Zyxel PMG2005-T20B

Informações sobre a Zyxel PMG2005-T20B GPON ONT/ONU. Teardown, hacking, unlocking (desbloqueio), firmwares, custom images, recuperação, bridge.

Disclaimer

Todas as informações, métodos, procedimentos, firmwares, aplicativos e material sobre modificações e configurações postadas neste wiki foram criados pelo O3 Labs (salvo menção em contrário) e disponibilizadas GRATUITAMENTE desde o dia de sua elaboração. Denuncie quando possível quaisquer tentativas de venda destes material.

Hardware

SoC	Ralink MT751020 XPON SoC - MIPS 34Kc @ 650 MHz
RAM	128 MB - W971GG6SB-25 DDR2 SDRAM
Flash	16 MB - KH25L12835F
LAN	1 x 1 Gbit/s
USB	-
Wireless 2.4 GHz	-
Wireless 5 GHz	-
Laser Driver/Transceiver	UX3328S
Acoplamento fibra	SC/APC
FXS	-
HPNA	-
Serial	Sim
JTAG	-
Alimentação	DC 12 V / 500 mA
Credenciais padrão (web)	admin / 1234
Credenciais padrão (telnet)	admin / 1234
Credenciais padrão (SSH)	admin / 1234
IP LAN padrão	192.168.1.1

GPON

Tipo	SFU (Ethernet UNI: 4 \ VEIP: 0) ou HGU (Ethernet UNI: 0 \ VEIP: 1)
Vendor ID	ZYWN
Version	PMG2005-T20B
Equipment ID	WKE2.119.241R2B
Product code	340
OMCC Version	160 (0xA0)
Software Version (Main, example)	V100ABNK1C0
Software Version (Standby, example)	-

Bootlog

Clique aqui para visualizar

DRAMC V2.2.0.2 (0)


MT751020 at Tue Aug 21 18:21:34 CST 2018 version 1.1 free bootbase

Memory size 128MB

flash base: bc000000
Found SPI Flash 16MiB MX25L12805D at 0xbc000000

tcPhyVer_mt7510FE
 Not found TC Phy
mtPhyVer_7510Ge
Not found TC Phy
Press any key in 5 secs to enter boot command mode.
....................................................................................................


==> boot flag = 0Decompress to 80002000 free_mem_ptr=80600000 free_mem_ptr_end=80780000
from main
Uncompressing [LZMA] ...  done.
Linux version 2.6.36 (root@kevinlin-12) (gcc version 4.3.4 (GCC) ) #1 SMP Tue Aug 21 18:06:54 CST 2018
ISPRAM0: PA=002a8000,Size=00008000,enabled
DSPRAM0: PA=1dff8000,Size=00001000,enabled
flash_init: flash_base:bc000000
flash_init: flash_base:bc000000
memsize:128MB
Ralink MT751020 SOC prom init
bootconsole [early0] enabled
CPU revision is: 00019555 (MIPS 34Kc)
Determined physical RAM map:
 memory: 07fe0000 @ 00020000 (usable)
Wasting 1024 bytes for tracking 32 unused pages
Zone PFN ranges:
  Normal   0x00000020 -> 0x00008000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
    0: 0x00000020 -> 0x00008000
3 available secondary CPU TC(s)
PERCPU: Embedded 7 pages/cpu @81103000 s7168 r8192 d13312 u65536
pcpu-alloc: s7168 r8192 d13312 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32480
Kernel command line:  es=1
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 64kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=0005f047
Readback ErrCtl register=0005f047
nmi base is 8115c200
Memory: 126132k/130944k available (2745k kernel code, 4812k reserved, 570k data, 220k init, 0k highmem)
SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
	RCU-based detection of stalled CPUs is disabled.
	Verbose stalled-CPUs detection is disabled.
NR_IRQS:64
CPU frequency 648.00 MHz
 Using 266.667 MHz high precision timer.
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
34K sync es set to 1.
Config7: 0x80080500
Limit of 4 TCs set
TLB of 64 entry pairs shared by 2 VPEs
VPE 0: TC 0 1 2, VPE 1: TC 3
IPI buffer pool of 16 buffers
CPU revision is: 00019555 ((null))
TC 1 going on-line as CPU 1
CPU revision is: 00019555 ((null))
TC 2 going on-line as CPU 2
CPU revision is: 00019555 ((null))
TC 3 going on-line as CPU 3
Brought up 4 CPUs
NET: Registered protocol family 16
MT7510_pcie_init
check pcie link up status:
isRC0_LINKUP=0
isRC1_LINKUP=0
PCI-E RC0 & RC1 can not link up
bio: create slab <bio-0> at 0
NET: Registered protocol family 8
NET: Registered protocol family 20
Switching to clocksource MIPS
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
TC3162 hardware watchdog module loaded.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 246
cryptomgr_test used greatest stack depth: 15632 bytes left
io scheduler noop registered (default)
ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162
brd: module loaded
tc3162 mtd init: mt6573_nand_init enter
MediaTek MT6573 Nand driver init, version v2.0
tc3162: flash device 0x01000000 at 0x1c000000
tc3162: Found SPIFLASH 16MiB MX25L12805D
Creating 10 MTD partitions on "tc3162":
0x000000000000-0x000000020000 : "bootloader"
0x000000020000-0x000000030000 : "romfile"
0x000000030000-0x0000001570c8 : "kernel"
mtd: partition "kernel" doesn't end on an erase block -- force read-only
0x0000001570c8-0x0000004b70c8 : "rootfs"
mtd: partition "rootfs" doesn't start on an erase block boundary -- force read-only
0x000000030000-0x000000830000 : "tclinux"
0x000000830000-0x0000008300ff : "kernel_slave"
mtd: partition "kernel_slave" doesn't end on an erase block -- force read-only
0x0000008300ff-0x000001000000 : "rootfs_slave"
mtd: partition "rootfs_slave" doesn't start on an erase block boundary -- force read-only
0x000000830000-0x000000fc0000 : "tclinux_slave"
0x000000fc0000-0x000001000000 : "reservearea"
0x000000fb0000-0x000000fc0000 : "romd"

