Does the SN persist after reboot? Does it change SN for UF-Instant? #1

Shto1337 · 2021-04-26T10:41:31Z

Hello,

I have 2 questions(not quite issues):

I have a UF-Nano-G, currently replacing a Huawei router(HG8247H). Does this tool modify the GPON Serial Number for the UF-Nano-G so that it persists after reboot?
Can the tool change the SN for UF-Instant while connected to an ER-X SFP? I am willing to test this out :)

Thank you

galvesribeiro · 2021-04-26T14:32:12Z

Hello!

I have a UF-Nano-G, currently replacing a Huawei router(HG8247H). Does this tool modify the GPON Serial Number for the UF-Nano-G so that it persists after reboot?

Yes, it patches one of the partitions which holds that data.

If you pass the --vendor HWTC and --serial XXXXXXXXXX (replace with your serial) it will be persistent across reboots for sure 😄. In fact all settings you do with this too is persistent and a backup of the original partition is kept local on the dumps directory from where you ran the tool.

Can the tool change the SN for UF-Instant while connected to an ER-X SFP? I am willing to test this out :)

I've tested the tool against a firmware dump from UF-Instant that I've got from the internet. I'm waiting the real device to arrive Today or Tomorrow so I can test on a real one.

Can you try run the tool with the --dry-run option as if you would replace the others to replace the serial number?

That will basically run all the processes and will print some information on your terminal without actually changing the device.

If you can print the output here would be awesome! 😄

Btw, out of curiosity, where did you found this repo?

Thank you!

Shto1337 · 2021-04-26T19:46:37Z

Hello,

If you pass the --vendor HWTC and --serial XXXXXXXXXX (replace with your serial) it will be persistent across reboots for sure 😄. In fact all settings you do with this too is persistent and a backup of the original partition is kept local on the dumps directory from where you ran the tool.

I've just tried this, it doesn't work because my serial is 16 characters. For example, I do this manually by connecting to the ufiber and using the commands:

`ssh [email protected]
cd bin
./gponctl stop

./gponctl setSnPwd --sn 12-34-56-78-90-12-34-56

======== Serial Number & Password ========

Serial Number: 12-34-56-78-90-12-34-56
Password : 20-20-20-20-20-20-20-20-20-20

==========================================

./gponctl init
./gponctl start

Start ONU with operational state: INIT (01)

./gponctl getSnPwd

======== Serial Number & Password ========

Serial Number: 41-4C-43-4C-xx-xx-xx-xx
Password : 20-20-20-20-20-20-20-20-20-20`

Below you can find the error using your tool:

`C:\Users\DD\Desktop\win-x64>UFiber.Configurator --host 192.168.9.2 --user ubnt --pw mypw --port 2222 --dry-run --vendor HWTC --serial 12-34-56-78-90-12-34-56

Original Image

--- NVRAM Information --

mtdblock3 hash: d79b72526c6f808fe85fda604565a80bb6cc2002bb1f5f6a21d504296b59fc9e
NVRAM Version: 6
Boot parameters: e=192.168.1.1:ffffff00 h=192.168.1.254 g= r=f f=vmlinux i=bcm963xx_fs_kernel d=1 p=0 c= a=
Board Id: UBNT_SFU
PSI size: 24
Total MAC addresses: 5
GPON MAC address:
GPON Vendor Id: UBNT
GPON Serial Number: 59a19d79
GPON SLID (password):
Checksum: 3126364939

Patching fw-26042021-073053.bin...
Unhandled exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation.
---> System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values. (Parameter 'serialNumber')
at UFiber.Configurator.NVRAM.SetGponSerialNumber(ReadOnlySpan1 serialNumber) at UFiber.Configurator.NVRAM.SetGponSerialNumber(String serialNumber) at <Program>$.<>c.<<Main>$>b__0_2(String host, String user, String pw, Int32 port, Boolean dryRun, String slid, String vendor, String serial, String mac) --- End of inner exception stack trace --- at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor, Boolean wrapExceptions) at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) at System.Delegate.DynamicInvokeImpl(Object[] args) at System.Delegate.DynamicInvoke(Object[] args) at System.CommandLine.Invocation.ModelBindingCommandHandler.InvokeAsync(InvocationContext context) at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<<BuildInvocationChain>b__0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass23_0.<<UseParseErrorReporting>b__0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass16_0.<<UseHelp>b__0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass27_0.<<UseVersionOption>b__1>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass25_0.<<UseTypoCorrections>b__0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<<UseSuggestDirective>b__24_0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass22_0.<<UseParseDirective>b__0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass11_0.<<UseDebugDirective>b__0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<<RegisterWithDotnetSuggest>b__10_0>d.MoveNext() --- End of stack trace from previous location --- at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass14_0.<<UseExceptionHandler>b__0>d.MoveNext()

What am I doing wrong? Or does the tool only allows 8 character serial...? Or should I replace the parameter --serial with --plid?

