Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| toh:zte:mf286r [2022/09/09 12:52] – fin(except hardware images) pcislocked | toh:zte:mf286r [2024/11/04 10:22] (current) – [Basic configuration] andrewz | ||
|---|---|---|---|
| Line 5: | Line 5: | ||
| /* USE https:// | /* USE https:// | ||
| - | {{page> | + | ZTE MF286R is a wireless LTE router, capable of connecting to LTE networks at download speeds up to 300Mbps using carrier aggegation. It has 3x3 2.4GHz Wi-Fi 4 and 2x2 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls. It is commonly used by some European ISPs for FWA(Fixed Wireless Access) services, such as Windtre on Italy, Turkcell on Türkiye, and more. Some models of the MF286 family include battery or phone ports, as well as corresponding LEDs on the front. |
| - | ZTE MF286 is a wireless LTE router, capable of connecting to LTE networks at speeds up to 300Mbps using carrier aggegation. It has tri-band 2.4GHz Wi-Fi 4 and dual-band 5GHz Wi-Fi 5 Wave 2 radios, four gigabit ethernet ports, one USB 2.0 port, two RJ-11 ports for connecting landline phones that lets you use the cellular network to make calls, and a battery slot on the back for a 3Ah battery. It is commonly used by some european ISPs for FWA(Fixed Wireless Access) services, by Windtre on Italy, Turkcell on Turkey, and more. Some models do not include battery or phone ports, as well as corresponding LEDs on the front. | + | {{media:zte:mf286r: |
| - | + | ||
| - | {{media: | + | |
| ===== Supported Versions ===== | ===== Supported Versions ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c,c,c,c,c | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | |
| + | } --> | ||
| /* If no unsupported functions known, comment out the following datatable or delete it. */ | /* If no unsupported functions known, comment out the following datatable or delete it. */ | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | filter | + | |
| - | filter | + | |
| - | ---- | + | " |
| + | " | ||
| + | } --> | ||
| ===== Experimental Versions ===== | ===== Experimental Versions ===== | ||
| Line 32: | Line 33: | ||
| ===== Hardware Highlights ===== | ===== Hardware Highlights ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | header | + | " |
| - | align : c,c, | + | " |
| - | filter | + | " |
| - | filter | + | |
| - | ---- | + | |
| + | } --> | ||
| ===== Installation ===== | ===== Installation ===== | ||
| - | ---- datatable ---- | + | <!-- ToH: { |
| - | cols | + | " |
| - | headers | + | " |
| - | align : c,c,c | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | |
| + | } --> | ||
| -> [[docs: | -> [[docs: | ||
| - | TL:DR; Get a TTL cable and connect to the serial(see ), boot the initramfs image, then apply the sysupgrade image. | + | |
| - | If you don't have a TTL cable, you can use the known exploiot | + | TL:DR; Get a serial adapter |
| + | If you don't have a serial adapter, you can use the known exploit | ||
| - | STEP 1: Gaining root shell | + | ====STEP 1: Gaining root shell==== |
| - | Method 1: | + | ===Method 1=== |
| - | Use a serial cable. It might seem inconvenient to tear apart the device and get a TTL adapter for one job but it is way easier to do the install with it. Otherwise, feel free to follow the other methods mentioned below, which takes advantage of an URL RCE exploit within the Web UI. Some up-to-date firmwares patched this bug(such as T-Mobile.pl firmware.). | + | Use a serial cable. It might seem inconvenient to tear apart the device and get a serial |
| - | Method 2: | + | ===Method 2=== |
| This works if busybox has telnetd compiled in the binary. If this does not work, try method 3.. | This works if busybox has telnetd compiled in the binary. If this does not work, try method 3.. | ||
| Line 69: | Line 73: | ||
| - After connecting to telnetd use " | - After connecting to telnetd use " | ||
| - | Method 3: | + | ===Method 3=== |
| This works if busybox does not have telnetd compiled in. Notably, this is the case in DNA.fi firmware. | This works if busybox does not have telnetd compiled in. Notably, this is the case in DNA.fi firmware. | ||
| - Set IP of your computer to 192.168.0.22/ | - Set IP of your computer to 192.168.0.22/ | ||
| - Have a TFTP server running at that address | - Have a TFTP server running at that address | ||
| - | - Download MIPS build of busybox including telnetd, for example from [[https:// | + | - Download MIPS build of busybox including telnetd, for example from [[https:// |
| - As previously, login to router' | - As previously, login to router' | ||
| - Using " | - Using " | ||
| Line 82: | Line 86: | ||
| - Save the settings. This will download the telnetd binary over tftp and execute it. You should be able to log in at port 23, using " | - Save the settings. This will download the telnetd binary over tftp and execute it. You should be able to log in at port 23, using " | ||
| - | STEP 2: Backing up original software: | + | ====STEP 2: Backing up original software==== |
| As the stock firmware may be customized by the carrier and is not officially available in the Internet, **IT IS IMPERATIVE** to back up the stock firmware, if you ever plan to returning to stock firmware. It is highly recommended to perform backup using both methods, to avoid hassle of reassembling firmware images in future, if a restore is needed. | As the stock firmware may be customized by the carrier and is not officially available in the Internet, **IT IS IMPERATIVE** to back up the stock firmware, if you ever plan to returning to stock firmware. It is highly recommended to perform backup using both methods, to avoid hassle of reassembling firmware images in future, if a restore is needed. | ||
| - | Method 1: after booting OpenWrt initramfs image via TFTP | + | ===Method 1 - After booting OpenWrt initramfs image via TFTP=== |
| PLEASE NOTE: YOU CANNOT DO THIS IF USING INTERMEDIATE FIRMWARE FOR INSTALLATION. | PLEASE NOTE: YOU CANNOT DO THIS IF USING INTERMEDIATE FIRMWARE FOR INSTALLATION. | ||
| - Dump stock firmware located on stock kernel and ubi partitions and keep them in a safe place, should a restore be needed in future. | - Dump stock firmware located on stock kernel and ubi partitions and keep them in a safe place, should a restore be needed in future. | ||
| Line 92: | Line 96: | ||
| ssh root@192.168.1.1: | ssh root@192.168.1.1: | ||
| - | Method 2: using stock firmware: | + | ===Method 2 - using stock firmware=== |
| - | - Connect an external USB drive formatted with FAT or ext4 to the USB port. | + | - After booting into the stock frimware and connecting to the console either via serial or telnet, |
| - The drive will be auto-mounted to / | - The drive will be auto-mounted to / | ||
| - Check the flash layout of the device: | - Check the flash layout of the device: | ||
| + | <WRAP BOX> | ||
| cat /proc/mtd | cat /proc/mtd | ||
| + | </ | ||
| It should show the following: | It should show the following: | ||
| + | |||
| mtd0: 000a0000 00010000 " | mtd0: 000a0000 00010000 " | ||
| mtd1: 00020000 00010000 " | mtd1: 00020000 00010000 " | ||
| Line 118: | Line 125: | ||
| mtd16: 01d00000 00020000 " | mtd16: 01d00000 00020000 " | ||
| - | Differences might indicate that this is NOT a MF286A device but one of other variants. | + | |
| + | //Differences might indicate that this is NOT a MF286A device but one of other variants.// | ||
| - Copy over all MTD partitions, for example by executing the following: | - Copy over all MTD partitions, for example by executing the following: | ||
| Line 131: | Line 139: | ||
| umount / | umount / | ||
| | | ||
| - | - Store the files in safe place if you ever plan to return to stock | + | - Store the files in safe place if you ever plan to return to stock firmware. |
| - | | + | |
| - | | + | |
| - | | + | Alternatively, |
| + | |||
| + | tftp -l /dev/mtd0ro -r mtd0ro_uboot.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd1ro -r mtd1ro_uenv.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd2ro -r mtd2ro_reseved1.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd3ro -r mtd3ro_foto-flag.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd4ro -r mtd4ro_art.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd5ro -r mtd5ro_mac.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd6ro -r mtd6ro_reserved2.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd7ro -r mtd7ro_cfg-param.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd8ro -r mtd8ro_log.img -p 192.168.1.144 | ||
| + | tftp -l /dev/mtd9ro -r mtd9ro_oops.img -p 192.168.1.144 | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | tftp -l / | ||
| + | |||
| + | Change the IP accordingly, | ||
| - | STEP 3: Booting initramfs image: | + | ====STEP 3: Booting initramfs image==== |
| - | Method 1: using serial console (RECOMMENDED): | + | ===Method 1: using serial console (RECOMMENDED): |
| - | - Have TFTP server running, exposing the OpenWrt initramfs image, and set your computer' | + | - Have TFTP server running, exposing the OpenWrt initramfs image, and set your computer' |
| - Connect the serial console if you haven' | - Connect the serial console if you haven' | ||
| - | - Interrupt boot sequence by pressing any key in U-boot when prompted "Hit any key to stop autoboot" | + | - Interrupt boot sequence by pressing any key in U-boot when prompted "Hit any key to stop autoboot" |
| - Use the following commands to boot OpenWrt initramfs through TFTP: | - Use the following commands to boot OpenWrt initramfs through TFTP: | ||
| setenv serverip 192.168.0.22 | setenv serverip 192.168.0.22 | ||
| setenv ipaddr 192.168.0.1 | setenv ipaddr 192.168.0.1 | ||
| - | tftpboot | + | tftpboot |
| - | bootm 0x81000000 | + | bootm 0x82000000 |
| (Replace server IP and router IP as needed). | (Replace server IP and router IP as needed). | ||
| Line 153: | Line 181: | ||
| - When OpenWrt initramfs finishes booting, proceed to actual installation. | - When OpenWrt initramfs finishes booting, proceed to actual installation. | ||
| - | Method 2: using initramfs image as temporary boot kernel | + | ===Method 2: using initramfs image as temporary boot kernel=== |
| This exploits the fact, that kernel and rootfs MTD devices are consecutive on NAND flash, so from within stock image, an initramfs can be written to this area and booted by U-boot on next reboot, because it uses " | This exploits the fact, that kernel and rootfs MTD devices are consecutive on NAND flash, so from within stock image, an initramfs can be written to this area and booted by U-boot on next reboot, because it uses " | ||
| - Download the initramfs-kernel.bin image | - Download the initramfs-kernel.bin image | ||
| Line 161: | Line 189: | ||
| / | / | ||
| - | - If write is OK, reboot the device, it will reboot to OpenWrt | + | - If the write fails with " |
| - | | + | |
| + | cat / | ||
| + | |||
| + | Retry the write afterwards. | ||
| + | |||
| + | - If write is OK, reboot the device, it will reboot to OpenWrt initramfs: | ||
| reboot -f | reboot -f | ||
| - | - After rebooting, SSH into the device and use sysupgrade to perform | + | - After rebooting, SSH into the device and use sysupgrade to perform proper installation. |
| - | | + | |
| - | Method 3: using built-in TFTP recovery (LAST RESORT): | + | ===Method 3: using built-in TFTP recovery (LAST RESORT)=== |
| - With that method, ensure you have complete backup of system' | - With that method, ensure you have complete backup of system' | ||
| - Download " | - Download " | ||
| Line 184: | Line 216: | ||
| | | ||
| flash_erase /dev/mtd12 | flash_erase /dev/mtd12 | ||
| + | | ||
| + | - If the erase fails with " | ||
| + | |||
| + | cat / | ||
| + | |||
| + | Retry erasing afterwards. | ||
| | | ||
| Replace mtd12 with kernel partition if differrent. **THIS IS POINT OF NO RETURN.** | Replace mtd12 with kernel partition if differrent. **THIS IS POINT OF NO RETURN.** | ||
| + | |||
| - Restart the device. U-boot will attempt flashing the recovery initramfs image, which will let you perform actual installation using sysupgrade. This might take a considerable time, sometimes the router doesn' | - Restart the device. U-boot will attempt flashing the recovery initramfs image, which will let you perform actual installation using sysupgrade. This might take a considerable time, sometimes the router doesn' | ||
| - After U-boot finishes flashing, the LEDs of switch ports will all light up. At this moment, perform power-on reset, and wait for OpenWrt initramfs to finish booting. Then proceed to actual installation. | - After U-boot finishes flashing, the LEDs of switch ports will all light up. At this moment, perform power-on reset, and wait for OpenWrt initramfs to finish booting. Then proceed to actual installation. | ||
| - | STEP 4: Actual installation: | + | ====STEP 4: Actual installation==== |
| - Set your computer IP to 192.168.1.22/ | - Set your computer IP to 192.168.1.22/ | ||
| - scp the sysupgrade image to the device: | - scp the sysupgrade image to the device: | ||
| Line 204: | Line 243: | ||
| ==== Flash Layout ==== | ==== Flash Layout ==== | ||
| <WRAP BOX> | <WRAP BOX> | ||
| - | FIXME // | ||
| - | |||
| - | Please check out the article [[docs: | ||
| mtd0: 000a0000 00010000 " | mtd0: 000a0000 00010000 " | ||
| mtd1: 00020000 00010000 " | mtd1: 00020000 00010000 " | ||
| Line 250: | Line 286: | ||
| ===== Debricking ===== | ===== Debricking ===== | ||
| - | -> [[docs: | + | See [[docs: |
| ===== Failsafe mode ===== | ===== Failsafe mode ===== | ||
| - | -> [[docs: | + | See [[docs: |
| ===== Basic configuration ===== | ===== Basic configuration ===== | ||
| - | Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so, you first need to install NCM protocol. To do that, you need to connect | + | Since the router is equipped with LTE modem as its main WAN interface, it might be useful to connect to the Internet right away after installation. To do so over Luci, you' |
| - | /* Offine | + | You can also add the necessary packages when building a new image with [[https:// |
| + | As of this writing, | ||
| + | * https:// | ||
| + | * https:// | ||
| + | | ||
| - | After installing NCM, you can either | + | If you can't access the Internet via other means or you want to set it up via console or SSH, you can put the following entries in '' |
| < | < | ||
| - | config interface 'lte' | + | config interface 'wwan' |
| option proto ' | option proto ' | ||
| option device '/ | option device '/ | ||
| - | option pdptype 'IPV4V6' | + | option pdptype 'IP' |
| option apn ' | option apn ' | ||
| - | option ipv6 ' | ||
| - | option pincode ' | ||
| </ | </ | ||
| - | * If you don't know your APN, you can either consult with your operator, or delete the line " | + | Please refer to [[: |
| - | * If your SIM card doesn' | + | |
| - | * If your operator doesn' | + | |
| After configuring your LTE modem, you can follow [[docs: | After configuring your LTE modem, you can follow [[docs: | ||
| Line 314: | Line 350: | ||
| ===== Hardware ===== | ===== Hardware ===== | ||
| ==== Info ==== | ==== Info ==== | ||
| - | ---- datatemplatelist dttpllist ---- | + | <!-- ToH: { |
| - | template: meta:template_datatemplatelist | + | " |
| - | cols | + | " |
| - | filter | + | " |
| - | filter | + | " |
| - | ---- | + | " |
| + | | ||
| + | } --> | ||
| ==== Photos ==== | ==== Photos ==== | ||
| - | /* =====>>>>> | ||
| - | /* When uploading photos, **name them** intelligently. Nobody knows what 20100930_000602.jpg is! */ | ||
| - | /* e.g. {{: | ||
| - | /* Thanks, your wiki administration - Oct. 2015 */ | ||
| // | // | ||
| - | **Insert photo of front of the casing** | + | {{media: |
| + | {{: | ||
| //Back://\\ | //Back://\\ | ||
| - | **Insert photo of back of the casing** | + | {{media: |
| + | {{: | ||
| - | //Backside label://\\ | + | //Top://\\ |
| - | **Insert photo of backside | + | {{: |
| + | |||
| + | // | ||
| + | {{: | ||
| + | |||
| + | //Under device | ||
| + | {{: | ||
| + | |||
| + | // | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| ==== Opening the case ==== | ==== Opening the case ==== | ||
| Line 340: | Line 388: | ||
| **Note:** This will void your warranty! | **Note:** This will void your warranty! | ||
| - | <WRAP BOX> | + | - Take of battery lid (no battery support for this model, battery cage is dummy). |
| - | FIXME //Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, | + | - Unscrew screw placed behind battery lid. |
| - | | + | - Take off back cover. It attached with multiple plastic clamps. |
| - | </ | + | - Unscrew four more screws |
| + | - Remove front panel from blue chassis. There are more plastic | ||
| + | | ||
| + | | ||
| + | - Extract board from blue chassis. | ||
| //Main PCB://\\ | //Main PCB://\\ | ||
| - | **Insert photo of PCB** | + | {{: |
| + | {{: | ||
| + | |||
| + | //PCB Board Details and modem photo:// | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| + | {{: | ||
| ==== Serial ==== | ==== Serial ==== | ||