RECESSIM - User contributions [en]

Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem

2021-09-02T18:42:42Z

Phaseloop: add ftp/telnet info

After wikipedia: ''The '''Broadband Global Area Network''' ('''BGAN''') is a global satellite network with telephony owned by Inmarsat using portable terminals. The terminals are normally used to connect a laptop computer to broadband Internet in remote locations, although as long as line-of-sight to the satellite exists''

From technical perspective BGAN is an UMTS compatible network running on L-Band satellite frequencies - with the terminal receiving frequencies of 1525.0-1559.0MHz & transmitting frequencies of 1626.5-1660.5MHz. BGAN is standarized under ETSI GMR-1 standard.

RBGAN (Regional BGAN) was initial service offering by Inmarsat, limited to 144 kbps and using leased regional beams from Thuraya satellites. After Inmarsat I-4 satellites were deployed, service was superseded by BGAN with more beams and higher capacity.

Goal of this reverse engineering effort is to get access to potential debugging modes to decode Inmarsat BGAN control channels (as I suppose control channels are still compatible between RBGAN and BGAN). Same goal can be probably achieved using SDR radio and [https://projects.osmocom.org/projects/gmr/wiki Osmocom GMR] project as both BGAN and Thuraya use GMR-1 protocols.

<br />

===Terminal connectivity===
Hughes 9101 can be interfaced using Ethernet, Bluetooth and USB.Only one interface can be active - you select interface using "select" button and then modem restarts with selected interface active. To check what interface is active - press "select" for 2 seconds and proper LED blinks for a very short time.
<br />

*Bluetooth - device is detected as some kind of ancient Bluetooth PPP profile, probably additional drivers are needed (bluetooth password: "blue")
*USB - no known drivers, although I suspect this is some kind of virtual/RNDIS-type device, showing as ethernet network card on your PC
*Ethernet (actually works)

IP address: 192.168.128.100

Open ports
{| class="wikitable"
|+
!Port number
!Protocol
!Description
|-
|Port number
|
|
|-
|21
|TCP
|FTP - user/password is: eetadmin/eetlogin
FTP according to documentation is used to upgrade the firmware using PC application (not found anywhere yet). It is also possible to download and upload modem config file.
|-
|23
|TCP
|Telnet - user/password is: eetadmin/eetlogin
After authorization, VxWorks kernel shell starts on console.
|-
|80
|TCP
|Web interface. Used to configure device and assists with pointing it to the proper satellite. Part of the interface is in Java and uses proprietary debug interface.
Please note that without BGAN SIM car, web interface will not start - leaving you with an error message. You cannot trick it by inserting regular SIM card.
|-
|
|
|
|}<br />

===Operating system===
OS is VxWorks 5.4.2 working on Intel SmartARM ARMSA1100<br /><syntaxhighlight lang="abap">
VxWorks (for HNS inmEET - ARMSA1110) version VxWorks5.4.2.

Kernel: WIND version 2.5.

Made on Jul 11 2005, 14:12:40.

Boot line:

tffsBootDev(0,0)host:/tffs0/vxWorks h=192.168.128.50 e=192.168.128.100:ffffff00 g=192.168.128.200 u=anonymous pw=inmarsat o=ekh

value = 140 = 0x8c
</syntaxhighlight>

Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem

2021-08-18T09:42:18Z

Phaseloop:

After wikipedia: ''The '''Broadband Global Area Network''' ('''BGAN''') is a global satellite network with telephony owned by Inmarsat using portable terminals. The terminals are normally used to connect a laptop computer to broadband Internet in remote locations, although as long as line-of-sight to the satellite exists''

From technical perspective BGAN is an UMTS compatible network running on L-Band satellite frequencies - with the terminal receiving frequencies of 1525.0-1559.0MHz & transmitting frequencies of 1626.5-1660.5MHz. BGAN is standarized under ETSI GMR-1 standard.

RBGAN (Regional BGAN) was initial service offering by Inmarsat, limited to 144 kbps and using leased regional beams from Thuraya satellites. After Inmarsat I-4 satellites were deployed, service was superseded by BGAN with more beams and higher capacity.

Goal of this reverse engineering effort is to get access to potential debugging modes to decode Inmarsat BGAN control channels (as I suppose control channels are still compatible between RBGAN and BGAN). Same goal can be probably achieved using SDR radio and [https://projects.osmocom.org/projects/gmr/wiki Osmocom GMR] project as both BGAN and Thuraya use GMR-1 protocols.

<br />

===Terminal connectivity===
Hughes 9101 can be interfaced using Ethernet, Bluetooth and USB.Only one interface can be active - you select interface using "select" button and then modem restarts with selected interface active. To check what interface is active - press "select" for 2 seconds and proper LED blinks for a very short time.
<br />

*Bluetooth - device is detected as some kind of ancient Bluetooth PPP profile, probably additional drivers are needed (bluetooth password: "blue")
*USB - no known drivers, although I suspect this is some kind of virtual/RNDIS-type device, showing as ethernet network card on your PC
*Ethernet (actually works)

IP address: 192.168.128.100

Open ports
{| class="wikitable"
|+
!Port number
!Protocol
!Description
|-
|Port number
|
|
|-
|80
|TCP
|Web interface. Used to configure device and assists with pointing it to the proper satellite. Part of the interface is in Java and uses proprietary debug interface.
Please note that without BGAN SIM car, web interface will not start - leaving you with an error message. You cannot trick it by inserting regular SIM card.
|-
|
|
|
|}<br />

===Operating system===
OS is VxWorks 5.4.2 working on Intel SmartARM ARMSA1100<br /><syntaxhighlight lang="abap">
VxWorks (for HNS inmEET - ARMSA1110) version VxWorks5.4.2.

Kernel: WIND version 2.5.

Made on Jul 11 2005, 14:12:40.

Boot line:

tffsBootDev(0,0)host:/tffs0/vxWorks h=192.168.128.50 e=192.168.128.100:ffffff00 g=192.168.128.200 u=anonymous pw=inmarsat o=ekh

value = 140 = 0x8c
</syntaxhighlight>

Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem

2021-08-17T19:26:49Z

Phaseloop:

After wikipedia: ''The '''Broadband Global Area Network''' ('''BGAN''') is a global satellite network with telephony owned by Inmarsat using portable terminals. The terminals are normally used to connect a laptop computer to broadband Internet in remote locations, although as long as line-of-sight to the satellite exists''

From technical perspective BGAN is an UMTS compatible network running on L-Band satellite frequencies - with the terminal receiving frequencies of 1525.0-1559.0MHz & transmitting frequencies of 1626.5-1660.5MHz. BGAN is standarized under ETSI GMR-1 standard.

RBGAN (Regional BGAN) was initial service offering by Inmarsat, limited to 144 kbps and using leased regional beams from Thuraya satellites. After Inmarsat I-4 satellites were deployed, service was superseded by BGAN with more beams and higher capacity.

Goal of this reverse engineering effort is to get access to potential debugging modes to decode Inmarsat BGAN control channels (as I suppose control channels are still compatible between RBGAN and BGAN). Same goal can be probably achieved using SDR radio and [https://projects.osmocom.org/projects/gmr/wiki Osmocom GMR] project as both BGAN and Thuraya use GMR-1 protocols.

