DG934G Source Code

[James67]

I wonder if there is some brave soul out there with a new (black) Netgear router that they can afford to trash (for example, if they've got two routers). I've modified the standard Sky firmware so that (hopefully) it has the telnet daemon enabled. The problem is that I don't have one of the new Netgear routers, so this firmware is completely untested. It may not work. It may render your router irreparably damaged. Please, please, please don't attempt to load it unless you can afford to run the (hopefully small) risk of it trashing your router.

Anyway, here's the modified image: DG934G-1SKUKS_V2.02.34-telnet.img

It should be possible to use the router update page on the router to load this new firmware. In fact, if that doesn't work, DON'T try and force it on the router (by, for example, using the Netgear Recovery Utility).

Once the update is complete and the router has rebooted, it should appear to be exactly as it was before, except that you can now telnet into the router. It should then be possible to extract the connection username and password by doing the following:

1. Telnet to the router
2. Type ps
3. Look through the output of the ps command and find the process ID (PID) of the /usr/sbin/pppd process. The PID is the first number of each line of output.
4. Change directory to that process's entry in the /proc directory. So, for example, if /usr/sbin/pppd has a PID of 749, then cd to the /proc/749 directory.
5. Type cat cmdline
6. The output will be a bit garbled because it doesn't have spaces, but the username should be visible between the words username and password, and the password should be there between the words password and mru.

And once again, this procedure is completely untested and it may render your router useless. Do NOT do it unless you know what you're doing and are not dependent on the router. You HAVE been WARNED!


SkyUser make this information available in the interests of our members. Please do not upgrade your FW unless you fully understand the risks that it could go wrong and render your router useless. Please remember also, that it is against the Terms and Conditions of Sky Broadband. You also run a high risk of having your Broadband Connection suspended as well as receiving no Technical Support.

[richone54]

James, why do you not turn off your router and phone sky saying your router has blown up, you may get the netgear as a replacement ?

(i do understand as a honest gentlemen you may not want to do something as sneaky as this, and would not like to suggest anyone does do this )

[routernoob]

It works, the V2 Netgear was succesfully flashed using your method. And is now connected to Sky BB

BusyBox v0.61.pre (2007.04.27-14:16+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ps
PID Uid VmSize Stat Command
1 root 1256 S init
2 root S [keventd]
3 root S [ksoftirqd_CPU0]
4 root S [kswapd]
5 root S [bdflush]
6 root S [kupdated]
7 root S [mtdblockd]
45 root 620 S /sbin/klogd
46 root 620 S /usr/sbin/utelnetd -d -l /bin/ash
74 root 684 S /usr/sbin/mini_httpd -d /www -r BSkyB DG934G -c **c
76 root 652 S /usr/sbin/udhcpd /etc/udhcpd.conf
78 root 616 S /usr/sbin/netgear_ntp -z GMT+0
125 root 1152 S wpa_auth
132 root 624 S /usr/sbin/crond
134 root 644 S /sbin/syslogd -f /etc/syslog.conf
135 root 620 S /usr/sbin/scfgmgr
139 root 604 S /usr/sbin/cmd_agent_ap
140 root 604 S /usr/sbin/pb_ap
142 root 604 S /usr/sbin/los
163 root 1256 S init
274 root 2348 S SERCOMM
302 root 1156 S dnrd -a 192.168.0.1 -m hosts -c off --timeout=0 -b -
327 root 2132 S /usr/sbin/upnpd
330 root 2132 S /usr/sbin/upnpd
333 root 2132 S /usr/sbin/upnpd
335 root 2132 S /usr/sbin/upnpd
336 root 2132 S /usr/sbin/upnpd
340 root 2132 S /usr/sbin/upnpd
506 root 636 S IGMPProxy -v -n ppp0
512 root 220 S /usr/sbin/provisioning_ap h
567 root 1260 S /bin/ash
568 root 1256 R ps
#
#

[James67]

Dammit! They've hacked the code so that it replaces the pppd command line with the string SERCOMM.

                // Ethan hack it for SKY for hiding pppoa password 2006/10/20
                if (strstr(buffer,"pppd"))
                {
                        strncpy(buffer,"SERCOMM\0",8);
                        res=8;
                }

They're not making this easy, are they.

[HSNetwork]

Well,

I am already drawing up a tutorial on how to flash the router with this modified firmware. If you were to find a way to extract the username and password then this would be ideal as I could build this into the tutorial.

Might need a replacement netgear though

[NewsreadeR]

Originally Posted by The_Local_Ned

I dont want to step on anyones toes here guys , but maybe asking the help of someone from this site...

Routertech

....could get us the answers we need , these guys produce their own firmwares for ar7 based routers using GPL. They might know some way to help us analyse the sky branded routers firmware structure.

Just an idea ?

Invite them over

[James67]

Right I think I've got it now. I've updated the modified image so that the pppd program is now referred to as PPPd (it's a symbolic link to the pppd file). This should get around the piece of code that makes the pppd command line invisible, thus enabling you to see the username and password.

In the output of the ps program, there should be an line with /usr/sbin/PPPd (instead of SERCOMM).

[routernoob]

This is after the second FW

BusyBox v0.61.pre (2007.04.27-14:16+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

# ps
PID Uid VmSize Stat Command
1 root 1256 S init
2 root S [keventd]
3 root R [ksoftirqd_CPU0]
4 root S [kswapd]
5 root S [bdflush]
6 root S [kupdated]
7 root S [mtdblockd]
45 root 620 S /sbin/klogd
46 root 620 S /usr/sbin/utelnetd -d -l /bin/ash
74 root 684 S /usr/sbin/mini_httpd -d /www -r BSkyB DG934G -c **c
76 root 652 S /usr/sbin/udhcpd /etc/udhcpd.conf
78 root 616 S /usr/sbin/netgear_ntp -z GMT+0
125 root 1152 S wpa_auth
132 root 624 S /usr/sbin/crond
134 root 644 S /sbin/syslogd -f /etc/syslog.conf
135 root 620 S /usr/sbin/scfgmgr
139 root 604 S /usr/sbin/cmd_agent_ap
140 root 604 S /usr/sbin/pb_ap
142 root 604 S /usr/sbin/los
163 root 1256 S init
192 root 2348 S /usr/sbin/PPPd plugin pppoa 0.38 user removed@s
214 root 1156 S dnrd -a 192.168.0.1 -m hosts -c off --timeout=0 -b -
236 root 2124 S /usr/sbin/upnpd
241 root 2124 S /usr/sbin/upnpd
242 root 2124 S /usr/sbin/upnpd
247 root 2124 S /usr/sbin/upnpd
248 root 2124 S /usr/sbin/upnpd
252 root 2124 S /usr/sbin/upnpd
407 root 636 S IGMPProxy -v -n ppp0
413 root 216 S /usr/sbin/provisioning_ap h
417 root 1260 S /bin/ash
422 root 1256 R ps
#
#

[James67]

Jeez how many layers of protection does this thing have?

Don't worry though, I've still got some more ideas.

[HSNetwork]

Tutorial on its way to make it easy to follow

With a huge great thanks to James67