# Introduction

The target device is ZTE ZXHN H298A Home Gateway, a commercial router commonly provided by ISPs. This post highlights how I got physical access of the router, found and interface UART and finally analyzed the boot process. I have not performed any type of exploitation or code execution yet. Enclosure Router

# Objectives

Gain physical access to the PCB
Identify exposed UART interface
Identify UART pads and interface with its console
Analyze boot process and identify attack surfaces

# Threat Model

## Attacker Capabilities

Physical access to the device
Ability to disasemble the enclosure and access the PCB
Ability to interface with exposed debug interfaces
Tooling limited to low cost;
- USB-to-TTL adapter
- Generic Saleae Logic Analyzer
- Soldering Iron

## Assests of Interest

UART console access level
Bootloader interaction capabilities
Firmware and filesystem access
Credentials or configuration data
Debug interfaces left exposed in production

# Methodology

## Device Teardown

The enclosure could be popped open and the PCB could simply unscrews from the enclosure. I have not taken any destructive measures to get physical access to the PCB. I then visually inspected the PCB for 4 exposed test points, headers and unpopulated pads. PCB inside the enclosure

## UART Discovery

I found a group of 4 test pads laying next to each other close to the SoC. Theyre overall shape and spacing is consistent with a typical UART interface (minus the markings) found on a regular consumer grade networking/IoT devices.

UART Router 1

## UART Configuration

I connected every exposed pad to the logic analyzer to observe the signal activity during the boot of the device. From the graph, two pads seem to show activity. One of them seems to stick to low and flicker to high; I assumed this was the TX pad. The other one did the same thing but less frequently and seems to stick to high and flicker to low; I assumed this is RX. As for GND (ground), I used a multimeter in continuity mode. The last remaining pad is automatically 3.3V - 5V (VCC) which is of no use to me right now. Saleae Logic Analyzer Saleae Logic Analyzer SS

# Boot Process Overview

## Bootlog Analysis

SoC initializes (Ralink MT751020)
DRAM initialized: 128MB
NAND flash detected: 128MB, partitioned
UART boot messages observed

## Boot Stages Identified

Early Boot:DRAM and NAND detection, UART console enabled.
Bootloader Stage: Images located in flash, decompressed, and kernel loaded.
Kernel Stage: Linux 2.6.36 initialization, CPU setup, memory map, peripheral drivers, and scheduling initialized.
Init Stage: BusyBox launches, mounts root filesystem, starts system services, network, and logging modules.

## Bootloader Observations

Bootloader identifies two kernel images
code
```
kernel1
```
and
code
```
kernel2
```
and two root filesystems
code
```
rootfs1
```
and
code
```
rootfs2
```
— likely for recovery/failsafe.
Offers boot/test/normal modes via UART prompt.
Early memory setup and peripheral probing visible.
Errors like missing TAG_PARA_MAC1 may indicate debug remnants or default configurations.

## Kernel Observations

Linux 2.6.36 compiled with GCC 4.3.4 on MIPS 34Kc.
Multiple CPUs initialized (4 threads/VPEs), caches enabled, IRQs configured.
Drivers for PCI, Ethernet, USB, ADSL, and DSP modules loaded.
Several warnings and errors logged
code
```
db view init fail
```
,
code
```
Install WPS KEY Callback Failed
```
indicate potential misconfigurations.

## Storage & Partition Clues

NAND flash partitions: Bootloader, tag, config, rootfs1/2, kernel1/2, tcpdump.
Root filesystem: squashfs (read-only) with optional JFFS2 overlay.
Partition layout suggests dual-image update mechanism — useful for firmware analysis.

## Security Mechanisms Observed

UART console exposes boot messages but no password protection in early boot.
Kernel enables
code
```
bootconsole
```
early but disables it after switching to ttyS0.
Warnings/errors may hint at missing validation checks.
Encryption/signature checks (
code
```
dbInitSignVal
```
) performed, but default values may be fallback if verification fails.

# Limitations & Roadblocks

All consoles modes are password protected.
Flash Chip is BGA and I dont have tools to work with it.
Limited chip documentation

# Attack Surface Assessment

Analyzing the configuration seems to be pulled from an ACS (Auto Configuration System) which suggests I might be able to perform some sort of ACS spoofing attack to reconfigure root credentials and perhaps enter test/debug mode.

# Next Steps

Firmware Extraction
Reverse Engineering
Lessons Learned
Conclusion

# Boot Process

code
DRAMC V2.0 (0)

DRAMC V2.3.0.2 (0)

MT751020 at Mon Jun 13 23:44:43 CST 2022 version 1.1 free bootbase

Memory size 128MB

NAND Page size:2048B,Total size 128MB 
bmt pool size: 81 

board ip address:192.168.1.254
reset DECT & SWITCH start.
..
reset DECT & SWITCH over.