rootfs
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
NET: Registered protocol family 24
RT3xxx EHCI/OHCI init.
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (1970 buckets, 7880 max)
ctnetlink v0.93: registering with nfnetlink.
nf_conntrack_rtsp v0.6.21 loading
nf_nat_rtsp v0.6.21 loading
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP cubic registered
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
Freeing unused kernel memory: 220k freed
init used greatest stack depth: 15448 bytes left
busybox init and set aff
init started:  BusyBox v1.00 (2018.08.21-10:07+0000) multi-call binary
[ used greatest stack depth: 14832 bytes left
chmod: chmod used greatest stack depth: 14776 bytes left
/userfs/profile.cfg: Read-only file system
[ used greatest stack depth: 14664 bytes left
busybox used greatest stack depth: 14320 bytes left
module_sel: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
insmod used greatest stack depth: 13896 bytes left

tcsmux version: tcsmux V1.1.0.0 (Sep 14 2015-15:57:28).

tcportbind version: tcportbind V1.1.0.0 (Sep 14 2015-15:57:30).
vlantag_drv_init
TCSUPPORT_IPV6
TC3162 LED Manager 0.1 init

tcledctrl version: tcledctrl V1.1.0.0 (Aug 21 2018-18:07:09).
tccicmd V1.1.0.0 (Aug 21 2018-18:07:11)

SIFMaster 0.1 init

Register sifm cmd
the number of cfg node is 64
portbind_init
autopvc_init
LanguageSwitch_init vendorCfgFile_init The number of cache node is 5
Enter into function:parser_romfile
sslca_write:get Frag Number failed!
Can't open /etc/Wireless/WLAN_APOn
Can't open /etc/Wirel
lanHost_read: Create node LanHost !
ess/RT61AP/RT61AP.dat
Cannot ip used greatest stack depth: 13792 bytes left
find device "br0"
insmod raeth driver
femac.c:v1.00-NAPI 29.Mar.2011
eth0: FE MAC Ethernet address: 98:0D:67:XX:XX:XX
xPON driver initialization
Alloc data struct memory successful, 34428
vendor id : T&W
vendor pn : TW2362G-CDEH
Match Vendor
PON PHY 2015_03_10
XPON Mapping Module init OK!
Mirror/redirect action on
SIOCGIFFLAGS: No such device
Ebtables v2.0 registered
eth0: starting interface.
EPhy debug(8): tcPhyVerLookUp() in
MT7510FE, EPhy debug(8)(15): tcPhyVerLookUp() out
PhyPart debug: tcPhyInit() in , tcphyver=15, phyaddr=8, eco=0x0
phyaddr = 8
PhyPart debug: tcPhyInit() out , r31=0xb000
EPhy debug(12): tcPhyVerLookUp() in
MT7510Ge,Internal check flag: fgMT7510Ge_INT=0x0, eco=0x50003
EPhy debug(12)(16): tcPhyVerLookUp() out
PhyPart debug: tcPhyInit() in , tcphyver=16, phyaddr=12, eco=0x0

