Hacking a Yacom / Orange ARV4518PW router

The spanish Ya.com ADSL connection comes with an ARV4518PW modem/router/access point. It looks like this:


Unfortunately, the router configuration forces you to have an ADSL username ending in a domain like @yacomadsl, @orange, or a few other pre-defined domains. This is to prevent you from using the router with another ADSL provider. But, heck! We don’t like these kind of boundaries, let’s tear them down!

Luckily for us, the router web gui does not implement any input validation. Here follows the procedure to input an arbitrary ADSL username.


  • These are some numbers appearing on the back of the router:
    • Model Name: ARV4518PW
    • HW Version: R01A
    • Astoria networks
    • Production date: 04/2010
  • This applies for firmware version 0.10.016. It could work as well for older firmwares. You can check your firmware version in the Status page.

The Quick way

  1. You may want to reset the router: while it’s turned on, press the reset button for 5 seconds.
  2. Log in the web gui. This is usually and the default password is admin
  3. From the same computer you logged in, set these variables with proper values (I’m assuming a bash shell):
    IP="" # Your router web gui IP address
    ENCAPSULATION=1 # 1 for LLC, 0 for VC-MUX
    USERNAME="your username"
    PASSWORD="your password"
  4. Run this command:
    wget "http://"$IP"/cgi-bin/qs2.exe" --post-data="ATM_Protocol=4&qISPType=37&ISP_ConnType=0&VC_VPI="$VPI"&VC_VCI="$VCI"&VC_AAL5="$ENCAPSULATION"&ISP_Username="$USERNAME"&ISP_Username_Domain=20&ISP_Password="$PASSWORD"&ISP_Password_Conf="$PASSWORD -O /dev/null
  5. Go to and check your data, then click on Finish. The router will reboot.
  6. Go to and log in, click on status to check that everything is working properly. After a bunch of seconds, you should see ADSL: CONNECTED. Cool! You can go through the menu to configure the router. I’d recommend to disable the built-in firewall because it causes problems with P2P traffic.

The classy way (installing OpenWRT)

As you have noticed, this is a tricky workaround. But your router can give you much more! You can install the OpenWRT firmware that lets you do more stuff. Unfortunately, you need to open its case, connect through a serial port and a converter, and upload the firmware. Information about the OpenWRT support of this modem can be found on the OpenWRT Wiki and detailed instructions to install it are here (first post, spanish) and here (spanish).

Explanation / troubleshooting

How did the trick work? Point is, the web gui forces you to set a domain for the username (click on “Setup Wizard”). This is chosen from a drop-down menu. Have a look at the HTML source, the drop-down menu is as follows:

<select name="ISP_Username_Domain">
<option value="0">@orangeadsl </option>
<option value="1">@orange </option>
 .... more domains
<option selected="" value="7">@yacomadsl </option>

Each domain corresponds to a value (an integer from 0 to 7) the variable ISP_Username_Domain can assume. And a gui that does input validation should check that the value passed by the browser falls in that range. Luckily for us, it doesn’t. So what happens if we pass values like 8, -1, 18, 20? Weird strings, taken from somewhere into the router’s memory, are appended to the username. Of course, if one of this values appends the empty string, we win: the username we pass will not be modified in any way.

Here are a few values not in the range [0,7] and how the username “billgates” gets modified:

  • -3 -> “billgatesTCP”
  • -1 -> “billgatesUser Defined Service”
  • 1 -> “billgates@orange
  • 9 -> “billgatesWEP”
  • 18 -> The router crashes and reboots 😀 (probably a Segmentation fault)
  • 20 -> “billgates” Bam! Empty string!

And that’s the reason why, in the step-by-step guide, we give 20 as parameter to the ISP_Username_Domain variable.

