UPDATE: OK so I guess this method doesn't work. If you want to give it a shot, feel free. Also, I did wuite a lot of work on this, so if you want my work from playing with the firmware, let me know. The rest of the article is from when I first wrote it thinking it would work.

-----------------

OK, well after months of hard work, I decided the best way to make NetBeer is really just modifying some settings and spitting out flash images. lol NetBeer is now just a fancy word for the stock firmware that allows Serial, SSH, and Telnet access, but will never check for firmware updates. This means that you have complete access to your modem except for the elusive USB host port that doesn't ever seem to have firmware that supports it. It has its driver and MAC address, but it doesn't work even with that. You'll never loose any console access unless you change it back to allow firmware updates. It'll work on any cable provider's system as this is the stock firmware that comes with the unit. (Hence, stock, as it comes with the unit, it's stock. lol OK, I just felt like making that sentence even more redundant. )

Now, on with the show. Below is the tutorial on how to get it on your unit and attached is the archive with the image and software that you'll need. The project requires you to buy a USB JTAG NT device, though.

On a side note, your cfg image is where your mac addresses, serial number, and root cable certificate are stored. Keep your cfg partition in tact.

PREREQUISITES:
In order to install this firmware, you'll need to buy a USB JTAG NT adapter and be comfortable soldering to your modem's board.
If you can't do this or ather have me do it, I will install the firmware for you for a service fee and I'll also need the return
shipping costs as well as a waiver stating that I'm not liable for any damages. I accept paypal for payment, or you can send a money
order for the correct amount agreed upon after discussing this with me. I need to solder a connector to your board to install it
and that takes about 20-30 minutes as they're small peices.

Contact me on this page: http://thelifemaster.com/Main/Contact

If that link doesn't work, go to http://thelifemaster.com and look for the contact link.


INSTALLATION:

DO NOT DO THIS AT 2AM! (Unless your coaxial cable is unplugged.) If you do it at 2AM, your modem might try to pull new firmware
before you have a change to block it.

1.) Follow the tutorial on the link below in order to JTAG your CG3000D or CG3100D unit.
http://thelifemaster.com/Main/Blog&ShowPost=347&postname=Here-s-how-to-JTAG-the-CG3000D-to-change-your-firmware

If that link is down, look at the guide on this one.
http://www.usbjtag.com/jtagnt/modem/CG3100D.php

2.) Now we need to install the CG3000D XML file. The USB JTAG NT software is included in this archive, but requires
registration with http://www.usbjtag.com and you get thefree registration info after you buy the required hardware. Install
that software and open the program files directory for usbjtagnt. Open the config directory in there and copy the XML file
to that directory.

3.) After you install your USB JTAG NT properly and have the unit connected to the board, open the software and on the config
screen, select Modem -> SPIFLASH -> CG3000DSPI and click OK. Click the ID button on your software to detect the chip. It
should say the following in the Output tab.

-flshdct 0
Found Address= 00000000 25FL064A

If not, check the wires. See the tutorial above for more help or contact me.

4.) Now go to the AllFlash tab and click the read button that's next to the button that says ID. It should read all the data
from the chip, onto your screen. Be sure to back up the data from each tab. (You really only need the AllFlash tab backed up,
but it makes it more convienient to have a copy of each section of the ROM.)

5.) Keep the read data in the software and then switch to the Image0 tab. In the left pane of the software is a way to browse
for another directory. Browse for the directory with the Image1.bin file in it from this archive. Now in the lower part of the
pane, you'll see Image1.bin. Double click that and it will fill the Image0.bin with the contents of that file.

6.) Switch to the Image1 tab and double click Image1.bin to fill Image1 with that data as well. This makes both images the same.

7.) Go to the AllFlash tab and click the write button at the top. Write the data to the chip and then when it says "Program pass"
at the bottom, you can unplug the modem, then the USB cable from the computer, then disconnect the USB JTAG NT device from the modem.

8.) Plug your modem back in and while its booting up, install PuTTY and run it. Click the SSH radio button for the connection type
and enter 192.168.0.1 for the Host Name/IP. Make sure its at port 22 and then type a name in "Saved Sessions" and then click "Save."

9.) Before opening the SSH console, you'll need to go to 192.168.0.1 and log in as user MSO with password changeme. Go to the "Remote
management" tab on the side and make sure that "through LAN interface" is checked under the Telnet and SSH options at the bottom.
Click apply.

