Gigaset elements starter kit Informs you about the comings and goings at your home, no matter where you are Alerts you immediately in case of an intrusion and allows. User manual for the device Siemens Gigaset SX541 WLAN dsl. Online user manual database. View and Download Siemens Gigaset SX541 WLAN dsl brochure online. Siemens Network Router Brochure. Gigaset SX541 WLAN dsl Network Router pdf manual download.
Siemens Gigaset SX5. Wlan DSL (manual, user guide, review, opinions)Products Reviews Underground. User Manual Download. Manual. Document type: user manual, user guide.
File type: PDFSiemens Gigaset SX5. Wlan DSLRating: 7. Manufacturer: Siemens. Category: Computers > Firewalls & Broadband Routers. Popularity trends. Review, opinions.
Siemens Gigaset SX541. The device is based on Texas Instrument AR7, so you need the target.ar7 in OpenWrt trunk. In addition, patches which support the BRN bootloader. VoIP box: Siemens Gigaset SX541 Firmware 1.63 PBX: Asterisk 1.2.0-rc2 (PSTN-Gateways mit BRI und PRI) Hardphones:: Grandstream BT 100, Cisco 7940, giptel. Gigaset SX541 WLAN dsl / englisch / A31008-M1025-L10 1-1-7619 / cover_front.fm / 21.07.2005. Manual. Document type: user manual, user guide File type: PDF. Download. Gigaset Read more about wireless, support, voip, interface, analog and networking.
Hacking the Siemens SX5. After extensive investigation I now have a good picture of the hard- and software. Together with some special bootloader features we will now be able to hack the SX5. Hardware. The microcontroller is a Texas Instruments AR7. MIPS). Product info can be found here: TI AR7.
This cpu is used in many other networking products such as: Netgear. DG8. 34. G, Dlink Dsl. G6. 04t and .. the AVM FRITZ! Box Fon. The codecs are implemented in hardware, the SX5. Voicepump VP1. 40 DSP. If proper programmed the codec quality should be very good.
Unfortunately the programming skills of Siemens' Taiwanese ODM partner leave a large space for improvement The rest of the hardware is described by Birger: 2. MB flash (Fritz! box uses 4. MB), 3. 2MB ram, etc. Software. Unfortunately there is no Linux running on the SX5. The OS is a RTOS called Supertask! Micro Digital Inc.
The TCPIP stack, Router and Vo. IP software is developed by the Institute for Information Industry in Taiwan and is called III TTF TCPIP Protocol Stack (for Router).
The bootloader is developed by Broad Net Inc. Taiwan. The bootloader can be accessed via the serial console as I described here. For your convenience I will copy the content of that post below.
But first the most important discovery I made which will help us running our own code on the SX5. The administrator menu shows: ====================== [U] Upload to Flash [E] Erase Flash [G] Run Runtime Code [M] Upload to Memory [R] Read from Memory [W] Write to Memory [T] Memory Test [Y] Go to Memory [A] Set MAC Address [#] Set Serial Number [V] Set Board Version [H] Set Options [P] Print Boot Params ====================== The additional menuitems are: [M] Upload to Memory [R] Read from Memory [W] Write to Memory [T] Memory Test [Y] Go to Memory With 'M', by using Tftp or Xmodem, code can be uploaded to RAM and then be executed. Execution can also be initiated with 'Y'.
There seem to be a few conditions which need to be fulfilled by the binary code. I haven't found these out yet, but using the 'R' command I managed to read the bootloader code which I will further analyze in IDA. Okay enough for now, below you find a copy of the info I posted earlier about serial console and telnet access. Have fun and let's get a linux kernel running on the sx. Jocky. W===================================as I wrote before, simply telnet into the sx. You don't need a serial cable for that.
Generic system parameter configurationinterface Interface parameter configurationw. LAN Wireless LAN configurationbridge Transparent bridging parameter configurationvc ATM virtual circuit parameter configurationppp PPP parameter configurationdial Dial- out parameter configurationip_share NAT parameter configurationfirewall- func Enable disable firewall functionsaccess- list Access list rules managerinspect Inspection threshold and rules managerroute Routing parameter configurationdhcp DHCP parameter configurationdns DNS proxy parameter configurationsnmp SNMP parameter congurationtftp Default TFTP paramng parameter configurationmail Mail parameter cont parameter configurationchuser Configuration paraigurationupnp Enable or disable configurationshow Showing system conigurationmonitor Monitor system runewall functionsupgrade Upgrade system firmanagerbackup Backup system confld and rules managerpasswd Change user passwoconfigurationdefault_reset Reset system configuration to default statuswrite Write configuration and restart systemreboot Restart system and activate new system configurationenable Enable configuration modesu Change to super user(root) modeping Ping testtracert Trace route utilityexit Disable privilege command or disconnect. The submenu "chuser" has these items: > > max_user Maximum allow telnet access user numbertelnet_port Telnet TCP port config (default 8.
Legal user profileaddress_control Legal client addresslogin_timeout Login timeout (minutes)remote_login Remote management function disable or enable=======If you connect a Siemens datacable (I bought one at CONRAD for ยค1. SIEMENS 2. 5- /3. Best.- Nr.: 7. 60. SX5. 41 you can in addition trace the bootlog, enter the bootmonitor for recovery, set debugmode, and telnet via serial cable. Strip the gsm phoneplug off, you see 3 wires: black, blue & white.
