Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Creating image files for the Update Software feature in the Zyxel PMG3000-D20B web interface

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file (rename to 'header') and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

Firmware collection

Change extension to .zip and extract.
.img: raw mtd2 flash dump
.upf: with header

V1 00(ABVJ 0)b3s (2020-12-23)

V1 00(ABVJ 0)b3v (2021-05-08)

V1 00(ABVJ 1)b1e (2023-07-26)

V2 50(ABVJ 1)b1d (2023-04-21)

Please leave a comment if you have any other flash dumps.

@Emmegi2001 This is getting really off topic... I was under the impression you already had access to the serial console.

The module needs to be disassembled to access the serial interface and a USB-to-UART (3.3V) converter is required. Instructions are available on https://hack-gpon.org/ont-zyxel-pmg3000-d20b/.

Then you can use a tool like PuTTY to access it.

Perfect! Tks

Hi, everything is working now, and I even have a new firmware version, and the SFP performs better. I'm currently trying to follow the commands to create my firmware image file, but I don't know how to proceed:

How to: "Download flash dump from SFP"?

How to: "upload the file header to SFP"?

So i have this:

"can't open header: no such file or directory"

"can't open mtd2: no such file or directory"

Thanks for the firmware. Can someone explain to me what the difference between V1 00(ABVJ 1)b1e and V2 50(ABVJ 1)b1d is?
Looks like the V1 00(ABVJ 1)b1e is the latest version based on the date, but the has a lower Version Number than V2 50. Looks kind of weird to me. Any release notes available or suggestions ?