Adtec RD-60: Difference between revisions
(→Images) |
mNo edit summary |
||
| (4 intermediate revisions by the same user not shown) | |||
| Line 12: | Line 12: | ||
= Reverse Engineering Notes = | = Reverse Engineering Notes = | ||
== Hardware == | == Hardware == | ||
[[File:Adtec_rd60_internals_overview.jpg|thumb|center]] | [[File:Adtec_rd60_internals_overview.jpg|thumb|center]] | ||
| Line 22: | Line 23: | ||
* '''PLB bus:''' 133 MHz | '''PCI bus:''' 33 MHz | * '''PLB bus:''' 133 MHz | '''PCI bus:''' 33 MHz | ||
* '''Kernel:''' Linux 2.6.14-gemppc-iolite | * '''Kernel:''' Linux 2.6.14-gemppc-iolite | ||
* '''Front panel:''' Character LCD/VFD | * '''Front panel:''' Character LCD/VFD, text only, ~40 chars wide. | ||
* '''Storage:''' CompactFlash card (8 partitions, 4 used) | * '''Storage:''' CompactFlash card (8 partitions, 4 used) | ||
It seems that the hardware doesn't do blind scan, but scripted sequential tuning might be a workaround? | |||
=== Demodulator Board === | === Demodulator Board === | ||
* '''Slot 2:''' <code>BA14</code> | * '''Slot 2:''' <code>BA14</code> - PC87 ver 1.4 (main decoder board) | ||
* '''Slot 99:''' <code>7044BB</code> | * '''Slot 99:''' <code>7044BB</code> - '''Newtec NTC/7044/BB DVB Demodulator''' | ||
** PRM firmware: '''v2.34''' (20/03/13) | ** PRM firmware: '''v2.34''' (20/03/13) | ||
** FPGA bitfile: v1.01 (09/01/12) | ** FPGA bitfile: v1.01 (09/01/12) | ||
| Line 35: | Line 38: | ||
** Software ID: NTC/6381 DVB Demodulator | ** Software ID: NTC/6381 DVB Demodulator | ||
** Product ID: NTC/7044/BB.BCDCBCAA.x.B | ** Product ID: NTC/7044/BB.BCDCBCAA.x.B | ||
** License: '''165''' (includes Baseband Frames | ** License: '''165''' (includes Baseband Frames, see below) | ||
** Communicates via I2C (<code>rmcp_i2c</code> kernel module) | ** Communicates via I2C (<code>rmcp_i2c</code> kernel module) | ||
** <code>BB</code> suffix = BaseBand licensed and capable | ** <code>BB</code> suffix = BaseBand licensed and capable | ||
| Line 44: | Line 47: | ||
* '''Base Band Frames''' (BBFrames) | * '''Base Band Frames''' (BBFrames) | ||
The control interface is '''RMCPv2 protocol''' over async serial TTL or I2C | The control interface is '''RMCPv2 protocol''' over async serial TTL or I2C implemented by the <code>rmcp_i2c</code> kernel module. | ||
This is the mechanism to switch output to BBFrame mode. | This is the mechanism to switch output to BBFrame mode. | ||
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf | See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf | ||
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf | |||
[[File:20250429 153804.jpg|thumb|center]] | [[File:20250429 153804.jpg|thumb|center]] | ||
| Line 53: | Line 58: | ||
=== Inputs/Outputs === | === Inputs/Outputs === | ||
* 2x RF/satellite inputs (RF1, RF2) | * 2x RF/satellite inputs (RF1, RF2) - 950–2150 MHz, 256 kSym/s – 45 MSym/s | ||
* DVB-ASI input/output (currently set to RECEIVE mode) | * DVB-ASI input/output (currently set to RECEIVE mode) | ||
* 2x SDI outputs (SD scaling) | * 2x SDI outputs (SD scaling) | ||
| Line 59: | Line 64: | ||
* 3x Ethernet (eth0, eth1, eth2) | * 3x Ethernet (eth0, eth1, eth2) | ||