Can you try run the tool with the --dry-run option as if you would replace the others to replace the serial number?

I will also order an UF-Instant and it should come next week. Will test it out.

Btw, out of curiosity, where did you found this repo?

https://community.ui.com/questions/Unofficially-support-3rd-party-OLTs-ONT-Serial-Number-Configuration-Serial-Changing/989b2134-f3b4-498a-a76f-b50a199b752e#answer/b7d57ab5-69f7-4c69-8190-a200dd238f5a

Thank you

galvesribeiro · 2021-04-26T22:10:49Z

Hello!

I've just merged #3 which allow the HEX SLID and Serial numbers.

Please download the release 0.1.1 which will allow that.

There wasn't actually a bug. When you have 16 HEX characters like on your case, the first 4 bytes (8 characters), is the VendorID which in your case is ALCL (Alcatel). The remaining 4 bytes are the actual serial number.

I've updated that --serial to accept 16 characters with the - and internally it will set the VendorID and the Serial at the same time so if you use a 16 characters long serial, you don't need to set the --vendor since it will be overwritten anyway.

Please let me know if it works.

I hope it helps, thanks for the report!

Shto1337 · 2021-04-26T23:10:20Z

Hello,

Thank you very much for the patch! I will test it out tomorrow first thing and will reply if it worked.

Shto1337 · 2021-04-27T08:58:50Z

it worked! but I had to pass the --vendor parameter.

`C:\Users\DD\Desktop\win-x64>UFiber.Configurator --host 192.168.9.2 --user ubnt --pw mypw --port 2222 --serial 12-34-56-78-90-12-34-56

Original Image

--- NVRAM Information --

mtdblock3 hash: d79b72526c6f808fe85fda604565a80bb6cc2002bb1f5f6a21d504296b59fc9e
NVRAM Version: 6
Boot parameters: e=192.168.1.1:ffffff00 h=192.168.1.254 g= r=f f=vmlinux i=bcm963xx_fs_kernel d=1 p=0 c= a=
Board Id: UBNT_SFU
PSI size: 24
Total MAC addresses: 5
GPON MAC address: redacted
GPON Vendor Id: UBNT
GPON Serial Number: 59a19d79
GPON SLID (password):
Checksum: 3126364939

Patching fw-27042021-084832.bin...

To set the GPON Serial Number, you must pass both --vendor and --serial

C:\Users\DD\Desktop\win-x64>UFiber.Configurator --host 192.168.9.2 --user ubnt --pw mypw --port 2222 --serial 12-34-56-78-90-12-34-56 --vendor ALCL

Original Image

--- NVRAM Information --

mtdblock3 hash: d79b72526c6f808fe85fda604565a80bb6cc2002bb1f5f6a21d504296b59fc9e
NVRAM Version: 6
Boot parameters: e=192.168.1.1:ffffff00 h=192.168.1.254 g= r=f f=vmlinux i=bcm963xx_fs_kernel d=1 p=0 c= a=
Board Id: UBNT_SFU
PSI size: 24
Total MAC addresses: 5
GPON MAC address: redacted
GPON Vendor Id: UBNT
GPON Serial Number: 59a19d79
GPON SLID (password):
Checksum: 3126364939

Patching fw-27042021-084904.bin...

Patched fw-27042021-084904.bin!

--- NVRAM Information --

mtdblock3 hash: 068b905195aac9821e0ce48b883546de3f03cdfacc421344ee5950599ad1fe94
NVRAM Version: 6
Boot parameters: e=192.168.1.1:ffffff00 h=192.168.1.254 g= r=f f=vmlinux i=bcm963xx_fs_kernel d=1 p=0 c= a=
Board Id: UBNT_SFU
PSI size: 24
Total MAC addresses: 5
GPON MAC address: redacted
GPON Vendor Id: HWTC
GPON Serial Number: 59A19D79
GPON SLID (password):
Checksum: 2696680764

Uploading patched file to the target UFiber device...
Uploaded!

