Need Help with Webstar EPC2100

[abangbejad]

Hi, I am new to this kind of thing. In fact I just read a tutorial on how to hack a modem. I plan to hack my EPC2100 using SB5100E Shelled Firmware. I'm afraid that I can't return my modem to its original state if I use infinite firmware. I also read that if my modem is using spansion tsop, it can be screwed by the firmware. The tutorial only tells how to change the mac address, not the serial number. Can someone tell me the telnet command to change the modem's serial number? If I don't change my serial number, will I get caught by my ISP? My modem is already registered to the ISP. Or can someone gime other advice or alternative way to hack my modem? Thank you very much. Sorry for my bad English.

[racky29]

its not wise to hack your original virgin modem, the idea is to get one from ebay or somewhere
otherwise they could have you for modding their equipment
get another one and hack that, then you can use the infinite firmware
you probably wont be able to do anything with the original modem cos virgin have sent updates to stop you getting the boot menu p option up
stay on the safer side and get another modem

[abangbejad]

Thanks for the advice. The modem I use now is my own modem. Although it is from my ISP, I bought it. So I think I can do whatever I want with my equipment. My only concern is that they will know that I hacked my modem to get higher speed. If I change my MAC and Serial, can the ISP still identify me? If have to buy a new modem, can you give me a recommendation on which modem to buy? If I can't buy on ebay, which one should I buy between motorolla and webstar? I'm not sure, but I think the shops in my country only sell motorolla 5101 and webstar 2100. Thanks in advance. Sorry for the stupid questions. I'm very new to this and I'm not a tech person. Just a regular computer user.

[racky29]

if its your own modem then use it, but if you want to use the original webstar firm it may not be a good idea, ive seen some posts saying not to use it that way, cos it could take the new update which can stop you from getting the p option on the boot menu, then you will have to black-cat it to get it going again.

just bang the 250 infinite firm on it, follow the 250 guide, the webstar guide is not so detailed, get the 250 ultimate pack, theres a video inside with everyting else you need for ntl-250 and webstar, if you use the 250_guide dont bother with the bit at the end where it tells you to put the tftp address in and forcing the config, just stop where it tells you to go online.

also you could make a simple unbufered jtag lead and get the 'Blackat software SchwarzeKatze V128', and take a backup of your webstar
then you can do what you like with it.

if you need some more info on the webstar jtagging heres a litle tutorial i have knocking about.
Diag to make the Blackcat cable:



all you need to get is
1xDb25 connector, buy one from maplins or cut a old printer cable up.
and
6x10inch lengths of thin wire or shorter.

Db25.



power up modem and open blackat software,
to save a copy of the original firmware, you can read and save a copy of your webstar from the flash tab and save the memory dump on the memory tab,

if you want to write firmware to the modem, untick verify data,
go to the "Flash tab" and press Detect Flash it will the detect the tsop,
select "Write All" and browse to the firmware dump file and press Ok,
once done you wanna stay on the "flash tab" and this time press WRITE and browse to a P option 250bootloader then press OK,
a little pop up box will appear and in it
select 0x00 for Offset and 32768 for Length then press OK,
this will then proceed to write the bootloader assuring you have the P option on your webstar.

[abangbejad]

Thank you very much for your help. I just downloaded ambit 250 ultimate. In the tutorial, I read that I have to type my DS frequency. How can I know my DS frequency? I suspect that it is in signal page of 192.168.100.1. However, in my 192.168.100.1 page, I can only see the system page. The ISP blocks the other page. If I unplug the cable feed, I can see all the page. Does the modem lock the last frequency so when I unplug the cable, the frequency is the same as when the cable is unplugged? In the ambit ulimate, I don't see P option 250bootloader. Also, I found 250hack_dump_telnet.bin and 250 infinite-upgrade.bin. Which one should I use? The 250hck_dump_telnet.bin is about 2 MB, 250 infinite-upgrade.bin is about 800KB. For the Blackat software SchwarzeKatze V128, can I use RS232 cable instead of blackcat cable? Because I already have RS232, but if I have to use blackcat cable, I have to make it first. Thanks.

[racky29]

you only want swartzekatz blackcat if you need it for a special reason like restoring a damaged flash so ignore that, its just for backup and restore, you will use the max232/ rs232 lead on com port and ethernet network cable

and im sure you can get the ds info from the webstar page, click icons at the top, or you can just use the default for your area, telwest is 331000000 or 339000000, c&w-586750000, ntl-402750000, you may need to confirm these.

the first thing before you do anything is to get a mac address from someone around your area with a different ubr number to yours
or trade in the mac trade forums

then you need to make yourself a max232 or max233 cable, max233 is the easy one to make, or you can buy em from internet,

then have a look at the ambit_250_video and watch it a couple of times
and look at the 250_final_tut.doc

then just folow the doc exactly, it will tell you to use 250hack_dump_telnet


so open a new folder in c:\
put in these files, 250hack_dump.bin, tftp32.exe, 250_final_tut.doc, ambit_250_video.avi, and a new .txt file and copy the commands into it for easy copy and paste

plug the max232 lead in and ethernet network cable, and follow the guide

just remember to stop folowing he guide towards the end where it says "Once you have established that you can get onto the web, need to force the modem to use the 10mb config file."
you wont want to force config so stop there, and you should be online at this point anyway.

good luck

[abangbejad]

Thank you very much. Gonna try to flash my modem when I have the time. Probably wednesday. I still don't know my ds frequency. Is there autosearch function or any program to check my ds frequency. I can only access the system page of my modem page, and it doesn't tell my ds frequency.
The other page is not accessible. The page says this.