<br />

===Terminal connectivity===
Hughes 9101 can be interfaced using Ethernet, Bluetooth and USB.Only one interface can be active - you select interface using "select" button and then modem restarts with selected interface active. To check what interface is active - press "select" for 2 seconds and proper LED blinks for a very short time.
<br />

*Bluetooth - device is detected as some kind of ancient Bluetooth PPP profile, probably additional drivers are needed (bluetooth password: "blue")
*USB - no known drivers, although I suspect this is some kind of virtual/RNDIS-type device, showing as ethernet network card on your PC
*Ethernet (actually works)

IP address: 192.168.128.100

Open ports
{| class="wikitable"
|+
!Port number
!Protocol
!Description
|-
|Port number
|
|
|-
|80
|TCP
|Web interface. Used to configure device and assists with pointing it to the proper satellite. Part of the interface is in Java and uses proprietary debug interface.
Please note that without BGAN SIM car, web interface will not start - leaving you with an error message. You cannot trick it by inserting regular SIM card.
|-
|
|
|
|}<br />

=== Operating system ===
OS is VxWorks 5.4.2 working on Intel SmartARM ARMSA1100<br />

VxWorks (for HNS inmEET - ARMSA1110) version VxWorks5.4.2.

Kernel: WIND version 2.5.

Made on Jul 11 2005, 14:12:40.

Boot line:

tffsBootDev(0,0)host:/tffs0/vxWorks h=192.168.128.50 e=192.168.128.100:ffffff00 g=192.168.128.200 u=anonymous pw=inmarsat o=ekh

value = 140 = 0x8c

Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem

2021-08-17T17:22:11Z

Phaseloop:

After wikipedia: ''The '''Broadband Global Area Network''' ('''BGAN''') is a global satellite network with telephony owned by Inmarsat using portable terminals. The terminals are normally used to connect a laptop computer to broadband Internet in remote locations, although as long as line-of-sight to the satellite exists''

From technical perspective BGAN is an UMTS compatible network running on L-Band satellite frequencies - with the terminal receiving frequencies of 1525.0-1559.0MHz & transmitting frequencies of 1626.5-1660.5MHz. BGAN is standarized under ETSI GMR-1 standard.

RBGAN (Regional BGAN) was initial service offering by Inmarsat, limited to 144 kbps and using leased regional beams from Thuraya satellites. After Inmarsat I-4 satellites were deployed, service was superseded by BGAN with more beams and higher capacity.

Goal of this reverse engineering effort is to get access to potential debugging modes to decode Inmarsat BGAN control channels (as I suppose control channels are still compatible between RBGAN and BGAN). Same goal can be probably achieved using SDR radio and [https://projects.osmocom.org/projects/gmr/wiki Osmocom GMR] project as both BGAN and Thuraya use GMR-1 protocols.

<br />

===Terminal connectivity===
Hughes 9101 can be interfaced using Ethernet, Bluetooth and USB.Only one interface can be active - you select interface using "select" button and then modem restarts with selected interface active. To check what interface is active - press "select" for 2 seconds and proper LED blinks for a very short time.
<br />

*Bluetooth - device is detected as some kind of ancient Bluetooth PPP profile, probably additional drivers are needed (bluetooth password: "blue")
*USB - no known drivers, although I suspect this is some kind of virtual/RNDIS-type device, showing as ethernet network card on your PC
*Ethernet (actually works)

IP address: 192.168.128.100

Open ports
{| class="wikitable"
|+
!Port number
!Protocol
!Description
|-
|Port number
|
|
|-
|80
|TCP
|Web interface. Used to configure device and assists with pointing it to the proper satellite. Part of the interface is in Java and uses proprietary debug interface.
Please note that without BGAN SIM car, web interface will not start - leaving you with an error message. You cannot trick it by inserting regular SIM card.
|-
|
|
|
|}
<br />

Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem

2021-08-17T17:20:24Z

Phaseloop: Initial edit

After wikipedia: ''The '''Broadband Global Area Network''' ('''BGAN''') is a global satellite network with telephony owned by Inmarsat using portable terminals. The terminals are normally used to connect a laptop computer to broadband Internet in remote locations, although as long as line-of-sight to the satellite exists''

From technical perspective BGAN is an UMTS compatible network running on L-Band satellite frequencies - with the terminal receiving frequencies of 1525.0-1559.0MHz & transmitting frequencies of 1626.5-1660.5MHz. BGAN is standarized under ETSI GMR-1 standard.