Applying patched file on the target UFiber device...

Applied patch! Please reboot your UFiber device to load the new image.`

It reboots and the SN persists! Thank you

galvesribeiro · 2021-04-27T15:55:55Z

I'm glad it worked!

but I had to pass the --vendor parameter.

Ops! My bad! When I've updated to support the HEX serial, I forgot to adjust the validation that was once requiring both to be filled.

Please check the release 0.1.2 which includes the fix. If you pass the --vendor, then it requires the --serial. If you pass just the --serial it is expected to be an HEX like on your case, so the --vendor is ignored. Thanks for reporting that!

Btw, was that the UF-Nano-G or UF-Instant?

Thank you!

Shto1337 · 2021-04-28T22:55:10Z

It was UF-Nano-G

kautzy · 2021-05-10T12:59:49Z

hello,

got an ufiber instant module here... just wondering how you would patch the firmware on that one... seems like your tool needs to connect to the device with ssh, but i think ssh isn't available on the ufiber instant...? can you elaborate a bit on how to adjust the serial configuration on the ufiber instant?

thank you :)

kautzy · 2021-05-10T13:26:00Z

ah, i just found out that there is dropbear on the uf-instant. if i try to set the serial i get the following exception thrown:

any advice? :)

.\UFiber.Configurator.exe --host 192.168.1.1 --serial 48-57-54-43-e3-XX-XX-XX
Unhandled exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation.
---> System.InvalidOperationException: Invalid data, CRC doesn't match
at UFiber.Configurator.NVRAM..ctor(ReadOnlySpan`1 data, UInt32 offset, UInt32 length)
at $.<>c.<

$>b__0_2(String host, String user, String pw, Int32 port, Boolean dryRun, String slid, String vendor, String serial, String mac)
--- End of inner exception stack trace ---
at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor, Boolean wrapExceptions)
at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
at System.Delegate.DynamicInvokeImpl(Object[] args)
at System.Delegate.DynamicInvoke(Object[] args)
at System.CommandLine.Invocation.ModelBindingCommandHandler.InvokeAsync(InvocationContext context)
at System.CommandLine.Invocation.InvocationPipeline.<>c__DisplayClass4_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass23_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass16_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass27_0.<b__1>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass25_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__24_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass22_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass11_0.<b__0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c.<b__10_0>d.MoveNext()
--- End of stack trace from previous location ---
at System.CommandLine.Builder.CommandLineBuilderExtensions.<>c__DisplayClass14_0.<b__0>d.MoveNext()

galvesribeiro · 2021-05-10T13:52:53Z

@kautzy yes, we do use SSH but the tool isn't yet with the changes for the UF-Instant as we are still testing the possibilities.

We will update with a new release once a solution comes up.

obenturk · 2021-05-11T18:06:43Z

For UF Instant laser configuration is done with europa.data and module has customized omciapp. What I have done is I just copied V2801F omciapp to uf instant and I am able to change serial number & mac id.

I changed them but my ISP kicked me out even with original isp ont so I left this modification. If someone put Carlitox firmware on github I will try to upload it to UF instant since both uses same hardware.

galvesribeiro · 2021-05-11T18:09:51Z

I’m about to receive the CarlitoxxPro device. Any guidance on how to dump the firmware? Thank you! Get Outlook for iOS<https://aka.ms/o0ukef>

…

________________________________ From: Oncu Benturk ***@***.***> Sent: Tuesday, May 11, 2021 3:07:01 PM To: Unifi-Tools/UFiber.Configurator ***@***.***> Cc: Gutemberg Ribeiro ***@***.***>; State change ***@***.***> Subject: Re: [Unifi-Tools/UFiber.Configurator] Does the SN persist after reboot? Does it change SN for UF-Instant? (#1) For UF Instant laser configuration is done with europa.data and module has customized omciapp. What I have done is I just copied V2801F omciapp to uf instant and I am able to change serial number & mac id. I changed them but my ISP kicked me out even with original isp ont so I left this modification. If someone put Carlitox firmware on github I will try to upload it to UF instant since both uses same hardware. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub<#1 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/ABD64OCOU2XK3FQVEWUZHY3TNFW4LANCNFSM43STTCHQ>.

