Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
Next revisionBoth sides next revision
inbox:toh:zyxel:nbg7815_armor_g5 [2024/10/04 11:29] – wip pwnedinbox:toh:zyxel:nbg7815_armor_g5 [2024/12/13 11:35] – [Hardware] pwned
Line 5: Line 5:
 {{media:zyxel:nbg7815:img_armor_ngb7815_t_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_r_01_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_t_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_r_01_600.png?350|Zyxel NBG7815 (Armor G5)}}
  
-[[https://www.zyxel.com/us/en-us/products/wifi-router/ax6000-12-stream-multi-gigabit-wifi-6-router-armor-g5|ZyXEL NBG7815 product page]] +[[https://www.zyxel.com/us/en-us/products/wifi-router/ax6000-12-stream-multi-gigabit-wifi-6-router-armor-g5|ZyXEL NBG7815 product page]]\\ 
-^+\\
  
 ===== Hardware ===== ===== Hardware =====
  
-^ CPU                           ^ Ram  ^ Flash                    ^ Network                                 ^ Wifi          ^ USB         ^ Serial ^ +^ Architecture        | ARMv8                                                                   | 
-| Qualcomm IPQ8074A @ 2.2 GHz | 1 GB | 4 GB eMMC + 8 MB SPI NOR | 1x 1/2.5/5/10 GbE 1x 1/2.5 GbE 4x 1 GbE | a/b/g/n/ac/ax | 1x 3.1 Gen2 | [[#Serial|Yes]] | +^ Vendor              | Qualcomm                                                                | 
-<hidden> +^ Bootloader          | U-Boot + ZyXEL zLoader                                                  | 
-^ Architecture      | ARMv8                                                                   | +^ System-On-Chip      | Qualcomm IPQ8074A                                                       | 
-^ Vendor            | Qualcomm                                                                | +^ CPU/Speed           | Quad Core 2.2 GHz                                                       | 
-^ Bootloader        | U-Boot + ZyXEL zLoader                                                  | +^ Flash-Chip          | Kingston EMMC04G-M627 + Winbond W25Q64DW                                | 
-^ System-On-Chip    | Qualcomm IPQ8074A                                                       | +^ Flash size          | 4 GB eMMC + 8 MB SPI NOR                                                | 
-^ CPU/Speed         | Quad Core 2.2 GHz                                                       | +^ RAM                 | 1 GB 2x Nanya NT5CC256M16ER-EK                                          | 
-^ Flash-Chip        | Kingston EMMC04G-M627 + Winbond W25Q64DW                                | +^ Bluetooth           | CSR8811 using HSUART                                                    | 
-^ Flash size        | 4 GB eMMC + 8 MB SPI NOR                                                | +^ Wireless            | QCN5024 bgn+ax                                                          | 
-^ RAM               | 1 GB 2x Nanya NT5CC256M16ER-EK                                          | +^ Wireless            | QCN5054 an+ac+ax                                                        | 
-^ Bluetooth         | CSR8811 using HSUART                                                    | +^ Ethernet            | 4x 10/100/1000 Mbps + 1x 1/2.5 GbE + 1x 1/2.5/5/10 GbE                  | 
-^ Wireless          | QCN5024 bgn+ax                                                          | +^ Ethernet            | ETH chip1: IPQ8074A + ETH chip2: QCA8081 + ETH chip3: Aquantia AQR113C 
-^ Wireless          | QCN5054 an+ac+ax                                                        | +^ Switch              | Qualcomm Atheros QCA8075                                                | 
-^ Ethernet          | 4x 10/100/1000 Mbps + 1x 1/2.5 GbE + 1x 1/2.5/5/10 GbE                  | +^ USB                 | 1x 3.1 Gen2, 5V/900mA                                                   
-^ Ethernet          | ETH chip1: IPQ8074A + ETH chip2: QCA8081 + ETH chip3: Aquantia AQR113C +^ [[#Serial|Serial]]  | TTL 115200, 8N1, 3.3V                                                   | 
-^ Switch            | Qualcomm Atheros QCA8075                                                | +^ PSU                 | 19VDC 2.1A                                                              | 
-^ USB               | 1x 3.1 Gen2                                                             +\\
-^ [[#Serial|Serial]]| TTL 115200, 8N1, 3.3V                                                   | +
-^ PSU               | 19VDC 2.1A                                                              | +
-</hidden> +
-^+
  
 ===== OpenWrt Firmware ===== ===== OpenWrt Firmware =====
Line 53: Line 49:
 | [[https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb|openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb]] | | [[https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb|openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb]] |
 </hidden> </hidden>
-^+\\
  
