Uap2105 » History » Version 24
tsaitgaist, 02/25/2016 09:14 AM
add UAP3 pictures
1 | 1 | tsaitgaist | The Huawei UAP2105 is a UMTS femtocell. |
---|---|---|---|
2 | |||
3 | 24 | tsaitgaist | {{>toc}} |
4 | |||
5 | 21 | tsaitgaist | h1. Support |
6 | 1 | tsaitgaist | |
7 | 22 | tsaitgaist | This product has been "EOL/deprecated":http://www1.huawei.com/en/ProductsLifecycle/RadioAccessProducts/small-cell/hw-331134.htm: |
8 | * "UAP2105":http://carrier.huawei.com/en/ProductsLifecycle/RadioAccessProducts/UMTSRANProducts/hw-105766-productlifecycleannouncement.htm (2011-12-20) |
||
9 | * "UAP2105C01":http://carrier.huawei.com/en/ProductsLifecycle/RadioAccessProducts/UMTSRANProducts/hw-105768-productlifecycleannouncement.htm (2011-12-20) |
||
10 | * "UAP2105C01 V300R011":http://carrier.huawei.com/en/ProductsLifecycle/RadioAccessProducts/UMTSRANProducts/hw-105771-productlifecycleannouncement.htm (2011-12-20) |
||
11 | * "UAP2105C01 V300R011":http://carrier.huawei.com/en/ProductsLifecycle/RadioAccessProducts/UMTSRANProducts/hw-112035-productlifecycleannouncement.htm (2011-12-30) |
||
12 | * "UAP2105C01 V300R012":http://carrier.huawei.com/en/ProductsLifecycle/RadioAccessProducts/UMTSRANProducts/hw-145907.htm (2012-06-19) |
||
13 | 1 | tsaitgaist | |
14 | 21 | tsaitgaist | h1. Hardware |
15 | |||
16 | 1 | tsaitgaist | main board (QWG1SUAP VER C), front: |
17 | 22 | tsaitgaist | * CPU (ARM based + integrated UMTS base station baseband): "HiSilicon SD6121RBC":http://support.hisilicon.com/support/ServiceSupNav!getAllProductListByKeyword?mid=PRODUCT_SUPPORT&keyword=SD6121 |
18 | * 1Gb DDR2 RAM: "Samsung K4T1G164QE-HCE6":http://www.samsung.com/global/business/semiconductor/file/2011/product/2010/1/19/130882ds_k4t1gxx4qe_industrial_rev13.pdf |
||
19 | * 10/100 Base-T transformer: "Wurth Electronics Midcom 7112-35-H":http://www.digchip.com/datasheets/download_datasheet.php?id=5503979&part-number=000-7112-35 |
||
20 | * 10/100 Base-T transceiver: "Broadcom BCM5241":https://www.broadcom.com/collateral/pb/5241-PB01-R.pdf |
||
21 | * AND-gate: "Fairchild 74LCX08":https://www.fairchildsemi.com/datasheets/74/74LCX08.pdf |
||
22 | * 3V voltage monitor: "Maxim MAX708S":https://datasheets.maximintegrated.com/en/ds/MAX706AP-MAX708T.pdf |
||
23 | * low dropout regulator: "Texas Instruments TPS73701":http://www.ti.com/lit/gpn/TPS737 |
||
24 | * step down DC-DC convert: "Texas Instruments TPS54331":http://www.ti.com/lit/ds/symlink/tps54331.pdf |
||
25 | 5 | tsaitgaist | |
26 | 21 | tsaitgaist | main board (QWG1SUAP VER C), back: |
27 | 22 | tsaitgaist | * 256Mb NOR flash: "Spansion S29GL256N10TFI01":http://www.spansion.com/Support/Related%20Product%20Info/S29GL256N_overview.pdf |
28 | * 16-bit transceiver: "NXP LVT16245B":http://www.nxp.com/documents/data_sheet/74LVT_LVTH16245B.pdf |
||
29 | * EPD TVS Diode Array: "Semtech SLVU2.8-4 ":http://www.semtech.com/images/datasheet/slvu2.8-4.pdf |
||
30 | 21 | tsaitgaist | |
31 | radio board (QWG1SRM1 VER B): |