This feature is not enabled.
This feature has not been enabled in your cable modem.

Please contact your data services provider for more information about this feature and its availability on the network.

To exit this page, click on the "Back" button on your browser tool bar to return to the previous page or click on the "System" link above.


If I use the infinite firmware, can the ISP know that i use hacked firmware? I read that many firmwares have stealth mode. Can you tell me how to make the infinite firmware stealth? I read the tutorial and it mention nothing about making infinite firmware stealth.

The ambit 250 ultimate.rar has the stealth firmware, but in the readme it says that it is for tw and pure. I live in another country so I don't think I can use settings for UK's ISP.

I also read that the ISP can force me to update my firmware. Can you tell me how to disable firmware update? Because I think I will need to prevent my ISP from updating my infinite firmware after I flash my modem.

Thanks for the help. It clears many of my confusions about modem hacking.

[racky29]

ok
if you got infinite loaded they cannot force an update, thats why i said in my first post dont use the original firmware cos then they can update it and lock you out of the menu and you wont get your p option and boot menu, ive got a feeling your modem has already taken this update, thats why you cant see the web pages with the ds freq, but we will soon find out when you boot up with your serial cable connected in hyperterm.
and if you cant get your p option, your only option then is to setup a blackcat and flash a new bootloder with p option (32.768kb) filesize.

alright so
dont bother with the stealthed firm or any of the others, just use the 250_hack_dump like the 250_guide says, it works well and stable
the stealth firm has a bug which can slowly degrade the bootloder over time so i heard, it only has different snmp ports anyway thats all.

if you want more stealth, ive got a txt file, here goes

Special Stealth Commands Section
Next open a new copy of HyperTerminal, and make sure cable feed not plugged into the modem, take it out
This time we select:
Port: TCP/IP (Winsock)
Host address: 192.168.100.1 Leave the port number as 23

Broadcom Corporation Embedded Telnet Server (c) 2000-2003
WARNING: Access allowed by authorized users only.

Press enter, then enter the following login and password:
Login: admin
Password: infinite

WARNING: It is possible to crash the system, cause a deadlock,
or cause the connection to be shut down via Telnet.
Run commands with caution!
Console now switched to Telnet session...
Scanning DS Channel at 240000000 Hz...
Scanning DS Channel at 249000000 Hz...
We are now back in the console using telnet. It should be scanning for a frequency to lock onto. We want to stop this so copy and paste these cmds separately.

cd \cm_hal
scan_stop
cd \

scanning should have stopped, now here's some stealth commands

disable reading your modem with snmp commands.
cd \
cd snmp
view_v1v2 Noaccess
cd \
you will have to accept the warning when working with snmp commands IE: (yes)
--------------------------------
disable remote telnet.
cd non-vol
cd msg-log
telnet_ipstacks 2
write
--------------------------------
block all remote updates.
cd \
cd non-vol
cd snmp
max_dload_tries 0
write
--------------------------------
bpi cmd. disable
cd \
cd \non
cd docsis
enable bpi false
write
--------------------------------
250 serial number change
cd \
cd non-vol
cd snmp_cm
docsDevSerialNumber 00D069F62D22 [ your mac addy in capitals or whatever you want]
write
-------------------------------
250 Change the Telnet user/pass from admin/infinite
cd \non (press enter)
cd msg (press enter)
user_name <your desired username here> (press enter)
password <your desired password here> (press enter)
write (press enter)
-------------------------------
250 Change Usb Mac Address
cd \non-vol/halif/
usb_mac_address <your usb mac address here> (press enter)
write (press enter)
note: usb mac should be entered as AA:bb:cc:dd:ee:fg
with the colons, not aabbccddeefg
and should be 1 number higher at the end than normal mac
-------------------------------
The settings will not be change until you reboot your modem.
hope this helps

[abangbejad]

Sorry I haven't replied in a long time. I broke my modem. I must use dialup to connect to Internet now. I tried to flash my modem, not with ambit infinite, but with haxorware 0.8 beta 4. I read that it is better and can be used in any broadcom 3349, so I try flashing with it. I think I messed up with my flashing. Now schwarzekatze can detect my modem cpu which is broadcom 3349 but when I try to detect flash, I got no flash detected.

I flash using the instruction, go to flash tab, detect flash, write haxorware 0.8 beta 4 with offset 0x10000. but nothing seems to happen. then I try to go to sb5100 tab, flash bootloader with sb5101 hacked bootloader, then go to flash tab, write haxorware 0.8 beta 4 with offset 0x10000. After that, schwarzekatze can't recognize my flash.

Do you have any suggestion? Is there a way to recover my modem? Thanks.

Btw, in your epc2100 picture, the 2nd pin and the 7th pin goes to gnd 22-25. Should I connect both the 2nd and the 7th pin to 22-25 pin in db25, or I just choose one pin between 2nd pin and 7th pin. My blackcat connection that i use when I flashed my modem only use the 7th pin to connect to the 4 pins (pin 22-25).