If the parameter 20 does not work for you (this may happen if your firmware version differ), you can check yourself what’s the correct parameter with this small script:


for (( n=-5 ; n<40 ; n++)) do
  wget "http://"$IP"/cgi-bin/qs2.exe" --post-data="ATM_Protocol=4&qISPType=37&ISP_ConnType=0&VC_VPI=8&VC_VCI=35&VC_AAL5=1&ISP_Username=billgates&ISP_Username_Domain=$n&ISP_Password=aaa&ISP_Password_Conf=aaa" -q -O /dev/null
  wget "http://"$IP"/setupq6_main.stm" -O /dev/stdout -q | grep billgates

An see if, for some value of n, you get the original username “billgates”. Still, you have to be logged in the web gui from the same machine where you run the script. Ah, and you want to avoid n=18 😉

For any question, please leave a comment.

June 19, 2013

Problems starting Eclipse

While trying to install a plugin, i’ve made some mess which resulted in Eclipse not starting, giving the following error in the log file:

!SESSION Tue Nov 09 15:18:43 CET 2010 ------------------------------------------
!ENTRY org.eclipse.equinox.launcher 4 0 2010-11-09 15:18:43.233
!MESSAGE Exception launching the Eclipse Platform:
java.lang.ClassNotFoundException: org.eclipse.core.runtime.adaptor.EclipseStarter
 at java.net.URLClassLoader$1.run(URLClassLoader.java:217)
 at java.security.AccessController.doPrivileged(Native Method)
 at java.net.URLClassLoader.findClass(URLClassLoader.java:205)
 at java.lang.ClassLoader.loadClass(ClassLoader.java:321)
 at java.lang.ClassLoader.loadClass(ClassLoader.java:266)
 at org.eclipse.equinox.launcher.Main.invokeFramework(Main.java:556)
 at org.eclipse.equinox.launcher.Main.basicRun(Main.java:514)
 at org.eclipse.equinox.launcher.Main.run(Main.java:1311)
 at org.eclipse.equinox.launcher.Main.main(Main.java:1287)

That’s what happen when you force the removal of some files 🙂

I solved the problem purging libequinox-osgi-java and reinstalling Eclipse. Try with:

sudo apt-get remove --purge libequinox-osgi-java
sudo apt-get install eclipse

November 10, 2010

Radeon Mobility M6 LY on Debian Squeeze

Upgrading from Debian Lenny to Squeeze, those having this old embedded video card (my laptop is an IBM Thinkpad R40) have found their video performance dropped. This is due to debian’s policy which produced the distribution of this video card’s firmware in a package that is not installed by default with the x.org driver. In lspci -nn, the card is shown as

01:00.0 VGA compatible controller [0300]: ATI Technologies Inc Radeon Mobility M6 LY [1002:4c59]

After some browsing I’ve found out that this card is part of the R100 family, so the firmware you are searching for are contained in:

sudo apt-get install firmware-linux-nonfree

Make sure that /etc/X11/xorg.conf, if any, uses driver radeon or ati (which redirects to radeon). So in your xorg.conf there must be something like:

Section "Device"
        Identifier      "ATI"
        Driver          "ati"

When you are done, you must restart Gnome (or whatever starts X):

sudo service gdm restart

November 8, 2010

Limiting access to some users in vsftpd

If you want a subset of your users to have access to your vsftpd FTP server, edit /etc/vsftpd.conf adding the following:

# Activate only users in /etc/vsftpd.enabledusers

The file /etc/vsftpd.enabledusers must contain the list of users enabled to access the FTP service, one per line. Be sure to also add the support for local users:


You may also want to fix the home directory, for example to /var/www/:


October 14, 2010

Making Wacom Bamboo Pen tablet work under Debian

I’ve been trying for days to make my brand new Wacom Bamboo (CTL-460) tablet work under Debian Squeeze. Finally, i wrote to the
linuxwacom-discuss mailing list and Rebecca Breu pointed me to the solution.
This tablet is supported by a driver powered by the linuxwacom project, which provides a kernel module (wacom.ko), a X.org driver (wacom_drv.so) and more utilities. The problem is that with the debian kernel 2.6.32-5 (latest in squeeze at the time when writing) the wacom module is provided, but its version (1.52) is too old and doesn’t support Bamboo Pen. We want version 1.52-pc-0.3. This also applies to debian kernel 2.6.33-2 (currently under experimental). On the other hand, X.org version 1.7.* has a prebuilt X.org driver which works perfectly, so there’s no need of replacing it.

