Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Creating image files for the Update Software feature in the Zyxel PMG3000-D20B web interface

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file (rename to 'header') and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

Firmware collection

Change extension to .zip and extract.
.img: raw mtd2 flash dump
.upf: with header

V1 00(ABVJ 0)b3s (2020-12-23)

V1 00(ABVJ 0)b3v (2021-05-08)

V1 00(ABVJ 1)b1e (2023-07-26)

V2 50(ABVJ 1)b1d (2023-04-21)

Please leave a comment if you have any other flash dumps.

@Emmegi2001 This gist is specifically about update files for the web interface, so the module can be updated without special hardware or SSH (which is unavailable in some firmware versions).

What firmware version is installed on your module? I'm not aware of one without web interface.

I don't remember what version it is. The problem is that after i typed the "set speed 2.5g mode full" command, I can no longer access to the pmg3000-d20b via ssh or the web. To solve the problem, I thought about flashing it. Or a hard reset might help, but I have no idea how to do that.

A firmware update will probably not fix this.
But you're not the first one with this issue. One solution is explained here: xvzf/zyxel-gpon-sfp#25

Unfortunately, my PMG3000-D20B isn't accessible via web UI. I tried that procedure, but obviously it doesn't work for me. If you have any information on how to perform a "PCB hard reset", please let me know. Thanks for your advice.

@Emmegi2001 Since you seem to have access to the serial console: Have you tried this? xvzf/zyxel-gpon-sfp#19 (comment)

Thanks. I just read the procedure described in the link you sent me. I have no idea what "DNS:NET" is. Is it a device?

@Emmegi2001 The relevant part is:

I could set the speed back to the default values with
Hal# set speed default mode default

So just the way you set the speed to 2.5G, you should be able to set it back to the default 1G.

Yes, you're right. I know that command line, but I don't know how log in to the pmg3000-d20b via uart to enter that command line. Can you suggest which console or tool I should use?

@Emmegi2001 This is getting really off topic... I was under the impression you already had access to the serial console.

The module needs to be disassembled to access the serial interface and a USB-to-UART (3.3V) converter is required. Instructions are available on https://hack-gpon.org/ont-zyxel-pmg3000-d20b/.

Then you can use a tool like PuTTY to access it.

Perfect! Tks

Hi, everything is working now, and I even have a new firmware version, and the SFP performs better. I'm currently trying to follow the commands to create my firmware image file, but I don't know how to proceed:

How to: "Download flash dump from SFP"?

How to: "upload the file header to SFP"?

So i have this:

"can't open header: no such file or directory"

"can't open mtd2: no such file or directory"

Thanks for the firmware. Can someone explain to me what the difference between V1 00(ABVJ 1)b1e and V2 50(ABVJ 1)b1d is?
Looks like the V1 00(ABVJ 1)b1e is the latest version based on the date, but the has a lower Version Number than V2 50. Looks kind of weird to me. Any release notes available or suggestions ?