Adtec RD-60: Difference between revisions

From NURDspace
Jump to navigation Jump to search
mNo edit summary
mNo edit summary
 
Line 23: Line 23:
* '''PLB bus:''' 133 MHz | '''PCI bus:''' 33 MHz
* '''PLB bus:''' 133 MHz | '''PCI bus:''' 33 MHz
* '''Kernel:''' Linux 2.6.14-gemppc-iolite
* '''Kernel:''' Linux 2.6.14-gemppc-iolite
* '''Front panel:''' Character LCD/VFD text only, ~40 chars wide.
* '''Front panel:''' Character LCD/VFD, text only, ~40 chars wide.
* '''Storage:''' CompactFlash card (8 partitions, 4 used)
* '''Storage:''' CompactFlash card (8 partitions, 4 used)


Line 30: Line 30:
=== Demodulator Board ===
=== Demodulator Board ===


* '''Slot 2:''' <code>BA14</code> PC87 ver 1.4 (main decoder board)
* '''Slot 2:''' <code>BA14</code> - PC87 ver 1.4 (main decoder board)
* '''Slot 99:''' <code>7044BB</code> '''Newtec NTC/7044/BB DVB Demodulator'''
* '''Slot 99:''' <code>7044BB</code> - '''Newtec NTC/7044/BB DVB Demodulator'''
** PRM firmware: '''v2.34''' (20/03/13)
** PRM firmware: '''v2.34''' (20/03/13)
** FPGA bitfile: v1.01 (09/01/12)
** FPGA bitfile: v1.01 (09/01/12)
Line 38: Line 38:
** Software ID: NTC/6381 DVB Demodulator
** Software ID: NTC/6381 DVB Demodulator
** Product ID: NTC/7044/BB.BCDCBCAA.x.B
** Product ID: NTC/7044/BB.BCDCBCAA.x.B
** License: '''165''' (includes Baseband Frames see below)
** License: '''165''' (includes Baseband Frames, see below)
** Communicates via I2C (<code>rmcp_i2c</code> kernel module)
** Communicates via I2C (<code>rmcp_i2c</code> kernel module)
** <code>BB</code> suffix = BaseBand licensed and capable
** <code>BB</code> suffix = BaseBand licensed and capable
Line 47: Line 47:
* '''Base Band Frames''' (BBFrames)
* '''Base Band Frames''' (BBFrames)


The control interface is '''RMCPv2 protocol''' over async serial TTL or I2C implemented by the <code>rmcp_i2c</code> kernel module.  
The control interface is '''RMCPv2 protocol''' over async serial TTL or I2C implemented by the <code>rmcp_i2c</code> kernel module.  
This is the mechanism to switch output to BBFrame mode.
This is the mechanism to switch output to BBFrame mode.


Line 58: Line 58:
=== Inputs/Outputs ===
=== Inputs/Outputs ===


* 2x RF/satellite inputs (RF1, RF2) 950–2150 MHz, 256 kSym/s – 45 MSym/s
* 2x RF/satellite inputs (RF1, RF2) - 950–2150 MHz, 256 kSym/s – 45 MSym/s
* DVB-ASI input/output (currently set to RECEIVE mode)
* DVB-ASI input/output (currently set to RECEIVE mode)
* 2x SDI outputs (SD scaling)
* 2x SDI outputs (SD scaling)
Line 64: Line 64:
* 3x Ethernet (eth0, eth1, eth2)
* 3x Ethernet (eth0, eth1, eth2)
* Serial: ttyS0 @ 115200, ttyBA
* Serial: ttyS0 @ 115200, ttyBA
* L-Band Modulator option slot '''not populated''' (<code>/dev/ntmod</code> = "No such device")
* L-Band Modulator option slot - '''not populated''' (<code>/dev/ntmod</code> = "No such device")




Line 75: Line 75:
! Partition !! Size !! Contents
! Partition !! Size !! Contents
|-
|-
| p5 || 137M || GNU sysroot gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain
| p5 || 137M || GNU sysroot - gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain
|-
|-
| p6 || 1.1M || '''Firmware''' adtec/RD-60/1.12.08 and 1.12.12
| p6 || 1.1M || '''Firmware''' - adtec/RD-60/1.12.08 and 1.12.12
|-
|-
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)
| p7 || 3.4M || Minimal initrd (busybox, bash, minimal libs)
Line 94: Line 94:
| <code>dvc/</code> || Tuner device profile files (.DVC)
| <code>dvc/</code> || Tuner device profile files (.DVC)
|-
|-
| <code>keys/</code> || Empty key material generated at runtime
| <code>keys/</code> || Empty - key material generated at runtime
|-
|-
| <code>log/</code> || Rotated system logs
| <code>log/</code> || Rotated system logs
Line 100: Line 100:
| <code>media/</code> || Media files
| <code>media/</code> || Media files
|-
|-
| <code>.meta/</code> || <code>freg.db</code> feature registry SQLite DB
| <code>.meta/</code> || <code>freg.db</code> - feature registry SQLite DB
|-
|-
| <code>mvl/</code>, <code>osd/</code>, <code>rdy/</code>, <code>schmi/</code>, <code>shd/</code> || Runtime state dirs (mostly empty)
| <code>mvl/</code>, <code>osd/</code>, <code>rdy/</code>, <code>schmi/</code>, <code>shd/</code> || Runtime state dirs (mostly empty)
Line 110: Line 110:
! Binary !! Purpose
! Binary !! Purpose
|-
|-
| <code>sysd</code> || Main system daemon tuner/demodulator config via XML
| <code>sysd</code> || Main system daemon - tuner/demodulator config via XML
|-
|-
| <code>cmdld</code> || Telnet API daemon (3 processes)
| <code>cmdld</code> || Telnet API daemon (3 processes)
Line 128: Line 128:
| <code>snmpd</code> || SNMP daemon
| <code>snmpd</code> || SNMP daemon
|-
|-
| <code>snmpl</code> || Internal SNMP poller continuously queries Newtec MIB
| <code>snmpl</code> || Internal SNMP poller - continuously queries Newtec MIB
|-
|-
| <code>vtosfifo</code> || TS-to-FIFO bridge to <code>/dev/vtosfifo4</code>
| <code>vtosfifo</code> || TS-to-FIFO bridge to <code>/dev/vtosfifo4</code>
Line 146: Line 146:
! Module !! Purpose
! Module !! Purpose
|-
|-
| <code>newtec</code> || Newtec 7044 demodulator driver core BBFrame driver
| <code>newtec</code> || Newtec 7044 demodulator driver - core BBFrame driver
|-
|-
| <code>newtec_dummy</code> || Stub for absent optional demodulator hardware
| <code>newtec_dummy</code> || Stub for absent optional demodulator hardware
|-
|-
| <code>dvblite</code> || DVB lite core (depends on newtec) exposes <code>dvblite_ioctl</code>
| <code>dvblite</code> || DVB lite core (depends on newtec) - exposes <code>dvblite_ioctl</code>
|-
|-
| <code>rmcp_i2c</code> || I2C transport for Newtec RMCP protocol
| <code>rmcp_i2c</code> || I2C transport for Newtec RMCP protocol
Line 194: Line 194:
| <code>/dev/tuner_rst0-3</code> || Tuner resets
| <code>/dev/tuner_rst0-3</code> || Tuner resets
|-
|-
| <code>/dev/ntmod</code> || Newtec modulator '''not populated'''
| <code>/dev/ntmod</code> || Newtec modulator - '''not populated'''
|}
|}


Line 241: Line 241:
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.


=== <code>/proc/driver/rddma/</code> FPGA DMA engine ===
=== <code>/proc/driver/rddma/</code> - FPGA DMA engine ===


* Channel 3 active: Control=<code>49C003C0</code>, Src=<code>03F01C00</code> (FPGA mapped)
* Channel 3 active: Control=<code>49C003C0</code>, Src=<code>03F01C00</code> (FPGA mapped)
* 3.98M timer IRQs, 3.98M "No Data" idle, no satellite IP stream
* 3.98M timer IRQs, 3.98M "No Data" - idle, no satellite IP stream
* PID <code>0x01E1</code> (481) being tracked
* PID <code>0x01E1</code> (481) being tracked


