hashcat Forum › Misc › User Contributions v
Verizon Fios G3100 and E3200 Research

Linear Mode
Verizon Fios G3100 and E3200 Research
FiosFiend Offline
Junior Member
**
Posts: 26
Threads: 1
Joined: Apr 2025
#1
04-03-2025, 06:54 PM (This post was last modified: 04-03-2025, 07:10 PM by FiosFiend.)
I recently discovered how easy it was to crack my Netgear default password.  That thrill led me to turn my attention to my Fios G3100.  However, this has turned out to be a much worthier adversary.  Boredom and a bit of tenacity has led me down a winding path, but here is where I am at so far in my research.

[Image: attachment.php?aid=1237]

The G3100 and E3200 routers are distributed by Verizon.  Per usual, the sticker on the back of the unit has the necessary information.  I wrote a small python script to scrape Ebay and FB listings and collect all of the associated images.  A second script sorts the images using computer vision and OCR to detect the QR code or relevant text.  I then personally process the good images to collect the useful information, whenever possible I use the QR code as it is the most trustworthy data to read.  Thus far, I have collected over 230+ complete records, as well as saving the images for verification.


.xlsx   FiosG3100andE3200.xlsx (Size: 43.08 KB / Downloads: 12)  
Link to Ref_Images.zip (this is a temporary free file sharing link, dm me if it expires)

From this sample we can gain some info on the G3100 key space:
  • MAC address starting with 04.A2.22 are the oldest and have 16 character passwords
        SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9>   
        SSID Passwords follow <word><number><word><number><word> format (ex: met8sonata868elm)
        Admin Passwords are 16 characters and follow a <word><number><word> format (ex: stubble16crowded)
  • MAC address starting with B8:F8:53 are mixed and may have 15 or 16 character passwords
        SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9> 
        SSID Passwords follow <word><number><word><number><word> format (ex: moat288nit48pug)
        Admin Passwords are 16 characters and follow a <word><number><word> format (ex: chopper86notably)
  • MAC address starting with 3C.BD.C5 are the newest and have 15 character passwords
        SSID is Fios-XXXXX where X is any char <a-z><A-Z><0-9>
                 or Verizon_XXXXXX where X is any char <A-Z><0-9>     
        SSID Passwords for “Fios” networks follow <word><number><word><number><word> format (ex: range36vex77toy)
                 or “Verizon” networks follow <word>-<word>-<word> with a single digit at the end of one word (ex: miry9-elm-north)
  •     Admin Passwords for “Fios” network are 16 characters and follow a <word><number><word> format (ex: unusual53smelter)
                or “Verizon” networks are 9 characters that are <A-Z><0-9> (ex: Z79KGSX4T)
                Note: 0 and 1 are not seen in sample    

From this sample we can gain some info on the E3200 key space:
  • MAC address starting with 04.A2.22 are the oldest and have 16 character passwords
        SSID is E3200-XXXXX where X is any char <a-z><A-Z><0-9>   
        SSID Passwords follow <word><number><word><number><word> format (ex: nylon88wit657aye)
        Admin Passwords are 16 characters and follow a <word><number><word> format (ex: ritual236auction)
  • MAC address starting with B8:F8:53 are mixed and may have 15 or 16 character passwords
        SSID is E3200-XXXXX where X is any char <a-z><A-Z><0-9>
        SSID Passwords follow <word><number><word><number><word> format (ex: mach92see36flat)
        Admin Passwords are 16 characters and follow a <word><number><word> format (ex: seraph497lantern)
  • MAC address starting with 3C.BD.C5 have 15 character passwords
        SSID is Verizon_XXXXXX where X is any char <A-Z><0-9>
        SSID Passwords follow <word>-<word>-<word> with a single digit at the end of one word (ex: tenth-ben6-vend)    
        Admin Passwords are are 9 characters that are <A-Z><0-9> (ex: 3JB94H6CQ)        
        Note: 0 and 1 are not seen in sample  
  • MAC address starting with DC.F5.1B are the newest and have 15 character passwords
        SSID is Verizon_XXXXXX where X is any char <A-Z><0-9>
        SSID Passwords follow <word>-<word>-<word> with a single digit at the end of one word (ex: plush-fast3-con)    
        Admin Passwords are are 9 characters that are <A-Z><0-9> (ex: QVB734TKL)           
        Note: 0 and 1 are not seen in sample  