jjeziorny · 2021-05-11T19:27:42Z

There's a collection of firmwares from a French user here , including Carlitos v1
https://www.dropbox.com/sh/6h1w2ud7k6xetpc/AABZtQngqzTqNnUvD7s3DesCa?dl=0

galvesribeiro · 2021-05-11T19:49:05Z

I think CarlitoxxPro v2 is the one which has the same hardware (Realtek IIRC)...

galvesribeiro · 2021-05-12T02:01:22Z

Just got an email from them with the "instructions manual"...
CPGOS03-0490v2_Configuration-Manual.pdf

From the telnet CLI it indeed is the same Realtek firmware which UF-Instant uses @obenturk except that they add and customize the RDK default admin pages which Ubiquiti deliberately removed. I've dig on the UF-Instant files and the web server settings still there and can be enabled, but there are no pages so it won't work anyway...

galvesribeiro · 2021-05-12T02:03:56Z

@obenturk

I changed them but my ISP kicked me out even with original isp ont so I left this modification.

You mean you were able to change it permanently as in it survive after reboot?

When I plug my fiber, even if I don't change anything, it just reboot my device even my ISP being OK with it and giving me O5....

obenturk · 2021-05-13T07:21:44Z

With original firmware I can get O5 state but since serial number & MAC is different than ISP ONT, when I check ONUID which was given by OLT was showing 65 instead of 5.

After I change omci_app with V2801F, I can see correct serial number with top command (omci_app sould show serial number). Than I realized that I triggered an alarm at OLT side and I even could not use ISP provided ONT anymore.

ISP tech came and replaced Ericsson T63 ONT with SERCOMM one very very small footprint but it has modified firmware to work with Ericsson omci protocol.

I am waiting to find a carlitoxx v2 full flash dump to check if it will be work better or not.

By the way does anyone know a SFP stick that is suitable to Ericsson environment?

Thanks.

obenturk · 2021-05-13T11:49:43Z

Connect via uart pins and boot into uboot than you can dump whole flash.

mdb dump of ufinstant

flash dump made with following commands

9601C# sf probe 0
9601C# sf read 0x80000000 0x0 0x1000000
9601C# md.b 0x80000000 0x1000000

then converted to bin file with

python3 uboot_mdb_to_image.py < uf_mdb_dump.txt > flash.bin

If you want only kernel1 and rootfs1 you can change sf read parameters with following

fl_kernel1=80000
fl_kernel1_sz=300000

fl_kernel2=830000
fl_kernel2_sz=300000

fl_rootfs1=380000
fl_rootfs1_sz=4b0000

fl_rootfs2=b30000
fl_rootfs2_sz=4b0000

galvesribeiro · 2021-05-20T22:42:33Z

I got my CarlitoxxPro, but it doesn't even work properly when connect to UDM-Pro or Unifi Switch Pro 24P. When plugged on the SFP, it just doesn't do anything. Even its IP address is not accessible...

pmgcosta · 2021-05-20T22:57:15Z

Can you check that: https://community.ui.com/questions/UDM-PRO-GPON-SFP-CarlitoxxPro-CPGOS03-0490-v2-0/362172d4-8a5f-4bda-a841-4a34c075c57f

galvesribeiro · 2021-05-20T23:32:09Z

@pmgcosta yup, already had. Check the last comment which is mine.

BTW, CarlitoxxPro support is pretty bad... Its almost a week since I asked for help and they don't reply emails...

pmgcosta · 2021-05-20T23:51:38Z

I'm in the same boat with an UDM-PRO and UF-Instant without any joy, i think next i will try to buy one AFM0002TIM or MA5671A

…

On Fri, May 21, 2021, 12:32 AM Gutemberg Ribeiro ***@***.***> wrote: @pmgcosta <https://github.com/pmgcosta> yup, already had. Check the last comment which is mine. BTW, CarlitoxxPro support is pretty bad... Its almost a week since I asked for help and they don't reply emails... — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABGY4H4GFEZHO3WRDC77RC3TOWLYRANCNFSM43STTCHQ> .

