I had a bit of time to sort through the general scrape that I did last week. I've added 32 new entries for the G3100/E3200 dataset, bringing us to 345 entries. As always we test the new entries against the Fios-F1nDr database and see that we're still catching a good number of new date codes with each scrape. Currently there are 186 unique Date Codes.
Updated Data Set:
router_data_FULL_042725.xlsx (Size: 405.04 KB / Downloads: 1)
Before:
Correct - 11 (34%)
Incorrect - 16 (50%)
unknown block - 2 (6%)
Unknown device - 3 (9%)
Not Enough Data - 0 (0%)
After:
Correct - 26 (81%)
Incorrect - 3 (9%)
unknown block - 0 (0%)
Unknown Device 3 (9%)
Not enough data (0%)
I will hold off on posting the updated data_ref_lines this time, but it’s available in the dataset if you want it or feel free to DM me.
As I mentioned, the image identifying script is doing amazing now that we’ve changed the QR code reader. Last week I did a more general search and caught a ton of different devices. The QR codes are all a little different, so I am working to update the script to grab the data on these. I have started to scrape these too so that we can better understand all of the Fios/Verizon variations.
ARC-XCI55AX
ASK-NCM1100 / ASK-NCM1100E
ASK-NCQ1338 / ASK-NCQ1338E / ASK-NCQ1338FA
CR1000A / CR1000B
FWA55V5L
G1100
LVSKIHP
WNC-CR200A
... probably a few more!
I plan to make posts for each of these devices as I begin to investigate them. In my original research, I obtained a good bit of useful info from the CR1000A / CR1000B devices. So that is where I will begin...
![[Image: attachment.php?aid=1263]](https://hashcat.net/forum/attachment.php?aid=1263)
![[Image: attachment.php?aid=1264]](https://hashcat.net/forum/attachment.php?aid=1264)
The CR1000A / CR1000B routers are manufactured by Wistron NeWeb Corporation. Unfortunately, the information is split into 2 labels so collecting complete entries is more difficult. The QR code does contain the MAC and serial at least. I updated my scraping script to include the images downloaded from each link, so now I can reference back to the actual listing when necessary. I think I will eventually put these all of these scripts on GitHub since posting updated versions here makes a lot of clutter.
Currently, the data set contains 86 entries for CR1000A / CR1000B!
SSID is Verizon_XXXXX where X is any char <A-Z><0-9> (This is slightly different from G3100/E3200)
SSID Passwords follow <word>-<word>-<word> with a single digit at the end of either the first 2 words, but never the third.
Admin Passwords are 9 characters that are <A-Z><0-9>.
![[Image: attachment.php?aid=1266]](https://hashcat.net/forum/attachment.php?aid=1266)
From this sample we can gain some other info:
Serial numbers are always 11 digits and start with 2-3 letters, followed by digits. If we compare the MAC/Serial difference like before, we see these change in steps of 7. So we should be able to calculate the serial numbers once I figure out how they’re blocked together.
![[Image: attachment.php?aid=1267]](https://hashcat.net/forum/attachment.php?aid=1267)
Here is a teardown of the device, the CPU is a Qualcomm IPQ8074 SoC. It contains (4) Arm Cortex A53 processors up to 2 GHz clock.
I had found references to CR1000A firmware, which is what helped me find the G3100. I searched for all the versions I could find, and unfortunately didn’t turn up anything earlier than what I found online. The good new is @soxrok2212 and crew have done a great job reversing this firmware.
That’s all I have currently for the CR1000A / CR1000B, however our scrape did catch a lot of other entries. I have also included them in the sheet “other”. I plan to scrape each of these devices individually and make a similar post to this one for them.
This update contains 178 additional entries for “Other” devices, bringing the total number of entries to 609!
Updated Data Set:
router_data_FULL_042725.xlsx (Size: 405.04 KB / Downloads: 1)
Before:
Correct - 11 (34%)
Incorrect - 16 (50%)
unknown block - 2 (6%)
Unknown device - 3 (9%)
Not Enough Data - 0 (0%)
After:
Correct - 26 (81%)
Incorrect - 3 (9%)
unknown block - 0 (0%)
Unknown Device 3 (9%)
Not enough data (0%)
I will hold off on posting the updated data_ref_lines this time, but it’s available in the dataset if you want it or feel free to DM me.
As I mentioned, the image identifying script is doing amazing now that we’ve changed the QR code reader. Last week I did a more general search and caught a ton of different devices. The QR codes are all a little different, so I am working to update the script to grab the data on these. I have started to scrape these too so that we can better understand all of the Fios/Verizon variations.
