Post a video on YouTube and it will be featured here!
Do you have a brand new device you want me to hack?
Send it to me!
Are you producing a device and want me to check it's security?
Send me an email!
As of now more than 3500 people unlocked Huawei E585, E5830,
E5832S, E583C and HW-01C successfully!

Friday, February 27, 2009

Unleash your ADSL horses!

Hello! I just made a discovery I want to share with you:
As a few of you may know, on broadcom based adsl modems/routers there is a command line utility which allows to tweak the adsl physical connection.
This command is adslctl and accepts many parameters.
One of them is SNR which is used to force a lower (or higher) SNR.
On the information page you will see that there is a maximum speed achievable on your own line due to noise, distance and quality and then you read the actual connection speed.
An example:
Max(Kbps): 18420 1027
Rate (Kbps): 17972 1013
If you issue the command
adslctl configure --snr 1
You are telling the modem to set the minimum SNR
(it may not give you any performance improves on a very noisy line)
thus allowing the modem to 'hook' at higher speed.
Since my line performed very well with snr=1 I wondered if it could be possible to lower the snr below 1. Then I thought that the variable used in the code is a signed WORD so
since a negative value is not possible why not trying an overflow ?
adslctl configure --snr 65440
This corresponds to -106 and it proved to be the best value on my line.
Now my connection details are:
Max(Kbps): 17740 1027
Rate (Kbps): 22237 1027
Yes! You read it right!
You can try values from 65400 to 65500.
Don't push the lower or the line will be so noisy that the remote dslam will degradate it's connection parameters and it will take long to come back to normal without a dslam reset!
Some stats:
Completed 698.82 M
Total Time 00:05:16
Average Speed 2264.53 KB/s
$ wget -O /dev/null
Length: 13,477,400 (13M) [text/plain]
100%[====================================>] 13,477,400 2.25M/s ETA 00:00