FACTORY MODE!
        Factory mode, when enabled, gives you access via snmp to the factory 
mib.
        the factory mib is a list of oid's, each oid having a uniq function.
        Here is a very small list of things you can do remote via snmp when in 
factory mode,
        *get/set the hfc, ethernet and usb mac addresses.
        *get/set the modem serial number.
        *get/set the modem certs (cm,vendor, and secure code).
        *ping ip addreses.
        *execute shell commands
        *execute injected code (see cmFactoryBCMGroup 'CommandType, 
AddressOrOpcode, 
ByteCount and Data')
For a complete list of factory mode oid's see the list at the end of this 
email blah :)

BIT FILES!
The bit file method works on firmware 0.4.5.0 and up on SB3100, SB4100, SB4101 
and SB4200.
and on any SB5100, SB5101 and SBG900.

The bitfile method works like this.
1) using snmp you set the oid 1.3.6.1.4.1.1166.1.19.3.1.18.0 to the interger 
value of the last 4 octets your hfc mac address.

2) the modem then tftp gets a 'bitfile' from 192.168.100.10
4100 modem will tftp get SB4100.bit , and 4200 modem will tftp get SB4200.bit

3) if the bit file is the correct size and contains the exact sequence of 
bytes, then factory mode is enabled and the modem reboots!

4) When the modem reboots you have full access to all the factory mib and 
oid's within it.

NOTE: Factory mode will stay enabled untill you turn it off by setting 
1.3.6.1.4.1.1166.1.19.4.29.0 to interger 1 and reboot the modem!


Here is an actual bitfile.
The size of the bit file is 123 bytes.
This bitfile works on SB3100, 4100,4101 and 4200 running firmware 0.4.5.0 or 
higher.
Offset   Data
0x00     43 6f 70 79 72 69 67 68  74 20 32 30 30 34 20 4d  |Copyright 2004 M|
0x10     6f 74 6f 72 6f 6c 61 2e  20 55 6e 61 75 74 68 6f  |otorola. Unautho|
0x20     72 69 7a 65 64 20 75 73  65 2c 20 63 6f 70 79 69  |rized use, copyi|
0x30     6e 67 20 6f 72 20 64 69  73 74 72 69 62 75 74 69  |ng or distributi|
0x40     6f 6e 20 69 73 20 70 72  6f 68 69 62 69 74 65 64  |on is prohibited|
0x50     20 77 69 74 68 6f 75 74  20 77 72 69 74 74 65 6e  | without written|
0x60     20 63 6f 6e 73 65 6e 74  20 66 72 6f 6d 20 4d 6f  | consent from Mo|
0x70     74 6f 72 6f 6c 61 2e 83  04 c4 f1                 |torola.....|

--dshocker