 ===== Limitations ===== ===== Limitations =====
  
-Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED and Bluetooth.+Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED.
   * LED: [[https://github.com/openwrt/openwrt/pull/15504|PR 15504]]   * LED: [[https://github.com/openwrt/openwrt/pull/15504|PR 15504]]
   * FAN: [[https://github.com/openwrt/openwrt/pull/14210|PR 14210]]   * FAN: [[https://github.com/openwrt/openwrt/pull/14210|PR 14210]]
-  * Bluetooth: is not supported. Only the driver is loaded but there are not mappings for CSR-8811. 
   * 5G 160MHz channel width is not supported officially. There is [[https://forum.openwrt.org/t/qualcommax-nss-build/148529/3376|hack]] available. For those doing their own builds.   * 5G 160MHz channel width is not supported officially. There is [[https://forum.openwrt.org/t/qualcommax-nss-build/148529/3376|hack]] available. For those doing their own builds.
-:!: The device can really run hot due to the disabled fan leading to throttling and instabilities. Esp. if an USB device is connected. You be advised to either deploy an active cooler directed to the device itself or making your own build integrating the patch referenced above for proper cooling. To the state of 2024 this FAN patch is not working reliable. But there are others (simpler, script based) solutions available (which could disappear/change over time) e. g.: [[https://github.com/asvio/openwrt|by asvio]], [[https://github.com/ddimension/openwrt/commit/4e4d1d2d8eaabc4dd0ee0b73b918a0504399977c|by ddimension]], [[https://github.com/psychowood/openwrt-armor-g5-nbg7815/commit/8ca55067afaf232c154238e0fffdda1e028ce57c|by psychowood]], [[https://github.com/pwned-pixel/nbg7815-fancontrol/commit/684928197983ca1920bbeae7fea8e9243855e365|by pwned-pixel]]. There are more available just ask/look within the [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|Forum Support Thread]] +:!: The device can **really run hot due to the disabled fan leading to throttling and instabilities**. Esp. if an USB device is connected. You be advised to either deploy an active cooler directed to the device itself or making your own build integrating the patch referenced above for proper cooling. To the state of 2024 this FAN patch is not working reliable. But there are others (simpler, script based) solutions available (which could disappear/change over time) e. g.: [[https://github.com/asvio/openwrt|by asvio]], [[https://github.com/ddimension/openwrt/commit/4e4d1d2d8eaabc4dd0ee0b73b918a0504399977c|by ddimension]], [[https://github.com/psychowood/openwrt-armor-g5-nbg7815/commit/8ca55067afaf232c154238e0fffdda1e028ce57c|by psychowood]], [[https://github.com/pwned-pixel/nbg7815-fancontrol/commit/684928197983ca1920bbeae7fea8e9243855e365|by pwned-pixel]]. There are more available just ask/look within the [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|Forum Support Thread]]\\ 
-^+\\
  
 ===== Forum Support Thread ===== ===== Forum Support Thread =====
  
-[[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|openwrt-support-for-armor-g5-nbg7815]] +[[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|openwrt-support-for-armor-g5-nbg7815]]\\ 
-^+\\
  
 ===== Installation ===== ===== Installation =====
Line 84: Line 79:
   - Reboot the device.   - Reboot the device.
   - Check if SSH access is working by using address: ''**192.168.123.1**'' / port: ''**22**'' / username: ''**root**'' / password: ''**OpenWrt**'' E. g. On a Linux Terminal: ''**ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null root@192.168.123.1 -p 22**'' using the password ''**OpenWrt**''   - Check if SSH access is working by using address: ''**192.168.123.1**'' / port: ''**22**'' / username: ''**root**'' / password: ''**OpenWrt**'' E. g. On a Linux Terminal: ''**ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null root@192.168.123.1 -p 22**'' using the password ''**OpenWrt**''
- 
 <tabbox Enable Root/SSH access> <tabbox Enable Root/SSH access>
 <code> <code>
Line 112: Line 106:
 </code> </code>
 </tabbox> </tabbox>
-^+\\ 
 + 
 +==== Backup ==== 
 + 
 +Before you modify the device it is always a good idea to make a backup of the flash drive(s) installed. The generic process is described [[:docs:guide-user:installation:generic.backup|here]].\\ 
 +We have one 8MB SPI NOR flash chip and one 4GB emmc flash chip. For both you can use dd. The partition layout of both chips is described [[#Flash-/Partition-Layout|here]].\\ 
 +You can spare out the last two big partitions on the emmc chip if you want. They are not important. Transfer the files either via USB or ssh/scp.\\ 
 +\\
  
