[Hardware Hacking General] E:V:A:
Backing up the router web UI settings (NV data)

Although, they call this "NV data" backup, it is not the same as backing

up the Qualcomm NV-items used to configure the internal modem processor.

This need to be done from another application such as QPST, CDMA-tools,

or RevSkills etc... Instead, this is only a backup of the router's web user interface (UI).

There are 2 different ways to do this.

One way is to:

Go to the web interface and login. Then navigate to:

Settings --> System --> "Back up and Restore"

Click on "Backup" button.

The other way is this:

Just go to: http://192.168.1.1/nvram.bak to download & save the file.

Then to see the contents which are Base64 encoded, you need to decode

by ignoring non-Base64 characters:

base64.exe -d -i nvram.bak >nvram.txt

Here's my output with the IMSI, "<custom-dir>" (which are the 8-first digits of the IMSI) and wifi SSID edited out with #'s:

[SIZE=2]model_verify
start_file
E589u-12
end_file
softversion_verify
start_file
11.433.13.00.01
end_file
dailup_file:
/hdev/ftl1h0p1/userdata/dialup/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<profile_imsi>###############</profile_imsi>
<current_profile>1</current_profile>
</config>

end_file:
profile_list_file:
/hdev/ftl1h0p1/userdata/dialup/profilelist.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<profile>
<index>1</index>
<is_valid>1</is_valid>
<profile_name>NetCom</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username/>
<password/>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
<profile>
<index>2</index>
<is_valid>1</is_valid>
<profile_name>Chess internet</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username>chess</username>
<password>chess</password>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
<profile>
<index>3</index>
<is_valid>1</is_valid>
<profile_name>Vitel</profile_name>
<apn_is_static>1</apn_is_static>
<apn>internet.netcom.no</apn>
<dailup_num>*99#</dailup_num>
<username/>
<password/>
<auth_mode>2</auth_mode>
<ip_is_static>0</ip_is_static>
<ip_address/>
<dns_is_static>0</dns_is_static>
<primary_dns/>
<secondary_dns/>
<read_only>2</read_only>
</profile>
</config>

end_file:
lan_config_file:
/hdev/ftl1h0p1/userdata/lan/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8" ?>
<config>

end_file:
firewall_config_file:
/hdev/ftl1h0p1/userdata/firewall/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<fwswitch>
<firewallwanportpingswitch>0</firewallwanportpingswitch>
<firewallipfilterswitch>0</firewallipfilterswitch>
<firewallmainswitch>0</firewallmainswitch>
</fwswitch>
</config>

end_file:
ipfilter_file:
/hdev/ftl1h0p1/userdata/firewall/ipfilter.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<ipfilters>
<ipfilter>
<lanipfilterprotocol>0</lanipfilterprotocol>
<lanipfilterstatus>0</lanipfilterstatus>
<lanipfilterlanstartaddress/>
<lanipfilterlanendaddress/>
<lanipfilterlanstartport>0</lanipfilterlanstartport>
<lanipfilterlanendport>0</lanipfilterlanendport>
<lanipfilterwanstartaddress/>
<lanipfilterwanendaddress/>
<lanipfilterwanstartport>0</lanipfilterwanstartport>
<lanipfilterwanendport>0</lanipfilterwanendport>
<lanipfiltersrcstartipmask>0</lanipfiltersrcstartipmask>
<lanipfilterdeststartipmask>0</lanipfilterdeststartipmask>
<lanipfilterpolicy>0</lanipfilterpolicy>
</ipfilter>

... [several more]

</ipfilters>
</config>

end_file:
specialapp_file:
/hdev/ftl1h0p1/userdata/firewall/specialapp.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<lanports>
<lanport>
<specialapplicationtriggername/>
<specialapplicationtriggerport>0</specialapplicationtriggerport>
<specialapplicationtriggerportend>0</specialapplicationtriggerportend>
<specialapplicationtriggerprotocol>0</specialapplicationtriggerprotocol>
<specialapplicationstartopenport0>0</specialapplicationstartopenport0>
<specialapplicationendopenport0>0</specialapplicationendopenport0>
<specialapplicationstartopenport1>0</specialapplicationstartopenport1>
<specialapplicationendopenport1>0</specialapplicationendopenport1>
<specialapplicationstartopenport2>0</specialapplicationstartopenport2>
<specialapplicationendopenport2>0</specialapplicationendopenport2>
<specialapplicationstartopenport3>0</specialapplicationstartopenport3>
<specialapplicationendopenport3>0</specialapplicationendopenport3>
<specialapplicationstartopenport4>0</specialapplicationstartopenport4>
<specialapplicationendopenport4>0</specialapplicationendopenport4>
<specialapplicationtriggerstatus>0</specialapplicationtriggerstatus>
<specialapplicationopenprotocol>0</specialapplicationopenprotocol>
</lanport>

