这是UAP2835的图片。
这个玩意的功能就是联通安装到用户家里，用来扩大信号的。其原理就是通过ADSL建立一个IPSec连接到联通的核心网，然后通过板载DSP发射WCDMA信号。众所周知，UMTS标准的认证/加密流程在基站完成，所以只要搞定这个玩意，你懂的。
这个玩意有两个板子，一个是路由器板，上面有EAP-AKA认证用的SIM卡。一个是基站板，有DSP等等，之间用不知名的接口相连。详情可见http://www.eepw.com.cn/article/144307.htm
然后我焊下了FLASH，发现是一个32兆的NOR。然后我购买了编程器读取了固件，接着用binwalk看了一下，是一个VxWorks：
DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
600           0x258           Copyright string: "Copyright 2002-2003 HUAWEI TECHNOLOGIES CO., LTD."
1792          0x700           VxWorks operating system version "5.5.1" , compiled: "Jun  7 2011, 17:09:32"
89163         0x15C4B         mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
114153        0x1BDE9         Zlib compressed data, default compression
510224        0x7C910         Copyright string: "Copyright 1984-2002 Wind River Systems, Inc."
511542        0x7CE36         VxWorks WIND kernel version "2.6"
524888        0x80258         Copyright string: "Copyright 2002-2003 HUAWEI TECHNOLOGIES CO., LTD."
526100        0x80714         VxWorks operating system version "5.5.1" , compiled: "Jun  7 2011, 17:16:35"
642980        0x9CFA4         Copyright string: "Copyright 1984-2002 Wind River Systems, Inc."
644034        0x9D3C2         VxWorks WIND kernel version "2.6"
644889        0x9D719         Zlib compressed data, default compression
1852852       0x1C45B4        Zip archive data, at least v1.0 to extract, name: CusBuiltPkt/
1852894       0x1C45DE        Zip archive data, at least v1.0 to extract, compressed size: 240, uncompressed size: 240, name: CusBuiltPkt/CusBuiltInfo.ini
1853324       0x1C478C        End of Zip archive
1990144       0x1E5E00        Zip archive data, at least v1.0 to extract, name: CusBuiltPkt/
1990186       0x1E5E2A        Zip archive data, at least v1.0 to extract, compressed size: 240, uncompressed size: 240, name: CusBuiltPkt/CusBuiltInfo.ini
1990616       0x1E5FD8        End of Zip archive
3149270       0x300DD6        End of Zip archive
3154944       0x302400        Zip archive data, at least v2.0 to extract, compressed size: 1549, uncompressed size: 39076, name: HNB-20100101000000-20160524205606-TRANSFERS-DLOG.TXT
3162843       0x3042DB        End of Zip archive
3175424       0x307400        Zip archive data, at least v2.0 to extract, compressed size: 483, uncompressed size: 15396, name: HNB-20100101000000-20160524205606-WIRELESS-DLOG.TXT
3182767       0x3090AF        End of Zip archive
3235328       0x315E00        Zip archive data, at least v2.0 to extract, compressed size: 4853, uncompressed size: 177636, name: HNB-20150607130355-20150607131920-TRANSFERS-DLOG.TXT
3243520       0x317E00        XML document, version: "1.0"
3245507       0x3185C3        End of Zip archive
3253760       0x31A600        Zip archive data, at least v2.0 to extract, compressed size: 2312, uncompressed size: 95076, name: HNB-20150607100208-20150607131921-WIRELESS-DLOG.TXT
3263444       0x31CBD4        End of Zip archive
3268071       0x31DDE7        Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
3268146       0x31DE32        Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
3283160       0x3218D8        End of Zip archive
3288064       0x322C00        Zip archive data, at least v2.0 to extract, compressed size: 2285, uncompressed size: 61476, name: HNB-20100101000000-20160525055721-TRANSFERS-DLOG.TXT
3293115       0x323FBB        End of Zip archive
3295232       0x324800        Zip archive data, at least v2.0 to extract, compressed size: 1157, uncompressed size: 41316, name: HNB-20100101000000-20160525055722-WIRELESS-DLOG.TXT
