SB4XXX Alternate Cable Modem Firmware Upgrade method Written by jazper Saturday, 10 November 2007

THIS TUTORIAL IS INTENDED FOR THEORETICAL USE ONLY, USE ON PRODUCTION SYSTEMS MAY VIOLATE YOUR ISP's TERMS OF SERVICE. THEORYSHARE TAKES NO RESPONSIBILITY FOR YOUR ACTIONS. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. THIS SOFTWARE IS INTENDED FOR EDUCATIONAL USE ONLY AND MAY BE ILLEGAL IF USED IMPROPORLY. USERS ASSUME FULL RESPONSIBILITY FOR THEIR ACTIONS.

<!-- @page { size: 8.27in 11.69in; margin: 0.79in } P { margin-bottom: 0.08in } --> Required programs are in the Uncap kit available in the downloads section. Objective: To be able to change firmware from (sb410x) v4.4.2 and greater, OR (sb3100) v3.2.15 and greater OR (sb4200) v4.4.2 and greater . These versions have disabled the ethernet interface during the initial registration process or when an snmp set command for "upgradeFromMgt" is invoked. Needed: CMFirm v3.0 How To: There are two methods to do this. Method 1: If you are a lucky one and have access to two cable modems, and they are both online, you would require one pc connected to one cable modem and another pc connected to the 2nd cable modem. (Note: two cable modems on the on the same coax can degrade performance.) The next step is to check that you can ping the cable modem's HFC IP address that you will be changing firmware on. From here on out, this document assumes only one of the two cable modems will be upgraded, and for reference, Cable Modem 1(CM1) and PC 1, will serve as the TFTP Server. Cable Modem 2(CM2) will have the firmware changed. Using PC 1, ping the hfc ip address of Cable Modem 2, the hfc ip address can be found on the surfboards internal web page, at http://192.168.100.1/address.html. If you can successfully ping and get a reply from CM2's HFC IP address you are a step closer! Next you HAVE to have the cable modem's SNMP read/write community string. This often, 7 times out of 10, can be found in the DOCSIS config file. This document assumes your knowledge of docsis

config files. More often than not this string is one of the words contained inside of the quotes (""). If your config file does not contain an snmp community string, you could try an SNMP brute force application, to try to find the community string but this can take an exorbitant amount of time. This method is beyond the scope of this document. Once you have successfully found the community string, PC1 needs to run CMFirm v2.0 For CM Address, you must put CM2's HFC IP address. Community, must be the read/write community string. Firmware Server, must be PC1's IP address. Firmware file, must be the EXACT name of the firmware to be loaded. I.e. SB4100-4.0.12-SMC05-NOSHELL.hex.bin TFTP Base Dir, is best to be left alone, however can be changed manually. This directory MUST contain the above firmware file. Once you have entered the 5 above "options" click Start. A message should pop up prompting you with the cable modem's SNMP Description. Click yes to proceed. If you have successfully written values to the cable modem you should see the following three messages: TFTP Server IP set as x.x.x.x Firmware filename set as xxxxxxxxx.hex.bin Cable Modem should now be downloading the firmware At this point it may take a few seconds but a seperate window should open up in CMFirm and display a progress bar containing byes left to upload. After the file has uploaded, the cable modem should reboot itself and come back online. To verify that you have successfully downgraded. Go to http://192.168.100.1/mainhelp.html and verify the new version. Pat yourself on the back because you have successfully beat Motorola and your isp at its firmware game. Method 2: This method is EXACTLY the same as above. Only difference is you may not have two pc's but if you know someone on the same ISP and who might live nearby. You can follow Method 1 to the key. Replace the above terms Cable Modem 1(CM1) and PC1 with your buddy's pc and the steps will work the same EXACT way.

Conclusion: As ISP's and CM manufacturers find out more and more what we do, things WILL change. This method DOES work with Surfboards and could be followed with other cable modems. I do not guarantee this to work 100% as there are many factors that could limit it from working. Examples are community strings may be wrong. SNMP may be blocked. Pinging the modem may not yield a reply.

Do your best to follow the instruction here and you can be successful. NOTE: downgrading your firmware to a "hacked" firmware version does NOT guarantee you safety from your ISP. Credits - Document written by jazper-