Disassemble of a T-Sinus 154 Firmware

The firmware can be downloaded on the T-Com Webpages ready to upgrade the box. The Firmware is a zip file which can be extracted. The 0.81 firmware contains a single file called:

-rw-rw-rw- 1 flo mways 786442 Feb 27 2004 FW_154Komfort_V0.81.bin

From looking at the file it seems to be some zip files concatted. I used foremost with this pattern to split the file:

zip y 155000000 PK\x03\x04\x14 PK\x05\x06??????????????????

The result are 3 files:

-rw-rw-r-- 1 flo mways 147867 Jan 25 21:15 00000000.zip -rw-rw-r-- 1 flo mways 430433 Jan 25 21:15 00000001.zip -rw-rw-r-- 1 flo mways 80502 Jan 25 21:15 00000002.zip

Extracting these files with a normal unzip returns these 3 files:

-rw-rw-r-- 1 flo mways 93996 Sep 10 2003 3890EndFW_1.0.4.3.arm -rw-rw-r-- 1 flo mways 812235 Jan 30 2004 PFS.IMG -rw-rw-r-- 1 flo mways 1251500 Jan 30 2004 SOHO.BIN

The 3890EndFW_1.0.4.3.arm seems to be a Prism 54 Firmware as i guess from this article as it shows:

0x00000080: 00000000 00000000 00000000 56657273 ............Vers 0x00000090: 696F6E20 312E302E 342E3320 6275696C ion 1.0.4.3 buil 0x000000A0: 74206F6E 20576564 204A756C 20313620 t on Wed Jul 16 0x000000B0: 31313A31 363A3239 20434553 54203230 11:16:29 CEST 20 0x000000C0: 30332062 7920696E 6C627569 6C644074 03 by inlbuild@t 0x000000D0: 69780000 5041434B 5041434B 5041434B ix..PACKPACKPACK 0x000000E0: D3F021E3 80FB8FE3 0000A0E1 C42F8FE2 Óð!ã.û.ã.. áÄ/.â

The PFS.IMG file is a pseudo read-only filesystem more like a tar. Fixed superblock and fixes size dentrys. I wrote a little programm readpfs.c to extrace the individual files from the PFS.IMG. The resulting files are:

