Cisco EPC3925

BCM33xx

This is a DOCSIS 3.0 Wireless cable Residential Gateway. It uses an eCos operating system. It seems it shares the same hardware with the Netgear CG3100D/CG3101D, Motorola SBG6580, Virgin Media Super Hub VMDG480.

There exist GPL sources available from Netgear FTP:
CG3100_GPL_src.zip eCos source code (38 MB)
CG3100Dv2_V5.5.5.83.mp2_LxG1.0.5.83.mp2_EU_src.zip eCos and Linux source code

visit Netgear FTP, models CG3xxx seems to share similar hardware

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
BCM3380 64MiB 16MiB 4 Yes Yes ?

Failsafe mode

Hardware

Info

Instruction set: MIPS
Vendor: Broadcom
Bootloader: Unknown (see bootlog and guess)
System-On-Chip: Broadcom BCM3380
CPU @Frq FIXME @333MHz
Flash-Chip: Macronix MX25L12845EMI-10G (SPI)
Flash size: 16 MiB
RAM: FIXME / DDR2-667
RAM size: 64 MiB
Wireless: Broadcom BCM43225 (802.11b/g/n) (MiniPCIe)
Ethernet: Atheros AR8316, switch Gigabit w/ vlan support swconfig
Internet: DOCSIS 3.0
USB: Yes 1 x 2.0
Serial: Yes
JTAG: ?

Photos

Casing

Opening the case

Note: This will void your warranty!

  • To remove the cover just unscrew the screws at the bottom of the case.

Photo of PCB

Serial

port.serial general information about the serial port, serial port cable, etc.

FIXME

How to connect to the Serial Port of this specific device:

FIXME Photo of PCB with markings

Use a serial TTL adapter to connect.

Flash chip programming

port.jtag general information about the JTAG port, JTAG cable, etc.

FIXME

Debricking

Bootloader Mods

  1. you could read about bootloader in general

Bootlogs

OEM bootlog

P BCM3380A1 TP0 1 Sync:1 346890 SA BootLoader Version: 2.3.0_R1(S) Release Gnu pcminit spiboot reduced DDR drive Build Date: Jul 1 2009 Build Time: 19:20:01 SPI flash ID 0xc22018, size 16MB, block size 64KB, write buffer 256, busy bit 1 Found image 1 at offset 20000 eCos - hal_diag_init Init device '/dev/BrcmTelnetIoDriver' Init device '/dev/ttydiag' Init tty channel: 814566c0 Init device '/dev/tty0' Init tty channel: 814566e0 Init device '/dev/haldiag' HAL/diag SERIAL init Init device '/dev/ser0' BCM 33XX SERIAL init - dev: 0.2 Set output buffer - buf: 0x81644810 len: 4096 Set input buffer - buf: 0x81645810 len: 4096 BCM 33XX SERIAL config LsSpiInit 3380 [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver... detecting flash3... [00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xc22018 [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Permanent NonVol would fit in the boot block of this flash device, but I found existing NonVol in the following block; using this location instead... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver... ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully. [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices... Detecting the next image number that we will store to by default... Bootloader indicates we are running image 1 By default, we will dload to image number 2! [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully. BcmCmDocsisCtlThread::GetSingletonInstance: WARNING - the singleton is NULL, and someone is accessing it! BcmCmDocsisCtlThread::GetSingletonInstance: WARNING - the singleton is NULL, and someone is accessing it! SAHttpCacheVariables::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! Setting up the SAHttpCacheVariables singleton pointer. CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! CmSnmpNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! BcmCmSANonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! [00:00:03 01/01/1970] [tStartup] BcmCmSANonVolSettings::BcmCmSANonVolSettings: (CM SA NonVol Settings) WARNING - Current CxC Version is 3.9.21.11.mp8 BcmEmtaBlindDataNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! ERROR: Unable to get GetCountry blind data. (BcmEmtaBlindDataNonVolSettings = NULL) WARNING: ResetDefaultBlindEmtaData() -Resetting EMTA non-vol data section to default values mtaNvCalcChecksum: checksum= 1273036006 Reading Permanent settings from non-vol... Checksum for permanent settings: 0x4f6bf263 [00:00:03 01/01/1970] [tStartup] BcmMessageLogNonVolSettings::ReadFromImpl: (User Interface NonVol Settings) WARNING - Read older version of the settings (0.2); they have been upgraded to version 0.3, preserving original settings. [00:00:03 01/01/1970] [tStartup] BcmHalIfNonVolSettings::ReadFromImpl: (HalIf NonVol Settings) WARNING - Read older version of the settings (0.19); they have been upgraded to version 0.21, preserving original settings. [00:00:03 01/01/1970] [tStartup] BcmWiFi80211NonVolSettings::ReadFromImpl: (WiFi 802.11 NonVol Settings) WARNING - Read older version of the settings (0.8); they have been upgraded to version 0.10, preserving original settings. [00:00:03 01/01/1970] [tStartup] BcmCmDocsis30NonVolSettings::ReadFromImpl: (

Notes

  • VMDG480 (disassembling, hardware specifications)
  • w00tsec Unpacking Firmware

—-

Tags

For some Help with the Tags, please have a look here: tags

Back to top

toh/cisco/epc3925.txt · Last modified: 2014/03/02 18:57 by fel2009