The config partition uses a custom nvram utility—D-Link’s old-school key-value store. You can read it with /usr/sbin/nvram show . The web UI is served by lighttpd + custom CGI binaries in /www/cgi-bin/ . Most are written in C (not PHP, thankfully).
A quick Python script to strip the first 256 bytes gave me a raw TRX image. Then: dsl-x1852e firmware
| Partition | Size | Purpose | |-----------|--------|-----------------------| | boot | 512KB | CFE bootloader | | firmware | 16MB | Kernel + RootFS | | config | 64KB | NVRAM (settings) | | factory | 64KB | Calibration data (WiFi MAC, board ID) | | log | 512KB | Crash logs (never cleared) | Most are written in C (not PHP, thankfully)
Otherwise, at least enable the hidden telnet and run netstat -tulpn to see what’s really listening. Have you looked at the DSL-X1852E firmware yourself? Found anything I missed? Drop a comment or ping me on the forums. Have you looked at the DSL-X1852E firmware yourself