== Kernel Module Internals (<code>strings</code> analysis) ==
== Kernel Module Internals (<code>strings</code> analysis) ==


=== <code>newtec.ko</code> BBFrame symbols ===
=== <code>newtec.ko</code> - BBFrame symbols ===


<pre>
<pre>
Line 267: Line 267:
=== <code>dvblite.ko</code> ===
=== <code>dvblite.ko</code> ===


Contains <code>dvblite_ioctl</code> a kernel ioctl interface on <code>/dev/dvblite0</code>. Commands unknown to be investigated with a live signal.
Contains <code>dvblite_ioctl</code> - a kernel ioctl interface on <code>/dev/dvblite0</code>. Commands unknown to be investigated with a live signal.


== Network Services ==
== Network Services ==
Line 293: Line 293:
</syntaxhighlight>
</syntaxhighlight>


== Credentials (Default/Hardcoded ZSL-2020-5603 / ExploitDB 48954) ==
== Credentials (Default/Hardcoded - ZSL-2020-5603 / ExploitDB 48954) ==


{| class="wikitable"
{| class="wikitable"
Line 307: Line 307:
|}
|}


* Password hashes: DES crypt crackable in seconds with <code>john</code>
* Password hashes: DES crypt which is crackable in seconds with <code>john</code>
* <code>apache ALL=(ALL) NOPASSWD: ALL</code> in sudoers
* <code>apache ALL=(ALL) NOPASSWD: ALL</code> in sudoers
* Diagnostic package passphrase: '''<code>iMoo3jio</code>''' (hardcoded, leaks in <code>ps aux</code>)
* Diagnostic package passphrase: '''<code>iMoo3jio</code>''' (hardcoded, leaks in <code>ps aux</code>)
Line 328: Line 328:
</pre>
</pre>


=== SNMP Newtec Demodulator MIB ===
=== SNMP & Newtec Demodulator MIB ===


OID base: <code>.1.3.6.1.4.1.19587</code>, MIB: <code>ADTEC-NT-DEMOD-MIB</code>, community: <code>public</code>
OID base: <code>.1.3.6.1.4.1.19587</code>, MIB: <code>ADTEC-NT-DEMOD-MIB</code>, community: <code>public</code>
Line 349: Line 349:
* '''30 MSym/s''', QPSK 3/4, roll-off 35%
* '''30 MSym/s''', QPSK 3/4, roll-off 35%
* Was '''LOCKED''' at -32 dBm when saved
* Was '''LOCKED''' at -32 dBm when saved
* <code>bbCrcerrors = 1</code> '''BBFrame counter was active and non-zero!'''
* <code>bbCrcerrors = 1</code> '''BBFrame counter was active and non-zero!'''
* Likely '''Türksat 42°E'''
* Likely '''Türksat 42°E'''


Line 367: Line 367:


* '''BISS-1 key''' in <code>dtrans.xml</code>: <code>69A969BBECA0</code>
* '''BISS-1 key''' in <code>dtrans.xml</code>: <code>69A969BBECA0</code>
* '''Viaccess''' (CA ID 0x0005) feed seen in logs no card present, could not decrypt
* '''Viaccess''' (CA ID 0x0005) feed seen in logs & no card present, could not decrypt


== IP-over-Satellite ==
== IP-over-Satellite ==
Line 373: Line 373:
The unit has a full satellite IP receive stack beyond TS decoding:
The unit has a full satellite IP receive stack beyond TS decoding:


* <code>rddma_ip</code> FPGA-backed DMA for IP-from-satellite
* <code>rddma_ip</code> - FPGA-backed DMA for IP-from-satellite
* <code>ip_ingress_main</code> GSE/MPE ingress pipeline
* <code>ip_ingress_main</code> - GSE/MPE ingress pipeline
* FPGA Channel 3 active at <code>03F01C00</code>
* FPGA Channel 3 active at <code>03F01C00</code>
* Currently idle no GSE/MPE stream configured
* Currently idle - no GSE/MPE stream configured