* Serial: ttyS0 @ 115200, ttyBA | * Serial: ttyS0 @ 115200, ttyBA | ||
* L-Band Modulator option slot | * L-Band Modulator option slot - '''not populated''' (<code>/dev/ntmod</code> = "No such device") | ||
== Firmware / Software == | == Firmware / Software == | ||
| Line 68: | Line 75: | ||
! Partition !! Size !! Contents | ! Partition !! Size !! Contents | ||
|- | |- | ||
| p5 || 137M || GNU sysroot | | p5 || 137M || GNU sysroot - gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain | ||
|- | |- | ||
| p6 || 1.1M || '''Firmware''' | | p6 || 1.1M || '''Firmware''' - adtec/RD-60/1.12.08 and 1.12.12 | ||
|- | |- | ||
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs) | | p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs) | ||
| Line 87: | Line 94: | ||
| <code>dvc/</code> || Tuner device profile files (.DVC) | | <code>dvc/</code> || Tuner device profile files (.DVC) | ||
|- | |- | ||
| <code>keys/</code> || Empty | | <code>keys/</code> || Empty - key material generated at runtime | ||
|- | |- | ||
| <code>log/</code> || Rotated system logs | | <code>log/</code> || Rotated system logs | ||
| Line 93: | Line 100: | ||
| <code>media/</code> || Media files | | <code>media/</code> || Media files | ||
|- | |- | ||
| <code>.meta/</code> || <code>freg.db</code> | | <code>.meta/</code> || <code>freg.db</code> - feature registry SQLite DB | ||
|- | |- | ||
| <code>mvl/</code>, <code>osd/</code>, <code>rdy/</code>, <code>schmi/</code>, <code>shd/</code> || Runtime state dirs (mostly empty) | | <code>mvl/</code>, <code>osd/</code>, <code>rdy/</code>, <code>schmi/</code>, <code>shd/</code> || Runtime state dirs (mostly empty) | ||
| Line 103: | Line 110: | ||
! Binary !! Purpose | ! Binary !! Purpose | ||
|- | |- | ||
| <code>sysd</code> || Main system daemon | | <code>sysd</code> || Main system daemon - tuner/demodulator config via XML | ||
|- | |- | ||
| <code>cmdld</code> || Telnet API daemon (3 processes) | | <code>cmdld</code> || Telnet API daemon (3 processes) | ||
| Line 121: | Line 128: | ||
| <code>snmpd</code> || SNMP daemon | | <code>snmpd</code> || SNMP daemon | ||
|- | |- | ||
| <code>snmpl</code> || Internal SNMP poller | | <code>snmpl</code> || Internal SNMP poller - continuously queries Newtec MIB | ||
|- | |- | ||
| <code>vtosfifo</code> || TS-to-FIFO bridge to <code>/dev/vtosfifo4</code> | | <code>vtosfifo</code> || TS-to-FIFO bridge to <code>/dev/vtosfifo4</code> | ||
| Line 139: | Line 146: | ||
! Module !! Purpose | ! Module !! Purpose | ||
|- | |- | ||
| <code>newtec</code> || Newtec 7044 demodulator driver | | <code>newtec</code> || Newtec 7044 demodulator driver - core BBFrame driver | ||
|- | |- | ||
| <code>newtec_dummy</code> || Stub for absent optional demodulator hardware | | <code>newtec_dummy</code> || Stub for absent optional demodulator hardware | ||
|- | |- | ||
| <code>dvblite</code> || DVB lite core (depends on newtec) | | <code>dvblite</code> || DVB lite core (depends on newtec) - exposes <code>dvblite_ioctl</code> | ||
|- | |- | ||
| <code>rmcp_i2c</code> || I2C transport for Newtec RMCP protocol | | <code>rmcp_i2c</code> || I2C transport for Newtec RMCP protocol | ||