jjeziorny · 2021-05-21T06:14:11Z

I have two AFM0002TIM @pmgcosta which I bought quite cheap on ebay, both working fine on UB edgerouter.
One internet connection is fully working (Moviestar network) but the second won't acquire DHCP IP (Orange network), still trying to work through that, some french posts say Orange used DHCP authentication and I need a fti/ password which so far I could not get it anywhere.

jjeziorny · 2021-06-01T19:58:21Z

I have two AFM0002TIM @pmgcosta which I bought quite cheap on ebay, both working fine on UB edgerouter.
One internet connection is fully working (Moviestar network) but the second won't acquire DHCP IP (Orange network), still trying to work through that, some french posts say Orange used DHCP authentication and I need a fti/ password which so far I could not get it anywhere.

Can you explain how to access to the AFM0002TIM default ip and
user and password ?

Default IP (if memory serves me well) is 192.168.1.1/24, so you can configure your router SFP interface with an IP on that range (I used 192.168.1.2/30 as my network is 1.1 already), then telnet (no password) or SSH with admin/system to it.

This device has no vi/vim, so for editing the config I copied it locally, edited and pushed back.

ssh [email protected] "cat /var/config/lastgood.xml" > lastgood.xml
ssh [email protected] "cat /var/config/lastgood_hs.xml" > lastgood_hs.xml

Then edit and upload again

cat lastgood.xml | ssh [email protected] -T "cat > /var/config/lastgood.xml"
cat lastgood_hs.xml | ssh [email protected] -T "cat > /var/config/lastgood_hs.xml"

I recommend loging into the device again after this and checking the config files are OK before rebooting it. If for any reason you lock yourself out by messing up the IP, these devices also have a secondary IP on VLAN2

2: br0.2@br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether ac:4a:fe:98:0a:f2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.1/24 brd 192.168.10.255 scope global br0.2

pmgcosta · 2021-06-01T21:18:49Z

ifconfig eth9:2 192.168.2.2 netmask 255.255.255.252 up

telnet 192.168.2.1

Connected to 192.168.2.1

Entering character mode
Escape character is '^]'.

Thanks!

pmgcosta · 2021-06-01T21:51:38Z

Is the right place to change ?

lastgood
<Value Name="GPON_PLOAM_PASSWD" Value="1234567890"/>

lastgood_hs
<Value Name="GPON_SN" Value="PTIN91194A08"/>

But when i check the serialnumber:

# omcicli get sn
SerialNumber: PTINffffff91194a08

I got this mess with ffff in the midle how can i fix that ?

My serial number is : 5054494E91194A08 (PTIN91194A08)

But appear that the serialnumber can't not start with 9 why ? with 7 works

omcicli set sn PTIN, 71194A08
omcicli get sn
SerialNumber: PTIN71194a08

omcicli set sn PTIN, 91194A08
omcicli get sn;
SerialNumber: PTINffffff91194a08

Is that normal how can i fix that ?

jjeziorny · 2021-06-02T05:18:57Z

Is the right place to change ?

lastgood
<Value Name="GPON_PLOAM_PASSWD" Value="1234567890"/>

lastgood_hs
<Value Name="GPON_SN" Value="PTIN91194A08"/>

But when i check the serialnumber:
# omcicli get sn
SerialNumber: PTINffffff91194a08
I got this mess with ffff in the midle how can i fix that ?

My serial number is : 5054494E91194A08 (PTIN91194A08)

But appear that the serialnumber can't not start with 9 why ? with 7 works
omcicli set sn PTIN, 71194A08
omcicli get sn
SerialNumber: PTIN71194a08
omcicli set sn PTIN, 91194A08
omcicli get sn;
SerialNumber: PTINffffff91194a08
Is that normal how can i fix that ?

I don't think that's a problem, just checked mine and the output of # omcicli get sn also shows ffff in some places.

# omcicli get sn
SerialNumber: HWTC3cffffff9a1dffffffa3

What provider are u using? Did you check the onu-state to see if it got O5 ?

