M OTOROLA S B6120 M ODEM If you are not a power user it is recommended that you do not attempt to use th e SB6120until

more user friendly options are developed. If ordered from ebay user diagmodems or www.modempremodz.net you should have been sent all the appropriate files via email. Ifyou have not r eceived these files please contact sales@modempremodz.net with your modems Custo mer S\N and paypal transaction ID ready. All files will be reset to yourdesignat ed email e-mail address. Backup files split (unused but good to have as future updates may come in splits)UBOOT.bin (bootloa der)ENV1.binENV2.binUB11.binUB12.binBLANK.binNVRAM.bin Custom Firmware SBH_BOOTLOADERSBH_FIRMWARE Full back file xxxxxxxx.bin** (all split files compiled in 1 binary for backup) **Your customer # is the xxxx or 0000 and the archive file is your customer S\N fromyour modem.

Part 1: Useful for Commands and setup for PreMod Buyers THE SETUP FOR ENVIRONMENT You are going to need to setup communication with the modem, from the modems new firmware with embedded BusyBox its easy to login and change options. Follow the instructionsbelow to enjoy your new educational experience within the DOCSIS 3.0 world. Putty is your bestfriend, have fun!! Connect your modem with only the po wer and the RJ-45 when configuring,then once you have it all setup plug in the c oaxial cable if all is fine then you can login again atany time to change options. How to connect to dropbear with Putty Download Putty then launch it Host Name: 192.168.100.1Port: 22Connection Type: SSH Click OpenUser name: rootPassword: sbhacker How to stop frequency scanning cli docsis/scan 0 How to TFTP the config file you want Your modem needs to be online already for this to work cd /nvram/tftp -g -r CONFIGNAME.cm IPADDRESScp CONFIGNAME.cm config.cmreboot

How to upload your config file via FTP and renaming it to autoserve in SSH orcon sole You can use this free ftp server http://filezilla-pro...php?type=server also i f you don't want to rename the config on the modem then just rename it to config .cmbefore you ftp it to your modemYou need to be in /nvram/ cd /nvram/wget ftp://user:password@localipaddress:port/filename.cmcp filename.cm

config.cm (ignore if your file is already named config.cm) To disable firmware updates do the following in SSH or console echo "1" >/nvram/disable_fw_update How to clear the http error logs in SSH or console use rm -rf /nvram/1/3ps (find /usr/sbin/eventmgr_cm and use the PID in the next step )kill -9 PID(also instead of killing the process you could just reboot but this isfaster) Then refresh http://192.168.100.1/cmLogs.htm How to change your MAC address/Serial In console type the followingShort way cli docsis/Production/prodset (Press ENTER until you get to "Cable Modem Serial Num" or "Cable Modem MAC")Cabl e Modem Serial Number is 24 digits Cable Modem MAC needs to be in this format 00-11-22-33-44-55 In SSH type this instead /usr/sbin/cli docsis/Production/prodset all the "prodset" settings are stored in /nvram/1/1 the first 4 bytes are a time stamp so itchanges everytime you save with prodset Enable config page changeable In Console type cli docsis/Motorola/mProduction/htmlReadOnlytype "false" [ENTER]then press W to save In SSH use /usr/sbin/cli docsis/Motorola/mProduction/htmlReadOnlytype "false" [ENTER]then p ress W to save How to enable more debugging info in console (You will see lots of diagnostic output allthe time) cli logger/setDefaults [ENTER] How to Clear DS and US frequency database in NVRAM cli docsis/Debug/clearNvramDsUsFreqDb How to Clear US frequency database in NVRAM cli docsis/Debug/clearNvramUsFreqDb The SB6120 accepts certs straight from a Haxorware modem this is a find from rajkostocd /nvram/1/securityrm mfg_key_pub.binrm cm_cert.ce rrm mfg_cert.cerrm cm_key_prv.bin(the rms are necessary because they are symboli c links by default)then transfer over wget or tftp or whatevercm_cert.cer = cm_c ert.cer from haxorwaremfg_cert.cer = ca_cert.cer from haxorwarecm_key_prv.bin = private.key from haxorwaremfg_key_pub.bin = public key from ca_cert.cer from hax orware (open with your operatingsystem's shell extensions, find the public key s tructure, and copy the hex bytes into a hexeditor having it treat them as hex da ta)and since the originals were chmod 777,chmod 777 mfg_key_pub.binchmod 777 cm_ cert.cerchmod 777 mfg_cert.cerchmod 777 cm_key_prv.bin Set MaxCPE cd proc/net/cd dbrctlecho "20">maxcpecat cpe (this should confirm Max CPEs)