From this sample we can gain some other info:
  • Password <word> are between 3-7 characters for SSID Password
  • Password <number> are between 1-4 digits
  • There are 3 HW version (1102, 1103, 1104)
  • Serial #’s are 16 digits (except for the most recent E3200 which have 11)
  • Shipped firmware ranges from 1.3.5.1 to 3.1.1.16 
  • There are the 568 unique words extracted from the passwords:
Code:
add aft ago aim air ait alp ape ark art ash ask awe aye bat bay bed bee beg ben bet bid biz boa bog bot bow bug bun bus bye cat caw cif cob con cot cub cud cup cut dab dad dam daw day del dew dia did dig dit doe dos due dun ear eeg ego eke elk elm end fad fat fax fay fed fee fen few fez fib fig fin fir fit fob fog fop for fox fro gad gap gel gem gen gig gin gnp gnu got gut had han has hat hew hey hid hie him hin hit hod hub hue hum ice icy jab jag jam jaw jet jib jog joy jus lab law lay let mad may met mil mix mod mow mud mug mum nag naw new nib nip nit nod non not now oak oar odd ode oil one ope opt ork out owl pal paw pay pea pet pit pod pug pun pup put ram ran rap raw ray ree ret rid rna roe rug run rut rye sat say see set sew sir sit six sly sou sow soy spa sum sun sup tag tap tax tee too tot toy tun ush vex vie vim wad was wax web wed why wig win wit woe won woo wry yak yam yea yes yet yon you zap zoo abbe aery agog alas alga allo arms atom back bake beak been beep bits boar bolt bone book boss bred brew brow cafe cape cart cast cene cere cham char cloy copy crib cuff dark dear deny dewy dial dine dint dock doff dory doth drub dump dust each ever exam fade fame fare fast fawn feet felt fine flat flaw flit form fund fuss gage gain gall gate gent golf grab gray grey grim hair hake halt hasp have hawk held hide high holm hone hoot hour huff hung ibis iron jibe jill june kale kidd kirk knit knot lack lead lean lend lens less lump mach mama mass meat mica mint miry moat mood myth nail name nice nigh nite oboe oily ouch over paid pail pant pelf pell pelt pert plan plot plus pool pram push quiz raze rill ripe roar rome roof rook ruby rush sage sale self shed sign sill skim slop slue slug soap solo spin stir swam swap tare tele tell than then they tidy tier ting tout tram trod tron tune type upon vain vane vend vide vine wain wait wake wane want wash wavy what whom will wind wing wire wisp wood yard yeah yell yelp yond zest acute amaze angel apace basic begot bough brush camel carry chase clean clump coach cocky combe comet coney could crate creak credo cress crock crone demur deter divan douse drily eater elope enact endow favor fifth fifty finny flock floor floss flown focal focus forte froth fuzzy games gorse guise hoary hobby hutch inapt inner jewel mayor meant mense mixed moose muddy mulct niter north nylon order papal pivot plait plumy plush poser price quard quell quest range rapid rayon sales salon salty scend scope scour sense shack sixty smack snips snort spark spent steep stiff swell synod taper tarry tempt tenth thank tinge today trace track tract trade trawl trend tweet tyler vague verse vetch vital whose witty woman worse wrist behove bethel german iodine pallor remove sonata bloated sweater

Although there is a lot of useful information collected in the sample, it is still a fairly large key space.  With that in mind I decided to take my first dives into firmware analysis, which of course requires some firmware.  Looking online, I was able to find a single reddit post that linked to g3100 firmware version 3.2.0.15.  With a lot more digging, I was able to find posts with links to firmware for other devices.  Using this information I wrote another script to try to find additional firmware.  Here’s what I've found, many of these are the first time posted online I believe.

https://cpe-ems34.verizon.com/firmware/g....0.0.6.bin
https://cpe-ems34.verizon.com/firmware/g...1.1.17.bin
https://cpe-ems34.verizon.com/firmware/g...1.1.18.bin
https://cpe-ems34.verizon.com/firmware/g...2.0.11.bin
https://cpe-ems34.verizon.com/firmware/B...2.0.13.bin
https://cpe-ems34.verizon.com/firmware/B...2.0.14.bin
https://cpe-ems34.verizon.com/firmware/B...2.0.15.bin
https://cpe-ems34.verizon.com/firmware/B...loader.bin
https://cpe-ems34.verizon.com/firmware/B...loader.bin
https://cpe-ems34.verizon.com/firmware/B...loader.bin
https://cpe-ems34.verizon.com/firmware/B...loader.bin

All of the links I found online for Verizon G3100, E3200, and CR1000 all used the cpe-ems34 link.  I did find some other routers that were using different servers such as cpe-ems20 and cpe-ems31.  Further investigation lead to this site showing all of the Verizon subdomains, which there are a ton of cpe-ems domains.