| Line 187: | Line 194: | ||
| <code>/dev/tuner_rst0-3</code> || Tuner resets | | <code>/dev/tuner_rst0-3</code> || Tuner resets | ||
|- | |- | ||
| <code>/dev/ntmod</code> || Newtec modulator | | <code>/dev/ntmod</code> || Newtec modulator - '''not populated''' | ||
|} | |} | ||
| Line 234: | Line 241: | ||
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619. | Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619. | ||
=== <code>/proc/driver/rddma/</code> | === <code>/proc/driver/rddma/</code> - FPGA DMA engine === | ||
* Channel 3 active: Control=<code>49C003C0</code>, Src=<code>03F01C00</code> (FPGA mapped) | * Channel 3 active: Control=<code>49C003C0</code>, Src=<code>03F01C00</code> (FPGA mapped) | ||
* 3.98M timer IRQs, 3.98M "No Data" | * 3.98M timer IRQs, 3.98M "No Data" - idle, no satellite IP stream | ||
* PID <code>0x01E1</code> (481) being tracked | * PID <code>0x01E1</code> (481) being tracked | ||
== Kernel Module Internals (<code>strings</code> analysis) == | == Kernel Module Internals (<code>strings</code> analysis) == | ||
=== <code>newtec.ko</code> | === <code>newtec.ko</code> - BBFrame symbols === | ||
<pre> | <pre> | ||
| Line 260: | Line 267: | ||
=== <code>dvblite.ko</code> === | === <code>dvblite.ko</code> === | ||
Contains <code>dvblite_ioctl</code> | Contains <code>dvblite_ioctl</code> - a kernel ioctl interface on <code>/dev/dvblite0</code>. Commands unknown to be investigated with a live signal. | ||
== Network Services == | == Network Services == | ||
| Line 286: | Line 293: | ||
</syntaxhighlight> | </syntaxhighlight> | ||
== Credentials (Default/Hardcoded | == Credentials (Default/Hardcoded - ZSL-2020-5603 / ExploitDB 48954) == | ||
{| class="wikitable" | {| class="wikitable" | ||
| Line 300: | Line 307: | ||
|} | |} | ||
* Password hashes: DES crypt | * Password hashes: DES crypt which is crackable in seconds with <code>john</code> | ||
* <code>apache ALL=(ALL) NOPASSWD: ALL</code> in sudoers | * <code>apache ALL=(ALL) NOPASSWD: ALL</code> in sudoers | ||
* Diagnostic package passphrase: '''<code>iMoo3jio</code>''' (hardcoded, leaks in <code>ps aux</code>) | * Diagnostic package passphrase: '''<code>iMoo3jio</code>''' (hardcoded, leaks in <code>ps aux</code>) | ||
| Line 321: | Line 328: | ||
</pre> | </pre> | ||
=== SNMP | === SNMP & Newtec Demodulator MIB === | ||
OID base: <code>.1.3.6.1.4.1.19587</code>, MIB: <code>ADTEC-NT-DEMOD-MIB</code>, community: <code>public</code> | OID base: <code>.1.3.6.1.4.1.19587</code>, MIB: <code>ADTEC-NT-DEMOD-MIB</code>, community: <code>public</code> | ||
| Line 342: | Line 349: | ||
* '''30 MSym/s''', QPSK 3/4, roll-off 35% | * '''30 MSym/s''', QPSK 3/4, roll-off 35% | ||
* Was '''LOCKED''' at -32 dBm when saved | * Was '''LOCKED''' at -32 dBm when saved | ||
* <code>bbCrcerrors = 1</code> | * <code>bbCrcerrors = 1</code> '''BBFrame counter was active and non-zero!''' | ||
* Likely '''Türksat 42°E''' | * Likely '''Türksat 42°E''' | ||
| Line 360: | Line 367: | ||
* '''BISS-1 key''' in <code>dtrans.xml</code>: <code>69A969BBECA0</code> | * '''BISS-1 key''' in <code>dtrans.xml</code>: <code>69A969BBECA0</code> | ||
