cli -l

1 resolver:settings/nameserver1=168.95.1.1

# echo 'sntp:settings/prim_server' | cm_cli -l

1 sntp:settings/prim_server=0.0.0.0

# echo 'sntp:settings/secn_server' | cm_cli -l

1 sntp:settings/secn_server=0.0.0.0

# echo 'sntp:settings/poll_interval' | cm_cli -l

1 sntp:settings/poll_interval=30

# echo 'system:settings/thttpd/port' | cm_cli -l

1 system:settings/thttpd/port=80

# echo 'fdb:settings/service/mtu/mss_value' | cm_cli -l

1 fdb:settings/service/mtu/mss_value=1452

# echo 'fdb:settings/service/remote_telnet/RemoteNetmask' | cm_cli -l

1 fdb:settings/service/remote_telnet/RemoteNetmask=255.255.255.255

# echo 'fdb:settings/service/remote_telnet/RemoteHost' | cm_cli -l

1 fdb:settings/service/remote_telnet/RemoteHost=0.0.0.0

# echo 'fdb:settings/service/service_filter_telnet/state' | cm_cli -l

1 fdb:settings/service/service_filter_telnet/state=1

# echo 'fdb:settings/categoryG/ruleG1/description' | cm_cli -l

1 fdb:settings/categoryG/ruleG1/description=Asheron's Call

# echo 'fdb:settings/categoryG/ruleG1/protocolport1/portstart' | cm_cli -l

1 fdb:settings/categoryG/ruleG1/protocolport1/portstart=9000

# echo 'fdb:settings/categoryG/ruleG1/protocolport1/protocol' | cm_cli -l

1 fdb:settings/categoryG/ruleG1/protocolport1/protocol=UDP

# echo 'fdb:settings/categoryH/description' | cm_cli -l

1 fdb:settings/categoryH/description=Remote Management ACL

# echo 'fdb:settings/categoryH/acl/IP0' | cm_cli -l

1 fdb:categoryH/acl/IP0=0

# echo 'systemdump:settings/func1/name' | cm_cli -l

1 systemdump:settings/func1/name=ls

# echo 'systemdump:settings/func1/option1' | cm_cli -l

1 systemdump:settings/func1/option1=-l

# echo 'cat:settings/func1/option1' | cm_cli -l

1 cat:settings/func1/option1=/proc/version

# echo 'time:settings/ntpserver' | cm_cli -l

1 time:settings/ntpserver=time.nist.gov

# echo 'route:status/table' | cm_cli -l

1 route:status/table=1 1.1.1.1 0.0.0.0 192.168.8.121 1