这是UAP2835的图片。
这个玩意的功能就是联通安装到用户家里,用来扩大信号的。其原理就是通过ADSL建立一个IPSec连接到联通的核心网,然后通过板载DSP发射WCDMA信号。众所周知,UMTS标准的认证/加密流程在基站完成,所以只要搞定这个玩意,你懂的。
这个玩意有两个板子,一个是路由器板,上面有EAP-AKA认证用的SIM卡。一个是基站板,有DSP等等,之间用不知名的接口相连。详情可见http://www.eepw.com.cn/article/144307.htm
然后我焊下了FLASH,发现是一个32兆的NOR。然后我购买了编程器读取了固件,接着用binwalk看了一下,是一个VxWorks:
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
600 0x258 Copyright string: "Copyright 2002-2003 HUAWEI TECHNOLOGIES CO., LTD."
1792 0x700 VxWorks operating system version "5.5.1" , compiled: "Jun 7 2011, 17:09:32"
89163 0x15C4B mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
114153 0x1BDE9 Zlib compressed data, default compression
510224 0x7C910 Copyright string: "Copyright 1984-2002 Wind River Systems, Inc."
511542 0x7CE36 VxWorks WIND kernel version "2.6"
524888 0x80258 Copyright string: "Copyright 2002-2003 HUAWEI TECHNOLOGIES CO., LTD."
526100 0x80714 VxWorks operating system version "5.5.1" , compiled: "Jun 7 2011, 17:16:35"
642980 0x9CFA4 Copyright string: "Copyright 1984-2002 Wind River Systems, Inc."
644034 0x9D3C2 VxWorks WIND kernel version "2.6"
644889 0x9D719 Zlib compressed data, default compression
1852852 0x1C45B4 Zip archive data, at least v1.0 to extract, name: CusBuiltPkt/
1852894 0x1C45DE Zip archive data, at least v1.0 to extract, compressed size: 240, uncompressed size: 240, name: CusBuiltPkt/CusBuiltInfo.ini
1853324 0x1C478C End of Zip archive
1990144 0x1E5E00 Zip archive data, at least v1.0 to extract, name: CusBuiltPkt/
1990186 0x1E5E2A Zip archive data, at least v1.0 to extract, compressed size: 240, uncompressed size: 240, name: CusBuiltPkt/CusBuiltInfo.ini
1990616 0x1E5FD8 End of Zip archive
3149270 0x300DD6 End of Zip archive
3154944 0x302400 Zip archive data, at least v2.0 to extract, compressed size: 1549, uncompressed size: 39076, name: HNB-20100101000000-20160524205606-TRANSFERS-DLOG.TXT
3162843 0x3042DB End of Zip archive
3175424 0x307400 Zip archive data, at least v2.0 to extract, compressed size: 483, uncompressed size: 15396, name: HNB-20100101000000-20160524205606-WIRELESS-DLOG.TXT
3182767 0x3090AF End of Zip archive
3235328 0x315E00 Zip archive data, at least v2.0 to extract, compressed size: 4853, uncompressed size: 177636, name: HNB-20150607130355-20150607131920-TRANSFERS-DLOG.TXT
3243520 0x317E00 XML document, version: "1.0"
3245507 0x3185C3 End of Zip archive
3253760 0x31A600 Zip archive data, at least v2.0 to extract, compressed size: 2312, uncompressed size: 95076, name: HNB-20150607100208-20150607131921-WIRELESS-DLOG.TXT
3263444 0x31CBD4 End of Zip archive
3268071 0x31DDE7 Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
3268146 0x31DE32 Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
3283160 0x3218D8 End of Zip archive
3288064 0x322C00 Zip archive data, at least v2.0 to extract, compressed size: 2285, uncompressed size: 61476, name: HNB-20100101000000-20160525055721-TRANSFERS-DLOG.TXT
3293115 0x323FBB End of Zip archive
3295232 0x324800 Zip archive data, at least v2.0 to extract, compressed size: 1157, uncompressed size: 41316, name: HNB-20100101000000-20160525055722-WIRELESS-DLOG.TXT
3297105 0x324F51 End of Zip archive