||
32 | 22 | tsaitgaist | * low dropout regulator: "Texas Instruments TPS73701":http://www.ti.com/lit/gpn/TPS737 |
33 | * base station transmitter: "Maxim MAX2599":https://www.maximintegrated.com/en/products/comms/wireless-rf/MAX2599.html |
||
34 | * base station receiver: "Maxim MAX2547":https://www.maximintegrated.com/en/products/comms/wireless-rf/MAX2547.html |
||
35 | * GSM baseband: "Texas Instruments T303IFZPH":http://read.pudn.com/downloads152/ebook/667710/t3031_Datasheet_V1.6.pdf |
||
36 | * 16Mb CMOS flash: "Spansion S29NS016J0LBJW00":https://www.spansion.com/Support/Obsolescence%20Notifications/2749.pdf |
||
37 | * CPU?: Texas Instruments D6928BB |
||
38 | 1 | tsaitgaist | |
39 | h2. connectors |
||
40 | 15 | tsaitgaist | |
41 | 1 | tsaitgaist | |
42 | debug connector: |
||
43 | 22 | tsaitgaist | |_. signal/state |_. pin |_. pin |_. signal/state | |
44 | | low | 1 | 2 | pulse | |
||
45 | | TX?/high | 3 | 4 | GND | |
||
46 | | RX?/high | 5 | 6 | low | |
||
47 | | low | 7 | 8 | low | |
||
48 | | TCK?/low | 9 | 10 | pulse | |
||
49 | | GND | 11 | 12 | GND | |
||
50 | | high | 13 | 14 | high | |
||
51 | | GND | 15 | 16 | GND | |
||
52 | | TDI?/high | 17 | 18 | pulse | |
||
53 | | TRST?/low | 19 | 20 | TDO?/low | |
||
54 | | high | 21 | 22 | TMS?/high | |
||
55 | | low | 23 | 24 | low | |
||
56 | | low | 25 | 26 | low | |
||
57 | |\4=. DEBUG | |
||
58 | 1 | tsaitgaist | |
59 | mode connector (use jumper to select): |
||
60 | 22 | tsaitgaist | |_. state |_. pin |_. pin |_. signal |_. mode | |
61 | | high | 1 | 2 | GND | WDGEN | |
||
62 | | low | 3 | 4 | GND | BOOTMODE | |
||
63 | | high | 5 | 6 | GND | JTAGMODE0 | |
||
64 | | high | 7 | 8 | GND | JTAGMODE1 | |
||
65 | | high | 9 | 10 | GND | RUNMODE | |
||
66 | |\5=. MODE | |
||
67 | 21 | tsaitgaist | |
68 | h2. UAP1 |
||
69 | |||
70 | The operator where it was bought from is Vodafone Greece. |
||
71 | The board date is 1023. |
||
72 | |||
73 | 23 | tsaitgaist | {{thumbnail(femto1-case_front.jpg, size=200)}} |
74 | {{thumbnail(femto1-case_back-blur.jpg, size=200)}} |
||
75 | {{thumbnail(femto1-board_front-blur.jpg, size=200)}} |
||
76 | {{thumbnail(femto1-board_back-blur.jpg, size=200)}} |
||
77 | {{thumbnail(femto1-rf_front-blur.jpg, size=200)}} |
||
78 | {{thumbnail(femto1-rf_front-naked-blur.jpg, size=200)}} |
||
79 | {{thumbnail(femto1-rf_back-blur.jpg, size=200)}} |
||
80 | {{thumbnail(femto1-rf_back-naked-blur.jpg, size=200)}} |
||
81 | 1 | tsaitgaist | |
82 | h2. UAP2 |
||
83 | 9 | tsaitgaist | |
84 | 21 | tsaitgaist | The operator where it was bought from is Vodafone Spain. |
85 | The board date is 1201. |
||
86 | |||
87 | This board has more shielding cans. |
||
88 | 20 | tsaitgaist | |
89 | 23 | tsaitgaist | {{thumbnail(uap2-board_front-blur.jpg, size=200)}} |
90 | {{thumbnail(uap2-board_back-blur.jpg, size=200)}} |
||
91 | 1 | tsaitgaist | {{thumbnail(uap2-rf_front-blur.jpg, size=200)}} |
92 | {{thumbnail(uap2-rf_back-blur.jpg, size=200)}} |
||
