#26 25/09/2015 20:20:54

VincentAlex
Modérateur
Lieu: Massy (91)
Date d'inscription: 01/10/2007
Messages: 3030

Re: SFR TV Evolution Sagem

C'est ce qu'on craignait.
Peux tu nous indiquer comment en est tu arrivé à ce message d'erreur ? merci.


Environnement de développement : MacOsX/Fedora 12
Dépôt dropbox

Hors ligne

 

#27 27/09/2015 00:59:18

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

En envoyant un .img au deco en mode bourrin avec un fake DNS du softversion.sfb.sfr.fr en local.
Le deco va chercher le fw sur mes serveurs ensuite (firmware.stb.fhocorp.net)

En tous cas cela fais bien ch[CENSURE] que l'on puisse pas avoir des sources ou infos sur ce deco sad


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#28 05/10/2015 07:59:39

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Après des recherches en wireshark et un peu de bourinnage, j'ai reussi a construire une PFS modifié. J'ai pu ainsi modifier certains aspects de la conf du deco:

- Ajout de webradios supplementaires dans l'app de radio a la demande
- Ajout d'applications supplémentaires dans les apps ( FHO Corp TV ... etc )
- Acces aux jeux SFR en direct

Mais je reste souvent bloqué au niveau des EMM d'initialisation des droits TV
Je precise que je n'ai toujours pas la main sur le fw et que je fais du fake DNS sur le deco pour le faire causer la ou je veux.


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#29 19/10/2015 16:19:55

hugopoi
Moddeur newbie
Date d'inscription: 27/08/2015
Messages: 6

Re: SFR TV Evolution Sagem

Ok donc la seule solution que je vois pour avancer rapidement, c'est de trouver une faille exploitable sur la box pour pouvoir faire un dump du filesyteme en clair.
2 choix :
soit trouver une faille soft au niveau des différents protocoles réseau de la box
soit se coller sur une interface hardware type port série ou faire un dump directe de la nand

Hors ligne

 

#30 20/10/2015 19:06:51

VincentAlex
Modérateur
Lieu: Massy (91)
Date d'inscription: 01/10/2007
Messages: 3030

Re: SFR TV Evolution Sagem

Pour l'option 2, je pense que c'est pas la peine car le firmware doit aussi être chiffré dans la nand. Le déchiffrement doit se faire à la volée dans la ram.


Environnement de développement : MacOsX/Fedora 12
Dépôt dropbox

Hors ligne

 

#31 28/11/2015 15:38:08

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

@VincentAlex  Je penses aussi sad


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#32 18/01/2016 00:24:02

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Hello

Voici une liste des ports qui sont ouverts sur le déco :

Code:

PORT      STATE SERVICE         VERSION

80/tcp    open  http

139/tcp   open  netbios-ssn     Samba smbd 3.X (workgroup: WORKGROUP)

445/tcp   open  netbios-ssn     Samba smbd 3.X (workgroup: WORKGROUP)

8000/tcp  open  http-alt        stb

8001/tcp  open  vcom-tunnel?

8002/tcp  open  teradataordbms?

49155/tcp open  upnp            Portable SDK for UPnP devices 1.6.18 (Linux 2.6.23.17_stm23_0125dorade00; DLNADOC 1.50; UPnP 1.0)

49156/tcp open  upnp            Portable SDK for UPnP devices 1.6.18 (Linux 2.6.23.17_stm23_0125dorade00; DLNADOC 1.50; UPnP 1.0)

50000/tcp open  ibm-db2?

50001/tcp open  unknown

Si ça peut faire avancer le schmilblik... sad

Dernière modification par FHO Corp (18/01/2016 00:25:23)


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#33 01/02/2016 11:14:36

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Aparament zbox s'etait déjà cassé les dents dessus : https://www.neufbox4.org/forum/viewtopic.php?pid=37337


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#34 02/02/2016 19:01:36

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

J'ai ça apres la methode des dd if sur le APPLI.img :

Code:

fho@FH0Corp-Linux:~/Desktop/stb/tmp$ file APPLI-13.2.23.img_extrat
APPLI-13.2.23.img_extrat: DOS executable (COM)

Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#35 29/03/2016 23:50:55

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Code:

root@linux:~/stb-fw/appli# binwalk -eM APPLI-13.2.23.img 

Scan Time:     2016-03-29 14:56:45
Target File:   /root/stb-fw/appli/APPLI-13.2.23.img
MD5 Checksum:  5904335e1bbe5d6960ae4f7c63ffb1bc
Signatures:    344

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
4581271       0x45E797        LANCOM OEM file
6687389       0x660A9D        MySQL MISAM index file Version 1
48269424      0x2E08870       MySQL MISAM compressed data file Version 10
63790218      0x3CD5C8A       MySQL MISAM compressed data file Version 4

Rien de bien exploitable pour l'instant... sad


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#36 18/04/2016 00:18:27

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Après un peu de recherches et un ou deux coups de fer à souder, voici le bootlog du déco quand il est branché. Enjoy wink

Code:

Linux version 2.6.23.17_stm23_0122-bsl (gaviot@SFR-FG) (gcc version 4.2.4 (snapshot) (STMicroelectronics/Linux Base 4.2.4-71)) #82 Tue May 10 12:59:52 CEST 2011
Booting machvec: dorade
Node 0: start_pfn = 0x40000, low = 0x60000
Zone PFN ranges:
  Normal     262144 ->   393216
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0:   262144 ->   393216
DORADE board initialisation
STx7105 version 3.x
Use BPA2 partitions table for xMiB DDR2
bpa2: partition 'gfx-memory' created at 0x40726000, size 16384 kB (0x01000000 B)
Built 1 zonelists in Zone order.  Total pages: 130048
Kernel command line:  nwhwconf=device:eth0,hwaddr:e0:a1:d7:9d:ab:78 mtdparts=physmap-flash:256k(Stage1),2304k(Bsl-1),5632k(Bsl-2) bsl=parts:16,34,33  console=ttyAS2,115200 CONSOLE=/dev/ttyAS2
PID hash table entries: 2048 (order: 11, 8192 bytes)
Using tmu for system timer
Using 25.000 MHz high precision timer.
Console: colour dummy device 80x25
console [ttyAS2] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 500096k/524288k available (1293k kernel code, 474k data, 1204k init)
PVR=04909200 CVR=60880000 PRR=00009e20
I-cache : n_ways=2 n_sets=512 way_incr=16384
I-cache : entry_mask=0x00003fe0 alias_mask=0x00003000 n_aliases=4
D-cache : n_ways=2 n_sets=512 way_incr=16384
D-cache : entry_mask=0x00003fe0 alias_mask=0x00003000 n_aliases=4
Mount-cache hash table entries: 512
CPU: STx7105
NET: Registered protocol family 16
PIO6:
10000000