# diag
RTK.0> gpon get onu-state
ONU state: Operation State(O5)

Once in state O5 you should see the flows have been created

RTK.0> gpon show ds-flow 
============================================================
     GPON ONU MAC D/S Flow Status
Flow ID | GEM Port | Type | Multicast | AES
      0 |     2047 |  ETH |         * |    
      1 |      278 |  ETH |           |   *
      2 |      279 |  ETH |           |   *
      3 |      280 |  ETH |           |   *
     32 |       10 | OMCI |           |   *
============================================================

Once the flows are created you should be able to acquire an IP via DHCP or PPPoE, depending on what your provider uses.

pmgcosta · 2021-06-02T10:05:45Z

Yes i'm on O5 state but without internet on my dream machine:

I'm using MEO, and FTTH Provider in portugal.

On my HG8012h i only have to change my serial number to PTIN91194A08 and password to " " (20 in hex)

# diag
RTK.0> gpon get onu-state
ONU state: Operation State(O5)
RTK.0>
RTK.0> gpon show ds-flow
============================================================
     GPON ONU MAC D/S Flow Status
Flow ID | GEM Port | Type | Multicast | AES
      0 |     4095 |  ETH |           |
     32 |       45 | OMCI |           |
============================================================
RTK.0>

Deam machine
# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNO                                                                                                                                                             WN qlen 1000
    link/ether ac:4a:fe:7b:2c:78 brd ff:ff:ff:ff:ff:ff
3: eth0.2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 00:00:00:01:00:02 brd ff:ff:ff:ff:ff:ff
4: nas0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNO                                                                                                                                                             WN qlen 1000
    link/ether 00:00:00:01:00:02 brd ff:ff:ff:ff:ff:ff
5: pon0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNO                                                                                                                                                             WN qlen 1000
    link/ether 00:00:00:01:00:02 brd ff:ff:ff:ff:ff:ff
6: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
    link/ether ac:4a:fe:7b:2c:78 brd ff:ff:ff:ff:ff:ff
    inet 192.168.2.1/24 brd 192.168.2.255 scope global br0
7: nas0_0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen                                                                                                                                                              10
    link/ether ac:4a:fe:7b:2c:7b brd ff:ff:ff:ff:ff:ff
8: br0.2@br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
    link/ether ac:4a:fe:7b:2c:78 brd ff:ff:ff:ff:ff:ff
    inet 192.168.10.1/24 brd 192.168.10.255 scope global br0.2

jjeziorny · 2021-06-02T10:55:48Z

Deam machine is the SFP I assume (the output looks like it's from it)

The SFP won't pick an IP, they work as bridge by default, you need to configure the correct VLAN on the SFP port in your router to get the IP (DHCP or PPPoE).

In my edgerouter for example
with pppoe

# show interfaces ethernet eth11        
 address 192.168.2.2/30
 duplex auto
 speed auto
 vif 20 {
     pppoe 1 {
         default-route force
         description DIGI
         firewall {
             in {
                 name WAN_IN
             }
             local {
                 name WAN_LOCAL
             }
         }
         mtu 1492
         name-server auto
         password xxxxx
         user-id yyyyy
     }
 }

with DHCP

# show interfaces ethernet eth8 
 address 192.168.254.254/30
 description Admin
 duplex auto
 speed auto
 vif 832 {
     address dhcp
     description Republica
     dhcp-options {
         default-route-distance 200
     }
     firewall {
         in {
             name WAN_IN
         }
         local {
             name WAN_LOCAL
         }
     }
 }

jjeziorny · 2021-06-02T10:57:53Z

btw, this conversation is way of topic here.... we should have it somewhere else.
feel free to use this thread on the mikrotik forum (most of what I mentioned here I already posted there also)
https://forum.mikrotik.com/viewtopic.php?f=3&t=116364&start=300

pmgcosta · 2021-06-02T13:08:13Z

Posted! in forum,

@galvesribeiro any news regarding uf-instant and CarlitoxxPro-CPGOS03-0490-v2 ?

galvesribeiro · 2021-06-02T13:17:52Z

Not yet. I'm trying to dump the firmware. Will update once I have more news.

obenturk · 2021-07-11T12:04:21Z

@galvesribeiro Hi any news about dumping the firmware?

galvesribeiro · 2021-07-11T14:19:04Z

Hello @obenturk no, I wasn't able to disassembly mine. I only have one CarlitoxxPro and it is running my internet. I'm afraid I'll brick it due to lack of soldering skills and will have to wait months to have a replacement arrive.