*** Press 1 means entering boot mode***
*** Press 2 means entering testing mode***
*** Press 3 means entering norm mode***
............................................................

Found image at 0x01680000

Found image at 0x01a80000
****Try the first image...
rootfs 1:addr:87400000--size:c00000
decompress_addr 1680100 decompress_addr_end 1a80000 
Decompress to 80002000 free_mem_ptr=80600000 free_mem_ptr_end=80780000
75xx: 0x80
Uncompressing [LZMA] ...  done.
Linux version 2.6.36 (xialei@localhost.localdomain) (gcc version 4.3.4 (GCC) ) #1 SMP Mon Jun 13 23:49:50 CST 2022
ISPRAM0: PA=00368000,Size=00008000,enabled
DSPRAM0: PA=1dff8000,Size=00001000,enabled
Check boot para cksum...
c0e c0eboot para cksum OK!
Boot 1'th image
bootPara reserved_fs_size=c00000
bootPara.runmode=3
pdt_verinfo_init: tcVerInfo->RunMode[3]
bootPara.bootWhichImg=1
bootPara.img_info_tbl[0].flashOffset=0x 1680000
hw_ver=00
sHardVersion=V1.0.00
memsize:128MB
Ralink MT751020 SOC prom init
bootconsole [early0] enabled
CPU revision is: 00019555 (MIPS 34Kc)
Determined physical RAM map:
 memory: 073e0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Zone PFN ranges:
  Normal   0x00000020 -> 0x00007400
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000020 -> 0x00007400
3 available secondary CPU TC(s)
PERCPU: Embedded 7 pages/cpu @810eb000 s7168 r8192 d13312 u65536
pcpu-alloc: s7168 r8192 d13312 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 29432
Kernel command line:  es=1
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 64kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=0002c136
Readback ErrCtl register=0002c136
nmi base is 81144200
Memory: 110904k/118656k available (3512k kernel code, 7752k reserved, 829k data, 240k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
	RCU-based detection of stalled CPUs is disabled.
	Verbose stalled-CPUs detection is disabled.
NR_IRQS:64
CPU frequency 750.00 MHz
 Using 266.667 MHz high precision timer.
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Calibrating delay loop... 498.07 BogoMIPS (lpj=2490368)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
34K sync es set to 1.
Config7: 0x80080500
Limit of 4 TCs set
TLB of 64 entry pairs shared by 2 VPEs
VPE 0: TC 0 1 2, VPE 1: TC 3
IPI buffer pool of 16 buffers
CPU revision is: 00019555 ((null))
TC 1 going on-line as CPU 1
CPU revision is: 00019555 ((null))
TC 2 going on-line as CPU 2
CPU revision is: 00019555 ((null))
TC 3 going on-line as CPU 3
Brought up 4 CPUs
NET: Registered protocol family 16
11930:22:53 [KMONITOR][Notice] [monitor.c(900)MonitorInit]  cspmonitor init... !  
MT7510_pcie_init:1
check pcie link up status: 
isRC0_LINKUP=1 
isRC1_LINKUP=1 
registering PCI controller with io_map_base unset
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff]
pci 0000:00:01.0: BAR 8: assigned [mem 0x20100000-0x201fffff]
pci 0000:00:01.0: BAR 9: assigned [mem 0x20200000-0x202fffff pref]
pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x200fffff]
pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x200fffff] (PCI address [0x20000000-0x200fffff]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [io  disabled]
pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff]
pci 0000:00:00.0:   bridge window [mem pref disabled]
pci 0000:02:00.0: BAR 0: assigned [mem 0x20100000-0x201fffff 64bit]
pci 0000:02:00.0: BAR 0: set to [mem 0x20100000-0x201fffff 64bit] (PCI address [0x20100000-0x201fffff]
pci 0000:02:00.0: BAR 6: assigned [mem 0x20200000-0x2020ffff pref]
pci 0000:00:01.0: PCI bridge to [bus 02-02]
pci 0000:00:01.0:   bridge window [io  disabled]
pci 0000:00:01.0:   bridge window [mem 0x20100000-0x201fffff]
pci 0000:00:01.0:   bridge window [mem 0x20200000-0x202fffff pref]
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
11930:22:54 [KQOS][Info] [qos.c(4999)CSPKernel_QoS_I] Qos module init
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
TC3162 hardware watchdog module loaded.
spitest init OK!
squashfs: version 4.0 (2009/01/31) Phillip Lougher
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 216
cryptomgr_test used greatest stack depth: 15632 bytes left
cryptomgr_test used greatest stack depth: 15600 bytes left
cryptomgr_test used greatest stack depth: 15360 bytes left
io scheduler noop registered (default)
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
brd: module loaded
tc3162 mtd init: mt6573_nand_init enter
MediaTek MT6573 Nand driver init, version v2.0
tc3162: flash device 0x01000000 at 0x1c000000
tc3162 mtd init: nandflash_probe enter
Allocate 16 byte aligned buffer: 804915b0
Enable NFI Clock
# MT6573 NAND # : Use HW ECC
manu_id=2c, dev_id=f1
ext_id=809504,
Device found in MTK table, ID: 2cf1
[NAND] pagesz:2048 eccsz: 32, oobsz: 128
Support this Device in MTK table! 2cf1 
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron NAND 128MiB 3,3V 8-bit)
bmt pool size: 81 
[mt6573_nand] probe successfully!
Creating 9 MTD partitions on "MT6573-Nand":
0x000000000000-0x000008000000 : "Whole flash"
mtd: partition "Whole flash" extends beyond the end of device "MT6573-Nand" -- size truncated to 0x75e0000
0x000000000000-0x000000040000 : "Bootloader"
0x000000040000-0x000000080000 : "tag"
0x000000080000-0x000000280000 : "config"
0x000000280000-0x000001680000 : "rootfs1"
0x000001680000-0x000001a80000 : "kernel1"
0x000001a80000-0x000001e80000 : "kernel2"
0x000001e80000-0x000003280000 : "rootfs2"
0x000003280000-0x000003c80000 : "tcpdump"
physmap mtd driver register!!!
pkq map rom ram_flash:offset:87400000---size:c00000
!!!! led bink!!!
RT3xxx EHCI/OHCI init.
nf_conntrack version 0.5.0 (1732 buckets, 6928 max)
IPv4 over IPSec tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team
Initializing XFRM netlink socket
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
NET: Registered protocol family 17
NET: Registered protocol family 15
Bridge firewalling registered
Ebtables v2.0 registered
PPP generic driver version 2.4.2
NET: Registered protocol family 24
11930:22:55 [KSWETH][Notice] [sweth_core.c(2547)sweth_init] SW&ETH HAL driver initing!
11930:22:55 [KSWETH][Notice] [sweth_core.c(143)CreateSwEthObjs] Create SW & ETH objects
11930:22:55 [KSWETH][Notice] [sweth_core.c(157)CreateSwEthObjs] Failed to get SWITCH attr, iRet=-2
11930:22:55 [KSWETH][Info] [sweth_core.c(164)CreateSwEthObjs] nEmac = 1, nSw = 0, nEth=5.
11930:22:55 [KSWETH][Warn] [sweth_core.c(293)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(306)CreateSwEthObjs] ETH obj0: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 0
11930:22:55 [KSWETH][Warn] [sweth_core.c(293)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(306)CreateSwEthObjs] ETH obj1: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 1
11930:22:55 [KSWETH][Warn] [sweth_core.c(293)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(306)CreateSwEthObjs] ETH obj2: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 2
11930:22:55 [KSWETH][Warn] [sweth_core.c(293)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(306)CreateSwEthObjs] ETH obj3: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 3
11930:22:55 [KSWETH][Warn] [sweth_core.c(293)CreateSwEthObjs] Failed to get TAG_PARA_MAC1!
11930:22:55 [KSWETH][Info] [sweth_core.c(306)CreateSwEthObjs] ETH obj4: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 4
11930:22:55 [LEDKEYDRV][Info] [ledkey_mod.c(1082)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:55 [LEDKEYDRV][Info] [ledkey_mod.c(1082)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:55 [LEDKEYDRV][Info] [ledkey_mod.c(1082)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms
11930:22:55 [TAGPARAM][Info] [tagparam_mod.c(1348)TagaramodInit] Tagaram module Driver Version 0.0.1.
11930:22:55 [TAGPARAM][Info] [tagparam_mod.c(1381)TagaramodInit] parse tag param success
Jiffies_test Driver Init Successfully 
logger: created 1024K log 'logger_main' major '99'
logger: created 512K log 'logger_sys' major '101'
11930:22:55 [KSWETH][Notice] [csp_ifinfo.c(209)csp_ifinfo_init] Initializing CSP IFinfo...
11930:22:55 [Kernm255][Info] [ver_info.c(407)ver_info_init] ver_info_init
11930:22:55 [Kernm255][Info] [ver_info.c(189)ReadInfoFromVer] ver_info_init
11930:22:55 [Kernm255][Info] [ver_info.c(196)ReadInfoFromVer] ver_info_init
11930:22:55 [Kernm255][Info] [ver_info.c(211)ReadInfoFromVer] wFirmwareForm is:0x1 
: success register character device for /dev/monitor
11930:22:55 [MIRROR][Notice] [cspmirror.c(1262)mirror_init] ***********mirror_init************
11930:22:55 [KIGMPSNP][Info] [br_multicast_se(7398)br_mcparam_init] info init!
11930:22:55 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(stb)
11930:22:55 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(srtc)
11930:22:55 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(trtc)
11930:22:55 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(hard)
11930:22:55 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(null)
11930:22:55 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(drop)
11930:22:55 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_mark)
11930:22:55 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(vlan_prio_mark)
11930:22:55 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_vlan_prio_mark)
child_dev_init start
child_dev_ioctl_set set[80357bf4]
khelper used greatest stack depth: 14864 bytes left
khelper used greatest stack depth: 14840 bytes left
#######begin FDB_Notify Reg
#######after FDB_Notify Reg
#######begin FDB_Notify Reg
Shouldn't be in WHILE
#######after FDB_Notify Reg
11930:22:55 [LEDKEYDRV][Error] [ledkey_callback(26)keycallback_ini] Install WPS KEY Callback Failed!
VFS: Mounted root (squashfs filesystem) readonly on device 31:9.
Freeing unused kernel memory: 240k freed
busybox init and set aff
sched_setaffinity cpu all success
Algorithmics/MIPS FPU Emulator v1.5
mount used greatest stack depth: 14312 bytes left
mount used greatest stack depth: 14144 bytes left
init normal mode!!!