Board SAGEM M91R3 BASIC detected
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: SuperH clocksource has been installed.
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 7, 524288 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 65536 bind 65536)
TCP reno registered
squashfs: version 3.3 (2007/10/31) Phillip Lougher
io scheduler noop registered (default)
stm_hwrandom stm_hwrandom: STM Random Number Generator ver. 0.1
STMicroelectronics ASC driver initialized
stasc.0: ttyAS0 at MMIO 0xfd031000 (irq = 122) is a stasc
stasc.1: ttyAS1 at MMIO 0xfd032000 (irq = 121) is a stasc
stasc.2: ttyAS2 at MMIO 0xfd033000 (irq = 120) is a stasc
loop: module loaded
        platform registration... <7>done!
        GMAC - user ID: 0x10, Synopsys ID: 0x33
        no valid MAC address; please, set using ifconfig or nwhwconfig!
        eth0 - (dev. name: stmmaceth - id: 0, IRQ #134
        IO base addr: 0xfd110000)
STMMAC MII Bus: probed
eth0: PHY ID 01410c89 at 16 IRQ 0 (0:10)
eth0: PHY ID 01410c89 at 17 IRQ 0 (0:11)
eth0: PHY ID 01410c89 at 18 IRQ 0 (0:12)
eth0: PHY ID 01410c89 at 19 IRQ 0 (0:13)
eth0: PHY ID 01410c89 at 20 IRQ 0 (0:14)
eth0: PHY ID 00000610 at 24 IRQ 246 (0:18) active
eth0: PHY ID 00000610 at 25 IRQ 0 (0:19)
eth0: PHY ID 00000610 at 26 IRQ 0 (0:1a)
eth0: PHY ID 00000610 at 27 IRQ 0 (0:1b)
eth0: PHY ID 00000610 at 28 IRQ 0 (0:1c)
eth0: PHY ID 00000610 at 29 IRQ 0 (0:1d)
Marvell 88E6161: Registered new driver
Marvell 88E6061: Registered new driver
nwhw_config: (eth0) setting mac address: e0:a1:d7:9d:ab:78
physmap platform flash device: 00800000 at 00000000
physmap-flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
physmap-flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
3 cmdlinepart partitions found on MTD device physmap-flash
Creating 3 MTD partitions on "physmap-flash":
0x00000000-0x00040000 : "Stage1"
0x00040000-0x00280000 : "Bsl-1"
0x00280000-0x00800000 : "Bsl-2"
NAND device: Manufacturer ID: 0xad, Chip ID: 0xda (Hynix NAND 256MiB 3,3V 8-bit)
Creating 1 MTD partitions on "stm-nand-afm.1":
0x00000000-0x10000000 : "NAND"
i2c_st40_pio: ST40 PIO based I2C Driver
i2c_st40_pio: allocated pin (2,2) for scl (0x8031a3d4)
i2c_st40_pio: allocated pin (2,3) for sda (0x8031a3f0)
i2c_st40_pio: allocated pin (2,5) for scl (0x8031a428)
i2c_st40_pio: allocated pin (2,6) for sda (0x8031a444)
i2c_st40_pio: allocated pin (3,4) for scl (0x8031a520)
i2c_st40_pio: allocated pin (3,5) for sda (0x8031a53c)
i2c_st40_pio: allocated pin (3,6) for scl (0x8031a558)
i2c_st40_pio: allocated pin (3,7) for sda (0x8031a574)
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Freeing unused kernel memoryvSFR - Bienvenue
m88e6061_config_init phy_id = 00000610
Marvell switch 88E6061 found
stmmac_timer: TMU2 Timer ON (freq 256Hz)
BIOS entry address at 0x80800740
stmcore-display: using HDMI hotplug
stmcore-display: STi7105 display: probed
device probe found 2 display pipelines
requesting frm: 'component.fw', c10da208/9ff7dd9c
loading frm: 'component.fw' failed: -2
stmfb: fb0 parameters = "1280x720-32@50:5M:0:PAL:RGB:RGB"
stmfb: fb1 parameters = "720x576-32@50i:4M:0:PAL:RGB:RGB"
ak4708: module license 'WYPLAY' taints kernel.
ak4708 2-0011: attaching i2c client
UBI: attaching mtd3 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd3 to ubi0
UBI: MTD device name:            "NAND"
UBI: MTD device size:            256 MiB
UBI: number of good PEBs:        2044
UBI: number of bad PEBs:         4
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     4
UBI: available PEBs:             761
UBI: total number of reserved PEBs: 1283
UBI: number of PEBs reserved for bad PEB handling: 20
UBI: max/mean erase counter: 47/18
UBI: background thread "ubi_bgt0d" started, PID 187

--- STB INFO ---
  STB-Model=DI91, CA-SN=0x2C6A93EC, NUID=0xA5FFAFFD

--- STB Content List ---
  StbId=e0a1d79dab78,   SerialNumber=BS2A012900205800072
  ContentId=0x46500301, ContentType=FRT-PNL, ContentVersion=0.0.21,
  ContentId=0x2042736C, ContentType=BSL, ContentVersion=1.4.32, VolumeId=0101 *
  ContentId=0x2042736C, ContentType=BSL, ContentVersion=1.4.32, VolumeId=0102
  ContentId=0x4170706C, ContentType=APPLI, ContentVersion=15.1.5, VolumeId=0601
  ContentId=0x4170706C, ContentType=APPLI, ContentVersion=13.2.23, VolumeId=0602
-----------------------

HandleVSYNCInterrupt: - time discontinuity detected, vsync interval = 48169 field duration = 20000
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 3, name "UBI-Volume-03"
UBIFS: file system size:   15364096 bytes (15004 KiB, 14 MiB, 121 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       4 (latest is 4)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  759305 bytes (741 KiB)
udhcpc (v1.14.1) started
PHY: 0:18 - Link is Up - 100/Full
Sending discover...
Sending discover...
Sending discover...

