User Tools

Site Tools


Cisco EPC3208G

This is a Cable Gateway. It uses an eCos operating system.



Instruction set: MIPS
Vendor: Broadcom
Bootloader: SA BootLoader - Gnu spiboot reduced DDR drive
System-On-Chip: Broadcom BCM3382
CPU @Frq ?
Flash-Chip: Spansion FL128PIF (SPI)
Flash size: 16 MB
RAM: Samsung K4T51163QJ-BCF7 / DDR2-800 6-6-6
RAM size: 32 MiB
Wireless: none
Ethernet: 1 GbE
Internet: DOCSIS 3.0
USB: none
Serial: Yes


EPC3208G PCB - Front EPC3208G PCB - Back


Interface Description J103 J303 / J505
Pictures Unknown Port - J303 TTL Port J303/J505
Grid Dimension
- Soldering Points:
2,54 mm 2,00 mm
Baudrate ? 115200 ; 8N1
Purpose ? TTL
Hint I don't know, for what it is…
feel free to edit.
Don't forget to cross the RX and TX on the TTL device,
otherwise you can damage your reader.

OEM bootlog - Locked

BCM338221 TP0 1 Sync:1 346890 SA BootLoader Version: 2.3.1_R3(S) Pre-release Gnu spiboot reduced DDR drive Build Date: Sep 26 2011 Build Time: 15:31:28 Setting SPI device 0 to clock 0 Setting SPI device 0 to clock 7 SPI flash ID 0x012018, size 16MB, block size 64KB, write buffer 256, flags 0x0 Found image 1 at offset 20000 Found image 2 at offset 800000 eCos - hal_diag_init Init device '/dev/BrcmTelnetIoDriver' Init device '/dev/ttydiag' Init tty channel: 81002218 Init device '/dev/tty0' Init tty channel: 81002238 Init device '/dev/haldiag' HAL/diag SERIAL init Init device '/dev/ser0' BCM 33XX SERIAL init - dev: 0.2 Set output buffer - buf: 0x811cacb0 len: 4096 Set input buffer - buf: 0x811cbcb0 len: 4096 BCM 33XX SERIAL config [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver... [00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0x12018 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver... ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully. [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices... Detecting the next image number that we will store to by default... Bootloader indicates we are running image 2 By default, we will dload to image number 1! [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully. BcmCmDocsisNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! SAHttpCacheVariables::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! Setting up the SAHttpCacheVariables singleton pointer. CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! BcmCmSANonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! [00:00:01 01/01/1970] [tStartup] BcmCmSANonVolSettings::BcmCmSANonVolSettings: (CM SA NonVol Settings) WARNING - Current CxC Version is BcmEmtaBlindDataNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! ERROR: Unable to get GetCountry blind data. (BcmEmtaBlindDataNonVolSettings = NULL) BcmPcpClientServiceAppIf::GetSingletonInstance: WARNING - the singleton is NULL, and someone is accessing it! WARNING: ResetDefaultBlindEmtaData() -Resetting EMTA non-vol data section to default values mtaNvCalcChecksum: checksum= 1273036007 Reading Permanent settings from non-vol... Checksum for permanent settings: 0xdc2ff584 [00:00:01 01/01/1970] [tStartup] BcmCmSANonVolSettings::ReadFromImpl: (CM SA NonVol Settings) WARNING - Read older version of the settings (0.10); they have been upgraded to version 0.11, preserving original settings. [00:00:01 01/01/1970] [tStartup] BcmNonVolSettings::IsDefault: (CM BFC Event Log) Permanent settings are default! [00:00:01 01/01/1970] [tStartup] BcmNonVolSettings::IsDefault: (CWMP Client NonVol Settings) Permanent settings are default! [00:00:01

The Console Output stops abrupt, exactly at this point. (firmware dump not modificated)
At this point he starts to read the nonvol settings - there is a setting inside that will hide the boot process.
Hint: Maybe it's a good idea to break the nvram… :)


Don't power on the modem till the firmware read/write out, if you use a external SPI Reader.
SPI flash - numbered contacts SPI flash - described contacts


toh/cisco/epc3208g.txt · Last modified: 2015/11/26 10:58 by macxylo