== Security Summary ==
== Security Summary ==
Line 406: Line 406:
* LCD API in <code>libsolib.so</code>: <code>FpLcdKpInit()</code>, <code>LcdClear()</code>, <code>LcdWriteStr(char*, pos, len)</code>
* LCD API in <code>libsolib.so</code>: <code>FpLcdKpInit()</code>, <code>LcdClear()</code>, <code>LcdWriteStr(char*, pos, len)</code>
* Writing to <code>/dev/frpanel2</code> activates the backlight
* Writing to <code>/dev/frpanel2</code> activates the backlight
* <code>menud</code> daemon owns the display must be stopped before direct writes
* <code>menud</code> daemon owns the display - must be stopped before direct writes
* Proc interface: <code>/proc/driver/frpanel/</code> (rows, cols, screen, type, version, access)
* Proc interface: <code>/proc/driver/frpanel/</code> (rows, cols, screen, type, version, access)


Line 443: Line 443:
== TODO (requires dish connected) ==
== TODO (requires dish connected) ==


* [ ] Read <code>/proc/driver/dvblite/fe0/stats</code> with live signal observe all BB* fields
* [ ] Read <code>/proc/driver/dvblite/fe0/stats</code> with live signal - observe all BB* fields
* [ ] SNMP walk full <code>.1.3.6.1.4.1.19587</code> with live signal
* [ ] SNMP walk full <code>.1.3.6.1.4.1.19587</code> with live signal
* [ ] Investigate <code>dvblite_ioctl</code> on <code>/dev/dvblite0</code>
* [ ] Investigate <code>dvblite_ioctl</code> on <code>/dev/dvblite0</code>
Line 452: Line 452:
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)
* [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)
* [ ] Explore Telnet API <code>*.NTC</code> command namespace
* [ ] Explore Telnet API <code>*.NTC</code> command namespace
* [ ] Investigate <code>xcpServerd</code>/<code>xcpClientd</code> XCP protocol capabilities
* [ ] Investigate <code>xcpServerd</code>/<code>xcpClientd</code> XCP protocol capabilities
* [ ] Check if <code>schnv.DVC</code> populates after a lock (empty offline)
* [ ] Check if <code>schnv.DVC</code> populates after a lock (empty offline)
* [ ] Read <code>freg.db</code> contents full feature registry dump
* [ ] Read <code>freg.db</code> contents, full feature registry dump
* [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call <code>LcdWriteStr()</code> from <code>libsolib.so</code>
* [ ] Send RMCP command via <code>rmcp_i2c</code> to switch NTC/7044/BB output to BBFrame mode
* [ ] Send RMCP command via <code>rmcp_i2c</code> to switch NTC/7044/BB output to BBFrame mode


== Links ==  
== Links ==  
- [https://www.tonercable.com/pdf/RD-60_Manual.pdf manual]
- [https://www.tonercable.com/pdf/RD-60_Manual.pdf manual]

Latest revision as of 19:33, 14 April 2026

Adtec RD-60
Adtec RD-60.jpg
Participants Melan
Skills
Status Active
Niche Sdr
Purpose
Tool No
Location the roof
Cost
Tool category

Adtec RD-60 Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:No | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:No | [[Tool Cost::{{{Cost}}} | }}

Adtec RD-60 IRD

The Adtec RD-60 is a 1RU integrated receiver/decoder (IRD).

It seems the Adtec RD-60 might expose DVB-S2 baseband frames (BBFrames) below the TS layer, this might be very useful as part of the dontlookup satellite interception paper replication project. See dontlookup

Reverse Engineering Notes

Hardware

Adtec rd60 internals overview.jpg

Main Unit

  • Model: Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)
  • Hostname: GOFFERT
  • IP: 10.1.2.172 (DHCP)
  • CPU: IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)
  • PLB bus: 133 MHz | PCI bus: 33 MHz
  • Kernel: Linux 2.6.14-gemppc-iolite
  • Front panel: Character LCD/VFD, text only, ~40 chars wide.
  • Storage: CompactFlash card (8 partitions, 4 used)

It seems that the hardware doesn't do blind scan, but scripted sequential tuning might be a workaround?