 7510Ge, phyaddr= (12,12)
debug... ,phyaddr=12 ,eco=0x50003
PhyPart debug: tcPhyInit() out , r31=0xb000
Ralink HW NAT Module Enabled
IP check use Black List
device eth0 entered promiscuous mode
done
telnetd: starting
  port: 23; login program: /bin/login
TC3162 hardware watchdog initialized
SSH
Will output 1024 bit rsa secret key to '/tmp/etc/dropbear/dropbear_rsa_host_key'
Generating key, this may take a while...
Public key portion is:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgnCJSQpqqjflfyCMw8vtoXP2awGb33UbdUaoxO0ltV+yvEsITgHOTjUR53G1qmBDmPSI6nwWAgFxsRhOuuGMe4iksyax2LhW889tKzEL81sOE46TpYuYOdLQgl6hzkk/Ttpb9MS0YXOb6OLkyRGnl31KgMMy6HpqhC03lD7LCa0PXBM= admin@PMG2005-T20B
Fingerprint: md5 db:0e:f2:7d:da:65:29:12:f4:70:92:2a:95:95:f5:d9
Will output 1024 bit dss secret key to '/tmp/etc/dropbear/dropbear_dss_host_key'
Generating key, this may take a while...
mtphy[4]:Link-up at 1000 F.
ALL 0x1E,0x9B =0x0
ALL 0x1E,0x9C =0x0
BB1 lch_mse_mdcA =0x0
BB2 lch_mse_mdcB =0x0
BB3 lch_mse_mdcC =0x0
BB4 lch_mse_mdcD =0x0
Public key portion is:
ssh-dss AAAAB3NzaC1kc3MAAACBAPyD86tJiUzk37BTzbUhXS0lTe8SWouXdoWnza21c3SW8OjbP/ZzlGuzCqH+YCLB/XnV72DaxPrn0PDofmeqsrqlgqLm19XW7NNEa5c2nI7eedArSosQeNxs/i4vZK5DNbQVXI45LlaBhqznP6aJPFgNUtiid8mKFDSZ+eZKRQe5AAAAFQCxRTzjKdFrvs6hC7wMwsUZL+fxcwAAAIEAnPUqp+c/3QJyRD8eWETH7hrJxUMG0VwYGWfuwFTC/LAAKyW2lW3BjZiceLMQOLCh+pNGrVjACxICiaERQns7fGtg91qsJgRlNwLkk3+tjXb94GUiNoS3IkdRHhlojYJ00wxqBuluCGSlm1D5sakpxDyjwjop54oQ6LBR28SNfMEAAACBALsgSyYzHINTT5SWQK5Gu5gCgHhh/dOjZWCTOo+DSUaCnljl3p0c1+lhXmsqaMMQ00fq4VE7dg1C4J+2WlJqgWt4LGLg2gQ3Sd0mmm+z6wDaJTC/FHJg3MYebm4s0Q86Ql9T8FO7oSoBu4qjUDgRtd4usrvKgIHBsct8D2fl8JP0 admin@PMG2005-T20B
Fingerprint: md5 d0:89:04:ba:a3:c0:27:4d:60:f7:3e:8e:39:e1:9a:aa
no specific node
four ports
SIOCGIFFLAGS: No such device
interface eth0.1 does not exist!