10.) Now open PuTTY and double click your saved session. It will open a console window. Enter MSO for the user and changeme for the
pass. You'll see the prompt show up. Type the following commands.

cd /non-vol/snmp_cm
max_dload_tries 0

The default is 4 for max_dload_tries, but setting it to 0 will disable it from getting firmware updates that lock your modem down. You
can copy and pase the lines above. Just copy 3 lines including the blank line after max_dload_tries 0 and it will automatically execute
that for you. I don't think you need to reboot, but now you have permanant SSH, Telnet, and Serial port access. The USB Hub I couldn't
get to work. Sorry.

Download NetBeer




Keywords: NetBeer, download, CG3000D, firmware, console access

cd /non-vol/halif

mac_addres 1 (Use this to show mac_address 1)
mac_address 2 00:00:00:00:00:00 (Change 00:00:00:00:00:00 to the mac address you want to set for mac_address 1.)


mac_address 1 - This is the main MAC address. Its the one on the back of your unit and you give that to the cable company when you register your modem with them.

mac_address 2 - I'm not sure what its for, but its the same on all modems.

mac_address 3 - This is your USB MAC address

mac_address 4 to mac_address 8 - I'm not sure what its for. (mac_address 6, 7, and 8 are all the same on all modems.)



You can use the following to show or set your mac addresses as well.

local_bt_mac_address - This is your local bluetooth mac address. (I don't thing the CG3000D does bluetooth, though.)

remote_bt_mac_address - This is your remote bluetooth mac address.

usb_mac_address - This is your USB MAC address.




Your modem has a total of 11 different mac addresses. I left the dummy addresses at 2, 6, 7, and 8 at the stock mac addresses as they're the same on all modems.
You need to change 1, 3, 4, and 5. 1 Is the number on the back of your modem. 3 Is one number or letter higher, 4 is one number or letter higher than 3, and 5 is one number or letter higher than 4. If you don't know the hex number system, you'll need to use a calculator online.

Change your serial number this way:

cd /non-vol/snmp_cm
docsDevSerialNumber SN000000




Keywords: mac address, cg3000d, netgear, modem, router

I've been working on Netbeer for a a few months now and I wanted to post my findings. I discovered that NetGear's open source firmware doesn't include the files for its web interface and it doesn't seem to have all the files that they use in the stock firmware, but much of its there from what I can tell.

In order to compile the NetGear firmware, you need to obtain payware software from Broadcom. While you can get the software from them (for free?) to evaluate it, you need a license to distribute it. Here's what its missing, how to get around this, and what I'm stuck on.

CFE: CFE is the Common Firmware Environment and its the firmware's bootloader. Without it, you have no way to boot the firmware. The workaround that I found is that if you use JTAG, you can copy the bootloader from the stock firmware by saving it as cfe3380.bin or the like. This means you don't need to rebuild the bootloader.

Broadcom SDK: Its a nice to have thing (I think) as it seem to be optional in make menuconfig. It could be useful for easing some troubles in the programs that cause errors.

BFC: The Broadband Foundation Class is most likely required to build this, but I'm not sure.

BRCM 3380 - This is where I fell short big time. The Broadcom Library is a needed component to compile the system with eCos properly and the BRCM is what creates the ecram_sto.bin file. Without it, I have no easy to create a compatible firmware with the CFE bootloader.

As I do have an EIN still, I can use it with the default business structure of a Sole Proprietorship, along with my dead business's DUNS number in order to be seen as a business in order to obtain the software needed. (Assuming I can figure out who has it and how to order it. I tried distributors and I'm trying a manufacturer's rep.) However, if I do get a hold of it, I'll need to buy the license to make NetBeer public and I can only do a little more than NetGear does in that I couldn't ship the BRCM and other stuff with the source code.

So, that being said, I'm looking into alternative firmware that I can use for making NetBeer. Open-WRT is currently incompatible with the BCM3380 chip, so I'm not sure how well it will work. Broadcom stuff isn't open source, so its difficult to write new firmware for it. Below are some things I created along the way.

