Pour ceux que ça intéresserait on peut accéder à l'interface UART sur ces ONT.
Voici le bootlog :
ROM: V1.1.4
ROM: CFG 0x00000006
ROM: SFLASH-4
U-Boot 2015.04-lantiq-gpon-1.3.4-ALB_0.4 (Aug 07 2017 - 17:19:33), Build: ptin_gsxxx0g
Board: PTIN-GSXXX0G
Chip: FALCON-V2 (A22)
Bootmode: 0x06
Reset cause: Power-On Reset
CPU Clock: 400 MHz
Watchdog enabled
I2C: ready
DRAM: 64 MiB
SF: Detected W25Q128BV with page size 256 Bytes, erase size 4 KiB, total 16 MiB
Net: GPHY0, GPHY1
Press PASS to abort autoboot in 5 seconds
SF: Detected W25Q128BV with page size 256 Bytes, erase size 4 KiB, total 16 MiB
SF: 6815744 bytes @ 0x800000 Read: OK
## Booting kernel from Legacy Image at 80f00000 ...
Image Name: 3FE7SW04030009
Created: 2017-08-07 16:54:35 UTC
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 1267773 Bytes = 1.2 MiB
Load Address: 80002000
Entry Point: 80002000
Verifying Checksum ... OK
FInd DTB
00 1389_V5 found! 80f00040
PTINDTB:PCB=1389_V5# found!PTINDTB:PCB=1389_V5# found!-- 5125743
Uncompressing Kernel Image ... OK
..1389_V5 found!
OWRTDTB found!
[ 0.000000] Linux version 3.10.49 (rsilva@rsilva-VirtualBox) (gcc version 4.8.3 (OpenWrt/Linaro GCC 4.8-2014.04 14.07_ltq) ) #11 Mon Aug 7 17:54:17 WEST 2017
[ 0.000000] SoC: Falcon rev A22
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU revision is: 00019556 (MIPS 34Kc)
[ 0.000000] MIPS: machine is PTIN-GSXXX0G - PTIN Ltq Reference Board - 1389 - 5
[ 0.000000] e=memsize=64
[ 0.000000] e=initrd_start=0xA0000000
[ 0.000000] e=initrd_size=0x0
[ 0.000000] e=flash_start=0x00000000
[ 0.000000] e=flash_size=0x0
[ 0.000000] e=ethaddr=00:06:91:5C:8A:3E
[ 0.000000] MEMSIZE = 67108864
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
procd: Console is alive
procd: - watchdog -
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
jffs2 is ready
switching to overlay
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[ 22.464000] ######################################################################################################
UBOOT_VERSION = 2015.04-lantiq-gpon-1.3.4-ALB_0.4
EXP_UBOOT_VERSION = 2015.04-lantiq-gpon-1.3.4-ALB_0.4
######################################################################################################
MIPS: set unaligned_action to 'SHOW'
[ 34.588000] [onu] PE[255] firmware loaded v9.75.1.0
[omcid] Use OMCC version 0xa0
[omcid] Use IOP option mask 0x00000000
[omcid] Use UNI 1 as LCT debug port
[omcid] Use mask 0x1 for disable functions
**************************************************************
PTIN Environment Vars
Serial Number :(0x50 0x54 0x49 0x4E 0x91 0x5C 0x8A 0x3E)
Model :(GS0100GH)
HW Version :(3NT7SFU1389B35)
**************************************************************
**************************************************************
PTIN IOP Mask (0x1)
**************************************************************
[omcia] 16:56:51 API ERR: GOT VLAN ID 12 from UCI OMCI CFG FILE!
[omcia] 16:56:51 API ERR: GOT SIP DSCP 0 from UCI OMCI CFG FILE!
[omcia] 16:56:51 API ERR: GOT SIP P-BIT 6 from UCI OMCI CFG FILE!
[omcia] 16:56:51 API ERR: GOT RTP DSCP 46 from UCI OMCI CFG FILE!
[omcia] 16:56:51 API ERR: GOT RTP P-BIT 6 from UCI OMCI CFG FILE!
[omcid] Reading MIB configuration from '/etc/mibs/ptin_GS0100G.ini'...
----------------------------------------------------------------------
Lantiq GPON Evaluation System (SFU Voice TR69), Image Revision 7.4.4
----------------------------------------------------------------------
ME367 Option (0) not supported
RMS 64 me_init me/omci_me_alu_generic_v2.c
RMS 243 me_init me/omci_me_alu_uni_supplemental_v2.c
[omcid] 16:56:55 ME ERR: 65297@257 ERROR(117) Can't find related ext vlan tag
MIB reset complete, time spent 3705 ms
[omcid] OMCI daemon initialized (v7.4.2)
[omcia] 16:56:55 API: port #0 link status changed to down
procd: - init complete -
On apprends beaucoup d'infos, dont le fait que l'ONT tourne sur une version (probablement un peu modifiée) d'OpenWrt.
On peut accéder à un shell root en tapant "f" puis entrée rapidement lorsqu'il le demande ! On a accès au rootfs, mais qui est en lecture seul. Pas de modification possible.
Je ferai plus d'exploration plus tard
De même je mettrai en photo la carte mère avec l'interface UART (lorsque le DDOS sur lafibre.info s'arrêtera)
Celle-ci est même probablement accessible sans avoir à ouvrir le boitier !