RBGAN (Regional BGAN) was initial service offering by Inmarsat, limited to 144 kbps and using leased regional beams from Thuraya satellites. After Inmarsat I-4 satellites were deployed, service was superseded by BGAN with more beams and higher capacity.

Goal of this reverse engineering effort is to get access to potential debugging modes to decode Inmarsat BGAN control channels (as I suppose control channels are still compatible between RBGAN and BGAN). Same goal can be probably achieved using SDR radio and [https://projects.osmocom.org/projects/gmr/wiki Osmocom GMR] project as both BGAN and Thuraya use GMR-1 protocols.

<br />

=== Terminal connectivity ===
Hughes 9101 can be interfaced using Ethernet, Bluetooth and USB.Only one interface can be active - you select interface using "select" button and then modem restarts with selected interface active. To check what interface is active - press "select" for 2 seconds and proper LED blinks for a very short time.
<br />

* Bluetooth - device is detected as some kind of ancient Bluetooth PPP profile, probably additional drivers are needed.
* USB - no known drivers, although I suspect this is some kind of virtual/RNDIS-type device, showing as ethernet network card on your PC
* Ethernet (actually works)

IP address: 192.168.128.100

Open ports
{| class="wikitable"
|+
!Port number
!Protocol
!Description
|-
|Port number
|
|
|-
|80
|TCP
|Web interface. Used to configure device and assists with pointing it to the proper satellite. Part of the interface is in Java and uses proprietary debug interface.
Please note that without BGAN SIM car, web interface will not start - leaving you with an error message. You cannot trick it by inserting regular SIM card.
|-
|
|
|
|}
<br />

Software Tools

2021-08-13T14:27:15Z

Phaseloop: add Universal Radio Hacker reference

[[File:Schematic Capture.png|thumb|Schematic of an embedded device]]
Disassemblers, Decompilers, Development Tools, Schematic/PCB Capture and other reverse engineering software. If you used it while reverse engineering, list it here!
==Tool Index==
<br />

==== Signals Analysis ====
[https://github.com/jopohl/urh Universal Radio Hacker] - tool to analyze and extract data from SDR-captured radio signals (especially pilots, ISM RF devices, etc). See youtube for tutorials and examples.

==== Binary reverse engineering ====
[https://binary.ninja/ Binary Ninja] - reverse-engineering platform that can disassemble a binary and display the disassembly in linear or graph views.

[https://www.nsa.gov/resources/everyone/ghidra/ Ghidra] - Ghidra is an open source software reverse engineering (SRE) framework developed by NSA's [https://www.nsa.gov/what-we-do/research/ Research] Directorate for NSA's [https://www.nsa.gov/what-we-do/cybersecurity/ cybersecurity mission].

[https://www.hex-rays.com/products/ida/ IDA] - The IDA Disassembler and Debugger is an interactive, programmable, extensible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X.

[https://github.com/vivisect/vivisect Vivisect] - Vivisect binary analysis framework. Includes Disassembler, Debugger, Emulation and Symbolik analysis engines. Includes built-in Server and Shared-Workspace functionality. Runs interactive or headless, programmable, extensible, multi-processor disassembler hosted on Windows, Linux, or Mac OS X (Pure-Python, using ctypes to access underlying OS debug mechanism). Supports RevSync via plugin, allowing basic collaboration with Binja, Ghidra, and IDA. Criticisms (from a core dev): "Graph View could use some work, slower than Binja and IDA (due to Python), documentation like an OpenSource Project... but we keep working to make it better. PR's and suggestions welcome." Best installed via Pip: <code>python3 -m pip install vivisect</code>

[https://codisec.com/veles/ Veles] - Open source tool for binary data analysis (No longer actively developed).

<br />

==Education==
Tools are great, and sometimes free! Without knowing how to use them, they can be a big waste of time. Better to spend your time learning the basics, then apply your knowledge.

[https://github.com/mytechnotalent/Reverse-Engineering-Tutorial Reverse Engineering Tutorial] - A comprehensive reverse engineering tutorial covering x86, x64, 32-bit ARM & 64-bit ARM architectures.