I tried my script with a few such as 31, 33, 43, however nothing new was turned up.
https://cpe-ems33.verizon.com/firmware/g...1.1.17.bin
https://cpe-ems34.verizon.com/firmware/g...2.0.15.bin

I tried binwalk on the first firmware I found (3.2.0.15), and while it extracts the file system, none of the files were readable for me.  The entropy graph shows that only a small part is encrypted, so I am a bit confused.  My next step is to try to mount it in a VM Linux since I only have Mac and RPI for testing.

.png   g3100_fw_3.2.0.15.bin.png (Size: 75.17 KB / Downloads: 3)

This is what led me to looking for older firmware, however using binwalk on 2.0.0.6 gives me similar results.  I know that there should be at least 2 more older firmware 1.3.6.27 and 1.5.0.10 but I have not been able to locate them.  

.png   g3100_fw_2.0.0.6.bin.png (Size: 79.38 KB / Downloads: 1)

The possibility of firmware encryption led me to look at physical access of the device.  After some quick soldering, I connected to the UART.  Unfortunately this did not lead to a shell either, but did provide a bit more information.  Referencing some of the output online, I found someone else who also connected this way and had a longer output (possibly because of older firmware?).
Code:
BTRM V1.0 R1.0 L1CD MMUI MMU9 DATA ZBBS MAIN OTP? REF? REFP RTF? RTFP OTPP FSBT NAND IMG? IMGL UHD? UHDP RLO? RLOP AHD? ROT? ROTA MID? MIDP AHDP SBI? SBIA PASS ---- U-Boot SPL 2019.07 (Oct 31 2023 - 03:52:42 -0400) Strap register: 0x53008176 Board is FLD secure $SPL: 5.04L.02@419765 $ nand flash device id 0x98d39126, total size 1024MB block size 256KB, page size 4096 bytes, spare area 216 bytes ECC BCH-8 FFinit done find magic number 0x75456e76 at address 0x100000 FFinit find magic number 0xcb00cb at address 0x114000 reading blob from 0x114000 offset 0x26c len 608 digest sha256 OK FFinit find magic number 0x64447233 at address 0x105000 reading blob from 0x105000 offset 0xc len 59888 digest sha256 OK mcb selector 0x1427 checksum 0x722c322d safe_mode 0 U-Boot DDR standalone 2019.07 (Jul 25 2021 - 18:43:37 -0700) Build: 5.04L.02@348603 MemsysInit hpg0_generic_aarch64 3.5.1.1 20171009 DDR3 8267D980 80180000 801A0000 00000000 00000000 0020476E MCB rev=0x00000501 Ref ID=0x0476E Sub Bld=0x002 Dram Timing 11-11-11 start of memsys_begin mc_cfg_init(): Initialize the default values on mc_cfg init_memc_dram_profile(): Initializing MEMC DRAM profile --------------------------------------------------------------- MEMC DRAM profile (memc_dram_profile_struct) values:   dram_type    = DDR3 ==================================================== PART values:   part_speed_grade    = 1600 CL11   part_size_Mbits    = 4096 (DRAM size in MegaBits)   part_row_bits      = 15 (number of row bits)   part_col_bits      = 10 (number of column bits)   part_ba_bits        = 3 (number of bank bits)   part_width_bits    = 16 (DRAM width in bits) NUMER OF PARTS:   part_num            = 1 (Number of parts) TOTAL values:   total_size_Mbits    = 4096 (DRAM size in MegaBits)   total_cs_bits      = 0 (number of cs bits, for dual_rank mode)   total_width_bits    = 16 (DRAM width in bits)   total_burst_bytes  = 16 (Number of bytes per DRAM access)   total_max_byte_addr = 0x1fffffff (Maximum/last DRAM byte address)                         (Number of bits in total_max_byte_addr is 29)                         (i.e. total_max_byte_addr goes from bit 0 to bit 28)   ddr_2T_mode        = 0   ddr_hdp_mode        = 1   large_page          = 1   ddr_dual_rank      = 0   cs_mode            = 0 MEMC timing (memc_dram_timing_cfg_struct) values: ====================================================   MC_CHN_TIM_TIM1_0 register fields:     tCwl  = 8     tRP    = 11     tCL    = 11     tRCD  = 11   MC_CHN_TIM_TIM1_1 register fields:     tCCD_L = 4     tCCD  = 4     tRRD_L = 6     tRRD  = 6   MC_CHN_TIM_TIM1_2 register fields:     tFAW  = 32     tRTP  = 6     tRCr  = 39   MC_CHN_TIM_TIM1_3 register fields:     tWTR_L = 6     tWTR  = 6     tWR_L  = 12     tWR    = 12   MC_CHN_TIM_TIM2 register fields:     tR2R  = 0     tR2W  = 2     tW2R  = 2     tW2W  = 0     tAL    = 0     tRFC  = 208 ==================================================== %1 SSC enabled Poll PHY Status register PHY Status= 1 Disable Auto-Refresh [0000000080180200] = 0x00000305 End of memsys_begin Add/Ctl Alignment Coarse Adj=0x087 deg, cmd steps=0x0DC reg 0x801A0090 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A0094 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A0098 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A009C set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00A0 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00A4 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00A8 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00AC set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00B0 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00B4 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00B8 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00BC set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00C0 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00C4 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00C8 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00CC set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00D0 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00D4 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00D8 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00DC set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00E0 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00E4 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00E8 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00EC set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00F0 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00F4 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00F8 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A00FC set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A0100 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A0108 set to VDL 0x054 with Fine Adj=0x01 deg reg 0x801A010C set to VDL 0x054 with Fine Adj=0x01 deg HP RX TRIM itrim = 0x0 lstrim = 0x9 ZQ Cal HP PHY R in Ohm P: Finger=0x318 Term=0x71 Drv=0x28 N: Finger=0x2A6 Term=0x71 Drv=0x28 PLL Ref(Hz)=0x02FAF080 UI STEPS=0x06E DDR CLK(MHz)=0x31B WL CLK dly(ps)=0x0C8 bitT(ps)=0x274 VDLsize(fs)=0x164D CLK_VDL=0x023 start of memc_init [0000000080180004] = 0x0110061f [0000000080180234] = 0x00001101 Enable Auto-Refresh [0000000080180110] = 0x11100f0e [0000000080180114] = 0x15141312 [0000000080180118] = 0x19181716 [000000008018011c] = 0x001c1b1a [0000000080180124] = 0x04000000 [0000000080180128] = 0x08070605 [000000008018012c] = 0x00000a09 [0000000080180134] = 0x000d0c0b Writing to MC_CHN_CFG_CNFG reg; data=0x00000000 [0000000080180100] = 0x00000000 cfg_memc_timing_ctrl() Called [0000000080180214] = 0x080b0b0b [0000000080180218] = 0x04040606 [000000008018021c] = 0x20000627 [0000000080180220] = 0x06060c0c [0000000080180224] = 0x120000d0 End of memc_init start of pre_shmoo [0000000080180004] = 0xc110071f end of pre_shmoo SHMOO 28nm 801A0000 80180800 00000000 00020000 00000000 Shmoo WL One UI Steps : 0x7B auto-clk result = 01B (filter=0C steps) initial CLK shift = 023 final CLK shift  = 01B   000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111111111   000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111111111222   012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012 00 S-------------------X------------------------------------------------------------------------------------------------------ 01 S-----------X-------------------------------------------------------------------------------------------------------------- Shmoo RD En FORCED WR ODT = 0x00001800 DQSN DRIVE PAD CONTROL (from) (to) B0 00039A91 00079A91 B1 00039A91 00079A91 B0 RISE UI=1 VDL=1B PICK UI=2 VDL=1B B1 RISE UI=1 VDL=28 PICK UI=2 VDL=28   000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111111111   000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111111111222   012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012 00 --S-----------------+---+++X+++++++++++++++-------------------------------------------------------------------------------- 01 --S-----------------------------+----++-X+++++++++++++++------------------------------------------------------------------- Shmoo RD DQ NP DQS : B0 VDL=6E ok B1 VDL=6E ok   000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111111111   000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111111111222   012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012 00 ---------------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------- 01 ---------------+++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++--------- 02 ------------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++--------- 03 ----------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++----------------- 04 --------------+++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++----------------- 05 ------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++--------------- 06 ------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++------------- 07 --------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++-------------------- 08 ------------------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++--- 