3297105       0x324F51        End of Zip archive
3341312       0x32FC00        Zip archive data, at least v2.0 to extract, compressed size: 917, uncompressed size: 4677, name: HNB-20100101000001-20160524224743-RLOG.TXT
3343439       0x33044F        End of Zip archive
3350528       0x332000        Zip archive data, at least v2.0 to extract, compressed size: 1804, uncompressed size: 41956, name: HNB-20100101000001-20160524224745-OM-DLOG.TXT
3357644       0x333BCC        End of Zip archive
3377152       0x338800        Zip archive data, at least v2.0 to extract, compressed size: 3403, uncompressed size: 104996, name: HNB-20100101000001-20160524224745-TRANSFERS-DLOG.TXT
3387417       0x33B019        End of Zip archive
3392000       0x33C200        Zip archive data, at least v2.0 to extract, compressed size: 1003, uncompressed size: 51236, name: HNB-20100101000001-20160524224746-WIRELESS-DLOG.TXT
3394231       0x33CAB7        End of Zip archive
3462656       0x34D600        Zip archive data, at least v2.0 to extract, compressed size: 996, uncompressed size: 5332, name: HNB-20100101000000-20160525075719-RLOG.TXT
3465374       0x34E09E        End of Zip archive
3473920       0x350200        Zip archive data, at least v2.0 to extract, uncompressed size: 123354, name: ChrLog_0.log
3534848       0x35F000        Zip archive data, at least v2.0 to extract, compressed size: 11533, uncompressed size: 123354, name: ChrLog_0.log
3629056       0x376000        Zip archive data, at least v2.0 to extract, compressed size: 581, uncompressed size: 2826, name: HNB-20100101000001-20160524205410-RLOG.TXT
3630847       0x3766FF        End of Zip archive
3640832       0x378E00        Zip archive data, at least v2.0 to extract, compressed size: 86, uncompressed size: 98, name: HNB-20100101000001-20160524205410-SLOG.TXT
3641104       0x378F10        End of Zip archive
3648512       0x37AC00        Zip archive data, at least v2.0 to extract, compressed size: 1091, uncompressed size: 18276, name: HNB-20100101000001-20160524205410-OM-DLOG.TXT
3652867       0x37BD03        End of Zip archive
3661824       0x37E000        Zip archive data, at least v2.0 to extract, compressed size: 1346, uncompressed size: 32036, name: HNB-20100101000001-20160524205410-TRANSFERS-DLOG.TXT
3667472       0x37F610        End of Zip archive
3818293       0x3A4335        Neighborly text, "NeighborListConfig" minOccurs="0" type="boolean" />  <element name="CellReSelectionConfig" minOccurs="0" type="boolean" />"
3939840       0x3C1E00        Zip archive data, at least v2.0 to extract, compressed size: 929, uncompressed size: 4771, name: HNB-20100101000000-20150607135007-RLOG.TXT
3941797       0x3C25A5        Neighborly text, "NeighborList">lement name="InterFreqCellNumberOfEntries" minOccurs="0">"
3946075       0x3C365B        End of Zip archive
3955712       0x3C5C00        Zip archive data, at least v2.0 to extract, compressed size: 2442, uncompressed size: 60836, name: HNB-20100101000000-20150607135008-OM-DLOG.TXT
3968074       0x3C8C4A        End of Zip archive
3974676       0x3CA614        Neighborly text, "NeighborList" minOccurs="0" />ListInUse" minOccurs="0">"
3974731       0x3CA64B        Neighborly text, "NeighborListInUse" minOccurs="0">   <sequence>"
3979776       0x3CBA00        Zip archive data, at least v2.0 to extract, compressed size: 3556, uncompressed size: 108196, name: HNB-20100101000000-20150607135009-TRANSFERS-DLOG.TXT
3995314       0x3CF6B2        End of Zip archive
4007424       0x3D2600        Zip archive data, at least v2.0 to extract, compressed size: 844, uncompressed size: 38756, name: HNB-20100101000000-20150607135010-WIRELESS-DLOG.TXT
