summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorSimone Bortolin <simonebortolin@users.noreply.github.com>2022-08-07 23:17:05 +0200
committerSimone Bortolin <simonebortolin@users.noreply.github.com>2022-12-19 22:56:20 +0100
commitb78c4b2210fbb9a7505a85e7b218fd3eadf7f093 (patch)
treec4949c32e8ce70e77bf91e428a823a88f26096e9
parentupdate huawei hg8010h (diff)
parentZyxel: OMCI debug (diff)
downloadhack-gpon.github.io-b78c4b2210fbb9a7505a85e7b218fd3eadf7f093.tar
hack-gpon.github.io-b78c4b2210fbb9a7505a85e7b218fd3eadf7f093.tar.gz
hack-gpon.github.io-b78c4b2210fbb9a7505a85e7b218fd3eadf7f093.tar.bz2
hack-gpon.github.io-b78c4b2210fbb9a7505a85e7b218fd3eadf7f093.tar.lz
hack-gpon.github.io-b78c4b2210fbb9a7505a85e7b218fd3eadf7f093.tar.xz
hack-gpon.github.io-b78c4b2210fbb9a7505a85e7b218fd3eadf7f093.tar.zst
hack-gpon.github.io-b78c4b2210fbb9a7505a85e7b218fd3eadf7f093.zip
Diffstat (limited to '')
-rw-r--r--ont-Zyxel-PMG3000-D20B.md125
-rw-r--r--ont-technicolor-afm0002.md37
2 files changed, 138 insertions, 24 deletions
diff --git a/ont-Zyxel-PMG3000-D20B.md b/ont-Zyxel-PMG3000-D20B.md
index a56da20..a69be64 100644
--- a/ont-Zyxel-PMG3000-D20B.md
+++ b/ont-Zyxel-PMG3000-D20B.md
@@ -22,6 +22,9 @@ parent: ONT
| SSH | ✅ username `admin`, password `1234` |
| Form Factor | miniONT SFP |
+Once you access the stick via ssh you will be challenged with a second tier login. The credentials to access the zyxel shell are: username: `twmanu` , password: `twmanu`.
+From the zyxel shell you can escape to a standard linux shell via the `linuxshell` command
+
## Interchangeable firmware with
- [Zyxel PMG3000-D20B](ont-Zyxel-PMG3000-D20B)
@@ -30,10 +33,124 @@ parent: ONT
- Zisa
- T&W
-## List of software version
-## List of partition
-## List of firmware and files
+# List of software version
+
+# List of partitions
+
+| dev | size | erasesize | name |
+| ---- | -------- | --------- | -------------- |
+| mtd0 | 00060000 | 00010000 | "Boot" |
+| mtd1 | 00010000 | 00010000 | "Env" |
+| mtd2 | 00390000 | 00010000 | "ImageA" |
+| mtd3 | 00390000 | 00010000 | "ImageB" |
+| mtd4 | 00060000 | 00010000 | "Config" |
+| mtd5 | 00010000 | 00010000 | "SECTION_EGIS" |
+| mtd6 | 00250000 | 00010000 | "rootfs" |
+| mtd7 | 00020000 | 00010000 | "rootfs_data" |
+
+
+This stick supports dual boot from `ImageA` and `ImageB` witch contains the rootfs.
+
+
+# List of firmware and files
+## Useful files
+- `/var/config/ont.sys` used to customize various settings on the stick
+
+# Useful commands
+
+# Useful commands
+*Note: all commands start from the twmanu shell*
+
+## Change the ONT S/N
+*Note the S/N is in ACII format*
+```sh
+manufactory
+set sn ALCLf0f0f0f0
+exit
+hal
+set sn ALCLf0f0f0f0
+```
+
+## Change the ONT PLOAM password
+*Note: the PLOAM is in ACII format*
+This can be done easily via web ui. If you prefer to do it via the shell use:
+```sh
+manufactory
+set password PLOAMPASS
+```
+
+## Change the ONT equipment ID
+*Note: model number must be 20 no more than chars total*
+```sh
+manufactory
+set equipment id MYEQUIPMENTID
+exit
+omci
+equipment id MYEQUIPMENTID
+```
+
+## Change the ONT hardware version
+```sh
+manufactory
+set hardware version 3FE49165BFAA01
+```
+
+## Change the software version
+Edit the /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line.