09 -----------------------++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++--- 10 -------------------+++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++----- 11 --------------------+++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++--- 12 -----------------+++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++------ 13 ----------------++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++----- 14 --------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++----------- 15 ------------------++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++--- Shmoo RD DQ P   000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111111111   000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111111111222   012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012 00 ---------------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------ 01 ---------------+++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++----- 02 -------------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++------ 03 ---------++++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++------------- 04 --------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------------- 05 ------------+++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++----------- 06 ------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++------------- 07 --------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++----------------- 08 ------------------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++- 09 -----------------------++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++--- 10 -------------------+++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++----- 11 --------------------+++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++--- 12 -----------------+++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++------- 13 ---------------++++++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++++--- 14 --------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++----------- 15 -----------------+++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++--- Shmoo RD DQ N   000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111111111   000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111111111222   012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012 00 ------------------+-+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------- 01 ----------------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++--------- 02 ------------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++--------- 03 ---------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------------------ 04 ------------++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++----------------- 05 -----------++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++-------------- 06 -----------+++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++------------- 07 -----++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++-------------------- 08 ------------------------++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++-- 09 ---------------------++++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++- 10 ------------------+++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++----- 11 ------------------+++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++-- 12 ---------------++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++------ 13 ----------------++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++----- 14 ------------++++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++++---------- 15 ------------------++++++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++++++--- RD DQS adjustments : BL0: Start: 0x6E Final: 0x6E BL1: Start: 0x6E Final: 0x6E Shmoo WR DQ   000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111111111   000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111111111222   012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012 00 ------------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++--------------- 01 ----------+++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++--------------------- 02 ------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++---------------- 03 ---+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------------------------ 04 ---------+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++----------------------- 05 --------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++-------------------- 06 -----------++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------------ 07 ---+++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++----------------------------- 08 ---------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------- 09 ---------------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++--------------- 10 -----------+++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++---------------- 11 -----------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++----------------- 12 -----------+++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++-------------------- 13 -----------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++----------------- 14 ----+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++------------------------ 15 ------------+++++++++++++++++++++++++++++++++++++++++++++++X+++++++++++++++++++++++++++++++++++++++++++++++---------------- Shmoo WR DM WR DM   000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000011111111111111111111111   000000000011111111112222222222333333333344444444445555555555666666666677777777778888888888999999999900000000001111111111222   012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012 00 -------++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++----------------------- 01 --------++++++++++++++++++++++++++++++++++++++++++++++++X++++++++++++++++++++++++++++++++++++++++++++++++------------------ start of memsys_end [0000000080180004] = 0x8110071f [0000000080180010] = 0x00000009 end of memsys_end DDR test done successfully FFinit find magic number 0x75456e76 at address 0x100000 FFinit find magic number 0x74506c21 at address 0x140000 reading blob from 0x140000 offset 0xc len 163741 digest sha256 OK U-Boot TPL 2019.07 (Oct 31 2023 - 03:52:39 -0400) Board is FLD secure $TPL: 5.04L.02@419765 $ CPU Clock: 1500MHz IMAGE is NAND Trying to boot from NAND nand flash device id 0x98d39126, total size 1024MB block size 256KB, page size 4096 bytes, spare area 216 bytes ECC BCH-8 image from 2097152 to 315621376 brcmnand_read_buf(): Attempt to read bad nand block 760 brcmnand_read_buf(): Attempt to read bad nand block 762 brcmnand_read_buf(): Attempt to read bad nand block 768 brcmnand_read_buf(): Attempt to read bad nand block 770 brcmnand_read_buf(): Attempt to read bad nand block 772 brcmnand_read_buf(): Attempt to read bad nand block 780 brcmnand_read_buf(): Attempt to read bad nand block 782 RESET STATUS is 0x80000000 SELECTED Image 1 FIT_VOL_ID is 3 brcmnand_read_buf(): Attempt to read bad nand block 760 brcmnand_read_buf(): Attempt to read bad nand block 762 brcmnand_read_buf(): Attempt to read bad nand block 768 brcmnand_read_buf(): Attempt to read bad nand block 770 brcmnand_read_buf(): Attempt to read bad nand block 772 brcmnand_read_buf(): Attempt to read bad nand block 780 brcmnand_read_buf(): Attempt to read bad nand block 782 Found FIT format U-Boot tpl_load_read: sector 7000000, count 3194, buf 0000000007000000 tpl_load_read: sector 7000000, count 4192, buf 0000000007000000 fit read sector 7000000, sectors=16786, dst=0000000007000000, count=16786, size=0x4192 FIT Header Authentication Successfull! INFO: Found disabled /trust/anti-rollback node! INFO: Found /trust/hw_state node in fit tpl_load_read: sector 7003680, count 8028, buf 0000000000004000 ## Checking hash(es) for Image atf ... sha256+ OK tpl_load_read: sector 700b680, count 27fc80, buf 0000000001000000 ## Checking hash(es) for Image uboot ... sha256+ OK tpl_load_read: sector 76ea1c0, count c5be, buf 000000000127fc80 ## Checking hash(es) for Image fdt_VERIZON-G3100 ... sha256+ OK INFO: Creating //trust INFO: Creating /trust/antirollback_lvl INFO: Adding exported item node antirollback_lvl to dtb, size:4 INFO: Creating /trust/brcm_pub_key INFO: Adding exported item node brcm_pub_key to dtb, size:256 U-Boot 2019.07 (Oct 31 2023 - 03:52:45 -0400), Build: 5.04L.02@419765 Model: VERIZON-G3100 DRAM:  512 MiB max supported leds 32[32] Serial LED interface found num shifters 2 [2] serial data polarity low 0 BCA LED Controller initialized HW led 3 registered HW led 4 registered HW led 5 registered HW led 6 registered HW led 7 registered HW led 8 registered HW led 9 registered HW led 10 registered SW led 0 registered SW led 1 registered SW led 2 registered SW led 11 registered SW led 12 registered SW led 13 registered SW led 14 registered SW led 15 registered Dump Current setting of SWREGs 1.0D, reg=0x00, val=0xc690 1.0D, reg=0x01, val=0x0d06 1.0D, reg=0x02, val=0xcb12 1.0D, reg=0x03, val=0x5372 1.0D, reg=0x04, val=0x0000 1.0D, reg=0x05, val=0x0702 1.0D, reg=0x06, val=0xb000 1.0D, reg=0x07, val=0x0029 1.0D, reg=0x08, val=0x0c02 1.0D, reg=0x09, val=0x0071 1.8 , reg=0x00, val=0xc690 1.8 , reg=0x01, val=0x0d06 1.8 , reg=0x02, val=0xcb12 1.8 , reg=0x03, val=0x5370 1.8 , reg=0x04, val=0x0000 1.8 , reg=0x05, val=0x0702 1.8 , reg=0x06, val=0xb000 