The GCC 3.2.1 MIPS compiler and other Gnutools are needed to build eCos 2.0 and the only way to compile that toolchain is with GCC 3. I compiled it on Fedora Core 3. Below is the download link and you just need to put the /gnutools directory in your root directory and put /gnutools/bin in your $PATH variable. That should allow you to use those compilers. Put it at the head of your $PATH by doing:

export PATH=/gnutools/bin:$PATH

This will make it find those tools before any other ones that might be present in the directories in $PATH.

Download MIPS32 GCC 3.2.1 toolchain

As you can't compile GCC 3 with GCC 4 since they were too lazy to make it backwards compatible, I can help you out by compiling it for you for other architectures if you really can't do it yourself. They said that they intentionally made part of it not backwards compatible because it was a security issue.

Also, the CG3000D has 2 image partitions and I made it show up that way in USB JTAG NT by creating a modified config file for it. Here it is below. Extract the XML file to your USB JTAG NT's config directory and open it up. Select it on the config settings for USB JTAG NT.

CG3000D config file for USB JTAG NT






Keywords: NetBeer, CG3000D, ecram_sto.bin, GCC 3.2.1, MIPS, MIPS32, download, NetGear, Broadcom, BCM3380, firmware

I'm hoping to get some feedback on this as to what you feel I should do. I'm living with my boyfriend, Ed, and his daughter Brianna treats me like garbage. I tried being nice to her, but she's still mean to me. So that I could have some alone time and also work my job, I installed an electronic lock on our bedroom door. I work from home making Isochronic tones and posting them on YouTube. That's where most of my income comes from and it takes quite a while to make those videos.

Aside from YouTube videos, I'm a programmer and a robotics inventor. My scientific studies and implementation also take up a lot of my time and I want to create NetBeer as an open source firmware to open up all the things on lock down on CG3000D modems so that people can benefit from this new technology. (A LOT of people want new firmware for it as its a popular modem.)

On top of that, I want to design an open source AI person and show people how to design their own AI person. I'm still in the beginning stages of creating that and I'm working on getting more tools, but I have most of them. It will consume a lot of time as well.

In my life, I have a LOT of projects that take quite a lot of concentration and time to complete and I need time to do them. In that, Melia is 8 years old and sometimes I need to help her out as well. Ed wants to spend time with me too.

So, here's my problem. As I don't have a lot of time for my own projects if I work on them for only 4 hours a day and give all my time to Ed and Melia, I can't finish my projects. Ed complains liberally about my not spending time with anyone very much. My focus is on my work as that's my passion in life.

Ed takes MANY things personally and is a bad judge of character much of the time in my opinion and I find myself being told that I'm selfish when he doesn't realize that we just have opposing viewpoints. We both can see each other as being selfish when we examine it from our own viewpoints sometimes.

Today I helped make burritos with him in the kitchen and when I finished doing the part that I was able to help out with, I asked him if he wanted me to stay there with him while he fried up the burritos. He told me no, so I decided to work a bit on my projects and asked him to get me when they were done.

Later, when I came down, I was greeted with an argument from not coming down every once in a while to check up on him. I didn't know that he wanted me to, especially with him stating that I didn't need to stick around. I tried to get him to understand that I had no idea that he wanted me to do that and he told me that its part of being human.

He's had me forgo much of my needs for his needs and complains that I'm selfish when I don't give in, but that when I try to have him compromise, or ask him to respect my needs, that's also selfish.

For instance, I told him that I would schedule work hours so that I would have designated times I can get things done, and then have family time after that, but that wasn't good enough for him. He stated that if Melia is needing something at 4PM, but my work hours are until 5PM, then he wants me to handle it. I said that if its an emergency, then I would. I brought up the fact that before I lived here, he was at work until 5PM. (Granted he was a heavy drinker and spent most of his time at the bar instead of at home, which is no different than my spending time in a locked up room in terms of not spending time with people.) I asked him what would happen if I wasn't here at 5PM, what would he do. He said she would call him.

So, in other words, because I'm at home, its convenient for him to dump all the duties onto me instead of giving me office hours. Heck, I even told him that I'd take the weekends off. That means that I'd work 5 -7 hours a day. (10AM or 12AM - 5PM) I'd be working about 35 hours a week max and that's less than his full time job. He won't accept it. He still maintains that I'm being selfish for not spending my time with the family. I'd be spending more time with the family than I'd be spending at work. (5PM - 12PM M-F and all day on the weekends.)

