Adtec RD-60

From NURDspace
Revision as of 01:18, 12 April 2026 by Buzz (talk | contribs) (→‎Hardware)
Jump to navigation Jump to search
Adtec RD-60
Adtec RD-60.jpg
Participants Melan
Skills
Status Active
Niche Sdr
Purpose
Tool No
Location the roof
Cost
Tool category

Adtec RD-60 Property "Tool Image" (as page type) with input value "File:{{{Picture}}}" contains invalid characters or is incomplete and therefore can cause unexpected results during a query or annotation process. {{{Picture}}} {{#if:No | [[Tool Owner::{{{ProjectParticipants}}} | }} {{#if:No | [[Tool Cost::{{{Cost}}} | }}

Adtec RD-60 IRD

The Adtec RD-60 is a 1RU integrated receiver/decoder (IRD).

It seems the Adtec RD-60 might expose DVB-S2 baseband frames (BBFrames) below the TS layer, this might be very useful as part of the dontlookup satellite interception paper replication project. See dontlookup

Reverse Engineering Notes

Hardware

Adtec rd60 internals overview.jpg

Main Unit

  • Model: Adtec RD-60 MultiCODEC Receiver/Decoder (IRD)
  • Hostname: GOFFERT
  • IP: 10.1.2.172 (DHCP)
  • CPU: IBM PowerPC PPC405GPr @ 399 MHz (GemPPC Iolite platform)
  • PLB bus: 133 MHz | PCI bus: 33 MHz
  • Kernel: Linux 2.6.14-gemppc-iolite
  • Front panel: Character LCD/VFD — text only, ~40 chars wide.
  • Storage: CompactFlash card (8 partitions, 4 used)

Demodulator Board

  • Slot 2: BA14 — PC87 ver 1.4 (main decoder board)
  • Slot 99: 7044BBNewtec NTC/7044/BB DVB Demodulator
    • PRM firmware: v2.34 (20/03/13)
    • FPGA bitfile: v1.01 (09/01/12)
    • Hardware: v3.0
    • Serial: 30091216
    • Software ID: NTC/6381 DVB Demodulator
    • Product ID: NTC/7044/BB.BCDCBCAA.x.B
    • License: 165 (includes Baseband Frames — see below)
    • Communicates via I2C (rmcp_i2c kernel module)
    • BB suffix = BaseBand licensed and capable

According to the official Newtec datasheet, the NTC/7044/BB supports explicit output mode switching between:

  • Single transport stream
  • Generic stream
  • Base Band Frames (BBFrames)

The control interface is RMCPv2 protocol over async serial TTL or I2C — implemented by the rmcp_i2c kernel module. This is the mechanism to switch output to BBFrame mode.

See also this PDF: https://www.melcom.co.uk/uploads/newdvbdemodntc7044_01.pdf

20250429 153804.jpg

Inputs/Outputs

  • 2x RF/satellite inputs (RF1, RF2) — 950–2150 MHz, 256 kSym/s – 45 MSym/s
  • DVB-ASI input/output (currently set to RECEIVE mode)
  • 2x SDI outputs (SD scaling)
  • CVBS output
  • 3x Ethernet (eth0, eth1, eth2)
  • Serial: ttyS0 @ 115200, ttyBA
  • L-Band Modulator option slot — not populated (/dev/ntmod = "No such device")

Firmware / Software

CF Card Partition Layout

Partition Size Contents
p5 137M GNU sysroot — gcc-3.4.4 / glibc-2.3.5, PPC cross toolchain
p6 1.1M Firmware — adtec/RD-60/1.12.08 and 1.12.12
p7 3.4M Minimal initrd (busybox, bash, minimal libs)
p8 24M Runtime/data (logs, DVC profiles, media)
  • Current firmware: 1.12.12 (symlinked at /opt/pkg/oem)
  • Previous firmware: 1.12.08 (symlinked at /opt/pkg/oem_prev)

p8 Runtime Directories

Dir Purpose
dvc/ Tuner device profile files (.DVC)
keys/ Empty — key material generated at runtime
log/ Rotated system logs
media/ Media files
.meta/ freg.db — feature registry SQLite DB
mvl/, osd/, rdy/, schmi/, shd/ Runtime state dirs (mostly empty)