Any other alternative to pull the firmware files besides soldering?

danielducu · 2021-07-16T14:46:06Z

Any news on the uf-instant ?

kautzy · 2021-08-04T10:45:04Z

Any news on the uf-instant ?

hm, i'd be interested in that one too... :)

galvesribeiro · 2021-08-08T17:02:29Z

Not yet :/ We are still unable to write to the partitions of the UF-Instant as of Today. Still trying workarounds.

galvesribeiro · 2021-08-20T00:39:56Z

@obenturk have you seen this: Anime4000/RTL960x#2 (comment) ?

Also, I could sponsor you to make you find time if you made it work.

obenturk · 2021-08-20T05:26:38Z

Hello,

If someone dump whole flash of carlitoxx pro. (Need to do that to get rid out ui's multiple ser# &mac protection) I can write it on uf instant. Currently I have original uf-instant firmware and I am able to load different firmwares and revert back to original.

What I know is carlitoxxpro has the best firmware.

galvesribeiro · 2021-08-20T11:51:23Z

AHHH ok. Sorry, I misunderstood. I Thought you wanted the UF-Instant Firmware.

Ok, so @obenturk can you show the steps to extract the firmware from it?

Danno88-88 · 2021-11-11T20:35:01Z

Hi, do someone have news about UF-Instant, configurator or flashing Carlioxxpro firm?

mangod18 · 2022-06-09T11:15:07Z

Hi All,
Long time no updates here. Browsing many websites I found one great repo https://github.com/Anime4000/RTL960x/
Many useful information and recommendation which one SFP stick you should buy. By the way the same repo took me to the next one you might be interested in https://github.com/stich86/UF-Instant-Mod. This one contains information how to upgrade rootFS in UF-Instant and there is also some custom rootfs available (you can download it) which I believe has SN/PLOAM change capability.

I didn't test it yet because my UF-Instant in being delivered to me. I can test and provide with result maybe next weekend. To all UF-Instant owners, you can check it and let us know in the meantime how it works. Good luck.

m0veax · 2023-12-07T00:02:43Z

I will try the mentioned firmware on an UFiber-Instant in the next few weeks.

Will report my results here afterwards.

m0veax · 2023-12-10T20:40:02Z

Hey, i tried the custom rootfs and the SN and stuff persists after reboot. Do you need any further informations? We will try the UFiber-Instant soon and I will provide informations if the ISP accepted it

m0veax · 2023-12-10T23:50:55Z

Hey,

I just realized, that the mtd3 partition is a mountable JFFS2. After mounting it, you can fiddle around in the xml files and persist the data there. I found my original serialnumber in those XML Files.

This tool here is patching on binary level, but for the UFiber-Instant it seems like the offsets aren't correct.

I have not tried this, but maybe changing the device name ect in the XML files and persisting the JFFS2 could result in getting the target serial number on the device after flashing it back to /dev/mtd3.

I can't test this by myself anymore, since i gave the Hardware back to his owner after getting a persisted SN using https://github.com/stich86/UF-Instant-Mod. But maybe this helps someone seeking a solution without using a modified rootfs.

m0veax · 2023-12-21T09:38:19Z

Update on this. I got the hardware back, the Dream Machine didnt recognized the new configured SN and VendorID. I will give you an update after I investigated this.

AyberkAltuntop · 2024-05-13T21:33:24Z

Update on this. I got the hardware back, the Dream Machine didnt recognized the new configured SN and VendorID. I will give you an update after I investigated this.

Hello, any update?

m0veax · 2024-05-13T21:36:23Z

Hey, I don't own a dream machine, so it is hard to try it.

I'll get in touch with my colleague who has a dream machine and try to find an appointment to try different things.

AyberkAltuntop · 2024-05-13T21:40:04Z

I tried something with UF-Instant-Mod, but why the changes I made are not permanent. I have an issue, can you help me with this please? Thanks a lot.

stich86/UF-Instant-Mod#21

fabioneves · 2024-09-10T10:57:15Z

@pmgcosta @galvesribeiro hello!
did you manage to replace MEO Fibergateway with Ubiquiti Nano G or Loco ONT's? I wanted to replace everything with a new Ubiquit ONT + Router, but looks like replacing the ONT might be a challenge.

