1 files changed, 227 insertions, 209 deletions

diff --git a/ont-technicolor-afm0002.md b/ont-technicolor-afm0002.md
index c6fc505..a8adb16 100644
--- a/ont-technicolor-afm0002.md
+++ b/ont-technicolor-afm0002.md
@@ -1,210 +1,228 @@
----

-title: Technicolor AFM0002

-has_children: false

-parent: ONT

----

-

-# Technicolor AFM0002TIM/FWB/WND

-

-## Hardware Specifications

-

-|             |                                                 |

-|-------------|-------------------------------------------------|

-| Vendor      | Technicolor                                     |

-| Model       | AFM0002TIM/FWB/WND                              |

-| Alias       |                                                 |

-| Chipset     | Realtek RTL9601B                                |

-| Flash       |                                                 |

-| RAM         |                                                 |

-| System      | Linux (Luna SDK)                                |

-| HSGMII      | NO                                              |

-| Optics      |                                                 |

-| IP address  | 192.168.2.1                                     |

-| Web Gui     | Can be enabled, user `admin`, password `system` |

-| SSH         | ✅ user `admin`, password `system`              |

-| Form Factor | miniONT SFP                                     |

-

-## List of software versions

-- V1_7_8_181123

-- V1_7_8_210928

-- V1_7_8_210412

-

-## List of partitions

-

-| dev   | size     | erasesize | name            |

-|-------|----------|-----------|-----------------|

-| mtd0  | 00040000 | 00001000  | "boot"          |

-| mtd1  | 00002000 | 00001000  | "env"           |

-| mtd2  | 00002000 | 00001000  | "env2"          |

-| mtd3  | 0003c000 | 00001000  | "config"        |

-| mtd4  | 00300000 | 00001000  | "k0"            |

-| mtd5  | 004c0000 | 00001000  | "r0"            |

-| mtd6  | 00300000 | 00001000  | "k1"            |

-| mtd7  | 004c0000 | 00001000  | "r1"            |

-| mtd8  | 00001000 | 00001000  | "Partition_008" |

-| mtd9  | 00001000 | 00001000  | "Partition_009" |

-| mtd10 | 00001000 | 00001000  | "Partition_010" |

-| mtd11 | 00001000 | 00001000  | "Partition_011" |

-| mtd12 | 00300000 | 00001000  | "linux"         |

-| mtd13 | 004c0000 | 00001000  | "rootfs"        |

-

-This stick supports dual boot. 

-

-`k0` and `r0` contains respectively the kernel and firmware of the first image, `k1` and `r1` of the second one

-

-## List of firmware and files

-### Useful files

-- `/var/config/lastgood.xml` - Contains the user portion of the configuration

-- `/var/config/lastgood-hs.xml` - Contains the "hardware" configuration (i.e. that _should_ not be changed)

-- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below)

-

-### Useful binaries

-- `/etc/scripts/flash`  - Used to manipulate the config files in a samewhat safe manner

-- `xmlconfig` - Used to low-level manipulate the XML config files. Called by `flash`

-- `nv` - Used to manipulate the nvram storage, including persistent config entries via `nv setenv`/`nv getenv`

-- `omcicli` - Used to interact with the running OMCI daemon

-- `omci_app` - The OMCI daemon

-- `diag` - Used to run low-level diagnostics commands on the stick

-

-## Useful commands

-

-### Enable the Web UI

-```sh

-# /bin/iptables -D INPUT -p tcp --dport 80 -j DROP

-```

-

-### Check the currently active image

-```sh

-# nv getenv sw_active

-sw_activ=1

-# nv getenv sw_version0

-sw_version0=V1_7_8_210412

-# nv getenv sw_version1

-sw_version1=V1_7_8_210412

-```

-

-### Boot to a different image

-```sh

-# nv setenv sw_commit 0|1

-# reboot

-```

-

-### Get/Set the ONT S/N

-```sh

-# /etc/scripts/bin flash get GPON_SN

-GPON_SN=TMBB00000000

-# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D

-```

-

-### Get/Set the ONT PLOAM password

-Note: the password is in ASCII format

-```sh

-# /etc/scripts/bin flash get GPON_PLOAM_PASSWD

-GPON_PLOAM_PASSWD=AAAAAAAAAA

-# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA

-```

-

-### Query a particular OMCI ME

-```sh

-# omcicli mib get MIB_IDX

-```

-

-## Low level modding

-Note: this section is based on version `V1_7_8_210412` of the stick

-### Trasnfer files from/to the stick

-Works with binary files too, just run md5sum on source and destination to make sure you are not corrupting anything...

