Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Zyxel PMG3000-D20B firmware image files

The firmware of this GPON ONT SFP module can be updated using the web interface (Management | Update Software):

The web interface only accepts image files with a special header. These can be created by adding the header to a flash dump.

Firmware collection

Change extension to .zip and extract.
.img unmodified mtd2 / mtd3 flash dump
.upf with header (can be installed using the web interface)

V1.00 is based on OpenWrt 12.09. Deutsche Telekom (Germany) seems to stick with this branch.

V1.00(ABVJ.0)b3s (2020-12-23)

V1.00(ABVJ.0)b3v (2021-05-08)

V1.00(ABVJ.1)b1e (2023-07-26)

V2.50 is based on OpenWrt 14.07. Wind Tre (Italy) upgraded to this branch at the end of 2022.

V2.50(ABVJ.1)b1d (2023-04-21)

V2.50(ABVJ.1)b1f (2023-07-14)

Both branches are maintained separately, so a 1.00 image can have a later build date than a 2.50 image.

Please leave a comment if you have any other flash dumps.

Creating image files

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file (rename to 'header') and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

Unfortunately, my PMG3000-D20B isn't accessible via web UI. I tried that procedure, but obviously it doesn't work for me. If you have any information on how to perform a "PCB hard reset", please let me know. Thanks for your advice.

@Emmegi2001 Since you seem to have access to the serial console: Have you tried this? xvzf/zyxel-gpon-sfp#19 (comment)

Thanks. I just read the procedure described in the link you sent me. I have no idea what "DNS:NET" is. Is it a device?

@Emmegi2001 The relevant part is:

I could set the speed back to the default values with
Hal# set speed default mode default

So just the way you set the speed to 2.5G, you should be able to set it back to the default 1G.

Yes, you're right. I know that command line, but I don't know how log in to the pmg3000-d20b via uart to enter that command line. Can you suggest which console or tool I should use?

@Emmegi2001 This is getting really off topic... I was under the impression you already had access to the serial console.

The module needs to be disassembled to access the serial interface and a USB-to-UART (3.3V) converter is required. Instructions are available on https://hack-gpon.org/ont-zyxel-pmg3000-d20b/.

Then you can use a tool like PuTTY to access it.

Perfect! Tks

Hi, everything is working now, and I even have a new firmware version, and the SFP performs better. I'm currently trying to follow the commands to create my firmware image file, but I don't know how to proceed:

How to: "Download flash dump from SFP"?

How to: "upload the file header to SFP"?

So i have this:

"can't open header: no such file or directory"

"can't open mtd2: no such file or directory"

Thanks for the firmware. Can someone explain to me what the difference between V1 00(ABVJ 1)b1e and V2 50(ABVJ 1)b1d is?
Looks like the V1 00(ABVJ 1)b1e is the latest version based on the date, but the has a lower Version Number than V2 50. Looks kind of weird to me. Any release notes available or suggestions ?

@Emmegi2001 Are you trying to extract a firmware image from the module? Does it have a version which is not available in this gist? Which one?

@breaver See my comment here about the different versions: xvzf/zyxel-gpon-sfp#35 (comment)
Thanks for the question, I'll add this information to the gist.
I'm not aware of public release notes, but would definitely be interested if you find any.

Ver: V2.50(ABVJ.1)b1f

@Emmegi2001 Okay, nice! I wrote this gist more as an addition to all the information that's already out there, hence it's not that detailed.

You can use TFTP to extract files from the SFP. This requires running a TFTP server on your PC. For example, Tftpd64 is a good option for Windows.

Then, while logged into the SFP's console, create a flash dump and upload it to your PC:

cd /tmp
dd if=/dev/mtd2 of=mtd2
tftp -v 10.10.1.2 -m binary -c put mtd2

Where 10.10.1.2 is the IP address of the PC running the TFTP server.

You can then send me the file (e. g. attach it to a comment). I'll add the header and include it in the gist. Thanks!

cd /tmp (....ok)
dd if=/dev/mtd2 of=mtd2 (....ok)

tftp -v 10.10.1.2 -m binary -c put mdt2 (....not ok: invalid option -v )

@Emmegi2001 Oh sorry, I seem to recall that the module uses busybox. The tftp command is a little different there.
tftp -l mtd2 -p 10.10.1.2 should work.

ok, done!
So... I have another pmg3000-d20b but the mtd0, mtd2, mtd3, mtd4 and mtd5 partitions have been erased. How can I restore them via UART?

@Emmegi2001 Thanks a lot for the image, but this is V1.00(ABVJ.0)b3s. The active firmware is most likely image B. Could you please try again with mtd3?

cd /tmp
dd if=/dev/mtd3 of=mtd3
tftp -l mtd3 -p 10.10.1.2

Without mtd0, I don't think the SFP can be unbricked via UART. mtd0 contains the bootloader, so it won't even boot and there's just nothing which answers on the UART.

Done (take two)

@Emmegi2001 These are identical, both are V1.00(ABVJ.0)b3s. But according to the screenshot, mtd3 is indeed V2.50(ABVJ.1)b1f.
There probably was a mix-up at some point. Could you try again?

ok, no problem.

Done. (Take three)

@Emmegi2001 Thanks a lot! I tested the image on my SFP module and added it to the gist.

Great! ;-)

ok, no problem.

Done. (Take three)

Hello, could you please resend the mtd2/mtd3 V2.50(ABVJ.1)b1f versions? The links here are inactive. Thank you!

@binlex-ar The links in the gist are working fine. As explained: Download link, change extension to .zip and extract.

@maurice-w Sorry, I'm an idiot, it's all good!

@maurice-w Thanks for providing those firmwares! Did you notice any difference with ipv6 support in these firmware versions?

Hey @bentau, IPv6 works fine in all of them, >99% of my traffic is IPv6. GPON shouldn't really care about layer 3, it handles Ethernet frames regardless of their contents.

My ISP does use PPPoE though, so any potential bugs regarding plain IPv6-over-Ethernet would have gone unnoticed.

Or do you mean the management (web interface / ssh)? Unfortunately, that's IPv4-only in all versions.

I noticed that this GPON module does not work with my provider with IPv6. I don't get any IPv6 IP with it. v4 just works.
However, the one that I bought from fs.com actually does work with IPv6 (same router and provider).

Also, https://hack-gpon.org/ont-zyxel-pmg3000-d20b/ says that someone also had problems with IPv6.

@bentau Do you use PPPoE or plain IP over Ethernet?

A different SFP working with the same router and ISP might indeed indicate an issue with the Zyxel SFP. Have you tried all firmware versions?

@maurice-w I think I use plain IP over Ethernet. At least I didn't have to configure PPPoE on my mikrotik router

I haven't tested the firmware versions yet. Since I have a working module, getting the Zyxel to work is low priority now.

@bentau That makes sense. Since my module doesn't ever see "naked" IPv6 packets (everything is encapsulated in PPPoE), I wouldn't notice potential bugs with that.