OpenWrt Forum Archive

Topic: Linksys locking down serial bootloader console to prevent hacking

The content of this topic has been archived between 11 Apr 2018 and 16 Apr 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

You can also use the shadow_data trick to get into the normal userspace.

At the U-Boot console, type:

  setenv shadow_data admin:XkRnx5gdf6RdQ:0:0:99999:7:::
  boot

Then login with username 'admin' and password 'admin'.

Now to start exploring the running system ...

-- Rod

I've found the way to make this permanent.

At the U-Boot console, type:

  setenv shadow_data admin:XkRnx5gdf6RdQ:0:0:99999:7:::
  setenv sync_to_pt enable
  reset

After the reboot, the shadow_data value will be set to the new value, allowing you to use the default 'admin' password to log into userspace.

If we are able to decode the firmware upgrade image format, we should be able to make an 'unlocking' firmware image which does these three commands (and unlocks the console) from userspace.

(Last edited by rwhitby on 25 Feb 2009, 12:20)

hi, is there a way i can get openwrt running on my wrp400?

what is this ETSI-Firmware doing?

Maybe if would be possible to create own uboot configuration with kernel and apps without cybertan rom. Voip advantages might be added later. Maybe software could be debuged in some kind of arm emulator and debugger...

The discussion might have continued from here.