Electronic Tools

2021-08-13T14:23:33Z

Phaseloop: /* Tool Index */ add info on RSP1A SDR

<templatestyles src="Template:Main_page/styles.css" />
[[File:Electronic Tools.jpeg|thumb|Oscilloscope and various multimeters]]
Multimeters, Function Generators, Oscilloscopes, Logic Analyzers, Spectrum Analyzers, Software Defined Radio's and Open Source/Community Designed Tools. If you used it while reverse engineering, list it here!
==Tool Index==
<div style="clear: both;"></div>
<div id="tools_row1" class="mainpage_row">
<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>Software Defined Radio’s</span></h3>
<div id="Electronic_Tools-SDR" title="Software Defined Radio’s" class="items">
[https://www.rtl-sdr.com/about-rtl-sdr/ RTL-SDR] - Very low cost (~$30) receiver operating from about 52MHz to 2200MHz.

[https://www.sdrplay.com/rsp1a/ SDRPlay RSP1a] - Medium cost (~$160) receiver operating from 100 Khz to 2000 MHZ. Device includes a lot of selectable filters (to cancel broadcast FM, WiFi interference, PC interference etc).

[https://greatscottgadgets.com/hackrf/one/ HackRF One] - Capable of transmission or reception of radio signals from 1 MHz to 6 GHz. Open source hardware platform that can be used as a USB peripheral or programmed for stand-alone operation. Cost ~$340

[https://www.ettus.com/all-products/ub200-kit/ Ettus Research USRP B200] - Universal Software Radio Peripheral with continuous frequency coverage from 70 MHz –6 GHz. Wider bandwidth and higher resolution ADC/DAC than the HackRF; cost with enclosure ~$875.
</div>
</div>

<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>Debugging Tools</span></h3>
<div id="Debugging_Tools" title="Debugging Tools" class="items">
[[JTAGulator]] - open source hardware tool that assists in identifying OCD connections from test points, vias, or component pads on a target device.

[https://www.tincantools.com/product/flyswatter2/ FlySwatter2] - In-circuit JTAG debugger and programmer.
</div>
</div>
</div>
<div id="tools_row2" class="mainpage_row">
<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>Test Enclosures</span></h3>
<div id="Test_Enclosures" title="Test Enclosures" class="items">
[[Ramsey STE-3000 Shielded Test Enclosure]] - Faraday cage for isolating RF signals
</div>
</div>
<div class="mainpage_box">
<h3>[[File:OOjs UI icon viewCompact.png|link=|alt=|20x20px]] <span>IC Decapsulating</span></h3>
<div id="IC_Decapsulating" title="IC Decapsulating" class="items">
[[B&G International Decapsulator Model 250]] - Acid etching decapsulation tool from the early 2000's
</div>
</div>
</div>

Industrial

2021-08-13T13:59:02Z

Phaseloop:

[[File:BG Model 250 Side 1.JPG|thumb|Fluid control valves for acid in integrated circuit decapping machine]]
Access Control, Camera Systems, Infrastructure (Power, Gas and Water Meters), SCADA and any other industrial systems.
==Device Index==
[[Advanced Metering Infrastructure]]

[[B&G International Decapsulator Model 250]]

[[LMS-6 Radiosonde]]

[[Electronic Parking Meter]]

[[Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem]]

Industrial

2021-08-13T13:58:48Z

Phaseloop:

[[File:BG Model 250 Side 1.JPG|thumb|Fluid control valves for acid in integrated circuit decapping machine]]
Access Control, Camera Systems, Infrastructure (Power, Gas and Water Meters), SCADA and any other industrial systems.
==Device Index==
[[Advanced Metering Infrastructure]]

[[B&G International Decapsulator Model 250]]

[[LMS-6 Radiosonde]]

[[Electronic Parking Meter]]
[[Hughes HNS 9101 Inmarsat Regional BGAN Satellite Modem]]