-From the stick to the PC:

-```sh

-# ssh admin@192.168.2.1 "cat /tmp/omcilog" > omcilog.log

-```

-From the PC to the stick

-```sh

-# cat lastgood.xml | ssh admin@192.168.2.1  "cat > /var/config/lastgood.xml"

-```

-**Note:** on windows replace type with cat and run the commands from cmd (not powershell)

-### Extract and repack the rootfs

-```sh

-# unsquashfs mtd5.bin

-# mksquashfs squashfs-root rootfs -b 131072 -comp lzma -no-recovery

-```

-### Flash a new rootfs

-**Note: you can only flash the inactive image**. So mtd4/5 if you are on image1, mtd6/7 if you are on image0.

-

-The follwing examples flashes a new rootfs to image1 and boots to it

-```sh

-# flash_eraseall /dev/mtd7

-# cat /tmp/rootfs.new > /dev/mtd7

-# nv setenv sw_commit=1

-# reboot

-```

-### Add support to configurable SW and HW versions, VENDOR ID and much more

-We can patch `/etc/scripts/flash` in order to add support for some variables implemented in `omci_app` but removed from `xmlconfig`. The patch is below (change the values to suit your needs)

-```patch

---- squashfs-root/etc/scripts/flash     2021-09-28 10:38:52.000000000 +0200

-+++ squashfs-root.new/etc/scripts/flash 2022-08-04 00:00:29.769605000 +0200

-@@ -62,7 +62,26 @@

-                if [ `echo $para | egrep $specific_mib_patten` ]; then

-                        /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" | sed -r "s/,+//g"

-                else

--                       /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g"

-+                       case "$para" in

-+                               "OMCI_EQID")

-+                                       echo "$para=MY_EQID"

-+                                       ;;

-+                               "OMCI_VENDOR_ID")

-+                                       echo "$para=MY_VENDOR"

-+                                       ;;

-+                               "OMCI_SW_VER1")

-+                                       echo "$para=MY_SW_VER1"

-+                                       ;;

-+                               "OMCI_SW_VER2")

-+                                       echo "$para=MY_SW_VER2"

-+                                       ;;

-+                               "OMCI_ONT_VER")

-+                                       echo "$para=MY_HW_VER"

-+                                       ;;

-+                               *)

-+                                       /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g"

-+                                       ;;

-+                       esac

-                fi

-                if [ "$?" = "0" ]; then

-                        exit 0

-```                        

-### Increase the length of the software version from 13 to 14 characters

-`omci_app` has an hard-coded limit of 13 characters for the software version, which is too low. We can binary patch it to increase it to 14 (or more, if you dare/need)

-```

-JVhEWjAwNCUAAAAIAAgACAAAAAAAAAAAAAAAAAAAAABvbWNpX2FwcG9tY2lfYXBwH4sIAAAAAAAA

-AwMAAAAAAAAAAAAfiwgAAAAAAAADY2BoYGZgYFjh9Uq/aNcZQdXsOh3R5ktr/fd0sTEwcuTnJmfG

-JxYUYJVlZGAA0gCHsMK2QQAAAAAAAEQlWERaMDA0JQ==

-```

-Save it as omci_app.xdelta.base64, then run:

-```sh

-# base64 -d omci_app.xdelta.base64 > omci_app.xdelta

-# xdelta patch omci_app.xdelta bin/omci_app bin/omci_app.new

-# mv bin/omci_app.new bin/omci_app

-```

-For reference, the patch changes the follwing section of the omci_app:

-```diff

--00408c24 24 05 00 0e     li         a1,0xe

-+00408c24 24 05 00 0f     li         a1,0xf

--00408cf0 24 05 00 0f     li         a1,0xe

-+00408cf0 24 05 00 0f     li         a1,0xf

-```

-(It's inside the function referecing the string `OMCI_SW_VER1`)

-

-The original file md5sum is: 4aea2f72bacc11256b7e2c1583d2ad4f

-The patched file md5sum is: da20327c4c002e4c27f82f6ee63dbc1a

-### Enable PLOAM logging

-```sh

-/etc/scripts/bin flash set OMCI_DBGLVL 1

-/etc/scripts/bin flash set OMCI_DBGLOGFILE 1

-reboot

-/bin/omcicli set logfile 1 ffffffff

-```

-1. The binary log will be placed inside: `/tmp/omcilog`

-2. You can convert it into .pcap using https://github.com/ADeltaX/omcilog2pcap

-3. You can then open it into wireshark by installing the OMCI plugin from https://wiki.wireshark.org/Contrib.md

-   

-If you want to log everything since the stick boots, you can create a custom rootfs. Place the last command inside `etc/runomci.sh` as the last line of the file

