Telus Actiontec V1000H Hacks and Information

The Actiontec V1000H is a combination xDSL modem/wireless router/internet gateway device which also provides functionality for newer technologies such as VoIP (Voice over IP) and IPTV (Internet Protocol Television). Actiontec manufactures the hardware and markets the devices to third party companies like ISPs (Internet Service Providers). The third party companies then customize the device firmware for their specific needs and provide it to their customers. Actiontec only provides support and firmware updates for NCS (non customer specific) devices. All other devices are supported by the customer (ISP) who has provided the device to the end user, because they contain modified firmware which is specific to each customer.

Telus provides a branded version of this device to some of their High Speed Internet and Optik TV customers.

The Telus firmware for the V1000H has many hidden features and other details which I have decided to compile into a single blog post. This will hopefully be helpful to other users who have this device.

NOTE: Actiontec V1000H devices which are not Telus branded will use a different firmware and will not work the same way. The details provided in this post are specific to the Telus branded devices and may not work properly (or at all) on other devices.

Specifications:

Hardware

Board ID: Broadcom 96368VVW
Memory: 64MB
Flash: 32MB (AM29LV320MT)
Ethernet: 5 Ports (1 WAN)
Wireless: 802.11 (b, g, n)
HPNA: Yes
USB: Yes

Software

Release: 31.30L.48
Kernel: Linux 2.6.21.5
Build Date: Wed Sep 1 23:33:32 PDT 2010

Logging Into the Web Based Administration Interface

The device can be graphically configured and monitored through it’s web based interface. To connect to the interface, open a web browser and enter the internal network IP of the V1000H into the address bar. The default http address to connect to the web interface is: http://192.168.1.254/.

The interface will load the “Home” screen by default. This page displays all kinds of useful status information about the device (like device model, firmware version, MAC address, IP addresses and enabled interfaces). On the upper right side of the page there will be an area which you can use to login to the interface and change the device configuration.

The default username and password for the device is:

Username: admin
Password: telus

Once you have logged in you should change the admin password from the default.

For more information about connecting to the web interface or configuring the device options, please check out the Wireless Gateway Settings Guide, User Manual, or support site provided by Telus.

Web Interface Accounts and Default Passwords

The web interface allows for multiple usernames and passwords which can be used to login to the device. The links available from the main web interface and the pages which you can access change depending on the credentials which you provide.

Administrator

Username: admin
Password: telus

The admin account provides standard end user options for configuring the device, however many options are hidden.

Technician

Username: tech
Password: t3lu5tv

The tech account is used by Telus technicians and provides all of the options hidden under the regular admin interface.

Hidden Pages of the Web Interface

Telus has hidden several pages of the web interface from the end user by removing their links. The configuration pages still exist and function (most likely intended only for Telus technicians or support to use) but you need to know and access the URL directly.

To use any of these features, you must login to the regular web interface first, then open the complete URL of the hidden page (copy and paste them into the address bar of your web browser, or open the links provided below). If the internal network IP address of your V1000H is different from the default then replace it with the correct IP address in the URLs below.

UPDATE: Under standard Telus firmware version 31.30L.55 these pages will no longer work when logged in as ‘admin’. They will always return the error “HTTP 403 Forbidden”. To access these URLs you must login using the ‘tech’ account (the links are also not hidden if you use the ‘tech’ account, but you can still use the links below for quick access).

Advanced Settings:

DHCP Reservation

http://192.168.1.254/advancedsetup_dhcpreservation.html

DHCP Settings

http://192.168.1.254/advancedsetup_dhcpsettings.html

HPNA LAN

http://192.168.1.254/advancedsetup_hpna.html

LAN IP Address

http://192.168.1.254/advancedsetup_lanipaddress.html

LAN IP and DHCP Settings

http://192.168.1.254/advancedsetup_lanipdhcpsettings.html

LAN Subnets

http://192.168.1.254/advancedsetup_lansubnets.html

Remote GUI

http://192.168.1.254/advancedsetup_remotegui.html

Remote Telnet

http://192.168.1.254/advancedsetup_remotetelnet.html

VLAN

http://192.168.1.254/advancedsetup_vlan.html

Utilities:

Upgrade Firmware

http://192.168.1.254/utilities_upgradefirmware.html

Installing Firmware Using the Web Interface

Telus has hidden the firmware update page of the web interface from end users by removing links to it under the area accessed by end users. The page can only be found by entering the correct address into the address bar of your browser.