PS: Si en as qui veulent avoir les pinouts du port série, demandez moi par MP wink

Bisous

Dernière modification par FHO Corp (18/04/2016 00:18:51)


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#37 19/08/2016 13:00:17

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Allez soyons fous
Voici le bootlog complet ( boot du boitier jusqu’à la mosaïque des services )

Code:

Linux version 2.6.23.17_stm23_0122-bsl (gaviot@SFR-FG) (gcc version 4.2.4 (snapshot) (STMicroelectronics/Linux Base 4.2.4-71)) #82 Tue May 10 12:59:52 CEST 2011
Booting machvec: dorade
Node 0: start_pfn = 0x40000, low = 0x60000
Zone PFN ranges:
  Normal     262144 ->   393216
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0:   262144 ->   393216
DORADE board initialisation
STx7105 version 4.x
Use BPA2 partitions table for xMiB DDR2
bpa2: partition 'gfx-memory' created at 0x40726000, size 16384 kB (0x01000000 B)
Built 1 zonelists in Zone order.  Total pages: 130048
Kernel command line:  nwhwconf=device:eth0,hwaddr:24:95:04:30:53:f8 mtdparts=physmap-flash:256k(Stage1),2304k(Bsl-1),5632k(Bsl-2) bsl=parts:16,34,33  console=ttyAS2,115200 CONSOLE=/dev/ttyAS2
PID hash table entries: 2048 (order: 11, 8192 bytes)
Using tmu for system timer
Using 25.000 MHz high precision timer.
Console: colour dummy device 80x25
console [ttyAS2] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 500096k/524288k available (1293k kernel code, 474k data, 1204k init)
PVR=04909200 CVR=60880000 PRR=00009e40
I-cache : n_ways=2 n_sets=512 way_incr=16384
I-cache : entry_mask=0x00003fe0 alias_mask=0x00003000 n_aliases=4
D-cache : n_ways=2 n_sets=512 way_incr=16384
D-cache : entry_mask=0x00003fe0 alias_mask=0x00003000 n_aliases=4
Mount-cache hash table entries: 512
CPU: STx7105
NET: Registered protocol family 16
PIO6:
00100110

Board SAGEM UNKNOWN PREMIUM detected
Generic PHY: Registered new driver
NET: Registered protocol family 2
Time: SuperH clocksource has been installed.
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 7, 524288 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 65536 bind 65536)
TCP reno registered
squashfs: version 3.3 (2007/10/31) Phillip Lougher
io scheduler noop registered (default)
stm_hwrandom stm_hwrandom: STM Random Number Generator ver. 0.1
STMicroelectronics ASC driver initialized
stasc.0: ttyAS0 at MMIO 0xfd031000 (irq = 122) is a stasc
stasc.1: ttyAS1 at MMIO 0xfd032000 (irq = 121) is a stasc
stasc.2: ttyAS2 at MMIO 0xfd033000 (irq = 120) is a stasc
loop: module loaded
        platform registration... <7>done!
        GMAC - user ID: 0x10, Synopsys ID: 0x33
        no valid MAC address; please, set using ifconfig or nwhwconfig!
        eth0 - (dev. name: stmmaceth - id: 0, IRQ #134
        IO base addr: 0xfd110000)
STMMAC MII Bus: probed
eth0: PHY ID 01410c89 at 16 IRQ 0 (0:10)
eth0: PHY ID 01410c89 at 17 IRQ 0 (0:11)
eth0: PHY ID 01410c89 at 18 IRQ 0 (0:12)
eth0: PHY ID 01410c89 at 19 IRQ 0 (0:13)
eth0: PHY ID 01410c89 at 20 IRQ 0 (0:14)
eth0: PHY ID 00000610 at 24 IRQ 246 (0:18) active
eth0: PHY ID 00000610 at 25 IRQ 0 (0:19)
eth0: PHY ID 00000610 at 26 IRQ 0 (0:1a)
eth0: PHY ID 00000610 at 27 IRQ 0 (0:1b)
eth0: PHY ID 00000610 at 28 IRQ 0 (0:1c)
eth0: PHY ID 00000610 at 29 IRQ 0 (0:1d)
Marvell 88E6161: Registered new driver
Marvell 88E6061: Registered new driver
nwhw_config: (eth0) setting mac address: 24:95:04:30:53:f8
physmap platform flash device: 00800000 at 00000000
physmap-flash: Found 1 x16 devices at 0x0 in 16-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
physmap-flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
3 cmdlinepart partitions found on MTD device physmap-flash
Creating 3 MTD partitions on "physmap-flash":
0x00000000-0x00040000 : "Stage1"
0x00040000-0x00280000 : "Bsl-1"
0x00280000-0x00800000 : "Bsl-2"
NAND device: Manufacturer ID: 0x98, Chip ID: 0xda (Toshiba NAND 256MiB 3,3V 8-bit)
Creating 1 MTD partitions on "stm-nand-afm.1":
0x00000000-0x10000000 : "NAND"
i2c_st40_pio: ST40 PIO based I2C Driver
i2c_st40_pio: allocated pin (2,2) for scl (0x8031a3d4)
i2c_st40_pio: allocated pin (2,3) for sda (0x8031a3f0)
i2c_st40_pio: allocated pin (2,5) for scl (0x8031a428)
i2c_st40_pio: allocated pin (2,6) for sda (0x8031a444)
i2c_st40_pio: allocated pin (3,4) for scl (0x8031a520)
i2c_st40_pio: allocated pin (3,5) for sda (0x8031a53c)
i2c_st40_pio: allocated pin (3,6) for scl (0x8031a558)
i2c_st40_pio: allocated pin (3,7) for sda (0x8031a574)
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Freeing unused kernel memory:SFR - Bienvenue
m88e6061_config_init phy_id = 00000610
Marvell switch 88E6061 found
stmmac_timer: TMU2 Timer ON (freq 256Hz)
BIOS entry address at 0x80800740
stmcore-display: using HDMI hotplug
stmcore-display: STi7105 display: probed
device probe found 2 display pipelines
requesting frm: 'component.fw', c10da208/9ff71d9c
loading frm: 'component.fw' failed: -2
stmfb: fb0 parameters = "1280x720-32@50:5M:0:PAL:RGB:RGB"
stmfb: fb1 parameters = "720x576-32@50i:4M:0:PAL:RGB:RGB"
ak4708: module license 'WYPLAY' taints kernel.
ak4708 2-0011: attaching i2c client
UBI: attaching mtd3 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd3 to ubi0
UBI: MTD device name:            "NAND"
UBI: MTD device size:            256 MiB
UBI: number of good PEBs:        2044
UBI: number of bad PEBs:         4
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     4
UBI: available PEBs:             761
UBI: total number of reserved PEBs: 1283
UBI: number of PEBs reserved for bad PEB handling: 20
UBI: max/mean erase counter: 39/22
UBI: background thread "ubi_bgt0d" started, PID 187

--- STB INFO ---
  STB-Model=ETSI91, CA-SN=0x2C9D6741, NUID=0xB5FEAB7F

--- STB Content List ---
  StbId=2495043053f8,   SerialNumber=PS3C042100212000062
  ContentId=0x46500301, ContentType=FRT-PNL, ContentVersion=0.0.21,
  ContentId=0x2042736C, ContentType=BSL, ContentVersion=1.4.32, VolumeId=0101 *
  ContentId=0x2042736C, ContentType=BSL, ContentVersion=1.4.32, VolumeId=0102
  ContentId=0x4170706C, ContentType=APPLI, ContentVersion=13.2.23, VolumeId=0601
  ContentId=0x4170706C, ContentType=APPLI, ContentVersion=15.1.5, VolumeId=0602
-----------------------

HandleVSYNCInterrupt: - time discontinuity detected, vsync interval = 54100 field duration = 20000
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 3, name "UBI-Volume-03"
UBIFS: file system size:   15364096 bytes (15004 KiB, 14 MiB, 121 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       4 (latest is 4)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  759305 bytes (741 KiB)
udhcpc (v1.14.1) started
PHY: 0:18 - Link is Up - 100/Full
Sending discover...
Sending discover...
Sending discover...
   Demarrage en cours - Etape 1/2
UBIFS: un-mount UBI device 0, volume 3
Check Signature of Application Id=0x4170706C Version=15.1.5 in Volume 0602
Sending discover...
Sending discover...
Sending discover...
Launch Application UBIBLK: adding volume 0:2
 ubiblka:Id=0x417 unknown partition table
0706C Version=15.1.5 in Volume 0602
Starting new kernel
kexec information
  segment[0]: 0x81000000 - 0x81435000 (0x00435000)
  start     : 0x81002000

image->start:       0x81002000
Linux version 2.6.23.17_stm23_0125dorade00 (root@builder) (gcc version 4.2.4 (snapshot) (STMicroelectronics/Linux Base 4.2.4-71)) #1 PREEMPT Mon Jul 20 18:03:26 Local time zone must be set--see
Booting machvec: dorade
Node 0: start_pfn = 0x40000, low = 0x60000
Zone PFN ranges:
  Normal     262144 ->   393216
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0:   262144 ->   393216
DORADE board initialisation
STx7105 version 4.x
Use BPA2 partitions table for 512MiB DDR2
bpa2: partition 'Player_Buffers' created at 0x4183d000, size 66560 kB (0x04100000 B)
bpa2: partition 'Bigphys_Buffers' created at 0x4c000000, size 65536 kB (0x04000000 B)
bpa2: partition 'gfx-memory-0' created at 0x58000000, size 65536 kB (0x04000000 B)
bpa2: partition 'gfx-memory-1' created at 0x5c000000, size 65536 kB (0x04000000 B)
bpa2: partition 'gfx-memory-2' created at 0x52200000, size 30720 kB (0x01e00000 B)
Built 1 zonelists in Zone order.  Total pages: 130048
Kernel command line: console=ttyAS2,115200 CONSOLE=/dev/ttyAS2 mem=512m coprocessor_mem=4m@0x40000000,4m@0x40400000 sh_mv=dorade
BIOS entry address at 0x00000000
PID hash table entries: 2048 (order: 11, 8192 bytes)
Using tmu for system timer
Using 25.000 MHz high precision timer.
Console: colour dummy device 80x25
console [ttyAS2] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 205056k/524288k available (2421k kernel code, 822k data, 912k init)
PVR=04909200 CVR=60880000 PRR=00009e40
I-cache : n_ways=2 n_sets=512 way_incr=16384
I-cache : entry_mask=0x00003fe0 alias_mask=0x00003000 n_aliases=4
D-cache : n_ways=2 n_sets=512 way_incr=16384
D-cache : entry_mask=0x00003fe0 alias_mask=0x00003000 n_aliases=4
Security Framework v1.0.0 initialized
Capability LSM initialized
Mount-cache hash table entries: 512
CPU: STx7105
NET: Registered protocol family 16