+---
+title: Technicolor AFM0002
+has_children: false
+parent: ONT
+---
+
+# Technicolor AFM0002TIM/FWB/WND
+
+## Hardware Specifications
+
+|             |                                                 |
+|-------------|-------------------------------------------------|
+| Vendor      | Technicolor                                     |
+| Model       | AFM0002TIM/FWB/WND                              |
+| Alias       |                                                 |
+| Chipset     | Realtek RTL9601B                                |
+| Flash       |                                                 |
+| RAM         |                                                 |
+| System      | Linux (Luna SDK)                                |
+| HSGMII      | NO                                              |
+| Optics      |                                                 |
+| IP address  | 192.168.2.1 / 169.0.0.1                         |
+| Web Gui     | Can be enabled, user `admin`, password `system` |
+| SSH         | ✅ user `admin`, password `system`              |
+| Form Factor | miniONT SFP                                     |
+
+![](../../assets/img/afm0002tim.jpg)
+
+## Hardware revision
+
+- AFM0002TIM (IP address: 192.168.2.1)
+- AFM0002FWB (IP address: 169.0.0.1)
+- AFM0002WND
+
+Warning
+{: .label .label-red }
+
+- On this page we discuss AFM0002TIM. 
+- The AFM0002FWB can be transformed into AFM0002TIM.
+- The AFM0002FWB has an older sw version.
+
+## List of software versions
+- V1_7_8_180122 
+- V1_7_8_180725
+- V1_7_8_181123
+- V1_7_8_210928
+- V1_7_8_210412
+
+## List of partitions
+
+| dev   | size     | erasesize | name            |
+|-------------|-------------------------------------------------|-----------|-----------------|
+| mtd0  | 00040000 | 00001000  | "boot"          |
+| mtd1  | 00002000 | 00001000  | "env"           |
+| mtd2  | 00002000 | 00001000  | "env2"          |
+| mtd3  | 0003c000 | 00001000  | "config"        |
+| mtd4  | 00300000 | 00001000  | "k0"            |
+| mtd5  | 004c0000 | 00001000  | "r0"            |
+| mtd6  | 00300000 | 00001000  | "k1"            |
+| mtd7  | 004c0000 | 00001000  | "r1"            |
+| mtd8  | 00001000 | 00001000  | "Partition_008" |
+| mtd9  | 00001000 | 00001000  | "Partition_009" |
+| mtd10 | 00001000 | 00001000  | "Partition_010" |
+| mtd11 | 00001000 | 00001000  | "Partition_011" |
+| mtd12 | 00300000 | 00001000  | "linux"         |
+| mtd13 | 004c0000 | 00001000  | "rootfs"        |
+
+This stick supports dual boot. 
+
+`k0` and `r0` contains respectively the kernel and firmware of the first image, `k1` and `r1` of the second one
+
+## List of firmware and files
+### Useful files
+- `/var/config/lastgood.xml` - Contains the user portion of the configuration
+- `/var/config/lastgood-hs.xml` - Contains the "hardware" configuration (i.e. that _should_ not be changed)
+- `/tmp/omcilog` - OMCI messages logs (must be enabeled, see below)
+
+### Useful binaries
+- `/etc/scripts/flash`  - Used to manipulate the config files in a samewhat safe manner
+- `xmlconfig` - Used to low-level manipulate the XML config files. Called by `flash`
+- `nv` - Used to manipulate the nvram storage, including persistent config entries via `nv setenv`/`nv getenv`
+- `omcicli` - Used to interact with the running OMCI daemon
+- `omci_app` - The OMCI daemon
+- `diag` - Used to run low-level diagnostics commands on the stick
+
+## Useful commands
+
+### Enable the Web UI
+```sh
+# /bin/iptables -D INPUT -p tcp --dport 80 -j DROP
+```
+
+### Check the currently active image
+```sh
+# nv getenv sw_active
+sw_activ=1
+# nv getenv sw_version0
+sw_version0=V1_7_8_210412
+# nv getenv sw_version1
+sw_version1=V1_7_8_210412
+```
+
+### Boot to a different image
+```sh
+# nv setenv sw_commit 0|1
+# reboot
+```
+
+### Get/Set the ONT S/N
+```sh
+# /etc/scripts/bin flash get GPON_SN
+GPON_SN=TMBB00000000
+# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D
+```
+
+### Get/Set the ONT PLOAM password
+Note: the password is in ASCII format
+```sh
+# /etc/scripts/bin flash get GPON_PLOAM_PASSWD
+GPON_PLOAM_PASSWD=AAAAAAAAAA
+# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA
+```
+
+### Query a particular OMCI ME
+```sh
+# omcicli mib get MIB_IDX
+```
+
+## Low level modding
+Note: this section is based on version `V1_7_8_210412` of the stick
+### Trasnfer files from/to the stick
+Works with binary files too, just run md5sum on source and destination to make sure you are not corrupting anything...