www\images\hg_linien_grau.gif www\images\pic_b_back.gif www\images\pic_c_b.gif www\images\pic_c_bl.gif www\images\pic_c_br.gif www\images\pic_c_m.gif www\images\pic_c_menu.gif www\images\pic_c_menu_first.gif www\images\pic_c_menu_l.gif www\images\pic_c_menu_l_first.gif www\images\pic_c_ml.gif www\images\pic_c_mr.gif www\images\pic_c_product.jpg www\images\pic_c_sl.gif www\images\pic_c_sr.gif www\images\pic_h_t.gif www\images\pic_h_tl.gif www\images\pic_h_tr.gif www\images\pic_t_back.jpg www\images\button_alles_loeschen2.gif www\images\button_alles_loeschen.gif www\images\button_beenden2.gif www\images\button_beenden.gif www\images\button_loeschen2.gif www\images\button_loeschen.gif www\images\button_ok2.gif www\images\button_ok.gif www\images\button_ok_weiter2.gif www\images\button_ok_weiter.gif www\images\button_speichern2.gif www\images\button_speichern.gif www\images\button_zurueck2.gif www\images\button_zurueck.gif www\images\pic_c_m_first.gif www\images\pic_i_back.jpg www\images\pic_m_back.jpg www\images\button_ok_r.gif www\images\button_ok_r2.gif www\images\button_standard2.gif www\images\button_standard.gif www\images\pic_m_head.gif www\images\pic_m_marker.gif www\images\pic_c_haken.gif www\images\pic_b_154K.gif www\images\pic_hinweis.gif www\doc\t_wan_2.stm www\doc\i_laden.htm www\doc\login.htm www\doc\c_status_information.stm www\doc\i_status.htm www\doc\hcti_assistent_3.htm www\doc\wait_u.stm www\doc\wait.stm www\doc\b.htm www\doc\c_hilfsmittel.stm www\doc\i_hilfsmittel_datum.htm www\doc\c_start.stm www\doc\c_laden.stm www\doc\c_status.stm www\doc\tmp_m.css www\doc\t_sicherheit_f_z_ft.stm www\doc\c_netzwerk_wireless.stm www\doc\tools.txt www\doc\c_netzwerk_wan_pppoe.stm www\doc\h_assistent_2.htm www\doc\loginerr.stm www\doc\c_netzwerk_wan_dhcp.stm www\doc\hcti_start.htm www\doc\hcti_sicherheit_f_z_ft.htm www\doc\c_netzwerk_wan_static.stm www\doc\c_sicherheit_f_z_ft.stm www\doc\t_0_l_z_s_history.stm www\doc\tmp_i.css www\doc\c_sicherheit_wpa.stm www\doc\routine.txt www\doc\hwoption.stm www\doc\c_status_usb.stm www\doc\dhcp.stm www\doc\t_wan_1.stm www\doc\igd.xml www\doc\hcti_assistent_2a.htm www\doc\hcti_status_wlan.htm www\doc\hcti_sicherheit_f_z.htm www\doc\production.stm www\doc\hcti_status_information.htm www\doc\i_laden_s.htm www\doc\hcti_security.htm www\doc\t_sicherheit_f.stm www\doc\c_netzwerk_nat_einaus.stm www\doc\EMI_TEST.STM www\doc\m_laden.htm www\doc\qstatus.stm www\doc\hcti_sicherheit_f.htm www\doc\hcti_assistent_1.htm www\doc\t_assistent_3.stm www\doc\top_start_passwort.htm www\doc\hcti_sicherheit_f_t_regneu.htm www\doc\i_laden_w.htm www\doc\function.stm www\doc\h_passwort.htm www\doc\c_assistent_5.stm www\doc\h_start.stm www\doc\m_status.htm www\doc\tmp_t.css www\doc\i_start.htm www\doc\c_hilfsmittel_datum.stm www\doc\i_netzwerk_ddns.htm www\doc\hcti_sicherheit_f_t.htm www\doc\hcti_sicherheit_g_mac.htm www\doc\i_sicherheit_802t.htm www\doc\t_0_z_history.stm www\doc\c_assistent_1.stm www\doc\c_sicherheit_f_t_regneu.stm www\doc\c_laden_l.stm www\doc\tmp_c.css www\doc\t_sicherheit_a.stm www\doc\ban.stm www\doc\t_wan_2a.stm www\doc\hcti_sicherheit_g_wep.htm www\doc\hcti_status_internet.htm www\doc\t_z_sicherheit_f.stm www\doc\hcti_status_sicherheit.htm www\doc\h_status_wlan.htm www\doc\h_status_sicherheit.htm www\doc\hcti_status.htm www\doc\i_laden_l.htm www\doc\hcti_passwort.htm www\doc\routine3.txt www\doc\hcti_hilfsmittel.htm www\doc\hcti_start_passwort.htm www\doc\c_status_sicherheit.stm www\doc\hcti_status_internet_W.htm www\doc\t_0_master.stm www\doc\m_startseite.htm www\doc\c_sicherheit_f_t.stm www\doc\c_sicherheit_f_z_mac.stm www\doc\index.stm www\doc\h_assistent_2p.htm www\doc\h_assistent_2s.htm www\doc\c_status_internet.stm www\doc\hcti_assistent_2s.htm www\doc\hcti_netzwerk_wan.htm www\doc\i_status_sicherheit.htm www\doc\i_netzwerk_wds.htm www\doc\t_z_s_sicherheit.stm www\doc\c_sicherheit_g_mac.stm www\doc\t_0_z_ok_history.stm www\doc\c_netzwerk_nat_s.stm www\doc\c_status_wlan.stm www\doc\routine2.txt www\doc\c_sicherheit_f.stm www\doc\t_hilfsmittel_datum.stm www\doc\i_sicherheit_802r.htm www\doc\h_assistent_5.htm www\doc\t_0_z_s_history.stm www\doc\h_netzwerk_wds_new.htm www\doc\tmp_h.css www\doc\c_sicherheit_f_einaus.stm www\doc\h_status_internet.htm www\doc\t_0_z_ok_start.stm www\doc\i_netzwerk_nat_v.htm www\doc\hcti_hilfsmittel_datum.htm www\doc\t_0_z_start.stm www\doc\qstatus_main.stm www\doc\hcti_netzwerk.htm www\doc\h_assistent_2d.htm www\doc\hcti_sicherheit_802r.htm www\doc\h_hilfsmittel_reboot.htm www\doc\c_netzwerk_wds_new.stm www\doc\t_assistent_5.stm www\doc\c_hilfsmittel_firm.stm www\doc\c_sicherheit_g_wep.stm www\doc\m_sicherheit.htm www\doc\tmp_status.css www\doc\hcti_assistent_2d.htm www\doc\c_start_passwort.stm www\doc\i_sicherheit_a_802_b.htm www\doc\hcti_netzwerk_nat.htm www\doc\t_assistent_1.stm www\doc\i_netzwerk_nat_einaus.htm www\doc\h_sicherheit_g_wep.htm www\doc\i_netzwerk_wan_R.htm www\doc\i_assistent_1.htm www\doc\t_netzwerk_nat.stm www\doc\hcti_laden.htm www\doc\i_hilfsmittel_reboot.htm www\doc\t_assistent_2.stm www\doc\m_start_passwort.htm www\doc\m_netzwerk.htm www\doc\h_assistent_4.htm www\doc\hcti_hilfsmittel_reboot.htm www\doc\h_sicherheit_g_mac.htm www\doc\h_status.htm www\doc\routine4.txt www\doc\hcti_netzwerk_nat_a.htm www\doc\c_laden_w.stm www\doc\tmp_s.css www\doc\c_netzwerk_lan.stm www\doc\tmp_0_master.css www\doc\m_hilfsmittel.htm www\doc\t_0_trigger.stm www\doc\h_sicherheit_f_t_regneu.htm www\doc\hcti_assistent_4.htm www\doc\c_netzwerk_wds.stm www\doc\loginpserr.htm www\doc\c_sicherheit_a_wpa.stm www\doc\hcti_sicherheit_a_wpa.htm www\doc\c_sicherheit_f_z.stm www\doc\c_hilfsmittel_fern.stm www\doc\h_sicherheit.htm www\doc\h_assistent_3.htm www\doc\i_hilfsmittel_firm.htm www\doc\hcti_sicherheit_wpa.htm www\doc\hcti_sicherheit_f_d.htm www\doc\c_netzwerk_nat_a.stm www\doc\h_hilfsmittel_datum.htm www\doc\i_netzwerk_lan.htm www\doc\h_sicherheit_wpa.htm www\doc\c_hilfsmittel_reboot.stm www\doc\hcti_netzwerk_nat_v.htm www\doc\c_hilfsmittel_datum_server.stm www\doc\hcti_sicherheit_e_w.htm www\doc\i_sicherheit_f_u.htm www\doc\h_netzwerk_nat.htm www\doc\t_0_s_z_s_history.stm www\doc\h_sicherheit_e_w.htm www\doc\hcti_sicherheit_p.htm www\doc\c_sicherheit_802t.stm www\doc\hcti_sicherheit_f_h.htm www\doc\h_netzwerk_nat_einaus.htm www\doc\i_netzwerk_nat.htm www\doc\c_sicherheit_e_w.stm www\doc\c_sicherheit.stm www\doc\c_sicherheit_f_d.stm www\doc\hcti_sicherheit_802t.htm www\doc\top_laden.htm www\doc\t_0_trigger1.stm www\doc\i_netzwerk_nat_s.htm www\doc\hcti_hilfsmittel_datum_svr.htm www\doc\hcti_netzwerk_nat_s.htm www\doc\h_sicherheit_a_wpa.htm www\doc\c_netzwerk_nat.stm www\doc\top_sicherheit.htm