OpenWrt support for Zyxel PMG5617GA, first GPON support !?

A new firmware isn’t impossible but I get the feeling that the firmware has oem provided .ko for the hardware, especially if it’s using that old kernel version.

Got the .ko files.

At the same time, I've realized I have no idea what I am doing. I've made a password decrypter with ghidra if I can't use the CLI exploits.
I have the EN75xx files, which seem to have the kernel stuff in it, if OpenWRT stores kernels at /target/.../base-files (i have no idea)

I tried searching for people that have documented hacking and installing openwrt for dummies, came up short. Is there a forum thread that has documented any router install process or github?

If not, that's fine. I clearly lack so many fundamentals to this process that I'm quite excited to try. I'll probably wait until I get back home, so I can have some feedback from the router itself. And do (a bunch) of reading on bootloaders.

Normally the steps should be:

  1. Research your router architecture and gather files (gpl, firmwares, patches, etc).
  2. Do a full dump of your mtd flash for backup.
  3. Compile an OpenWrt kernel for your architecture and attach relevant patches if needed.
  4. On your router's unlocked bootloader, copy the OpenWrt kernel in RAM and boot from there. On econet, it starts at 0x80020000 (This is a trial-and-error step as the perfect build needs the right patches to function completely)
  5. Once you perfected your build (kernel, boot, init...), compile a full .sysupgrade and flash it to mtd partitions permanently using TFTP.

I have a similar device, based on EN7528 using mt7663 and mt7603 for 5g and 2.4g wifi respectively. The firmware seems to be based on linux 3.18 but I have seen firmware images for these devices with linux 4.14. I have the firmware, device and the nand dump. How can I help with this development?

What brand and model is it?

Genexis Titanium T21A --- the one i described above
Richerlink RL821GWV-DB based on EN7526GT
and a Nokia G-2425-A which are similar to those with different wifi chips
For the first two I have seen firmwares with linux version above 3.8, maybe the support will be better?

Hi, I can help with Nokia G-140W-C

CPU: EcoNet EN7526GT MIPS 34Kc V5.8 @900MHz
WLAN: MediaTek MT7602EN/MT7612EN
Originally was in use by Vivacom provider, now I am trying to convert it for use on a different provider.

Please let me know how I can help, I have two or more unites since here the secondhand blackmarket is quite strong right now.


start by scrolling up 11 posts, or so.

Please be more specific. I can't login to webinterface with '; /bin/sh; # and there is no ssh or telnet. I haven't been able to access a uboot IP adress if such a thing even exists. (previously was reflashing CPEs through Broadcoms CFE). '; /bin/sh; # that's not meant literally just to paste it in the weblogin is it ? Give me a hint please.

Maybe we can OMCI through LAN or should I buy a GPON head to do the OMCI ?

OMCI is only a way for the router to get setup information from the OLT (VLAN ID, ALLOC-ID, GEM PORT...). Don't really need it now. Better start by tapping onto the UART pins and try to see what can commands you can execute. My router doesn't support tftp for quick kernel tests.

Also enroute to my evil hacker mind is G-2425G-A if that's of any help.

A1 telecom use Huawei which sets many things through the OMCI including the accounts. That could be Huawei specific management backdoor.

I don't wanna UART right now as I havent' setup my hardware hacking station yet.

I prefer to try to go in through the front door web and upnp. As well as through bootloader if it listens on LAN for firmwares.

I can also get any thing from bazar bg and olx bg and probably other places for opensourcing the device.


bro it's the same chip as the XR500v and I have the gpl code, what changes is the 5G and the ports are gigabit

Dropping this repo as I found some more details about its custom Uboot(TCboot):

Notice there is some sweet PDF documentation on the inner workings of its SoC. I believe that's the entire SDK.

1 Like