拆一个天邑的电信光猫，型号TEWA-300AI，请大家看看能否得到系统的root密码

wangw***

拆一个天邑的电信光猫，型号TEWA-300AI，请大家看看能否得到系统的root密码


























ttl log

wangw***

TTL LOG：

Login: D%GHELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
ZQDN
STRF
400H
PHYE
DINT
LASY
USYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
NAN0
BT00
0001
NAN9
BT01
0476
NAN9
NAN3
RFS2
NAN5


CFE version 1.0.38-114.98 for BCM96828 (32bit,SP,BE)
Build Date: Tue Jul 16 06:54:43 EDT 2013 (root@TianYi)
Copyright (C) 2000-2011 Broadcom Corporation.

NAND flash device: name Spansion S34ML01G1, id 0x01f1 block 128KB size 131072KB
Chip ID: BCM6828F_A0, MIPS: 400MHz, DDR: 800MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

Board IP address                  : 192.168.1.1:ffffff00  
Host IP address                   : 192.168.1.100  
Gateway IP address                :   
Run from flash/host (f/h)         : f  
Default host run file name        : vmlinux  
Default host flash file name      : bcm963xx_fs_kernel  
Boot delay (0-9 seconds)          : 1  
Boot image (0=latest, 1=previous) : 0  
Board Id (0-1)                    : 96828HGW  
Number of MAC Addresses (1-32)    : 16  
Base MAC Address                  : 00:23:c9:63:f6:3c  
PSI Size (1-64) KBytes            : 24  
Enable Backup PSI [0|1]           : 0  
System Log Size (0-256) KBytes    : 0  
Auxillary File System Size Percent: 10  
Main Thread Number [0|1]          : 0  
Voice Board Configuration (0-10)  : LE9530  

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 0
Booting from latest image (0xbbb80000) ...
Decompression OK!
Entry at 0x8031e520
Closing network.
Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x8031e520
Linux version 2.6.30 (x@debian6) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #1 SMP PREEMPT Thu Jan 2 04:21:30 EST 2014
BCM Flash API. Flash device is not found.
96828HGW prom init
CPU revision is: 0002a080 (Broadcom4350)
DSL SDRAM reserved: 0x40000
Determined physical RAM map:
memory: 03fc0000 @ 00000000 (usable)
Zone PFN ranges:
  DMA      0x00000000 -> 0x00001000
  Normal   0x00001000 -> 0x00003fc0
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000000 -> 0x00003fc0
On node 0 totalpages: 16320
free_area_init_node: node 0, pgdat 804147d0, node_mem_map 81000000
  DMA zone: 32 pages used for memmap
  DMA zone: 0 pages reserved
  DMA zone: 4064 pages, LIFO batch:0
  Normal zone: 96 pages used for memmap
  Normal zone: 12128 pages, LIFO batch:1
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16192
Kernel command line: root=mtd:rootfs ro rootfstype=jffs2 console=ttyS0,115200
wait instruction: enabled
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
NR_IRQS:128
PID hash table entries: 256 (order: 8, 1024 bytes)
console [ttyS0] enabled
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Allocating memory for DSP module core and initialization code
Allocated DSP module memory - CORE=0x0 SIZE=0, INIT=0x0 SIZE=0
Memory: 60076k/65280k available (3161k kernel code, 5184k reserved, 971k data, 152k init, 0k highmem)
Calibrating delay loop... 399.36 BogoMIPS (lpj=199680)
Mount-cache hash table entries: 512
--Kernel Config--
  SMP=1
  PREEMPT=1
  DEBUG_SPINLOCK=0
  DEBUG_MUTEXES=0
Broadcom Logger v0.1 Jan  2 2014 04:13:43
CPU revision is: 0002a080 (Broadcom4350)
Primary instruction cache 64kB, VIPT, 4-way, linesize 16 bytes.
Primary data cache 32kB, 2-way, VIPT, cache aliases, linesize 16 bytes
Calibrating delay loop... 402.43 BogoMIPS (lpj=201216)
Brought up 2 CPUs
net_namespace: 1140 bytes
NET: Registered protocol family 16
Total Flash size: 0K with -1 sectors
registering PCI controller with io_map_base unset
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:09.0: reg 10 32bit mmio: [0x10002600-0x100026ff]
pci 0000:00:0a.0: reg 10 32bit mmio: [0x10002500-0x100025ff]
pci 0000:01:00.0: PME# supported from D0 D3hot
pci 0000:01:00.0: PME# disabled
pci 0000:02:00.0: reg 10 64bit mmio: [0x000000-0x007fff]
pci 0000:02:00.0: supports D1 D2
pci 0000:01:00.0: PCI bridge, secondary bus 0000:02
pci 0000:01:00.0:   IO window: disabled
pci 0000:01:00.0:   MEM window: 0x11000000-0x110fffff
pci 0000:01:00.0:   PREFETCH window: disabled
PCI: Enabling device 0000:01:00.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:01:00.0 to 64
BLOG v3.0 Initialized
BLOG Rule v1.0 Initialized
Broadcom IQoS v0.1 Jan  2 2014 04:19:11 initialized
Broadcom GBPM v0.1 Jan  2 2014 04:19:11 initialized
NET: Registered protocol family 8
NET: Registered protocol family 20
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
JFFS2 version 2.2. (NAND) &#194;&#169; 2001-2006 Red Hat, Inc.
fuse init (API version 7.11)
msgmni has been set to 117
io scheduler noop registered (default)
pcieport-driver 0000:01:00.0: device [14e4:6828] has invalid IRQ; check vendor BIOS
PCI: Setting latency timer of device 0000:01:00.0 to 64
Driver 'sd' needs updating - please use bus_type methods
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
IMQ driver loaded successfully.
        Hooking IMQ after NAT on PREROUTING.
        Hooking IMQ before NAT on POSTROUTING.
bcm963xx_mtd driver v2.0
Failed to read image tag from flash
Broadcom DSL NAND controller (BrcmNand Controller)
-->brcmnand_scan: CS=0, numchips=1, csi=0
mtd->oobsize=0, mtd->eccOobSize=0
NAND_CS_NAND_XOR=00000000
Disabling XOR on CS#0
brcmnand_scan: Calling brcmnand_probe for CS=0
B4: NandSelect=40000001, nandConfig=15142200, chipSelect=0
brcmnand_read_id: CS0: dev_id=01f1001d
After: NandSelect=40000001, nandConfig=15142200
Block size=00020000, erase shift=17
NAND Config: Reg=15142200, chipSize=128 MB, blockSize=128K, erase_shift=11
busWidth=1, pageSize=2048B, page_shift=11, page_mask=000007ff
timing1 not adjusted: 6574845b
timing2 not adjusted: 00001e96
brcmnand_adjust_acccontrol: gAccControl[CS=0]=00000000, ACC=f7ff1010
BrcmNAND mfg 1 f1 Spansion S34ML01G1 128MB on CS0

Found NAND on CS0: ACC=f7ff1010, cfg=15142200, flashId=01f1001d, tim1=6574845b, tim2=00001e96
BrcmNAND version = 0x80000500 128MB @00000000
brcmnand_scan: Done brcmnand_probe
brcmnand_scan: B4 nand_select = 40000001
brcmnand_scan: After nand_select = 40000001
100 CS=0, chip->ctrl->CS[0]=0
ECC level 15, threshold at 1 bits
reqEccLevel=0, eccLevel=15
190 eccLevel=15, chip->ecclevel=15, acc=f7ff1010
brcmnand_scan 10
200 CS=0, chip->ctrl->CS[0]=0
200 chip->ecclevel=15, acc=f7ff1010
page_shift=11, bbt_erase_shift=17, chip_shift=27, phys_erase_shift=17
brcmnand_scan 220
Brcm NAND controller version = 5.0 NAND flash size 128MB @18000000
brcmnand_scan 230
brcmnand_scan 40, mtd->oobsize=64, chip->ecclayout=00000000
brcmnand_scan 42, mtd->oobsize=64, chip->ecclevel=15, isMLC=0, chip->cellinfo=0
ECC layout=brcmnand_oob_bch4_4k
brcmnand_scan:  mtd->oobsize=64
brcmnand_scan: oobavail=50, eccsize=512, writesize=2048
brcmnand_scan, eccsize=512, writesize=2048, eccsteps=4, ecclevel=15, eccbytes=3
300 CS=0, chip->ctrl->CS[0]=0
500 chip=83a43d90, CS=0, chip->ctrl->CS[0]=0
-->brcmnand_default_bbt
brcmnand_default_bbt: bbt_td = bbt_main_descr
Bad block table Bbt0 found at page 0000ffc0, version 0x01 for chip on CS0
Bad block table 1tbB found at page 0000ff80, version 0x01 for chip on CS0
brcmnandCET: Status -> Deferred
brcmnand_scan 99
Creating 5 MTD partitions on "brcmnand.0":
0x000003b80000-0x0000076e0000 : "rootfs"
0x000000020000-0x000003b80000 : "rootfs_update"
0x000007b00000-0x000007f00000 : "data"
0x000000000000-0x000000020000 : "nvram"
0x000007700000-0x000007b00000 : "middleware"
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
PCI: Enabling device 0000:00:0a.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:0a.0 to 64
ehci_hcd 0000:00:0a.0: EHCI Host Controller
ehci_hcd 0000:00:0a.0: new USB bus registered, assigned bus number 1
ehci_hcd 0000:00:0a.0: Enabling legacy PCI PM
ehci_hcd 0000:00:0a.0: irq 18, io mem 0x10002500
ehci_hcd 0000:00:0a.0: USB f.f started, EHCI 1.00
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 2 ports detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
PCI: Enabling device 0000:00:09.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:00:09.0 to 64
ohci_hcd 0000:00:09.0: OHCI Host Controller
ohci_hcd 0000:00:09.0: new USB bus registered, assigned bus number 2
ohci_hcd 0000:00:09.0: irq 17, io mem 0x10002600
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 2 ports detected
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
brcmboard: brcm_board_init entry
SES: Button Interrupt 0x1 is enabled
SES: LED GPIO 0x8012 is enabled
Wifi Button: Button Interrupt 0x2 is enabled
Serial: BCM63XX driver $Revision: 3.00 $
Magic SysRq enabled (type ^ h for list of supported commands)
ttyS0 at MMIO 0xb0000180 (irq = 13) is a BCM63XX
ttyS1 at MMIO 0xb00001a0 (irq = 43) is a BCM63XX
Total # RxBds=1200
bcmPktDmaBds_init: Broadcom Packet DMA BDs initialized