CPEs List--------------------Max CPEs 20--------------------

Mac Name Learning Source Cpe Num--- ---- -------- ------ --------> 00:00:00:00:0 0:00 lbr0 Dynamic eth0 1 Ignore REG_RSP cli docsis/Debug/SetDebugOption 18 1 Debug> showDebugOptions Debug options : 0x00040000Option State Num Bit pos================= ===== === == =====DOCSIS_DBG_NO_MAC_REINIT Off 0 0x00000001DOCSIS_DBG_NO_INIT_ETH0 Off 1 0x00 000002DOCSIS_DBG_NO_AES Off 2 0x00000004DOCSIS_DBG_CAP_DOCSIS_VER_20 Off 3 0x000 00008DOCSIS_DBG_CAP_MCAST_DSID_FOR Off 4 0x00000010DOCSIS_DBG_CAP_MAP_UCD_RECEIP T Off 5 0x00000020DOCSIS_DBG_CAP_DROP_QUAL Off 6 0x00000040DOCSIS_DBG_DEF_SNMP_A CC_NMACC Off 7 0x00000080DOCSIS_DBG_IGNORE_BAD_UCD Off 8 0x00000100DOCSIS_DBG_FO RCE_CONFIRMATION_OK Off 9 0x00000200DOCSIS_DBG_DISABLE_NB_RCP_WA Off 10 0x000004 00DOCSIS_DBG_FORCE_TCC_WO_RCC_OK Off 11 0x00000800DOCSIS_DBG_NO_UCD_ON_PRIMARY_D S Off 12 0x00001000DOCSIS_DBG_SIMULATE_DS_CABLE_CUT Off 13 0x00002000DOCSIS_DBG_ IGNORE_DBC_ACK Off 14 0x00004000DOCSIS_DBG_IGNORE_DCC_ACK Off 15 0x00008000DOCSI S_DBG_BLOCK_BIRNG_REQ_POWER_CHANGE Off 16 0x00010000DOCSIS_DBG_NO_AUTH_ON_AUTH_I NVALID Off 17 0x00020000DOCSIS_DBG_IGNORE_REG_RSP On 18 0x00040000

Part 2:FLASHING THE SB6120 (for backup or update only) If you purchased a premod there is no need to read this section until an update or if you need to backup your modem, you have 2 options. To email sales@modempr emodz.net and have them update it or simply follow the instructions below. Note: In order to flash the SB6120 you must have a USBJTAG (NT) this product is soldexclusively at http://www.USBJTAG.com . Blackcat USB is also compatible but is much slower when flashing. We will cover only USBJTAG Flashing the SB6120 with the USBJTAG NT Make sure USBJTAG NT ISACTIVATED Have your wires soldered up and the usbjtagNT N OT connected and then power up themodem give it 10 seconds then you connect the usbjtagNT to your soldered lead, youshould see the modem lights turn off this is completely NORMAL once you get the modeminto that state run these commands.Save full 8MB dump flshdct 0getram 0 800000save 0 800000 Programing the bootloader flshdct 0ldram bootblock (select the noisy bootloader " SB6120 Noisy Bootloader.bin")erase 00000000 00020000sprogram 0 20000 Programing Image0 lshdct 0ldram Image0 (Select the firmware file you wish to flash either"SBH_Alph a1.0.0.bin" or "SBH_Alpha1.0.0-BPI_DISABLED.bin")erase 00040000 003b0000sprogram

40000 3b0000 Programing Image1 flshdct 0ldram Image1 (Select the firmware file you wish to flash either"SBH_Alp ha1.0.0.bin" or "SBH_Alpha1.0.0-BPI_DISABLED.bin")erase 003f0000 003b0000sprogra m 3f0000 3b0000 http://usbjtag.net/t...sb6120shell.php thanks to usbbdm @ usbjtag.com for this t utorialdevDelay suggests that you just use usbjtagNT to flash only the bootloade r(BootBlock) andget experienced using serial to flash.Part 2: Serial Port Connec tionsNEW SB6120's are missing two resistors that give the output and input, flip the SB6120 PCB over and look near the serial connections see R271 R272 if there isnothing c onnecting the points together then you need to bridge the connection with solder and it'll work. Baud Rate: 115200Data Bits: 8Stop Bits: 1Parity: NoneFlow Control: None Flash firmware via serial cable (U-Boot) You need the noisy boot loader Set up a TFTP server on your computer and set y our NIC to static 192.168.100.2 Use these commandsName your firmware " puma5_ubfi " or it won't work printenvrun updateX (replace X with what you see for ACTIMAGE=1)boot Part 3: Firmware usage and Commands How to remove the p7 header from SB6120 firmwares and some newer Motorolafirmwar e Remove X amount of bytes from the beginning of the fileDocsis: 1604 bytesEuro-D ocsis: 1527 bytes