Bricked Zyxel EX5601-T1/T-56

[wirl]

Somehow managed to brick the router, it's pretty dead. Seems the nand is stuck in read only. It boot loops with this on serial:

F0: 102B 0000
FA: 1040 0000
FA: 1040 0000 [0200]
F9: 0000 0000
L0: 3901 0031 [0001]
00: 1012 0000
F9: 0000 0000
L0: 3901 0031 [0001]
01: 102A 0001
02: 1012 0000
BP: 2000 00C0 [0001]
EC: 0000 0000 [1000]
T0: 0000 00B9 [010F]
System halt!

I can still sort of use mtk_uartboot...

$ sudo mtk_uartboot --aarch64 -s /dev/ttyUSB0 -p mt7986-ram-ddr4-bl2.bin -f openwrt-mediatek-filogic-zyxel_ex5601-t0-ubootmod-bl31-uboot.fip 
mtk_uartboot - 0.1.1
Using serial port: /dev/ttyUSB0
Handshake...
hw code: 0x7986
hw sub code: 0x8a00
hw ver: 0xca01
sw ver: 0x1
Baud rate set to 460800
sending payload to 0x201000...
Checksum: 0x503b
Setting baudrate back to 115200
Jumping to 0x201000 in aarch64...
Waiting for BL2. Message below:
==================================
NOTICE:  BL2: v2.10.0	(release):OpenWrt v2024.01.17~bacca82a-3 (mt7986-ram-ddr4)
NOTICE:  BL2: Built : 13:32:43, Jan 27 2025
NOTICE:  WDT: Cold boot
NOTICE:  WDT: disabled
NOTICE:  CPU: MT7986 (1998MHz)
NOTICE:  EMI: Using DDR4 settings
NOTICE:  EMI: Detected DRAM size: 1024MB
NOTICE:  EMI: complex R/W mem test passed
NOTICE:  Starting UART download handshake ...
==================================
BL2 UART DL version: 0x10
Baudrate set to: 921600
FIP sent.
==================================
NOTICE:  Received FIP 0x1021b9 @ 0x40400000 ...
==================================

But it does not load any files from the tftp server and no attempts either. The network config is correct and worked before. I can load firmware's from other routers from the same tftp server. The server will also log download attempts and none are being made. The network port on the router still lights up though.

Serial console shows this message repeating and scrolling really fast:

ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB 1641:0, read only 64 bytes, retry
ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB 1641:0, read only 64 bytes, retry
ubi0 warning: ubi_io_read: error -74 (ECC error) while reading 64 bytes from PEB 1641:0, read only 64 bytes, retry

The number increase and it never seems to finish. I guess it is trying to free up space before downloading the firmware and fails? No idea if this is fixable or not.

Happy to hear what you think!

[Dante]

Did you try loading files from a USB drive?

[wirl]

Sorry, I'm confused, how would I load files from usb? Is there a recovery method that can load the firmware from a usb stick?

[Dante]

I meant the instructions from the wiki and then using the USB method:

https://openwrt.org/toh/zyxel/t-56

[wirl]

My router is bricked. It can't even boot. I don't know what you're trying to tell me.

[Dante]

You said mtk_uartboot works, so try the instructions from the wiki and follow the USB method, instead of the TFTP one.

[wirl]

It does not work cuz when I open the serial it scrolls the read only message I posted earlier and no image is being loaded form tftp. I explained it all in my post? Sorry if I did a bad job.

[wirl]

Ok, so the endless read only error message scrolling was not endless after all but it did take over 10 minutes before some other messages showed. Then another few minutes passed and the router collected the firmware from the tftp server:

Took another 5-15 minutes before it was done and I could actually login! I'm not sure how long it took exactly because I went to make tea.

I am not sure why it was so slow but at least it wasn't a hard brick, which is great! And good to know it can take a very long time in cases like this to boot up the recovery image. Also does not help my recovery image is almost 20mb instead of the default less than 10mb, but I want my Luci in the recovery image too haha.

tl;dr problem solved with by giving it a lot more time to boot and do it's thing.