Loading drivers and kernel modules... 

tcpdump_jffs2 exist! mount...
=========== mount jffs ===========
procfile used greatest stack depth: 14128 bytes left
mount tcpdump_jffs OK
tccicmd V1.1.0.0 (Jun 13 2022-23:51:16)
femac.c:v1.00-NAPI 29.Mar.2011
rasw: FE MAC Ethernet address: 00:00:AA:BB:CC:FF
11930:22:58 [KSWETH][Info] [femac.c(7782)csp_create_vpor] register_netdev ETH obj: eth0.
11930:22:58 [KSWETH][Info] [femac.c(7782)csp_create_vpor] register_netdev ETH obj: eth1.
11930:22:58 [KSWETH][Info] [femac.c(7782)csp_create_vpor] register_netdev ETH obj: eth2.
11930:22:58 [KSWETH][Info] [femac.c(7782)csp_create_vpor] register_netdev ETH obj: eth3.
11930:22:58 [KSWETH][Info] [femac.c(7782)csp_create_vpor] register_netdev ETH obj: eth4.
11930:22:58 [KSWETH][Notice] [fe_mac_adapter.(813)Register_raeth_] Register raeth EMAC driver
11930:22:58 [KSWETH][Notice] [sweth_core.c(560)RegisterEmacDrv] Register EMAC driver
11930:22:58 [KSWETH][Notice] [sweth_core.c(403)InitSwEthObjs] Initialise SW & ETH objects
11930:22:58 [KSWETH][Warn] [sweth_core.c(1629)hal_set_port_ma] Driver do not support set MAC address!
11930:22:58 [KSWETH][Warn] [sweth_core.c(1629)hal_set_port_ma] Driver do not support set MAC address!
11930:22:58 [KSWETH][Warn] [sweth_core.c(1629)hal_set_port_ma] Driver do not support set MAC address!
11930:22:58 [KSWETH][Warn] [sweth_core.c(1629)hal_set_port_ma] Driver do not support set MAC address!
11930:22:58 [KSWETH][Warn] [sweth_core.c(1629)hal_set_port_ma] Driver do not support set MAC address!
insmod used greatest stack depth: 13864 bytes left
pcm_silicon: module license 'MTK' taints kernel.
Disabling lock debugging due to kernel taint
PCM V2.3 (Nov 30 2016 15:04:57) 
init mod-slic3

Silabs SLIC type selected by SW makefile compile option

Init fxsNum(3) + fxoNum(0) = deviceNum(1)
init mod-ksocket
init mod-acodec
[adslTimer (1564)23:51:17]  ADSL_MODEM_STATE_DOWN
init mod-foip3

===============================
|| MTK DSP init successfully ||
===============================

dbgTool_init init v2.0 
pid 89's current affinity mask: (null)
pid 89's new affinity mask: 8
pid 86's current affinity mask: (null)
pid 86's new affinity mask: 8
pid 96's current affinity mask: (null)
pid 96's new affinity mask: 8
pid 94's current affinity mask: (null)
pid 94's new affinity mask: 8
pid 95's current affinity mask: (null)
pid 95's new affinity mask: 8
taskset: invalid number '0x8'
11930:23:00 [OSS][Notice] [pc.c(1883)main] sched_setaffinity cpu 0 (ret = 0)
sh: can't create /proc/systools: nonexistent directory

