Neupgradovatelny FW Zyxel P-660HW-T3 v2 V3.40(BEI.0)
Napsal: 20 říj 2020, 09:59
Objavil som odlozeny ADSL router Zyxel P-660HW-T3 v2. Zdalo sa, ze funguje - ale pre istotu som premeral ESR elytov. Par sa mi zdalo podozrivych, tak som ich vybral - a mimo obvodu boli uplne v prdeli - nakoniec som vymenil vsetky znacky JH.
Dalsi krok - upgrade firmware. Bol tam V3.40(BEI.0), ale Zyxel ma na webe V3.40(ANR.5). Uz som tusil, ze s tym bude problem. Samozrejme, ze upgrade nefungoval a na webe som nasiel viackrat potvrdene, ze to nejde.
Nejde to ani cez seriovu konzolu:
Po chvili hladania som zistil, ze prve dva bajty "Other Feature Bits" su identifikator modelu a treba ich zmenit. Lenze ake tam maju byt?
Nasiel som pekny commit v OpenWrt, ktory pridava podporu pre zariadenia Zyxel:
https://gitlab.nic.cz/turris/openwrt/-/ ... 032e5e8e3d
Odtial som zistil, ze treba vo firmware najst retazec "Model 1". Za nim nasleduje cislo (decimalne), v pripade V3.40(ANR.x) "15770", co je 0x3D9A. Takze prve dva bajty "Other Feature Bits" treba nastavit na 0x9A, 0x3D (lebo je to v big endiane):
8001F468 je adresa v bufferi v RAM. V inej verzii Bootbase moze byt ina! Nasiel som ju dumpovanim adresneho priestoru cez XMODEM (prikaz ATDO).
A uz to fici
Dalsi krok - upgrade firmware. Bol tam V3.40(BEI.0), ale Zyxel ma na webe V3.40(ANR.5). Uz som tusil, ze s tym bude problem. Samozrejme, ze upgrade nefungoval a na webe som nasiel viackrat potvrdene, ze to nejde.
Nejde to ani cez seriovu konzolu:
Kód: Vybrat vše
Bootbase Version: V1.04 | 6/28/2006 10:10:34
RAM: Size = 16384 Kbytes
DRAM POST: Testing: 16384K
OK
FLASH: AMD 16M *1
ZyNOS Version: V3.40(BEI.0) | 12/25/2007 14:41:37
Press any key to enter debug mode within 3 seconds.
...
Enter Debug Mode
ATHE
======= Debug Command Listing =======
AT just answer OK
ATHE print help
ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k
ATENx,(y) set BootExtension Debug Flag (y=password)
ATSE show the seed of password generator
ATTI(h,m,s) change system time to hour:min:sec or show current time
ATDA(y,m,d) change system date to year/month/day or show current date
ATDS dump RAS stack
ATDT dump Boot Module Common Area
ATDUx,y dump memory contents from address x for length y
ATRBx display the 8-bit value of address x
ATRWx display the 16-bit value of address x
ATRLx display the 32-bit value of address x
ATGO(x) run program at addr x or boot router
ATGR boot router
ATGT run Hardware Test Program
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)
ATSH dump manufacturer related data in ROM
ATTD download router configuration to PC via XMODEM
ATUR upload router firmware to flash ROM
ATLC upload router configuration file to flash ROM
< press any key to continue >
ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode
ATSR system reboot
ATSP send packet
ATMU print Multiboot client version
ATEB prit ExpressBoot client version
OK
ATSH
ZyNOS Version : V3.40(BEI.0) | 12/25/2007 14:41:37
Bootbase Version : V1.04 | 6/28/2006 10:10:34
Vendor Name : ZyXEL Communications Corp.
Product Model : P-660HW-T3 v2
ZyNOS ROM address : bfc10000
System Type : 7
MAC Address : xxxxxxxxxxxx
Default Country Code : F6
Boot Module Debug Flag : 00
RomFile Version : 68
RomFile Checksum : 74fe
ZyNOS Checksum : 11a5
Core Checksum : 870f
SNMP MIB level & OID : 060102030405060708091011121314151617181920
Main Feature Bits : C0
Other Feature Bits :
01 5B 00 00 01 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-02 41 13 00 00 00
OK
ATBA5
Now, console speed will be changed to 115200 bps
OK
ATXS1
OK
ATUR
Starting XMODEM upload (checksum mode)....
UUU
Total 1896960 bytes received.
Wrong product firmware!!
Please upgrade the newest firmware version!!
ERRORPo chvili hladania som zistil, ze prve dva bajty "Other Feature Bits" su identifikator modelu a treba ich zmenit. Lenze ake tam maju byt?