3341312 0x32FC00 Zip archive data, at least v2.0 to extract, compressed size: 917, uncompressed size: 4677, name: HNB-20100101000001-20160524224743-RLOG.TXT
3343439 0x33044F End of Zip archive
3350528 0x332000 Zip archive data, at least v2.0 to extract, compressed size: 1804, uncompressed size: 41956, name: HNB-20100101000001-20160524224745-OM-DLOG.TXT
3357644 0x333BCC End of Zip archive
3377152 0x338800 Zip archive data, at least v2.0 to extract, compressed size: 3403, uncompressed size: 104996, name: HNB-20100101000001-20160524224745-TRANSFERS-DLOG.TXT
3387417 0x33B019 End of Zip archive
3392000 0x33C200 Zip archive data, at least v2.0 to extract, compressed size: 1003, uncompressed size: 51236, name: HNB-20100101000001-20160524224746-WIRELESS-DLOG.TXT
3394231 0x33CAB7 End of Zip archive
3462656 0x34D600 Zip archive data, at least v2.0 to extract, compressed size: 996, uncompressed size: 5332, name: HNB-20100101000000-20160525075719-RLOG.TXT
3465374 0x34E09E End of Zip archive
3473920 0x350200 Zip archive data, at least v2.0 to extract, uncompressed size: 123354, name: ChrLog_0.log
3534848 0x35F000 Zip archive data, at least v2.0 to extract, compressed size: 11533, uncompressed size: 123354, name: ChrLog_0.log
3629056 0x376000 Zip archive data, at least v2.0 to extract, compressed size: 581, uncompressed size: 2826, name: HNB-20100101000001-20160524205410-RLOG.TXT
3630847 0x3766FF End of Zip archive
3640832 0x378E00 Zip archive data, at least v2.0 to extract, compressed size: 86, uncompressed size: 98, name: HNB-20100101000001-20160524205410-SLOG.TXT
3641104 0x378F10 End of Zip archive
3648512 0x37AC00 Zip archive data, at least v2.0 to extract, compressed size: 1091, uncompressed size: 18276, name: HNB-20100101000001-20160524205410-OM-DLOG.TXT
3652867 0x37BD03 End of Zip archive
3661824 0x37E000 Zip archive data, at least v2.0 to extract, compressed size: 1346, uncompressed size: 32036, name: HNB-20100101000001-20160524205410-TRANSFERS-DLOG.TXT
3667472 0x37F610 End of Zip archive
3818293 0x3A4335 Neighborly text, "NeighborListConfig" minOccurs="0" type="boolean" /> <element name="CellReSelectionConfig" minOccurs="0" type="boolean" />"
3939840 0x3C1E00 Zip archive data, at least v2.0 to extract, compressed size: 929, uncompressed size: 4771, name: HNB-20100101000000-20150607135007-RLOG.TXT
3941797 0x3C25A5 Neighborly text, "NeighborList">lement name="InterFreqCellNumberOfEntries" minOccurs="0">"
3946075 0x3C365B End of Zip archive
3955712 0x3C5C00 Zip archive data, at least v2.0 to extract, compressed size: 2442, uncompressed size: 60836, name: HNB-20100101000000-20150607135008-OM-DLOG.TXT
3968074 0x3C8C4A End of Zip archive
3974676 0x3CA614 Neighborly text, "NeighborList" minOccurs="0" />ListInUse" minOccurs="0">"
3974731 0x3CA64B Neighborly text, "NeighborListInUse" minOccurs="0"> <sequence>"
3979776 0x3CBA00 Zip archive data, at least v2.0 to extract, compressed size: 3556, uncompressed size: 108196, name: HNB-20100101000000-20150607135009-TRANSFERS-DLOG.TXT
3995314 0x3CF6B2 End of Zip archive
4007424 0x3D2600 Zip archive data, at least v2.0 to extract, compressed size: 844, uncompressed size: 38756, name: HNB-20100101000000-20150607135010-WIRELESS-DLOG.TXT
4014104 0x3D4018 End of Zip archive
4084958 0x3E54DE Neighborly text, "NeighborCellDetect" minOccurs="0"> <complexType>"
4181504 0x3FCE00 XML document, version: "1.0"
4202584 0x402058 End of Zip archive
4614630 0x4669E6 End of Zip archive
4629504 0x46A400 Zip archive data, at least v2.0 to extract, compressed size: 4771, uncompressed size: 98317, name: HNB-20150606042910-20150606055910-RLOG.TXT
4645213 0x46E15D End of Zip archive
4755456 0x489000 Zip archive data, at least v2.0 to extract, compressed size: 878, uncompressed size: 4211, name: HNB-20100101000001-20160526201118-RLOG.TXT
4758056 0x489A28 End of Zip archive
4762112 0x48AA00 Zip archive data, at least v2.0 to extract, compressed size: 86, uncompressed size: 98, name: HNB-20100101000000-20160526201118-SLOG.TXT
4762384 0x48AB10 End of Zip archive
4768768 0x48C400 Zip archive data, at least v2.0 to extract, compressed size: 2074, uncompressed size: 42916, name: HNB-20100101000001-20160526201118-OM-DLOG.TXT
4773082 0x48D4DA End of Zip archive
4780544 0x48F200 Zip archive data, at least v2.0 to extract, compressed size: 2578, uncompressed size: 76836, name: HNB-20100101000001-20160526201119-TRANSFERS-DLOG.TXT
4786912 0x490AE0 End of Zip archive
4792832 0x492200 Zip archive data, at least v2.0 to extract, compressed size: 732, uncompressed size: 32036, name: HNB-20100101000001-20160526201120-WIRELESS-DLOG.TXT
4795304 0x492BA8 End of Zip archive
4858880 0x4A2400 Zip archive data, at least v2.0 to extract, compressed size: 553, uncompressed size: 27236, name: HNB-20100101000001-20160524205411-WIRELESS-DLOG.TXT
4872437 0x4A58F5 End of Zip archive
4948992 0x4B8400 XML document, version: "1.0"
4967399 0x4BCBE7 Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
4967474 0x4BCC32 Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
4986653 0x4C171D End of Zip archive
5004288 0x4C5C00 Zip archive data, at least v2.0 to extract, compressed size: 1167, uncompressed size: 20836, name: HNB-20100101000001-20160524205337-OM-DLOG.TXT
5006671 0x4C654F End of Zip archive
5011968 0x4C7A00 Zip archive data, at least v2.0 to extract, compressed size: 1309, uncompressed size: 30436, name: HNB-20100101000001-20160524205337-TRANSFERS-DLOG.TXT
5019115 0x4C95EB End of Zip archive
5030400 0x4CC200 Zip archive data, at least v2.0 to extract, compressed size: 450, uncompressed size: 13476, name: HNB-20100101000001-20160524205338-WIRELESS-DLOG.TXT
5032078 0x4CC88E End of Zip archive
5248000 0x501400 Zip archive data, at least v2.0 to extract, compressed size: 7873, uncompressed size: 215716, name: HNB-20100101000000-20160525075719-OM-DLOG.TXT
5265793 0x505981 End of Zip archive
5282816 0x509C00 Zip archive data, at least v2.0 to extract, compressed size: 2320, uncompressed size: 62436, name: HNB-20100101000000-20160525075722-TRANSFERS-DLOG.TXT
5290462 0x50B9DE End of Zip archive
5297152 0x50D400 Zip archive data, at least v2.0 to extract, compressed size: 1229, uncompressed size: 43876, name: HNB-20100101000000-20160525075723-WIRELESS-DLOG.TXT
5301657 0x50E599 End of Zip archive
5387776 0x523600 Zip archive data, at least v2.0 to extract, compressed size: 9452, uncompressed size: 146020, name: HisUserAlm.log
5404667 0x5277FB Neighborly text, "NeighborListSelfConfigEnable" type="boolean" minOccurs="0" /> <element name="CellReSelectionSelfConfigEnable" type="boolean" minOccurs="0" />"
5509120 0x541000 Zip archive data, at least v2.0 to extract, compressed size: 12, uncompressed size: 20, name: CurUserAlm.log
5509262 0x54108E End of Zip archive
5601792 0x557A00 Zip archive data, at least v2.0 to extract, uncompressed size: 146020, name: HisUserAlm.log
5927795 0x5A7373 Neighborly text, "NeighborListConfig id = "0X66D5000" pid = "54" src = "hms" access = "r">true</NeighborListConfig>ss = "r">true</NeighborListConfig>"
5927873 0x5A73C1 Neighborly text, "NeighborListConfig>00" pid = "54" src = "hms" access = "r">false</CellReSelectionConfig>"
5980200 0x5B4028 Unix path: /export/home/sysm/ftproot/AP/PerfFile</URL>
6166016 0x5E1600 Zip archive data, at least v2.0 to extract, compressed size: 9277, uncompressed size: 99664, name: ChrLog_0.log
6179328 0x5E4A00 Zip archive data, at least v2.0 to extract, compressed size: 4302, uncompressed size: 108836, name: HNB-20100101000000-20160525045719-OM-DLOG.TXT
6200206 0x5E9B8E End of Zip archive
6210560 0x5EC400 Zip archive data, at least v2.0 to extract, compressed size: 2232, uncompressed size: 60196, name: HNB-20100101000000-20160525045721-TRANSFERS-DLOG.TXT
6220678 0x5EEB86 End of Zip archive
6226432 0x5F0200 Zip archive data, at least v2.0 to extract, compressed size: 811, uncompressed size: 26596, name: HNB-20100101000000-20160525045721-WIRELESS-DLOG.TXT
6431541 0x622335 Neighborly text, "NeighborListConfig" minOccurs="0" type="boolean" /> <element name="CellReSelectionConfig" minOccurs="0" type="boolean" />"
6693888 0x662400 XML document, version: "1.0"
6750203 0x66FFFB Neighborly text, "NeighborListSelfConfigEnable" type="boolean" minOccurs="0" /> <element name="CellReSelectionSelfConfigEnable" type="boolean" minOccurs="0" />"
6860197 0x68ADA5 Neighborly text, "NeighborList">lement name="InterFreqCellNumberOfEntries" minOccurs="0">"
6893076 0x692E14 Neighborly text, "NeighborList" minOccurs="0" />ListInUse" minOccurs="0">"
6893131 0x692E4B Neighborly text, "NeighborListInUse" minOccurs="0"> <sequence>"
7081984 0x6C1000 Zip archive data, at least v2.0 to extract, compressed size: 113, uncompressed size: 191, name: HNB-20100101000000-20100101080114-SLOG.TXT
7082283 0x6C112B End of Zip archive
7203328 0x6DEA00 Zip archive data, at least v2.0 to extract, compressed size: 635, uncompressed size: 3706, name: HNB-20100101000000-20160524205604-RLOG.TXT
7205173 0x6DF135 End of Zip archive
7208448 0x6DFE00 Zip archive data, at least v2.0 to extract, compressed size: 1302, uncompressed size: 25956, name: HNB-20100101000000-20160524205605-OM-DLOG.TXT
7255040 0x6EB400 Zip archive data, at least v2.0 to extract, uncompressed size: 146020, name: HisUserAlm.log
7300096 0x6F6400 Zip archive data, at least v2.0 to extract, compressed size: 9461, uncompressed size: 146020, name: HisUserAlm.log
7399134 0x70E6DE Neighborly text, "NeighborCellDetect" minOccurs="0"> <complexType>"
7479383 0x722057 Neighborly text, "NeighborListInUse>= "0X6019000">"
7573377 0x738F81 Neighborly text, "NeighborCellDetect id = "0X306C000">d = "0X4179000" pid = "73" length = "8" src = "hms">on</NCellDetectSwitch>"
7573694 0x7390BE Neighborly text, "NeighborCellDetect>witch id = "0X417C000" pid = "73" length = "8" src = "hms">off</AtiSwitch>"
7734784 0x760600 Zip archive data, at least v2.0 to extract, compressed size: 8561, uncompressed size: 254116, name: HNB-20100101000000-20150607202007-OM-DLOG.TXT
7781425 0x76BC31 End of Zip archive
7793664 0x76EC00 Zip archive data, at least v2.0 to extract, compressed size: 3676, uncompressed size: 111076, name: HNB-20100101000000-20150607202010-TRANSFERS-DLOG.TXT
7812394 0x77352A End of Zip archive
7824384 0x776400 Zip archive data, at least v2.0 to extract, compressed size: 1076, uncompressed size: 45796, name: HNB-20100101000000-20150607202012-WIRELESS-DLOG.TXT
7831296 0x777F00 End of Zip archive
8034304 0x7A9800 Zip archive data, at least v2.0 to extract, compressed size: 140, uncompressed size: 324, name: HNB-20100101000001-20100101080438-SLOG.TXT
8034630 0x7A9946 End of Zip archive
8110592 0x7BC200 Zip archive data, at least v2.0 to extract, compressed size: 71, uncompressed size: 166, name: HisUserAlm.log
8110793 0x7BC2C9 End of Zip archive
8162816 0x7C8E00 XML document, version: "1.0"
8189946 0x7CF7FA Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
8190021 0x7CF845 Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
8238129 0x7DB431 Neighborly text, "NeighborList id = "0X6017000">ntries id = "0X70A5000" pid = "73" access = "r">0</InterFreqCellNumberOfEntries>"
8251007 0x7DE67F Neighborly text, "NeighborListInUse id = "0X6018000">ntries id = "0X70AC000" pid = "54" src = "hms" access = "r">11</MaxIntraFreqCellEntries>"
8262385 0x7E12F1 End of Zip archive
8272896 0x7E3C00 Zip archive data, at least v2.0 to extract, compressed size: 2285, uncompressed size: 61476, name: HNB-20100101000000-20160525062721-TRANSFERS-DLOG.TXT
8281019 0x7E5BBB End of Zip archive
8288768 0x7E7A00 Zip archive data, at least v2.0 to extract, compressed size: 1168, uncompressed size: 41636, name: HNB-20100101000000-20160525062723-WIRELESS-DLOG.TXT
8291676 0x7E855C End of Zip archive
8372736 0x7FC200 Zip archive data, at least v2.0 to extract, compressed size: 86, uncompressed size: 98, name: HNB-20100101000000-20121029123227-SLOG.TXT
8373008 0x7FC310 End of Zip archive
8519680 0x820000 Zip archive data, at least v2.0 to extract, compressed size: 10269307, uncompressed size: 10276388, name: HSAP.bin
18789025 0x11EB2A1 Zip archive data, at least v2.0 to extract, compressed size: 467789, uncompressed size: 492002, name: pck.zip
19256851 0x125D613 Zip archive data, at least v2.0 to extract, compressed size: 64, uncompressed size: 68, name: UAP.ini
19256952 0x125D678 Zip archive data, at least v2.0 to extract, compressed size: 90, uncompressed size: 110, name: UAPVer.ini
19257082 0x125D6FA Zip archive data, at least v2.0 to extract, compressed size: 214, uncompressed size: 840, name: VersionMatch.xml
19257620 0x125D914 End of Zip archive
20054016 0x1320000 XML document, version: "1.0"
20068346 0x13237FA Neighborly text, "NeighborListSelfConfigEnable id = "0X501D000" pid = "74" src = "hms">true</NeighborListSelfConfigEnable>"hms">true</NeighborListSelfConfigEnable>"
20068421 0x1323845 Neighborly text, "NeighborListSelfConfigEnable>Enable id = "0X501E000" pid = "74">true</CellReSelectionSelfConfigEnable>"
20099121 0x132B031 Neighborly text, "NeighborList id = "0X6017000">ntries id = "0X70A5000" pid = "73" access = "r">0</InterFreqCellNumberOfEntries>"
20108415 0x132D47F Neighborly text, "NeighborListInUse id = "0X6018000">ntries id = "0X70AC000" pid = "54" src = "hms" access = "r">11</MaxIntraFreqCellEntries>"
20120151 0x1330257 Neighborly text, "NeighborListInUse>= "0X6019000">"
20213121 0x1346D81 Neighborly text, "NeighborCellDetect id = "0X306C000">d = "0X4179000" pid = "73" length = "8" src = "hms">on</NCellDetectSwitch>"
20213438 0x1346EBE Neighborly text, "NeighborCellDetect>witch id = "0X417C000" pid = "73" length = "8" src = "hms">off</AtiSwitch>"
20647283 0x13B0D73 Neighborly text, "NeighborListConfig id = "0X66D5000" pid = "54" src = "hms" access = "r">true</NeighborListConfig>ss = "r">true</NeighborListConfig>"
20647361 0x13B0DC1 Neighborly text, "NeighborListConfig>00" pid = "54" src = "hms" access = "r">false</CellReSelectionConfig>"
20690472 0x13BB628 Unix path: /export/home/sysm/ftproot/AP/PerfFile</URL>
21102592 0x1420000 Zip archive data, at least v2.0 to extract, compressed size: 10269307, uncompressed size: 10276388, name: HSAP.bin
31371937 0x1DEB2A1 Zip archive data, at least v2.0 to extract, compressed size: 467789, uncompressed size: 492002, name: pck.zip
31839763 0x1E5D613 Zip archive data, at least v2.0 to extract, compressed size: 64, uncompressed size: 68, name: UAP.ini
31839864 0x1E5D678 Zip archive data, at least v2.0 to extract, compressed size: 90, uncompressed size: 110, name: UAPVer.ini
31839994 0x1E5D6FA Zip archive data, at least v2.0 to extract, compressed size: 214, uncompressed size: 840, name: VersionMatch.xml
31840532 0x1E5D914 End of Zip archive
32636928 0x1F20000 XML document, version: "1.0"
32650612 0x1F23574 Neighborly text, "NeighborListSelfConfigEnable id="0X501D000" pid="74" src="hms">true</NeighborListSelfConfigEnable>true</NeighborListSelfConfigEnable>"
32650681 0x1F235B9 Neighborly text, "NeighborListSelfConfigEnable>ConfigEnable id="0X501E000" pid="74">true</CellReSelectionSelfConfigEnable>"
32682734 0x1F2B2EE Neighborly text, "NeighborList id="0X6017000">berOfEntries id="0X70A5000" pid="73" access="r">0</InterFreqCellNumberOfEntries>"
32692317 0x1F2D85D Neighborly text, "NeighborList>"
32692347 0x1F2D87B Neighborly text, "NeighborListInUse id="0X6018000">qCellEntries id="0X70AC000" pid="54" src="hms" access="r">11</MaxIntraFreqCellEntries>"
32695304 0x1F2E408 Neighborly text, "NeighborListInUse>ice id="0X6019000">"
32780975 0x1F432AF Neighborly text, "NeighborCellDetect id="0X306C000">h id="0X4179000" pid="73" length="8" src="hms">on</NCellDetectSwitch>"
32781289 0x1F433E9 Neighborly text, "NeighborCellDetect> <AtiSwitch id="0X417C000" pid="73" length="8" src="hms">off</AtiSwitch>"
33223406 0x1FAF2EE Neighborly text, "NeighborListConfig id="0X66D5000" pid="54" src="hms" access="r">true</NeighborListConfig>>true</NeighborListConfig>"
33223476 0x1FAF334 Neighborly text, "NeighborListConfig>6D6000" pid="54" src="hms" access="r">false</CellReSelectionConfig>"