Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Creating image files for the Update Software feature in the Zyxel PMG3000-D20B web interface

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file (rename to 'header') and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

Firmware collection

Change extension to .zip and extract.
.img: raw mtd2 flash dump
.upf: with header

1.00 is based on OpenWrt 12.09. Deutsche Telekom (Germany) seems to stick with this branch.
2.50 is based on OpenWrt 14.07. Wind Tre (Italy) upgraded to this branch at the end of 2022.
Both branches are maintained separately, so a specific 1.00 image can have a later build date than a specific 2.50 image.

V1 00(ABVJ 0)b3s (2020-12-23)

V1 00(ABVJ 0)b3v (2021-05-08)

V1 00(ABVJ 1)b1e (2023-07-26)

V2 50(ABVJ 1)b1d (2023-04-21)

Please leave a comment if you have any other flash dumps.

@Emmegi2001 The relevant part is:

I could set the speed back to the default values with
Hal# set speed default mode default

So just the way you set the speed to 2.5G, you should be able to set it back to the default 1G.

Yes, you're right. I know that command line, but I don't know how log in to the pmg3000-d20b via uart to enter that command line. Can you suggest which console or tool I should use?

@Emmegi2001 This is getting really off topic... I was under the impression you already had access to the serial console.

The module needs to be disassembled to access the serial interface and a USB-to-UART (3.3V) converter is required. Instructions are available on https://hack-gpon.org/ont-zyxel-pmg3000-d20b/.

Then you can use a tool like PuTTY to access it.

Perfect! Tks

Hi, everything is working now, and I even have a new firmware version, and the SFP performs better. I'm currently trying to follow the commands to create my firmware image file, but I don't know how to proceed:

How to: "Download flash dump from SFP"?

How to: "upload the file header to SFP"?

So i have this:

"can't open header: no such file or directory"

"can't open mtd2: no such file or directory"

Thanks for the firmware. Can someone explain to me what the difference between V1 00(ABVJ 1)b1e and V2 50(ABVJ 1)b1d is?
Looks like the V1 00(ABVJ 1)b1e is the latest version based on the date, but the has a lower Version Number than V2 50. Looks kind of weird to me. Any release notes available or suggestions ?

@Emmegi2001 Are you trying to extract a firmware image from the module? Does it have a version which is not available in this gist? Which one?

@breaver See my comment here about the different versions: xvzf/zyxel-gpon-sfp#35 (comment)
Thanks for the question, I'll add this information to the gist.
I'm not aware of public release notes, but would definitely be interested if you find any.