Haxorware Manual By rajkosto For version 0.9.2 Haxorware Firmware Forum http://www.sbhacker.net/forum//index.php?showforum=131 Configure http://192.168.100.1 Configuration page layout: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 Information section: 1. This shows your MACâs DHCP settings, such as the original configuration file name and the IP of the server it is on 2. Current IP addresses of the modem. HFC IP is the ip of the Coaxial interface and Eth IP is the ip of the network interface that connects to your computer. This is the IP you use to access the configuration page and telnet. It can be changed with the following Telnet or Web Shell commands: cd /non/msg dhcp_settings Remote access server IP address: [192.168.100.1] Remote access server subnet mask: [255.255.255.0] Remote access server router: [192.168.100.254] write 3. The configuration file the modem is currently using. Clicking on the filename will allow you to save the config on your computer. 4. Current modemâs uptime.This shows how much time has passed since the modem was last restarted. The format is Days:Hours:Minutes:Seconds. Administration section: 5. Telnet parameters. The checkbox indicates whether or not the telnet daemon is started at modem boot. If you do not use the telnet daemon, you can uncheck this to save 2KB of RAM on the modem. Also you can change the username and password that is requested when you connect to the telnet daemon. 6. Here you can change what Vendor, Model, and software version the modem reports when it is SNMP scanned and when it requests a HFC DHCP lease. For example, if you are using the MAC address of a ambit, it is a good idea to change these to reflect an Ambit modem to prevent suspicion.Clearing any of these boxes will return that box to the default Motorola values. 7. Since ISPâs mainly do snmp scanning on the default SNMP ports (161 and 162), changing these will essentially block any snmp probes from the ISP. The default âstealthâ ports are 225 and 226 for the snmp and trap ports respectively. 8. Checking the box here will make the modem ignore any DHCP settings set by the ISP for the HFC interface and instead use th static parameters defined here. This is useful for ISPâs which do not give unregistered MAC addresses a valid DHCP lease, or give it a limited, walled garden IP. You can set any parameters that you want here, however if you set one out of the normal range of your ISPâs HFC ips, your modem will probably not be able to access the TFTP and TOD servers.This will require you to autoserve a config to get it online. However, setting an IP out of range like this will make your modem virtually invisible to the isp, they cant scan it, and since it doesnât request a DHCP lease, they have no idea itâs even on. 9. This should be set to Disabled on most ISPâs. The available options are: Disabled, Use DHCP, and Manual. If your ISP has the tftp-enforce option enabled in their CMTS, you will have to turn it on. If you arenât using the Force Static IP option, the Use DHCP setting is best. This will simulate your modem getting the original configuration from the ISP before it loads a forced/autoserved one.However, if Force Static IP is ON, then there are no DHCP settings for the modem to use, and you will have to set this to Manual and specify the IP and filename in the boxes below. 10. If you have changed any settings in the Administration section, you will have to click this button to permanently save them. Utility functions: 11. This will perform a soft restart of the modem, saving any settings before rebooting.Equivalent to the /reset command in the Broadcom shell. 12. This will disable all the IP filters that your modem is using.Equivalent to the /snmp/cm_filters off command in the Broadcom shell. Some ISPâs use IP filters to block certain traffic such as port 80 incoming, which will block you from hosting any web servers. Disabling the filters makes all ports open. 13. This will erase all the dynamic settings in the modem. I have added this option here simply because some people that have had infinite firmware previously running on their modems have the dynamic settings in a weird state that will make the modem crash after parsing the configuration file. Note that a soft reset will rewrite all the dynamic settings back into the modem, so usually after clicking this you will have to do a hard reset (power cycle the modem). Addresses section: 14. You can change the MAC addresses and the Serial number of the modem here. Note that all 3 MAC addresses MUST be different from each other. If they arenât all hell will break loose when the modem tries to get online. These addresses vary depending on the modem vendor, on Motorola modems the Ethernet MAC will be the HFC MAC +1 and the USB mac is a completely different number. You will only need to change the HFC MAC in order to clone the address of another modem. The others are irrelevant (except the serial number which may also need to be cloned on some ISPâs). 15. Clicking this button will save any of the changes you have made to the addresses. Note that all the fields must be filled out (none must be left blank) and be in a proper format otherwise you will receive an error and the addresses wonât be changed. Autoserve section: 16. This checkbox toggles the Autoserve feature. Autoserve is a feature that allows the modem to host itâs own config, removing the need to have a TFTPD on another computer or on a Router in order to use configs that arenât available on the ISPâs servers such as custom or outdated ones (that are still valid of course). A config must be uploaded in the flash memory of the modem (use the upload form below this checkbox to do so) for this feature to work. If Autoserve is enabled, the Forced config settings in the section below are ignored. 17. If you have toggled the checkbox for the Autoserve feature, you will have to click this button to apply the change. 18. Use this form to upload a configuration file from your computer to the modemâs flash for use in the Autoserve function. Please do not use long file names or names with special characters as this may break something. Once you have browsed and selected an appropriate file, click Upload to save it to the modem. Config settings section: 19. With these you can override (force) your modem to use a specific config, ignoring the one it gets from the DHCP server. If you leave any of the fields blank, the default settings from the DHCP will be used for that field. Most people will only need to fill out the Config file field, unless the config they want is located on a different TFTP server.Note that when SNMP queried, the modem will respond with the original DHCP tftp ip and filename, or if you use Static IP, with the bypass IP and filename that you specified. 20. If you change any of the settings in the config settings section, you will need to click this button to apply them. BPI settings section: 21. If you change the MAC address of the modem without changing itâs certificates, you will have to either completely disable BPI or use bpi version 0. This is always at Donât change because Haxorware cannot properly determine the current BPI settings that are in effect. Selecting any of the other options will apply the apropriate setting when you click Save. The options are: - Disabled: This completely disables Baseline Privacy. Equivalent to the Broadcom shell command âenable bpi falseâ. - BPI: This will force the modem to use Baseline Privacy version 0. Equivalent to the Broadcom shell command âenable bpi true, bpi_version 0â. - BPI+: The default state of all bought modems, this enables full Baseline Privacy Plus with certificate authorization. This will only be usable if the configured MAC address matches the one in the certificate. 22. You will need to click this button to apply any settings related to BPI if you have changed them. Backup and Restore section: 23. Use this feature to create a backup of your modems flash. You can backup either the Full 2MB flash, or jus the Permanent Non-vol area (32KB). After choosing which region to backup, clicking on Download will save it to your computer. 24. You can use this option to restore a Permanent Non-Vol backup (32KB) from a file on your computer to the modem. Useful when you donât have JTAG or a Diagnostic cable and want to overwrite a Infinite Non-Vol to a real Motorola one to prevent issues and allow BPI to work. Firmware upgrade section: 25. You can upload a valid .bin Firmware image here and it will be flashed to the first image slot on the modem. Note that if you upload a .p7 or any other otherwise invalid Firmware image, the flash will not be performed and an error will appear with no damage caused to the modem. After you click upload it may appear like it got stuck but wait a few minutes and the firmware upgrade should be complete. You can then reboot the modem and it will use the new firmware you uploaded. TFTP GET section: 26. This is the interface to the TFTP client present in Haxorware. When input with a valid IP and Filename, it will initiate a TFTP download from the specified TFTP server and save the file to your computer. The limit is 10KB for the file size so you canât use this option to download original firmware images, but you can use it to download modem configuration files, if you want to analyse them on your computer or use them for the Autoserve feature.