Haxorware Manual

By rajkosto
For version 0.9.2
Configuration page layout:

1
1
2
1
1

1 3
1

4 1

1
1
1

5
1

6
1
7
1
8
1
9
1 10

11
12
13

14
15

16 17

18

19
20

21 22

23
24

25

26
Information section:
1. This shows your MAC’s DHCP settings, such as the original configuration file name and the IP of the server it
is on
2. Current IP addresses of the modem. HFC IP is the ip of the Coaxial interface and Eth IP is the ip of the
network interface that connects to your computer. This is the IP you use to access the configuration page
and telnet. It can be changed with the following Telnet or Web Shell commands:
cd /non/msg
dhcp_settings
Remote access server IP address: [192.168.100.1] <Enter your new Eth IP here>
Remote access server subnet mask: [255.255.255.0] <Just press Enter>
Remote access server router: [192.168.100.254] <Just press Enter>
write
3. The configuration file the modem is currently using. Clicking on the filename will allow you to save the
config on your computer.
4. Current modem’s uptime.This shows how much time has passed since the modem was last restarted. The
format is Days:Hours:Minutes:Seconds.

Administration section:
5. Telnet parameters. The checkbox indicates whether or not the telnet daemon is started at modem boot. If
you do not use the telnet daemon, you can uncheck this to save 2KB of RAM on the modem. Also you can
change the username and password that is requested when you connect to the telnet daemon.
6. Here you can change what Vendor, Model, and software version the modem reports when it is SNMP
scanned and when it requests a HFC DHCP lease. For example, if you are using the MAC address of a ambit,
it is a good idea to change these to reflect an Ambit modem to prevent suspicion.Clearing any of these
boxes will return that box to the default Motorola values.
7. Since ISP’s mainly do snmp scanning on the default SNMP ports (161 and 162), changing these will
essentially block any snmp probes from the ISP. The default “stealth” ports are 225 and 226 for the snmp
and trap ports respectively.
8. Checking the box here will make the modem ignore any DHCP settings set by the ISP for the HFC interface
and instead use th static parameters defined here. This is useful for ISP’s which do not give unregistered
MAC addresses a valid DHCP lease, or give it a limited, walled garden IP. You can set any parameters that
you want here, however if you set one out of the normal range of your ISP’s HFC ips, your modem will
probably not be able to access the TFTP and TOD servers.This will require you to autoserve a config to get it
online. However, setting an IP out of range like this will make your modem virtually invisible to the isp, they
cant scan it, and since it doesn’t request a DHCP lease, they have no idea it’s even on.
9. This should be set to Disabled on most ISP’s. The available options are: Disabled, Use DHCP, and Manual. If
your ISP has the tftp-enforce option enabled in their CMTS, you will have to turn it on. If you aren’t using the
Force Static IP option, the Use DHCP setting is best. This will simulate your modem getting the original
configuration from the ISP before it loads a forced/autoserved one.However, if Force Static IP is ON, then
there are no DHCP settings for the modem to use, and you will have to set this to Manual and specify the IP
and filename in the boxes below.
10. If you have changed any settings in the Administration section, you will have to click this button to
permanently save them.
Utility functions:
11. This will perform a soft restart of the modem, saving any settings before rebooting.Equivalent to the /reset
command in the Broadcom shell.
12. This will disable all the IP filters that your modem is using.Equivalent to the /snmp/cm_filters off command
in the Broadcom shell. Some ISP’s use IP filters to block certain traffic such as port 80 incoming, which will
block you from hosting any web servers. Disabling the filters makes all ports open.
13. This will erase all the dynamic settings in the modem. I have added this option here simply because some
people that have had infinite firmware previously running on their modems have the dynamic settings in a
weird state that will make the modem crash after parsing the configuration file. Note that a soft reset will
rewrite all the dynamic settings back into the modem, so usually after clicking this you will have to do a hard
reset (power cycle the modem).

