Looking for Flash dump from Zyxel devices

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • highland
    New Member
    • Aug 2020
    • 7
    • UK

    #1

    Looking for Flash dump from Zyxel devices

    Hi all,

    I'm looking for flash dumps for my following bricked Zyxel devices;

    XMG3927-B50* (also accepted alternatives VMG3927-B50* and VMG8825-B50*)

    and also,

    VMG3925-B10*

    Thanks in advance for all your support.


    ...
  • stj
    Great Sage 齊天大聖
    • Dec 2009
    • 30950
    • Albion

    #2
    Re: Looking for Flash dump from Zyxel devices

    "The Zyxel XMG3927-B Series supports TR-69 that simplifies remote configuration, upgrade and management and therefore improves cost effectiveness and customer satisfaction. Additional support to the latest TR-181 issue-2 data model also enhances service providers’ visibility on subscriber LAN networks"
    backdoor infested junk - what isp supplied that unit??

    Comment

    • highland
      New Member
      • Aug 2020
      • 7
      • UK

      #3
      Re: Looking for Flash dump from Zyxel devices

      Originally posted by stj
      backdoor infested junk - what isp supplied that unit??
      From 'Elisa', FIN.
      It boots but it can't find config file and reboots. That zcfg_config file is missing. Can't update or upgrade via serial connection either. Perhaps, only option is to get a full flash dump and rewrite the nand.

      Comment

      • stj
        Great Sage 齊天大聖
        • Dec 2009
        • 30950
        • Albion

        #4
        Re: Looking for Flash dump from Zyxel devices

        it probably has a serial port on the board, so you could get in with that.
        but you really need to convert it to openWRT or atleast cross-flash it to whatever the model was that was sold direct to the public without isp specific locks in it.

        Comment

        • highland
          New Member
          • Aug 2020
          • 7
          • UK

          #5
          Re: Looking for Flash dump from Zyxel devices

          Originally posted by stj
          it probably has a serial port on the board, so you could get in with that.
          but you really need to convert it to openWRT or atleast cross-flash it to whatever the model was that was sold direct to the public without isp specific locks in it.
          I've serial access to the device. The CFE is locked with new algorithm, which is different to known old algorithm. Thus, I can't enable 'BootExtension Debug Flag' to flash vanilla/generic firmware either. I know, some UK ISPs devices are not CFE locked and can be flashed to get rid of ISP traps.

          Comment

          • stj
            Great Sage 齊天大聖
            • Dec 2009
            • 30950
            • Albion

            #6
            Re: Looking for Flash dump from Zyxel devices

            is the flash bga or something socketable?

            or is there an identifiable jtag port?

            Comment

            • highland
              New Member
              • Aug 2020
              • 7
              • UK

              #7
              Re: Looking for Flash dump from Zyxel devices

              Originally posted by stj
              is the flash bga or something socketable?

              or is there an identifiable jtag port?
              It is ESMT F59L2G81A, TSOP48. I've RT809H to flash the nand.

              Not identifiable JTAG port.

              Comment

              • stj
                Great Sage 齊天大聖
                • Dec 2009
                • 30950
                • Albion

                #8
                Re: Looking for Flash dump from Zyxel devices

                o.k. try to find out what other model numbers are the same pcb.
                is it marked on the pcb?

                Comment

                • highland
                  New Member
                  • Aug 2020
                  • 7
                  • UK

                  #9
                  Re: Looking for Flash dump from Zyxel devices

                  Originally posted by stj
                  o.k. try to find out what other model numbers are the same pcb.
                  is it marked on the pcb?
                  Not much idea about which other models share the same pcb, but I was confirmed that vmg3927-B50* and vmg8825-B50* also share the same bootloader as of xmg3927-B50*.

                  Comment

                  • SMDFlea
                    Super Moderator
                    • Jan 2018
                    • 20453
                    • UK

                    #10
                    Re: Looking for Flash dump from Zyxel devices

                    Originally posted by highland
                    Not much idea about which other models share the same pcb, but I was confirmed that vmg3927-B50* and vmg8825-B50* also share the same bootloader as of xmg3927-B50*.
                    might help - https://forum.kitz.co.uk/index.php/topic,23648.60.html
                    All donations to badcaps are welcome, click on this link to donate. Thanks to all supporters

                    Comment

                    • highland
                      New Member
                      • Aug 2020
                      • 7
                      • UK

                      #11
                      Re: Looking for Flash dump from Zyxel devices

                      Originally posted by SMDFlea
                      Thank you for the link. The device's CFE Bootloader is locked thus I can't enable 'BootExtension Debug Flag' to be able to flash via serial/UART connection either. I need to reflash the NAND with an external programmer to unbrick it. I was hoping to get a complete NAND FLASH DUMP from any device similar or same as KCOM.

                      Comment

                      Related Topics

                      Collapse

                      • kooroshi60
                        Traktor Kontrol S4 MK1 Flash dump
                        by kooroshi60
                        Hi guys
                        I need the Flash Dump (.bin) file of the Traktor Kontrol S4 MK1. SPI chip number is 25DF041A from Atmel (4Mbit)
                        So please let me know if you have the .BIN Dump of this model and its price and the payment method.
                        I appreciate your help.
                        10-01-2024, 10:17 AM
                      • bamdad61
                        Canon DR-1210C flash dump request
                        by bamdad61
                        Dear folks, recently got a canon dr-1210c and it worked perfectly just for one day. Right now it shows all possible errors on the screen and do nothing. I tear down the device and found a 32 pin plcc flash chip. I thought reprogramming firmware might be helpful. The firmware update file from canon support include a dll file which doesn't help. So if anyone has the dump it would such a great favor to share.
                        04-15-2025, 02:43 PM
                      • corrize
                        Nikon D800 camera - flash don’t work and capacitor don’t charge
                        by corrize
                        Hello, I'm stuck in troubleshooting…
                        The flash system works like that : when the (mechanic) flash button is pressed, the flash mecanically pop up, and a circuit buck boost elevate 7v (batt) to 200-300v (?) for charging the big capacitor. And when the photo shoot button is pressed, the capacitor is discharged in the xeon light.

                        In the D800, there is a first « power board » close to the battery. 2 wires (batt 7v) goes to another little « flash board ». I measured 7v, so ok.
                        When I press the flash button, it's detected by the system, flash icon appear on LDC display....
                        10-01-2022, 10:02 AM
                      • numerlor
                        lenovo P720 SIO flash dump
                        by numerlor
                        Hi, the SIO firmware flash in my lenovo P720 seems to be corrupted, after a reboot POST fails with CPU1 fan failure and all fans set to max, proceeding with booting shows SIO FW no response.

                        I've tried using the lenovo sio update utility but that fails with "EC Autho Value not Match" when the system reboots for the update. The efi update tools has a S04FW.cap file but it's 256kb which seems too small?

                        S/N S4PD6489...
                        06-23-2025, 01:22 AM
                      • bestrafer
                        Lenovo L460 LAN issue after BIOS dump flash
                        by bestrafer
                        Hello everyone.

                        I have L460 Type 20FV (2 X 8MB bios chips) with no boot issue after BIOS update (black screen with restarts, common issue on this model + BIOS update).

                        BIOS dump(s) from this post https://www.badcaps.net/forum/showpo...7&postcount=27 makes the laptop boot absolutely fine, no delays, etc..

                        But there is an exclamation mark in the device manager for the LAN card right after fresh OS installation - LAN naturally doesn't work. I saw requests like "BIOS: fix LAN" on other sites.
                        Could someone point on a direction...
                        01-31-2023, 01:14 PM
                      • Loading...
                      • No more items.
                      Working...