Looking for Flash dump from Zyxel devices

[highland]

Hi all,

I'm looking for flash dumps for my following bricked Zyxel devices;

XMG3927-B50* (also accepted alternatives VMG3927-B50* and VMG8825-B50*)

and also,

VMG3925-B10*

Thanks in advance for all your support.


...

[stj]

"The Zyxel XMG3927-B Series supports TR-69 that simplifies remote configuration, upgrade and management and therefore improves cost effectiveness and customer satisfaction. Additional support to the latest TR-181 issue-2 data model also enhances service providers’ visibility on subscriber LAN networks"
backdoor infested junk - what isp supplied that unit??

[highland]

Originally Posted by stj

backdoor infested junk - what isp supplied that unit??

From 'Elisa', FIN.
It boots but it can't find config file and reboots. That zcfg_config file is missing. Can't update or upgrade via serial connection either. Perhaps, only option is to get a full flash dump and rewrite the nand.

[stj]

it probably has a serial port on the board, so you could get in with that.
but you really need to convert it to openWRT or atleast cross-flash it to whatever the model was that was sold direct to the public without isp specific locks in it.

[highland]

Originally Posted by stj

it probably has a serial port on the board, so you could get in with that.
but you really need to convert it to openWRT or atleast cross-flash it to whatever the model was that was sold direct to the public without isp specific locks in it.

I've serial access to the device. The CFE is locked with new algorithm, which is different to known old algorithm. Thus, I can't enable 'BootExtension Debug Flag' to flash vanilla/generic firmware either. I know, some UK ISPs devices are not CFE locked and can be flashed to get rid of ISP traps.

[stj]

is the flash bga or something socketable?

or is there an identifiable jtag port?

[highland]

Originally Posted by stj

is the flash bga or something socketable?

or is there an identifiable jtag port?

It is ESMT F59L2G81A, TSOP48. I've RT809H to flash the nand.

Not identifiable JTAG port.

[stj]

o.k. try to find out what other model numbers are the same pcb.
is it marked on the pcb?

[highland]

Originally Posted by stj

o.k. try to find out what other model numbers are the same pcb.
is it marked on the pcb?

Not much idea about which other models share the same pcb, but I was confirmed that vmg3927-B50* and vmg8825-B50* also share the same bootloader as of xmg3927-B50*.

[SMDFlea]

Originally Posted by highland

Not much idea about which other models share the same pcb, but I was confirmed that vmg3927-B50* and vmg8825-B50* also share the same bootloader as of xmg3927-B50*.

might help - https://forum.kitz.co.uk/index.php/topic,23648.60.html

[highland]

Originally Posted by SMDFlea

might help - https://forum.kitz.co.uk/index.php/topic,23648.60.html

Thank you for the link. The device's CFE Bootloader is locked thus I can't enable 'BootExtension Debug Flag' to be able to flash via serial/UART connection either. I need to reflash the NAND with an external programmer to unbrick it. I was hoping to get a complete NAND FLASH DUMP from any device similar or same as KCOM.