Unlocking the potential of Sagemcom 2704N

[#1]

Here's a snippet of the source, if you want to do it by hand...

        ' MAC
        For I = 0 To 5
            FirmwareConts(&H6A0& + I) = Convert.ToInt32(txtMAC.Text.Substring(I * 2, 2), 16)
        Next
        ' Serial string
        For I = 0 To txtSer.Text.Length - 1
            FirmwareConts(&H808& + I) = Asc(txtSer.Text.Substring(I, 1))
        Next
        FirmwareConts(&H808& + txtSer.Text.Length) = 0

        ' Blank out cfe crc
        For I = &H97C& To &H97F&
            FirmwareConts(I) = 0
        Next
        ' CFE
        Dim retCRC = ComputeChecksum(FirmwareConts, &H580&, &H400&)        '  The CRC32 seed is 0xFFFFFFFF
        FirmwareConts(&H97C& + 0) = (retCRC And &HFF000000&) >> 24
        FirmwareConts(&H97C& + 1) = (retCRC And &HFF0000&) >> 16
        FirmwareConts(&H97C& + 2) = (retCRC And &HFF00&) >> 8
        FirmwareConts(&H97C& + 3) = (retCRC And &HFF&)
        ' Image (like addvtoken)
        retCRC = ComputeChecksum(FirmwareConts, 0, FirmwareConts.Length - 20)
        FirmwareConts(FirmwareConts.Length - 20) = (retCRC And &HFF000000&) >> 24
        FirmwareConts(FirmwareConts.Length - 19) = (retCRC And &HFF0000&) >> 16
        FirmwareConts(FirmwareConts.Length - 18) = (retCRC And &HFF00&) >> 8
        FirmwareConts(FirmwareConts.Length - 17) = (retCRC And &HFF&)

[#2]

Matty, thanks.  I already had a look at your source code from the VB files but I wasn't confident that I knew enough about the CRC algorithm to code it myself and not make a mistake.  I ended up doing it the easy way.  I managed to access a Windows 7 computer and use it just to run your programmes - the one to change the MAC/serial no. and the one to decrypt the config - both successful.
Now I have to decide if I take the plunge.  Is there still no easy way to get back to the original firmware by uploading via the web GUI?  I like to have an escape route!  I have two binary images that I have been able to download - original-plusnet-bcm-image-72731.bin and original-plusnet-flash-backup-removed-ids.bin.  I know that al teast the second one comes from you.  However, they don't seem to be in the right format to upload through the web GUI.  When I run them through your app, there is a lot of red writing!  Also, the second one is about 8MB which is a lot bigger than the other images I have seen.  Is the move to one of your images a one way deal?

[#3]

Hello, oh both of those images (original-plusnet-bcm-image-72731.bin, original-plusnet-flash-backup-removed-ids.bin) are just raw flash dumps.  They will not upload via the Web-GUI.
The original-plusnet-bcm-image-72731.bin does not even contain a CFE,  I think that was from another thread when I was talking about Openwrt to someone.
I only made the ones starting with "2704N-sagemcom-plusnet-whole-image-no-ids-XXX.zip" work with the web-GUI.  Which are all based on the old firmware.
I can understand your reluctance to change any firmware because there is always risk involved.  But perhaps I can ask when what you are planning to use it for?.  Because there maybe another way around it.

[#4]

Here's a link to all my 2704N (ver 1) stuff:
https://drive.google.com/open?id=0B4-Ln6UubyEeb1VQaTZDaXJzNVE

EDIT:
I've just uploaded a firmware to restore it back to the original (7.273.1) using the web interface.  BUT I have not tested it.  Because I need my good computer which may take a week.
https://drive.google.com/open?id=0B4-Ln6UubyEeemhzdnBFWHdxWkk > Something's wrong

[#5]

I've just re-tested the original firmware and it worked? > https://drive.google.com/open?id=0B4-Ln6UubyEeemhzdnBFWHdxWkk
Just a 'heads-up', the first time I tried it.  I got a red power led on power up???  So I accessed the bootloader recovery menu http://192.168.1.1 and uploaded the file again from there, and it worked?.  I really don't understand why that happened.  I'm guessing there was a flash error somewhere probably because I have not been nice to this router.
Also I've found a early config decrypt code I made for Linux (this one is in C).  It's attached.

[#6]

Matty, thanks again for all your help.  You have really pushed the boat out and I think you have given me all the tools I need now and more.  I am really just trying to explore the potential of this router.  I know some functions have been completely removed and others have just been hidden even from the original expert_user.html.  I am happy to take some risks but it is always good to minimise them.

[#7]

Many thanks Matty123123 and Darsh for your hard work (and anyone else I've missed)
I have a v2 box, and after updating the Firmware to 3B and following the steps in Post #77 bridge mode is working perfectly.

Thanks again!

[#8]

cheers guys/gals.

[#9]

Hi All,
I've just joined and I've got the Hub one (which is a 2704n I believe).
I want to allow ping on the external interface, I've got newish firmware (Software version 4.7.5.1.83.8.217.1.1 Last updated 06/01/16) and I can't access expert_user.html or dumpcfgdynamic.cmd, is there another way to get to the config on this version ?
Maurice

[#10]

The Hub One is a totally different device. This thread is about the Hub Zero, which is the 2704n.
The Hub One is a re-branded BT HomeHub 5A, I think its firmware is very similar and likewise does not have an option to reply to pings on the external interface, sorry.

[#11]

Thanks Matty123123
I have updated the Firmware to 3B and following the steps in Post #77 bridge mode and cant get the file to update.
Get a graphic issue . Is it posible to fix your link to this file in your post 77  test-bridge-config.conf.pdf
Cheers

[#12]

Hi Ciderman, welcome to the forum.
I'm not clear on precisely what error you are getting, so a bit of a guess here. The file you need to upload is test-bridge-config.conf - the .pdf extension has only been added on to enable it to be attached to a post (file types are constrained).

[#13]

Thank You Anotherone thats done the trick.I have the bridge mode working now .

[#14]

I was looking at how to set a reserved ip range :
Very helpful post from Eva:
Some additional options e.g. turn DHCP on/off, limit DHCP address range, reserve addresses and some other things are available via the Sagemcom GUI i.e.
http://192.168.1.254/expert_user.html

Original Post: http://www.ispreview.co.uk/index.php/2015/01/isp-plusnet-launch-faster-hub-zero-2704n-broadband-rout...

[#15]

All that information is either in this thread or other threads on the Hardware board. There is some, note I said some, rather ignorant remarks made over there on ISP review.