www\doc\top_assistent.htm www\doc\hcti_netzwerk_wireless.htm www\doc\h_netzwerk_nat_ddns.htm www\doc\hcti_sicherheit_a_802.htm www\doc\h_netzwerk_nat_upnp.htm www\doc\top_netzwerk.htm www\doc\hcti_sicherheit_f_u.htm www\doc\i_sicherheit.htm www\doc\verinfo.txt www\doc\top_status.htm www\doc\top_hilfsmittel.htm www\doc\i_assistent_2.htm www\doc\h_sicherheit_802t.htm www\doc\h_status_information.htm www\doc\m_assistent.htm www\doc\h_sicherheit_802r.htm www\doc\t_assistent_4.stm www\doc\c_sicherheit_802r.stm www\doc\i_sicherheit_f_z_pchinzu.htm www\doc\c_netzwerk_nat_v.stm www\doc\h_sicherheit_f_t_regneu.stm www\doc\c_assistent_2.stm www\doc\h_sicherheit_a_802.htm www\doc\i_sicherheit_f_h.htm www\doc\i_sicherheit_f_d.htm www\doc\i_sicherheit_f_t.htm www\doc\IGD_L.STM www\doc\igd.stm www\doc\igd_l3f.xml www\doc\igd_lcm.xml www\doc\igd_osf.xml www\doc\i_netzwerk_wireless.htm www\doc\igd_wcic.xml www\doc\igd_wdsl.xml www\doc\igd_wec.xml www\doc\igd_wic.xml www\doc\igd_wpc.xml www\doc\i_sicherheit_a_802.htm www\doc\igd_w.stm www\doc\igd_wc1.stm www\doc\igd_wc2.stm www\doc\i_status_information.htm www\doc\hcti_assistent_2.htm www\doc\c_sicherheit_f_u.stm www\doc\c_sicherheit_f_z_pchinzu.stm www\doc\h_sicherheit_f_einaus.htm www\doc\hcti_sicherheit_f_einaus.htm www\doc\hcti_netzwerk_wds.htm www\doc\i_sicherheit_f_z_mac.htm www\doc\hcti_sicherheit_a_wep.htm www\doc\h_netzwerk_wds.htm www\doc\h_sicherheit_f_z_ft.htm www\doc\h_netzwerk_nat_a.htm www\doc\c_sicherheit_p.stm www\doc\h_netzwerk_lan.htm www\doc\i_sicherheit_e_w.htm www\doc\h_netzwerk.htm www\doc\my_function.txt www\doc\h_netzwerk_nat_v.htm www\doc\i_sicherheit_f_z.htm www\doc\c_netzwerk.stm www\doc\h_netzwerk_nat_s.htm www\doc\h_sicherheit_f_z_mac.htm www\doc\h_sicherheit_f_z_pchinzu.stm www\doc\c_sicherheit_f_z_einaus.stm www\doc\h_sicherheit_f_z.htm www\doc\i_sicherheit_f_z_ft.htm www\doc\h_assistent_1.htm www\doc\h_sicherheit_f_u.htm www\doc\h_netzwerk_wan.htm www\doc\h_netzwerk_wireless.htm www\doc\h_sicherheit_f_t.htm www\doc\i_sicherheit_g_mac.htm www\doc\i_assistent_5.htm www\doc\i_sicherheit_g_wep.htm www\doc\i_sicherheit_wpa.htm www\doc\t_0_al_z_s_history.stm www\doc\h_sicherheit_f.htm www\doc\hcti_netzwerk_ddns.htm www\doc\i_sicherheit_f.htm www\doc\i_netzwerk_upnp.htm www\doc\i_netzwerk_nat_a.htm www\doc\hcti_netzwerk_nat_einaus.htm www\doc\i_passwort.htm www\doc\c_netzwerk_ddns.stm www\doc\i_sicherheit_f_z_einaus.htm www\doc\t_start_passwort.stm www\doc\top_startseite.htm www\doc\hcti_assistent_5.htm www\doc\i_hilfsmittel_datum_server.htm www\doc\i_sicherheit_a_wpa.htm www\doc\i_sicherheit_a_wep.htm www\doc\i_hilfsmittel_fern.htm www\doc\c_netzwerk_upnp.stm www\doc\i_sicherheit_f_t_regneu.htm www\doc\hcti_netzwerk_upnp.htm www\doc\hcti_sicherheit.htm www\doc\h_sicherheit_f_h.htm www\doc\i_hilfsmittel.htm www\doc\h_sicherheit_p.htm www\doc\i_hilfsmittel_datum_manuell.htm www\doc\hcti_netzwerk_lan.htm www\doc\i_assistent_4.htm www\doc\hcti_hilfsmittel_datum_man.htm www\doc\i_assistent_3.htm www\doc\i_sicherheit_p.htm www\doc\h_sicherheit_f_d.htm www\doc\i_0_master.htm www\doc\i_status_wlan.htm www\doc\c_assistent_2p.stm www\doc\h_sicherheit_f_z_pchinzu.htm www\doc\hcti_sicherheit_f_z_pchinzu.htm www\doc\hcti_sicherheit_f_z_mac.htm www\doc\i_status_internet.htm www\doc\h_sicherheit_f_z_einaus.htm