Board SAGEM UNKNOWN PREMIUM detected
Generic PHY: Registered new driver
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
DMA: Registering DMA API.
NET: Registered protocol family 2
Time: SuperH clocksource has been installed.
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 7, 524288 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 65536 bind 65536)
TCP reno registered
squashfs: version 3.3 (2007/10/31) Phillip Lougher
JFS: nTxBlock = 1602, nTxLock = 12823
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
stm_hwrandom stm_hwrandom: STM Random Number Generator ver. 0.1
STMicroelectronics ASC driver initialized
stasc.0: ttyAS0 at MMIO 0xfd031000 (irq = 122) is a stasc
stasc.1: ttyAS1 at MMIO 0xfd032000 (irq = 121) is a stasc
stasc.2: ttyAS2 at MMIO 0xfd033000 (irq = 120) is a stasc
        platform registration... <7>done!
        GMAC - user ID: 0x10, Synopsys ID: 0x33
        eth0 - (dev. name: stmmaceth - id: 0, IRQ #134
        IO base addr: 0xfd110000)
STMMAC MII Bus: probed
eth0: PHY ID 01410c89 at 16 IRQ 0 (0:10)
eth0: PHY ID 01410c89 at 17 IRQ 0 (0:11)
eth0: PHY ID 01410c89 at 18 IRQ 0 (0:12)
eth0: PHY ID 01410c89 at 19 IRQ 0 (0:13)
eth0: PHY ID 01410c89 at 20 IRQ 0 (0:14)
eth0: PHY ID 00000610 at 24 IRQ 246 (0:18) active
eth0: PHY ID 00000610 at 25 IRQ 0 (0:19)
eth0: PHY ID 00000610 at 26 IRQ 0 (0:1a)
eth0: PHY ID 00000610 at 27 IRQ 0 (0:1b)
eth0: PHY ID 00000610 at 28 IRQ 0 (0:1c)
eth0: PHY ID 00000610 at 29 IRQ 0 (0:1d)
Marvell 88E6161: Registered new driver
Marvell 88E6061: Registered new driver
usbcore: registered new interface driver asix
scsi0 : sata_stm
ata1: SATA max UDMA/133 cmd 0xfe209000 ctl 0xfe209820 bmdma 0x00000000 irq 72
ata1: SATA link down (SStatus 0 SControl 300)
NAND device: Manufacturer ID: 0x98, Chip ID: 0xda (Toshiba NAND 256MiB 3,3V 8-bit)
Creating 1 MTD partitions on "stm-nand-afm.1":
0x00000000-0x10000000 : "NAND"
spi_stm_ssc: SSC SPI Driver
stm-ehci stm-ehci.0: st-ehci
stm-ehci stm-ehci.0: new USB bus registered, assigned bus number 1
stm-ehci stm-ehci.0: irq 169, io mem 0xfe1ffe00
stm-ehci stm-ehci.0: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
stm-ohci stm-ohci.0: stm-ohci
stm-ohci stm-ohci.0: new USB bus registered, assigned bus number 2
stm-ohci stm-ohci.0: irq 168, io mem 0xfe1ffc00
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
stm-ehci stm-ehci.1: st-ehci
stm-ehci stm-ehci.1: new USB bus registered, assigned bus number 3
stm-ehci stm-ehci.1: irq 143, io mem 0xfeaffe00
stm-ehci stm-ehci.1: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb3: configuration #1 chosen from 1 choice
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
stm-ohci stm-ohci.1: stm-ohci
stm-ohci stm-ohci.1: new USB bus registered, assigned bus number 4
stm-ohci stm-ohci.1: irq 142, io mem 0xfeaffc00
usb usb4: configuration #1 chosen from 1 choice
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 1 port detected
Initializing USB Mass Storage driver...
usb 3-1: new high speed USB device using stm-ehci and address 2
usb 3-1: configuration #1 chosen from 1 choice
hub 3-1:1.0: USB hub found
hub 3-1:1.0: 4 ports detected
usb 3-1.4: new high speed USB device using stm-ehci and address 3
usb 3-1.4: configuration #1 chosen from 1 choice
scsi1 : SCSI emulation for USB Mass Storage devices
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
input: gpio-keys as /class/input/input0
scsi 1:0:0:0: Direct-Access     Generic  Ultra HS-COMBO   1.98 PQ: 0 ANSI: 0
sd 1:0:0:0: [sda] Attached SCSI removable disk
i2c /dev entries driver
i2c: STM PIO based I2C Driver
i2c_stm_pio: allocated pin (2,2) for scl (0x8142a7f4)
i2c_stm_pio: allocated pin (2,3) for sda (0x8142a810)
i2c_stm_pio: allocated pin (2,5) for scl (0x8142a848)
i2c_stm_pio: allocated pin (2,6) for sda (0x8142a864)
i2c_stm_pio: allocated pin (3,4) for scl (0x8142a940)
i2c_stm_pio: allocated pin (3,5) for sda (0x8142a95c)
i2c_stm_pio: allocated pin (3,6) for scl (0x8142a978)
i2c_stm_pio: allocated pin (3,7) for sda (0x8142a994)
stm-pwm stm-pwm: registers at 0xfd010000, mapped to 0xfd010000
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
Line discipline N_MCU is registering
Driver MCU_SERIAL_1 is registering
MCU service is registering
MCU service drv instance is starting
Registered led device: led:green
Registered led device: led:red
Registered led device: icon:play
Registered led device: icon:pause
Registered led device: icon:fastforward
Registered led device: icon:reverse
Registered led device: icon:lock
Registered led device: icon:Record
Registered led device: icon:clock
Registered led device: icon:power
Registered led device: icon:usb
Registered led device: icon:HDD
Registered led device: icon:HD
Registered led device: icon:euro
Registered led device: icon:notes
Registered led device: icon:TV
Registered led device: icon:mail
Registered led device: icon:mute
RCU service is registering
input: ir_rcu as /class/input/input1
input: rf_rcu as /class/input/input2
VFD service is registering
ledserv_trig_init
ledserv_trig_activate
ledserv_trig_activate
DMA: Registering fdma_dmac.0 handler (16 channels).
platform fdma_dmac.0: SLIM hw 0.0, FDMA fw 2.1
DMA: Registering fdma_dmac.1 handler (16 channels).
platform fdma_dmac.1: SLIM hw 0.0, FDMA fw 2.1
STMicroelectronics - Coprocessors st231 Init
st231.0 Coprocessor -------------------------------------------
    flags 0001 RAM start at 0xc1100000  size      0x00400000
                  cop. addr 0x40000000
    Channels : Not defined
    IRQ      : not used
---------------------------------------------------------------
st231.1 Coprocessor -------------------------------------------
    flags 0001 RAM start at 0xc1580000  size      0x00400000
                  cop. addr 0x40400000
    Channels : Not defined
    IRQ      : not used
---------------------------------------------------------------
stm_rng hardware driver 1.0 configured
Advanced Linux Sound Architecture Driver Version 1.0.14 (Fri Jul 20 09:12:58 2007 UTC).
ALSA device list:
  #0: STMicroelectronics STx7105 cut 4 SOC audio subsystem
Load wynetfilter
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
Freeing unused kernel memor
----  RootFsAppli v3.18 ----

SMCU: device activated
UBI: attaching mtd0 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: attached mtd0 to ubi0
UBI: MTD device name:            "NAND"
UBI: MTD device size:            256 MiB
UBI: number of good PEBs:        2044
UBI: number of bad PEBs:         4
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     4
UBI: available PEBs:             761
UBI: total number of reserved PEBs: 1283
UBI: number of PEBs reserved for bad PEB handling: 20
UBI: max/mean erase counter: 39/22
UBI: background thread "ubi_bgt0d" started, PID 396
BIOS entry address at 0x80800740
st_floyd: module license 'STM' taints kernel.
stm_bios_queue_node: XXX: node 0:8 not complete (ctrl=0x8000001e)
BIOS entry address at 0x80800740
TKDMA firmware version 0x00000093 has been loaded.
stmcore-display: using HDMI hotplug
stmcore-display: STi7105 display: probed
device probe found 2 display pipelines
requesting frm: 'component.fw', c1a2b774/97c95dc0
loading frm: 'component.fw' failed: -2
stmfb: fb0 parameters = "1280x720-32@50:42M:158M:PAL:RGB:RGB:1"
trying to alloc 67108864 bytes (align: 0000, still needed: 165675008) from 'gfx-memory-0' for GFX0 auxmem
success: base: 58000000, still needed: 98566144
trying to alloc 67108864 bytes (align: 0000, still needed: 98566144) from 'gfx-memory-1' for GFX0 auxmem
success: base: 5c000000, still needed: 31457280
trying to alloc 31457280 bytes (align: 0000, still needed: 31457280) from 'gfx-memory-0' for GFX0 auxmem
trying to alloc 31457280 bytes (align: 0000, still needed: 31457280) from 'gfx-memory-1' for GFX0 auxmem
trying to alloc 31457280 bytes (align: 0000, still needed: 31457280) from 'gfx-memory-2' for GFX0 auxmem
success: base: 52200000, still needed: 0
stmfb: fb1 parameters = "<NULL>"
ak4708 2-0011: attaching i2c client
wyaavio: no version for "ak4708_command" found: kernel tainted.
wyaavio char device created with number 243:0
Exp [iRc] < 0, Error=-25 [Inappropriate ioctl for device] in Fct:[standby] File:[src/CScart.cpp] Line:(46)
Mount VolumeId=0602UBIBLK: adding volume 0:2
 ubiblka:, Option unknown partition table
s=0x00000000, WakeupInfo=0x3F02
UBIFS: mounted UBI device 0, volume 3, name "UBI-Volume-03"
UBIFS: file system size:   15364096 bytes (15004 KiB, 14 MiB, 121 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       4 (latest is 4)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  759305 bytes (741 KiB)
UBIFS: un-mount UBI device 0, volume 3
SMCU: device closed down