The default address for the firmware update page is:

http://192.168.1.254/utilities_upgradefirmware.html

From here you can select and update the device firmware using a downloaded image file on your computer. You can use this to install official Telus firmware updates or custom firmware which you select.

NOTE: Firmware updates are not compatible between different customer specific devices. If you install the incorrect firmware for your device (like using Actiontec NCS firmware on a Telus branded V1000H) there is a huge risk of damaging or bricking the device!

UPDATE: Under standard Telus firmware version 31.30L.55 this page will no longer work when logged in as ‘admin’. You must login using the ‘tech’ account (see sections above for details).

Hacked Firmware to Remove Telus Limitations

There is a hacked version of the Telus 31.30L.48 firmware which removes many of the limitations in the standard Telus firmware. The download (file name: Actiontec_V1000H_31.30L.48-TELUS-1302125540.1.img) was initially provided on a thread in the DSLReports forum. This link no longer works. Fortunately, there is a copy available for download under this blog post by Chad Klassen.

You can install the firmware using the method described in the above section. Make sure you extract the image file if it in a compressed archive (like .ZIP or .RAR) so that you are uploading only the raw .IMG file to the device.

NOTE: Your device’s Telus firmware should be the same version (31.30L.48) as the hacked firmware to guarantee it will work properly.

UPDATE: Telus has automatically pushed firmware update version 31.30L.55 to their V1000H devices (including those running the hacked 31.30L.48 firmware). The hacked firmware provided above will no longer work on the devices which have been updated with version 31.30L.55, and it is no longer necessary. You can now access all of the hidden firmware features using the ‘tech’ account (details provided in the above sections).

Logging into the Console Using Telnet

The V1000H has a console which you can access over Telnet. The console can be used to control the device and configure low level options using command line instead of the web interface.

The Telnet service is disabled by default and must be enabled using the web interface. Login to the web interface and access this page:

http://192.168.1.254/advancedsetup_remotetelnet.html

You need to enable the local telnet service and configure the login user name and password which you would like to use. Once you apply the settings the Telnet service will be enabled.

You can access the Telnet port using the telnet command included in Windows. Under Windows Vista and newer the Telnet Client is not installed by default and you may need to add it first using the “Add/Remove Windows Components” wizard in the “Programs and Features” control panel (Start->Run and enter “rundll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,2”).

Depending on your browser/system configuration, you may be able to open this link directly to open your telnet client:

telnet://192.168.1.254

You can also open a new Command Prompt (Start->Run and enter “cmd”) and then type in the following command:

telnet 192.168.1.254

NOTE: If your router IP address is different than the default 192.168.1.254 then you must change it in the URL or command above.

The telnet client should prompt you for the same login and password you configured in the web interface, and should display a shell prompt (“>”) upon successful login:

===Actiontec xDSL Router===
Login: admin
Password:
>

Console Commands

For a list of commands which you can use, enter “?” or “help” into the prompt. The following commands are listed:

?, help, logout, exit, quit, reboot, adsl, xtm, brctl, cat, loglevel, logdest, virtualserver, ddns, df, dumpcfg, dumpmdm, meminfo, syslog, psp, echo, ifconfig, kill, ping, ps, pwd, sntp, sysinfo, tftp, wlctl, arp, defaultgateway, dhcpserver, dns, lan, lanhosts, passwd, ppp, restoredefault, route, save, swversion, wan

I won’t go into the usage and function of every command here. There are many tiny custom tools which are for modifying or operating the device. Many of them are compact versions of regular Linux commands (you can lookup their details via online man pages).

Java Runtime Environment Display Issues on NVIDIA GeForce FX 5200

The Java Runtime Environment (often called JRE, J2RE, Java Standard Edition, or JSE) is a set of software which allows your Windows system to run Java programs alongside your regular applications or within your web browser. Java is a programming language and software platform. Java applications run inside of a virtual machine which translates the portable Java code to native code on the host operating system. More information is available here.

On Windows, you usually use the Oracle (previously Sun Microsystems) version of the Java runtime (downloads available here), older versions available here. Note that there is a Microsoft Java VM (also called the MSJVM, or Microsoft VM), but because of a lawsuit from Sun, Microsoft is no longer allowed to distribute it. It can be downloaded from here and will still install into modern Windows versions, but it is quite old and unmaintained. There is also an IBM JVM (also known as J9), however IBM requires that you license it, so it is really only used internally or made available for IBM branded systems.