Open the sx. 54. 1 and look at the at the pin header from the top.- -5- -- 4- -- 3- -- 2- -- 1+- -- +- -- +- -- +- -- +- -- +| o | o | o | o | o |+ + + + + +| o | o | o | o | o |+- -- +- -- +- -- +- -- +- -- +- 1. Connect the 3 wires as follows: 3: TX : blue. RX : white. 5: GND : black. Connect the 9- pin d- sub to the serial port of your PC. Open hyperterminal and set to 1. N- 1- No flow control.
If you switch on the SX5. TI ADSL AR7. 30. 0 Loader 0. Sep 1. 5 2. 00. 4 1. Broad Net Technology, INC. Flash not found Copying boot params... DONE Press any key to enter command mode ..
Flash Checking Passed. Unzipping web at 0x.
Unzipping code at 0x. In C_Entry() function .. Set GPIO Reset USB and VP1.
C3. 00 ##### end = 0x. C ##### Backup Data from 0x. C~0x. 95. 4CF6. 5C len 3. INIT] System Log Pool startup .. INIT] MTinitialize . Runtime code version: 1.
System startup.. [INIT] Memory COLOR 0, 1. INIT] Memory COLOR 1, 6. INIT] Memory COLOR 2, 1. A chip_id=2. 24. 9 ES2. LV1. 60. D bottom boot 1. Set flash memory layout to Boot Parameters found !!!
Bootcode version: 0. Serial number: A4. Hardware version: 0. III_Config_t) is 8. A chip_id=2. 24. 9 ES2.
LV1. 60. D bottom boot 1. Invalid wireless channel range 0 ~ 0 !!! Use default value 1 ~ 1. Buffer. Init: BUF_HDR_SZ=4.
BUF_ALIGN_SZ=8 BUFFER_OFFSET=1. BUF_BUFSZ0=3. 84 BUF_BUFSZ1=1. NUM_OF_B0=0 NUM_OF_B1=1.
BUF_POOL0_SZ=0 BUF_POOL1_SZ=2. BUFFER0)=4. 32,sizeof(BUFFER1)=1. BUF0=0x. 94c. 75.
BUF1=0x. 94a. 42. Altgn *BUF0=0x. 94c. BUF1=0x. 94a. 42. End at BUF0: 0x. 94c. BUF1: 0x. 94c. 75. BUF0[0]=0x. 94c. 75.
BUF1[0]=0x. 94a. 42. OK! buffer.
OK! [qm_lnk_init] CLOCKHZ=1. CLOCKHZ=1. 00. 0 time = 0. TRAP(link. Up) : send ok! Interface 0 ip = 1. MAC Address: 0. 0: 0.
Memory request 2. F0. 74 Call tn. B4. 43. F0. 74 size: 2. MAC1 [RX=1. 28 TX=1]: TI External PHY time = 0. TRAP(link. Up) : send ok!
Interface 1 ip = 1. Check()> Group: 0, Error: Useless rule index will be truncated rule.
Check()> Group: 1, Error: Useless rule index will be truncated rule. Check()> Group: 2, Error: Useless rule index will be truncated CBAC rule format check succeed !!
CBACBuf()> init match pool, Have: 1. Memory Address: 0x. CBACBuf()> init time.
Gap pool, Have: 1. Memory Address: 0x. CBACBuf()> init same. Host pool, Have: 2. Memory Address: 0x.
CBAC rule pool initialized !! Clsfy] clsfy_local_if_mask=0xf. Clsfy] clsfy_localor. VPN_if_mask=0xf. 00. Init NAT data structure RUNTASK id=2 if_task if.
RUNTASK id=3 if_task if. RUNTASK id=4 timer_task.. RUNTASK id=5 conn_mgr.. RUNTASK id=6 main_8. RUNTASK id=7 Usb. Sys. Init. Task ..
RUNTASK id=8 period_task..========== ADSL Modem initialization OK ! RUNTASK id=9 telnetd_main.. Unzipping from B0. EF0. 00. 0 .. done. Uncompressed size = 9.
HTTPD] flash_init: failed!! HTTPD TIMER_RESOURCE: 5, FS_RESOURCE: 6. RUNTASK httpd.. RUNTASK id=1. RUNTASK id=1. 3 snmp_task.. RUNTASK id=1. 4 rip.. RUNTASK id=1. 5 ripout..
UPn. P is enabled. UPNP Device initialize success! Starting Multitask..- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -You can now press: shift- 0: to enable debugshift- 9: to enable configshift- 8: to start telnet console. ENTER : show this help. Looking at this bootlog I'd say it is some kind of RTOS, but not a Linux kernel If you press any key directly after switching on the sx. U] Upload to Flash[E] Erase Flash[G] Run Runtime Code[A] Set MAC Address[#] Set Serial Number[V] Set Board Version[H] Set Options[P] Print Boot Params======================[AR7. Boot]MAC address : 0.
E3- xx- xx- xx Serial number : A4xxxxxxxxx Hardware version: 0. Options : 0. 0- 0. AR7. 30. 0 Boot]: g Unzipping web at 0x. Unzipping code at 0x. In C_Entry() function .. Set GPIO Reset USB and VP1. I think it should now be possible to get the Vo.
IP stuff working if the sx.