4014104       0x3D4018        End of Zip archive
4084958       0x3E54DE        Neighborly text, "NeighborCellDetect" minOccurs="0"> <complexType>"
4181504       0x3FCE00        XML document, version: "1.0"
4202584       0x402058        End of Zip archive
4614630       0x4669E6        End of Zip archive
4629504       0x46A400        Zip archive data, at least v2.0 to extract, compressed size: 4771, uncompressed size: 98317, name: HNB-20150606042910-20150606055910-RLOG.TXT
4645213       0x46E15D        End of Zip archive
4755456       0x489000        Zip archive data, at least v2.0 to extract, compressed size: 878, uncompressed size: 4211, name: HNB-20100101000001-20160526201118-RLOG.TXT
4758056       0x489A28        End of Zip archive
4762112       0x48AA00        Zip archive data, at least v2.0 to extract, compressed size: 86, uncompressed size: 98, name: HNB-20100101000000-20160526201118-SLOG.TXT
4762384       0x48AB10        End of Zip archive
4768768       0x48C400        Zip archive data, at least v2.0 to extract, compressed size: 2074, uncompressed size: 42916, name: HNB-20100101000001-20160526201118-OM-DLOG.TXT
4773082       0x48D4DA        End of Zip archive
4780544       0x48F200        Zip archive data, at least v2.0 to extract, compressed size: 2578, uncompressed size: 76836, name: HNB-20100101000001-20160526201119-TRANSFERS-DLOG.TXT
4786912       0x490AE0        End of Zip archive
4792832       0x492200        Zip archive data, at least v2.0 to extract, compressed size: 732, uncompressed size: 32036, name: HNB-20100101000001-20160526201120-WIRELESS-DLOG.TXT
4795304       0x492BA8        End of Zip archive
4858880       0x4A2400        Zip archive data, at least v2.0 to extract, compressed size: 553, uncompressed size: 27236, name: HNB-20100101000001-20160524205411-WIRELESS-DLOG.TXT
4872437       0x4A58F5        End of Zip archive
4948992       0x4B8400        XML document, version: "1.0"
4967399       0x4BCBE7        Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
4967474       0x4BCC32        Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
4986653       0x4C171D        End of Zip archive
5004288       0x4C5C00        Zip archive data, at least v2.0 to extract, compressed size: 1167, uncompressed size: 20836, name: HNB-20100101000001-20160524205337-OM-DLOG.TXT
5006671       0x4C654F        End of Zip archive
5011968       0x4C7A00        Zip archive data, at least v2.0 to extract, compressed size: 1309, uncompressed size: 30436, name: HNB-20100101000001-20160524205337-TRANSFERS-DLOG.TXT
5019115       0x4C95EB        End of Zip archive
5030400       0x4CC200        Zip archive data, at least v2.0 to extract, compressed size: 450, uncompressed size: 13476, name: HNB-20100101000001-20160524205338-WIRELESS-DLOG.TXT
5032078       0x4CC88E        End of Zip archive
5248000       0x501400        Zip archive data, at least v2.0 to extract, compressed size: 7873, uncompressed size: 215716, name: HNB-20100101000000-20160525075719-OM-DLOG.TXT
5265793       0x505981        End of Zip archive
5282816       0x509C00        Zip archive data, at least v2.0 to extract, compressed size: 2320, uncompressed size: 62436, name: HNB-20100101000000-20160525075722-TRANSFERS-DLOG.TXT
5290462       0x50B9DE        End of Zip archive
5297152       0x50D400        Zip archive data, at least v2.0 to extract, compressed size: 1229, uncompressed size: 43876, name: HNB-20100101000000-20160525075723-WIRELESS-DLOG.TXT
5301657       0x50E599        End of Zip archive