 ==== Installing OpenWrt ==== ==== Installing OpenWrt ====
  
-:!: WIP use [[#Example 2|**Example 2**]] for now!+:!: **Do not power off the device during the process!** 
   - Login as root via SSH.   - Login as root via SSH.
-  - Change to directory ''**cd /tmp/ApplicationData**'' +  - Change to directory ''**/tmp/ApplicationData**''. 
-  - Get the [[#OpenWrt Firmware|OpenWrt Firmware]] onto your router by either: +  - Get the [[#OpenWrt Firmware|OpenWrt Firmware]] onto your router by either a) or b):\\ a) The device to has internet access for downloading the OpenWrt firmware file to the device using wget.\\ b) Download the OpenWrt firmware to your computer and move the file to a FAT or NTFS formatted USB drive. Connect the USB drive to your router and mount the USB device. Copy the file to /tmp/ApplicationData.
-     The device to has internet access for downloading the OpenWrt firmware file to the device using wget. +
-     Download the OpenWrt firmware to your computer and move the file to a FAT or NTFS formatted USB drive. Connect the USB drive to your router and mount the USB device. Copy the file to /tmp/ApplicationData.+
   - Extract the firmware file.   - Extract the firmware file.
-  - Determine the bootconfig of the device+  - Determine the bootconfig of the device and flash OpenWrt to the currently not active kernel and rootfs partitions. 
-  - Flash OpenWrt to the currently not active kernel and rootfs partitions. +  - Mark the partitions to boot OpenWrt.
-  - Mark the partitions to boot OpenWrt. :!: This is the most dangerous part of this process. Do not power off the router under any circumstances!+
   - Reboot the device.   - Reboot the device.
  
-**__Example:__** In this example we download and install a snapshot build on the router.+<tabbox Semi-automatic (Step 2-7)><WRAP><code> 
 +cd /tmp/ApplicationData 
 +wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin 
 +wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh 
 +sh flash_to_openwrt.sh 
 +</code></WRAP>
  
-<tabbox Step 2-4><WRAP><code>+<tabbox Step 2-6><WRAP><code> 
 +# Author: Karol Przybylski <itor@o2.pl> 
 +# https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh 
 + 
 +# Step 2
 cd /tmp/ApplicationData cd /tmp/ApplicationData
 +
 +# Step 3
 wget -O zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin wget -O zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin
 if [ ! -f "/tmp/ApplicationData/zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then if [ ! -f "/tmp/ApplicationData/zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then
Line 137: Line 147:
      exit 1      exit 1
 fi fi
 +
 +# Step 4
 tar xvf zyxel_nbg7815-squashfs-sysupgrade.bin tar xvf zyxel_nbg7815-squashfs-sysupgrade.bin
-</code></WRAP> 
-<tabbox Step 5><WRAP><code> 
-mtd_part_a=$(grep -i "\"0:bootconfig"\" /proc/mtd | awk -F: '{print $1}') 
-get_bootconfig=$(hexdump -v -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/"$mtd_part_a" | cut -f 1 -d "|" | head -n1) 
  
-</code></WRAP+# Step 5 
-<tabbox Step 6><WRAP><code>+primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot) 
 +if [ $primaryboot_hlos -eq 0 ]; then 
 +     dd if=/dev/zero of=/dev/mmcblk0p7 
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p7 
 +     echo 1 /proc/boot_info/0:HLOS/primaryboot 
 +else 
 +     dd if=/dev/zero of=/dev/mmcblk0p3 
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p3 
 +     echo 0 /proc/boot_info/0:HLOS/primaryboot 
 +fi
  
-</code></WRAP+primaryboot_rootfs=$(cat /proc/boot_info/rootfs/primaryboot) 
-<tabbox Step 7><WRAP><code>+if [ $primaryboot_rootfs -eq 0 ]; then 
 +     dd if=/dev/zero of=/dev/mmcblk0p8 
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p8 
 +     echo 1 /proc/boot_info/rootfs/primaryboot 
 +else 
 +     dd if=/dev/zero of=/dev/mmcblk0p4 
 +     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p4 
 +     echo 0 /proc/boot_info/rootfs/primaryboot 
 +fi
  
 +# Step 6
 +mkdir /tmp/ApplicationData/boot
 +cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin
 +echo 1 > /proc/mtd_writeable
 +dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null
 +dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null
 +echo 0 > /proc/mtd_writeable
 +sync
 </code></WRAP></tabbox> </code></WRAP></tabbox>
  
-**Example 2**: +:!For reference[[https://github.com/openwrt/openwrt/commit/5dee5965012e788f06e4d095e8cfb73200d818cb|initial commit nbg7815]]\\ 
-<code> +\\
-  root@NBG7815:~# cd /tmp/ApplicationData +
-  root@NBG7815:~# wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/ipq807x/generic/openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin +
-  root@NBG7815:~# wget https://raw.githubusercontent.com/itorK/nbg7815_tools/main/flash_to_openwrt.sh +
-  root@NBG7815:~# chmod 755 ./flash_to_openwrt +
-  root@NBG7815:~# ./flash_to_openwrt +
-  root@NBG7815:~# reboot +
-</code>+
  
