Professional Documents
Culture Documents
Version VI
Written By Monkeywrencher
Disclaimer:
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA,
OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
POSSIBILITY OF SUCH DAMAGE.
For more information, help and updates, visit http://theoryshare.com if you do not have a
Surfboard Modem, or find this process is too hard for you to complete; pre-modified
modems are for sale at http://theoryshare.com which include the modem pre-modified
with firmware and support. Also support forums FAQs and P2P support are available.
Some things to know before using this guide – Make sure you understand these:
1. This process is real and can increase the speeds you get from your cable service.
2. This guide may not work with all modems it is currently only known to work with
surfboard modems but should work with others.
3. No matter how much you uncap you can be caught JUST AS EASILY use at your own
risk.
4. Don't be disappointed if this does not work for you certain configurations with your
modem or isp may prevent you from properly performing this process.
5. I CANNOT help you if you do NOT have a Surfboard modem.
6. Finally please read through all of the documentation before asking me or anyone else
for support thank you.
7. Every Step must be followed exactly as stated, in exact order. Deviation will result
in FAILURE.
There are 2 good ways to Uncap the first is to use hacked firmware the second is using
DHCP Force. Both methods will work on Surfboard 3100/4100/4200 cable modems but
DHCP force has been reported to work on many modems despite it was designed only for
Motorolas so if this doesn't work it probably can't be done with your modem.
Uncapping With Hacked Firmware
FIRST THIS WILL ONLY WORK WITH SUFBOARD SB4100,SB4101, and SB4200
Modems. It will not work with any other modems. For the SB3100 you must use the
Alternate method for loading firmware. IF YOU ARE ON A EURODOCSIS SYSTEM
THIS PROCESS WILL WORK WITH ONLY THE 3100, 4200 AND YOU WILL NEED
TO FOLLOW STEP 4B.
If you have trouble with this process help/support forums are available at
http://theoryshare.com
STEP 1:
Go to your modem config page http://192.168.100.1 and reset all defaults then unplug
your modem from power and coax. DO NOT REBOOT YOUR MODEM only reset all
defaults it will not take as long as it says.
STEP 2 :
Go to network settings in control panel and change your network settings.
Change your network settings to the following:
IP ADDRESS: 192.168.100.10
SUBNET: 255.255.255.0
GATEWAY: 192.168.100.1
DNS: Leave blank
Once finished Disable then Enable your network interface.
STEP 3:
Open NetBoot and verify the boxes 'Enable FTP Server', “Reset Modem Before Booting”
and “Auto IP” are checked. Now plug your modem in to POWER ONLY. Then after
about 1 minute, press boot over network. Your modem should reset then begin a power
up DO NOT reset your modem this may take a minute or two. Once Netboot shows that
the FTP Client has been disconnected your modem is finished net booting and you may
go on to the next step. DO NOT CLOSE SBRIDER
PICTURES BELOW
STEP 4:
After your modem has been net booted return to your cable modem config page
http://192.168.100.1 and go to the hack tab. Scroll down to “Upgrade Firmware” Proceed
to upgrade your firmware with the firmware corresponding to your cable modem in the
Firmware folder. Fiberware firmware is for advanced users only and is not recommended
for general use. At this point your modem will begin upgrading DO NOT unplug your
modem or change pages on your browser until your modem reboots this in rare cases may
take up to 5 minutes. Once your modem has rebooted return to the config page and verify
that the firmware has been updated by seeing if the hack tab is available. If so you may
plug your modem back into coax and go on at this stage the firmware is permanently
loaded and no further action is required to make it stay on the modem.
Once this upgrade is finished you may change your IP back to normal and you can access
the internet and the hacked firmware.
Step 4B: EURO DOCSIS WORK AROUND: -NEW
If you are on a Euro Docsis System you need to follow this step otherwise proceed to step
5.
Step 1: Open a command line (Start run cmd.exe) or open your favorite
telnet client. At the command line type: telnet 192.168.100.1
Step 2:
Stop the scanning task, type BroadcomDebugMode(1); and hit enter.
Step 3:
Create an instance of the CmApi (which has your config in it):
pCmApi=Instance__5CmApi() and then get a copy of your config: pCfg=GetCm-
Config(pCmApi);
Step 4:
Change the Frequency plan by running SetFreqPlanType(pCmApi,0x1);
*Note, the flag at the end of this command sets the scan table:
Scan North
Europe China Japan
Table America
Step 5:
With the instance of your modified class, save it to the Cable modem using this com-
mand: SetCmConfig(pCmApi,pCfg);
Step 6:
Reboot the modem and go to: http://192.168.100.1/configdata.html
If you did everything right (and the shell did not crash) it should be changed. If the shell
did crash, unplug the modem for 30 seconds and try it again
STEP 5:
All Cable Modems use config files that control your modem’s speed, importance and a
few other parameters. Each time your modem boots it automatically downloads a config
file chosen by your isp. To uncap you must identify a config file which has faster speeds
than the one you are currently using.
The Hackware firmware that you have just loaded includes a config file sniffer under the
sniffer tab. At this point the easiest route to take is to leave the modem on for a few hours
then check back to see if your config list has been updated. Often config names are quite
obvious as to what speed they will give you because of their name. If the config file
names you have are not easy to understand you may have to try a few. If the configs do
not have anything in common and there are a large number of them you are on a dynamic
config system and perform a method known as mac cloning visit http://theoryshare.com
for more details. If you find a config you want to try simply go back to the hack page and
enter the name of the config you want to load and save the change. Reboot the modem
and look at the max download/upload speed listed in the hack page this tells you how fast
the config is if you do not know.
If you have Trouble Finding Configs or Simply want to find more use the method below:
Open the SNMPCfg Admin Program locate the ip address range near the bottom. Then
for the first # in the range put your hfc ip address listed in the DHCP Force Application.
For the second value put a address considerably higher but no to much higher. EX.
10.142.1.213 --> 10.142.255.255 is a reasonable value. 10.142.1.213 -->
255.255.255.255 is not. Play around with this application to find a range that will best
suit you. After the info has been entered use the mass get function to retrieve the config
names. Then press the + next to the names to get a ip address list. Put one of the
addresses from each config into the step 1 program to find out which config is the fastest
in many cases this is not necessary however because the configs are named like
BANNED.cm, BRONZE.cm, GOLD.cm, PLATINUM.cm in which case knowing which
is the fastest does not require a technical solution.
If the configs do not list you will need to retrieve your current config an explanation for
this can be found in the archive this was distributed in.
After you have retrieved the config open it with Config Edit and locate your community
string. It should be a line something like this
snmp_mib_object 1.3.6.1.3.83.1.2.1.4.2 = string "YHaPLFR8";
Enter this string into SNMPCfg to find the config names. After you have found the config
names. You can set you modem to download it when it boots using the config boot
command. If your isp uses dynamic configs (each modem gets a unique config) you will
need to use the following oids Download: 1.3.6.1.2.1.10.127.1.1.3.1.5.1 or Upload:
1.3.6.1.2.1.10.127.1.1.3.1.3.1 in SNMPcfg then once you find a faster modem find its
mac address and clone it. This is not difficult and there are many 3rd party programs that
can help you with this. Refer to the firmware command list for all functions.
Note that the SB3100 uses a different hacked firmware than the SB4XXX Series all of its
functions can be accessed by going to http://192.168.100.1/tcniso.html this same
firmware can be used on the SB4XXX series but it is not recommended. You can find the
4XXX images and many others here: http://thescentoflove.com/test
Thanks for the Fibercoax Group and the TCNISO for software used in this kit. Hackware
firmware written by Kuyza