ZXHN H298A 
login: 11930:23:02 [User][Info] [db_shm_mgr.c(131)DBShmSrvInit] iShmId:65538
11930:23:02 [User][Info] [db_shm_mgr.c(146)DBShmSrvInit] pShmBuf:60000000
11930:23:02 [User][Notice] [bget.c(179)database_bpool] sub_bpool buf(0x600008b4),len(1046348)
cspd loading plugins@/lib/cspd/
11930:23:02 [User][Info] [oss_debugtrace.(445)OssLogServerIni] FIFO Log Init OK.
11930:23:02 [User][Info] [oss_debugtrace.(453)OssLogServerIni] SIP Log Init OK.
11930:23:02 [User][Info] [oss_debugtrace.(461)OssLogServerIni] DNS Log Init OK.
11930:23:02 [User][Info] [oss_debugtrace.(469)OssLogServerIni] CWMP Log Init OK.
11930:23:02 [User][Info] [oss_debugtrace.(478)OssLogServerIni] Call Log in  Init OK.
11930:23:02 [User][Info] [oss_debugtrace.(486)OssLogServerIni] Call Log out  Init OK.
11930:23:02 [User][Info] [oss_debugtrace.(494)OssLogServerIni] DHCP Log Init OK.
11930:23:02 [User][Info] [oss_debugtrace.(502)OssLogServerIni] Routing Table Init OK.
11930:23:02 [User][Info] [dnscheat_mgr.c(347)DNSCheatModuleI] dnscheat init
11930:23:03 [OSS][Error] [oss_subproc.c(46)OssAttachEvHand] GetPCBPtrByPID(cspd.dhcp6s_task.dhcp6s) failed 

11930:23:03 [OSS][Error] [oss_subproc.c(46)OssAttachEvHand] GetPCBPtrByPID(cspd.cspd.slaac_mgr) failed 