Enabling SSL security system
SSL security system enabled[01/Jan/1970:00:00:13 +0000] boa: server version Boa/0.94.13
[01/Jan/1970:00:00:13 +0000] boa: server built Aug 21 2018 at 18:09:49.
[01/Jan/1970:00:00:13 +0000] sh: vconfig: not found
boa: starting server pid=214, port 80
SIOCGIFFLAGS: No such device
interface eth0.2 does not exist!
sh: vconfig: not found
SIOCGIFFLAGS: No such device
interface eth0.3 does not exist!
sh: vconfig: not found
SIOCGIFFLAGS: No such device
interface eth0.4 does not exist!
sh: vconfig: not found
device eth0 is already a member of a bridge; can't enslave it to bridge br0.
MT7520S is single port!
pon_vlan_init

Single Lan port
 initilize xpon igmp module....done!
pon_mac_filter_init

Single Lan portSIOCSIFMTU: No such device
SIOCSIFMTU: No such device
SIOCSIFMTU: No such device
SIOCSIFMTU: No such device
SIOCSIFMTU: No such device
*reg=00001640 value:00000000 (ext_switch:0)
mtd[readflash]:device=reservearea tclen=512 tcoffset=197632
Unlocking reservearea ...
Reading from reservearea to /tmp/productlinecwmpfile ...
mtd[readfl
 gpon_boot main strlen(tempbuffer)=16,trx:256as
 gpon_boot main fwver=V1.00(ABNK.1)C0
,trx->version:V1.00(ABNK.1)C0

h]:device=tclinux tclen=32 tcoffset=0
Unlocking tclinux ...
Reading from tclinux to /tmp/main_trx.bin ...
mtd[readflash]:
 gpon_boot:  slave_trx.bin Bad trx magic
device=tclinux_slave tclen=32 tcoffset=0
Unlocking tclinux_slave ...
Reading from tclinux_slave to /tmp/slave_trx.bin ...
00:00:14 imgr.c [71]: Initial system driver.
00:00:14 imgr.c [77]: Initial pthread parameters.
00:00:14 imgr.c [83]: Initial dispatcher.
00:00:14 dspch_init.c [23]: Create IPC trap message queue
00:00:14 dspch_init.c [36]: Create IPC trap message queue
00:00:14 imgr.c [89]: Initial database manager.
00:00:14 dbmgr_init.c [32]: Create database memory.
00:00:14 dbmgr_init.c [38]: Create the share database memory successful.
00:00:14 dbmgr_init.c [41]: The total share database size is 0.
00:00:14 imgr.c [95]: Initial config manager.
00:00:14 imgr.c [101]: Initial fault manager.
00:00:14 imgr.c [107]: Initial performance manager.
========================insmod iptable_filter=======================
insmod used greatest stack depth: 13696 bytes left
chmod: /userfs/profile.cfg: Read-only file system
/etc/isp0.conf
info, udhcpc (v0.9.9-pre) started
chmod: /userfs/profile.cfg: Read-only file system
rm: cannot remove `/etc/nas0_gateway.conf': No such file or directory
debug, Sending discover...
/etc/isp1.conf
/etc/isp2.conf
Cannot find device "imq0"
bad action parsing
parse_action: bad value (5:mirred)!
Illegal fw "action"
/etc/isp3.conf
/etc/isp4.conf
/etc/isp5.conf
/etc/isp6.conf
/etc/isp7.conf
br0: port 1(eth0) entering forwarding state
br0: port 1(eth0) entering forwarding state
Radvd function activated!
Enter set first loop, IP addr by radvd
sh: /tmp/del_radvd_prefix.sh: not found
radvd starting
dhcp6s parameter activated by exec!
killall: dropbear: no process killed
dropbear used greatest stack depth: 12468 bytes left
info, udhcpd (v0.9.9-pre) started
error, Unable to open /etc/udhcpd.leases for reading
sh: /userfs/bin/dproxy: not found
mtcphy[4]: Link-down!!!
valid subcommands:
adsl

Enter cwmp boot, we will start tr69 Process
debug, Sending discover...
/etc/lanAlias0.conf
killall: klogd: no process killed
killall: syslogd: no process killed
ftp switch turn off
sip switch turn off
h323 switch turn off
rtsp switch turn off
l2tp switch turn off,sw_state=
iptables: Bad rule (does a matching rule exist in that chain?).
ipsec switch turn off,sw_state=
iptables: Bad rule (does a matching rule exist in that chain?).
pptp switch turn off
iptables: Bad rule (does a matching rule exist in that chain?).
set olt type: 0
echo used greatest stack depth: 8952 bytes left
gpon_boot: buffer =0
valid subcommands:
adsl

parameter_init(), buf = mtd[writeflash]:device=reservearea tclen=1 tcoffset=65536 tcfilelen =2
Unlocking reservearea ...
Writing from /tmp/image_boot_flag to reservearea ...
enter real action -----tclen:0x1,tcoffset:0x10000
writeflash: write 0 'st sector,start from 0x10000,0x1 bytes
[e]iptables: No chain/target/match by that name.
Daemon Successfully forked (pid: 819)
[w]writeflash: total write 0x1 bytes