93 | 24 | tsaitgaist | |
94 | h2. UAP3 |
||
95 | |||
96 | This femtocell was baught directly in china and is not operator branded. |
||
97 | The board date is 1215. |
||
98 | |||
99 | This femtocell even has a power button on the case. |
||
100 | |||
101 | {{thumbnail(uap3-box-front.jpg, size=200)}} |
||
102 | {{thumbnail(uap3-box-back-blur.jpg, size=200)}} |
||
103 | {{thumbnail(uap3-board_main-front-blur.jpg, size=200)}} |
||
104 | {{thumbnail(uap3-board_main-front-naked-blur.jpg, size=200)}} |
||
105 | {{thumbnail(uap3-board_main-back-blur.jpg, size=200)}} |
||
106 | {{thumbnail(uap3-board_rf-front.jpg, size=200)}} |
||
107 | {{thumbnail(uap3-board_rf-front-naked.jpg, size=200)}} |
||
108 | {{thumbnail(uap3-board_rf-back-blur.jpg, size=200)}} |
||
109 | {{thumbnail(uap3-board_rf-back-naked-blur.jpg, size=200)}} |
||
110 | |||
111 | 21 | tsaitgaist | |
112 | 11 | tsaitgaist | h1. Rooting |
113 | 1 | tsaitgaist | |
114 | 22 | tsaitgaist | How to root this device and intercept communication has been shown in August 2015 at the "in Femtoland 350 Yuan for Invaluable Fun":https://www.blackhat.com/us-15/briefings.html#adventures-in-femtoland-350-yuan-for-invaluable-fun presentation ("slides":http://www.slideshare.net/arbitrarycode/adventures-in-femtoland-350-yuan-for-invaluable-fun, "video":https://www.youtube.com/watch?v=U-COwT7dwWg). |
115 | 1 | tsaitgaist | |
116 | 22 | tsaitgaist | This issue has been "analysed":http://www1.huawei.com/en/security/psirt/security-bulletins/security-notices/archive/hw-446728.htm and "fixed":http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-452865.htm by the vendor. |
117 | 1 | tsaitgaist | |
118 | |||
119 | h2. UAP1 |
||
120 | |||
121 | |||
122 | firmware version: QWGM3SUAP4 V300R011C00 SPC173 |
||
123 | 21 | tsaitgaist | |
124 | 13 | tsaitgaist | debug port: |
125 | * UART not found on pins described in slides (all modes) |
||
126 | * no UART identified using JTAGulator (all modes) |
||
127 | * JTAG not found on pins described in slides (all modes) |
||
128 | * no JTAG identified using JTAGulator, using id code and bypass scans (all modes) |
||
129 | |||
130 | 18 | tsaitgaist | boot process (all modes): |
131 | 22 | tsaitgaist | # red and blue LEDs on for 7 s |
132 | # ethernet link on |
||
133 | # red and blue LEDs on for 9 s |
||
134 | # ethernet link off |
||
135 | # red and blue LEDs on for 2 s |
||
136 | # ethernet link on |
||
137 | # red and blue LEDs on for 12 s |
||
138 | # red LED on for 23 s |
||
139 | # red and blue LEDs on for 2 s |
||
140 | # LEDs off for 0.1 s |
||
141 | # red and blue LEDs on for 5 s |
||
142 | # red LED on |
||
143 | 18 | tsaitgaist | |
144 | network ports: |
||
145 | 1 | tsaitgaist | * the first time the link is on, only UDP port 17185 on fixed IP 172.16.1.1 is open, apparently providing wdbrpc service: |
146 | 18 | tsaitgaist | <pre> |
147 | sudo nmap -n -Pn -p21,23,80,17185,6000,6006,7547 -sT -sU 172.16.1.1 |
||
148 | |||
