Debrand Ericsson W35 - Rogers Rocket Dock

[westofanywhere]

The W35 runs linux. As you might expect, there are a functionally rich set of cli tools to set up, configure and determine the status of the W35. Included in these tools are configuration functions which set up the country, operator and cellular functionality for the device.

The key is that you need cli access as user "operator" or "root" via telnet or ssh2 to perform these functions. I should point out as well that the W35 cli functionality is documented in the W35 System Admin Guide, which used to be available from the Ericsson FWT website. I don't know where it can be obtained now, but I do have a .pdf copy of this document on my PC.

You should also be aware that both the Rogers W35 RocketHub and the Bell W35 TurboHub originally ran the same R13A version of the W35 firmware dated Oct 16, 2009. Bell eventually issued a firmware update R13B dated Nov 18, 2010.

The W35 System Admin Guide of which I have a copy is for the R12 release of the W35 firmware.

So, the long and the short of it is, that if you can figure out how to access linux on the W35 as root, you will likely be able to configure the device to the full extent of its capabilities. And yes, the W35 System Admin Guide does mention that there are three different versions of the W35: "There are different models of the Ericsson W35 available each supporting different combinations of frequency bands; 850/1900/2100 MHz, 900/1900/2100 MHz and 2100 MHz only." I have not yet determined how you can tell which variant is which, other than by using it. Could it be that the device has hardware differences to accommodate those three variants?



westofanywhere

[westofanywhere]

Just a post script to my previous posting: as a newbie here, I just noticed that I could upload a file to Digital Kaos for access by all. I would not have any problems uploading the .pdf of the W35 System Admin guide. But I would like to have it clarified as to what the legal and copyright issues might be. Would this be a problem either to this site, or potentially to whomever now owns the copyright to the document?

westofanywhere

[Meat-Head]

just upload the pdf and just say your a new member if any comeback

welcome to dk the worlds best website.

are you frpm emerica?

[westofanywhere]

From Canada, eh!

The .pdf of the W35 System Admin document is almost 2.5Mb in size. It is too big to upload, based on the max file sizes for .pdf that I see in the upload window.

TIA

[westofanywhere]

W35 Sys Admin file as a .zip

Here is the W35 Sys Admin file as a zipped .pdf file.

Enjoy!

[DjohnB]

Has Anybody Gleaned anything from the Administrators Guide

G'day, Firstly, thanks for putting the Administrators Guide up for people to download.
Had anybody gleaned anything from this file such as what setting to change IF you can get into it ?
Cheers
DjohnB

[Vechinus]

Inside is a Sierra Wireles air card mc8790v Is my only chance of unlocking this by putting into a pc slot & using dc-unlocker?

Hello
The Sierra Card inside mc8790v is unlocked!!!
I inserted it in my notebook, installed drivers from SierraWireless and it worked fine with any network.
The internal CD of the card is turned off .

[westofanywhere]

Sys Admin commands to change Region

The question was posed as to what commands would allow one to change the Region for which the W35 was functional. The following command is found on p 29:

5.1.1 Set PRL Region
To set a PRL region, the following command is used:
$ cf set cellular.prl_region <region>
$ cf commit
The <region> is an integer in the interval 0 ? 255 and current valid values are:
0 ? No regional preference/no region defined
1 ? Europe / Rest of the World.
2 ? North America.
3 ? Australia.
4 ? Japan.
6 ? H3G, W2100, G900/1800



The Rogers W35 web-based management interface must be customized to lock out certain functionality and parameter changes. I can only guess how this is accomplished. For sure, the web interface on my Rogers W35 has a number of options grayed out. How specific this is to the Rogers W35, I do not know.

What I do know is that the Bell Canada W35 TurboHub originally used the same firmware based on version number and release date. Bell W35 users encountered frequent internet disconnects and Ericsson issued an updated firmware which Bell has available on its website:

How to update the software on my Ericsson W35 Turbo Hub

Rogers has not issued any firmware updates for the W35.

westofanywhere

[Akofa]

is there a way to completely replace firmwire for the w35?

[westofanywhere]

@Akofa:

you are probably familiar with the saying "where there is a will, there is a way...". So, I am sure it could be done.

Judging by the following W35 Event Log contents,

Oct 16 19:51:27 (none) user.notice kernel: klogd started:
BusyBox v1.10.2 (2009-10-16 19:55:11 CEST) Oct 16 19:51:27 (none) user.notice kernel: Linux version 2.6.23.14
([email protected]) (gcc version 3.4.3
(MontaVista 3.4.3-25.0.70.0501961 2005-12-18)) #1 Fri Oct 16 19:51:15 CEST 2009
the W35 runs BusyBox, which I understand to be a specialized, compact packaging of Linux .

So, someone who had the desire and the technical abilities could reverse-engineer a firmware package for the W35 to do whatever, just like has been done with DD-WRT and Tomato for certain Linksys routers, and others.

But at this point it would seem more useful and effective, to use more conventional "penetration" techniques to access the W35 at root and thus gain access to its full design capabilities as initially provided by Ericsson.

There is as yet no indications by anyone that the device itself is lacking in functionality. The main issue is that we cannot access that functionality that we know to be there.

This just appears to me to be part of an ongoing strategy on the part of carriers to sell us these devices. But by blocking root access they ham-string us, the owners, primarily for their own self-centered reasons.

westofanywhere

[kobiss]

please any some one help me here,after upgrading my router w35, this is what comes up any help..


The system database cannot be accessed right now, since it is locked.
Please wait and retry later.

[jps44]

Convetional Penetration Attemt

westofanywhere and friends:

In case you are interested in getting into your w35, here are a few hints.
Get metasploit framework and use samba symlink traversal exploit.
Usb stick in w35 must be formatted to ext2.
You can then browse the file system.

In the passwd file we find the hash of root password. In my case it was: (including period)

$1$QeUoekTR$NtbPHdFKR/rz372mzYVyt.

Need help with the next step.
PM me if you have advice.

[westofanywhere]

@kobiss:

you say you "upgraded" the firmware of your W35. What firmware were you originally running/what carrier/provider sold you the W35? Where did you get the firmware "upgrade" from, and what version was it?

These are all pretty much required pieces of information in order for us to determine what happened to your unit.

westofanywhere

[kcmconnect]

Thanks for the info

I got this given to me by someone that that no idea what they were doing. I think they upgraded the FW and now i can't login to the WUI. I get the error saying the system DB can't be accesed as it is locked. Anyone have any suggestions?

Also, tks for the manual.

[kcmconnect]

upgraded FW

@westofanywhere. I think it was the firmware from the Ericson site. w35-006-R12C003.arc