He demands things of me and yet says he's not trying to control me. He allows Brianna to act like the parent of Melia and Milan and even sometimes boss him around, but maintains that she doesn't control anyone. He said I came into this house and tried to act like the queen of it all, but I said that Brianna does that and he disagreed. Then he turns around and says that before I came in, he was the king and Brianna was the queen. (Mind you, every time he'd contradict his self, I'd call him out on it, but he maintained that he was right with whatever seemed the best end of the contradiction at the time.)

I'm sick of talking in loops with him and he refuses to see anything from my perspective. I want to know what you think of this. As Ed reads this blog too, I'm hoping he'll write his side of the story in a comment or an email that I can update this post with. Maybe 3rd party input will help fix the situation.




Keywords: family, ed, troubles, work

Many people have been wondering how to change the firmware on their CG3000D modem so you can get it out of lock down. This is a very popular modem and much like the CG3100D modem as well. I made more progress in this area as it seems that there are a lot of people interested in this, but no one seems to want to build new firmware to unlock the USB host port or other features that companies don't feel like supporting.

Well, now I figured out the means to update the firmware and it can't be locked down by the companies. JTAG (Actually SPI programming in this case) is where you're talking directly to the flash chip and you can erase it and program it. This is programming at the hardware level. No software can stop that.

So, I made a tutorial on how to change the firmware, but the thing is, I haven't yet made the firmware to replace it with. It'll be called NetBeer and its a pun. As NetGear made the unit and they open sourced their firmware, its licensed under the GNU GPL. (Gnu software is free as in free beer. NOTE: I just went to their site and they apparently now want it thought of as "Free speech" instead of as "Free beer" like they used to say.) Anyway, that's the pun. NetBeer will also be open sourced under the GNU GPL.

I'm looking for programmers who want to help develop the NetBeer software. Now that I finished procuring the means to get the software loaded onto the unit, the next stage is to create a successful compile of the NetGear release. Here's the link to the page for the firmware I'm basing NetBeer off of.

http://kb.netgear.com/app/answers/detail/a_id/…gpl-open-source-code-for-programmers

NetBeer will be to the CG3000D, as DD-WRT is to routers. It should be a sight to "beer-hold!" After we create a successful NetGear build and successfully JTAG it onto the unit, the next step is building NetBeer and JTAGing that on. When its finished, I'll create a forum for NetBeer and people can get help with the software, learn how to add it to their modems.

If they can't do it their self, they can hire myself and anyone else who's interested, to add it to their modem. They'll need to mail a form with it stating that they will not hold the technician accountable for any damages from adding the firmware to their modems. Plus, we'll sell modems with NetBeer preloaded onto them. Get them from the website or from eBay. Anyone can sell them as long as they say they aren't affiliated with the NetBeer programmers if they aren't. NetBeer programmers can show that they are part of the team to add credibility to their sale.

OK, so now for the fun part...

TUTORIAL

After months of hard work and spending over $100 to try different things, I learned how to JTAG my CG3000D.
I'll show you how so you don't have to fumble around in the dark like I was.

CREDITS:

1.) Myself (Na'ven)
2.) USBBDM from usbjtag.com (He helped me figure out how to set up the wiring.)
3.) CAPONE from usbjtag.com (He gave me advice and things to try.)

TECHNICAL NOTES:

1.) The CG3000D uses SPI Flash, So, its a SPI core, not MIPS EJTAG as I originally thought.

REQUIRED EQUIPMENT:

1.) Soldering iron and solder (Get one on eBay or at Radio Shack. Weller is a popular brand.)
2.) USB JTAG NT (Buy that at http://usbjtag.com/zenshop/index.php/…ducts_id=9)
3.) Wire (I used a 14 conductor (wire) ribbon cable)
4.) Multimeter (Optional, but HIGHLY reccomended)
5.) The CG3000D or the CG3100D
6.) A USB type A to USB type B adapter cable. USB JTAG NT doesn't come with a USB cable.

NOTE: USB JTAG NT comes with a header and as well as its own software. (Included in the archive) We'll be using those in this tutorial.

WIRING IT UP:

1.) Open this page: http://www.usbjtag.com/jtagnt/modem/CG3100D.php

2.) On the page above, you'll see that its for the CG3100D. That model is much like the CG3000D and it uses the same chips, so we'll be using that tutorial. In case the page ever gets removed, I added a backup of that page in the the archive for this tutorial.

