24Sep/05Off
Actiontec DSL Modem Hacking
So, as you know, I recently upgraded to DSL from Cable. The Actiontec DSL modem provided by Qwest is really cool and provides quite a few features, but the firmware upgrade provided at the company website makes the thing stop responding.
My self-assigned quest was to figure out exactly what was going wrong, and to do so in a non-destructive way. This involved attaching a serial cable to the modem's circuit board and using it as a console to interactively diagnose the issue.
Some disassembly required. Some pictures provided.
http://www.tlarson.com/guides/dslhack
October 9th, 2005 - 02:20
any info on what the other 6 pins are on this router jp604?
October 9th, 2005 - 16:05
any info on what the other 6 pins are on this router jp604?
According to the bootloader, this hardware has two serial ports. The pins pointed out are on the “primary” one–the one the console is attached to. It wouldn’t be a stretch to think that this second set of pins correspond to the second serial port. I’m not sure what you’d do with it, though.
The /dev directory in the stock os image does have one serial port listed, by the way. Rather than /dev/ttyS0, it’s /dev/tts/0 — the name is different, but the major/minor numbers are 4/64, which correspond to the first serial port. /etc/securetty lists tts/0 and tts/1, though the latter doesn’t appear in /dev, and mknod isn’t available.
The clever fellow who discovered which pins to use for the serial console did so with a simple multimeter, based on the following knowledge:
The voltage difference between ground and send/recv is about 5v.
The resistance between send and recv is fairly high
The resistance between multiple jumped lines (like grounds) is low.
Then it’s trial and error to find out which is send and which is recv.