Adtec RD-60: Difference between revisions
No edit summary |
No edit summary |
||
| Line 12: | Line 12: | ||
= Reverse Engineering Notes = | = Reverse Engineering Notes = | ||
== Hardware == | == Hardware == | ||
[[File:Adtec_rd60_internals_overview.jpg|thumb|center]] | [[File:Adtec_rd60_internals_overview.jpg|thumb|center]] | ||
| Line 24: | Line 25: | ||
* '''Front panel:''' Character LCD/VFD — text only, ~40 chars wide. | * '''Front panel:''' Character LCD/VFD — text only, ~40 chars wide. | ||
* '''Storage:''' CompactFlash card (8 partitions, 4 used) | * '''Storage:''' CompactFlash card (8 partitions, 4 used) | ||
It seems that the hardware doesn't do blind scan, but scripted sequential tuning might be a workaround? | |||
=== Demodulator Board === | === Demodulator Board === | ||
| Line 48: | Line 51: | ||
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf | See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf | ||
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf | RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf | ||
Revision as of 01:35, 12 April 2026
| Adtec RD-60 | |
|---|---|
| Participants | Melan |
| Skills | |
| Status | Active |
| Niche | Sdr |
| Purpose | |
| Tool | No |
| Location | the roof |
| Cost | |
| Tool category | |
Adtec RD-60 Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:No | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:No | [[Tool Cost::{{{Cost}}} | }}
Adtec RD-60 IRD
The Adtec RD-60 is a 1RU integrated receiver/decoder (IRD).
It seems the Adtec RD-60 might expose DVB-S2 baseband frames (BBFrames) below the TS layer, this might be very useful as part of the dontlookup satellite interception paper replication project. See dontlookup
Reverse Engineering Notes
Hardware
Main Unit
- Model: Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)
- Hostname:
GOFFERT - IP: 10.1.2.172 (DHCP)
- CPU: IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)
- PLB bus: 133 MHz | PCI bus: 33 MHz
- Kernel: Linux 2.6.14-gemppc-iolite
- Front panel: Character LCD/VFD — text only, ~40 chars wide.
- Storage: CompactFlash card (8 partitions, 4 used)
It seems that the hardware doesn't do blind scan, but scripted sequential tuning might be a workaround?
Demodulator Board
- Slot 2:
BA14— PC87 ver 1.4 (main decoder board) - Slot 99:
7044BB— Newtec NTC/7044/BB DVB Demodulator- PRM firmware: v2.34 (20/03/13)
- FPGA bitfile: v1.01 (09/01/12)
- Hardware: v3.0
- Serial: 30091216
- Software ID: NTC/6381 DVB Demodulator
- Product ID: NTC/7044/BB.BCDCBCAA.x.B
- License: 165 (includes Baseband Frames — see below)
- Communicates via I2C (
rmcp_i2ckernel module) BBsuffix = BaseBand licensed and capable
According to the official Newtec datasheet, the NTC/7044/BB supports explicit output mode switching between:
- Single transport stream
- Generic stream
- Base Band Frames (BBFrames)
The control interface is RMCPv2 protocol over async serial TTL or I2C — implemented by the rmcp_i2c kernel module.
This is the mechanism to switch output to BBFrame mode.
See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf
RMCP protocol docs: https://newerasystems.net/wp-content/uploads/2017/02/RMCP-Manual-1_8.pdf
Inputs/Outputs
- 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s
- DVB-ASI input/output (currently set to RECEIVE mode)
- 2x SDI outputs (SD scaling)
- CVBS output
- 3x Ethernet (eth0, eth1, eth2)
- Serial: ttyS0 @ 115200, ttyBA
- L-Band Modulator option slot — not populated (
/dev/ntmod= "No such device")
Firmware / Software
CF Card Partition Layout
| Partition | Size | Contents |
|---|---|---|
| p5 | 137M | GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain |
| p6 | 1.1M | Firmware — adtec/RD-60/1.12.08 and 1.12.12 |
| p7 | 3.4M | Minimal initrd (busybox, bash, minimal libs) |
| p8 | 24M | Runtime/data (logs, DVC profiles, media) |
- Current firmware: 1.12.12 (symlinked at
/opt/pkg/oem) - Previous firmware: 1.12.08 (symlinked at
/opt/pkg/oem_prev)
p8 Runtime Directories
| Dir | Purpose |
|---|---|