+From the stick to the PC:
+```sh
+# ssh admin@192.168.2.1 "cat /tmp/omcilog" > omcilog.log
+```
+From the PC to the stick
+```sh
+# cat lastgood.xml | ssh admin@192.168.2.1  "cat > /var/config/lastgood.xml"
+```
+**Note:** on windows replace type with cat and run the commands from cmd (not powershell)
+### Extract and repack the rootfs
+```sh
+# unsquashfs mtd5.bin
+# mksquashfs squashfs-root rootfs -b 131072 -comp lzma -no-recovery
+```
+### Flash a new rootfs
+**Note: you can only flash the inactive image**. So mtd4/5 if you are on image1, mtd6/7 if you are on image0.
+
+The follwing examples flashes a new rootfs to image1 and boots to it
+```sh
+# flash_eraseall /dev/mtd7
+# cat /tmp/rootfs.new > /dev/mtd7
+# nv setenv sw_commit=1
+# reboot
+```
+### Add support to configurable SW and HW versions, VENDOR ID and much more
+We can patch `/etc/scripts/flash` in order to add support for some variables implemented in `omci_app` but removed from `xmlconfig`. The patch is below (change the values to suit your needs)
+```patch
+--- squashfs-root/etc/scripts/flash     2021-09-28 10:38:52.000000000 +0200
++++ squashfs-root.new/etc/scripts/flash 2022-08-04 00:00:29.769605000 +0200
+@@ -62,7 +62,26 @@
+                if [ `echo $para | egrep $specific_mib_patten` ]; then
+                        /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g" | sed -r "s/,+//g"
+                else
+-                       /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g"
++                       case "$para" in
++                               "OMCI_EQID")
++                                       echo "$para=MY_EQID"
++                                       ;;
++                               "OMCI_VENDOR_ID")
++                                       echo "$para=MY_VENDOR"
++                                       ;;
++                               "OMCI_SW_VER1")
++                                       echo "$para=MY_SW_VER1"
++                                       ;;
++                               "OMCI_SW_VER2")
++                                       echo "$para=MY_SW_VER2"
++                                       ;;
++                               "OMCI_ONT_VER")
++                                       echo "$para=MY_HW_VER"
++                                       ;;
++                               *)
++                                       /bin/xmlconfig -g $para | sed -r "s/$rename_mib_name+/$2/g"
++                                       ;;
++                       esac
+                fi
+                if [ "$?" = "0" ]; then
+                        exit 0
+```                        
+### Increase the length of the software version from 13 to 14 characters
+`omci_app` has an hard-coded limit of 13 characters for the software version, which is too low. We can binary patch it to increase it to 14 (or more, if you dare/need)
+```
+JVhEWjAwNCUAAAAIAAgACAAAAAAAAAAAAAAAAAAAAABvbWNpX2FwcG9tY2lfYXBwH4sIAAAAAAAA
+AwMAAAAAAAAAAAAfiwgAAAAAAAADY2BoYGZgYFjh9Uq/aNcZQdXsOh3R5ktr/fd0sTEwcuTnJmfG
+JxYUYJVlZGAA0gCHsMK2QQAAAAAAAEQlWERaMDA0JQ==
+```
+Save it as `omci_app.xdelta.base64`, then run:	
+```sh
+# base64 -d omci_app.xdelta.base64 > omci_app.xdelta
+# xdelta patch omci_app.xdelta bin/omci_app bin/omci_app.new
+# mv bin/omci_app.new bin/omci_app
+```
+For reference, the patch changes the follwing section of the omci_app:
+```diff
+-00408c24 24 05 00 0e     li         a1,0xe
++00408c24 24 05 00 0f     li         a1,0xf
+-00408cf0 24 05 00 0f     li         a1,0xe
++00408cf0 24 05 00 0f     li         a1,0xf
+```
+(It's inside the function referecing the string `OMCI_SW_VER1`)
+
+The original file md5sum is: `4aea2f72bacc11256b7e2c1583d2ad4f`
+The patched file md5sum is: `da20327c4c002e4c27f82f6ee63dbc1a`
+### Enable PLOAM logging
+```sh
+/etc/scripts/bin flash set OMCI_DBGLVL 1
+/etc/scripts/bin flash set OMCI_DBGLOGFILE 1
+reboot
+/bin/omcicli set logfile 1 ffffffff
+```
+1. The binary log will be placed inside: `/tmp/omcilog`
+2. You can convert it into .pcap using https://github.com/ADeltaX/omcilog2pcap
+3. You can then open it into wireshark by installing the OMCI plugin from https://wiki.wireshark.org/Contrib.md
+   
+If you want to log everything since the stick boots, you can create a custom rootfs. Place the last command inside `etc/runomci.sh` as the last line of the file
+
 ## Miscellaneous Links
\ No newline at end of file