www\doc\hcti_sicherheit_f_z_einaus.htm www\doc\h_laden.htm www\doc\h_hilfsmittel_datum_manuell.htm www\doc\i_start_passwort.htm www\doc\hcti_laden_w.htm www\doc\hcti_laden_l.htm www\doc\h_laden_l.htm www\doc\h_laden_w.htm www\doc\h_hilfsmittel_firm.htm www\doc\h_hilfsmittel_fern.htm www\doc\h_hilfsmittel.htm www\doc\hcti_hilfsmittel_firm.htm www\doc\hcti_hilfsmittel_fern.htm www\doc\h_hilfsmittel_datum_server.htm www\doc\c_hilfsmittel_datum_manuell.stm www\doc\hcti_netzwerk_wds_new.htm www\doc\c_sicherheit_a_802.stm www\doc\hcti_assistent_2p.htm www\doc\c_netzwerk_wan_R.stm www\doc\h_start_passwort.htm www\doc\i_assistent_2p.htm www\doc\i_sicherheit_f_einaus.htm www\doc\i_assistent_2s.htm www\doc\c_sicherheit_f_h.stm www\doc\i_assistent_2d.htm www\doc\t_assistent_2a.stm www\doc\i_netzwerk.htm www\cgi-bin\ac_control.exe www\cgi-bin\admz.exe www\cgi-bin\antenna_test.exe www\cgi-bin\aoaccadd.exe www\cgi-bin\aoaccdel.exe www\cgi-bin\aoschadd.exe www\cgi-bin\aoschdel.exe www\cgi-bin\aportadd.exe www\cgi-bin\aportdel.exe www\cgi-bin\aportfd.exe www\cgi-bin\asec.exe www\cgi-bin\aurlbk.exe www\cgi-bin\backup_config.bin www\cgi-bin\backup_log.exe www\cgi-bin\badsl.exe www\cgi-bin\bcable.exe www\cgi-bin\bdhcp.exe www\cgi-bin\bwtype.exe www\cgi-bin\clientfilter.exe www\cgi-bin\csetup_wan_fix.exe www\cgi-bin\fire_eb.exe www\cgi-bin\firewall_SPI.exe www\cgi-bin\hacker_prevention.exe www\cgi-bin\ipsec-sa.exe www\cgi-bin\log www\cgi-bin\login.exe www\cgi-bin\logout.exe www\cgi-bin\nat_sp.exe www\cgi-bin\pptp_c.exe www\cgi-bin\pptp_s.exe www\cgi-bin\qsetup_cable.exe www\cgi-bin\qsetup_time.exe www\cgi-bin\qsetup_wan_fix.exe www\cgi-bin\qsetup_wan_pppoe.exe www\cgi-bin\qstatusprocess.exe www\cgi-bin\restart.exe www\cgi-bin\restore.exe www\cgi-bin\setup_clientfilter.exe www\cgi-bin\setup_config_data.exe www\cgi-bin\setup_dmz.exe www\cgi-bin\setup_dns.exe www\cgi-bin\setup_firewall.exe www\cgi-bin\setup_fix_pat.exe www\cgi-bin\setup_lan.exe www\cgi-bin\setup_misc.exe www\cgi-bin\setup_pass.exe www\cgi-bin\setup_remote_mgmt.exe www\cgi-bin\setup_sch.exe www\cgi-bin\setup_snmp.exe www\cgi-bin\setup_specialapps.exe www\cgi-bin\setup_time.exe www\cgi-bin\setup_virtualserver.exe www\cgi-bin\setup_wan.exe www\cgi-bin\setup_wan_bridge.exe www\cgi-bin\setup_wan_dhcp.exe www\cgi-bin\setup_wan_fix.exe www\cgi-bin\setup_wan_modem.exe www\cgi-bin\setup_wan_pppoe.exe www\cgi-bin\snmp_community.exe www\cgi-bin\snmp_trap.exe www\cgi-bin\status.exe www\cgi-bin\statusprocess.exe www\cgi-bin\tdhcp.exe www\cgi-bin\tlog.exe www\cgi-bin\tmailtst.exe www\cgi-bin\tpppoe.exe www\cgi-bin\trenewip.exe www\cgi-bin\tswup.exe www\cgi-bin\tswupst.exe www\cgi-bin\upgrade.exe www\cgi-bin\upgrade_config.exe www\cgi-bin\upgrade_firm_browse.exe www\cgi-bin\wireless.exe www\cgi-bin\wireless_f.exe www\cgi-bin\wireless_info.exe www\cgi-bin\wireless_m.exe www\cgi-bin\wireless_mac.exe www\cgi-bin\wireless_ssid.exe www\cgi-bin\wiretype.exe www\cgi-bin\aadsl.exe www\cgi-bin\setup_ddns.exe www\cgi-bin\upnp_eb.exe www\cgi-bin\wireless_wep.exe www\cgi-bin\wireless_wpa.exe www\cgi-bin\wireless_e.exe www\cgi-bin\wireless1X.exe www\cgi-bin\setup_schxx.exe www\cgi-bin\emi_test.exe www\cgi-bin\tiny_del.exe www\cgi-bin\batmint.exe www\cgi-bin\ntp_setting.exe www\cgi-bin\nat_eb.exe www\cgi-bin\wds.exe www\cgi-bin\hw_opt.cgi www\cgi-bin\production.exe

