Skip to main content Link Search Menu Expand Document Warning Info Success Info (external link) Copy Copied Following system colour scheme Selected dark colour scheme Selected light colour scheme Telegram GitHub Edit
Hack GPON 🏳️‍🌈

Hardware Specifications

   
Vendor/Brand Free/Iliad
Model  
ODM  
ODM Product Code  
Chipset BCM63153
Flash 4GB eMMC 5.1 KLM4G1FETE-B041
RAM 2x 512MB DDR3L-1866 NT5CC128M16JR-EK
CPU  
CPU Clock  
Bootloader  
System  
Load addr  
SFP 1G-BASEX, 10G-BASESR-LR, HSGMII (only AFM0003ILD), PON equivalent symbol EPON 10/1
Ethernet 2 1GbE, 1 2.5GbE LAN/WAN
Optics SC/UPC
IP address 192.168.1.254
Web Gui ✅
SSH  
Telnet  
Serial  
Serial baud 115200
Serial encoding 8-N-1
Form Factor CPE with SFP w/o MAC support

Serial

The serial port is routed through the USB-C port used for power (which is PD compliant, tested with a notebook power supply). The pins are SBU1 and SBU2, reversal is handled using an open drain buffer (SN74LVC2G07) so a pull-up resistor on RX is needed. On the power daughter board TP7 is TX and TP8 is RX. There is also a USB differential pair routed through the USB-C connector but there is no use for it yet. At the moment nothing more than a boot log is available. 1 2

SFP Whitelist

  • WTD RTXM166-401-C13 (EPON w/o MAC)
  • WTD RTXM166-401-C11 (EPON w/o MAC)
  • Hisense LTF7215-BH+ (EPON w/o MAC)
  • Technicolor AFM0003 (GPON with MAC)
  • SFP Copper 10Gtek (1 and 10 Gbps)

Miscellaneous Links

  1. Pwning the bcm61650 https://blog.xilokar.info/pwning-the-bcm61650.html ↩

  2. Firmware key extraction by gaining EL3 https://blog.xilokar.info/firmware-key-extraction-by-gaining-el3.html ↩