5387776       0x523600        Zip archive data, at least v2.0 to extract, compressed size: 9452, uncompressed size: 146020, name: HisUserAlm.log
5404667       0x5277FB        Neighborly text, "NeighborListSelfConfigEnable" type="boolean" minOccurs="0" />  <element name="CellReSelectionSelfConfigEnable" type="boolean" minOccurs="0" />"
5509120       0x541000        Zip archive data, at least v2.0 to extract, compressed size: 12, uncompressed size: 20, name: CurUserAlm.log
5509262       0x54108E        End of Zip archive
5601792       0x557A00        Zip archive data, at least v2.0 to extract, uncompressed size: 146020, name: HisUserAlm.log
5927795       0x5A7373        Neighborly text, "NeighborListConfig id = "0X66D5000" pid = "54" src = "hms" access = "r">true</NeighborListConfig>ss = "r">true</NeighborListConfig>"
5927873       0x5A73C1        Neighborly text, "NeighborListConfig>00" pid = "54" src = "hms" access = "r">false</CellReSelectionConfig>"
5980200       0x5B4028        Unix path: /export/home/sysm/ftproot/AP/PerfFile</URL>
6166016       0x5E1600        Zip archive data, at least v2.0 to extract, compressed size: 9277, uncompressed size: 99664, name: ChrLog_0.log
6179328       0x5E4A00        Zip archive data, at least v2.0 to extract, compressed size: 4302, uncompressed size: 108836, name: HNB-20100101000000-20160525045719-OM-DLOG.TXT
6200206       0x5E9B8E        End of Zip archive
6210560       0x5EC400        Zip archive data, at least v2.0 to extract, compressed size: 2232, uncompressed size: 60196, name: HNB-20100101000000-20160525045721-TRANSFERS-DLOG.TXT
6220678       0x5EEB86        End of Zip archive
6226432       0x5F0200        Zip archive data, at least v2.0 to extract, compressed size: 811, uncompressed size: 26596, name: HNB-20100101000000-20160525045721-WIRELESS-DLOG.TXT
6431541       0x622335        Neighborly text, "NeighborListConfig" minOccurs="0" type="boolean" />  <element name="CellReSelectionConfig" minOccurs="0" type="boolean" />"
6693888       0x662400        XML document, version: "1.0"
6750203       0x66FFFB        Neighborly text, "NeighborListSelfConfigEnable" type="boolean" minOccurs="0" />  <element name="CellReSelectionSelfConfigEnable" type="boolean" minOccurs="0" />"
6860197       0x68ADA5        Neighborly text, "NeighborList">lement name="InterFreqCellNumberOfEntries" minOccurs="0">"
6893076       0x692E14        Neighborly text, "NeighborList" minOccurs="0" />ListInUse" minOccurs="0">"
6893131       0x692E4B        Neighborly text, "NeighborListInUse" minOccurs="0">   <sequence>"
7081984       0x6C1000        Zip archive data, at least v2.0 to extract, compressed size: 113, uncompressed size: 191, name: HNB-20100101000000-20100101080114-SLOG.TXT
7082283       0x6C112B        End of Zip archive
7203328       0x6DEA00        Zip archive data, at least v2.0 to extract, compressed size: 635, uncompressed size: 3706, name: HNB-20100101000000-20160524205604-RLOG.TXT
7205173       0x6DF135        End of Zip archive
7208448       0x6DFE00        Zip archive data, at least v2.0 to extract, compressed size: 1302, uncompressed size: 25956, name: HNB-20100101000000-20160524205605-OM-DLOG.TXT
7255040       0x6EB400        Zip archive data, at least v2.0 to extract, uncompressed size: 146020, name: HisUserAlm.log
7300096       0x6F6400        Zip archive data, at least v2.0 to extract, compressed size: 9461, uncompressed size: 146020, name: HisUserAlm.log
7399134       0x70E6DE        Neighborly text, "NeighborCellDetect" minOccurs="0"> <complexType>"