        Next Generation Init version ( 0.6.10.2 Die bugs die! )
        http://www.initng.org
        Author: Jimmy Wennlund <jimmy.wennlund@gmail.com>
        If you find initng useful, please consider a small donation.

        System is starting up!

      runlevel/default                  [starting]
      system/coredumpme                 [starting]
      system/mountfs                    [starting]
      system/splash                     [starting]
      system/splash/start               [starting]
      system/splash/early               [starting]
      system/initial/mountvirtfs        [starting]
      system/udev/populate              [starting]
      system/udev/udevd                 [starting]
      system/udev/pre-fill              [starting]
      modules/stmfb                     [starting]
      modules/wyaavio                   [starting]
      modules/ak4708                    [starting]
      system/change-lids                [starting]
      system/change-lids/pre-start      [starting]
      system/mountfs/params             [starting]
      system/getty/ttyAS0               [starting]
      system/getty/ttyAS2               [starting]
      modules/ufsd                      [starting]
      modules/wynet                     [starting]
      modules/wynet/pre-start           [starting]
      modules/wypti                     [starting]
      modules/wypti/frontend            [starting]
      modules/engine                    [starting]
      system/initial/lo                 [starting]
      system/switchrunlevel             [starting]
      system/inetd                      [starting]
      modules/wypti-csa                 [starting]
      daemon/wycas                      [starting]
      daemon/dbus                       [starting]
      daemon/dbus/start                 [starting]
      daemon/wycas/pre-start            [starting]
      system/syslogd                    [starting]
      daemon/pygui/ready                [starting]
      daemon/pygui                      [starting]
      daemon/pygui/pre-start            [starting]
      daemon/cpcd                       [starting]
      daemon/cpcd/cpcd-pdb-dbus         [starting]
      daemon/hal                        [starting]
      daemon/hal/start                  [starting]
      daemon/wycrs                      [starting]
      daemon/wycrs/pre-start            [starting]
      daemon/wynetwork                  [starting]
      daemon/wynetwork/pre-start        [starting]
      daemon/wyplayer                   [starting]
      modules/fuse                      [starting]
      daemon/wystorage                  [starting]
      daemon/wyscan                     [starting]
      daemon/wyscan/pre-start           [starting]
      daemon/tuner                      [starting]
      modules/fusion                    [starting]
      system/wyscancleandb              [starting]
      modules/keym                      [starting]
      daemon/standby_crawler            [starting]
      daemon/wyfan                      [starting]
   1% modules/ak4708                    [done]          ( done in 474ms )
   3% modules/fusion                    [done]          ( done in 466ms )
   4% system/initial/mountvirtfs        [done]          ( done in 639ms )
   6% modules/ufsd                      [done]          ( done in 618ms )
  10% system/initial/lo                 [done]          ( done in 360ms )
  12% system/udev/pre-fill              [done]          ( done in 413ms )
  13% system/udev/udevd                 [started]       ( pid: 491 )
  15% system/mountfs/params             [done]          ( done in 1092ms )
  16% system/change-lids/pre-start      [done]          ( done in 1871ms )
  18% modules/stmfb                     [done]          ( done in 1473ms )
  20% system/udev/populate              [done]          ( done in 1562ms )
  24% system/switchrunlevel             [done]          ( done in 71ms )
      runlevel/fullapp                  [starting]
      daemon/samba                      [starting]
      daemon/samba/pre-start            [starting]
      daemon/polipo                     [starting]
      daemon/polipo/pre-start           [starting]
      daemon/gsad                       [starting]
      system/sfringest                  [starting]
      system/sfringest/boot             [starting]
      system/sfringest/pre-start        [starting]
      system/diag                       [starting]
      daemon/wyupnp                     [starting]
      system/ntpd                       [starting]
      system/setup                      [starting]
      system/ntpdate                    [starting]
      daemon/settingsd                  [starting]
      system/standby                    [starting]
      system/standby/early              [starting]
      system/setupwatch/write           [starting]
      system/setupwatch/delete          [starting]
      daemon/srsd                       [starting]
      daemon/npvr                       [starting]
      daemon/istream                    [starting]
      daemon/wyupnp/start-dms           [starting]
      daemon/crond                      [starting]
      daemon/crond/pre-start            [starting]
      system/smartd                     [starting]
      modules/god                       [starting]
      daemon/upnp-sfr                   [starting]
      daemon/mysniffer                  [starting]
      daemon/collector                  [starting]
      daemon/supervisor                 [starting]
      daemon/audience                   [starting]
      daemon/liberror-dbus-signals      [starting]
  18% system/change-lids                [done]          ( done in 451ms )
  18% modules/keym                      [done]          ( done in 325ms )
      runlevel/default                  [stopped]       ( stopped in 3007ms )
  19% modules/wyaavio                   [done]          ( done in 218ms )
  20% system/standby/early              [done]          ( done in 522ms )
  21% system/splash/early               [done]          ( done in 10348ms )
  22% system/splash/start               [started]       ( pid: 812 )
  23% system/splash                     [done]          ( done in 71812ms )
  24% system/mountfs                    [done]          ( done in 303ms )