ARC-XCI55AX
ASK-NCM1100 / ASK-NCM1100E
ASK-NCQ1338 / ASK-NCQ1338E / ASK-NCQ1338FA
CR1000A / CR1000B
FWA55V5L
G1100
LVSKIHP
WNC-CR200A
... probably a few more!
I plan to make posts for each of these devices as I begin to investigate them. In my original research, I obtained a good bit of useful info from the CR1000A / CR1000B devices. So that is where I will begin...
The CR1000A / CR1000B routers are manufactured by Wistron NeWeb Corporation. Unfortunately, the information is split into 2 labels so collecting complete entries is more difficult. The QR code does contain the MAC and serial at least. I updated my scraping script to include the images downloaded from each link, so now I can reference back to the actual listing when necessary. I think I will eventually put these all of these scripts on GitHub since posting updated versions here makes a lot of clutter.
Code:
('WIFI:S:Verizon_WP4ZXC;T:WPA;P:bug-aged6-noun;;ROUTER:M:CR1000A;S:ABV24234358;W:78670EA7007D;I:admin;P:WNV33WG6C;;1',)Currently, the data set contains 86 entries for CR1000A / CR1000B!
SSID is Verizon_XXXXX where X is any char <A-Z><0-9> (This is slightly different from G3100/E3200)
SSID Passwords follow <word>-<word>-<word> with a single digit at the end of either the first 2 words, but never the third.
Admin Passwords are 9 characters that are <A-Z><0-9>.
From this sample we can gain some other info:
- Password <word> are between 3-6 characters for SSID Password
- We don’t currently see 0 or 1 in any of the SSID, SSID Password, or Admin Password.
- There are several HW versions (103, 0.0.6, 0.0.7, 0.0.8, 0.0.A, 0.0.B, 0.0.C)
- Shipped firmware ranges from 3.1.0.17 to 3.2.0.14
- Somewhat surprising, in this small sample we have caught a good many Mac prefixes: 04.70.56, 1C.D6.BE, 58.96.71, 78.67.0E, 84.90.0A, AC.91.9B, BC.F8.7E, DC.4B.A1
Serial numbers are always 11 digits and start with 2-3 letters, followed by digits. If we compare the MAC/Serial difference like before, we see these change in steps of 7. So we should be able to calculate the serial numbers once I figure out how they’re blocked together.
Here is a teardown of the device, the CPU is a Qualcomm IPQ8074 SoC. It contains (4) Arm Cortex A53 processors up to 2 GHz clock.
I had found references to CR1000A firmware, which is what helped me find the G3100. I searched for all the versions I could find, and unfortunately didn’t turn up anything earlier than what I found online. The good new is @soxrok2212 and crew have done a great job reversing this firmware.
Code:
CR1000A:
https://cpe-ems34.verizon.com/firmware/chr2fa_fw_3.2.0.6.bin
https://cpe-ems34.verizon.com/firmware/chr2fa_fw_3.2.0.7.bin
https://cpe-ems34.verizon.com/firmware/chr2fa_fw_3.2.0.8.bin
https://cpe-ems34.verizon.com/firmware/chr2fa_fw_3.2.0.9.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.2.0.14_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.3.0.7_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.3.0.8_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.3.0.10_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.3.0.11_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.3.1.1.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.3.1.2.bin
https://cpe-ems34.verizon.com/firmware/CHRA/chr2fa_fw_3.3.1.2_loader.bin
CR1000B:
https://cpe-ems34.verizon.com/firmware/chr2fb_fw_3.1.1.16.bin
https://cpe-ems34.verizon.com/firmware/chr2fb_fw_3.1.1.17.bin
https://cpe-ems34.verizon.com/firmware/chr2fb_fw_3.1.1.18.bin
https://cpe-ems34.verizon.com/firmware/CHRB/chr2fb_fw_3.1.1.20.bin
https://cpe-ems34.verizon.com/firmware/CHRB/chr2fb_fw_3.3.0.7_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRB/chr2fb_fw_3.3.0.8_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRB/chr2fb_fw_3.3.0.9_loader.bin
https://cpe-ems34.verizon.com/firmware/CHRB/chr2fb_fw_3.3.0.10_loader.binThat’s all I have currently for the CR1000A / CR1000B, however our scrape did catch a lot of other entries. I have also included them in the sheet “other”. I plan to scrape each of these devices individually and make a similar post to this one for them.
This update contains 178 additional entries for “Other” devices, bringing the total number of entries to 609!