bootm is a boot loader command, if you're at root@openwrt, you already passed it.
1 Like
Thank you for your reply! Continued with the steps from Bezeria and T56 is now booting from openwrt 
1 Like
I confirm this works on the Zyxel T-56 from T-Mobile / Odido. Thanks for that.
3 Likes
I can also confirm that @bezeria (and the input of many others) have provided guidance to get OpenWRT (open) on my Odido (NL) ex5601-T0! THANK YOU. So happy!!
3 Likes
Hi.
I'm new to this forum but have been using OpenWrt for a few years now on various devices. This one was the trickiest to flash, so thanks to everyone for all of your input.
It took me quite a while searching through this thread to understand what I had to do, so I'm going to write a small step-by-step guide which worked for me in my case.
Hopefully this will help others who come across this router, as it's a fairly decent piece of hardware.
My router is a Zyxel ex5601-T1 (carrier locked).
I started by following the Hack GPON guide.
I attached a USB-TTL adapter to the serial, tried to access zloader and quickly realized that I didn't have root access.
Edit: After completing this whole process and writing it down, I realized that you could probably get away without using serial at all, although it does help to be able to see what is going on.
Using this method, you don't need to access zloader either.
So, what to do next? (Thanks Frost for this!)
Connect via SSH with the 'admin' user (I use PuTTY).
The firmware you have just flashed is a modified, rooted version of the stock firmware, which was confusing to me at first because the filename suggests it is an OpenWRT firmware image.
Anyway, with this firmware, signature verification is gone, which means we are able to flash an actual OpenWrt firmware, without getting the "Illegal image" message, however there are a couple more steps before we can do that.
From a Linux terminal (I used WSL with Ubuntu 20.04 LTS), download this firmware image using wget:
wget https://downloads.openwrt.org/releases/23.05.3/targets/mediatek/filogic/openwrt-23.05.3-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin
I chose not to use the modified OpenWrt image provided by Hack GPON, because it is a fork and is not updated as frequently, and the ex5601-T1 does not have an SFP port anyway.
Now we need to generate a zyfwinfo file:
echo -n -e '\x45\x58\x59\x5A\x02\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x53\x01' > zyfwinfo
Credit goes to Pameruoso on Github for the above script. See this page for more information: https://github.com/openwrt/openwrt/pull/12580/commits/1c05388ab04c934ec240e8362321908f91381a90
Now we need to amend our newly generated zyfwinfo file into the OpenWrt sysupgrade file:
mkdir sysupgrade-zyxel_ex5601-t0-stock
mv zyfwinfo sysupgrade-zyxel_ex5601-t0-stock/
tar -rvf openwrt-23.05.3-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-sysupgrade.bin sysupgrade-zyxel_ex5601-t0-stock/
You should see this output:
sysupgrade-zyxel_ex5601-t0-stock/
sysupgrade-zyxel_ex5601-t0-stock/zyfwinfo
SSH into your router again and issue the same commands as earlier:
zycli fwidcheck off
zycli modelcheck off
Proceed to the router web interface, login as admin, go to the firmware upgrade page, tick the box "restore default settings" and upload the sysupgrade.bin file that you just amended.
The router should now flash and reboot into OpenWrt.
Note: The 2.5Gbps WAN port wasn't working for me initially.
If you have the same issue, go to Network, Interfaces, Devices, and configure eth1.
Go back to interfaces, attach both WAN interfaces to eth1.
If it won't work, delete the wan interfaces and create new ones, making sure to put them both back in the wan firewall zone.
Good luck!
2 Likes
Would someone be able to acknowledge my assumptions?
So, as of now (and for what I've read in this thread), the Zyxel EX5601-T1 isn't completely capable to be flashed with this procedure, as root access isn't available via console cable. The only known working method is to flash the ROM with a CH341 programmer (or similar SPI programmer), correct?
From what I've read, I need to flash another Zyxel ROM which isn't TMNL branded, so root becomes available and the above procedure can be executed for installing OpenWRT, correct?
Can anyone point me into the right direction for this stock Zyxel ROM? Is it this one? https://hack-gpon.org/zyxel/#firmware-version-v570acdz0c0-no-brand (the mega-URL named "Firmware Version V5.70(ACDZ.0)C0_no-brand_pa_0.1" beneath the warning on that page).
As this procedure can be quite the challenge for some, dumping the ROM beforehand would probably be recommended, correct? Even if it's just to be sure that one's able to go back to a known-working state.
The mtk_uartboot binary isn't available inside its repository: https://github.com/981213/mtk_uartboot, so how are you able to run it? Am I still missing some other package?
Thanks in advance!
yes you need to connect with the ch341 (or similar). Did you try to follow the steps above? There it explains how to build also tbe binary for mtk_uartboot.
You don't need to flash another closed-source ROM. You interrupt the normal boot and instead network-boot openwrt in RAM. From there, you flash openwrt to the flash
Thanks for your reply. It's much appreciated.
You've pointed me into the right direction. I've compiled mtk_uartboot, and I'm able to start it with my USB-serial adapter. However, I'm getting stuck on:
$ ./target/debug/mtk_uartboot -s /dev/cu.usbserial-14320 --aarch64 -p mt7986-ram-ddr4-bl2.bin -f openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip
mtk_uartboot - 0.1.1
Using serial port: /dev/cu.usbserial-14320
Handshake...
I've tried setting the baudrate manually, but nothing happens.
Do note that the USB serial interface does in fact work when using screen /dev/cu.usbserial-14320 115200 -L.
As mentioned before, I've got the Zyxel EX5601-T1 TMNL version (not rooted). I'm still not sure if that has anything to do with this all. I'm noticing that when I kill mtk_uartboot and connect to the serial port with screen again, it asks for a password when I press the return key. Also very much unsure if it has anything to do with it. ¯\_(ツ)_/¯
I had the same issue that there was no handshake.
Run only the mkt_uart command
And not both at the same time, I thought that was the solution.
Even that appears to be not working.
I think it's due to the firmware update Odido has pushed onto the TMNL variant. The backup that I've exported from the Zyxel GUI seems to be encrypted, which makes it impossible to execute this tutorial: Adding OpenWrt support for Zyxel EX5601-T0 - #314 by Twolitrepinto
I'm currently on V5.70(ACEA.0)T56C_b10_0130
Is anyone else able to confirm this? Better yet, is anyone able to send me a configuration backup from their earlier version of the router?
It also seems to be impossible to downgrade to any earlier firmware version, as the GUI looks to have been completely optimized for automatic OTA updates. Which is great for automatic updates, but very sad for manual updates.
Please would you be able to give detail on what file you loaded to ghidra and what processor settings you used to get it to decompile?
Hello InjectMeneer,
I'm on TMNL and successfully my T1 with uartboot method. my handshake works fine about a month ago (not sure if they pushed new firmware since)..
But i agree with @nvl that the handshake itself might be the issue...
1 Like
Can confirm that @bezeria summed-up steps in post 297 are "mostly" valid for me for a T-mobile branded EX5601-T1 (without SFP socket) using the same ISP firmware V5.70(ACEA.0)T56C_b10_0130 version as you do.
I used a modified CH341 programmer 5V>3,3V in serial TTL mode (jumper 2-3) not SPI programmer mode. My 3 pin ground /tx/rx cable length was around 30cm.
This was the console output of the original unmodified bootloader/os on ex5601 using minicom at default settings for 115200 as soon as the ex5601 was powered on:
F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
V0: 0000 0000 [0001]
00: 0000 0000
BP: 2400 0041 [0000]
G0: 1190 0000
EC: 0000 0000 [1000]
T0: 0000 0228 [010F]
Jump to BL
NOTICE: BL2: v2.6(release):3b1fd9bf-dirty <--- mtk_uart pushes v2.10.0 !!!
NOTICE: BL2: Built : 09:47:06, Aug 11 2022
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (2000MHz)
NOTICE: EMI: Using DDR4 settings
NOTICE: EMI: Detected DRAM size: 1024MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: SPI_NAND parses attributes from parameter page.
NOTICE: SPI_NAND Detected ID 0x2c
NOTICE: Page size 4096, Block size 262144, size 536870912
NOTICE: Initializing NMBM ...
NOTICE: Signature found at block 2047 [0x1ffc0000]
NOTICE: First info table with writecount 0 found in block 1920
NOTICE: Second info table with writecount 0 found in block 1923
NOTICE: NMBM has been successfully attached in read-only mode
NOTICE: BL2: Booting BL31
NOTICE: BL31: v2.6(release):3b1fd9bf-dirty
NOTICE: BL31: Built : 09:47:11, Aug 11 2022
U-Boot 2022.01-rc4 (Aug 11 2022 - 09:45:52 +0000)
CPU: MediaTek MT7986
Model: ZYXEL EX5601-T0
DRAM: 1 GiB
Initializing NMBM ...
spi-nand: spi_nand spi_nand@1: Micron SPI NAND was found.
spi-nand: spi_nand spi_nand@1: 512 MiB, block size: 256 KiB, page size: 4096, O6
Could not find a valid device for nmbm0
Signature found at block 2047 [0x1ffc0000]
First info table with writecount 0 found in block 1920
Second info table with writecount 0 found in block 1923
NMBM has been successfully attached
MMC: mmc@11230000: 0
Loading Environment from MTD... OK
In: serial@11002000
Out: serial@11002000
Err: serial@11002000
Net: eth0: ethernet@15100000
Reading 262144 byte(s) at offset 0x00000000
## Booting kernel from Legacy Image at 46000000 ...
Image Name: zld-2.3 08/11/2022 09:46:58
Image Type: AArch64 U-Boot Standalone Program (gzip compressed)
Data Size: 23638 Bytes = 23.1 KiB
Load Address: 41e00200
Entry Point: 41e003f4
Verifying Checksum ... OK
Uncompressing Standalone Program
ZYXEL zloader v2.3.9 (08/11/2022 - 09:46:58)
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 8/2, WL threshold: 4096, image sequence number: 15
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB ha8
Reading from volume 'zyfwinfo' to 0x7f7fe8e0, size 0x400 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB ha8
Reading from volume 'zyfwinfo' to 0x7f7fece0, size 0x400 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
ubi0: attaching mtd7
ubi0: scanning is finished
ubi0: attached mtd7 (name "ubi", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 8/2, WL threshold: 4096, image sequence number: 15
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB ha8
Reading from volume 'rootfs' to 0x46000000, size 0x29ca000 ... OK
ubi0: detaching mtd7
ubi0: mtd7 is detached
zld_verify_rootfs_signature-[Info]: checksum-algorithm sha256 for rsa2048!
rootfs signature verification of ubi passed
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB ha8
Reading from volume 'rootfs' to 0x46000000, size 0x2a4c000 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
zld_verify_rootfs_signature-[Info]: checksum-algorithm sha256 for rsa2048!
rootfs signature verification of ubi2 passed
Current bootflag is 1
BOARD_DETECT_BY_GPIO=>result=2
ubi0: attaching mtd8
ubi0: scanning is finished
ubi0: attached mtd8 (name "ubi2", size 64 MiB)
ubi0: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
ubi0: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
ubi0: VID header offset: 4096 (aligned 4096), data offset: 8192
ubi0: good PEBs: 256, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 5, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 7/2, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 256, PEBs reserved for bad PEB ha8
Reading from volume 'zyfwinfo' to 0x7fb46210, size 0x400 ... OK
ubi0: detaching mtd8
ubi0: mtd8 is detached
Multiboot clinent version: 2.7
Hit any key to stop autoboot: 5
Password:
Besides the file naming not matching up perfectly in @bezeria instructions, I only reversed the tftp server part which is easier for newbies and downloaded the pre-compiled mtk_uartboot linux binary. Will summarize my changes below, just install a tftp client on the PC host and let the router act as a server, I DO had to disable my firewall for tftp to sent images!
#pc host
#fedora
sudo dnf install tftp
#debian/ubuntu
sudo apt install tftp-hpa
#pc host tftp shell
tftp 192.168.1.1
bin
trace
put openwrt-23.05.4-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
#press enter
# goto EX5601-t1 serial tty shell
tftpsrv
EX5601> tftpsrv
Using ethernet@15100000 device
Listening for TFTP transfer on 192.168.1.1
Load address: 0x46000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################################################
33.2 KiB/s
done
Bytes transferred = 7301992 (6f6b68 hex)
#close pc host tftp client
...
sent DATA <block=14261, 512 bytes>
received ACK <block=14261>
sent DATA <block=14262, 360 bytes>
received ACK <block=14262>
...
q
#pc host login again on ex5601 tty serial
bootm #will boot openwrt in RAM on ex5601
#continue @bezeria steps
This device does now run OpenWrt 23.05.4 thanks to all developers!
@InjectMeneer Can you compare your original bootloader output and check if you closed your active serial/tty shell "minicom/screen" while you push firmware in mtk_uartboot mode to it? Try minicom -s to setup your serial port instead of screen.
Are you sure your serial port is working fine /dev/ttyUSB0 / cu.usbserial-14320 and has all the privileges (sudo)?
You may try a fedora(40) live session, I did all these steps on a fedora mate linux live session.
1 Like
@walterav, Thank you for your helpful comment.
I've come to the conclusion that my serial to usb device is faulty. It became really hot after connecting it, so I trashed it.
As you were saying, the CH341 programmer would've been a very nice candidate, if it wasn't using 5v. So I've modified mine too.
I've connected it to my Windows PC and Mac, and they both ran fine.
I've added some documentation for future reference, which might help future hobbyists to upgrade their Zyxel EX5601-T0/T1 to a firmware that's actually able to fit their needs. It's not to replace previous documentation, it's only an addition.
Note: First of all, be sure to only gather OpenWRT files from the same OpenWRT version.
- connect RJ45 cable between 1gbit port of EX5601-T0/T1
- Set computer IP to 192.168.1.254/255.255.255.0
preparation mtk_uartboot
- Get the latest
mtk_uartbootthat fits your OS: https://github.com/981213/mtk_uartboot/releases and extract the file(s) to a folder. - Download https://downloads.openwrt.org/releases/23.05.4/targets/mediatek/filogic/openwrt-23.05.4-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb (modify OpenWRT version number if needed)
- Rename
openwrt-23.05.4-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itbtoopenwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb - serve
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itbvia tftp service from 192.168.1.254
Note: Make sure you allow port 69 and/or the application in the firewall rules, or disable the firewall temporarily.
Note2: Make sure you test the TFTP service with a TFTP client, to make sure the service actually works (you'll thank me later)
Gathering files
Create a new folder with the following files:
- zyxel_ex5601-t0-ubootmod-bl31-uboot.fip
- zyxel_ex5601-t0-ubootmod-initramfs-factory.ubi
- zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
- zyxel_ex5601-t0-ubootmod-preloader.bin
- zyxel_ex5601-t0-ubootmod-squashfs-sysupgrade.itb
You can find these files here:
- https://downloads.openwrt.org/releases/23.05.4/targets/mediatek/filogic/
- modify version if needed
- files will be downloaded as
openwrt-23.05.4-mediatek-filogic-zyxel_ex5601-t0-ubootmod-<remainder of file name>
And:
- kmod-mtd-rw*_aarch64_cortex-a53.ipk
- You can find this file here:
- https://mirror-03.infra.openwrt.org/releases/23.05.4/targets/mediatek/filogic/kmods/
- modify version if needed
- open the build version on your screen and use the browsers find function to look for
kmod-mtd-rw
- You can find this file here:
Once downloaded, rename all the filenames by removing the version number (example: openwrt-mediatek-filogic*-ubootmod-initramfs-recovery.itb)
Connecting the Serial/uart to router:
-
Pin 1 (3.3v) on router - no need to connect
-
Pin 2 (Tx) on router goes to Rx on your Serial device
-
Pin 3 (Rx) on router goes to Tx on your Serial device
-
Pin 4 (notch) on router
-
Pin 5 (gnd) on router goes to ground on your Serial device
-
rename
openwrt-23.05.4-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fiptoopenwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip -
Put
bl2-mt7986-ddr4-ram.binandopenwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fipinside the same directory asmtk_uartboot(.exe) -
Run
mtk_uartboot.exe --serial COM6 --aarch64 -p bl2-mt7986-ddr4-ram.bin -f openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip
Note: COM6 is the name my serial device has under Windows, /dev/tty.wchusbserial14310 was the device name under MacOS and /dev/ttyUSB0 under Debian. These device names might be different for you.
You should see the message "Handshake...", after which you can power on the EX5601-T0/T1
Now mtk_uartboot should be able to push the files (payload) from its root directory to the router. The pushed bootloader will be started on the router.
Using serial port: COM6
Handshake...
hw code: 0x7986
hw sub code: 0x8a00
hw ver: 0xca01
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0xeefd
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE: BL2: v2.10.0 (release):v2.10.0-mtk
NOTICE: BL2: Built : 13:17:14, Mar 1 2024
NOTICE: WDT: Cold boot
NOTICE: WDT: disabled
NOTICE: CPU: MT7986 (2000MHz)
NOTICE: EMI: Using DDR4 settings
NOTICE: EMI: Detected DRAM size: 1024MB
NOTICE: EMI: complex R/W mem test passed
NOTICE: Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE: Received FIP 0x101369 @ 0x40400000 ...
==================================
After this, it should bring you back to the prompt
Serial connection - baud rate 115200
- Now you need to connect to the router via the serial interface, using a terminal (screen/putty/minicom/etc).
- If the file hasn't been found yet:
- You might want to check if the local firewall has actually been disabled,
- Also check if the filename
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itbhas correctly been set.
Note: The bootloader will retry until you've fixed it:
Loading: *
TFTP error: 'File not found' (1)
Not retrying...
Wrong Image Type for bootm command
ERROR -91: can't get kernel image!
Using ethernet@15100000 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.1
Filename 'openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb'.
Load address: 0x46000000
You'll be able to see if it's booting the openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb file over TFTP
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################################################
2.8 MiB/s
done
Bytes transferred = 7301992 (6f6b68 hex)
## Loading kernel from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'kernel-1' kernel subimage
Description: ARM64 OpenWrt Linux-5.15.162
Type: Kernel Image
Compression: lzma compressed
Data Start: 0x460000ec
Data Size: 3779836 Bytes = 3.6 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x48000000
Entry Point: 0x48000000
Hash algo: crc32
Hash value: b736c825
Hash algo: sha1
Hash value: 2fc05ba58e3317134cc541a2cd331f7e54ae5060
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading ramdisk from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'initrd-1' ramdisk subimage
Description: ARM64 OpenWrt zyxel_ex5601-t0-ubootmod initrd
Type: RAMDisk Image
Compression: uncompressed
Data Start: 0x4639af2c
Data Size: 3495464 Bytes = 3.3 MiB
Architecture: AArch64
OS: Linux
Load Address: unavailable
Entry Point: unavailable
Hash algo: crc32
Hash value: ba5afe98
Hash algo: sha1
Hash value: a8eb27d4ca1d75d96edcba7defd0bccc038f89fb
Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 46000000 ...
Using 'config-1' configuration
Trying 'fdt-1' fdt subimage
Description: ARM64 OpenWrt zyxel_ex5601-t0-ubootmod device tree blob
Type: Flat Device Tree
Compression: uncompressed
Data Start: 0x466f0668
Data Size: 24510 Bytes = 23.9 KiB
Architecture: AArch64
Hash algo: crc32
Hash value: d42eebfd
Hash algo: sha1
Hash value: 4055351dc417adf07e5c178392e57f52660d9921
Verifying Hash Integrity ... crc32+ sha1+ OK
Booting using the fdt blob at 0x466f0668
Working FDT set to 466f0668
Uncompressing Kernel Image to 48000000
Loading Ramdisk to 7e4a2000, end 7e7f7628 ... OK
Loading Device Tree to 000000007e499000, end 000000007e4a1fbd ... OK
Working FDT set to 7e499000
Add 'ramoops@42ff0000' node failed: FDT_ERR_EXISTS
Starting kernel ...
It is booting from RAM now.
Once it's done booting the openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb image, you'll be able to connect via SSH, web and SCP.
I also recommend scp for copying the files to the /tmp dir on the router:
Navigate to the folder with the previously downloaded files
scp ./* root@192.168.1.1:/tmp
You should be seeing this via terminal, after copying:
root@OpenWrt:/tmp# ls
TZ
dhcp.leases
dnsmasq.d
etc
hosts
kmod-mtd-rw_5.15.162+git-20160214-2_aarch64_cortex-a53.ipk
lib
lock
log
luci-indexcache.bf4fbbcc.json
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-factory.ubi
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-initramfs-recovery.itb
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-preloader.bin
openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-squashfs-sysupgrade.itb
resolv.conf
resolv.conf.d
run
shm
state
sysinfo
tmp
From this point, we'll be able to start installing OpenWRT onto the flash.
I found @bezeria 's post (Adding OpenWrt support for Zyxel EX5601-T0 - #305 by bezeria) very helpful.
3 Likes
Hi! I'm planning to follow the mtk_uartboot related process on my EX5601-T1. Is there a way to backup and restore the original firmware? I've read something earlier in this thread about boot slots and I'm not sure if that system is still involved when installing OpenWRT this way.
Unfortunately it does not work for me. When i try to transfer through ftp to the FW folder it transfers few kb and then stops rapidly issuing a QUOTA command so i guess they blocked it in the latest ACDZ.3.2 they blocked it?
I've bought a used EX5601-T0 that is running the stock V5.70(ACDZ.2)C0 firmware. I've downloaded the image openwrt-23.05.5-mediatek-filogic-zyxel_ex5601-t0-stock-squashfs-factory.bin from OpenWRT firmware selector page. However, when trying to upgrade to this image using the firmware upgrade in the Zyxel admin web page, I get the following error:
"Image uploading failed. The selected file is an illegal image."
I thought that since a "factory" image is available, I can just flash that in with the Web UI. Do I need to actually go through all the bootloader unlocking process with a USB TTL adapter? Could we somehow improve the documentation when it comes to the installation procedure?
Does it say anywhere it's doable ?
It's an open source project, feel free to contribute.
Yes, it says on the firmware selector: "Use a Factory image to flash a router with OpenWrt for the first time. You normally do this via the web interface of the original firmware."
I'm more than happy to contribute towards the documentation but I need to understand first how it works.
So you can choose between Zyxel EX5601-T0 (stock layout) and Zyxel EX5601-T0 (OpenWrt U-Boot layout). In which situation would you use one or the other?