7479383       0x722057        Neighborly text, "NeighborListInUse>= "0X6019000">"
7573377       0x738F81        Neighborly text, "NeighborCellDetect id = "0X306C000">d = "0X4179000" pid = "73" length = "8" src = "hms">on</NCellDetectSwitch>"
7573694       0x7390BE        Neighborly text, "NeighborCellDetect>witch id = "0X417C000" pid = "73" length = "8" src = "hms">off</AtiSwitch>"
7734784       0x760600        Zip archive data, at least v2.0 to extract, compressed size: 8561, uncompressed size: 254116, name: HNB-20100101000000-20150607202007-OM-DLOG.TXT
7781425       0x76BC31        End of Zip archive
7793664       0x76EC00        Zip archive data, at least v2.0 to extract, compressed size: 3676, uncompressed size: 111076, name: HNB-20100101000000-20150607202010-TRANSFERS-DLOG.TXT
7812394       0x77352A        End of Zip archive
7824384       0x776400        Zip archive data, at least v2.0 to extract, compressed size: 1076, uncompressed size: 45796, name: HNB-20100101000000-20150607202012-WIRELESS-DLOG.TXT
7831296       0x777F00        End of Zip archive
8034304       0x7A9800        Zip archive data, at least v2.0 to extract, compressed size: 140, uncompressed size: 324, name: HNB-20100101000001-20100101080438-SLOG.TXT
8034630       0x7A9946        End of Zip archive
8110592       0x7BC200        Zip archive data, at least v2.0 to extract, compressed size: 71, uncompressed size: 166, name: HisUserAlm.log
8110793       0x7BC2C9        End of Zip archive
8162816       0x7C8E00        XML document, version: "1.0"
8189946       0x7CF7FA        Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
8190021       0x7CF845        Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
8238129       0x7DB431        Neighborly text, "NeighborList id = "0X6017000">ntries id = "0X70A5000" pid = "73" access = "r">0</InterFreqCellNumberOfEntries>"
8251007       0x7DE67F        Neighborly text, "NeighborListInUse id = "0X6018000">ntries id = "0X70AC000" pid = "54" src = "hms" access = "r">11</MaxIntraFreqCellEntries>"
8262385       0x7E12F1        End of Zip archive
8272896       0x7E3C00        Zip archive data, at least v2.0 to extract, compressed size: 2285, uncompressed size: 61476, name: HNB-20100101000000-20160525062721-TRANSFERS-DLOG.TXT
8281019       0x7E5BBB        End of Zip archive
8288768       0x7E7A00        Zip archive data, at least v2.0 to extract, compressed size: 1168, uncompressed size: 41636, name: HNB-20100101000000-20160525062723-WIRELESS-DLOG.TXT
8291676       0x7E855C        End of Zip archive
8372736       0x7FC200        Zip archive data, at least v2.0 to extract, compressed size: 86, uncompressed size: 98, name: HNB-20100101000000-20121029123227-SLOG.TXT
8373008       0x7FC310        End of Zip archive
8519680       0x820000        Zip archive data, at least v2.0 to extract, compressed size: 10269307, uncompressed size: 10276388, name: HSAP.bin
18789025      0x11EB2A1       Zip archive data, at least v2.0 to extract, compressed size: 467789, uncompressed size: 492002, name: pck.zip
19256851      0x125D613       Zip archive data, at least v2.0 to extract, compressed size: 64, uncompressed size: 68, name: UAP.ini
19256952      0x125D678       Zip archive data, at least v2.0 to extract, compressed size: 90, uncompressed size: 110, name: UAPVer.ini
19257082      0x125D6FA       Zip archive data, at least v2.0 to extract, compressed size: 214, uncompressed size: 840, name: VersionMatch.xml
19257620      0x125D914       End of Zip archive
20054016      0x1320000       XML document, version: "1.0"
20068346      0x13237FA       Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