Demodulator Board

  • Slot 2: BA14 - PC87 ver 1.4 (main decoder board)
  • Slot 99: 7044BB - Newtec NTC/7044/BB DVB Demodulator
    • PRM firmware: v2.34 (20/03/13)
    • FPGA bitfile: v1.01 (09/01/12)
    • Hardware: v3.0
    • Serial: 30091216
    • Software ID: NTC/6381 DVB Demodulator
    • Product ID: NTC/7044/BB.BCDCBCAA.x.B
    • License: 165 (includes Baseband Frames, see below)
    • Communicates via I2C (rmcp_i2c kernel module)
    • BB suffix = BaseBand licensed and capable

According to the official Newtec datasheet, the NTC/7044/BB supports explicit output mode switching between:

  • Single transport stream
  • Generic stream
  • Base Band Frames (BBFrames)

The control interface is RMCPv2 protocol over async serial TTL or I2C implemented by the rmcp_i2c kernel module. This is the mechanism to switch output to BBFrame mode.

See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf

RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf

20250429 153804.jpg

Inputs/Outputs

  • 2x RF/satellite inputs (RF1, RF2) - 950–2150 MHz, 256 kSym/s – 45 MSym/s
  • DVB-ASI input/output (currently set to RECEIVE mode)
  • 2x SDI outputs (SD scaling)
  • CVBS output
  • 3x Ethernet (eth0, eth1, eth2)
  • Serial: ttyS0 @ 115200, ttyBA
  • L-Band Modulator option slot - not populated (/dev/ntmod = "No such device")


Firmware / Software

CF Card Partition Layout

Partition Size Contents
p5 137M GNU sysroot - gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain
p6 1.1M Firmware - adtec/RD-60/1.12.08 and 1.12.12
p7 3.4M Minimal initrd (busybox, bash, minimal libs)
p8 24M Runtime/data (logs, DVC profiles, media)
  • Current firmware: 1.12.12 (symlinked at /opt/pkg/oem)
  • Previous firmware: 1.12.08 (symlinked at /opt/pkg/oem_prev)

p8 Runtime Directories

Dir Purpose
dvc/ Tuner device profile files (.DVC)
keys/ Empty - key material generated at runtime
log/ Rotated system logs
media/ Media files
.meta/ freg.db - feature registry SQLite DB
mvl/, osd/, rdy/, schmi/, shd/ Runtime state dirs (mostly empty)

Key Binaries (/usr/local/sbin/)

Binary Purpose
sysd Main system daemon - tuner/demodulator config via XML
cmdld Telnet API daemon (3 processes)
menud Front panel menu daemon
fregd Feature/license registry daemon
dtrans TS transport handler (--slot=2 --id=BA14)
dcmd Device command interface for BA14
myles Web API backend (SQLite)
requestHandler Apache CGI/FastCGI handler
snmpd SNMP daemon
snmpl Internal SNMP poller - continuously queries Newtec MIB
vtosfifo TS-to-FIFO bridge to /dev/vtosfifo4
xcpServerd/xcpClientd XCP protocol daemons (3 each)
pard Parallel interface daemon
pnpd PnP device daemon
mirror Mirror/redundancy daemon (runs as adtec)

Kernel Modules

Module Purpose
newtec Newtec 7044 demodulator driver - core BBFrame driver
newtec_dummy Stub for absent optional demodulator hardware
dvblite DVB lite core (depends on newtec) - exposes dvblite_ioctl
rmcp_i2c I2C transport for Newtec RMCP protocol
vtosfifo TS FIFO device driver
rddma_ip IP-over-satellite receive DMA engine (FPGA-backed)
ip_ingress_main IP ingress pipeline (GSE/MPE over satellite)
frpanel Front panel driver
fanctrl / pc96 Fan controller
proxyimg Image proxy
epb EPB bus driver
pnp PnP device manager
fec / ethfrm Ethernet/FEC
pc73a / pc93 Front panel dependencies

Failed to load (hardware absent): teamcast, nim, lnb_pwr, pc72

Device Nodes

Device Purpose
/dev/dvblite0-2 DVB lite interfaces
/dev/vtosfifo0-5 TS FIFO char devices (major 240)
/dev/tuner0-3 Tuner interfaces (major 123)
/dev/tuner_ledgr0-3 Tuner lock (green) LEDs
/dev/tuner_ledrd0-3 Tuner read LEDs
/dev/tuner_rst0-3 Tuner resets
/dev/ntmod Newtec modulator - not populated

