21 Followers
47 Following
120 Posts
#securityresearch, embedded #electronics, #amateurradio, #opensource etc.
My passion is figuring out how things work, whether they be documented, undocumented, or intentionally obscured
So far I post a thread whenever I have time to work on a project, hashtags in the first post of the thread
Websitehttps://kwest.haus/
LocationSeattle
Outdoors Hobbieshttps://mountains.social/@kwest_outdoors
Whipping up a fresh serving of concave hulls today #gis #SummitsOnTheAir
(7/n)
So while the "DOCSIS WAN" page gave us the downstream DOCSIS channels that my modem is actually using, of course I used the spectrum analyzer to investigate every channel across Xfinity's whole downstream bandwidth (on the node serving me, at least). This includes channels serving internet data as well as digital television channels. See screenshots and alt text for a few different things that happen across the band
#electronics #docsis #cablemodem

(6/n)
And we get a nice little UI as a result!:
1. A spectrum analyzer with configurable center frequency/bandwidth span
2. Per-downstream-channel plots of Power (in dBmV - remember characteristic impedance is 75Ω here) and Modulation Error Ratio (in dB) over time
3. Constellation diagrams of any of the active downstream QAM channels!

These are pretty cool - someone has done some good work in developing this feature. Lots of companies simply got rid of the spectrum analyzer functionality in their modems instead of fixing the bug after the Cable Haunt (https://github.com/Lyrebirds/Cable-Haunt-Report/releases/latest/download/report.pdf) vulnerability came out a few years ago, which is a shame since it's such a great learning and debugging tool. So I'm happy to see Hitron is actually working on adding this functionality to a modem that didn't have it yet.
#electronics #docsis #cablemodem

(5/n)
The "Spectrum" hidden tab is a little more complicated - the javascript isn't just grabbing some data from a .asp page and displaying it in a table, it's a whole application with buttons and fancy graphs. So I figured out a devtools javascript console incantation to get the main page to load it, ignoring the fact that it's marked as not visible:
```js
$('#maincontent').html('');
var loadPage = "advanced_spectrum.html"
$('#maincontent').load(loadPage, function(response,status){
if (status=="success") {
$("a").unbind("click");
}
});
$('#maincontent').fadeIn();
```

(This is basically ripped from /js/mainApp.js, lines 305-321)
#electronics #docsis #cablemodem

(4/n)
The "DOCSIS Event" one gets its info from https://192.168.100.1/data/status_log.asp, and is an event log. I'm happy they've started adding this functionality - it's way more helpful for troubleshooting internet outages than just looking at the status LEDs on the front of the device.
#electronics #docsis #cablemodem
(3/n)
For the first one, "Gateway", I browsed to https://192.168.100.1/js/status_process.js and can see that it gets its data from https://192.168.100.1/data/getCMInit.asp. Browsing there shows some pretty basic data
#electronics #docsis #cablemodem
(2/n)
So of course I poked around the UI a bit. Looks like for each tab there's an HTML and javascript file loaded, and the JS in turn gets the actual data (including some incomplete "TODOs") from requests to /data/*.asp pages. Notably, the response from /data/getSubMenu.asp indicates there are some hidden pages!
#electronics #docsis #cablemodem
(1/n)
Some time since the last time I checked, a new firmware version was rolled out for my cable internet modem (Hitron CODA https://www.hitrontech.com/wp-content/uploads/2021/07/Datasheet-2021-CODA.pdf) with a web interface (https://192.168.100.1). It reports software version 7.3.5.3.2b2, and looks like this was added in 7.3.5.0.1b2 (per https://ussupport.hitrontech.com/portal/en/kb/articles/how-do-i-access-the-gui-on-the-coda). There's 3 different tabs on the main page: "System Information", "DOCSIS WAN", and "LAN Port Status". The middle one is the most interesting (to me, at least) since it contains a bunch of info about the upstream/downstream channel allocations.
tl;dr: combo of (directional coupler or rf circulator) and a "carrier cancellation circuit"
Starting to get some decent looking FSK signals out of the (STM32 into FT-1900R) system, one step closer to MSK144 and FT8...
The tones are roughly +1kHz/+2kHz at 500baud, MSK144 is +1kHz/+2kHz at 2000 baud. They are generated using 1.2v, 1.42v from the STM32 DAC into the GMSK pin of the radio main unit (deviation setting "Wide")
#HamRadio #electronics