* '''Viaccess''' (CA ID 0x0005) feed seen in logs | * '''Viaccess''' (CA ID 0x0005) feed seen in logs & no card present, could not decrypt | ||
== IP-over-Satellite == | == IP-over-Satellite == | ||
| Line 366: | Line 373: | ||
The unit has a full satellite IP receive stack beyond TS decoding: | The unit has a full satellite IP receive stack beyond TS decoding: | ||
* <code>rddma_ip</code> | * <code>rddma_ip</code> - FPGA-backed DMA for IP-from-satellite | ||
* <code>ip_ingress_main</code> | * <code>ip_ingress_main</code> - GSE/MPE ingress pipeline | ||
* FPGA Channel 3 active at <code>03F01C00</code> | * FPGA Channel 3 active at <code>03F01C00</code> | ||
* Currently idle | * Currently idle - no GSE/MPE stream configured | ||
== Security Summary == | == Security Summary == | ||
| Line 399: | Line 406: | ||
* LCD API in <code>libsolib.so</code>: <code>FpLcdKpInit()</code>, <code>LcdClear()</code>, <code>LcdWriteStr(char*, pos, len)</code> | * LCD API in <code>libsolib.so</code>: <code>FpLcdKpInit()</code>, <code>LcdClear()</code>, <code>LcdWriteStr(char*, pos, len)</code> | ||
* Writing to <code>/dev/frpanel2</code> activates the backlight | * Writing to <code>/dev/frpanel2</code> activates the backlight | ||
* <code>menud</code> daemon owns the display | * <code>menud</code> daemon owns the display - must be stopped before direct writes | ||
* Proc interface: <code>/proc/driver/frpanel/</code> (rows, cols, screen, type, version, access) | * Proc interface: <code>/proc/driver/frpanel/</code> (rows, cols, screen, type, version, access) | ||
== IP Reception == | |||
The RD-60 supports multiple IP-based protocols for receiving transport streams: | |||
{| class="wikitable" | |||
! Protocol !! Max throughput !! Notes | |||
|- | |||
| UDP (unicast/multicast) || 100 Mbps || 7 DVB packets per UDP packet. No packet loss protection. Not recommended over public internet. | |||
|- | |||
| RTP (unicast/multicast) || 100 Mbps || 7 DVB packets per RTP packet. Adds packet sequencing for out-of-order correction. | |||
|- | |||
| RTP + FEC (SMPTE-2022) || 45 Mbps || FEC streams on base port N, with two FEC streams on N+2 and N+4. Handles lost packets at cost of latency/overhead. | |||
|- | |||
| TCP (unicast only) || 15 Mbps || No multicast support. Higher latency but reliable delivery. Recently added. | |||
|} | |||
The RD-60 automatically detects whether an incoming stream is UDP, RTP, or SMPTE-2022 FEC. TCP must be explicitly configured. | |||
The default mode is UDP/RTP. Switching between UDP/RTP and TCP requires a unit reboot. FEC streams require ports N+2 and N+4 to be open in addition to the base port N. | |||
Our unit was observed configured for UDP multicast at <code>224.0.0.5:5520</code> (see <code>dtrans.xml</code>). | |||
== Images == | == Images == | ||
| Line 414: | Line 443: | ||
== TODO (requires dish connected) == | == TODO (requires dish connected) == | ||
* [ ] Read <code>/proc/driver/dvblite/fe0/stats</code> with live signal | * [ ] Read <code>/proc/driver/dvblite/fe0/stats</code> with live signal - observe all BB* fields | ||
* [ ] SNMP walk full <code>.1.3.6.1.4.1.19587</code> with live signal | * [ ] SNMP walk full <code>.1.3.6.1.4.1.19587</code> with live signal | ||