20068421      0x1323845       Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
20099121      0x132B031       Neighborly text, "NeighborList id = "0X6017000">ntries id = "0X70A5000" pid = "73" access = "r">0</InterFreqCellNumberOfEntries>"
20108415      0x132D47F       Neighborly text, "NeighborListInUse id = "0X6018000">ntries id = "0X70AC000" pid = "54" src = "hms" access = "r">11</MaxIntraFreqCellEntries>"
20120151      0x1330257       Neighborly text, "NeighborListInUse>= "0X6019000">"
20213121      0x1346D81       Neighborly text, "NeighborCellDetect id = "0X306C000">d = "0X4179000" pid = "73" length = "8" src = "hms">on</NCellDetectSwitch>"
20213438      0x1346EBE       Neighborly text, "NeighborCellDetect>witch id = "0X417C000" pid = "73" length = "8" src = "hms">off</AtiSwitch>"
20647283      0x13B0D73       Neighborly text, "NeighborListConfig id = "0X66D5000" pid = "54" src = "hms" access = "r">true</NeighborListConfig>ss = "r">true</NeighborListConfig>"
20647361      0x13B0DC1       Neighborly text, "NeighborListConfig>00" pid = "54" src = "hms" access = "r">false</CellReSelectionConfig>"
20690472      0x13BB628       Unix path: /export/home/sysm/ftproot/AP/PerfFile</URL>
21102592      0x1420000       Zip archive data, at least v2.0 to extract, compressed size: 10269307, uncompressed size: 10276388, name: HSAP.bin
31371937      0x1DEB2A1       Zip archive data, at least v2.0 to extract, compressed size: 467789, uncompressed size: 492002, name: pck.zip
31839763      0x1E5D613       Zip archive data, at least v2.0 to extract, compressed size: 64, uncompressed size: 68, name: UAP.ini
31839864      0x1E5D678       Zip archive data, at least v2.0 to extract, compressed size: 90, uncompressed size: 110, name: UAPVer.ini
31839994      0x1E5D6FA       Zip archive data, at least v2.0 to extract, compressed size: 214, uncompressed size: 840, name: VersionMatch.xml
31840532      0x1E5D914       End of Zip archive
32636928      0x1F20000       XML document, version: "1.0"
32650612      0x1F23574       Neighborly text, "NeighborListSelfConfigEnable id="0X501D000" pid="74" src="hms">true</NeighborListSelfConfigEnable>true</NeighborListSelfConfigEnable>"
32650681      0x1F235B9       Neighborly text, "NeighborListSelfConfigEnable>ConfigEnable id="0X501E000" pid="74">true</CellReSelectionSelfConfigEnable>"
32682734      0x1F2B2EE       Neighborly text, "NeighborList id="0X6017000">berOfEntries id="0X70A5000" pid="73" access="r">0</InterFreqCellNumberOfEntries>"
32692317      0x1F2D85D       Neighborly text, "NeighborList>"
32692347      0x1F2D87B       Neighborly text, "NeighborListInUse id="0X6018000">qCellEntries id="0X70AC000" pid="54" src="hms" access="r">11</MaxIntraFreqCellEntries>"
32695304      0x1F2E408       Neighborly text, "NeighborListInUse>ice id="0X6019000">"
32780975      0x1F432AF       Neighborly text, "NeighborCellDetect id="0X306C000">h id="0X4179000" pid="73" length="8" src="hms">on</NCellDetectSwitch>"
32781289      0x1F433E9       Neighborly text, "NeighborCellDetect>  <AtiSwitch id="0X417C000" pid="73" length="8" src="hms">off</AtiSwitch>"
33223406      0x1FAF2EE       Neighborly text, "NeighborListConfig id="0X66D5000" pid="54" src="hms" access="r">true</NeighborListConfig>>true</NeighborListConfig>"
33223476      0x1FAF334       Neighborly text, "NeighborListConfig>6D6000" pid="54" src="hms" access="r">false</CellReSelectionConfig>"

之后我用-e导出文件，没有什么效果，出来的都是乱的东西。
谁有什么想法么？文件系统在哪里？
固件下载地址：http://pan.baidu.com/s/1gfptnAN

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)