dvc/ |
Tuner device profile files (.DVC) |
keys/ |
Empty — key material generated at runtime |
log/ |
Rotated system logs |
media/ |
Media files |
.meta/ |
freg.db — feature registry SQLite DB
|
mvl/, osd/, rdy/, schmi/, shd/ |
Runtime state dirs (mostly empty) |
Key Binaries (/usr/local/sbin/)
| Binary | Purpose |
|---|---|
sysd |
Main system daemon — tuner/demodulator config via XML |
cmdld |
Telnet API daemon (3 processes) |
menud |
Front panel menu daemon |
fregd |
Feature/license registry daemon |
dtrans |
TS transport handler (--slot=2 --id=BA14)
|
dcmd |
Device command interface for BA14 |
myles |
Web API backend (SQLite) |
requestHandler |
Apache CGI/FastCGI handler |
snmpd |
SNMP daemon |
snmpl |
Internal SNMP poller — continuously queries Newtec MIB |
vtosfifo |
TS-to-FIFO bridge to /dev/vtosfifo4
|
xcpServerd/xcpClientd |
XCP protocol daemons (3 each) |
pard |
Parallel interface daemon |
pnpd |
PnP device daemon |
mirror |
Mirror/redundancy daemon (runs as adtec) |
Kernel Modules
| Module | Purpose |
|---|---|
newtec |
Newtec 7044 demodulator driver — core BBFrame driver |
newtec_dummy |
Stub for absent optional demodulator hardware |
dvblite |
DVB lite core (depends on newtec) — exposes dvblite_ioctl
|
rmcp_i2c |
I2C transport for Newtec RMCP protocol |
vtosfifo |
TS FIFO device driver |
rddma_ip |
IP-over-satellite receive DMA engine (FPGA-backed) |
ip_ingress_main |
IP ingress pipeline (GSE/MPE over satellite) |
frpanel |
Front panel driver |
fanctrl / pc96 |
Fan controller |
proxyimg |
Image proxy |
epb |
EPB bus driver |
pnp |
PnP device manager |
fec / ethfrm |
Ethernet/FEC |
pc73a / pc93 |
Front panel dependencies |
Failed to load (hardware absent): teamcast, nim, lnb_pwr, pc72
Device Nodes
| Device | Purpose |
|---|---|
/dev/dvblite0-2 |
DVB lite interfaces |
/dev/vtosfifo0-5 |
TS FIFO char devices (major 240) |
/dev/tuner0-3 |
Tuner interfaces (major 123) |
/dev/tuner_ledgr0-3 |
Tuner lock (green) LEDs |
/dev/tuner_ledrd0-3 |
Tuner read LEDs |
/dev/tuner_rst0-3 |
Tuner resets |
/dev/ntmod |
Newtec modulator — not populated |
/proc Driver Interfaces
/proc/driver/dvblite/fe0/info
NAME=NTC/7044/BB DVB Demodulator FREQ_MIN=950000 / FREQ_MAX=2150000 SYMRATE_MIN=256000 / SYMRATE_MAX=45000000 S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO S_8PSK=2/3, 5/6, 8/9, AUTO S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10 S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10 S2_16QAM=3/4, 7/8, AUTO S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10 S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10 SOFTWARE_LICENSE=165 SOFTWARE_VERSION=v2.34 20/03/13 FPGA_BITFILE_VERSION=v1.01 09/01/12 HARDWARE_VERSION=v3.0 SERIAL_NUM=30091216
/proc/driver/dvblite/fe0/stats (no signal)
LOCK=UNLOCKED RECV_LEVEL=-70.00 INTRATE=41470588 MOD_FEC=QPSK_3/4 BB_CRC_ERRORS=N/A <- populates with live signal DUMMY_PL_RATIO=N/A <- populates with live signal ISI_FILTER_BYTE=N/A <- populates with live signal BASEBAND_LEN=N/A <- populates with live signal FRAMES_SEC=N/A <- populates with live signal ALARMS=0000110001011000 STATE=READY
fe1 has same structure but NAME=NTC7044 (no BB suffix, no license).
/proc/driver/vtosfifo/chn
Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.
/proc/driver/rddma/ — FPGA DMA engine
- Channel 3 active: Control=
49C003C0, Src=03F01C00(FPGA mapped) - 3.98M timer IRQs, 3.98M "No Data" — idle, no satellite IP stream
- PID
0x01E1(481) being tracked
Kernel Module Internals (strings analysis)
newtec.ko — BBFrame symbols
BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT BB_FRAMES BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT BASEBAND_LEN ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS ISI_FILTER_BYTE / ISI_MASK SAT_BB_GAIN ntc_debug (module param, uint)
BB_DATA_FIELD_LEN and BB_FRAMES suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.
dvblite.ko
Contains dvblite_ioctl — a kernel ioctl interface on /dev/dvblite0. Commands unknown — to be investigated with a live signal.