* [ ] Investigate <code>dvblite_ioctl</code> on <code>/dev/dvblite0</code> | * [ ] Investigate <code>dvblite_ioctl</code> on <code>/dev/dvblite0</code> | ||
| Line 423: | Line 452: | ||
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3) | * [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3) | ||
* [ ] Explore Telnet API <code>*.NTC</code> command namespace | * [ ] Explore Telnet API <code>*.NTC</code> command namespace | ||
* [ ] Investigate <code>xcpServerd</code>/<code>xcpClientd</code> | * [ ] Investigate <code>xcpServerd</code>/<code>xcpClientd</code> XCP protocol capabilities | ||
* [ ] Check if <code>schnv.DVC</code> populates after a lock (empty offline) | * [ ] Check if <code>schnv.DVC</code> populates after a lock (empty offline) | ||
* [ ] Read <code>freg.db</code> contents | * [ ] Read <code>freg.db</code> contents, full feature registry dump | ||
* [ ] Send RMCP command via <code>rmcp_i2c</code> to switch NTC/7044/BB output to BBFrame mode | * [ ] Send RMCP command via <code>rmcp_i2c</code> to switch NTC/7044/BB output to BBFrame mode | ||
== Links == | |||
- [https://www.tonercable.com/pdf/RD-60_Manual.pdf manual] | |||
Latest revision as of 19:33, 14 April 2026
| Adtec RD-60 | |
|---|---|
| Participants | Melan |
| Skills | |
| Status | Active |
| Niche | Sdr |
| Purpose | |
| Tool | No |
| Location | the roof |
| Cost | |
| Tool category | |
Adtec RD-60 Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:No | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:No | [[Tool Cost::{{{Cost}}} | }}
Adtec RD-60 IRD
The Adtec RD-60 is a 1RU integrated receiver/decoder (IRD).
It seems the Adtec RD-60 might expose DVB-S2 baseband frames (BBFrames) below the TS layer, this might be very useful as part of the dontlookup satellite interception paper replication project. See dontlookup
Reverse Engineering Notes
Hardware
Main Unit
- Model: Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)
- Hostname:
GOFFERT - IP: 10.1.2.172 (DHCP)
- CPU: IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)
- PLB bus: 133 MHz | PCI bus: 33 MHz
- Kernel: Linux 2.6.14-gemppc-iolite
- Front panel: Character LCD/VFD, text only, ~40 chars wide.
- Storage: CompactFlash card (8 partitions, 4 used)
It seems that the hardware doesn't do blind scan, but scripted sequential tuning might be a workaround?
Demodulator Board
- Slot 2:
BA14- PC87 ver 1.4 (main decoder board) - Slot 99:
7044BB- Newtec NTC/7044/BB DVB Demodulator- PRM firmware: v2.34 (20/03/13)
- FPGA bitfile: v1.01 (09/01/12)
- Hardware: v3.0
- Serial: 30091216
- Software ID: NTC/6381 DVB Demodulator
- Product ID: NTC/7044/BB.BCDCBCAA.x.B
- License: 165 (includes Baseband Frames, see below)
- Communicates via I2C (
rmcp_i2ckernel module) BBsuffix = BaseBand licensed and capable
According to the official Newtec datasheet, the NTC/7044/BB supports explicit output mode switching between:
- Single transport stream
- Generic stream
- Base Band Frames (BBFrames)
The control interface is RMCPv2 protocol over async serial TTL or I2C implemented by the rmcp_i2c kernel module.
This is the mechanism to switch output to BBFrame mode.
