FACTORY MODE!
Factory mode, when enabled, gives you access via snmp to the factory
mib.
the factory mib is a list of oid's, each oid having a uniq function.
Here is a very small list of things you can do remote via snmp when in
factory mode,
*get/set the hfc, ethernet and usb mac addresses.
*get/set the modem serial number.
*get/set the modem certs (cm,vendor, and secure code).
*ping ip addreses.
*execute shell commands
*execute injected code (see cmFactoryBCMGroup 'CommandType,
AddressOrOpcode,
ByteCount and Data')
For a complete list of factory mode oid's see the list at the end of this
BIT FILES!
The bit file method works on firmware 0.4.5.0 and up on SB3100, SB4100, SB4101
and SB4200.
and on any SB5100, SB5101 and SBG900.
The bitfile method works like this.
1) using snmp you set the oid 1.3.6.1.4.1.1166.1.19.3.1.18.0 to the interger
value of the last 4 octets your hfc mac address.
2) the modem then tftp gets a 'bitfile' from 192.168.100.10
4100 modem will tftp get SB4100.bit , and 4200 modem will tftp get SB4200.bit
3) if the bit file is the correct size and contains the exact sequence of
bytes, then factory mode is enabled and the modem reboots!
4) When the modem reboots you have full access to all the factory mib and
oid's within it.
NOTE: Factory mode will stay enabled untill you turn it off by setting
1.3.6.1.4.1.1166.1.19.4.29.0 to interger 1 and reboot the modem!
Here is an actual bitfile.
The size of the bit file is 123 bytes.
This bitfile works on SB3100, 4100,4101 and 4200 running firmware 0.4.5.0 or
higher.
Offset Data
0x00 43 6f 70 79 72 69 67 68 74 20 32 30 30 34 20 4d |Copyright 2004 M|
0x10 6f 74 6f 72 6f 6c 61 2e 20 55 6e 61 75 74 68 6f |otorola. Unautho|
0x20 72 69 7a 65 64 20 75 73 65 2c 20 63 6f 70 79 69 |rized use, copyi|
0x30 6e 67 20 6f 72 20 64 69 73 74 72 69 62 75 74 69 |ng or distributi|
0x40 6f 6e 20 69 73 20 70 72 6f 68 69 62 69 74 65 64 |on is prohibited|
0x50 20 77 69 74 68 6f 75 74 20 77 72 69 74 74 65 6e | without written|
0x60 20 63 6f 6e 73 65 6e 74 20 66 72 6f 6d 20 4d 6f | consent from Mo|
0x70 74 6f 72 6f 6c 61 2e 83 04 c4 f1 |torola.....|
--dshocker