Send OAM Update config!
!sendEponOamCmdMsg open message queue fail!
Unlocking romfile ...
Writing from /tmp/var/romfile.cfg to romfile ...
 [ ][e][w][w][w]debug, Sending discover...
Link State: LAN_1 up.
hw_nat -U 30 30 30 30
mtphy[4]:Link-up at 1000 F.
ALL 0x1E,0x9B =0x0
ALL 0x1E,0x9C =0x0
BB1 lch_mse_mdcA =0x0
BB2 lch_mse_mdcB =0x0
BB3 lch_mse_mdcC =0x0
BB4 lch_mse_mdcD =0x0
done

Please press Enter to activate this console.
sendOmciCmdMsg open message queue fail!ThreadedTimerCheck: get last for first time

Configurações

É de sua total responsabilidade o uso e implicações que utilizar equipamentos não fornecidos ou homologados pelo ISP podem causar.

Com o firmware custom versão V1.00(OBNK.1)C0 ou superior, é possível alterar quase todos os dados que o aparelho se identifica e reporta via OMCI, com exceção do MAC address da interface WAN (raramente é necessário mudá-lo, de qualquer forma) e o Vendor ID, que é automaticamente extraído do serial GPON atualmente configurado (seus 4 primeiros dígitos; o usual).

Para editá-los, obtenha um backup do romfile atual do aparelho, abra-o em um editor de texto simples e procure pela seção <GPON>:

Neste seção, basta editar os seguintes campos conforme o aparelho que pretende emular:

ONU > SerialNumber	Serial GPON, 12 dígitos (4 ASCII + 8 hexadecimais). Os 4 primeiros dígitos serão utilizados como o VendorId
ONU > VendorId	Sigla/ID do fabricante. Será sobrescrito pelo aparelho a partir do serial GPON
ONU > Version	Versão do equipamento. Também conhecido como “Hardware version”
ONU > Password	Senha PLOAM/SLID. Deixe o padrão se não utilizado.
ONU > TMOption	Tipo de gerenciamento de tráfego (traffic management)
ONU > EquipmentId	ID do equipamento
ONU > OMCCVersion	Versão do OMCC suportado pelo equipamento
ONU > VendorProCode	Código de produto do fabricante
SoftImage0 > Version	Versão do software do banco principal
SoftImage1 > Version	Versão do software do banco secundário
LOIDAuth > LOID	LOID, para autenticações com este mecanismo. Deixe em branco se não utilizado
LOIDAuth > Password	Senha LOID, para autenticações com este mecanismo. Deixe em branco se não utilizado

Bugs, dicas e notas

Firmwares

Stock

Versões oficiais e não modificadas para o aparelho. São de propriedade do fabricante - que detém todos os direitos sobre elas - e mantidas aqui apenas em caráter de arquivamento e espelhamento, podendo ser removidas caso solicitado pelos representantes oficiais da empresa.

Custom

Todas as versões custom são testadas localmente ao máximo possível, porém seu uso e possíveis implicações são de total responsabilidade do proprietário do aparelho. Não atualize o aparelho sem necessidade; só atualize o aparelho para as versões custom se confirmado que precise das alterações listadas.

Os arquivos produzidos pelo O3 Labs são assinados para garantir sua integridade e procedência. Para instruções de como validar as assinaturas, acesse aqui.

Versões modificadas com correções e/ou melhorias, baseadas em releases oficiais/stock. As versões são cumulativas, ou seja, a mais recente sempre contém também todas as modificações das versões anteriores.

É possível atualizar entre versões custom ou stock sem nenhum problema. Note que saltos na versão base podem incluir ou remover parâmetros de configuração, portanto é aconselhável um factory reset após realizar tais atualizações. Adicionalmente, efetue estes procedimentos com a fibra desconectada do aparelho.

Caso a versão base continue a mesma de uma versão custom para a outra, não é necessário o factory reset, salvo se solicitado explicitamente na descrição.

Agradecimentos

Pessoas envolvidas em arquivos, discussões, dicas, doações ou bate papo em geral. Lista em ordem alfabética.

skullao