bcmPktDma_init: Broadcom Packet DMA Library initialized
GACT probability NOT on
Mirror/redirect action on
u32 classifier
    input device check on
    Actions configured
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
NET: Registered protocol family 15
Initializing MCPD Module
Ebtables v2.0 registered
ebt_time registered
ebt_ftos registered
ebt_wmm_mark registered
ebt_ipv6_flabel registered
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (jffs2 filesystem) readonly on device 31:0.
Freeing unused kernel memory: 152k freed
init started: BusyBox v1.17.2 (2014-01-02 04:27:42 EST)
starting pid 224, tty '': '/etc/init.d/rcS'
starting pid 228, tty '': '-/bin/sh'


BusyBox v1.17.2 (2014-01-02 04:27:42 EST) built-in shell (ash)
Enter 'help' for a list of built-in commands.


Loading drivers and kernel modules...

bcm_ingqos: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
Broadcom Ingress QoS Module  Char Driver v0.1 Jan  2 2014 04:18:06 Registered<243>

Broadcom Ingress QoS ver 0.1 initialized
BPM: tot_mem_size=67108864B (64MB), buf_mem_size=10066329B (9MB), num of buffers=4802, buf size=2096
Broadcom BPM Module Char Driver v0.1 Jan  2 2014 04:16:10 Registered<244>
[NTC bpm] bpm_set_status: BPM status : enabled

NBUFF v1.0 Initialized
Initialized fcache state
Broadcom Packet Flow Cache  Char Driver v2.2 Jan  2 2014 04:18:07 Registered<242>
Created Proc FS /procfs/fcache
Broadcom Packet Flow Cache registered with netdev chain
Broadcom Packet Flow Cache learning via BLOG enabled.
Constructed Broadcom Packet Flow Cache v2.2 Jan  2 2014 04:18:07
chipId 0x682800A0
Broadcom Forwarding Assist Processor (FAP) Char Driver v0.1 Jan  2 2014 04:18:00 Registered <241>
FAP Debug values at 0x00000010 0x00000010
Enabling SMISBUS PHYS_FAP_BASE[0] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Enabling SMISBUS PHYS_FAP_BASE[1] is 0x10c01000
FAP Soft Reset Done
4ke Reset Done
Allocated FAP0 GSO Buffers (0xA2A97728) : 1048576 bytes @ 0xA2B00000
Allocated FAP1 GSO Buffers (0xA2AB7728) : 1048576 bytes @ 0xA2400000
Allocated FAP0 TM SDRAM Queue Storage (a2a9772c) : 604800 bytes @ a2500000
Allocated FAP1 TM SDRAM Queue Storage (a2ab772c) : 604800 bytes @ a2600000
[NTC fapProto] fapReset  : Reset FAP Protocol layer
fapDrv_construct: FAP0: pManagedMemory=b08200e0. wastage 8 bytes
fapDrv_construct: FAP1: pManagedMemory=b0a200e0. wastage 8 bytes
bcmPktDma_bind: FAP Driver binding successfull
[FAP0] DSPRAM : stack <0x80000000><1536>, global <0x80000600><5888>, free <768>, total<8192>
[FAP1] DSPRAM : stack <0x80000000><1536>, global <0x80000600><5888>, free <768>, total<8192>
[FAP0] PSM : addr<0x80002000>, used <22988>, free <1588>, total <24576>
[FAP1] PSM : addr<0x80002000>, used <22988>, free <1588>, total <24576>
[FAP0] Flows supported: 215 (dsp 49, psm 41, qsm 125)
[FAP1] Flows supported: 215 (dsp 49, psm 41, qsm 125)
[FAP0] DQM : availableMemory 14032 bytes, nextByteAddress 0xE0010930
[FAP1] DQM : availableMemory 14032 bytes, nextByteAddress 0xE0010930
[FAP0] GSO Buffer set to 0xA2B00000
[FAP1] GSO Buffer set to 0xA2400000
[FAP0] FAP TM: ON
[FAP1] FAP TM: ON
[FAP0] fap4keTm_queueEntry_t 24, fap4keTm_scheduler_t 112
[FAP1] fap4keTm_queueEntry_t 24, fap4keTm_scheduler_t 112
[FAP0] FAP BPM Initialized.
[FAP1] FAP BPM Initialized.
Broadcom BCM6828F_A0 Ethernet Network Device v0.1 Jan  2 2014 04:18:21
fapDrv_psmAlloc: fapIdx=0, size: 3600, offset=b08200e0 bytes remaining 7400
ETH Init: Ch:0 - 180 tx BDs at 0xb08200e0
fapDrv_psmAlloc: fapIdx=1, size: 3600, offset=b0a200e0 bytes remaining 7400
ETH Init: Ch:1 - 180 tx BDs at 0xb0a200e0
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=0, size: 4808, offset=b0820ef0 bytes remaining 2584
ETH Init: Ch:0 - 600 rx BDs at 0xb0820ef0
fapDrv_psmAlloc: wastage 8 bytes
fapDrv_psmAlloc: fapIdx=1, size: 4808, offset=b0a20ef0 bytes remaining 2584
ETH Init: Ch:1 - 600 rx BDs at 0xb0a20ef0
dgasp: kerSysRegisterDyingGaspHandler: bcmsw registered
eth1: MAC Address: 00:23:C9:63:F6:3C
eth0: MAC Address: 00:23:C9:63:F6:3C
eth3: MAC Address: 00:23:C9:63:F6:3C
eth2: MAC Address: 00:23:C9:63:F6:3C
epon0: MAC Address: 00:23:C9:63:F6:3C
--SMP support
wl: dsl_tx_pkt_flush_len=338
wl: high_wmark_tot=3121
PCI: Enabling device 0000:02:00.0 (0000 -> 0002)
PCI: Setting latency timer of device 0000:02:00.0 to 64
wl: passivemode=1
wl: napimode=0
wl0: allocskbmode=1 currallocskbsz=256
otp_read_pci: bad crc
Neither SPROM nor OTP has valid image
wl:srom/otp not programmed, using main memory mapped srom info(wombo board)
wl:loading /etc/wlan/bcm43217_vars.bin
Failed to open srom image from '/etc/wlan/bcm43217_vars.bin'.
wl:loading /etc/wlan/bcm43217_map.bin
wl0: Broadcom BCMa8db 802.11 Wireless Controller 5.100.138.2008.cpe4.12L02_CT.2
dgasp: kerSysRegisterDyingGaspHandler: wl0 registered
Endpoint: endpoint_init entry
Endpoint: endpoint_init COMPLETED
Broadcom 802.1Q VLAN Interface, v0.1
Broadcom EPON LUE Interface Char Driver v0.1 Registered<247>

===== Release Version 4.12L.02_CT (build timestamp 140102_0422) =====

Adjust WLAN Configuration, has configuration [1], num [4], defaultnum [4]
ssk:error:21.978:lck_checkBeforeEntry:205:lock required during cmsObj_getNextInSubTreeFlags
BOS: Enter bosInit
BOS: Exit bosInit
endpoint_open COMPLETED
upwd:IcWa0
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1020 buckets, 4080 max)
ip6_tables: (C) 2000-2006 Netfilter Core Team
ip_tables: (C) 2000-2006 Netfilter Core Team
CMS_MSG_STOP_APP EID_FTPD
smd:error:23.397:processStopAppMsg:2815:get targetDinfo fail