0- To check out your X.org version, type:

Xorg -version

For the wacom module version, type:

modprobe wacom
dmesg | grep wacom

1- To check if the wacom module works with your tablet, plug it in and do:

modprobe wacom
dmesg | grep -i wacom | grep -i input

If you see anything like

input: Wacom Bamboo 4x5 Pen as /devices/pci0000:00/0000:00:1a.1/usb4/4-2/4-2:1.0/input/input14

then your hardware is supported and there’s no need of compiling the driver. Just skip to step 3.

2- If your hardware is not supported by your wacom module version, then you have to drop the one provided by your kernel and replace it with the latest version compiled by yourself. The following commands apply for kernel version 2.6.32-5 AMD64, but should also work for later kernels, just change 2.6.32-5 in whatever your kernel version is and -amd64 in your architecture:

sudo -s
rmmod wacom
apt-get install build-essential libx11-dev libxi-dev
x11proto-input-dev xserver-xorg-dev tk8.4-dev tcl8.4-dev libncurses5-dev linux-headers-2.6.32-5-amd64

Now that the kernel headers are installed, we have to make a small hack to let the compiling work:

sudo -s
cd /usr/src/linux-headers-2.6.32-5-amd64/include/linux/
ln -s /usr/src/linux-headers-2.6.32-5-common/include/linux/input.h
ln -s /usr/src/linux-headers-2.6.32-5-common/include/linux/input-polldev.h

After this, the system is ready to download the source and compile the wacom module. Do:

cd ~
wget http://downloads.sourceforge.net/project/linuxwacom/linuxwacom/0.8.8-9/linuxwacom-0.8.8-9.tar.bz2
tar -xf linuxwacom-0.8.8-9.tar.bz2
cd linuxwacom-0.8.8-9
./configure --enable-wacom --with-kernel=/usr/src/linux-headers-2.6.32-5-amd64

If everything was fine, install the driver with:

cp src/2.6.30/wacom.ko /lib/modules/2.6.32-5-amd64/kernel/drivers/input/tablet/wacom.ko
depmod -a

Now unplug and replug the tablet and retry step 1 to see if the hardware has been recognized.

3- The X.org wacom drivers are cointained in a package. Do:

sudo apt-get install xserver-xorg-input-wacom

To load the module automatically at startup, if your /etc/modules does not contain wacom, edit /etc/modules and add “wacom” in a new line at the bottom of the file.

4- Restart X (or reboot) and draw your self-portrait. Mine is here:
lik self-portrait

14 Comments May 7, 2010

What’s going to happen in 2012


April 20, 2010

Recover data from a formatted NTFS partition

Shit happens. And you are the one that may make it happen. If you’ve never accidentally formatted a partition, typed a rm -rf ~ or deleted some file that you actually didn’t have to remove, it can happen to some of your friends (if you got idiot friends) or customers (if you got idiot customers).

So here are a few notes about how to recover data from a formatted NTFS partition. I’ve tried several tools which I’ll give a brief opinion about.

  • Do not use any forensics analysis Live distribution. F.I.R.E. (homepage) is abandoned since 2004 and others are not necessary. The best forensics and recovery live distribution is indeed Knoppix (homepage), in which you can easily add any data recovery package with a simple apt-get install.
  • ntfsundelete (part of the ntfsprogs package, homepage) was completely useless, and could not find any deleted data but pagefile.sys.
  • sleuthkit (homepage), with its web GUI Autopsy worked exactly the same as ntfsundelete and was useless the same.
  • foremost (homepage) helped to recover some files, especially Jpeg pictures. Foremost does not re-create any directory structure. Furthermore, it didn’t find any Word document.
  • scalpel (homepage), based on foremost, is a bit better and was able to recover also some of the .doc documents. This tool should only be used is the support is severely compromised, otherwise more efficient tools can do a better work.

The problem with all these tools is that they can recover data from NTFS volumes but do not use any information in the volume. NTFS is a very redundant file system and store a lot of information that can be used to completely recreate the directory structure of a formatted volume, including file and directory names. To find a tool that uses these information, the Open Source option has to be discarded and we have to go for something commercial. My salvation was Runtime Software GetDataBack for NTFS (homepage), a commercial tool for Microsoft Windows that let me recover almost all the data with their original names and directory structure.

Still there are some tricks that may ease your work. The following is only an option of how to use this software which resulted easy for me because I had a ready Windows XP virtual machine running on VirtualBox and the formatted NTFS volume was saved in an image with dd. Here are some useful information for this specific scenario (otherwise, if you don’t have any installed Windows VM and the NTFS volume you want to recover is not saved in an image file, there are probably faster methods):

  • To convert a .img disk image created with dd to a .vdi disk image compatible with VirtualBox, use the command (takes long time):
    VBoxManage convertfromraw -format VDI image.img image.vdi
  • From VirtualBox, right-click on your Windows virtual machine, click Settings, Storage and add the virtual disk.
  • Run Windows, the virtual disk will appear as a normal volume. Install GetDataBack and run the recovery tool on the volume.
  • If you don’t have enough space in the Windows VM to save the restored data, install the guest additions and share a directory between the virtual Windows and your OS (google to find a how to).

If you find any working Open Source NTFS recovery tool or have had other experiences about NTFS data recovery, please leave a comment.

February 20, 2010

Monochrome Qt fonts

Using Debian 5.0 i noticed a problem with Qt-based applications such as TexMaker, Skype, Qt-config itself and many more. All fonts were rendered bad, in a monochromatic flavour without any anti-aliasing. My solution to this was to regenerate the font cache. So, as normal user (no sudo!), try:

fc-cache -f

You may need to restart the affected applications.

1 Comment January 31, 2010

Bad graphical behaviour with Nvidia GeForce 9200M GS

The following applies for those that, running a lspci, get:

01:00.0 VGA compatible controller: nVidia Corporation G98 [GeForce 9200M GS] (rev a1)

When trying to play a DVD or a divx movie at fullscreen, the image movement were not fluent, just like a 25fps movie played at 11fps. Similiarly, the 3D screen-savers were slow. Checking the /var/log/Xorg.0.log file everything seemed ok, since the default NV drivers included in Xorg are capable of recognizing the NVidia graphic card. Unfortunately, those driver are definitely not optimized and they perform very bad. NVidia released some alternative drivers for linux and -still- unfortunately, they are propertary. It’s your choice to use the free unoptimized drivers or the propertary optimized ones. Anyway, here follows the procedure to install the propertary ones.

Drivers depends on the architecture used by your system. Nvidia releases driver only for x86 and AMD64 CPUs. To check what’s your architecture, type

uname -r

If your kernel version ends with -*86, follow the blue steps, otherwise if it ends with -amd64 follow the red steps. (NOTE: if you have this video card and are using a x86 kernel, you are probably not using all your PC potential. Consider installing an AMD64 distribution. More information here.)