Key Binaries (/usr/local/sbin/)

Binary Purpose
sysd Main system daemon — tuner/demodulator config via XML
cmdld Telnet API daemon (3 processes)
menud Front panel menu daemon
fregd Feature/license registry daemon
dtrans TS transport handler (--slot=2 --id=BA14)
dcmd Device command interface for BA14
myles Web API backend (SQLite)
requestHandler Apache CGI/FastCGI handler
snmpd SNMP daemon
snmpl Internal SNMP poller — continuously queries Newtec MIB
vtosfifo TS-to-FIFO bridge to /dev/vtosfifo4
xcpServerd/xcpClientd XCP protocol daemons (3 each)
pard Parallel interface daemon
pnpd PnP device daemon
mirror Mirror/redundancy daemon (runs as adtec)

Kernel Modules

Module Purpose
newtec Newtec 7044 demodulator driver — core BBFrame driver
newtec_dummy Stub for absent optional demodulator hardware
dvblite DVB lite core (depends on newtec) — exposes dvblite_ioctl
rmcp_i2c I2C transport for Newtec RMCP protocol
vtosfifo TS FIFO device driver
rddma_ip IP-over-satellite receive DMA engine (FPGA-backed)
ip_ingress_main IP ingress pipeline (GSE/MPE over satellite)
frpanel Front panel driver
fanctrl / pc96 Fan controller
proxyimg Image proxy
epb EPB bus driver
pnp PnP device manager
fec / ethfrm Ethernet/FEC
pc73a / pc93 Front panel dependencies

Failed to load (hardware absent): teamcast, nim, lnb_pwr, pc72

Device Nodes

Device Purpose
/dev/dvblite0-2 DVB lite interfaces
/dev/vtosfifo0-5 TS FIFO char devices (major 240)
/dev/tuner0-3 Tuner interfaces (major 123)
/dev/tuner_ledgr0-3 Tuner lock (green) LEDs
/dev/tuner_ledrd0-3 Tuner read LEDs
/dev/tuner_rst0-3 Tuner resets
/dev/ntmod Newtec modulator — not populated

/proc Driver Interfaces

/proc/driver/dvblite/fe0/info

NAME=NTC/7044/BB DVB Demodulator
FREQ_MIN=950000 / FREQ_MAX=2150000
SYMRATE_MIN=256000 / SYMRATE_MAX=45000000
S_QPSK=1/2, 2/3, 3/4, 5/6, 6/7, 7/8, AUTO
S_8PSK=2/3, 5/6, 8/9, AUTO
S2_QPSK=1/4, 1/3, 1/2, 2/5, 2/3, 3/5, 3/4, 4/5, 5/6, 8/9, 9/10
S2_8PSK=2/3, 3/5, 3/4, 5/6, 8/9, 9/10
S2_16QAM=3/4, 7/8, AUTO
S2_16APSK=2/3, 3/4, 4/5, 5/6, 8/9, 9/10
S2_32APSK=3/4, 4/5, 5/6, 8/9, 9/10
SOFTWARE_LICENSE=165
SOFTWARE_VERSION=v2.34   20/03/13
FPGA_BITFILE_VERSION=v1.01 09/01/12
HARDWARE_VERSION=v3.0
SERIAL_NUM=30091216

/proc/driver/dvblite/fe0/stats (no signal)

LOCK=UNLOCKED
RECV_LEVEL=-70.00
INTRATE=41470588
MOD_FEC=QPSK_3/4
BB_CRC_ERRORS=N/A        <- populates with live signal
DUMMY_PL_RATIO=N/A       <- populates with live signal
ISI_FILTER_BYTE=N/A      <- populates with live signal
BASEBAND_LEN=N/A         <- populates with live signal
FRAMES_SEC=N/A           <- populates with live signal
ALARMS=0000110001011000
STATE=READY

fe1 has same structure but NAME=NTC7044 (no BB suffix, no license).