Network Services
| Service | Port | Notes |
|---|---|---|
| SSH | 22 | Legacy KEX only (diffie-hellman-group1-sha1) |
| Telnet API | 23 | cmdld via xinetd
|
| FTP | 21 | pure-ftpd |
| HTTP | 80 | Apache + myles + requestHandler |
| SNMP | 161 | Community public
|
| mDNS | 5353 | GOFFERT.local
|
# SSH/SCP
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>:/path /local
Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954)
| User | Password | Notes |
|---|---|---|
root |
1root! |
Full root SSH |
admin |
1admin! |
Also root via sudoers |
adtec |
none |
Telnet API / web UI |
adtecftp |
adtecftp2231 |
FTP only |
- Password hashes: DES crypt — crackable in seconds with
john apache ALL=(ALL) NOPASSWD: ALLin sudoers- Diagnostic package passphrase:
iMoo3jio(hardcoded, leaks inps aux)
gpg --passphrase "iMoo3jio" --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -
APIs
Telnet API
Connect: telnet <ip>, login adtec/none
*.SYSD SHELLCMD <cmd> # arbitrary root shell execution! *.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2 # configure tuner *.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000 *.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0 # commit/apply
SNMP — Newtec Demodulator MIB
OID base: .1.3.6.1.4.1.19587, MIB: ADTEC-NT-DEMOD-MIB, community: public
snmpwalk -v2c -c public <ip> .1.3.6.1.4.1.19587
Key OIDs: tunerLock, recvLevel, esNo, linkMargin, modFec, rolloff, pilot, fecFrameType, unCorrFs, bbCrcerrors, basebandLen, dummyPlRatio, isiFilterByte, framesSec, satFeedType, satFeedDownlink, satFeedSymRate, satFeedModulation, lnbEnable, lnbPolarity, lnbTone
DVC Profile Format
SNMP SET commands as tuner presets, applied via Telnet API or web UI.
Saved Tuner Profiles
prfturktest.DVC (2018-04-28)
- DVB-S, 10762 MHz, KU 9750 LO → 1012 MHz L-band
- 30 MSym/s, QPSK 3/4, roll-off 35%
- Was LOCKED at -32 dBm when saved
bbCrcerrors = 1— BBFrame counter was active and non-zero!- Likely Türksat 42°E
prfMUX.DVC (2018-04-28)
- DVB-S2, 10960 MHz, KU 9750 LO → 1210 MHz L-band
- 8.352 MSym/s, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM
- Was unlocked when saved
Licensed Features (Key ID 165)
DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate <= 33 MBaud + ACM + Single TS/GS or Multiple Streams + (Baseband Frames) + no ACM client + no AES
BBFrame access is explicitly licensed and enabled.
Encryption / CA
- BISS-1 key in
dtrans.xml:69A969BBECA0 - Viaccess (CA ID 0x0005) feed seen in logs — no card present, could not decrypt
IP-over-Satellite
The unit has a full satellite IP receive stack beyond TS decoding:
rddma_ip— FPGA-backed DMA for IP-from-satelliteip_ingress_main— GSE/MPE ingress pipeline- FPGA Channel 3 active at
03F01C00 - Currently idle — no GSE/MPE stream configured
Security Summary
| Issue | Detail |
|---|---|
| Default root creds | root/1root! over SSH
|
| Telnet RCE | *.SYSD SHELLCMD = root shell with adtec/none
|
| Sudoers | apache ALL=(ALL) NOPASSWD: ALL
|
| Shared SSH host keys | Same across all units (stored on CF card) |
| Weak password hashes | DES crypt, trivially crackable |
| GPG passphrase leak | iMoo3jio visible in ps aux
|
| Public exploit | ZSL-2020-5603 / ExploitDB 48954 |
Other
Front Panel
- Driver:
frpanel.ko(depends onpc93,pc73a) - Device nodes:
/dev/frpanel0,/dev/frpanel1,/dev/frpanel2 - Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)
- LCD API in
libsolib.so:FpLcdKpInit(),LcdClear(),LcdWriteStr(char*, pos, len) - Writing to
/dev/frpanel2activates the backlight menuddaemon owns the display — must be stopped before direct writes- Proc interface:
/proc/driver/frpanel/(rows, cols, screen, type, version, access)
Images
TODO (requires dish connected)
- [ ] Read
/proc/driver/dvblite/fe0/statswith live signal — observe all BB* fields - [ ] SNMP walk full
.1.3.6.1.4.1.19587with live signal - [ ] Investigate
dvblite_ioctlon/dev/dvblite0 - [ ] Enable
ntc_debugmodule param and watch dmesg - [ ] Try ISI multistream filtering via SNMP SET
- [ ] Investigate
rddma_ipwith GSE/MPE satellite signal - [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)
- [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)
- [ ] Explore Telnet API
*.NTCcommand namespace - [ ] Investigate
xcpServerd/xcpClientd— XCP protocol capabilities - [ ] Check if
schnv.DVCpopulates after a lock (empty offline) - [ ] Read
freg.dbcontents — full feature registry dump - [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call
LcdWriteStr()fromlibsolib.so - [ ] Send RMCP command via
rmcp_i2cto switch NTC/7044/BB output to BBFrame mode