Fusion version 15.1.5 (The long journey)
NEUFTVSTB_MA_53F8 login:   29% system/ge[started]0      ( pid: 952 )
  29% system/getty/ttyAS2               [started]       ( pid: 955 )
  29% system/inetd                      [started]       ( pid: 957 )
  30% system/smartd                     [started]       ( pid: 972 )
  35% system/coredumpme                 [done]          ( done in 595ms )
  35% daemon/wycrs/pre-start            [done]          ( done in 365ms )
  35% daemon/wynetwork/pre-start        [done]          ( done in 329ms )
  36% daemon/crond/pre-start            [done]          ( done in 315ms )
  37% modules/fuse                      [done]          ( done in 644ms )
  38% system/wyscancleandb              [done]          ( done in 733ms )
 01:01:30 -- WARN:      daemon daemon/dbus/start has been killed!, executing DAEMON_CLEAN!
  39% daemon/dbus/start                 [started]       ( pid: 994 )
  41% daemon/pygui/pre-start            [done]          ( done in 1175ms )
  41% daemon/dbus                       [done]          ( done in 224ms )
  46% daemon/cpcd/cpcd-pdb-dbus         [started]       ( pid: 1007 )
  46% daemon/wynetwork                  [started]       ( pid: 1009 )
  46% daemon/srsd                       [started]       ( pid: 1010 )
  46% daemon/npvr                       [started]       ( pid: 1011 )
  46% daemon/liberror-dbus-signals      [started]       ( pid: 1012 )
  50% daemon/wycas/pre-start            [done]          ( done in 1522ms )
  50% daemon/cpcd                       [started]       ( pid: 1013 )
  50% daemon/wycrs                      [started]       ( pid: 1014 )
  51% daemon/settingsd                  [started]       ( pid: 1016 )
      system/syslogd/ram                [starting]
  52% system/syslogd/ram                [started]       ( pid: 1022 )
  52% daemon/hal/start                  [started]       ( pid: 1017 )
  53% system/syslogd                    [done]          ( done in 1679ms )
  54% daemon/hal                        [done]          ( done in 7484ms )
  56% daemon/wystorage                  [started]       ( pid: 1152 )
  57% modules/engine                    [done]          ( done in 11733ms )
  58% daemon/wyplayer                   [started]       ( pid: 1288 )
  59% modules/wypti/frontend            [done]          ( done in 352ms )
  60% modules/wypti-csa                 [done]          ( done in 357ms )
  63% modules/wypti                     [done]          ( done in 1724ms )
  64% daemon/standby_crawler            [started]       ( pid: 1393 )
  65% modules/wynet/pre-start           [done]          ( done in 904ms )
  66% modules/wynet                     [done]          ( done in 923ms )
  67% daemon/wyscan/pre-start           [done]          ( done in 2593ms )
  69% daemon/wyscan                     [started]       ( pid: 1430 )
  69% daemon/tuner                      [started]       ( pid: 1431 )
      system/ntpdate/get-date           [starting]
  69% system/ntpdate/get-date           [done]          ( done in 8131ms )
      system/ntpdate/check-date         [starting]
  69% system/ntpdate/check-date         [started]       ( pid: 1456 )
      daemon/wycas/check-date           [starting]
  69% daemon/wycas/check-date           [started]       ( pid: 1465 )
      daemon/wyupnp/check-date          [starting]
  70% daemon/wyupnp/check-date          [started]       ( pid: 1469 )
  71% system/ntpdate                    [done]          ( done in 8612ms )
  74% daemon/wycas                      [started]       ( pid: 1472 )
  74% daemon/wyupnp                     [started]       ( pid: 1473 )
  74% daemon/upnp-sfr                   [started]       ( pid: 1474 )
  75% system/setup                      [done]          ( done in 2401ms )
  75% daemon/pygui                      [done]          ( done in 111ms )
  76% system/standby                    [started]       ( pid: 1518 )
  77% daemon/pygui/ready                [done]          ( done in 118ms )
  89% modules/god                       [done]          ( done in 8343ms )
  89% daemon/wyfan                      [started]       ( pid: 1617 )
  89% daemon/gsad                       [started]       ( pid: 1619 )
  89% system/ntpd                       [started]       ( pid: 1624 )
  89% system/setupwatch/write           [started]       ( pid: 1625 )
  89% system/setupwatch/delete          [started]       ( pid: 1628 )
  89% daemon/istream                    [started]       ( pid: 1631 )
  89% daemon/crond                      [started]       ( pid: 1634 )
  89% daemon/mysniffer                  [started]       ( pid: 1636 )
  89% daemon/collector                  [started]       ( pid: 1638 )
  89% daemon/supervisor                 [started]       ( pid: 1640 )
  89% daemon/audience                   [started]       ( pid: 1644 )
  92% system/sfringest/pre-start        [done]          ( done in 11527ms )
  92% daemon/wyupnp/start-dms           [done]          ( done in 11231ms )
  93% system/sfringest/boot             [done]          ( done in 4329ms )

Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#38 19/08/2016 13:01:43

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

ah intéressant. On à un accès CLI de disponible sur le boitier :

Code:

Fusion version 15.1.5 (The long journey)
NEUFTVSTB_MA_53F8 login:

Bon encore faut t'il connaitre les identifiants ^^
Non connus chez SFR apparamment

Dernière modification par FHO Corp (11/10/2016 19:19:24)


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#39 11/10/2016 19:18:32

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Code:

UBIFS: mounted UBI device 0, volume 3, name "UBI-Volume-03"

Code:

Creating 3 MTD partitions on "physmap-flash":
0x00000000-0x00040000 : "Stage1"
0x00040000-0x00280000 : "Bsl-1"
0x00280000-0x00800000 : "Bsl-2"

Code:

--- STB Content List ---
  StbId=2495043053f8,   SerialNumber=PS3C042100212000062
  ContentId=0x46500301, ContentType=FRT-PNL, ContentVersion=0.0.21,
  ContentId=0x2042736C, ContentType=BSL, ContentVersion=1.4.32, VolumeId=0101 *
  ContentId=0x2042736C, ContentType=BSL, ContentVersion=1.4.32, VolumeId=0102
  ContentId=0x4170706C, ContentType=APPLI, ContentVersion=13.2.23, VolumeId=0601
  ContentId=0x4170706C, ContentType=APPLI, ContentVersion=15.1.5, VolumeId=0602

Bon c'est clair que cela ressemble à du UBIFS compressé... sad

Code:

UBIFS: un-mount UBI device 0, volume 3
Check Signature of Application Id=0x4170706C Version=15.1.5 in Volume 0602

Et crypté en prime... ;(

Code:

0706C Version=15.1.5 in Volume 0602
Starting new kernel
kexec information
  segment[0]: 0x81000000 - 0x81435000 (0x00435000)
  start     : 0x81002000

image->start:       0x81002000
Linux version 2.6.23.17_stm23_0125dorade00 (root@builder)

Enfin c'est un bon vieux linux derrière. wink

Cela ressemble un peu au FS de la NB6VAC de efixo...


