Looking for Flash dump from Zyxel devices

[highland]

Hi all,

I'm looking for flash dumps for my following bricked Zyxel devices;

XMG3927-B50* (also accepted alternatives VMG3927-B50* and VMG8825-B50*)

and also,

VMG3925-B10*

Thanks in advance for all your support.


...

[stj]

Re: Looking for Flash dump from Zyxel devices

"The Zyxel XMG3927-B Series supports TR-69 that simplifies remote configuration, upgrade and management and therefore improves cost effectiveness and customer satisfaction. Additional support to the latest TR-181 issue-2 data model also enhances service providers’ visibility on subscriber LAN networks"
backdoor infested junk - what isp supplied that unit??

[highland]

Re: Looking for Flash dump from Zyxel devices

backdoor infested junk - what isp supplied that unit??

From 'Elisa', FIN.
It boots but it can't find config file and reboots. That zcfg_config file is missing. Can't update or upgrade via serial connection either. Perhaps, only option is to get a full flash dump and rewrite the nand.

[stj]

Re: Looking for Flash dump from Zyxel devices

it probably has a serial port on the board, so you could get in with that.
but you really need to convert it to openWRT or atleast cross-flash it to whatever the model was that was sold direct to the public without isp specific locks in it.

[highland]

Re: Looking for Flash dump from Zyxel devices

it probably has a serial port on the board, so you could get in with that.
but you really need to convert it to openWRT or atleast cross-flash it to whatever the model was that was sold direct to the public without isp specific locks in it.

I've serial access to the device. The CFE is locked with new algorithm, which is different to known old algorithm. Thus, I can't enable 'BootExtension Debug Flag' to flash vanilla/generic firmware either. I know, some UK ISPs devices are not CFE locked and can be flashed to get rid of ISP traps.

[stj]

Re: Looking for Flash dump from Zyxel devices

is the flash bga or something socketable?

or is there an identifiable jtag port?

[highland]

Re: Looking for Flash dump from Zyxel devices

is the flash bga or something socketable?

or is there an identifiable jtag port?

It is ESMT F59L2G81A, TSOP48. I've RT809H to flash the nand.

Not identifiable JTAG port.

[stj]

Re: Looking for Flash dump from Zyxel devices

o.k. try to find out what other model numbers are the same pcb.
is it marked on the pcb?

[highland]

Re: Looking for Flash dump from Zyxel devices

o.k. try to find out what other model numbers are the same pcb.
is it marked on the pcb?

Not much idea about which other models share the same pcb, but I was confirmed that vmg3927-B50* and vmg8825-B50* also share the same bootloader as of xmg3927-B50*.

[SMDFlea]

Re: Looking for Flash dump from Zyxel devices

Not much idea about which other models share the same pcb, but I was confirmed that vmg3927-B50* and vmg8825-B50* also share the same bootloader as of xmg3927-B50*.

might help - https://forum.kitz.co.uk/index.php/topic,23648.60.html

[highland]

Re: Looking for Flash dump from Zyxel devices

might help - https://forum.kitz.co.uk/index.php/topic,23648.60.html

Thank you for the link. The device's CFE Bootloader is locked thus I can't enable 'BootExtension Debug Flag' to be able to flash via serial/UART connection either. I need to reflash the NAND with an external programmer to unbrick it. I was hoping to get a complete NAND FLASH DUMP from any device similar or same as KCOM.

[lilos]

Hi guys
I need a working 2MB SPI flash dump for a 2.5G switch Zyxel MG 108 rev B1
The original Macronix chip was acting up and data layout in parameter section got corrupted but the chip itself is actually fine because it programs normally now in NeoProgrammer
My hardware is 100 percent ok all rails are perfect Core VCC is 1 14V AVDD analog is 0 95V and IO lines are 3 3V LED shift registers show no shorts on megaohms
When I flash the original backup onto the chip the CPU boots up and prints this via UART 115200:
uart init ---------------- done
flash driver init ------- done
Right after flash driver init the CPU pulls Pin 1 CS high to 3 3V and halts completely because of a configuration error or checksum block mismatch No LEDs flash on front panel and Windows shows unidentified network
Board markings and info:
Board PCB: 270 NB1 MS208A004B1 REV B1 (Platform MS208A)
CPU: Realtek RTL8373
PHY: Realtek RTL8224
PN: 951 ZY0 MS208A00B00 / 961 ZYO MS208A00B00
SN: S224348002043
I tried alternative firmware like RTLPlayground but it crashes immediately at address 0x000000 because of different boot ROM header alignment in this specific Zyxel B1 revision
If anyone has a working original bin backup from a working donor board please upload it here
I am attaching my original corrupted dump just in case someone can fix the parameter block layout in hex
Thanks in advance for any help

---

[lilos]

Hi I need also full dump for zyxelxgs1210-12 rev B1 or at least orginal U-boot if anyone can upload would be great.