I’m currently running the current release of the JRE: Java 6 Standard Edition Version 6 Update 25 (build 1.6.0_25-b06). The issue I’m experiencing has appeared in many older releases which I was running under 32-bit Windows 7.

Basically what happens is that Java applications fail to display some contents of windows or controls. The objects which fail to be drawn correctly are different across various Java applications (ie. one might fail to draw the contents of a text box, another may fail to draw in a button caption, a third may not have any problems at all). However, for each application the same thing will always fail to be drawn no matter how many times you run it again (ie. the first application will fail to draw text box content, and this will happen every time the application is run). The buggy control will function normally even though you cannot see it’s contents (ie typed text will still be in the edit field, blank buttons can still be clicked). In a few cases the window is not functional at all (parts of the Java control panel even do this sometimes).

At first I thought my system was running out of handles, but Task Manager was able to load correctly with all of it’s window contents. Under Task Manager I was able to confirm that the Java process wasn’t using any resources excessively or doing anything else out of the ordinary. When I started troubleshooting the issue, I tried many different JRE versions, web browsers, and even a completely different installations of Windows 7. I also tried changing various settings under the Java control panel with no success. There were also not many other users who were reporting the same problem on the net, so it’s most likely not an issue caused directly by the Java Runtime.

I found that it would usually draw the missing content if I would minimize the window to the taskbar and then restore it (by clicking it’s icon in the taskbar). It also works sometimes if you drag the window onto another screen. As soon as the control refreshes or updates itself, the content will disappear again. You can keep minimizing and restoring the window over and over again in so you can view and interact with the missing contents…this can quickly become very annoying though!

Because the graphical content of the window is visible when it’s restored, it appears to be a problem with the display driver and some hardware accelerated graphics routines which Java uses. I tried lowering the graphics acceleration slider under the advanced display properties, but it didn’t have any effect (even at the lowest level).

I have an NVIDIA GeForce FX 5200 and am running the most current Windows 7 compatible driver release provided by NVIDIA (from their support/download page) for that adapter: version 9.6.8.5 (09/10/2006). The NVIDIA drivers and tools don’t provide many options which you can customize, I changed a few of the 3D options but none of them had any effect on the problematic Java applications.

The driver is old and will never be updated to fix this bug. From the sounds of their release notes, this version fixes many more significant problems in other programs, so downgrading to older versions of the drivers is probably a really bad idea. Java has used hardware accelerated drawing for a long time now, and you’d have to downgrade to a much older version which probably leaves you open to some nasty exploits. In the end it’s probably going to be easier to just replace the video adapter! The GeForce FX 5200 is old and was never a great video card anyway (I just use it because it was the cheapest AGP card I was capable of running Aero).

So for now the best solution is to use the minimize/restore trick for the Java applications that have problems, or replace the video card. If I have any more ideas or discover anything else, I’ll post it here!

Solution for Compaq Presario 2100 Laptop Random System Lock-ups With a PCMCIA Wireless Adapter

Over the past few months a strange problem had surfaced on my Compaq Presario 2100 laptop where it would lock up completely while it was in use. If any sound was playing it would skip endlessly, the mouse and keyboard would not respond, the hard drive led would remain lit. The system would freeze completely and not respond until it was powered off and on again (by holding the power button down for 4 seconds). The problem became more frequent over time and was completely random, making it extremely frustrating to use.

Troubleshooting:

My Compaq Presario 2100 was running Windows Vista (using the driver setup from my earlier blog post) and had initially attributed it to a possible driver issue with my hacked Vista setup. I tried many different configurations (different versions of the drivers, various BIOS and driver settings, different PCMCIA wireless cards and drivers) in an attempt to locate the incompatible driver(s). Eventually I performed a clean install of Windows XP, and was dismayed when it started locking up (before I had even finished installing the drivers and system updates). This confirmed that the problem must be related to the physical hardware.

I cleaned the vents and internal fans with compressed air and confirmed that there was no problem with excessive heat inside the laptop. I ran a full chkdsk (with the option to test and locate bad sectors) which found no problems with the file system and didn’t lock up during testing, which indicates to me that the hard disk is good. I swapped out the two sticks of DDR SDRAM and it didn’t seem to affect the issue at all. This was extremely frustrating because I knew the system had worked fine before, yet after so much troubleshooting I was unable to find any reasonable cause or solution for the laptop locking up constantly.