 ===== Back to OEM firmware ===== ===== Back to OEM firmware =====
  
-OpenWrt is currently not using the dual partition layout writing the opposite/not active kernel/rootfs partitions during upgrade. So we can easy go back to OEM firmware by just setting the active kernel and rootfs partitions [[#Back to OEM firmware (1)|(1)]]. In case this changes in future or you have flashed the other partitions as well you can flash the OEM firmware with proper rootfs and kernel image too [[#Back to OEM firmware (2)|(2)]]. Another option would be using the [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] process from section [[#Debricking|Debricking]]. +OpenWrt is currently not using the dual partition layout writing the opposite/not active kernel/rootfs partitions during upgrade. So we can easy go back to OEM firmware by just setting the active kernel and rootfs partitions [[#Back to OEM firmware (1)|Back to OEM firmware (1)]]. In case this changes in future or you have flashed the other partitions as well you can flash the OEM firmware with proper rootfs and kernel image too [[#Back to OEM firmware (2)|Back to OEM firmware (2)]]. Another option would be using the [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] process from section [[#Debricking|Debricking]].\\  
-^+\\ 
 ==== Back to OEM firmware (1) ==== ==== Back to OEM firmware (1) ====
  
-  - Login via SSH to your router. +Be carefull with this process. :!: **Do not power off the device during the process!** 
-  - Change directory to /tmp + 
-  - Get script from to change partition with ''**wget https://github.com/itorK/nbg7815_tools/blob/main/change_boot_partition.sh**'' +  - Login via SSH to the router
-  - Execute the script with ''**sh change_boot_partition.sh**''+  - To use this method it is required to install kmod-mtd-rw first: ''**opkg update && opkg install kmod-mtd-rw**''
 +  - Change directory to /tmp. 
 +  - Copy & paste the code from script ''**Step 4**'' below. 
 +  - Execute the script with ''**sh change_boot_partition.sh**''
 +  - Reboot the device. 
 +  - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. 
 + 
 +<tabbox Step 4><WRAP><code> 
 +cat <<'EOF' > /tmp/change_boot_partition.sh 
 +# Script to changing active boot partitions  
 +# Author: Karol Przybylski <itor@o2.pl> 
 +# Orginal script: https://github.com/itorK/nbg7815_tools/blob/main/change_boot_partition.sh // It lacks the insmod mtd-rw i_want_a_brick=1 
 + 
 +openwrt_type=$(cat /etc/openwrt_release|grep DISTRIB_TARGET|cut -f 2 -d "'") 
 + 
 +if [ ${openwrt_type} == "ipq807x/generic" ]; then 
 +  echo "OpenWrt release" 
 +  boot_part=$(hexdump -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/mtd2|cut -f 1 -d "|"|head -n1) 
 + 
 +  dd if=/dev/mtd2 of=boot.bin bs=336 count=1 
 + 
 +  if [ ${boot_part} -eq 0 ]; then 
 +    printf '\x01| dd of=boot.bin bs=1 seek=168 count=1 conv=notrunc 
 +  else 
 +    printf '\x00| dd of=boot.bin bs=1 seek=168 count=1 conv=notrunc 
 + 
 +  fi 
 +  insmod mtd-rw i_want_a_brick=1 
 +  mtd write boot.bin /dev/mtd2 
 +  mtd write boot.bin /dev/mtd3 
 +fi 
 + 
 +if [ ${openwrt_type} == "ipq/ipq807x_64" ]; then 
 +  echo "Original Zyxel Firmware" 
 +  primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot) 
 +  if [ $primaryboot_hlos -eq 0 ]; then 
 +       echo 1 > /proc/boot_info/0:HLOS/primaryboot 
 +  else 
 +       echo 0 > /proc/boot_info/0:HLOS/primaryboot 
 +  fi 
 +   
 +  mkdir /tmp/ApplicationData/boot 
 +  cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin 
 +  echo 1 > /proc/mtd_writeable 
 +  dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null 
 +  dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null 
 +  echo 0 > /proc/mtd_writeable 
 +  sync 
 +fi 
 +EOF 
 +</code></WRAP></tabbox> 
 +\\
  
 ==== Back to OEM firmware (2) ==== ==== Back to OEM firmware (2) ====
 +
 +:!: Be carefull with this process. Make sure you write the correct images to the correct partitions! **Do not power off the device during the process!**
  
   - Download OEM firmware: [[#OEM firmware|see below]]   - Download OEM firmware: [[#OEM firmware|see below]]
   - Extract rootfs and kernel. Already extracted v8: [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel]], [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs]]   - Extract rootfs and kernel. Already extracted v8: [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel]], [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs]]
-  - Copy the files to the router into /tmp (e. g. with scpusb stick+  - Login via SSH to the router. 
-  - Flash kernel and rootfs to the device. +  - To use this method it is required to install kmod-mtd-rw first: ''**opkg update && opkg install kmod-mtd-rw**'' 
-  - Set active boot partition.+  - Copy the files to the router to /tmp (e. g. using scp or an usb drive). Rename them to ''**kernel**'' resp. ''**rootfs**''. 
 +  - Flash the kernel and rootfs to the currently not active partitions. Copy & paste the code from and execute the script with ''**sh flash_kernel_rootfs.sh**''.. 
 +  - Copy & paste the code from [[#Back to OEM firmware (1)|script Step 4]] from [[#Back to OEM firmware (1)|Back to OEM firmware (1)]] and execute the script with ''**sh change_boot_partition.sh**''
 +  - Reboot the device. 
 +  - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. 
 + 
 +<tabbox Step 6><WRAP><code> 
 +cat <<'EOF' > /tmp/flash_kernel_rootfs.sh 
 +# check files 
 + 
 +if [ ! -f "/tmp/rootfs" ]; then 
 +     echo "rootfs image" 
 +     exit 1 
 +fi 
 + 
 +if [ ! -f "/tmp/kernel" ]; then 
 +     echo "kernel image" 
 +     exit 1 
 +fi 
 + 
 +# get bootconfig 
 + 
 +mtd_part=$(grep -i "\"0:bootconfig"\" /proc/mtd | awk -F: '{print $1}'
 +bootconfig=$(hexdump -v -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/"$mtd_part" | cut -f 1 -d "|" | head -n1) 
 + 
 +# write rootfs and kernel; mmcblk0p3=0/mmcblk0p4=0 mmcblk0p7=1/mmcblk0p8=1 
 + 
 +if [ "${bootconfig}" -eq 1 ]; then 
 + dd if=/dev/zero of=/dev/mmcblk0p7 
 + dd if=/tmp/kernel of=/dev/mmcblk0p7 
 + dd if=/dev/zero of=/dev/mmcblk0p8 
 + dd if=/tmp/root of=/dev/mmcblk0p8 
 + sync 
 +fi 
 +if [ "${bootconfig}" -eq 0 ]; then 
 + dd if=/dev/zero of=/dev/mmcblk0p3 
 + dd if=/tmp/kernel of=/dev/mmcblk0p3 
 + dd if=/dev/zero of=/dev/mmcblk0p4 
 + dd if=/tmp/root of=/dev/mmcblk0p4 
 + sync 
 +fi 
 +EOF 
 +</code></WRAP></tabbox>\\
  
 ==== OEM firmware ==== ==== OEM firmware ====
  
-There are no public firmware files available for this cloud managed router. You can retrieve the firmware file by forcing a firmware upgrade and catching the temporary valid random cloudflare link by yourself. Firmware files version 6-8:+There is no official publicly available ressource to download the firmware files for this cloud managed router. You can retrieve the firmware file by forcing a firmware upgrade and catching the temporary valid random cloudflare link by yourself (this is limited to the latest firmware only). Firmware files version 6-8 were uploaded to mega.nz:
  
-^ Firmware/Link                                                                                       ^ sha256sum ^+^ Firmware                                                                                            ^ sha256sum ^
 | [[https://mega.nz/file/ptRilZZD#aGvqNpfj0mmSB-DEaE1gXEOZhE_k1FGkg6NR-ysn-90|V1.00(ABSK.8)C0.bin]] | ''1213e94cab334a9317ea405d95817255ba8970c3d2cd0fa4f16b92847ff8906c'' | | [[https://mega.nz/file/ptRilZZD#aGvqNpfj0mmSB-DEaE1gXEOZhE_k1FGkg6NR-ysn-90|V1.00(ABSK.8)C0.bin]] | ''1213e94cab334a9317ea405d95817255ba8970c3d2cd0fa4f16b92847ff8906c'' |
 | [[https://mega.nz/file/Ut51UZ4K#C16JLl2Yfw9Cn2cXOxnRvRVmPQIxXxa9YbgTWEMnYXg|V1.00(ABSK.7)C0.bin]] | ''3a6cd0a4a15fa88bfe4e05d77e562ccd6dfb9bc61994d411155d94710192a884'' | | [[https://mega.nz/file/Ut51UZ4K#C16JLl2Yfw9Cn2cXOxnRvRVmPQIxXxa9YbgTWEMnYXg|V1.00(ABSK.7)C0.bin]] | ''3a6cd0a4a15fa88bfe4e05d77e562ccd6dfb9bc61994d411155d94710192a884'' |
Line 191: Line 313:
 To get the rootfs and kernel image you have to extract them from the firmware file: rootfs=openwrt-ipq-ipq807x_64-squashfs-root.img, kernel=openwrt-ipq-ipq807x_64-qcom-ipq807x-zyxel-fit-uImage.itb.padded. To do so you would need a Linux machine with u-boot tools installed using dumpimage. Extracted rootfs and kernel for v8: To get the rootfs and kernel image you have to extract them from the firmware file: rootfs=openwrt-ipq-ipq807x_64-squashfs-root.img, kernel=openwrt-ipq-ipq807x_64-qcom-ipq807x-zyxel-fit-uImage.itb.padded. To do so you would need a Linux machine with u-boot tools installed using dumpimage. Extracted rootfs and kernel for v8:
  
 +^ Firmware                                                                                  ^ sha256sum ^
 | [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel_v8]] | ''9661a36422f357b3072ff5d1dd4e43c89410d8dd2267b343ca2e7f2cc608f6d3'' | | [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel_v8]] | ''9661a36422f357b3072ff5d1dd4e43c89410d8dd2267b343ca2e7f2cc608f6d3'' |
 | [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs_v8]] | ''cff590a82bb30ddced01e1d6514083519471aa4ca36e99a22d6fa74824075398'' | | [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs_v8]] | ''cff590a82bb30ddced01e1d6514083519471aa4ca36e99a22d6fa74824075398'' |
 +\\
  
 ===== Debricking ===== ===== Debricking =====
Line 203: Line 327:
  
   - [[#Opening the case|Open the device case.]]   - [[#Opening the case|Open the device case.]]
-  - Access to the device via [[#serial|serial]] connection using a terminal application e. g. [[https://www.putty.org|putty]] and an USB to TTL/USB to Serial adapter. +  - Connect to the device via [[#serial|serial]] connection using a terminal application e. g. [[https://www.putty.org|putty]] and an USB to TTL/USB to Serial adapter. 
-  - [[#U-Boot access|Login to the device with full u-boot access.]]+  - [[#Bootloader/U-Boot access|Access the device via bootloader.]]
   - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt.   - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt.
 +\\
  
 ==== Opening the case ==== ==== Opening the case ====
  
-<WRAP BOX> +  - Remove the two rubber crosses from the device' bottom side. 
-FIXME //Describe what needs to be done to open the device, e.gremove rubber feet, adhesive labels, screws, ...// +  - Unscrew the two screws appearing after step 1. 
-</WRAP>+  - Remove the socket. 
 +  - After step 3. another four screws appear. Remove them as well. 
 +  - Around the device' case there are eleven clips* inside (two on each sidefour in front and three in back) tying the upper shell with the bottom side. 
 +  - Keep the device with bottom side up and pry it up carefully around the case to remove the bottom sideStart at the side where the connectors are lead out
 + 
 +*) You will likely break some of them. Especially those on the left or right side. The clips at the front's case are very tight clipped because of the case' shape and the fact that there are four of them. 
 +\\ 
 + 
 +{{media:zyxel:nbg7815_open_1.jpg?350}} 
 +{{media:zyxel:nbg7815_open_2.jpg?350}} 
 +{{media:zyxel:nbg7815_open_3.jpg?350}}
  
 ==== Serial ==== ==== Serial ====
Line 226: Line 361:
  
 | Serial connection parameters | **TTL 115200, 8N1, 3.3V** | | Serial connection parameters | **TTL 115200, 8N1, 3.3V** |
-:!: Connect RX, TX, GND cable to your USB to TTL/USB to Serial adapter only! +:!: Connect RX, TX, GND cable to your USB to TTL/USB to Serial adapter only!\\ 
-^+\\
  
-==== U-Boot access ====+==== Bootloader/U-Boot access ====
  
-1. Connect the USB-to-serial adapter to the router and PC. Open up a serial console program.+  - Connect the USB-to-serial adapter to the router and PC. Open up a serial console program. 
 +  - Reboot the device and interrupt autoboot by pressing any key. You will end up with a shell prompt: ''**NBG7815>**''\\ \\ <code> 
 +Zyxel zloader v1.0.0 (2020-01-06 - 08:24)
  
-2. Reboot the device and interrupt autoboot by pressing any key: 
-<code> 
-Zyxel zloader v1.0.0 (2020-01-06 - 08:24) 
 Multiboot clinent version: 2.0 Multiboot clinent version: 2.0
 ipq807x_eth_halt: done ipq807x_eth_halt: done
Line 248: Line 382:
  
 **Hit any key to stop autoboot:  3** **Hit any key to stop autoboot:  3**
-</code> 
  
-You will end up with a shell prompt: ''**NBG7815>**'' +NBG7815>
- +
-3. To get access to the bootloader you first need a seed/passcode. You will obtain it by typing ''**ATSE NBG7815**'' into the console prompt: +
-<code> +
-NBG7815> ATSE NBG7815+
 </code> </code>
---> ''**013D72FF0710**'' +  To get access to the bootloader you first need a seed/passcode. You will obtain it by typing ''**ATSE NBG7815**'' into the console prompt:\\ \\ <code> 
- +NBG7815> ATSE NBG7815 
-:!: The resulting seed/passcode is always different for each boot -> You have to do the same procedure on every reboot to access u-boot! +NBG7815> 013D72FF0710 
- +</code> ''**013D72FF0710**'' is the resulting seed/passcode :!: This seed/passcode is always different for each boot -> You have to do the same procedure on every reboot to access u-boot!\\  
-4. Generate the password: +  Generate the password:\\ \\ :!: **Do not enter the code below it into the current shell!** We have to open a new terminal application. We have distinguish here between Windows and Linux users!\\ \\ **__Linux__**: Copy and paste the code from below into a **newly** opened terminal. First use **calc script** and then **generate password** executing the script using the seed/passcode generated in section 3.\\ \\ **__Windows__** you can use [[https://mega.nz/file/sgZnnYoT#WYuFCmvTETYVr6j8vIZuVHC9rWVykBIBXOOWB3MFhfs|ZynPass]] to calculate the password.\\ \\ <tabbox calc script>
- +
-:!: **Do not enter the code below it into the current shell!** We have to open a new terminal application. We have distinguish here between Windows and Linux users! +
- +
-**__On Linux__**: Copy and paste the code from below into a **newly** opened terminal. First use **create calc script** and then **generate password** executing the script using the seed/passcode generated in section 3. +
-**__On Windows__** you can use [[https://mega.nz/file/sgZnnYoT#WYuFCmvTETYVr6j8vIZuVHC9rWVykBIBXOOWB3MFhfs|ZynPass]] to calculate the password. +
- +
-<tabbox create calc script>+
 <code> <code>
-cat <<EOF> tool.sh+cat <<'EOF> tool.sh
 ror32() { ror32() {
   echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))   echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
Line 281: Line 403:
 EOF EOF
 </code> </code>
-<tabbox generate password> +<tabbox password>
-<code> +
-sh tool.sh **013D72FF0710** +
-</code> +
-</tabbox> +
- +
---> ''**ATEN 1,10F0A563**'' +
- +
-5. Put the output from section 5. in the terminal and press enter:+
 <code> <code>
 +sh tool.sh 013D72FF0710
 +</code></tabbox> The resulting password looks like: ''**ATEN 1,10F0A563**''
 +  - Put the output from paragraph 4. in the terminal and press enter:\\ \\ <code>
 NBG7815> ATEN 1,10F0A563 NBG7815> ATEN 1,10F0A563
 </code> </code>
 +  -  Now Enter ''ATGU'' for full u-boot access. You will end up with a new prompt: ''**ZYXEL#**''\\ \\ <code>
 +NBG7815> ATGU
  
-6. Now Enter ''ATGU'' for full u-boot access: +ZYXEL#
-<code> +
-NBG7815> ATGU+
 </code> </code>
-You will end up with a new prompt: --> ''**ZYXEL#**'' +\\ 
-+
- +
-==== TFTP flash OEM firmware ==== +
- +
-  - Get **[[#OEM firmware|original firmware]]**. +
-  - Setup your PC/Workstation assigning the static IP 192.168.1.99. +
-  - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). +
-  - Connect your PC/Workstation via LAN cable to the router. +
-  - Power up your router and get access to [[#U-Boot access|u-boot]] as describe above. Step 1-2 is enough (no need unlock). +
-  - Enter ''ATUR'' and the name of the downloaded firmware file e. g. ''ATUR V1.00(ABSK.8)C0.bin'': <code>NBG7815> ATUR V1.00(ABSK.8)C0.bin</code>+
  
 ==== TFTP boot OpenWrt ==== ==== TFTP boot OpenWrt ====
  
-  - Get **[[#OpenWrt Firmware|Other images (factory, initramfs)]]** choosing an itb firmware file.+  - Download **[[#OpenWrt Firmware|OpenWrt Firmware/Other images (factory, initramfs)]]** choosing an itb firmware file.
   - Setup your PC/Workstation assigning the static IP 192.168.1.99.   - Setup your PC/Workstation assigning the static IP 192.168.1.99.
   - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open).   - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open).
   - Connect your PC/Workstation via LAN cable to the router.   - Connect your PC/Workstation via LAN cable to the router.
-  - Power up your router and get access to [[#U-Boot access|u-boot]] as describe above. Step 1-6 reaching ''ZYXEL#'' prompt.+  - Power up your router and get access to [[#Bootloader/U-Boot access|u-boot]] as describe above. Step 1-6 reaching ''ZYXEL#'' prompt.
   - Enter ''tftpboot'' and the name of firmware file e. g. ''openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb'': <code>ZYXEL# tftpboot openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb</code>   - Enter ''tftpboot'' and the name of firmware file e. g. ''openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb'': <code>ZYXEL# tftpboot openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb</code>
   - After the file is uploaded (this takes a while) you may proceed with entering ''bootm'' into the shell: <code>ZYXEL# bootm</code>   - After the file is uploaded (this takes a while) you may proceed with entering ''bootm'' into the shell: <code>ZYXEL# bootm</code>
   - If OpenWrt is up you can try to fix your issues. E. g. fixing wrong config preventing booting the device, reinstall OpenWrt using sysupgrade, reinstall OpenWrt as described [[#Installing OpenWrt|here]] or install OEM firmware like [[#Back to OEM firmware|here]].   - If OpenWrt is up you can try to fix your issues. E. g. fixing wrong config preventing booting the device, reinstall OpenWrt using sysupgrade, reinstall OpenWrt as described [[#Installing OpenWrt|here]] or install OEM firmware like [[#Back to OEM firmware|here]].
-^+\\ 
  
-===== Notes =====+==== TFTP flash OEM firmware ====
  
-Code of flash_to_openwrt.sh Script: +  - Download the **[[#OEM firmware|OEM firmware]]**
-<code+  - Setup your PC/Workstation assigning the static IP 192.168.1.99. 
-AuthorKarol Przybylski <itor@o2.pl>+  - Install and configure TFTP server. Your router's u-boot environment is acting as client. -[[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). 
 +  - Connect your PC/Workstation via LAN cable to the router. 
 +  - Power up your router and get access to [[#Bootloader/U-Boot access|u-boot]] as describe above. Step 1-2 is enough (no need unlock). 
 +  - Enter ''ATUR'' and the name of the downloaded firmware file e. g. ''ATUR V1.00(ABSK.8)C0.bin'': <code>NBG7815> ATUR V1.00(ABSK.8)C0.bin</code:!: **Do not power off the device during the process!**\\ 
  
-if [ ! -f "openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then +===== Photos =====
-     echo "Cannot find image openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin" +
-     exit 1 +
-fi +
- +
-tar xvf ./openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin +
- +
-primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot) +
-if [ $primaryboot_hlos -eq 0 ]; then +
-     dd if=/dev/zero of=/dev/mmcblk0p7 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p7 +
-     echo 1 > /proc/boot_info/0:HLOS/primaryboot +
-else +
-     dd if=/dev/zero of=/dev/mmcblk0p3 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p3 +
-     echo 0 > /proc/boot_info/0:HLOS/primaryboot +
-fi +
- +
-primaryboot_rootfs=$(cat /proc/boot_info/rootfs/primaryboot) +
-if [ $primaryboot_rootfs -eq 0 ]; then +
-     dd if=/dev/zero of=/dev/mmcblk0p8 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p8 +
-     echo 1 > /proc/boot_info/rootfs/primaryboot +
-else +
-     dd if=/dev/zero of=/dev/mmcblk0p4 +
-     dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p4 +
-     echo 0 > /proc/boot_info/rootfs/primaryboot +
-fi +
- +
- +
-mkdir /tmp/ApplicationData/boot +
-cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin +
-echo 1 > /proc/mtd_writeable +
-dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null +
-dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null +
-echo 0 > /proc/mtd_writeable +
-sync +
-reboot +
-</code>+
  
-==== Photos ====+{{media:zyxel:zyxel_nbg7815_pcb_1_.jpg?250|Zyxel NBG7815 (Armor G5) PCB (1)}} {{media:zyxel:zyxel_nbg7815_pcb_2.jpg?250|Zyxel NBG7815 (Armor G5) PCB (2)}}\\ 
 +\\
  
-{{media:zyxel:zyxel_nbg7815_pcb_1_.jpg?250|Zyxel NBG7815 (Armor G5) PCB (1)}} {{media:zyxel:zyxel_nbg7815_pcb_2.jpg?250|Zyxel NBG7815 (Armor G5) PCB (2)}} +===== Flash-/Partition-Layout =====
-+
-==== Flash-/Partition-Layout =====+
  
 <tabbox 8MB SPI NOR><WRAP><code> <tabbox 8MB SPI NOR><WRAP><code>
Line 464: Line 535:
   10          307234         1355809   512.0 MiB   FFFF  nbg   10          307234         1355809   512.0 MiB   FFFF  nbg
   11         1355810         7122977   2.8 GiB     FFFF  appdata   11         1355810         7122977   2.8 GiB     FFFF  appdata
-</code></WRAP></tabbox>+</code></WRAP></tabbox>\\ 
 +\\
  
 ===== Bootlogs ===== ===== Bootlogs =====
  • Last modified: 2024/12/13 12:10
  • by pwned