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf
Inputs/Outputs
- 2x RF/satellite inputs (RF1, RF2) - 950–2150 MHz, 256 kSym/s – 45 MSym/s
- DVB-ASI input/output (currently set to RECEIVE mode)
- 2x SDI outputs (SD scaling)
- CVBS output
- 3x Ethernet (eth0, eth1, eth2)
- Serial: ttyS0 @ 115200, ttyBA
- L-Band Modulator option slot - not populated (
/dev/ntmod= "No such device")
Firmware / Software
CF Card Partition Layout
| Partition | Size | Contents |
|---|---|---|
| p5 | 137M | GNU sysroot - gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain |
| p6 | 1.1M | Firmware - adtec/RD-60/1.12.08 and 1.12.12 |
| p7 | 3.4M | Minimal initrd (busybox, bash, minimal libs) |
| p8 | 24M | Runtime/data (logs, DVC profiles, media) |
- Current firmware: 1.12.12 (symlinked at
/opt/pkg/oem) - Previous firmware: 1.12.08 (symlinked at
/opt/pkg/oem_prev)
p8 Runtime Directories
| Dir | Purpose |
|---|---|
dvc/ |
Tuner device profile files (.DVC) |
keys/ |
Empty - key material generated at runtime |
log/ |
Rotated system logs |
media/ |
Media files |
.meta/ |
freg.db - feature registry SQLite DB
|
mvl/, osd/, rdy/, schmi/, shd/ |
Runtime state dirs (mostly empty) |
Key Binaries (/usr/local/sbin/)
| Binary | Purpose |
|---|---|
sysd |
Main system daemon - tuner/demodulator config via XML |
cmdld |
Telnet API daemon (3 processes) |
menud |
Front panel menu daemon |
fregd |
Feature/license registry daemon |
dtrans |
TS transport handler (--slot=2 --id=BA14)
|
dcmd |
Device command interface for BA14 |
myles |
Web API backend (SQLite) |
requestHandler |
Apache CGI/FastCGI handler |
snmpd |
SNMP daemon |
snmpl |
Internal SNMP poller - continuously queries Newtec MIB |
vtosfifo |
TS-to-FIFO bridge to /dev/vtosfifo4
|
xcpServerd/xcpClientd |
XCP protocol daemons (3 each) |
pard |
Parallel interface daemon |
pnpd |
PnP device daemon |
mirror |
Mirror/redundancy daemon (runs as adtec) |
Kernel Modules
| Module | Purpose |
|---|---|
newtec |
Newtec 7044 demodulator driver - core BBFrame driver |
newtec_dummy |
Stub for absent optional demodulator hardware |
dvblite |
DVB lite core (depends on newtec) - exposes dvblite_ioctl
|
rmcp_i2c |
I2C transport for Newtec RMCP protocol |
vtosfifo |
TS FIFO device driver |
rddma_ip |
IP-over-satellite receive DMA engine (FPGA-backed) |
ip_ingress_main |
IP ingress pipeline (GSE/MPE over satellite) |
frpanel |
Front panel driver |
fanctrl / pc96 |
Fan controller |
proxyimg |
Image proxy |
epb |
EPB bus driver |
pnp |
PnP device manager |
fec / ethfrm |
Ethernet/FEC |
pc73a / pc93 |
Front panel dependencies |
Failed to load (hardware absent): teamcast, nim, lnb_pwr, pc72
Device Nodes
| Device | Purpose |
|---|---|
/dev/dvblite0-2 |
DVB lite interfaces |
/dev/vtosfifo0-5 |
TS FIFO char devices (major 240) |
/dev/tuner0-3 |
Tuner interfaces (major 123) |
/dev/tuner_ledgr0-3 |
Tuner lock (green) LEDs |
/dev/tuner_ledrd0-3 |
Tuner read LEDs |
/dev/tuner_rst0-3 |
Tuner resets |
/dev/ntmod |
Newtec modulator - not populated |
/proc Driver Interfaces
/proc/driver/dvblite/fe0/info
NAME=NTC/7044/BB DVB Demodulator FREQ_MIN=950000 / FREQ_MAX=2150000 SYMRATE_MIN=256000 / SYMRATE_MAX=45000000 S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO S_8PSK=2/3, 5/6, 8/9, AUTO S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10 S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10 S2_16QAM=3/4, 7/8, AUTO S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10 S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10 SOFTWARE_LICENSE=165 SOFTWARE_VERSION=v2.34 20/03/13 FPGA_BITFILE_VERSION=v1.01 09/01/12 HARDWARE_VERSION=v3.0 SERIAL_NUM=30091216
/proc/driver/dvblite/fe0/stats (no signal)
LOCK=UNLOCKED RECV_LEVEL=-70.00 INTRATE=41470588 MOD_FEC=QPSK_3/4 BB_CRC_ERRORS=N/A <- populates with live signal DUMMY_PL_RATIO=N/A <- populates with live signal ISI_FILTER_BYTE=N/A <- populates with live signal BASEBAND_LEN=N/A <- populates with live signal FRAMES_SEC=N/A <- populates with live signal ALARMS=0000110001011000 STATE=READY
fe1 has same structure but NAME=NTC7044 (no BB suffix, no license).