  1. Get into a non-X shell (typing CTRL+ALT+F1) and log in as root.
  2. Install the linux-kernel headers:apt-get install linux-headers-$(uname -r)
  3. stop the Gnome Desktop manager:/etc/init.d/gdm stop
  4. take the NVIDIA propertary drivers:
    for x86: wget http://us.download.nvidia.com/XFree86/Linux-x86/190.53/NVIDIA-Linux-x86-190.53-pkg1.run
    for AMD64: wget http://us.download.nvidia.com/XFree86/Linux-x86_64/190.53/NVIDIA-Linux-x86_64-190.53-pkg2.run
  5. make the driver installer runnable:
    for x86: chmod a+x NVIDIA-Linux-x86-190.53-pkg1.run
    for AMD64: chmod a+x NVIDIA-Linux-x86_64-190.53-pkg2.run
  6. run the installer:
    for x86: ./NVIDIA-Linux-x86-190.53-pkg1.run
    for AMD64: ./NVIDIA-Linux-x86_64-190.53-pkg2.run
    accept everything and when asked to update the /etc/xorg.conf file, answer yes.
  7. restart gdm:
    /etc/init.d/gdm start
  8. (now Gnome should start, but you still have an open root shell. Type again CTRL+ALT+F1 and close it, then CTRL+ALT+F7 to go back to Gnome.)

The NVidia drivers should be now loaded and the movies should play fine. If you want to run a 3D test, try:

apt-get install mesa-utils

and then run from a console:


The tool will print the FPS rate, that should be around 3000 frames/sec

Enjoy your movies and 3D games, and reclaim your optimized free drivers from your hardware vendor!

June 5, 2009

Audio and wireless on a HP Pavilion dv6-1060

This post has been updated since something changed (yeah, the audio out jack now works great!)

Making both the wireless connection and the audio board work on a HP Pavilion DV6-1060el with Debian Lenny (currently stable) and Squeeze (currently testing) needs a small effort. This is due to 2 reasons: first, the linux kernel up to version 2.6.26 (current version distributed with Lenny) doesn’t support the Intel 5100 wireless interface, second, the ALSA driver up to 1.0.21 (that comes with Squeeze’s kernel) doesn’t support the audio board’s codec (that is, IDC 92HD75B3X5) out of the box, yet you can force the driver to use another codec and make the audio board fully work.

So, if running lspci you got:

02:00.0 Network controller: Intel Corporation PRO/Wireless 5100 AGN [Shiloh] Network Connection
00:1f.3 SMBus: Intel Corporation 82801I (ICH9 Family) SMBus Controller (rev 03)

And running

cat /proc/asound/card0/codec#* | grep Codec

you got:

Codec: IDT 92HD75B3X5
  1. If you are using Debian Lenny, follow the instructions here to install a new kernel >= 2.6.30. This kernel version supports the wireless interface and has the pre-built ALSA module version >= 1.0.21.
    (to check your running ALSA version, type cat /proc/asound/version)
  2. Otherwise, if you are using Debian Squeeze, just add non-free to your repository list and install 2 packages as described here. If your kernel is not up to date, update it with:
    apt-get install linux-image-amd64
    (replace ‘amd64’ with your architecture)
  3. edit /etc/modprobe.d/alsa-base.conf adding the line: options snd-hda-intel model=hp-dv5 at the bottom of the file. This can be done with the command (as root):
    echo “options snd-hda-intel model=hp-dv5” >> /etc/modprobe.d/alsa-base.conf
  4. remove and reload the snd-hda-intel module with the command (as root):
    alsa force-reload
    or restarting your machine.
  5. Now everything should work fine. With alsamixer raise up the volume of Master, Speaker and PCM. Switch to Capture (using Tab key) and make sure it is activated, pressing space until a red CAPTURE appears. Raise up Digital and Digital Mic volumes. Try out the speakers, the headphones, the internal and external microphone (try recording with Audacity or another sound recorder). Everything should work now.

The audio card is still not fully supported. When switching the pc off, you may hear some weird noises. Anyhow, that’s a workaround that will make your PC rock. When an ALSA version fully supporting this audio board will be released in future debian kernels, you’ll probably have to remove the line “options snd-hda-intel model=hp-dv5” from /etc/modprobe.d/alsa-base.conf, and everything will work as is.

If you found this post useful, you have alternative solutions, some news, or something is unclear, please comment.

June 3, 2009

Previous page