1.8 , reg=0x07, val=0x0029 1.8 , reg=0x08, val=0x0c02 1.8 , reg=0x09, val=0x0071 1.5 , reg=0x00, val=0xc690 1.5 , reg=0x01, val=0x0d06 1.5 , reg=0x02, val=0xcb12 1.5 , reg=0x03, val=0x5370 1.5 , reg=0x04, val=0x0000 1.5 , reg=0x05, val=0x0702 1.5 , reg=0x06, val=0xb000 1.5 , reg=0x07, val=0x0029 1.5 , reg=0x08, val=0x0c02 1.5 , reg=0x09, val=0x0071 1.0A, reg=0x00, val=0xc690 1.0A, reg=0x01, val=0x0d06 1.0A, reg=0x02, val=0xcb12 1.0A, reg=0x03, val=0x5370 1.0A, reg=0x04, val=0x0000 1.0A, reg=0x05, val=0x0702 1.0A, reg=0x06, val=0xb000 1.0A, reg=0x07, val=0x0029 1.0A, reg=0x08, val=0x0c02 1.0A, reg=0x09, val=0x0071 Take PMC out of reset waiting for PMC finish booting PMC rev: 3.4.1.427360 running pmc_init:PMC using DQM mode Chip ID: BCM68369_B1 Broadcom B53 Dual Core: 1500MHz RDP: 1400MHz $Uboot: 5.04L.02@419765 $ WDT:  Started with servicing (80s timeout) NAND:  1024 MiB MMC:  sdhci: 0 Loading Environment from BOOT_MAGIC... ENV_BOOT_MAGIC_LOAD found magic at 100000 good crc resize from 16384 to 8192 OK In:    serial0 Out:  serial0 Err:  serial0 Board is FLD secure INFO: Can't find /trust/fit-aes1 node in boot DTB! Now we are in UBOOT proper HTTPD: ready for starting boot_device is NAND Net:  Using MAC Address b8:f8:53:0b:1d:01 eth0: switch0 No size specified -> Using max size (7300992) Read 7300992 bytes from volume bootfs1 to 0000000002000000 FIT Header Authentication Successfull! Read 4 bytes from volume rootfs1 to 000000001dd40664 ## Loading kernel from FIT Image at 02000000 ...   Using 'conf_lx_VERIZON-G3100' configuration   Verifying Hash Integrity ... OK   Trying 'kernel' kernel subimage     Description:  4.19 kernel     Type:        Kernel Image     Compression:  lzma compressed     Data Start:  0x0228c800     Data Size:    3461392 Bytes = 3.3 MiB     Architecture: AArch64     OS:          Linux     Load Address: 0x00100000     Entry Point:  0x00100000     Hash algo:    sha256     Hash value:  77e40836ec218fa969f9d2bd572115ed9a7ef008cc75bfec4912354ce78a6349   Verifying Hash Integrity ... sha256+ OK ## Loading fdt from FIT Image at 02000000 ...   Using 'conf_lx_VERIZON-G3100' configuration   Verifying Hash Integrity ... OK   Trying 'fdt_VERIZON-G3100' fdt subimage     Description:  dtb     Type:        Flat Device Tree     Compression:  uncompressed     Data Start:  0x026ea1c4     Data Size:    50618 Bytes = 49.4 KiB     Architecture: AArch64     Hash algo:    sha256     Hash value:  c50470d2e693ebcd7dd68e42cc1de0ace24ccc30766e9c36d08c6b4462fa2e53   Verifying Hash Integrity ... sha256+ OK   Booting using the fdt blob at 0x26ea1c4 ARCADYAN: Authenticating vmlinux ... ARCADYAN: Authenticating vmlinux pass ARCADYAN: Decrypting kernel image ... ARCADYAN: Decrypting kernel image done   Uncompressing Kernel Image ... OK ERROR: reserving fdt memory region failed (addr=1b400000 size=4c00000)   Loading Device Tree to 0000000007f73000, end 0000000007fff5b9 ... OK RSVD: not found enrty for adsl RSVD: not found enrty for bufmem RSVD: not found enrty for rnrmem RSVD: Allocated for rdp1    64MB RSVD: Allocated for rdp2    8MB RSVD: Allocated for dhd0    11MB RSVD: Allocated for dhd1    11MB RSVD: Allocated for dhd2    11MB RSVD: Total 0x06c00000 bytes CMA reserved memory @ 0x19400000 appending extra boot args to linux boot command line:   mtdparts=brcmnand.0:2097152(loader),313524224@2097152(image),8388608@315621376(misc1),1048576@324009984(misc3),709885952@325058560(data),28311552@1034944512(owl),1048576@1063256064(mtdoops),2097152@1064304640(license),2097152@1066401792(certificate),1048576@1068498944(pri Starting kernel ... D%G

My device is currently running firmware 3.4.0.9, which I tried to revert to any previous version.  I found a reference to a “hidden” admin page to update firmware at https://192.168.1.1/#/firmware_upgrade, but none of the firmware I downloaded would work (I think due to anti rollback).

So this is where I am currently stuck.  I doubt that the key generation algorithm is on the device.  However, if anyone is able to make sense of the serial output that might help unlock the firmware, I would love to just have a look around for curiosity sake.  I will try to periodically scrape and update the password file, I originally thought it would have more entries by now.

Next Steps:
  • Analyze the data set to try to reduce key space (unused characters, common words, find the wordlist?)
  • Collect more complete entries for the dataset
  • Try to mount file system (ubi.img) in a proper Linux environment
  • Try to find older firmware


Attached Files
.jpeg   Backref.jpeg (Size: 50 KB / Downloads: 260)
Find
Reply


Messages In This Thread
Verizon Fios G3100 and E3200 Research - by FiosFiend - 04-03-2025, 06:54 PM