/proc Driver Interfaces

/proc/driver/dvblite/fe0/info

NAME=NTC/7044/BB DVB Demodulator
FREQ_MIN=950000 / FREQ_MAX=2150000
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO
S_8PSK=2/3, 5/6, 8/9, AUTO
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10
S2_16QAM=3/4, 7/8, AUTO
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10
SOFTWARE_LICENSE=165
SOFTWARE_VERSION=v2.34   20/03/13
FPGA_BITFILE_VERSION=v1.01 09/01/12
HARDWARE_VERSION=v3.0
SERIAL_NUM=30091216

/proc/driver/dvblite/fe0/stats (no signal)

LOCK=UNLOCKED
RECV_LEVEL=-70.00
INTRATE=41470588
MOD_FEC=QPSK_3/4
BB_CRC_ERRORS=N/A        <- populates with live signal
DUMMY_PL_RATIO=N/A       <- populates with live signal
ISI_FILTER_BYTE=N/A      <- populates with live signal
BASEBAND_LEN=N/A         <- populates with live signal
FRAMES_SEC=N/A           <- populates with live signal
ALARMS=0000110001011000
STATE=READY

fe1 has same structure but NAME=NTC7044 (no BB suffix, no license).

/proc/driver/vtosfifo/chn

Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.

/proc/driver/rddma/ - FPGA DMA engine

  • Channel 3 active: Control=49C003C0, Src=03F01C00 (FPGA mapped)
  • 3.98M timer IRQs, 3.98M "No Data" - idle, no satellite IP stream
  • PID 0x01E1 (481) being tracked

Kernel Module Internals (strings analysis)

newtec.ko - BBFrame symbols

BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT
BB_FRAMES
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT
BASEBAND_LEN
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS
ISI_FILTER_BYTE / ISI_MASK
SAT_BB_GAIN
ntc_debug  (module param, uint)

BB_DATA_FIELD_LEN and BB_FRAMES suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.

dvblite.ko

Contains dvblite_ioctl - a kernel ioctl interface on /dev/dvblite0. Commands unknown to be investigated with a live signal.

Network Services

Service Port Notes
SSH 22 Legacy KEX only (diffie-hellman-group1-sha1)
Telnet API 23 cmdld via xinetd
FTP 21 pure-ftpd
HTTP 80 Apache + myles + requestHandler
SNMP 161 Community public
mDNS 5353 GOFFERT.local
# SSH/SCP
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>:/path /local

Credentials (Default/Hardcoded - ZSL-2020-5603 / ExploitDB 48954)

User Password Notes
root 1root! Full root SSH
admin 1admin! Also root via sudoers
adtec none Telnet API / web UI
adtecftp adtecftp2231 FTP only
  • Password hashes: DES crypt which is crackable in seconds with john
  • apache ALL=(ALL) NOPASSWD: ALL in sudoers
  • Diagnostic package passphrase: iMoo3jio (hardcoded, leaks in ps aux)
gpg --passphrase "iMoo3jio" --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -

APIs

Telnet API

Connect: telnet <ip>, login adtec/none

*.SYSD SHELLCMD <cmd>          # arbitrary root shell execution!
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply

SNMP & Newtec Demodulator MIB

OID base: .1.3.6.1.4.1.19587, MIB: ADTEC-NT-DEMOD-MIB, community: public

snmpwalk -v2c -c public <ip> .1.3.6.1.4.1.19587

Key OIDs: tunerLock, recvLevel, esNo, linkMargin, modFec, rolloff, pilot, fecFrameType, unCorrFs, bbCrcerrors, basebandLen, dummyPlRatio, isiFilterByte, framesSec, satFeedType, satFeedDownlink, satFeedSymRate, satFeedModulation, lnbEnable, lnbPolarity, lnbTone

DVC Profile Format

SNMP SET commands as tuner presets, applied via Telnet API or web UI.

