dcx3200p2 decompressed file system

[merkin]

https://code.google.com/p/binwalk/ found a valid squashfs filesytem


Use hex editor to and remove 15727041 bytes starting at 0x661E6B.

Use squashfs tools to decompress and here is the result...
http://speedy.sh/XkcfT/dcx3200p2-fs.zip

If you really wanna get your panties wet you can download HexRaysIDA and disassemble the compiled mips binaries. (CVC )


But this is only filesystem, of course firmware also includes bootloader and linux kernel.

The scripts and the private oid mibs is also interesting.

[JoeGreen]

I know this is like one year old but any chance you could re-post the squashfs filesystem? I could really use that for a project I am working on.

Thanks!

[merkin]

cant believe its been a year already.

here ya go.. http://speedy.sh/TFgVG/dcx3200p2-fs-ocap.zip

mind sharing some details about your project?

[JoeGreen]

This filesystem has some default settings in motocap/bin/features folder.

ocps.properties is for Shaw customers
ocpt.properties is for Time Warner
ocpx.properties is for COX customers

If you could change a setting in there, it would be "hideEsataRecordingDisks".. set to false to enable the external eSata port.

Any chance you can gain shell access to a running box to make some changes?

[JoeGreen]

Enabling the Ethernet and USB ports:

# To enable ethernet:
/opt/ucentric/bin/ctrl_security eth enable

# To enable usb:
/opt/ucentric/bin/ctrl_security usb enable

---
To read or write settings to a running box, use the stbtools prog. It is in ucentric/bin
It can make a backup of the flash, the certificates, etc.

[merkin]

pretty cool, eh?

i feel like i was able to get some sort of crippled shell prompt when using a ttl>rs232 adapter with the serial port on the rear of the box, hard to recall the exact details.
it required a certain key combination to be pressed on the remote control as well.

its nice to see someone on here not just looking for a free lunch and willing to learn something new.

i usually post all my info on the forum, so it may already be here somwhere, but ill update this thread when my memory comes back..

[Team Windowpane]

suppose i can use to increase capacity on a DVR ?

[JoeGreen]

This is the OCAP (tru2way) version of the DCX box. Very cool. I have another box (not a Moto) that I have root shell access... The box has the same Broadcom chip and uses a cablecard.

The plan is to place the OCAP files onto this other box. Of course some adjustment of settings is planned... Turn on USB, eSata, and ethernet.

Ethernet is useful when cablecard is in DSG mode or if you simply want the box to work as a mediahub and/or have apps like netflix on it.

Not sure how quick results will be available but I will put some updates here soon.

The intent is to get DVR features for no additional monthly cost (the way it should be). Moca is there, may explore that if ethernet port becomes difficult.

[Wolfgang]

... i feel like i was able to get some sort of crippled shell prompt when using a ttl>rs232 adapter with the serial port on the rear of the box, hard to recall the exact details.it required a certain key combination to be pressed on the remote control as well....

Press several times Info button while applying the power cord and you will be taken to the boot Menu. When the customer code (Comcast) is loaded the menu is just a substitute for the missing buttons on the front panel, nothing else. In order to start downloading a fresh Platform code choose #3 (this is equal to diag option) then from the next menu choose #5 which is equal to OOB option. If an image file is available the firmware will start downloading via the RF port. There are a few more options in those two menus not very useful though. Unfortunately, I am not aware of a way of downloading or uploading of the firmware via the serial cable.
Also, applying the following sequence via remote after applying the power will reset the box to factory settings: Volume Down, 3-2-8

[JoeGreen]

Things just got a little more interesting!

Check out this link (about a bug in bash shell)

http://www.troyhunt.com/2014/09/everyth ... t.html?m=1

This should work if you have moca on a box and can see the box using IP.

This bug has the potential to be real bad.

[MrRogers]

Very nice work. I was able to use this to activate the external USB port as a secondary storage device. Hooked up a 3TB HDD and it actually formatted it as well using the GPFS that is coded on to the box, it unlocked the external capabilities that are normally locked down by the ISP, very very nice work, congrats on finding the coding to enable it. It must have taken you some time

@JoeGreen - it also works on non MoCA units as well (my MoCA is disabled) on the boxes I have, and activated on one. I tested it on a few of my boxes, DCX3501 being the first, then the DCX3200. The coding provided gave me a baseline as far as where to look and what to change to enable it, and amazingly enough there is no watchdog to change the settings back when you unplug the unit, so even if power is lost to the unit the memory saves the settings, this could be a very good start to something awesome if you guys follow me

Right now I am sectioning myself off to FTA coding but it's no where near as exciting as this is

@ merkin - why did you share that info bud, that info is potentially game changing for us you know that right (I am sure your motives are pure to share the knowledge), but seriously? I really wish these forums had a private section for people experienced in actual coding as stated and not just the free riders. I am glad that your active and always seem to be working on something, have you ever given any thought to FTA and setting up a private IKS server? Honestly, there is alot more room in that aspect of things and more doors are already opened to use the FTA units as a playground to work on. And there's alot more money involved than just reversing the USB and outer ports on company units..