Nasiel som pekny commit v OpenWrt, ktory pridava podporu pre zariadenia Zyxel:
https://gitlab.nic.cz/turris/openwrt/-/ ... 032e5e8e3d
Odtial som zistil, ze treba vo firmware najst retazec "Model 1". Za nim nasleduje cislo (decimalne), v pripade V3.40(ANR.x) "15770", co je 0x3D9A. Takze prve dva bajty "Other Feature Bits" treba nastavit na 0x9A, 0x3D (lebo je to v big endiane):
Kód: Vybrat vše
...
Enter Debug Mode
ATEN1,C43C2958
OK
ATCL
OK
ATCB
OK
ATBU
ZyNOS Version : V3.40(BEI.0) | 12/25/2007 14:41:37
Bootbase Version : V1.04 | 6/28/2006 10:10:34
Vendor Name : ZyXEL Communications Corp.
Product Model : P-660HW-T3 v2
ZyNOS ROM address : bfc10000
System Type : 7
MAC Address : 0023F8A7A70A
Default Country Code : F6
Boot Module Debug Flag : 00
RomFile Version : 68
RomFile Checksum : 74fe
ZyNOS Checksum : 11a5
Core Checksum : 870f
SNMP MIB level & OID : 060102030405060708091011121314151617181920
Main Feature Bits : C0
Other Feature Bits :
01 5B 00 00 01 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-02 41 13 00 00 00
OK
ATDU8001F468,20
8001F468: 01 5B 00 00 01 00 00 00-00 00 00 00 00 00 00 00 .[..............
8001F478: 00 00 00 00 00 00 00 00-02 41 13 00 00 00 C0 00 .........A......
OK
ATWB8001F468,9A
OK
ATWB8001F469,3D
OK
ATBU
ZyNOS Version : V3.40(BEI.0) | 12/25/2007 14:41:37
Bootbase Version : V1.04 | 6/28/2006 10:10:34
Vendor Name : ZyXEL Communications Corp.
Product Model : P-660HW-T3 v2
ZyNOS ROM address : bfc10000
System Type : 7
MAC Address : xxxxxxxxxxxx
Default Country Code : F6
Boot Module Debug Flag : 00
RomFile Version : 68
RomFile Checksum : 74fe
ZyNOS Checksum : 11a5
Core Checksum : 870f
SNMP MIB level & OID : 060102030405060708091011121314151617181920
Main Feature Bits : C0
Other Feature Bits :
9A 3D 00 00 01 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-02 41 13 00 00 00
OK
ATBT1
OK
ATSB
....
OK
ATSH
ZyNOS Version : V3.40(BEI.0) | 12/25/2007 14:41:37
Bootbase Version : V1.04 | 6/28/2006 10:10:34
Vendor Name : ZyXEL Communications Corp.
Product Model : P-660HW-T3 v2
ZyNOS ROM address : bfc10000
System Type : 7
MAC Address : xxxxxxxxxxxx
Default Country Code : F6
Boot Module Debug Flag : 00
RomFile Version : 68
RomFile Checksum : 74fe
ZyNOS Checksum : 11a5
Core Checksum : 870f
SNMP MIB level & OID : 060102030405060708091011121314151617181920
Main Feature Bits : C0
Other Feature Bits :
9A 3D 00 00 01 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-02 41 13 00 00 00
OK8001F468 je adresa v bufferi v RAM. V inej verzii Bootbase moze byt ina! Nasiel som ju dumpovanim adresneho priestoru cez XMODEM (prikaz ATDO).
A uz to fici
Kód: Vybrat vše
ATUR
Starting XMODEM upload (checksum mode)....
U
Total 1896960 bytes received.
Erasing..............................
............................................................................................................................................................
OK
System Reboot...
Console speed will be changed to 9600 bps
Bootbase Version: V1.04 | 6/28/2006 10:10:34
RAM: Size = 16384 Kbytes
DRAM POST: Testing: 16384K
OK
FLASH: AMD 16M *1
ZyNOS Version: V3.40(ANR.5) | 12/31/2009 14:33:00
Press any key to enter debug mode within 3 seconds.
...
Enter Debug Mode
ATSH
ZyNOS Version : V3.40(ANR.5) | 12/31/2009 14:33:00
Bootbase Version : V1.04 | 6/28/2006 10:10:34
Vendor Name : ZyXEL Communications Corp.
Product Model : P-660HW-T3 v2
ZyNOS ROM address : bfc10000
System Type : 7
MAC Address : xxxxxxxxxxxx
MAC Quantity : 1
Default Country Code : F6
Boot Module Debug Flag : 00
RomFile Version : 68
RomFile Checksum : 74fe
ZyNOS Checksum : 9848
Core Checksum : f55b
SNMP MIB level & OID : 060102030405060708091011121314151617181920
Main Feature Bits : C0
Other Feature Bits :
9A 3D 00 00 01 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-02 41 13 00 00 00
OK