/proc/driver/vtosfifo/chn
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.
/proc/driver/rddma/ - FPGA DMA engine
- Channel 3 active: Control=
49C003C0, Src=03F01C00(FPGA mapped) - 3.98M timer IRQs, 3.98M "No Data" - idle, no satellite IP stream
- PID
0x01E1(481) being tracked
Kernel Module Internals (strings analysis)
newtec.ko - BBFrame symbols
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT BB_FRAMES BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT BASEBAND_LEN ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS ISI_FILTER_BYTE / ISI_MASK SAT_BB_GAIN ntc_debug (module param, uint)
BB_DATA_FIELD_LEN and BB_FRAMES suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.
dvblite.ko
Contains dvblite_ioctl - a kernel ioctl interface on /dev/dvblite0. Commands unknown to be investigated with a live signal.
Network Services
| Service | Port | Notes |
|---|---|---|
| SSH | 22 | Legacy KEX only (diffie-hellman-group1-sha1) |
| Telnet API | 23 | cmdld via xinetd
|
| FTP | 21 | pure-ftpd |
| HTTP | 80 | Apache + myles + requestHandler |
| SNMP | 161 | Community public
|
| mDNS | 5353 | GOFFERT.local
|
# SSH/SCP
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>:/path /local
Credentials (Default/Hardcoded - ZSL-2020-5603 / ExploitDB 48954)
| User | Password | Notes |
|---|---|---|
root |
1root! |
Full root SSH |
admin |
1admin! |
Also root via sudoers |
adtec |
none |
Telnet API / web UI |
adtecftp |
adtecftp2231 |
FTP only |
- Password hashes: DES crypt which is crackable in seconds with
john apache ALL=(ALL) NOPASSWD: ALLin sudoers- Diagnostic package passphrase:
iMoo3jio(hardcoded, leaks inps aux)
gpg --passphrase "iMoo3jio" --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -
APIs
Telnet API
Connect: telnet <ip>, login adtec/none
*.SYSD SHELLCMD <cmd> # arbitrary root shell execution! *.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2 # configure tuner *.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000 *.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0 # commit/apply
SNMP & Newtec Demodulator MIB
OID base: .1.3.6.1.4.1.19587, MIB: ADTEC-NT-DEMOD-MIB, community: public
snmpwalk -v2c -c public <ip> .1.3.6.1.4.1.19587
Key OIDs: tunerLock, recvLevel, esNo, linkMargin, modFec, rolloff, pilot, fecFrameType, unCorrFs, bbCrcerrors, basebandLen, dummyPlRatio, isiFilterByte, framesSec, satFeedType, satFeedDownlink, satFeedSymRate, satFeedModulation, lnbEnable, lnbPolarity, lnbTone
DVC Profile Format
SNMP SET commands as tuner presets, applied via Telnet API or web UI.
Saved Tuner Profiles
prfturktest.DVC (2018-04-28)
- DVB-S, 10762 MHz, KU 9750 LO → 1012 MHz L-band
- 30 MSym/s, QPSK 3/4, roll-off 35%
- Was LOCKED at -32 dBm when saved
bbCrcerrors = 1BBFrame counter was active and non-zero!- Likely Türksat 42°E
prfMUX.DVC (2018-04-28)
- DVB-S2, 10960 MHz, KU 9750 LO → 1210 MHz L-band
- 8.352 MSym/s, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM
- Was unlocked when saved
Licensed Features (Key ID 165)
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate <= 33 MBaud + ACM + Single TS/GS or Multiple Streams + (Baseband Frames) + no ACM client + no AES
BBFrame access is explicitly licensed and enabled.
Encryption / CA
- BISS-1 key in
dtrans.xml:69A969BBECA0 - Viaccess (CA ID 0x0005) feed seen in logs & no card present, could not decrypt
IP-over-Satellite
The unit has a full satellite IP receive stack beyond TS decoding:
rddma_ip- FPGA-backed DMA for IP-from-satelliteip_ingress_main- GSE/MPE ingress pipeline- FPGA Channel 3 active at
03F01C00 - Currently idle - no GSE/MPE stream configured
Security Summary
| Issue | Detail |
|---|---|
| Default root creds | root/1root! over SSH
|
| Telnet RCE | *.SYSD SHELLCMD = root shell with adtec/none
|
| Sudoers | apache ALL=(ALL) NOPASSWD: ALL
|
| Shared SSH host keys | Same across all units (stored on CF card) |
| Weak password hashes | DES crypt, trivially crackable |
| GPG passphrase leak | iMoo3jio visible in ps aux
|
| Public exploit | ZSL-2020-5603 / ExploitDB 48954 |
Other
Front Panel
- Driver:
frpanel.ko(depends onpc93,pc73a) - Device nodes:
/dev/frpanel0,/dev/frpanel1,/dev/frpanel2 - Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)
- LCD API in
libsolib.so:FpLcdKpInit(),LcdClear(),LcdWriteStr(char*, pos, len) - Writing to
/dev/frpanel2activates the backlight menuddaemon owns the display - must be stopped before direct writes- Proc interface:
/proc/driver/frpanel/(rows, cols, screen, type, version, access)
IP Reception
The RD-60 supports multiple IP-based protocols for receiving transport streams:
| Protocol | Max throughput | Notes |
|---|---|---|
| UDP (unicast/multicast) | 100 Mbps | 7 DVB packets per UDP packet. No packet loss protection. Not recommended over public internet. |
| RTP (unicast/multicast) | 100 Mbps | 7 DVB packets per RTP packet. Adds packet sequencing for out-of-order correction. |
| RTP + FEC (SMPTE-2022) | 45 Mbps | FEC streams on base port N, with two FEC streams on N+2 and N+4. Handles lost packets at cost of latency/overhead. |
| TCP (unicast only) | 15 Mbps | No multicast support. Higher latency but reliable delivery. Recently added. |
The RD-60 automatically detects whether an incoming stream is UDP, RTP, or SMPTE-2022 FEC. TCP must be explicitly configured.
The default mode is UDP/RTP. Switching between UDP/RTP and TCP requires a unit reboot. FEC streams require ports N+2 and N+4 to be open in addition to the base port N.
Our unit was observed configured for UDP multicast at 224.0.0.5:5520 (see dtrans.xml).
Images
TODO (requires dish connected)
- [ ] Read
/proc/driver/dvblite/fe0/statswith live signal - observe all BB* fields - [ ] SNMP walk full
.1.3.6.1.4.1.19587with live signal - [ ] Investigate
dvblite_ioctlon/dev/dvblite0 - [ ] Enable
ntc_debugmodule param and watch dmesg - [ ] Try ISI multistream filtering via SNMP SET
- [ ] Investigate
rddma_ipwith GSE/MPE satellite signal - [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)
- [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)
- [ ] Explore Telnet API
*.NTCcommand namespace - [ ] Investigate
xcpServerd/xcpClientdXCP protocol capabilities - [ ] Check if
schnv.DVCpopulates after a lock (empty offline) - [ ] Read
freg.dbcontents, full feature registry dump - [ ] Send RMCP command via
rmcp_i2cto switch NTC/7044/BB output to BBFrame mode
Links
- manual