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#40 11/10/2016 19:25:57

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Code:

UBIFS: mounted UBI device 0, volume 3, name "UBI-Volume-03"
UBIFS: file system size:   15364096 bytes (15004 KiB, 14 MiB, 121 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       4 (latest is 4)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  759305 bytes (741 KiB)

et ben voila !!

La partition de donnée semble être du UBIFS avec une compression LZO !

@SGDA, @VincentAlex et Cie, vous avez une idée de comment l'extraire ?


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#41 11/10/2016 22:22:23

VincentAlex
Modérateur
Lieu: Massy (91)
Date d'inscription: 01/10/2007
Messages: 3030

Re: SFR TV Evolution Sagem

As tu essayer de monter l'image UBIFS ?

http://www.linux-mtd.infradead.org/faq/ … fs_extract


Environnement de développement : MacOsX/Fedora 12
Dépôt dropbox

Hors ligne

 

#42 12/10/2016 11:45:21

SGDA
Pachyderme
Lieu: 95170
Date d'inscription: 28/08/2007
Messages: 8460

Re: SFR TV Evolution Sagem


XP Pro/Fedora 19 (Schrödinger's cat)

Hors ligne

 

#43 13/10/2016 21:44:30

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Déjà ça s'annonce mal....

Code:

/Bureau/STB# ubireader_display_info APPLI-15.1.6.img_extract 
guess_start_offset Fatal: Could not determine start offset.

Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#44 17/10/2016 18:41:34

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

up . Des idée sur comment avancer ?


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#45 14/11/2016 20:25:35

hugopoi
Moddeur newbie
Date d'inscription: 27/08/2015
Messages: 6

Re: SFR TV Evolution Sagem

@FHOCorp GG! pour la connexion à la console de debug.

Si je comprend bien maintenant il faut le mot de passe root de la console.

Sinon j'ai une autre piste que j'avais déjà évoqué qui était d'exploiter plusieurs failles pour faire une escalade de privilège, en sachant que c'est kernel 2.6 il y a moyen 2-3 failles dispo pour faire un root shell reste à trouver un service vulnérable.

Hors ligne

 

#46 19/11/2016 21:00:20

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

Jusqu’à présent, je n'ai pas trouvé de faille particulière lors du démarrage du boitier.

J'ai juste trouvé comment forcer le bypass du setup mais cela fonctionne uniquement quand le boitier dispose de droits TV non expirés et la methode est assez bourin lol

Sinon faudrait faire du reverse engineering du firmware mais à ce que j'ai pu voir, lors d'une MAJ, le BSL (Bootloader SFR) vérifie la signature du firmware envoyé. sad

C'est pas gagné.... sad
Pourtant ce boitier, si un jour on peut l'exploiter, peut donner pas mal de possibilités intéressantes wink


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#47 30/05/2017 14:32:03

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

NOTE: Si le boitier dispose de droits TV non expirés et qu'il n'arrive pas à joindre la PFS de SFR (rpc.stb.sfr.fr) il by-pass la vérification des droits et on arrive sur l’écran d’accueil. wink


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#48 26/10/2018 13:26:56

ph0be
Moddeur newbie
Date d'inscription: 23/10/2017
Messages: 4

Re: SFR TV Evolution Sagem

Hello, j'ai un décodeur STB7 et j'aimerais savoir si en bidouillant un peu via le réseau il y aurait moyen de réactiver le navigateur internet (ce qui pourrait être intéressant car possibilité d'exploiter via des failles WebKit existantes) et les applications YouTube et Dailymotion, car elles étaient présentes sur les anciennes versions du firmware, j'ai même appelé le service technique à ce sujet mais à part me dire que les "ingénieurs" ont décidé de désactiver ces fonctionnalités je n'ai pas eu plus d'informations...

Hors ligne

 

#49 26/10/2018 13:28:51

FHO Corp
Modérateur et bricoleur barbare !
Lieu: Lyon (69)
Date d'inscription: 22/02/2012
Messages: 761
Site web

Re: SFR TV Evolution Sagem

@ph0be  C'est le noir de chez numéricable ?  Contacte moi en MP si besoin wink


Neufbox 4 R3.3.13-RT (ADSL2+ chez Rural Telecom)
Neufbox 6 R3.3.13-RT (Full Routed @ Rural Telecom)
Neufbox 6V R3.3.9-RT (Full Routed @ Rural Telecom)
Dépot Nextcloud Dépot SFR Me on lafibre.info Livebox 2.1 en FTTH sur DSLAM/BAS Personnel

Hors ligne

 

#50 26/10/2018 15:33:48

ph0be
Moddeur newbie
Date d'inscription: 23/10/2017
Messages: 4

Re: SFR TV Evolution Sagem

"

".str_replace(array('[', '\"'), array('[', '"'), '$matches[2]')." ".$lang_common['wrote'].":

"@ph0be  C'est le noir de chez numéricable ?  Contacte moi en MP si besoin wink

C'est celui-ci https://lafibre.info/sfr-les-news/nouveau-decodeur-stb7 mais j'ai un abonnement SFR et non Numéricable ce qui d'ailleurs expliquerait pourquoi je n'ai pas le navigateur et les applications, le firmware est peut-être différent.


C'est suite à cette image que je me suis posé la question:

handle_img_tag('$matches[1]$matches[3]')


L'interface SFR:

handle_img_tag('$matches[1]$matches[3]')


Ce que j'ai actuellement, avec comme seule application Netflix (coupée en bas de l'image) et pour ce qui est du dessus ça reste la même chose que l'image précédente:

handle_img_tag('$matches[1]$matches[3]')


D'ailleurs le disque dur fourni avec le décodeur est une vaste blague, il possède une capacité de 500Gb mais seulement 40 sont utilisables pour les enregistrements, je crois que l'on peut monter jusqu'à 120 ou 160 gratuitement sur demande mais pour profiter pleinement de sa capacité il faut payer un "débridage"...

La partition de 40Gb est au format ext4, j'ai essayé de l'agrandir mais le décodeur détecte la modification et affiche comme quoi la partition dépasse la capacité autorisée et remet en place une partition de 40Gb.

Reste à voir s'il y a moyen de bidouiller la configuration du décodeur lorsqu'elle est envoyée sur le réseau afin de contourner cette limite.

Dernière modification par ph0be (26/10/2018 15:45:22)

Hors ligne

 

Pied de page des forums