Friday, April 1, 2011

Freebox was overclocked with a paperclip

Freebox, we disassembled a few months ago, we offer some surprises. Many wondered what was the RJ11 connector, and we found: it gives access to the system of the Freebox, a connection via UART. We pass the details of our research, which will be featured once validated our method, but we managed to transfer the system of internal flash memory to another machine.

Once that was done, we analyzed the code and installed everything on a hard drive. As the case is based on a fairly standard x86 platform, it is fairly simple to look at how the system works. In the meantime you can install Windows, what we do not (yet) been done, we found how to access the BIOS.

Handling is simple: turn the Freebox by pressing (in order) the following keys on a keyboard USB: 1, 1, 0, 2, l, i, r, v, a, 1 then enter. Once that is done, we must use a paper clip into the reset button and you can access the BIOS of the machine, very traditional and close to that of a PC.

The Atom is installed in the housing base is clocked at 1.6 GHz, but the BIOS can change the FSB, which is core clocked at 133 MHz QDR. We have ours up to 166 MHz and thus obtain a frequency of 2 GHz. To properly cool the Atom, we recovered a cooler Athlon XP in our laboratory, securing it with thermal paste adhesive.

In fact, the Freebox is not going faster, and that's a shame, but at least the exploit is there. Who wants to test it with liquid nitrogen?

No comments:

Post a Comment