Telsey CPVA642XF

This is a Fastweb (italian ISP) router with voip and usb port

1. enable telnet server (via web interface)
2. connect via telnet to your device using web interface credentials
3. type the undocumented “sh” command
4. enjoy your root shell!

• CPVA642_SIP_fk_sip_3.7.127V
• CPVA642_SIP_fk_sip_3.7.130V

Available soon!

Available soon!

Latest device was shipped with the very old 2.6.8.1 Linux kernel WITHOUT swap support. Swap support can't be compiled as module so you should be careful with memory usage.

• For some strange reason in VoIP configuration the option “Interface name” must be the internal lan, not wan. - Fixed in latest firmware revision (3.7.130V-sip)
• Some phones doesn't show caller-id - Fixed in latest firmware revision (3.7.130V-sip)

• If you activate telnet on wan interface the service is reachable over this interface but the router won't accept admin credential
• telnet capabilities was limited, ncurses based application and others could works bad.

OpenWRT porting was done for a similar model that differ only for half size ram and flash. FXS/FXO ports are not working on OpenWRT (to be verified). I prefer keep the original firmware and extend its functionality.

1. Download latest busybox for mips
2. Download a brcm63xx generic jffs2-128k image (backfire link)
3. Mount it on your computer (take a look in how-to section on Linux page) and copy contents making a tar archive to preserve permissions
4. Unpack rootfs and move busybox on the drive to be attached to your Telsey
5. Eject drive from your computer and attach it to your Telsey
6. Login via telnet and enter in root shell
7. Copy system files and bind system folders inside chroot

   CHROOTDIR=/var/udev/mount/NASusbsda/openwrt_backfire
   
   cp /etc/hosts $CHROOTDIR/etc/hosts
   cp /etc/fstab $CHROOTDIR/etc/fstab
   cp /etc/resolv.conf $CHROOTDIR/etc/resolv.conf
   
   mount -o bind /proc $CHROOTDIR/proc
   mount -o bind /dev $CHROOTDIR/dev
   
   mount -o bind /var/udev/mount/NASusbsda $CHROOTDIR/mnt/NASusbsda

8. Make a “boot” script to set right variables inside chroot

   vi $CHROOTDIR/root/startchroot
   (paste this inside)
   #!/bin/sh
   
   source /etc/profile
   /bin/sh

9. Chroot!

   ./busybox-mips chroot $CHROOTDIR /root/startchroot

• DEL - ONLY in bash it print a ~ without delete characters, however it works fine in vi
• ENTER - ONLY in nano I can't confirm the filename when saving

Somethings works but for example reading log cause a system crash

SSH accepts commands but can't open a remote shell, so you can use direct commands in this way:

ssh root@Telsey "touch /tmp/thisworks"

or use rsync. This issue is related with the kernel that miss /dev/pts filesystem (and can't be fixed using a module)

Be sure that your /etc/resolv.conf contains a working DNS server /etc/hosts is not read when a DNS resolution is in progress so you can't specify a particular ip for a name or use localhost instead of 127.0.0.1

• Merlino60
• Pegasus (usb-ethernet driver) kernel module - Available soon!
• Alsa+USB Soundcards kernel modules - Available soon!