/proc/driver/vtosfifo/chn

Channel 0 processed 16620 TS frames during session. Channel 4 processed 1619.

/proc/driver/rddma/ — FPGA DMA engine

  • Channel 3 active: Control=49C003C0, Src=03F01C00 (FPGA mapped)
  • 3.98M timer IRQs, 3.98M "No Data" — idle, no satellite IP stream
  • PID 0x01E1 (481) being tracked

Kernel Module Internals (strings analysis)

newtec.ko — BBFrame symbols

BB_CRC_ERRORS / BB_CRC_ERRORS_CURRENT / BB_CRC_ERRORS_NEXT
BB_DATA_FIELD_LEN / BB_DATA_FIELD_LEN_CURRENT / BB_DATA_FIELD_LEN_NEXT
BB_FRAMES
BB_GAIN / BB_GAIN_CURRENT / BB_GAIN_NEXT
BASEBAND_LEN
ISI / ISI_CTRL / ISI_CTRL_STRUCT / ISI_CTRL_STRUCT_FIELDS
ISI_FILTER_BYTE / ISI_MASK
SAT_BB_GAIN
ntc_debug  (module param, uint)

BB_DATA_FIELD_LEN and BB_FRAMES suggest the driver tracks individual baseband frames, not just statistics. Very promising for BBFrame capture.

dvblite.ko

Contains dvblite_ioctl — a kernel ioctl interface on /dev/dvblite0. Commands unknown — to be investigated with a live signal.

Network Services

Service Port Notes
SSH 22 Legacy KEX only (diffie-hellman-group1-sha1)
Telnet API 23 cmdld via xinetd
FTP 21 pure-ftpd
HTTP 80 Apache + myles + requestHandler
SNMP 161 Community public
mDNS 5353 GOFFERT.local
# SSH/SCP
ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>
scp -oKexAlgorithms=+diffie-hellman-group1-sha1 -oHostKeyAlgorithms=+ssh-rsa root@<ip>:/path /local

Credentials (Default/Hardcoded — ZSL-2020-5603 / ExploitDB 48954)

User Password Notes
root 1root! Full root SSH
admin 1admin! Also root via sudoers
adtec none Telnet API / web UI
adtecftp adtecftp2231 FTP only
  • Password hashes: DES crypt — crackable in seconds with john
  • apache ALL=(ALL) NOPASSWD: ALL in sudoers
  • Diagnostic package passphrase: iMoo3jio (hardcoded, leaks in ps aux)
gpg --passphrase "iMoo3jio" --batch --ignore-mdc-error --decrypt RD-60_*.tar.gpg | tar xf -

APIs

Telnet API

Connect: telnet <ip>, login adtec/none

*.SYSD SHELLCMD <cmd>          # arbitrary root shell execution!
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedType.0 = dvbs2   # configure tuner
*.SNMP ADTEC-NT-DEMOD-MIB::satFeedDownlink.0 = 10960000
*.SNMP .1.3.6.1.4.1.19587.6000.3.999.0 i 0         # commit/apply

SNMP — Newtec Demodulator MIB

OID base: .1.3.6.1.4.1.19587, MIB: ADTEC-NT-DEMOD-MIB, community: public

snmpwalk -v2c -c public <ip> .1.3.6.1.4.1.19587

Key OIDs: tunerLock, recvLevel, esNo, linkMargin, modFec, rolloff, pilot, fecFrameType, unCorrFs, bbCrcerrors, basebandLen, dummyPlRatio, isiFilterByte, framesSec, satFeedType, satFeedDownlink, satFeedSymRate, satFeedModulation, lnbEnable, lnbPolarity, lnbTone

DVC Profile Format

SNMP SET commands as tuner presets, applied via Telnet API or web UI.