3.) Begin soldering wires to the pins shown on the page above. Notice that there are 2 chips at play here. The one listed as having an ISP pin is in the same place on the CG3000D as it is on the pictures on that page. There are two chips circled in red. Notice that the flash chip is

4.) Once you finish soldering all the wires to the board and preferably have checked that they don't bridge with any other pins or components, you can solder the olter ends of the wires to the appropriate pins on the header that came with your USB JTAG NT. Take note of the position of pin 1 on the header. When you connect the header to USB JTAG NT, look for the arrow on its connector. The arrow on the connector will show you where pin 1 is.

I included the numbered pinout for USB JTAG NT in the archive as well. Be sure to solder the wires to the short leads on the header.

5.) Unplug your modem from its power.

6.) Connect USB JTAG NT to the header you just soldered all your wires to, making sure that you have pin 1 in the right place. (If you did what I did and used two connectors connected by a header, you'll need to make sure that you twist the wires in twos before adding the connector to your modem's ribbon cable. That way you can line up pin 1 (red wire) on both headers and connect them without the rows being reversed. See the pictures for a picture of what I mean.)

7.) Connect the USB cable to USB JTAG NT and then to your computer.

SOFTWARE

1.) Install the drivers included in the archive if windows doesn't automatically install them.

2.) Install the USB JTAG NT software from this archive.

3.) Run Start -> All Programs -> usbjtag -> UJmodem

4.) Click the "system" tab and you'll see the activation screen. Your hardware ID should be showing. Type in your email address from when you ordered your USB JTAG NT and send an email to the email address you were sent to get your activation code. Include the hardware ID shown on that screen. When you recieve your activation code, type that into the activation code box on that screen. Select the target as anything you'd like. We're just activating it for now. After that, click OK and close that program.

5.) Run Start -> All Programs -> usbjtag -> USBJTAG NT

6.) Change the category and change it back to "Modem" and then select the "SPIFLASH" protocol. Select CG3100DSPI under target select. Check "Register view" and click OK.

7.) Now you should see the main program. Click the button at the top that says "ID" and it should detect your flash properly. Below is an example of a proper flash detect.

-flshdct 0
Found Address= 00000000 25FL064A

Below is an example of an improper flash detect.

-flshdct 0
Unknown flash type!
Report these values http://www.usbjtag.com/vbforum 00,00,00

8.) When you have a proper flash detect, you need to click the "AllFlash" tab and then click the button to the right of the "ID" button you just hit. It should say "R" and have an arrow pointing right. Click it and it will read everything from your chip. It'll take a few seconds and show a progress bar before spilling its contents to the screen.

9.) Now you'll want to backup your chip, so click save and save it as something like CG3000D_Original.bin

10.) Verify that there's actually data in that file. This way you know for a fact that its a good backup. To do that, install HxD (Included in the archive) and open it. In HxD, open the bin file you just saved. If it has FF FF FF all over the entire page, or 00 00 00, then you'll need to back it up again before erasing your chip. If it has FF FF FF in only some places, but it has many other values as well, then you're good to go. When you have a proper backup, move on to the next step.

11.) I can't include a copy of my firmware as it has my MAC address in it, so you'll want to write the firmware you just backed up, to the modem instead. Open the file you just saved as your backup. Click the "W" button that has an arrow pointing left. That will start the write process.

12.) When it finishes writing, diconnect the power to the modem, then the USB cable from the computer, and then disconnect the JTAG connection. Do it in that order so you don't risk damaging your modem. Connect the power to the modem and see if you can go online. If you can, then you're good to go and you finished this tutorial.



FIRMWARE PROGRAMMING

People have been looking for firmware for this unit to enable that USB feature and I still plan on making NetBeer, my own custom firmware for this modem. It'll stop network pushed firmware, allow you to have console access, and also have the USB Host finally activated at long last. I'll change the interface to look better and I'll only add features, not take them away. Plus, you'll have SSH, Telnet, and Serial port access again in case you want to use those instead. If you'd like to help me build it, please let me know. You'll need to have completed this tutorial, though.


DOWNLOAD TUTORIAL: http://thelifemaster.com/Main/uploads/CG3000D-JTAG.zip




Keywords: CG3000D, USB JTAG NT, firmware, tutorial