The most interesting parts the .exe files are empty 0 byte files. The guess is that the OS or the Webserver just interprets them as jumps to internal routines. Also the webserver seems to be able to do SSI as some webpages show exec cmd includes.

The final file SOHO.BIN seems to be the real executable. From lookin at the binary the T-Sinus 154 uses a ADMTek 5120 CPU which is a Mips 4Kc CPU. It seems the Authors have used a lot Open Source Software:

0x000F1AA0: 6D2C2573 2025640A 00000000 633A2F67 m,%s %d.....c:/g 0x000F1AB0: 6E755F73 74756666 2F313534 4B6F6D66 nu_stuff/154Komf 0x000F1AC0: 6F72742F 736F7572 63652F66 69726D77 ort/source/firmw 0x000F1AD0: 6172652F 61702F68 74747064 2F687474 are/ap/httpd/htt 0x000F1AE0: 70642E63 00000000 68747470 643A2067 pd.c....httpd: g
0x000EFC50: 53484131 20706172 74206F66 2053534C SHA1 part of SSL 0x000EFC60: 65617920 302E382E 32622030 382D4A61 eay 0.8.2b 08-Ja 0x000EFC70: 6E2D3139 39380000 28313030 2563206C n-1998..(100%c l 0x000EFC80: 6F737329 0A000000 41707072 6F78696D oss)....Approxim

Here is a very similar device which has the exact same files in the firmware and seems to be quite similar. BBR-4MG. It seems our Baby is produced by Buffalo Tech Inc..

Disassembly of the T-Sinus 154 SE versions show that they are basically the same. Onyl the wireless seems to be replaced. Instead of a Prism54 not a Texas Instrument is assembled. Therefor the Wireless firmware image disappeared.