Saved Tuner Profiles

prfturktest.DVC (2018-04-28)

  • DVB-S, 10762 MHz, KU 9750 LO → 1012 MHz L-band
  • 30 MSym/s, QPSK 3/4, roll-off 35%
  • Was LOCKED at -32 dBm when saved
  • bbCrcerrors = 1BBFrame counter was active and non-zero!
  • Likely Türksat 42°E

prfMUX.DVC (2018-04-28)

  • DVB-S2, 10960 MHz, KU 9750 LO → 1210 MHz L-band
  • 8.352 MSym/s, 16APSK 2/3, roll-off 20%, pilot ON, normal frames, CCM
  • Was unlocked when saved

Licensed Features (Key ID 165)

DVB-DSNG + DVB-S2 + QPSK + 8-PSK + 16-QAM/16APSK + 32APSK + Symbol Rate <= 33 MBaud + ACM + Single TS/GS or Multiple Streams + (Baseband Frames) + no ACM client + no AES

BBFrame access is explicitly licensed and enabled.

Encryption / CA

  • BISS-1 key in dtrans.xml: 69A969BBECA0
  • Viaccess (CA ID 0x0005) feed seen in logs — no card present, could not decrypt

IP-over-Satellite

The unit has a full satellite IP receive stack beyond TS decoding:

  • rddma_ip — FPGA-backed DMA for IP-from-satellite
  • ip_ingress_main — GSE/MPE ingress pipeline
  • FPGA Channel 3 active at 03F01C00
  • Currently idle — no GSE/MPE stream configured

Security Summary

Issue Detail
Default root creds root/1root! over SSH
Telnet RCE *.SYSD SHELLCMD = root shell with adtec/none
Sudoers apache ALL=(ALL) NOPASSWD: ALL
Shared SSH host keys Same across all units (stored on CF card)
Weak password hashes DES crypt, trivially crackable
GPG passphrase leak iMoo3jio visible in ps aux
Public exploit ZSL-2020-5603 / ExploitDB 48954

Other

Front Panel

  • Driver: frpanel.ko (depends on pc93, pc73a)
  • Device nodes: /dev/frpanel0, /dev/frpanel1, /dev/frpanel2
  • Display: 2 rows × 40 columns character LCD (PC93 I2C MCU)
  • LCD API in libsolib.so: FpLcdKpInit(), LcdClear(), LcdWriteStr(char*, pos, len)
  • Writing to /dev/frpanel2 activates the backlight
  • menud daemon owns the display — must be stopped before direct writes
  • Proc interface: /proc/driver/frpanel/ (rows, cols, screen, type, version, access)

Images

TODO (requires dish connected)

  • [ ] Read /proc/driver/dvblite/fe0/stats with live signal — observe all BB* fields
  • [ ] SNMP walk full .1.3.6.1.4.1.19587 with live signal
  • [ ] Investigate dvblite_ioctl on /dev/dvblite0
  • [ ] Enable ntc_debug module param and watch dmesg
  • [ ] Try ISI multistream filtering via SNMP SET
  • [ ] Investigate rddma_ip with GSE/MPE satellite signal
  • [ ] Lock on Türksat 42°E: 10762 MHz / 30 MSym/s / QPSK 3/4 (known working)
  • [ ] Identify prfMUX transponder on Lyngsat (10960 MHz / 8.352 MSym/s / 16APSK 2/3)
  • [ ] Explore Telnet API *.NTC command namespace
  • [ ] Investigate xcpServerd/xcpClientd — XCP protocol capabilities
  • [ ] Check if schnv.DVC populates after a lock (empty offline)
  • [ ] Read freg.db contents — full feature registry dump
  • [ ] Write to LCD display — cross-compile against glibc 2.3.5 and call LcdWriteStr() from libsolib.so
  • [ ] Send RMCP command via rmcp_i2c to switch NTC/7044/BB output to BBFrame mode