Addresses section:
14. You can change the MAC addresses and the Serial number of the modem here. Note that all 3 MAC
addresses MUST be different from each other. If they aren’t all hell will break loose when the modem tries
to get online. These addresses vary depending on the modem vendor, on Motorola modems the Ethernet
MAC will be the HFC MAC +1 and the USB mac is a completely different number. You will only need to
change the HFC MAC in order to clone the address of another modem. The others are irrelevant (except the
serial number which may also need to be cloned on some ISP’s).
15. Clicking this button will save any of the changes you have made to the addresses. Note that all the fields
must be filled out (none must be left blank) and be in a proper format otherwise you will receive an error
and the addresses won’t be changed.

Autoserve section:
16. This checkbox toggles the Autoserve feature. Autoserve is a feature that allows the modem to host it’s own
config, removing the need to have a TFTPD on another computer or on a Router in order to use configs that
aren’t available on the ISP’s servers such as custom or outdated ones (that are still valid of course). A config
must be uploaded in the flash memory of the modem (use the upload form below this checkbox to do so)
for this feature to work. If Autoserve is enabled, the Forced config settings in the section below are ignored.
17. If you have toggled the checkbox for the Autoserve feature, you will have to click this button to apply the
change.
18. Use this form to upload a configuration file from your computer to the modem’s flash for use in the
Autoserve function. Please do not use long file names or names with special characters as this may break
something. Once you have browsed and selected an appropriate file, click Upload to save it to the modem.

Config settings section:

19. With these you can override (force) your modem to use a specific config, ignoring the one it gets from the
DHCP server. If you leave any of the fields blank, the default settings from the DHCP will be used for that
field. Most people will only need to fill out the Config file field, unless the config they want is located on a
different TFTP server.Note that when SNMP queried, the modem will respond with the original DHCP tftp ip
and filename, or if you use Static IP, with the bypass IP and filename that you specified.
20. If you change any of the settings in the config settings section, you will need to click this button to apply
them.
BPI settings section:
21. If you change the MAC address of the modem without changing it’s certificates, you will have to either
completely disable BPI or use bpi version 0. This is always at Don’t change because Haxorware cannot
properly determine the current BPI settings that are in effect. Selecting any of the other options will apply
the apropriate setting when you click Save. The options are:
- Disabled: This completely disables Baseline Privacy. Equivalent to the Broadcom shell command
“enable bpi false”.
- BPI: This will force the modem to use Baseline Privacy version 0. Equivalent to the Broadcom shell
command “enable bpi true, bpi_version 0”.
- BPI+: The default state of all bought modems, this enables full Baseline Privacy Plus with certificate
authorization. This will only be usable if the configured MAC address matches the one in the
certificate.
22. You will need to click this button to apply any settings related to BPI if you have changed them.

Backup and Restore section:

23. Use this feature to create a backup of your modems flash. You can backup either the Full 2MB flash, or jus
the Permanent Non-vol area (32KB). After choosing which region to backup, clicking on Download will save
it to your computer.
24. You can use this option to restore a Permanent Non-Vol backup (32KB) from a file on your computer to the
modem. Useful when you don’t have JTAG or a Diagnostic cable and want to overwrite a Infinite Non-Vol to
a real Motorola one to prevent issues and allow BPI to work.

Firmware upgrade section:

25. You can upload a valid .bin Firmware image here and it will be flashed to the first image slot on the modem.
Note that if you upload a .p7 or any other otherwise invalid Firmware image, the flash will not be performed
and an error will appear with no damage caused to the modem. After you click upload it may appear like it
got stuck but wait a few minutes and the firmware upgrade should be complete. You can then reboot the
modem and it will use the new firmware you uploaded.

TFTP GET section:

26. This is the interface to the TFTP client present in Haxorware. When input with a valid IP and Filename, it will
initiate a TFTP download from the specified TFTP server and save the file to your computer. The limit is 10KB
for the file size so you can’t use this option to download original firmware images, but you can use it to
download modem configuration files, if you want to analyse them on your computer or use them for the
Autoserve feature.