The Netgear CG3100D-2 is the default cable-modem you get for Telstra Cable, at least at one time. Having retired it after changing service providers, I wanted to see if it was somewhat able to be re-purposed.
In short it's hackability is low.
First thing was to check out the Netgear Open Source page to see if the source had anything interesting. There is some source, but honestly when you dig into the platform code and see things like kernel/linux/arch/mips/bcm963xx/setup.c:
/***************************************************************************
* C++ New and delete operator functions
***************************************************************************/
/* void *operator new(unsigned int sz) */
void *_Znwj(unsigned int sz)
{
return( kmalloc(sz, GFP_KERNEL) );
}
/* void *operator new[](unsigned int sz)*/
void *_Znaj(unsigned int sz)
{
return( kmalloc(sz, GFP_KERNEL) );
}
...
there's a bit of a red-flag that this is not the cleanest code in the world (I guess it interfaces with some sort of cross-platform SDK written in some sort of C++).
So next we can open it up, where it turns out there are two separate UARTs as shown in the following image.
One of these is for the bootloader and eCOS environment, and the other seems to be connected to the Linux side.
A copy of the boot-logs for the bootloader and eCOS and Linux don't show anything particuarly interesting. The Linux boot does identify itself as Linux version 2.6.30-V2.06.05u while the available source lists its version as 2.6.30-1.0.5.83.mp2 so it's questionable if the source matches whatever firmware has made it onto the modem.
We do see that this identifies as a BCM338332 which seems to be one of the many sub-models of the BCM3383 SoC cable-modem solution. There is an OpenWrt wiki page that indicates support is limited.
Both Linux and eCos boot to a login prompt where all the usual default combinations of login/passwords fail. So my next thought was to try and get to the firmware via the bootloader, which has a simple interface
BCM338332 TP0 346890
Reset Switch - Low GPIO-18 50ms
MemSize: 128 M
Chip ID: BCM3383G-B0
BootLoader Version: 2.4.0alpha14R6T Pre-release Gnu spiboot dual-flash reduced DDR drive linux
Build Date: Mar 24 2012
Build Time: 14:04:50
SPI flash ID 0x012018, size 16MB, block size 64KB, write buffer 256, flags 0x0
Dual flash detected. Size is 32MB.
parameter offset is 49944
Signature/PID: a0e8
Image 1 Program Header:
Signature: a0e8
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2013/4/18 04:01:11 Z
File Length: 3098751 bytes
Load Address: 80004000
Filename: CG3100D_2BPAUS_V2.06.02u_130418.bin
HCS: 1e83
CRC: b95f4172
Found image 1 at offset 20000
Image 2 Program Header:
Signature: a0e8
Control: 0005
Major Rev: 0003
Minor Rev: 0000
Build Time: 2013/10/17 02:33:29 Z
File Length: 3098198 bytes
Load Address: 80004000
Filename: CG3100D_2BPAUS_V2.06.05u_131017.bin
HCS: 2277
CRC: a6c0fd23
Found image 2 at offset 800000
Image 3 Program Header:
Signature: a0e8
Control: 0105
Major Rev: 0002
Minor Rev: 0017
Build Time: 2013/10/17 02:22:30 Z
File Length: 8277924 bytes
Load Address: 84010000
Filename: CG3100D_2BPAUS_K2630V2.06.05u_131017.bin
HCS: 157e
CRC: 57bb0175
Found image 3 at offset 1000000
Enter '1', '2', or 'p' within 2 seconds or take default...
. .
Board IP Address [0.0.0.0]: 192.168.2.10
Board IP Mask [255.255.255.0]:
Board IP Gateway [0.0.0.0]:
Board MAC Address [00:10:18:ff:ff:ff]:
Internal/External phy? (e/i/a)[a]
Switch detected: 53125
ProbePhy: Found PHY 0, MDIO on MAC 0, data on MAC 0
Using GMAC0, phy 0
Enet link up: 1G full
Main Menu:
==========
b) Boot from flash
g) Download and run from RAM
d) Download and save to flash
e) Erase flash sector
m) Set mode
s) Store bootloader parameters to flash
i) Re-init ethernet
p) Print flash partition map
r) Read memory
w) Write memory
j) Jump to arbitrary address
X) Erase all of flash except the bootloader
z) Reset
Flash Partition information:
Name Size Offset
=====================================
bootloader 0x00010000 0x00000000
image1 0x007d0000 0x00020000
image2 0x007c0000 0x00800000
linux 0x00800000 0x01000000
linuxapps 0x00600000 0x01800000
permnv 0x00010000 0x00010000
dhtml 0x00200000 0x01e00000
dynnv 0x00040000 0x00fc0000
vennv 0x00010000 0x007f0000
The "read memory" seems to give you one byte at a time and I'm not certain it actually works. So I think the next step is solder some leads to dump out the firmware from the flash-chip directly, which is on the underside of the board. At that point, I imagine the passwords would be easily found in the image and you might then be able to leverage this into some sort of further hackability.
If you want a challenge and have a lot of time on your hands, this might be your platform — but practically I think the best place for this is the recycling bin.