... [several more]

</lanports>
</config>

end_file:
virtualserver_file:
/hdev/ftl1h0p1/userdata/firewall/virtualserver.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<servers>
<server>
<virtualserveripname/>
<virtualserverstatus>0</virtualserverstatus>
<virtualserverremoteip/>
<virtualserverwanport>0</virtualserverwanport>
<virtualserverwanportend>0</virtualserverwanportend>
<virtualserverlanport>0</virtualserverlanport>
<virtualserveripaddress/>
<virtualserverprotocol>0</virtualserverprotocol>
</server>

... [several more]

</servers>
</config>

end_file:
device_config_file:
/hdev/ftl1h0p1/userdata/firewall/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<fwswitch>
<firewallwanportpingswitch>0</firewallwanportpingswitch>
<firewallipfilterswitch>0</firewallipfilterswitch>
<firewallmainswitch>0</firewallmainswitch>
</fwswitch>
</config>

end_file:
device_config_file:
/hdev/ftl1h0p1/userdata/device/config.xml
start_file:
<?xml version="1.0" encoding="utf-8" ?>
<config>
</config>

end_file:
global_config_file:
/hdev/ftl1h0p1/userdata/global/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<custom_dir>########</custom_dir>
</config>

end_file:
webserver_config_file:
/hdev/ftl1h0p1/userdata/webserver/config.xml
start_file:
﻿<?xml version="1.0" encoding="UTF-8"?>
<config>

end_file:
wifi_config_file:
/hdev/ftl1h0p1/userdata/wifi/config.xml
start_file:
<?xml version="1.0" encoding="UTF-8"?>
<config>
<wifiwps>
<wpspin></wpspin>
</wifiwps>
<wifisec>
<WifiRestart>0</WifiRestart>
<wifiwpscfg>1</wifiwpscfg>
<wifiwpsenbl>1</wifiwpsenbl>
<wifiwepkeyindex>1</wifiwepkeyindex>
<wifiwpaencryptionmodes>MIX</wifiwpaencryptionmodes>
<wifibasicencryptionmodes>NONE</wifibasicencryptionmodes>
<wifiauthmode>WPA/WPA2-PSK</wifiauthmode>
<wifiwpapsk>10234873</wifiwpapsk>
<wifiwepkey4>34873</wifiwepkey4>
<wifiwepkey3>34873</wifiwepkey3>
<wifiwepkey2>34873</wifiwepkey2>
<wifiwepkey1>34873</wifiwepkey1>
</wifisec>
<wifibasic>
<WifiRestart>1</WifiRestart>
<wifiprotectionmode>0</wifiprotectionmode>
<wifipamode>0</wifipamode>
<wifiwme>1</wifiwme>
<wifibcnintvl>100</wifibcnintvl>
<wifidtmintvl>1</wifidtmintvl>
<wifirtsthrshld>2347</wifirtsthrshld>
<wififrgthrshld>2346</wififrgthrshld>
<wifitxpwrpcnt>128</wifitxpwrpcnt>
<wifiofftime>600</wifiofftime>
<wifioffenable>0</wifioffenable>
<wifiisolate>0</wifiisolate>
<wifimaxassoc>10</wifimaxassoc>
<wifirate>0</wifirate>
<wifimode>b/g/n</wifimode>
<wificountry>NO</wificountry>
<wifihide>0</wifihide>
<wifichannel>0</wifichannel>
<wifienable>1</wifienable>
<wifissid>###-############</wifissid>
</wifibasic>
</config>

end_file:
upnp_config_file:
/hdev/ftl1h0p1/userdata/upnp/config.xml
start_file:
﻿<?xml version="1.0" encoding="utf-8"?>
<config>
</config>

end_file:
[B]<checksum>29905063</checksum>[/B]
[/SIZE]

At the very end of the file, you find a "checksum" tag like this:

<checksum>29905063</checksum>

I don't know how this checksum is calculated. (Anyone?) But I think it could be some kind of CRC of the contents previous to, and above the tag.

The eagle-eyed would also have noticed the lack of the closing "</config>" tag for the "lan_config_file:". Could this influence the SD-card sharing problems?