+The entries for the software version are:
+```
+SW_VER0:0xabcdef
+SW_VER1:0xabcedf
+```
+*Note: it's better to enter the software version in hex format, all lowercase precedeed by 0x.*
+
+## Query a particular OMCI ME
+Query via OMCI ME Class Name
+```sh
+omci
+show me classname OmciClassName (e.g Ont2g)
+```
+
+Query via OMCI ME ID
+```sh
+omci
+show me id OmciClassId (e.g 7)
+```
+
+
+# Low level modding
+
+## Create a new rootfs
+The stick has a tricky image packing method, fortuntaly it has been reverse engineered. A script to help you create a custom rootfs can be found here: [https://github.com/nanomad/zyxel-pmg-3000-mod-kit](https://github.com/nanomad/zyxel-pmg-3000-mod-kit)
+
+## Flash a new rootfs
+*Note: all commands start from the twmanu shell*
+
+- Transfer the new mtd on the stick via tftp
+```
+linuxshell
+tftp -gr mtd2.mod.bin TFTP_SERVER_IP
+```
+- Flash it on the standby partition.
+You can use `system` and then `show actimage` to get the current active image. Check `/proc/mtd` for the right mtds. Usually:
+- if the currect active image is A the mtd in use is mtd2
+- If the current active image is B the mtd in use is mtd3
+```
+linuxshell
+mtd -e /dev/mtd2 write /tmp/mtd2.mod.bin /dev/mtd2
+```
+- Switch to the new image
+```
+system
+set actimage a
+```
+- Reboot the ONT
+```
+system
+reboot
+```
+
# Miscellaneous Links
- [https://github.com/xvzf/zyxel-gpon-sfp](https://github.com/xvzf/zyxel-gpon-sfp)
-
+- [https://github.com/nanomad/zyxel-pmg-3000-mod-kit](https://github.com/nanomad/zyxel-pmg-3000-mod-kit)
diff --git a/ont-technicolor-afm0002.md b/ont-technicolor-afm0002.md
index 92fd915..4512a1d 100644
--- a/ont-technicolor-afm0002.md
+++ b/ont-technicolor-afm0002.md
@@ -35,9 +35,6 @@ parent: ONT
{% include info.html content="The AFM0002FWB can be transformed into AFM0002TIM. The AFM0002FWB has an older sw version." %}
-# Serial
-
-
# List of software versions
- V1_7_8_180122
- V1_7_8_180725
@@ -84,6 +81,23 @@ This stick supports dual boot.
# Useful commands
+## Get/Set the ONT S/N
+```sh
+# /etc/scripts/bin flash get GPON_SN
+GPON_SN=TMBB00000000
+# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D
+```
+
+## Get/Set the ONT PLOAM password
+
+{% include info.html content="The PLOAM password is in ASCII format" %}
+
+```sh
+# /etc/scripts/bin flash get GPON_PLOAM_PASSWD
+GPON_PLOAM_PASSWD=AAAAAAAAAA
+# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA
+```
+
## Enable the Web UI
```sh
# /bin/iptables -D INPUT -p tcp --dport 80 -j DROP
@@ -105,23 +119,6 @@ sw_version1=V1_7_8_210412
# reboot
```
-## Get/Set the ONT S/N
-```sh
-# /etc/scripts/bin flash get GPON_SN
-GPON_SN=TMBB00000000
-# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D
-```
-
-## Get/Set the ONT PLOAM password
-
-{% include info.html content="The PLOAM password is in ASCII format" %}
-
-```sh
-# /etc/scripts/bin flash get GPON_PLOAM_PASSWD
-GPON_PLOAM_PASSWD=AAAAAAAAAA
-# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA
-```
-
## Query a particular OMCI ME
```sh
# omcicli mib get MIB_IDX