11930:23:03 [dhcp4c][Warn] [dhcp4c_inst.c(4674)_dhcp4cRegSendO] Send code[60]fun[0x609284] is replaced by fun[0x60fb9c]
11930:23:03 [dhcps][Info] [dhcps.c(165)DHCPSInit] module init success!dhcp server
[source/log_file.c(2233)ProcLogConf] Set LOG_FILE_CONF_SET_PDTCONF.
[source/log_file.c(2287)ProcLogConf] Set cAutoSave = 1
[source/log_file.c(2333)ProcLogConf] Set LogFileFormatLog
11930:23:03 [ipif_mgr][Info] [ipv4_addr_mgr.c(1568)ipv4AddrInit] [ipv4AddrInit] success
11930:23:03 [ipif_mgr][Info] [ifs_ipif.c(2195)ifsIPIFInit] [ifsIPIFInit] success
11930:23:03 [OSS][Error] [oss_subscribe.c(525)SubScribPublish] SubScribPublish server 10002 already exist!
11930:23:03 [OSS][Error] [oss_subscribe.c(525)SubScribPublish] SubScribPublish server 10008 already exist!
11930:23:03 [qos_mgr][Info] [hardware_qos.c(2676)ComMTK7510Regis] PdtMTKRegisteIFQdisc***register*****
11930:23:03 [DB][Notice] [dbc_core.c(395)_dbInit] Check whether the proc file started successfully
11930:23:03 [DB][Notice] [dbc_core.c(401)_dbInit] the proc file started successfully
11930:23:03 [DB][Error] [dbc_mgr_tbl.c(614)dbCreateDomainN] create tbl failed, (ParentControlUser) domain(FilterMode) error default value
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(8) table(WLANSSID)
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(8) table(WLANSSID)
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(8) table(WLANSSID)
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(8) table(WLANSSID)
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(9) table(WLANSSID)
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(9) table(WLANSSID)
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(9) table(WLANSSID)
11930:23:03 [DB][Notice] [dbc_mgr_tbl.c(1932)dbSetValCommByR] cannot find row, RowNo(9) table(WLANSSID)
11930:23:03 [qos_mgr][Info] [interface_api.c(1726)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[3] Handle[0x50fc88]
11930:23:03 [qos_mgr][Info] [interface_api.c(1769)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[3], pHandle[0x50fc88], Event[6]
11930:23:03 [route_mgr][Info] [policy_route.c(1615)policyRtTableIn] policyRtTableInit ok
11930:23:03 [route_mgr][Info] [policy_route.c(1528)defPolicyRtChai] defPolicyRtChainInit ok
11930:23:03 [route_mgr][Info] [policy_route.c(2011)defVLANMarkChai] defVLANMarkChainInit ok
11930:23:03 [route_mgr][Info] [route_mgr.c(462)routeInit] SubScribPublish DefGW Service OK
11930:23:03 [bridge][Warn] [bridge.c(2873)bridgeInit] SubScribPublish Bridge Service OK
11930:23:03 [bridge][Warn] [bridge.c(2884)bridgeInit] Bridge Initialization success(bridge_mgr)
11930:23:03 [eth_mgr][Info] [eth_mgr.c(1241)ethInit] module init success!ethernet mgr
11930:23:03 [sntp_diag_mgr][Info] [sntp_diagnostic(515)SntpDiagPowerOn] module init success!sntp_diag_mgr
11930:23:03 [sntp_mgr][Info] [time_policy.c(109)TpInit] module init success!2
11930:23:03 [sntp_mgr][Info] [sntp_mgr.c(2038)sntpInit] module init success!SNTP mgr
11930:23:03 [tr143_mgr][Info] [tr143_mgr.c(536)tr143Init] module init success! tr143 mgr init
11930:23:03 [binding_mgr][Info] [binding_mgr.c(1653)bindingInit] [bindingInit] end
11930:23:03 [multiapd_mgr][Info] [multiapd_mgr.c(707)MultiapMgrPower] MultiapMgrEvent=0x1100, wMsgLen=0
11930:23:03 [multiapd_mgr][Info] [multiapd_mgr.c(713)MultiapMgrPower] SubScribPublish multiap Service OK
11930:23:03 [kernelmonitor][Info] [cspd_monitor.c(494)MonitorMain] monitor init success
11930:23:03 [PingTracert_mgr][Info] [tracert_mgr.c(1464)tracertInit] module init success!tracert mgr
11930:23:03 [ppp_mgr][Info] [ppp_mgr.c(8791)PPPInit] module init success!
11930:23:03 [addr6_mgr][Info] [addr6_mgr.c(3147)Addr6Main] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
11930:23:03 [prefix_mgr][Info] [prefix_mgr.c(3512)prefixInit] Prefix Init Success!
11930:23:03 [ptry_mgr][Info] [ptry_mgr.c(481)ptryMgrInit] module init success!(PTry mgr)
11930:23:03 [ddns_mgr][Info] [ddns_mgr.c(2021)ddnsInit] module init success!ddns_mgr
11930:23:03 [dns_mgr][Info] [dns_mgr.c(475)dnsInit] SubScribPublish NetIF Service OK
11930:23:03 [dns_mgr][Info] [comp_dns_mgr.c(77)CompDnsInit] Init Comp_Dns_Mgr Success!
11930:23:03 [OSS][Warn] [oss_event_handl(149)OssEventListCal]  OssEventListCallChain id = 0x0001!!
11930:23:03 [fm_mgr][Info] [fm_mgr.c(3388)fmServerInit] module init success!Enter FmServer Init!
11930:23:03 [fm_mgr][Info] [fm_mgr.c(5286)fmMgrInit] module init success!fm mgr
11930:23:03 [OSS][Warn] [oss_event_handl(149)OssEventListCal]  OssEventListCallChain id = 0x0001!!
11930:23:03 [ipv6_tunl_mgr][Info] [ipv6_tunl_mgr.c(359)IPv6TunlMgrMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