149 | 1 | tsaitgaist | Starting Nmap 6.40 ( http://nmap.org ) at 2015-11-22 20:47 CET |
150 | 21 | tsaitgaist | Nmap scan report for 172.16.1.1 |
151 | Host is up (0.0030s latency). |
||
152 | PORT STATE SERVICE VERSION |
||
153 | 18 | tsaitgaist | ... |
154 | 17185/udp open wdbrpc? |
||
155 | </pre> |
||
156 | * the second time the link is on, all ports are blocked/filtered: |
||
157 | <pre> |
||
158 | sudo nmap -n -A -Pn -p21,23,80,17185,6000,6006,7547 -sT -sU 172.16.1.1 |
||
159 | |||
160 | Starting Nmap 6.40 ( http://nmap.org ) at 2015-11-22 20:53 CET |
||
161 | Nmap scan report for 172.16.1.1 |
||
162 | 12 | tsaitgaist | Host is up (0.0019s latency). |
163 | 20 | tsaitgaist | PORT STATE SERVICE VERSION |
164 | 21/tcp closed ftp |
||
165 | 12 | tsaitgaist | 23/tcp closed telnet |
166 | 21 | tsaitgaist | 80/tcp filtered http |
167 | 12 | tsaitgaist | 6000/tcp filtered X11 |
168 | 6006/tcp filtered X11:6 |
||
169 | 21 | tsaitgaist | 7547/tcp filtered unknown |
170 | 17185/tcp closed unknown |
||
171 | </pre> |
||
172 | 14 | tsaitgaist | |
173 | h2. UAP2 |
||
174 | |||
175 | 21 | tsaitgaist | firmware version: QWGM3SUAP4 V300R011C02 SPC182 |
176 | |||
177 | debug port: |
||
178 | 14 | tsaitgaist | * UART not found on pins described in slides (all modes) |
179 | * JTAG not found on pins described in slides (all modes) |
||
180 | * no JTAG identified using JTAGulator, using id code scan (all modes) |
||
181 | |||
182 | boot process (all modes): |
||
183 | 22 | tsaitgaist | # red and blue LEDs on for 7 s |
184 | # ethernet link on |
||
185 | # red and blue LEDs on for 14 s |
||
186 | # ethernet link off |
||
187 | # red and blue LEDs on for 2 s |
||
188 | # ethernet link on |
||
189 | # red and blue LEDs on for 1 s |
||
190 | # ethernet link off |
||
191 | # red and blue LEDs on for 2 s |
||
192 | # ethernet link on |
||
193 | # red and blue LEDs on for 8 s |
||
194 | # red and blue LEDs on for 25 s |
||
195 | # red and blue LEDs on for 2 s |
||
196 | # LEDs off for 0.5 s |
||
197 | # red and blue LEDs on for 3 s |
||
198 | # 6x LEDs off for 2 s |
||
199 | # 6x red and blue LEDs on for 2 s |
||
200 | # red LED on |
||
201 | 21 | tsaitgaist | |
202 | network ports: |
||
203 | 19 | tsaitgaist | * the first time the link is on no ports are open on IP 172.16.1.1 (compared to UAP1 for wdbrpc service): |
204 | * the second time the link is on, only TCP port 80 is open an there is an HTTP service |
||
205 | <pre> |
||
206 | 1 | tsaitgaist | Starting Nmap 6.40 ( http://nmap.org ) at 2015-11-25 21:56 CET |
207 | Nmap scan report for 172.16.1.1 |
||
208 | 21 | tsaitgaist | Host is up (0.0014s latency). |
209 | 1 | tsaitgaist | PORT STATE SERVICE VERSION |
210 | ... |
||
211 | 80/tcp open http [[GoAhead]]-Webs httpd |
||
212 | |_http-methods: No Allow or Public header in OPTIONS response (status code 400) |
||
213 | 21 | tsaitgaist | | http-title: User Login |
214 | 1 | tsaitgaist | |_Requested resource was http://172.16.1.1/index.htm |
215 | ... |
||
216 | </pre> |