The Cause:

There are numerous reports from people having problems with the Presario’s PCMCIA/CardBus under both Windows and Linux. After reading through many manuals, technical documents, FAQ’s, forums and various other bits of information related to the Compaq Presario 2100, I found that some Compaq Presario laptops have poorly implemented PCMCIA/CardBus chipsets or non-standard sockets that do not supply enough power to the cards. Some are so bad you simply cannot use any PCMCIA cards at all.

This is no surprise… Compaq used cheap hardware components and many of their systems were poorly designed. The USB on the Presario 2100 is also underpowered, when you plug devices into both USB ports it can cause the system to stop responding (until one device is unplugged) or the USB devices may behave erratically. The onboard MacPhyter ethernet controller also has problems with being flakey and having poor network performance.

The Solution:

Avoid using any PCMCIA cards in the laptop.

I stopped using my PCMCIA wireless adapter and the laptop has not frozen a single time since.

I haven’t tested a wide range of cards but I did try three or four different PCMCIA wireless adapters and all of them caused the laptop to lock up (some more often than others). I will try a few other cards in the near future and see if they still cause problems, but I suspect all of them will cause the laptop to lockup.

Other Solutions for Connecting to Wireless:

If you use a PCMCIA wireless adapter then there are a few solutions for wireless networking on the Presario 2100 which do not use the PCMCIA slot.

A USB wireless adapter or tethered mobile device (like a cell phone) will work fine, however performance may not be the best. The Presario 2100 doesn’t have USB 2.0 so the transfer speed of the USB ports is fairly slow. There are also problems with the power to the ports (as mentioned above), which may cause issues if another USB device is plugged in or the wireless adapter draws too much power.

The Presario 2100 has a mini-PCI slot on the bottom of it’s motherboard which you can access via a removable metal panel on the bottom of the laptop. The panel is unmarked (no icon beside it or on it) and positioned to the right. You have to remove two small black phillips screws and the panel should open up revealing a single card slot.

The mini-PCI slot is standard and can use any kind of mini-PCI wireless card you put into it, even models from other laptops. You may have issues with some Intel wireless adapters which rely on an Intel chipset for some functions (and will not work properly on an ATI chipset like mine has). Broadcom wireless cards are very popular and should work without any problems. The mini-PCI slot is fast and will not have any issues with performance like you would have using USB.

I used a Broadcom BCM4x card which I pulled from an old Acer TravelMate in my Presario 2100 and it worked flawlessly. The only problem I had with this method was that my Presario 2100 had no wireless antennas inside the chassis at all (many other laptops have the antenna wires inside the display or base with open connectors by the mini-PCI slot which you can connect to the card when it is installed). The Presario 2100 has nothing. Without antennas the internal wireless card will not be able to pick up wireless signals properly and is almost useless. I had to salvage two antennas from a broken Dell Latitude and manually install them into the Presario 2100 chassis.

How to Backup/Sync iPhone Apps Installed With Installous and iTunes

Installous is an app used on jailbroken iPhones which you can use to easily locate, download and install cracked iPhone applications. It can be installed using Cydia from the cydia.hackulo.us repository. Installous provides a nice app store style interface with download links for cracked packages stored on popular file storage web sites (like MediaFire). It manages the downloads, stores the cracked IPA packages on the iPhone’s file system, and then installs them onto the iPhone. I also use AppSync which allows you to use iTunes to sync cracked IPA packages from your iTunes library and install them onto a jailbroken iPhone.

Installous provides an option for iTunes Sync but it does not always work as expected. If you install cracked apps using installous and then perform a sync in iTunes, you might run into a problem where iTunes removes the apps during a sync. You might also want to copy the cracked IPA packages which Installous downloads onto your iPhone to your iTunes library, but find that the packages are not backed up during a sync like other packages from the app store.

The solution is to first install the app with Installous and then connect the iPhone to the computer with iTunes. Right click on the iPhone under the left pane in iTunes and select “Transfer Purchases” (or left click to select the iPhone under the left pane and go to “File” –> “Transfer Purchases from … Phone” under the main iTunes menu). iTunes will copy the cracked apps into the iTunes library without any problems and they will no longer be deleted during the next sync.