11930:23:03 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1851)TunnelMain] wEvent=0x1100, wMsgType=1, wMsgLen=0, wState=0
11930:23:03 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1615)TunnelMgrInit] [TunnelMgrInit] start
11930:23:03 [ipv6_tunl_mgr][Info] [tunl46_mgr.c(1620)TunnelMgrInit] [TunnelMgrInit] OK
11930:23:03 [ipif_mgr][Info] [ifs_netif.c(2582)interfaceNotify] [interfaceNotifyHook] start, to pid[cspd.cspd.qos_mgr]
11930:23:03 [DB][Error] [dbc_mgr_view.c(429)dbMgrCommViewAd] db view init fail(DHCPSHostCfg)
11930:23:03 [DB][Error] [dbc_mgr_view.c(429)dbMgrCommViewAd] db view init fail(DHCPSPool)
11930:23:03 [DB][Error] [dbc_mgr_view.c(429)dbMgrCommViewAd] db view init fail(DHCPSBind)
11930:23:03 [DB][Error] [dbc_mgr_view.c(429)dbMgrCommViewAd] db view init fail(BrVlan)
11930:23:03 [DB][Error] [dbc_mgr_view.c(429)dbMgrCommViewAd] db view init fail(BrVlanport)
open file failed
11930:23:03 [DB][Error] [dbc_mgr_view.c(429)dbMgrCommViewAd] db view init fail(BrFilter)
11930:23:03 [DB][Warn] [dbc_mgr_pdt_enc(82)_getTagparamMD5] var/tagparam_m does not exist!
11930:23:03 [DB][Warn] [dbc_mgr_pdt_enc(156)PdtDBSetAESEncr] _getTagparamMD5 failed! Use default
11930:23:03 [DB][Info] [dbc_person_wlan(581)dbPersonInitPSK] set wlan0: EChRuXHYjj from flash 
11930:23:03 [DB][Info] [dbc_person_wlan(581)dbPersonInitPSK] set wlan3: H3fgKArKPa from flash 
11930:23:03 [DB][Info] [dbc_person_wlan(581)dbPersonInitPSK] set wlan4: EChRuXHYjj from flash 
11930:23:03 [DB][Info] [dbc_person_wlan(581)dbPersonInitPSK] set wlan7: H3fgKArKPa from flash 
11930:23:03 [DB][Error] [dbc_person_dev_(35)dbPersonInitHar] get parameter from Flash failed HardwareTag
11930:23:03 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:03 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:03 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:03 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:03 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:03 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:03 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_user_cfg.xml
11930:23:03 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_user_cfg.xml
11930:23:03 [DB][Info] [dbc_mgr_file.c(1311)dbFileLoadCfg] find file /var/tmp/db_Decry_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/db_backup_cfg.xml
11930:23:05 [DB][Info] [dbc_mgr_file.c(2491)dbInitSignVal] szCfgSignVal= ZXHN H298A V1.0,iRet:0
11930:23:05 [DB][Info] [dbc_init_com_tr(120)ComDBSetTransfe] **********enter ComDBSetTransferCfg!
11930:23:05 [OSS][Warn] [oss_event_handl(149)OssEventListCal]  OssEventListCallChain id = 0x0009!!
11930:23:05 [DB][Info] [dbc_core.c(1331)dbEndTm] (ALL) end, use 273 tick
11930:23:06 [dnsurl_policy][Info] [route_api.c(449)RegisterDefGWNo] RegisterDefGWNotify sucessed, ipType[3] event[3] Handle[0x47bb94]
11930:23:06 [dhcps][Info] [ipif_api.c(1792)RegisterV4AddrN] RegisterV4AddrNotify start, event[1] IF_ID[DEV.IP.IF1] WanLan[2] Handle[0x5f2074]
11930:23:06 [dhcps][Warn] [interface_api.c(801)GetIFBaseInfo] call dbAPIQryView failed!IF_ID[DEV.IP.IF1], count[0]
11930:23:06 [dhcps][Warn] [dhcpsinst.c(468)getIFInfoAndCre] Call function failed!GetWANLANBaseInfo, IF_ID[DEV.IP.IF1]
11930:23:06 [dhcps][Info] [dhcpsinst.c(554)dhcp4sIFRegiste] dhcps start inst,dhcp4sIFRegister fail
11930:23:06 [dhcps][Info] [interface_api.c(1726)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[2] Handle[0x5f215c]
11930:23:06 [dhcps][Info] [interface_api.c(1769)RegisterNetIFNo] Reg NetIF Notifyiptables used greatest stack depth: 13672 bytes left
 ok, IF_ID[], WanLan[2], pHandle[0x5f215c], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1726)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF3] WanLan[3] Handle[0x60e630]
11930:23:06 [dhcp4c][Info] [interface_api.c(1739)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF3]
11930:23:06 [dhcp4c][Info] [interface_api.c(1769)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF3], WanLan[3], pHandle[0x60e630], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1726)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF5] WanLan[3] Handle[0x60e630]
11930:23:06 [dhcp4c][Info] [interface_api.c(1739)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF5]
11930:23:06 [dhcp4c][Info] [interface_api.c(1769)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF5], WanLan[3], pHandle[0x60e630], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1726)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF6] WanLan[3] Handle[0x60e630]
11930:23:06 [dhcp4c][Info] [interface_api.c(1739)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1769)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF6], WanLan[3], pHandle[0x60e630], Event[6]
