Skip to content

Instantly share code, notes, and snippets.

@maurice-w
Last active August 16, 2025 02:52
Show Gist options
  • Save maurice-w/faeb60bf8201ce70391873bcb9059bc2 to your computer and use it in GitHub Desktop.
Save maurice-w/faeb60bf8201ce70391873bcb9059bc2 to your computer and use it in GitHub Desktop.
Zyxel PMG3000-D20B firmware image files

Creating image files for the Update Software feature in the Zyxel PMG3000-D20B web interface

image

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file (rename to 'header') and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

Firmware collection

Change extension to .zip and extract.
.img: raw mtd2 flash dump
.upf: with header

1.00 is based on OpenWrt 12.09. Deutsche Telekom (Germany) seems to stick with this branch.
2.50 is based on OpenWrt 14.07. Wind Tre (Italy) upgraded to this branch at the end of 2022.
Both branches are maintained separately, so a specific 1.00 image can have a later build date than a specific 2.50 image.

V1 00(ABVJ 0)b3s (2020-12-23)

V1 00(ABVJ 0)b3v (2021-05-08)

V1 00(ABVJ 1)b1e (2023-07-26)

V2 50(ABVJ 1)b1d (2023-04-21)

Please leave a comment if you have any other flash dumps.

@Emmegi2001
Copy link

Hi, everything is working now, and I even have a new firmware version, and the SFP performs better. I'm currently trying to follow the commands to create my firmware image file, but I don't know how to proceed:

How to: "Download flash dump from SFP"?

How to: "upload the file header to SFP"?

So i have this:

"can't open header: no such file or directory"

"can't open mtd2: no such file or directory"

@breaver
Copy link

breaver commented Aug 15, 2025

Thanks for the firmware. Can someone explain to me what the difference between V1 00(ABVJ 1)b1e and V2 50(ABVJ 1)b1d is?
Looks like the V1 00(ABVJ 1)b1e is the latest version based on the date, but the has a lower Version Number than V2 50. Looks kind of weird to me. Any release notes available or suggestions ?

@maurice-w
Copy link
Author

@Emmegi2001 Are you trying to extract a firmware image from the module? Does it have a version which is not available in this gist? Which one?

@breaver See my comment here about the different versions: xvzf/zyxel-gpon-sfp#35 (comment)
Thanks for the question, I'll add this information to the gist.
I'm not aware of public release notes, but would definitely be interested if you find any.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment