Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
inbox:toh:zyxel:nbg7815_armor_g5 [2024/10/04 10:06] – wip pwnedinbox:toh:zyxel:nbg7815_armor_g5 [2024/10/31 16:08] – case pwned
Line 5: Line 5:
 {{media:zyxel:nbg7815:img_armor_ngb7815_t_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_r_01_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_t_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_r_01_600.png?350|Zyxel NBG7815 (Armor G5)}}
  
-[[https://www.zyxel.com/us/en-us/products/wifi-router/ax6000-12-stream-multi-gigabit-wifi-6-router-armor-g5|ZyXEL NBG7815 product page]] +[[https://www.zyxel.com/us/en-us/products/wifi-router/ax6000-12-stream-multi-gigabit-wifi-6-router-armor-g5|ZyXEL NBG7815 product page]]\\ 
-^+\\
  
 ===== Hardware ===== ===== Hardware =====
Line 31: Line 31:
 ^ PSU               | 19VDC 2.1A                                                              | ^ PSU               | 19VDC 2.1A                                                              |
 </hidden> </hidden>
-^+\\
  
 ===== OpenWrt Firmware ===== ===== OpenWrt Firmware =====
Line 53: Line 53:
 | [[https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb|openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb]] | | [[https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb|openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb]] |
 </hidden> </hidden>
-^+\\
  
 ===== Limitations ===== ===== Limitations =====
  
-Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED and Bluetooth.+Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED.
   * LED: [[https://github.com/openwrt/openwrt/pull/15504|PR 15504]]   * LED: [[https://github.com/openwrt/openwrt/pull/15504|PR 15504]]
   * FAN: [[https://github.com/openwrt/openwrt/pull/14210|PR 14210]]   * FAN: [[https://github.com/openwrt/openwrt/pull/14210|PR 14210]]
-  * Bluetooth: is not supported. Only the driver is loaded but there are not mappings for CSR-8811. 
   * 5G 160MHz channel width is not supported officially. There is [[https://forum.openwrt.org/t/qualcommax-nss-build/148529/3376|hack]] available. For those doing their own builds.   * 5G 160MHz channel width is not supported officially. There is [[https://forum.openwrt.org/t/qualcommax-nss-build/148529/3376|hack]] available. For those doing their own builds.
-:!: The device can really run hot due to the disabled fan leading to throttling and instabilities. Esp. if an USB device is connected. You be advised to either deploy an active cooler directed to the device itself or making your own build integrating the patch referenced above for proper cooling. To the state of 2024 this FAN patch is not working reliable. But there are others (simpler, script based) solutions available e. g.:  [[https://github.com/ddimension/openwrt/commit/4e4d1d2d8eaabc4dd0ee0b73b918a0504399977c|by ddimension]], [[https://github.com/psychowood/openwrt-armor-g5-nbg7815/commit/8ca55067afaf232c154238e0fffdda1e028ce57c|by psychowood]], [[https://github.com/pwned-pixel/nbg7815-fancontrol/commit/684928197983ca1920bbeae7fea8e9243855e365|by pwned-pixel]]. There are more available just ask/look within the [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|Forum Support Thread]] +:!: The device can **really run hot due to the disabled fan leading to throttling and instabilities**. Esp. if an USB device is connected. You be advised to either deploy an active cooler directed to the device itself or making your own build integrating the patch referenced above for proper cooling. To the state of 2024 this FAN patch is not working reliable. But there are others (simpler, script based) solutions available (which could disappear/change over time) e. g.: [[https://github.com/asvio/openwrt|by asvio]], [[https://github.com/ddimension/openwrt/commit/4e4d1d2d8eaabc4dd0ee0b73b918a0504399977c|by ddimension]], [[https://github.com/psychowood/openwrt-armor-g5-nbg7815/commit/8ca55067afaf232c154238e0fffdda1e028ce57c|by psychowood]], [[https://github.com/pwned-pixel/nbg7815-fancontrol/commit/684928197983ca1920bbeae7fea8e9243855e365|by pwned-pixel]]. There are more available just ask/look within the [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|Forum Support Thread]]\\ 
-^+\\
  
 ===== Forum Support Thread ===== ===== Forum Support Thread =====
  
-[[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|openwrt-support-for-armor-g5-nbg7815]] +[[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|openwrt-support-for-armor-g5-nbg7815]]\\ 
-^+\\
  
 ===== Installation ===== ===== Installation =====
Line 84: Line 83:
   - Reboot the device.   - Reboot the device.
   - Check if SSH access is working by using address: ''**192.168.123.1**'' / port: ''**22**'' / username: ''**root**'' / password: ''**OpenWrt**'' E. g. On a Linux Terminal: ''**ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null root@192.168.123.1 -p 22**'' using the password ''**OpenWrt**''   - Check if SSH access is working by using address: ''**192.168.123.1**'' / port: ''**22**'' / username: ''**root**'' / password: ''**OpenWrt**'' E. g. On a Linux Terminal: ''**ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null root@192.168.123.1 -p 22**'' using the password ''**OpenWrt**''
- 
 <tabbox Enable Root/SSH access> <tabbox Enable Root/SSH access>
 <code> <code>
Line 112: Line 110:
 </code> </code>
 </tabbox> </tabbox>
-^+\\ 
 + 
 +==== Backup ==== 
 + 
 +Before you modify the device it is always a good idea to make a backup of the flash drive(s) installed. The generic process is described [[:docs:guide-user:installation:generic.backup|here]].\\ 
 +We have one 8MB SPI NOR flash chip and one 4GB emmc flash chip. For both you can use dd. The partition layout of both chips is described [[#Flash-/Partition-Layout|here]].\\ 
 +You can spare out the last two big partitions on the emmc chip if you want. They are not important. Transfer the files either via USB or ssh/scp.\\ 
 +\\
  
 ==== Installing OpenWrt ==== ==== Installing OpenWrt ====
-:!: WIP use [[#Example 2|**Example 2**]] for now!+ 
 +:!: **Do not power off the device during the process!** 
   - Login as root via SSH.   - Login as root via SSH.
-  - Change to directory ''**cd /tmp/ApplicationData**'' +  - Change to directory ''**/tmp/ApplicationData**''. 
-  - Get the [[#OpenWrt Firmware|OpenWrt Firmware]] onto your router by either: +  - Get the [[#OpenWrt Firmware|OpenWrt Firmware]] onto your router by either a) or b):\\ a) The device to has internet access for downloading the OpenWrt firmware file to the device using wget.\\ b) Download the OpenWrt firmware to your computer and move the file to a FAT or NTFS formatted USB drive. Connect the USB drive to your router and mount the USB device. Copy the file to /tmp/ApplicationData.
-     The device to has internet access for downloading the OpenWrt firmware file to the device using wget. +
-     Download the OpenWrt firmware to your computer and move the file to a FAT or NTFS formatted USB drive. Connect the USB drive to your router and mount the USB device. Copy the file to /tmp/ApplicationData.+
   - Extract the firmware file.   - Extract the firmware file.
-  - Determine the bootconfig of the device+  - Determine the bootconfig of the device and flash OpenWrt to the currently not active kernel and rootfs partitions. 
-  - Flash OpenWrt to the currently not active kernel and rootfs partitions. +  - Mark the partitions to boot OpenWrt.
-  - Mark the partitions to boot OpenWrt. :!: This is the most dangerous part of this process. Do not power off the router under any circumstances!+
   - Reboot the device.   - Reboot the device.
  
-**__Example:__** In this example we download and install a snapshot build on the router.+<tabbox Semi-automatic (Step 2-7)><WRAP><code> 
 +cd /tmp/ApplicationData 
 +wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin 
 +wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh 
 +sh flash_to_openwrt.sh 
 +</code></WRAP> 
 + 
 +<tabbox Step 2-6><WRAP><code> 
 +# Author: Karol Przybylski <itor@o2.pl> 
 +# https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh
  
-<tabbox Step 2-4><WRAP><code>+Step 2
 cd /tmp/ApplicationData cd /tmp/ApplicationData
 +
 +# Step 3
 wget -O zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin wget -O zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin
 if [ ! -f "/tmp/ApplicationData/zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then if [ ! -f "/tmp/ApplicationData/zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then
Line 136: Line 151:
      exit 1      exit 1
 fi fi
 +
 +# Step 4
 tar xvf zyxel_nbg7815-squashfs-sysupgrade.bin tar xvf zyxel_nbg7815-squashfs-sysupgrade.bin
-</code></WRAP> 
-<tabbox Step 5><WRAP><code> 
-mtd_part_a=$(grep -i "\"0:bootconfig"\" /proc/mtd | awk -F: '{print $1}') 
-get_bootconfig=$(hexdump -v -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/"$mtd_part_a" | cut -f 1 -d "|" | head -n1) 
- 
- 
-</code></WRAP> 
-<tabbox Step 5><WRAP><code> 
- 
  
 +# Step 5
 +primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot)
 +if [ $primaryboot_hlos -eq 0 ]; then
 +     dd if=/dev/zero of=/dev/mmcblk0p7
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p7
 +     echo 1 > /proc/boot_info/0:HLOS/primaryboot
 +else
 +     dd if=/dev/zero of=/dev/mmcblk0p3
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p3
 +     echo 0 > /proc/boot_info/0:HLOS/primaryboot
 +fi
  
 +primaryboot_rootfs=$(cat /proc/boot_info/rootfs/primaryboot)
 +if [ $primaryboot_rootfs -eq 0 ]; then
 +     dd if=/dev/zero of=/dev/mmcblk0p8
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p8
 +     echo 1 > /proc/boot_info/rootfs/primaryboot
 +else
 +     dd if=/dev/zero of=/dev/mmcblk0p4
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p4
 +     echo 0 > /proc/boot_info/rootfs/primaryboot
 +fi
  
 +# Step 6
 +mkdir /tmp/ApplicationData/boot
 +cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin
 +echo 1 > /proc/mtd_writeable
 +dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null
 +dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null
 +echo 0 > /proc/mtd_writeable
 +sync
 </code></WRAP></tabbox> </code></WRAP></tabbox>
  
-**Example 2**: +:!For reference[[https://github.com/openwrt/openwrt/commit/5dee5965012e788f06e4d095e8cfb73200d818cb|initial commit nbg7815]]\\ 
-<code> +\\
-  root@NBG7815:~# cd /tmp/ApplicationData +
-  root@NBG7815:~# wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/ipq807x/generic/openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin +
-  root@NBG7815:~# wget https://raw.githubusercontent.com/itorK/nbg7815_tools/main/flash_to_openwrt.sh +
-  root@NBG7815:~# chmod 755 ./flash_to_openwrt +
-  root@NBG7815:~# ./flash_to_openwrt +
-  root@NBG7815:~# reboot +
-</code>+
  
 ===== Back to OEM firmware ===== ===== Back to OEM firmware =====
  
-OpenWrt is currently not using the dual partition layout writing the opposite/not active kernel/rootfs partitions during upgrade. So we can easy go back to OEM firmware by just setting the active kernel and rootfs partitions [[#Back to OEM firmware (1)|(1)]]. In case this changes in future or you have flashed the other partitions as well you can flash the OEM firmware with proper rootfs and kernel image too [[#Back to OEM firmware (2)|(2)]]. Another option would be using the [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] process from section [[#Debricking|Debricking]]. +OpenWrt is currently not using the dual partition layout writing the opposite/not active kernel/rootfs partitions during upgrade. So we can easy go back to OEM firmware by just setting the active kernel and rootfs partitions [[#Back to OEM firmware (1)|Back to OEM firmware (1)]]. In case this changes in future or you have flashed the other partitions as well you can flash the OEM firmware with proper rootfs and kernel image too [[#Back to OEM firmware (2)|Back to OEM firmware (2)]]. Another option would be using the [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] process from section [[#Debricking|Debricking]].\\  
-^+\\ 
 ==== Back to OEM firmware (1) ==== ==== Back to OEM firmware (1) ====
  
-  - Login via SSH to your router. +Be carefull with this process. :!: **Do not power off the device during the process!** 
-  - Change directory to /tmp + 
-  - Get script from to change partition with ''**wget https://github.com/itorK/nbg7815_tools/blob/main/change_boot_partition.sh**'' +  - Login via SSH to the router
-  - Execute the script with ''**sh change_boot_partition.sh**''+  - To use this method it is required to install kmod-mtd-rw first: ''**opkg update && opkg install kmod-mtd-rw**''
 +  - Change directory to /tmp. 
 +  - Copy & paste the code from script ''**Step 4**'' below. 
 +  - Execute the script with ''**sh change_boot_partition.sh**''
 +  - Reboot the device. 
 +  - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. 
 + 
 +<tabbox Step 4><WRAP><code> 
 +cat <<'EOF' > /tmp/change_boot_partition.sh 
 +# Script to changing active boot partitions  
 +# Author: Karol Przybylski <itor@o2.pl> 
 +# Orginal script: https://github.com/itorK/nbg7815_tools/blob/main/change_boot_partition.sh // It lacks the insmod mtd-rw i_want_a_brick=1 
 + 
 +openwrt_type=$(cat /etc/openwrt_release|grep DISTRIB_TARGET|cut -f 2 -d "'") 
 + 
 +if [ ${openwrt_type} == "ipq807x/generic" ]; then 
 +  echo "OpenWrt release" 
 +  boot_part=$(hexdump -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/mtd2|cut -f 1 -d "|"|head -n1) 
 + 
 +  dd if=/dev/mtd2 of=boot.bin bs=336 count=1 
 + 
 +  if [ ${boot_part} -eq 0 ]; then 
 +    printf '\x01| dd of=boot.bin bs=1 seek=168 count=1 conv=notrunc 
 +  else 
 +    printf '\x00| dd of=boot.bin bs=1 seek=168 count=1 conv=notrunc 
 + 
 +  fi 
 +  insmod mtd-rw i_want_a_brick=1 
 +  mtd write boot.bin /dev/mtd2 
 +  mtd write boot.bin /dev/mtd3 
 +fi 
 + 
 +if [ ${openwrt_type} == "ipq/ipq807x_64" ]; then 
 +  echo "Original Zyxel Firmware" 
 +  primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot) 
 +  if [ $primaryboot_hlos -eq 0 ]; then 
 +       echo 1 > /proc/boot_info/0:HLOS/primaryboot 
 +  else 
 +       echo 0 > /proc/boot_info/0:HLOS/primaryboot 
 +  fi 
 +   
 +  mkdir /tmp/ApplicationData/boot 
 +  cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin 
 +  echo 1 > /proc/mtd_writeable 
 +  dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null 
 +  dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null 
 +  echo 0 > /proc/mtd_writeable 
 +  sync 
 +fi 
 +EOF 
 +</code></WRAP></tabbox> 
 +\\
  
 ==== Back to OEM firmware (2) ==== ==== Back to OEM firmware (2) ====
 +
 +:!: Be carefull with this process. Make sure you write the correct images to the correct partitions! **Do not power off the device during the process!**
  
   - Download OEM firmware: [[#OEM firmware|see below]]   - Download OEM firmware: [[#OEM firmware|see below]]
   - Extract rootfs and kernel. Already extracted v8: [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel]], [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs]]   - Extract rootfs and kernel. Already extracted v8: [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel]], [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs]]
-  - Copy the files to the router into /tmp (e. g. with scpusb stick+  - Login via SSH to the router. 
-  - Flash kernel and rootfs to the device. +  - To use this method it is required to install kmod-mtd-rw first: ''**opkg update && opkg install kmod-mtd-rw**'' 
-  - Set active boot partition.+  - Copy the files to the router to /tmp (e. g. using scp or an usb drive). Rename them to ''**kernel**'' resp. ''**rootfs**''. 
 +  - Flash the kernel and rootfs to the currently not active partitions. Copy & paste the code from and execute the script with ''**sh flash_kernel_rootfs.sh**''.. 
 +  - Copy & paste the code from [[#Back to OEM firmware (1)|script Step 4]] from [[#Back to OEM firmware (1)|Back to OEM firmware (1)]] and execute the script with ''**sh change_boot_partition.sh**''
 +  - Reboot the device. 
 +  - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. 
 + 
 +<tabbox Step 6><WRAP><code> 
 +cat <<'EOF' > /tmp/flash_kernel_rootfs.sh 
 +# check files 
 + 
 +if [ ! -f "/tmp/rootfs" ]; then 
 +     echo "rootfs image" 
 +     exit 1 
 +fi 
 + 
 +if [ ! -f "/tmp/kernel" ]; then 
 +     echo "kernel image" 
 +     exit 1 
 +fi 
 + 
 +# get bootconfig 
 + 
 +mtd_part=$(grep -i "\"0:bootconfig"\" /proc/mtd | awk -F: '{print $1}'
 +bootconfig=$(hexdump -v -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/"$mtd_part" | cut -f 1 -d "|" | head -n1) 
 + 
 +# write rootfs and kernel; mmcblk0p3=0/mmcblk0p4=0 mmcblk0p7=1/mmcblk0p8=1 
 + 
 +if [ "${bootconfig}" -eq 1 ]; then 
 + dd if=/dev/zero of=/dev/mmcblk0p7 
 + dd if=/tmp/kernel of=/dev/mmcblk0p7 
 + dd if=/dev/zero of=/dev/mmcblk0p8 
 + dd if=/tmp/root of=/dev/mmcblk0p8 
 + sync 
 +fi 
 +if [ "${bootconfig}" -eq 0 ]; then 
 + dd if=/dev/zero of=/dev/mmcblk0p3 
 + dd if=/tmp/kernel of=/dev/mmcblk0p3 
 + dd if=/dev/zero of=/dev/mmcblk0p4 
 + dd if=/tmp/root of=/dev/mmcblk0p4 
 + sync 
 +fi 
 +EOF 
 +</code></WRAP></tabbox>\\
  
 ==== OEM firmware ==== ==== OEM firmware ====
  
-There are no public firmware files available for this cloud managed router. You can retrieve the firmware file by forcing a firmware upgrade and catching the temporary valid random cloudflare link by yourself. Firmware files version 6-8:+There is no official publicly available ressource to download the firmware files for this cloud managed router. You can retrieve the firmware file by forcing a firmware upgrade and catching the temporary valid random cloudflare link by yourself (this is limited to the latest firmware only). Firmware files version 6-8 were uploaded to mega.nz:
  
-^ Firmware/Link                                                                                       ^ sha256sum ^+^ Firmware                                                                                            ^ sha256sum ^
 | [[https://mega.nz/file/ptRilZZD#aGvqNpfj0mmSB-DEaE1gXEOZhE_k1FGkg6NR-ysn-90|V1.00(ABSK.8)C0.bin]] | ''1213e94cab334a9317ea405d95817255ba8970c3d2cd0fa4f16b92847ff8906c'' | | [[https://mega.nz/file/ptRilZZD#aGvqNpfj0mmSB-DEaE1gXEOZhE_k1FGkg6NR-ysn-90|V1.00(ABSK.8)C0.bin]] | ''1213e94cab334a9317ea405d95817255ba8970c3d2cd0fa4f16b92847ff8906c'' |
 | [[https://mega.nz/file/Ut51UZ4K#C16JLl2Yfw9Cn2cXOxnRvRVmPQIxXxa9YbgTWEMnYXg|V1.00(ABSK.7)C0.bin]] | ''3a6cd0a4a15fa88bfe4e05d77e562ccd6dfb9bc61994d411155d94710192a884'' | | [[https://mega.nz/file/Ut51UZ4K#C16JLl2Yfw9Cn2cXOxnRvRVmPQIxXxa9YbgTWEMnYXg|V1.00(ABSK.7)C0.bin]] | ''3a6cd0a4a15fa88bfe4e05d77e562ccd6dfb9bc61994d411155d94710192a884'' |
Line 191: Line 317:
 To get the rootfs and kernel image you have to extract them from the firmware file: rootfs=openwrt-ipq-ipq807x_64-squashfs-root.img, kernel=openwrt-ipq-ipq807x_64-qcom-ipq807x-zyxel-fit-uImage.itb.padded. To do so you would need a Linux machine with u-boot tools installed using dumpimage. Extracted rootfs and kernel for v8: To get the rootfs and kernel image you have to extract them from the firmware file: rootfs=openwrt-ipq-ipq807x_64-squashfs-root.img, kernel=openwrt-ipq-ipq807x_64-qcom-ipq807x-zyxel-fit-uImage.itb.padded. To do so you would need a Linux machine with u-boot tools installed using dumpimage. Extracted rootfs and kernel for v8:
  
 +^ Firmware                                                                                  ^ sha256sum ^
 | [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel_v8]] | ''9661a36422f357b3072ff5d1dd4e43c89410d8dd2267b343ca2e7f2cc608f6d3'' | | [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel_v8]] | ''9661a36422f357b3072ff5d1dd4e43c89410d8dd2267b343ca2e7f2cc608f6d3'' |
 | [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs_v8]] | ''cff590a82bb30ddced01e1d6514083519471aa4ca36e99a22d6fa74824075398'' | | [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs_v8]] | ''cff590a82bb30ddced01e1d6514083519471aa4ca36e99a22d6fa74824075398'' |
 +\\
  
 ===== Debricking ===== ===== Debricking =====
Line 202: Line 330:
 In case neither the **failsafe mode nor a factory reset** does bring back a working unit you can try to recover your device by the following steps: In case neither the **failsafe mode nor a factory reset** does bring back a working unit you can try to recover your device by the following steps:
  
-  - [[#Opening the case|Opening the device case]] +  - [[#Opening the case|Open the device case.]] 
-  - Access to the device via [[#serial|serial]] connection using a terminal application e. g. [[https://www.putty.org|putty]] and an USB to TTL/USB to Serial adapter. +  - Connect to the device via [[#serial|serial]] connection using a terminal application e. g. [[https://www.putty.org|putty]] and an USB to TTL/USB to Serial adapter. 
-  - [[#U-Boot access|Login to the device with full u-boot access]] +  - [[#Bootloader/U-Boot access|Access the device via bootloader.]] 
-  - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt+  - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt
 +\\
  
 ==== Opening the case ==== ==== Opening the case ====
  
-<WRAP BOX> +1. Remove the two rubber crosses from the device' bottom side. 
-FIXME //Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...// +2. Unscrew the two screws appearing after step 1. 
-</WRAP>+3. Remove the socket. 
 +4. After step 3. another four screws appear. Remove them as well. 
 +5. Around the device' case there are six clips* on the bottom case part inside and five on the uppper shell inside. 
 +6Keep the device with bottom side up and pry it up carefully around the case to remove the bottom sideStart at the side where the connectors are lead out. 
 + 
 +*) You will likely break some of them. Especially those on the left or right side. The clips at the front's case are very tight clipped because of the case' shape and the fact that they are four of them
 +\\
  
 ==== Serial ==== ==== Serial ====
  
-General information about the serial port and its usage: -> [[docs:techref:hardware:port.serial]]+General information about the serial port and its usage:  
 + 
 +  * -> [[docs:techref:hardware:port.serial]] 
 +  * -> [[docs:techref:hardware:port.serial|Serial Console]] 
 +  * -> [[docs:techref:hardware:port.serial.cables|Serial Cables]]
  
 Serial Port connectors of this specific device: Serial Port connectors of this specific device:
Line 222: Line 361:
  
 | Serial connection parameters | **TTL 115200, 8N1, 3.3V** | | Serial connection parameters | **TTL 115200, 8N1, 3.3V** |
-:!: Connect RX, TX, GND cable to your USB to TTL/USB to Serial adapter only! +:!: Connect RX, TX, GND cable to your USB to TTL/USB to Serial adapter only!\\ 
-^+\\
  
-==== U-Boot access ====+==== Bootloader/U-Boot access ====
  
-1. Connect the USB-to-serial adapter to the router and PC. Open up a serial console program.+  - Connect the USB-to-serial adapter to the router and PC. Open up a serial console program. 
 +  - Reboot the device and interrupt autoboot by pressing any key. You will end up with a shell prompt: ''**NBG7815>**''\\ \\ <code> 
 +Zyxel zloader v1.0.0 (2020-01-06 - 08:24)
  
-2. Reboot the device and interrupt autoboot by pressing any key 
- 
-<code> 
-Zyxel zloader v1.0.0 (2020-01-06 - 08:24) 
 Multiboot clinent version: 2.0 Multiboot clinent version: 2.0
 ipq807x_eth_halt: done ipq807x_eth_halt: done
Line 245: Line 382:
  
 **Hit any key to stop autoboot:  3** **Hit any key to stop autoboot:  3**
 +
 +NBG7815>
 </code> </code>
- +  - To get access to the bootloader you first need a seed/passcode. You will obtain it by typing ''**ATSE NBG7815**'' into the console prompt:\\ \\ <code>
-You will end up with a shell prompt: ''**NBG7815>**'' +
- +
-3. To get access to the bootloader you first need a seed/passcode. You will obtain it by typing ''**ATSE NBG7815**'' into the console prompt: +
-<code>+
 NBG7815> ATSE NBG7815 NBG7815> ATSE NBG7815
-</code+NBG7815> 013D72FF0710 
---> ''**013D72FF0710**'' +</code> ''**013D72FF0710**'' is the resulting seed/passcode :!: This seed/passcode is always different for each boot -> You have to do the same procedure on every reboot to access u-boot!\\  
- +  Generate the password:\\ \\ :!: **Do not enter the code below it into the current shell!** We have to open a new terminal application. We have distinguish here between Windows and Linux users!\\ \\ **__Linux__**: Copy and paste the code from below into a **newly** opened terminal. First use **calc script** and then **generate password** executing the script using the seed/passcode generated in section 3.\\ \\ **__Windows__** you can use [[https://mega.nz/file/sgZnnYoT#WYuFCmvTETYVr6j8vIZuVHC9rWVykBIBXOOWB3MFhfs|ZynPass]] to calculate the password.\\ \\ <tabbox calc script>
-:!: The resulting seed/passcode is always different for each boot -> You have to do the same procedure on every reboot to access u-boot! +
- +
-4. Generate the password: +
- +
-:!: **Do not enter the code below it into the current shell!** We have to distinguish here between Windows and Linux users! +
- +
-**__On Linux__**: Copy and paste the code from below into a **new terminal**. First use **create calc script** and then **generate passcode** using the code generated in section 3. +
- +
-<tabbox create calc script>+
 <code> <code>
-cat <<EOF> tool.sh+cat <<'EOF> tool.sh
 ror32() { ror32() {
   echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))   echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
Line 277: Line 403:
 EOF EOF
 </code> </code>
-<tabbox generate passcode> +<tabbox password>
-<code> +
-sh tool.sh **013D72FF0710** +
-</code> +
-</tabbox> +
- +
-**__On Windows__** you can use [[https://mega.nz/file/sgZnnYoT#WYuFCmvTETYVr6j8vIZuVHC9rWVykBIBXOOWB3MFhfs|ZynPass]] to calculate the password+
- +
---''**ATEN 1,10F0A563**'' +
- +
-5. Put the output from above in terminal and press enter+
 <code> <code>
 +sh tool.sh 013D72FF0710
 +</code></tabbox> The resulting password looks like: ''**ATEN 1,10F0A563**''
 +  - Put the output from paragraph 4. in the terminal and press enter:\\ \\ <code>
 NBG7815> ATEN 1,10F0A563 NBG7815> ATEN 1,10F0A563
 </code> </code>
 +  -  Now Enter ''ATGU'' for full u-boot access. You will end up with a new prompt: ''**ZYXEL#**''\\ \\ <code>
 +NBG7815> ATGU
  
-6. Now Enter ''ATGU'' for full u-boot access +ZYXEL#
-<code> +
-NBG7815> ATGU+
 </code> </code>
-You will end up with a new prompt: --> ''**ZYXEL#**'' +\\ 
-+
-==== TFTP flash OEM firmware ==== +
- +
-**Hard debricking from U-boot with Serial Access:** +
- +
-1. Get orginal firmware [[https://d3jal3boi407dg.cloudfront.net/mycloud/nbg7815/latest_firmware_info/s3_file/1634698613953/V1.00(ABSK.7)C0.bin|V1.00(ABSK.7)C0.bin]] +
- +
-2. Setup your laptop to 192.168.1.99 +
- +
-3. install and configure TFTP server, connect your laptop by cable, turn off windows firewall +
- +
-4. Interrupt autoboot and execute command (no need unlock): +
- +
-    NBG7815> ATUR V1.00(ABSK.7)C0.bin+
  
 ==== TFTP boot OpenWrt ==== ==== TFTP boot OpenWrt ====
  
-**Alternatively, you may recover the device with OpenWrt initramfs:**+  - Download **[[#OpenWrt Firmware|OpenWrt Firmware/Other images (factoryinitramfs)]]** choosing an itb firmware file. 
 +  - Setup your PC/Workstation assigning the static IP 192.168.1.99. 
 +  - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). 
 +  - Connect your PC/Workstation via LAN cable to the router. 
 +  - Power up your router and get access to [[#Bootloader/U-Boot access|u-boot]] as describe above. Step 1-6 reaching ''ZYXEL#'' prompt. 
 +  - Enter ''tftpboot'' and the name of firmware file e. g. ''openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb'': <code>ZYXEL# tftpboot openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb</code> 
 +  - After the file is uploaded (this takes a while) you may proceed with entering ''bootm'' into the shell: <code>ZYXEL# bootm</code> 
 +  - If OpenWrt is up you can try to fix your issues. E. g. fixing wrong config preventing booting the device, reinstall OpenWrt using sysupgrade, reinstall OpenWrt as described [[#Installing OpenWrt|here]] or install OEM firmware like [[#Back to OEM firmware|here]]. 
 +\\ 
  
-1. Stop the bootloader by pressing any key. Once you're presented with the ''NBG7815>'' prompt, +==== TFTP flash OEM firmware ====
-unlock the bootloader via the ''tool.sh'' script as detailed in the +
-[[:inbox:toh:zyxel:nbg7815_armor_g5#full_u-boot_access|Full U-boot access section]].+
  
-2. Connect to one of the //lan// Ethernet interfaces of the device, +  - Download the **[[#OEM firmware|OEM firmware]]**. 
-and configure your host computer to have static 192.168.1.99/24 Legacy IP address.+  - Setup your PC/Workstation assigning the static IP 192.168.1.99
 +  - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). 
 +  - Connect your PC/Workstation via LAN cable to the router. 
 +  - Power up your router and get access to [[#Bootloader/U-Boot access|u-boot]] as describe above. Step 1-2 is enough (no need unlock). 
 +  - Enter ''ATUR'' and the name of the downloaded firmware file e. g. ''ATUR V1.00(ABSK.8)C0.bin'': <code>NBG7815> ATUR V1.00(ABSK.8)C0.bin</code> :!: **Do not power off the device during the process!**\\ 
  
-3. Start a TFTP server in a directory where you downloaded (or built) a (possibly known-good) +===== Photos =====
-''openwrt-ipq807x-generic-zyxel_nbg7815-initramfs-uImage.itb'' file. +
- +
-4. Once presented with the ''ZYXEL#'' proompt, issue the following command: +
-  tftpboot openwrt-ipq807x-generic-zyxel_nbg7815-initramfs-uImage.itb +
-If the download was successful, you can proceed; otherwise, check your setup. +
- +
-5. Boot the initramfs: +
-  bootm +
- +
-6. If you didn't alter vendor eMMC partition table, skip to the next step. If you did, you need to +
-  opkg update && opkg install fdisk +
-and then use fdisk manually to create GPT matching +
-[[:inbox:toh:zyxel:nbg7815_armor_g5#emmc_partition_table|vendor partition table]]. +
- +
-7. If all went well, you should be in OpenWrt now; you may +
-  sysupgrade -n /tmp/openwrt... +
-to a working sysupgrade image. In no case you should use any force option. +
- +
-===== Notes ===== +
-Code of flash_to_openwrt.sh Script: +
-<code> +
-# Author: Karol Przybylski <itor@o2.pl> +
- +
-if [ ! -f "openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then +
-     echo "Cannot find image openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin" +
-     exit 1 +
-fi +
- +
-tar xvf ./openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin +
- +
-primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot) +
-if [ $primaryboot_hlos -eq 0 ]; then +
-     dd if=/dev/zero of=/dev/mmcblk0p7 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p7 +
-     echo 1 > /proc/boot_info/0:HLOS/primaryboot +
-else +
-     dd if=/dev/zero of=/dev/mmcblk0p3 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p3 +
-     echo 0 > /proc/boot_info/0:HLOS/primaryboot +
-fi +
- +
-primaryboot_rootfs=$(cat /proc/boot_info/rootfs/primaryboot) +
-if [ $primaryboot_rootfs -eq 0 ]; then +
-     dd if=/dev/zero of=/dev/mmcblk0p8 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p8 +
-     echo 1 > /proc/boot_info/rootfs/primaryboot +
-else +
-     dd if=/dev/zero of=/dev/mmcblk0p4 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p4 +
-     echo 0 > /proc/boot_info/rootfs/primaryboot +
-fi +
- +
- +
-mkdir /tmp/ApplicationData/boot +
-cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin +
-echo 1 > /proc/mtd_writeable +
-dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null +
-dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null +
-echo 0 > /proc/mtd_writeable +
-sync +
-reboot +
-</code>+
  
-==== Photos ====+{{media:zyxel:zyxel_nbg7815_pcb_1_.jpg?250|Zyxel NBG7815 (Armor G5) PCB (1)}} {{media:zyxel:zyxel_nbg7815_pcb_2.jpg?250|Zyxel NBG7815 (Armor G5) PCB (2)}}\\ 
 +\\
  
-{{media:zyxel:zyxel_nbg7815_pcb_1_.jpg?250|Zyxel NBG7815 (Armor G5) PCB (1)}} {{media:zyxel:zyxel_nbg7815_pcb_2.jpg?250|Zyxel NBG7815 (Armor G5) PCB (2)}} +===== Flash-/Partition-Layout =====
-+
-==== Flash-/Partition-Layout =====+
  
 <tabbox 8MB SPI NOR><WRAP><code> <tabbox 8MB SPI NOR><WRAP><code>
Line 483: Line 535:
   10          307234         1355809   512.0 MiB   FFFF  nbg   10          307234         1355809   512.0 MiB   FFFF  nbg
   11         1355810         7122977   2.8 GiB     FFFF  appdata   11         1355810         7122977   2.8 GiB     FFFF  appdata
-</code></WRAP></tabbox>+</code></WRAP></tabbox>\\ 
 +\\
  
 ===== Bootlogs ===== ===== Bootlogs =====
  • Last modified: 2024/12/13 12:10
  • by pwned