CMS_MSG_STOP_APP EID_TELNETD
smd:error:23.398:processStopAppMsg:2815:get targetDinfo fail

smd:error:24.451:startApp:2647ptional args length 148 is greater than max 128, ignored
sntp:error:24.546:main:774:No servers specified.
Broadcom Packet Flow Cache learning via BLOG enabled.
Broadcom Packet Flow Cache flushing the flows
fun=rcl_ipv6LanHostCfgObject line=538 advManagedFlag=0 ra=1 6s=0 mannalLan=0
device eth0 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth0: link is not ready
send dhcpd vlanid info success
iptables v1.4.0: MARK target: kernel too old for --or-mark
Try `iptables -h' or 'iptables --help' for more information.
ip6tables v1.4.0: MARK target: kernel too old for --or-mark
Try `ip6tables -h' or 'ip6tables --help' for more information.
ip6tables v1.4.0: MARK target: kernel too old for --or-mark
Try `ip6tables -h' or 'ip6tables --help' for more information.
ip6tables v1.4.0: MARK target: kernel too old for --or-mark
Try `ip6tables -h' or 'ip6tables --help' for more information.
device eth3 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth3: link is not ready
[debug] rcl_ipv6LanHostCfgObject Invalid argument iidStack=0x7f8687b0
[debug] rcl_ipv6LanHostCfgObject Invalid argument iidStack->instance[0]=2
device eth1 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth1: link is not ready
device eth2 entered promiscuous mode
ADDRCONF(NETDEV_UP): eth2: link is not ready
ADDRCONF(NETDEV_UP): epon0: link is not ready
monitor task is initialized pid= 314
dnsproxy:error:31.683:processCmsMsg:1196:unrecognized msg 0x10000250
ssk:error:32.011:initVodslBoundIpIfWanSideUpLocked:792:Failed to get WAN Connection object
vlanIdInfo->vlanBindEnable=1
vlanIdInfo->internetVlanId=1351
vlanIdInfo->iptvVlanId=43
vlanIdInfo->voipVlanId=45
ssk:error:32.076:ssk_main:953:cannot handle msg type 0x10000802
WLmngr Daemon is running
optarg=0 shmId=0
Note: Loading 6300 MDK (default) driver for 6828 chip
Switch MDK: num_switches = 1
Switch MDK: unit = 0; phy_pbmp = 0xf; config_pbmp = 0x8f
Switch MDK link pFAP TM: 0Kbps -> tokens <0>, bucketSize <0>
oll thread: unit=epon0 (switch port: 7) Link UP 1000 mbps full duplex
[FAP0] FAP TM: port <7>, portEnableMask <0x00>, tokens <0>, bucketSize <0>
[FAP1] FAP TM: port <7>, portEnableMask <0x00>, tokens <0>, bucketSize <0>
0; phypbmp=0xf
ADDRCONF(NETDEV_CHANGE): epon0: link becomes ready
eponapp.c:shmSize = 12692
shared memory, shmid=32769
netdev path : epon0.0 -> epon0
BCMVLAN : epon0 mode was set to RG
Created new Tag Rule: dev=epon0, dir=0, tags=0, id=0

WEBUI Operation WPS Type is NONE, interface number is [1]
WEBUI Operation WPS Type is NONE, interface number is [2]
WEBUI Operation WPS Type is NONE, interface number is [3]
WEBUI Operation WPS Type is NONE, interface number is [4]
There is no Predefined DevicePin in CFE
WPS Device PIN = 66131533
baseEponMac is 0:23:c9:63:f6:3c
app: brctl delif br0 wl0
the orignal crc is b22679ad, and the newer one is 25c3809c
device wl0 is not a slave of br0
app: brctl delif br0 wl0.1
interface wl0.1 does not exist!
app: brctl delif br0 wl0.2
interface wl0.2 does not exist!
app: brctl delif br0 wl0.3
EPON MAC loaded with simulated flash of 1048576 bytes.
interface wl0.3 does not exist!
device epon0.0 entered promiscuous mode
device epon0 entered promiscuous mode
app: killall -9 lld2d 2>/dev/null
TkExtOamTaskInit success!
app: killall -9 wps_ap 2>/dev/null
Send state change msg. State 0
Waiting 15 seconds for the EPON MAC to boot.
app: killall -9 wps_enr 2>/dev/null
app: killall -15 wps_monitor 2>/dev/null
app: killall -9 nas 2>/dev/null
[tr69 debug] epon link error status = LinkStatusLinkLos
app: killall -9 eapd 2>/dev/null
app: killall -9 acsd 2>/dev/null
Setting SSID: "ChinaNet-willis"
Setting SSID: "ChinaNet-2"
Setting SSID: "ChinaNet-3"
Setting SSID: "ChinaNet-4"
app: ifconfig wl0 down 2>/dev/null
app: ifconfig wl0.1 down 2>/dev/null
app: ifconfig wl0.2 down 2>/dev/null
app: ifconfig wl0.3 down 2>/dev/null
app: ifconfig wl0 > /var/hwaddr
app: ifconfig wl0 hw ether 00:23:C9:63:F6:3D 2>/dev/null
app: ifconfig wl0.1 hw ether 6a:23:c9:63:f6:3e 2>/dev/null
app: ifconfig wl0.2 hw ether 6a:23:c9:63:f6:3f 2>/dev/null
app: ifconfig wl0.3 hw ether 6a:23:c9:63:f6:3c 2>/dev/null
Chanspec set to 0x2b02
wlctl: Unsupported
EPONSDK: linkStatus change: -1 --> 0
device wl0 entered promiscuous mode
device wl0.1 entered promiscuous mode
device wl0.2 entered promiscuous mode
device wl0.3 entered promiscuous mode
br0: port 3(wl0) entering forwarding state
epon0: no IPv6 routers present
epon0.0: no IPv6 routers present
                 OamAlmCodeLos:0x00000011, val:1 (Link Los)
          OamAlmCodeReserved61:0x00000061, val:1 (Mpcp Fail)
sdk is ready.
SDK VERSION:0.1.1eponapp uses obsolete (PF_INET,SOCK_PACKET)
4
SDK VERSION:114
receive an unknown TK alarm: 176
01 80 c2 00 00 02 00 0d b6 00 00 00 88 09 03 00
09 01 ff ff fe 0e 00 0d b6 b0 01 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00

BCM96828 Broadband Router
Login: root
Password:
Login incorrect. Try again.

wangw***

都没人看看么？？

rwzs***

这个看不出吧  话说我们这儿也是这个光猫  只是密码什么的都是默认的

pppen***

这个是“光猫”？

wangw***

rwzsycwan 发表于 2014-6-10 02:11
这个看不出吧  话说我们这儿也是这个光猫  只是密码什么的都是默认的

我是指ttl登录以后的root密码，不是web页的用户和密码，也不是web也的telecomadmin的密码，web的密码好搞。
但是系统底层的密码不好弄～～

wangw***

pppeng-101 发表于 2014-6-10 04:02
这个是“光猫”？

这个是四川电信光纤入户以后，配的设备，单模光纤接入后，为网络、电视（ITV）、语音提供服务的设备～

pt***

BCM6828的芯片
差不多都这样
手头有只烽火的HG220GS
是BCM6838的Soc芯片

宇***

pt950 发表于 2014-10-5 20:43
BCM6828的芯片
差不多都这样
手头有只烽火的HG220GS

烽火的咋搞  我想进路由器  但是不晓得密码

宇***

wangwillis 发表于 2014-6-15 01:08
我是指ttl登录以后的root密码，不是web页的用户和密码，也不是web也的telecomadmin的密码，web的密码好搞 ...

web 页面的路由器登录密码怎么获得 求教

22593***

[size=14.285714149475098px]拆一个天邑的电信光猫，型号TEWA-300AI，请大家看看能否得到系统的root密码

Wh0***

我知道这个密码，233333

qi***

ssh  username:admin   password:admin

to chang > into # ,   type "sh" and click enter key.

there is something usefull in http://192.168.1.1/enableTelnet.html, or http://192.168.1.1/ftpcfg.html ;
if enable you can access telnet and ftp (ftp dir is /mnt).

if sshd is dead, use telnet to kill sshd, and then connect again.

zhj***

ttl下面 用user登陆之后输入命令 dumpcfg 就可以得到明文的配置文件，就可以用base64解码出密码

wangw***

zhjook 发表于 2017-1-12 23:32
ttl下面 用user登陆之后输入命令 dumpcfg 就可以得到明文的配置文件，就可以用base64解码出密码

谢谢，有空尝试一下~