11930:23:06 [dhcp4c][Info] [interface_api.c(1726)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF7] WanLan[3] Handle[0x60e630]
11930:23:06 [dhcp4c][Info] [interface_api.c(1739)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF7]
11930:23:06 [dhcp4c][Info] [interface_api.c(1769)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF7], WanLan[3], pHandle[0x60e630], Event[6]
11930:23:06 [dhcp6s][Info] [ipif_api.c(1964)RegAddr6Notify] RegAddr6Notify start, event[3] IF_ID[] WanLan[2] Handle[0x4664cc]
11930:23:06 [adev_mgr][Info] [extend_options.(174)CspAddParseOptP] CspAddParseOptPolicy, option code=125, handle=0x427fec
11930:23:06 [adev_mgr][Info] [access_dev_mgr.(359)adevStart] module start success!(Adev mgr)
11930:23:06 [srm_mgr][Info] [srm_mgr.c(277)SrmInit] module init success!use SRM_DBVIEW data
11930:23:06 [wwan_mgr][Info] [wwan_mgr.c(1080)WwanMgrInit] module init success!wwan mgr
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1197)AllocNetIF] AllocNetIF start,IF_ID DEV.POTS1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1197)AllocNetIF] AllocNetIF start,IF_ID DEV.DT1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(972)lowlayerIFChang] oldcount 0, newcount 1
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1197)AllocNetIF] AllocNetIF start,IF_ID DEV.DT2
11930:23:06 [OSS][Warn] [oss_event_handl(149)OssEventListCal]  OssEventListCallChain id = 0x1103!!
11930:23:06 [wwan_mgr][Info] [ifs_netif.c(972)lowlayerIFChang] oldcount 0, newcount 1
11930:23:06 [syslog_mgr][Info] [route_api.c(449)RegisterDefGWNo] RegisterDefGWNotify sucessed, ipType[3] event[3] Handle[0x536fb0]
[syslog_common.c(228)_SyslogHandleLogctrlReply] operation result --- Success
[syslog_common.c(425)SyslogRegisterLogcat] RegisterToLogcat success.
sh: can't create /proc/systools: nonexistent directory
11930:23:06 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/log
[source/log_file.c(1942)_ProcLogConfSetEnable] Set SaveEnable=254
Bad argument `webfilter'
Try `ip6tables -h' or 'ip6tables --help' for more information.
Bad argument `wfmode'
Try `ip6tables -h' or 'ip6tables --help' for more information.
Bad argument `webpolicy'
Try `ip6tables -h' or 'ip6tables --help' for more information.
11930:23:09 [fw_core_mgr][Info] [ipif_api.c(1792)RegisterV4AddrN] RegisterV4AddrNotify start, event[3] IF_ID[] WanLan[3] Handle[0x48a908]
11930:23:09 [fw_core_mgr][Info] [ipif_api.c(1964)RegAddr6Notify] RegAddr6Notify start, event[3] IF_ID[] WanLan[3] Handle[0x48b070]
11930:23:09 [fw_core_mgr][Info] [route_api.c(449)RegisterDefGWNo] RegisterDefGWNotify sucessed, ipType[1] event[3] Handle[0x48a7c8]
11930:23:09 [adev_mgr][Info] [access_dev_mgr.(455)adevReg] moudle cspd.cspd.fw_core_mgr reg adev trigger!
11930:23:09 [fw_core_mgr][Info] [ipif_api.c(39)getBridgeIDByIP] GetInterFaceBaseInfo failed[DEV.ETH.LINK1]
11930:23:09 [fw_core_mgr][Info] [ipif_api.c(39)getBridgeIDByIP] GetInterFaceBaseInfo failed[DEV.ETH.LINK1]
iptables: No chain/target/match by that name.
ip6tables: No chain/target/match by that name.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
sip alg change port ok!
rtsp alg change port ok!
11930:23:12 [fw_core_mgr][Info] [fwalg_mgr.c(42)fwAlgStart] fwAlgStart
11930:23:12 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/log
11930:23:12 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/log
11930:23:12 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/log
11930:23:12 [Kernel][Info] [proc_file_mod.c(1287)file_open] open file: /proc/cfg/log
[source/log_file.c(1643)ReadFileDataOnly] fread error: pfile=0xd0b9a0,Len=13,iRet=0
11930:23:12 [fw_core_mgr][Info] [fwmac_api.c(249)CfFwMacModeChan] FwMac Mode change to [0]
iptables: Bad rule (does a matching rule exist in that chain?).
ip6tables: Bad rule (does a matching rule exist in that chain?).
11930:23:13 [fw_core_mgr][Info] [fwmac_api.c(329)CfFwMacEnabled] FwMac Enabled change to [0]
==============c:1
Sorry, rule does not exist.
11930:23:13 [fw_core_mgr][Info] [fwmac_api.c(82)ebtChainLoading] subChain loading[ebtables -D FORWARD --dir-wan -j mf_forward][0]
iptables: No chain/target/match by that name.
11930:23:13 [fw_core_mgr][Info] [fwmac_api.c(50)iptChainLoading] subChain loading[iptables -t filter -D macfilter -j mf_routing][0]
[source/log_file.c(3776)logFileProcMsg] operation result --- Success
[source/log_file.c(3631)logRegisterToLogcat] RegisterToLogcat success.
11930:23:13 [log_mgr][Info] [log_mgr.c(2000)logSetSerialEna] logGetVerDate str = 20220614.
11930:23:13 [Kernel][Info] [proc_file_mod.c(1417)file_close] close file: /proc/cfg/log
ip6tables: No chain/target/match by that name.
11930:23:13 [fw_core_mgr][Info] [fwmac_api.c(54)iptChainLoading] subChain loading[ip6tables -t filter -D macfilter -j mf_routing][0]

ZXHN H298A 
login: