| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision |
| inbox:toh:zyxel:nbg7815_armor_g5 [2024/10/04 16:05] – wip pwned | inbox:toh:zyxel:nbg7815_armor_g5 [2024/10/31 16:08] – case pwned |
|---|
| {{media:zyxel:nbg7815:img_armor_ngb7815_t_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_r_01_600.png?350|Zyxel NBG7815 (Armor G5)}} | {{media:zyxel:nbg7815:img_armor_ngb7815_t_600.png?350|Zyxel NBG7815 (Armor G5)}} {{media:zyxel:nbg7815:img_armor_ngb7815_r_01_600.png?350|Zyxel NBG7815 (Armor G5)}} |
| |
| [[https://www.zyxel.com/us/en-us/products/wifi-router/ax6000-12-stream-multi-gigabit-wifi-6-router-armor-g5|ZyXEL NBG7815 product page]] | [[https://www.zyxel.com/us/en-us/products/wifi-router/ax6000-12-stream-multi-gigabit-wifi-6-router-armor-g5|ZyXEL NBG7815 product page]]\\ |
| ^ | \\ |
| |
| ===== Hardware ===== | ===== Hardware ===== |
| ^ PSU | 19VDC 2.1A | | ^ PSU | 19VDC 2.1A | |
| </hidden> | </hidden> |
| ^ | \\ |
| |
| ===== OpenWrt Firmware ===== | ===== OpenWrt Firmware ===== |
| | [[https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb|openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb]] | | | [[https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb|openwrt-qualcommax-ipq807x-zyxel_nbg7815-initramfs-uImage.itb]] | |
| </hidden> | </hidden> |
| ^ | \\ |
| |
| ===== Limitations ===== | ===== Limitations ===== |
| |
| Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED and Bluetooth. | Currently (state of 2024) OpenWrt officially **__does not support__** the integrated FAN, the integrated LED. |
| * LED: [[https://github.com/openwrt/openwrt/pull/15504|PR 15504]] | * LED: [[https://github.com/openwrt/openwrt/pull/15504|PR 15504]] |
| * FAN: [[https://github.com/openwrt/openwrt/pull/14210|PR 14210]] | * FAN: [[https://github.com/openwrt/openwrt/pull/14210|PR 14210]] |
| * Bluetooth: is not supported. Only the driver is loaded but there are not mappings for CSR-8811. | |
| * 5G 160MHz channel width is not supported officially. There is [[https://forum.openwrt.org/t/qualcommax-nss-build/148529/3376|hack]] available. For those doing their own builds. | * 5G 160MHz channel width is not supported officially. There is [[https://forum.openwrt.org/t/qualcommax-nss-build/148529/3376|hack]] available. For those doing their own builds. |
| :!: The device can **really run hot due to the disabled fan leading to throttling and instabilities**. Esp. if an USB device is connected. You be advised to either deploy an active cooler directed to the device itself or making your own build integrating the patch referenced above for proper cooling. To the state of 2024 this FAN patch is not working reliable. But there are others (simpler, script based) solutions available (which could disappear/change over time) e. g.: [[https://github.com/asvio/openwrt|by asvio]], [[https://github.com/ddimension/openwrt/commit/4e4d1d2d8eaabc4dd0ee0b73b918a0504399977c|by ddimension]], [[https://github.com/psychowood/openwrt-armor-g5-nbg7815/commit/8ca55067afaf232c154238e0fffdda1e028ce57c|by psychowood]], [[https://github.com/pwned-pixel/nbg7815-fancontrol/commit/684928197983ca1920bbeae7fea8e9243855e365|by pwned-pixel]]. There are more available just ask/look within the [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|Forum Support Thread]] | :!: The device can **really run hot due to the disabled fan leading to throttling and instabilities**. Esp. if an USB device is connected. You be advised to either deploy an active cooler directed to the device itself or making your own build integrating the patch referenced above for proper cooling. To the state of 2024 this FAN patch is not working reliable. But there are others (simpler, script based) solutions available (which could disappear/change over time) e. g.: [[https://github.com/asvio/openwrt|by asvio]], [[https://github.com/ddimension/openwrt/commit/4e4d1d2d8eaabc4dd0ee0b73b918a0504399977c|by ddimension]], [[https://github.com/psychowood/openwrt-armor-g5-nbg7815/commit/8ca55067afaf232c154238e0fffdda1e028ce57c|by psychowood]], [[https://github.com/pwned-pixel/nbg7815-fancontrol/commit/684928197983ca1920bbeae7fea8e9243855e365|by pwned-pixel]]. There are more available just ask/look within the [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|Forum Support Thread]]\\ |
| ^ | \\ |
| |
| ===== Forum Support Thread ===== | ===== Forum Support Thread ===== |
| |
| [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|openwrt-support-for-armor-g5-nbg7815]] | [[https://forum.openwrt.org/t/openwrt-support-for-armor-g5-nbg7815/98598/11|openwrt-support-for-armor-g5-nbg7815]]\\ |
| ^ | \\ |
| |
| ===== Installation ===== | ===== Installation ===== |
| </code> | </code> |
| </tabbox> | </tabbox> |
| ^ | \\ |
| | |
| | ==== Backup ==== |
| | |
| | Before you modify the device it is always a good idea to make a backup of the flash drive(s) installed. The generic process is described [[:docs:guide-user:installation:generic.backup|here]].\\ |
| | We have one 8MB SPI NOR flash chip and one 4GB emmc flash chip. For both you can use dd. The partition layout of both chips is described [[#Flash-/Partition-Layout|here]].\\ |
| | You can spare out the last two big partitions on the emmc chip if you want. They are not important. Transfer the files either via USB or ssh/scp.\\ |
| | \\ |
| |
| ==== Installing OpenWrt ==== | ==== Installing OpenWrt ==== |
| |
| :!: WIP use [[#Example 2|**Example 2**]] for now! | :!: **Do not power off the device during the process!** |
| - Login as root via SSH. | - Login as root via SSH. |
| - Change to directory ''**/tmp/ApplicationData**''. | - Change to directory ''**/tmp/ApplicationData**''. |
| - Get the [[#OpenWrt Firmware|OpenWrt Firmware]] onto your router by either: | - Get the [[#OpenWrt Firmware|OpenWrt Firmware]] onto your router by either a) or b):\\ a) The device to has internet access for downloading the OpenWrt firmware file to the device using wget.\\ b) Download the OpenWrt firmware to your computer and move the file to a FAT or NTFS formatted USB drive. Connect the USB drive to your router and mount the USB device. Copy the file to /tmp/ApplicationData. |
| * The device to has internet access for downloading the OpenWrt firmware file to the device using wget. | |
| * Download the OpenWrt firmware to your computer and move the file to a FAT or NTFS formatted USB drive. Connect the USB drive to your router and mount the USB device. Copy the file to /tmp/ApplicationData. | |
| - Extract the firmware file. | - Extract the firmware file. |
| - Determine the bootconfig of the device. | - Determine the bootconfig of the device and flash OpenWrt to the currently not active kernel and rootfs partitions. |
| - Flash OpenWrt to the currently not active kernel and rootfs partitions. | - Mark the partitions to boot OpenWrt. |
| - Mark the partitions to boot OpenWrt. :!: This is the most dangerous part of this process. Do not power off the router under any circumstances! | |
| - Reboot the device. | - Reboot the device. |
| |
| **__Example:__** In this example we download and install a snapshot build on the router. | <tabbox Semi-automatic (Step 2-7)><WRAP><code> |
| | cd /tmp/ApplicationData |
| | wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin |
| | wget https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh |
| | sh flash_to_openwrt.sh |
| | </code></WRAP> |
| |
| <tabbox Step 2-4><WRAP><code> | <tabbox Step 2-6><WRAP><code> |
| | # Author: Karol Przybylski <itor@o2.pl> |
| | # https://github.com/itorK/nbg7815_tools/blob/main/flash_to_openwrt.sh |
| | |
| | # Step 2 |
| cd /tmp/ApplicationData | cd /tmp/ApplicationData |
| | |
| | # Step 3 |
| wget -O zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin | wget -O zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq807x/openwrt-qualcommax-ipq807x-zyxel_nbg7815-squashfs-sysupgrade.bin |
| if [ ! -f "/tmp/ApplicationData/zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then | if [ ! -f "/tmp/ApplicationData/zyxel_nbg7815-squashfs-sysupgrade.bin" ]; then |
| exit 1 | exit 1 |
| fi | fi |
| | |
| | # Step 4 |
| tar xvf zyxel_nbg7815-squashfs-sysupgrade.bin | tar xvf zyxel_nbg7815-squashfs-sysupgrade.bin |
| </code></WRAP> | |
| <tabbox Step 5><WRAP><code> | |
| mtd_part_a=$(grep -i "\"0:bootconfig"\" /proc/mtd | awk -F: '{print $1}') | |
| get_bootconfig=$(hexdump -v -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/"$mtd_part_a" | cut -f 1 -d "|" | head -n1) | |
| |
| </code></WRAP> | # Step 5 |
| <tabbox Step 6><WRAP><code> | primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot) |
| | if [ $primaryboot_hlos -eq 0 ]; then |
| | dd if=/dev/zero of=/dev/mmcblk0p7 |
| | dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p7 |
| | echo 1 > /proc/boot_info/0:HLOS/primaryboot |
| | else |
| | dd if=/dev/zero of=/dev/mmcblk0p3 |
| | dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/kernel of=/dev/mmcblk0p3 |
| | echo 0 > /proc/boot_info/0:HLOS/primaryboot |
| | fi |
| |
| </code></WRAP> | primaryboot_rootfs=$(cat /proc/boot_info/rootfs/primaryboot) |
| <tabbox Step 7><WRAP><code> | if [ $primaryboot_rootfs -eq 0 ]; then |
| | dd if=/dev/zero of=/dev/mmcblk0p8 |
| | dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p8 |
| | echo 1 > /proc/boot_info/rootfs/primaryboot |
| | else |
| | dd if=/dev/zero of=/dev/mmcblk0p4 |
| | dd if=/tmp/ApplicationData/sysupgrade-zyxel_nbg7815/root of=/dev/mmcblk0p4 |
| | echo 0 > /proc/boot_info/rootfs/primaryboot |
| | fi |
| |
| | # Step 6 |
| | mkdir /tmp/ApplicationData/boot |
| | cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin |
| | echo 1 > /proc/mtd_writeable |
| | dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null |
| | dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null |
| | echo 0 > /proc/mtd_writeable |
| | sync |
| </code></WRAP></tabbox> | </code></WRAP></tabbox> |
| |
| **Example 2**: | :!: For reference: [[https://github.com/openwrt/openwrt/commit/5dee5965012e788f06e4d095e8cfb73200d818cb|initial commit nbg7815]]\\ |
| <code> | \\ |
| root@NBG7815:~# cd /tmp/ApplicationData | |
| root@NBG7815:~# wget -O openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin https://downloads.openwrt.org/snapshots/targets/ipq807x/generic/openwrt-ipq807x-generic-zyxel_nbg7815-squashfs-sysupgrade.bin | |
| root@NBG7815:~# wget https://raw.githubusercontent.com/itorK/nbg7815_tools/main/flash_to_openwrt.sh | |
| root@NBG7815:~# chmod 755 ./flash_to_openwrt | |
| root@NBG7815:~# ./flash_to_openwrt | |
| root@NBG7815:~# reboot | |
| </code> | |
| |
| ===== Back to OEM firmware ===== | ===== Back to OEM firmware ===== |
| |
| OpenWrt is currently not using the dual partition layout writing the opposite/not active kernel/rootfs partitions during upgrade. So we can easy go back to OEM firmware by just setting the active kernel and rootfs partitions [[#Back to OEM firmware (1)|(1)]]. In case this changes in future or you have flashed the other partitions as well you can flash the OEM firmware with proper rootfs and kernel image too [[#Back to OEM firmware (2)|(2)]]. Another option would be using the [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] process from section [[#Debricking|Debricking]]. | OpenWrt is currently not using the dual partition layout writing the opposite/not active kernel/rootfs partitions during upgrade. So we can easy go back to OEM firmware by just setting the active kernel and rootfs partitions [[#Back to OEM firmware (1)|Back to OEM firmware (1)]]. In case this changes in future or you have flashed the other partitions as well you can flash the OEM firmware with proper rootfs and kernel image too [[#Back to OEM firmware (2)|Back to OEM firmware (2)]]. Another option would be using the [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] process from section [[#Debricking|Debricking]].\\ |
| ^ | \\ |
| ==== Back to OEM firmware (1) ==== | ==== Back to OEM firmware (1) ==== |
| :!: WIP! | |
| | Be carefull with this process. :!: **Do not power off the device during the process!** |
| - Login via SSH to the router. | - Login via SSH to the router. |
| | - To use this method it is required to install kmod-mtd-rw first: ''**opkg update && opkg install kmod-mtd-rw**''. |
| - Change directory to /tmp. | - Change directory to /tmp. |
| - Get script from to change partition with ''**wget https://github.com/itorK/nbg7815_tools/blob/main/change_boot_partition.sh**'' | - Copy & paste the code from script ''**Step 4**'' below. |
| - Execute the script with ''**sh change_boot_partition.sh**'' | - Execute the script with ''**sh change_boot_partition.sh**''. |
| | - Reboot the device. |
| | - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. |
| | |
| | <tabbox Step 4><WRAP><code> |
| | cat <<'EOF' > /tmp/change_boot_partition.sh |
| | # Script to changing active boot partitions |
| | # Author: Karol Przybylski <itor@o2.pl> |
| | # Orginal script: https://github.com/itorK/nbg7815_tools/blob/main/change_boot_partition.sh // It lacks the insmod mtd-rw i_want_a_brick=1 |
| | |
| | openwrt_type=$(cat /etc/openwrt_release|grep DISTRIB_TARGET|cut -f 2 -d "'") |
| | |
| | if [ ${openwrt_type} == "ipq807x/generic" ]; then |
| | echo "OpenWrt release" |
| | boot_part=$(hexdump -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/mtd2|cut -f 1 -d "|"|head -n1) |
| | |
| | dd if=/dev/mtd2 of=boot.bin bs=336 count=1 |
| | |
| | if [ ${boot_part} -eq 0 ]; then |
| | printf '\x01' | dd of=boot.bin bs=1 seek=168 count=1 conv=notrunc |
| | else |
| | printf '\x00' | dd of=boot.bin bs=1 seek=168 count=1 conv=notrunc |
| | |
| | fi |
| | insmod mtd-rw i_want_a_brick=1 |
| | mtd write boot.bin /dev/mtd2 |
| | mtd write boot.bin /dev/mtd3 |
| | fi |
| | |
| | if [ ${openwrt_type} == "ipq/ipq807x_64" ]; then |
| | echo "Original Zyxel Firmware" |
| | primaryboot_hlos=$(cat /proc/boot_info/0:HLOS/primaryboot) |
| | if [ $primaryboot_hlos -eq 0 ]; then |
| | echo 1 > /proc/boot_info/0:HLOS/primaryboot |
| | else |
| | echo 0 > /proc/boot_info/0:HLOS/primaryboot |
| | fi |
| | |
| | mkdir /tmp/ApplicationData/boot |
| | cat /proc/boot_info/getbinary_bootconfig > /tmp/ApplicationData/boot/bootconfig_new.bin |
| | echo 1 > /proc/mtd_writeable |
| | dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd2" write - "/dev/mtd2" 2>/dev/null |
| | dd if=/tmp/ApplicationData/boot/bootconfig_new.bin 2>/dev/null | mtd -e "/dev/mtd3" write - "/dev/mtd3" 2>/dev/null |
| | echo 0 > /proc/mtd_writeable |
| | sync |
| | fi |
| | EOF |
| | </code></WRAP></tabbox> |
| | \\ |
| |
| ==== Back to OEM firmware (2) ==== | ==== Back to OEM firmware (2) ==== |
| :!: WIP! | |
| | :!: Be carefull with this process. Make sure you write the correct images to the correct partitions! **Do not power off the device during the process!** |
| - Download OEM firmware: [[#OEM firmware|see below]] | - Download OEM firmware: [[#OEM firmware|see below]] |
| - Extract rootfs and kernel. Already extracted v8: [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel]], [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs]] | - Extract rootfs and kernel. Already extracted v8: [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel]], [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs]] |
| - Login via SSH to the router. | - Login via SSH to the router. |
| - Copy the files to the router to /tmp (e. g. using scp or an usb drive). | - To use this method it is required to install kmod-mtd-rw first: ''**opkg update && opkg install kmod-mtd-rw**'' |
| - Flash the kernel and rootfs to the device. | - Copy the files to the router to /tmp (e. g. using scp or an usb drive). Rename them to ''**kernel**'' resp. ''**rootfs**''. |
| - Set active boot partition. | - Flash the kernel and rootfs to the currently not active partitions. Copy & paste the code from and execute the script with ''**sh flash_kernel_rootfs.sh**''.. |
| | - Copy & paste the code from [[#Back to OEM firmware (1)|script Step 4]] from [[#Back to OEM firmware (1)|Back to OEM firmware (1)]] and execute the script with ''**sh change_boot_partition.sh**''. |
| | - Reboot the device. |
| | - After reboot force a reflash of OEM firmware via WebGui using one of the provided [[#OEM firmware| OEM firmware files]] to purge OpenWrt entirely. |
| | |
| | <tabbox Step 6><WRAP><code> |
| | cat <<'EOF' > /tmp/flash_kernel_rootfs.sh |
| | # check files |
| | |
| | if [ ! -f "/tmp/rootfs" ]; then |
| | echo "rootfs image" |
| | exit 1 |
| | fi |
| | |
| | if [ ! -f "/tmp/kernel" ]; then |
| | echo "kernel image" |
| | exit 1 |
| | fi |
| | |
| | # get bootconfig |
| | |
| | mtd_part=$(grep -i "\"0:bootconfig"\" /proc/mtd | awk -F: '{print $1}') |
| | bootconfig=$(hexdump -v -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/"$mtd_part" | cut -f 1 -d "|" | head -n1) |
| | |
| | # write rootfs and kernel; mmcblk0p3=0/mmcblk0p4=0 mmcblk0p7=1/mmcblk0p8=1 |
| | |
| | if [ "${bootconfig}" -eq 1 ]; then |
| | dd if=/dev/zero of=/dev/mmcblk0p7 |
| | dd if=/tmp/kernel of=/dev/mmcblk0p7 |
| | dd if=/dev/zero of=/dev/mmcblk0p8 |
| | dd if=/tmp/root of=/dev/mmcblk0p8 |
| | sync |
| | fi |
| | if [ "${bootconfig}" -eq 0 ]; then |
| | dd if=/dev/zero of=/dev/mmcblk0p3 |
| | dd if=/tmp/kernel of=/dev/mmcblk0p3 |
| | dd if=/dev/zero of=/dev/mmcblk0p4 |
| | dd if=/tmp/root of=/dev/mmcblk0p4 |
| | sync |
| | fi |
| | EOF |
| | </code></WRAP></tabbox>\\ |
| |
| ==== OEM firmware ==== | ==== OEM firmware ==== |
| | [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel_v8]] | ''9661a36422f357b3072ff5d1dd4e43c89410d8dd2267b343ca2e7f2cc608f6d3'' | | | [[https://mega.nz/file/Q1wWEBoL#W7LaCnTeFMCOaxP_TX65yGD2h13BmYGbJQ0xe5m2qYo|kernel_v8]] | ''9661a36422f357b3072ff5d1dd4e43c89410d8dd2267b343ca2e7f2cc608f6d3'' | |
| | [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs_v8]] | ''cff590a82bb30ddced01e1d6514083519471aa4ca36e99a22d6fa74824075398'' | | | [[https://mega.nz/file/Uh4gQRqa#QEEDJ5k1tFU4zBn9yGAEHqBmWDu6S9fMF4rQxXXv_MA|rootfs_v8]] | ''cff590a82bb30ddced01e1d6514083519471aa4ca36e99a22d6fa74824075398'' | |
| | \\ |
| |
| ===== Debricking ===== | ===== Debricking ===== |
| - [[#Opening the case|Open the device case.]] | - [[#Opening the case|Open the device case.]] |
| - Connect to the device via [[#serial|serial]] connection using a terminal application e. g. [[https://www.putty.org|putty]] and an USB to TTL/USB to Serial adapter. | - Connect to the device via [[#serial|serial]] connection using a terminal application e. g. [[https://www.putty.org|putty]] and an USB to TTL/USB to Serial adapter. |
| - [[#U-Boot access|Access the device via bootloader.]] | - [[#Bootloader/U-Boot access|Access the device via bootloader.]] |
| - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt. | - [[#TFTP boot OpenWrt|TFTP boot OpenWrt]] to either reinstall or fix a broken installation | [[#TFTP flash OEM firmware|TFTP flash OEM firmware]] to purge OpenWrt. |
| | \\ |
| |
| ==== Opening the case ==== | ==== Opening the case ==== |
| |
| <WRAP BOX> | 1. Remove the two rubber crosses from the device' bottom side. |
| FIXME //Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...// | 2. Unscrew the two screws appearing after step 1. |
| </WRAP> | 3. Remove the socket. |
| | 4. After step 3. another four screws appear. Remove them as well. |
| | 5. Around the device' case there are six clips* on the bottom case part inside and five on the uppper shell inside. |
| | 6. Keep the device with bottom side up and pry it up carefully around the case to remove the bottom side. Start at the side where the connectors are lead out. |
| | |
| | *) You will likely break some of them. Especially those on the left or right side. The clips at the front's case are very tight clipped because of the case' shape and the fact that they are four of them. |
| | \\ |
| |
| ==== Serial ==== | ==== Serial ==== |
| |
| | Serial connection parameters | **TTL 115200, 8N1, 3.3V** | | | Serial connection parameters | **TTL 115200, 8N1, 3.3V** | |
| :!: Connect RX, TX, GND cable to your USB to TTL/USB to Serial adapter only! | :!: Connect RX, TX, GND cable to your USB to TTL/USB to Serial adapter only!\\ |
| ^ | \\ |
| |
| ==== Bootloader/U-Boot access ==== | ==== Bootloader/U-Boot access ==== |
| - To get access to the bootloader you first need a seed/passcode. You will obtain it by typing ''**ATSE NBG7815**'' into the console prompt:\\ \\ <code> | - To get access to the bootloader you first need a seed/passcode. You will obtain it by typing ''**ATSE NBG7815**'' into the console prompt:\\ \\ <code> |
| NBG7815> ATSE NBG7815 | NBG7815> ATSE NBG7815 |
| </code> The resulting seed/passcode looks like: ''**013D72FF0710**'' :!: This seed/passcode is always different for each boot -> You have to do the same procedure on every reboot to access u-boot!\\ | NBG7815> 013D72FF0710 |
| - Generate the password:\\ \\ :!: **Do not enter the code below it into the current shell!** We have to open a new terminal application. We have distinguish here between Windows and Linux users!\\ **__Linux__**: Copy and paste the code from below into a **newly** opened terminal. First use **create calc script** and then **generate password** executing the script using the seed/passcode generated in section 3.\\ **__Windows__** you can use [[https://mega.nz/file/sgZnnYoT#WYuFCmvTETYVr6j8vIZuVHC9rWVykBIBXOOWB3MFhfs|ZynPass]] to calculate the password.\\ \\ <tabbox create calc script> | </code> ''**013D72FF0710**'' is the resulting seed/passcode :!: This seed/passcode is always different for each boot -> You have to do the same procedure on every reboot to access u-boot!\\ |
| | - Generate the password:\\ \\ :!: **Do not enter the code below it into the current shell!** We have to open a new terminal application. We have distinguish here between Windows and Linux users!\\ \\ **__Linux__**: Copy and paste the code from below into a **newly** opened terminal. First use **calc script** and then **generate password** executing the script using the seed/passcode generated in section 3.\\ \\ **__Windows__** you can use [[https://mega.nz/file/sgZnnYoT#WYuFCmvTETYVr6j8vIZuVHC9rWVykBIBXOOWB3MFhfs|ZynPass]] to calculate the password.\\ \\ <tabbox calc script> |
| <code> | <code> |
| cat <<EOF> tool.sh | cat <<'EOF' > tool.sh |
| ror32() { | ror32() { |
| echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) | echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) |
| EOF | EOF |
| </code> | </code> |
| <tabbox generate password> | <tabbox password> |
| <code> | <code> |
| sh tool.sh **013D72FF0710** | sh tool.sh 013D72FF0710 |
| </code></tabbox> The resulting password looks like: ''**ATEN 1,10F0A563**'' | </code></tabbox> The resulting password looks like: ''**ATEN 1,10F0A563**'' |
| - Put the output from paragraph 4. in the terminal and press enter:\\ \\ <code> | - Put the output from paragraph 4. in the terminal and press enter:\\ \\ <code> |
| NBG7815> ATEN 1,10F0A563 | NBG7815> ATEN 1,10F0A563 |
| </code> | </code> |
| - Now Enter ''ATGU'' for full u-boot access:\\ \\ <code> | - Now Enter ''ATGU'' for full u-boot access. You will end up with a new prompt: ''**ZYXEL#**''\\ \\ <code> |
| NBG7815> ATGU | NBG7815> ATGU |
| </code> You will end up with a new prompt: --> ''**ZYXEL#**'' | |
| | ZYXEL# |
| | </code> |
| | \\ |
| |
| ==== TFTP boot OpenWrt ==== | ==== TFTP boot OpenWrt ==== |
| |
| - Get **[[#OpenWrt Firmware|Other images (factory, initramfs)]]** choosing an itb firmware file. | - Download **[[#OpenWrt Firmware|OpenWrt Firmware/Other images (factory, initramfs)]]** choosing an itb firmware file. |
| - Setup your PC/Workstation assigning the static IP 192.168.1.99. | - Setup your PC/Workstation assigning the static IP 192.168.1.99. |
| - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). | - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). |
| - After the file is uploaded (this takes a while) you may proceed with entering ''bootm'' into the shell: <code>ZYXEL# bootm</code> | - After the file is uploaded (this takes a while) you may proceed with entering ''bootm'' into the shell: <code>ZYXEL# bootm</code> |
| - If OpenWrt is up you can try to fix your issues. E. g. fixing wrong config preventing booting the device, reinstall OpenWrt using sysupgrade, reinstall OpenWrt as described [[#Installing OpenWrt|here]] or install OEM firmware like [[#Back to OEM firmware|here]]. | - If OpenWrt is up you can try to fix your issues. E. g. fixing wrong config preventing booting the device, reinstall OpenWrt using sysupgrade, reinstall OpenWrt as described [[#Installing OpenWrt|here]] or install OEM firmware like [[#Back to OEM firmware|here]]. |
| | \\ |
| |
| ==== TFTP flash OEM firmware ==== | ==== TFTP flash OEM firmware ==== |
| |
| - Get **[[#OEM firmware|original firmware]]**. | - Download the **[[#OEM firmware|OEM firmware]]**. |
| - Setup your PC/Workstation assigning the static IP 192.168.1.99. | - Setup your PC/Workstation assigning the static IP 192.168.1.99. |
| - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). | - Install and configure TFTP server. Your router's u-boot environment is acting as client. -> [[:docs:guide-user:troubleshooting:tftpserver]]. Put the firmware file downloaded in the tftp download directory and make sure the firewall is turned off or configured properly (port 69/udp has to be open). |
| - Connect your PC/Workstation via LAN cable to the router. | - Connect your PC/Workstation via LAN cable to the router. |
| - Power up your router and get access to [[#Bootloader/U-Boot access|u-boot]] as describe above. Step 1-2 is enough (no need unlock). | - Power up your router and get access to [[#Bootloader/U-Boot access|u-boot]] as describe above. Step 1-2 is enough (no need unlock). |
| - Enter ''ATUR'' and the name of the downloaded firmware file e. g. ''ATUR V1.00(ABSK.8)C0.bin'': <code>NBG7815> ATUR V1.00(ABSK.8)C0.bin</code> | - Enter ''ATUR'' and the name of the downloaded firmware file e. g. ''ATUR V1.00(ABSK.8)C0.bin'': <code>NBG7815> ATUR V1.00(ABSK.8)C0.bin</code> :!: **Do not power off the device during the process!**\\ |
| | |
| | ===== Photos ===== |
| |
| ==== Photos ==== | {{media:zyxel:zyxel_nbg7815_pcb_1_.jpg?250|Zyxel NBG7815 (Armor G5) PCB (1)}} {{media:zyxel:zyxel_nbg7815_pcb_2.jpg?250|Zyxel NBG7815 (Armor G5) PCB (2)}}\\ |
| | \\ |
| |
| {{media:zyxel:zyxel_nbg7815_pcb_1_.jpg?250|Zyxel NBG7815 (Armor G5) PCB (1)}} {{media:zyxel:zyxel_nbg7815_pcb_2.jpg?250|Zyxel NBG7815 (Armor G5) PCB (2)}} | ===== Flash-/Partition-Layout ===== |
| ^ | |
| ==== Flash-/Partition-Layout ===== | |
| |
| <tabbox 8MB SPI NOR><WRAP><code> | <tabbox 8MB SPI NOR><WRAP><code> |
| 10 307234 1355809 512.0 MiB FFFF nbg | 10 307234 1355809 512.0 MiB FFFF nbg |
| 11 1355810 7122977 2.8 GiB FFFF appdata | 11 1355810 7122977 2.8 GiB FFFF appdata |
| </code></WRAP></tabbox> | </code></WRAP></tabbox>\\ |
| | \\ |
| |
| ===== Bootlogs ===== | ===== Bootlogs ===== |