Saved Tuner Profiles

prfturktest.DVC (2018-04-28)

  • DVB-S, 10762 MHz, KU 9750 LO → 1012 MHz L-band
  • 30 MSym/s, QPSK 3/4, roll-off 35%
  • Was LOCKED at -32 dBm when saved
  • bbCrcerrors = 1 BBFrame counter was active and non-zero!
  • Likely Türksat 42°E

prfMUX.DVC (2018-04-28)

  • DVB-S2, 10960 MHz, KU 9750 LO → 1210 MHz L-band
  • 8.352 MSym/s, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM
  • Was unlocked when saved

Licensed Features (Key ID 165)

DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate <= 33 MBaud + ACM + Single TS/GS or Multiple Streams + (Baseband Frames) + no ACM client + no AES

BBFrame access is explicitly licensed and enabled.

Encryption / CA

  • BISS-1 key in dtrans.xml: 69A969BBECA0
  • Viaccess (CA ID 0x0005) feed seen in logs & no card present, could not decrypt

IP-over-Satellite

The unit has a full satellite IP receive stack beyond TS decoding:

  • rddma_ip - FPGA-backed DMA for IP-from-satellite
  • ip_ingress_main - GSE/MPE ingress pipeline
  • FPGA Channel 3 active at 03F01C00
  • Currently idle - no GSE/MPE stream configured

Security Summary

Issue Detail
Default root creds root/1root! over SSH
Telnet RCE *.SYSD SHELLCMD = root shell with adtec/none
Sudoers apache ALL=(ALL) NOPASSWD: ALL
Shared SSH host keys Same across all units (stored on CF card)
Weak password hashes DES crypt, trivially crackable
GPG passphrase leak iMoo3jio visible in ps aux
Public exploit ZSL-2020-5603 / ExploitDB 48954

Other

Front Panel

  • Driver: frpanel.ko (depends on pc93, pc73a)
  • Device nodes: /dev/frpanel0, /dev/frpanel1, /dev/frpanel2
  • Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)
  • LCD API in libsolib.so: FpLcdKpInit(), LcdClear(), LcdWriteStr(char*, pos, len)
  • Writing to /dev/frpanel2 activates the backlight
  • menud daemon owns the display - must be stopped before direct writes
  • Proc interface: /proc/driver/frpanel/ (rows, cols, screen, type, version, access)

IP Reception

The RD-60 supports multiple IP-based protocols for receiving transport streams:

Protocol Max throughput Notes
UDP (unicast/multicast) 100 Mbps 7 DVB packets per UDP packet. No packet loss protection. Not recommended over public internet.
RTP (unicast/multicast) 100 Mbps 7 DVB packets per RTP packet. Adds packet sequencing for out-of-order correction.
RTP + FEC (SMPTE-2022) 45 Mbps FEC streams on base port N, with two FEC streams on N+2 and N+4. Handles lost packets at cost of latency/overhead.
TCP (unicast only) 15 Mbps No multicast support. Higher latency but reliable delivery. Recently added.

The RD-60 automatically detects whether an incoming stream is UDP, RTP, or SMPTE-2022 FEC. TCP must be explicitly configured.

The default mode is UDP/RTP. Switching between UDP/RTP and TCP requires a unit reboot. FEC streams require ports N+2 and N+4 to be open in addition to the base port N.

Our unit was observed configured for UDP multicast at 224.0.0.5:5520 (see dtrans.xml).

Images

TODO (requires dish connected)

  • [ ] Read /proc/driver/dvblite/fe0/stats with live signal - observe all BB* fields
  • [ ] SNMP walk full .1.3.6.1.4.1.19587 with live signal
  • [ ] Investigate dvblite_ioctl on /dev/dvblite0
  • [ ] Enable ntc_debug module param and watch dmesg
  • [ ] Try ISI multistream filtering via SNMP SET
  • [ ] Investigate rddma_ip with GSE/MPE satellite signal
  • [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)
  • [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)
  • [ ] Explore Telnet API *.NTC command namespace
  • [ ] Investigate xcpServerd/xcpClientd XCP protocol capabilities
  • [ ] Check if schnv.DVC populates after a lock (empty offline)
  • [ ] Read freg.db contents, full feature registry dump
  • [ ] Send RMCP command via rmcp_i2c to switch NTC/7044/BB output to BBFrame mode

Links

- manual