galvesribeiro added the question Further information is requested label Apr 26, 2021

galvesribeiro mentioned this issue Apr 26, 2021

Allow HEX Serial and SLID values. #3

Merged

galvesribeiro closed this as completed in #3 Apr 26, 2021

galvesribeiro added bug Something isn't working enhancement New feature or request and removed bug Something isn't working labels Apr 26, 2021

galvesribeiro reopened this Apr 26, 2021

thibaltus mentioned this issue Nov 11, 2021

CRC-Error / How to use it with UF-Instant? #12

Open

mjrr15 mentioned this issue Nov 14, 2021

UFiber WiFi #7

Open

m0veax mentioned this issue Jan 10, 2024

Login to UF-Instant???? #24

Open

Does the SN persist after reboot? Does it change SN for UF-Instant? #1

Does the SN persist after reboot? Does it change SN for UF-Instant? #1

Comments

Shto1337 commented Apr 26, 2021

galvesribeiro commented Apr 26, 2021 • edited Loading

Shto1337 commented Apr 26, 2021 • edited Loading

Original Image

galvesribeiro commented Apr 26, 2021

Shto1337 commented Apr 26, 2021

Shto1337 commented Apr 27, 2021 • edited Loading

Original Image

Patching fw-27042021-084832.bin...

Original Image

Patching fw-27042021-084904.bin...

Patched fw-27042021-084904.bin!

Applying patched file on the target UFiber device...

Applied patch! Please reboot your UFiber device to load the new image.`

galvesribeiro commented Apr 27, 2021

Shto1337 commented Apr 28, 2021

kautzy commented May 10, 2021

kautzy commented May 10, 2021

galvesribeiro commented May 10, 2021

obenturk commented May 11, 2021

galvesribeiro commented May 11, 2021 via email

jjeziorny commented May 11, 2021

galvesribeiro commented May 11, 2021

galvesribeiro commented May 12, 2021

galvesribeiro commented May 12, 2021

obenturk commented May 13, 2021

obenturk commented May 13, 2021 • edited Loading

galvesribeiro commented May 20, 2021

pmgcosta commented May 20, 2021

galvesribeiro commented May 20, 2021

pmgcosta commented May 20, 2021 via email

jjeziorny commented May 21, 2021

jjeziorny commented Jun 1, 2021

pmgcosta commented Jun 1, 2021 • edited Loading

ifconfig eth9:2 192.168.2.2 netmask 255.255.255.252 up

telnet 192.168.2.1

pmgcosta commented Jun 1, 2021 • edited Loading

jjeziorny commented Jun 2, 2021

pmgcosta commented Jun 2, 2021 • edited Loading

jjeziorny commented Jun 2, 2021

jjeziorny commented Jun 2, 2021

pmgcosta commented Jun 2, 2021

galvesribeiro commented Jun 2, 2021

obenturk commented Jul 11, 2021 • edited Loading

galvesribeiro commented Jul 11, 2021

danielducu commented Jul 16, 2021

kautzy commented Aug 4, 2021

galvesribeiro commented Aug 8, 2021

galvesribeiro commented Aug 20, 2021

obenturk commented Aug 20, 2021

galvesribeiro commented Aug 20, 2021 • edited Loading

Danno88-88 commented Nov 11, 2021

mangod18 commented Jun 9, 2022 • edited Loading

m0veax commented Dec 7, 2023

m0veax commented Dec 10, 2023 • edited Loading

m0veax commented Dec 10, 2023 • edited Loading

m0veax commented Dec 21, 2023

AyberkAltuntop commented May 13, 2024

m0veax commented May 13, 2024

AyberkAltuntop commented May 13, 2024

fabioneves commented Sep 10, 2024

galvesribeiro commented Apr 26, 2021 •

edited

Loading

Shto1337 commented Apr 26, 2021 •

edited

Loading

Shto1337 commented Apr 27, 2021 •

edited

Loading

obenturk commented May 13, 2021 •

edited

Loading

pmgcosta commented Jun 1, 2021 •

edited

Loading

pmgcosta commented Jun 1, 2021 •

edited

Loading

pmgcosta commented Jun 2, 2021 •

edited

Loading

obenturk commented Jul 11, 2021 •

edited

Loading

galvesribeiro commented Aug 20, 2021 •

edited

Loading

mangod18 commented Jun 9, 2022 •

edited

Loading

m0veax commented Dec 10, 2023 •

edited

Loading

m0veax commented Dec 10, 2023 •

edited

Loading