Hello folks,
First of all, Happy New Year! All the best!
I am asking for help here as I have run out of other options.
I recently came across routers branded Smartcom GE DB, originally supplied by the ISP Vivacom and A1 in Bulgaria. Internally these devices appear to be ZBT-WG108 units with the exception that they lack the USB and card reader ports found on the retail models seen on the internet.
The routers ship with a custom ISP firmware. Since this firmware is no longer provided or supported by the ISP, I decided to try installing OpenWrt.
Flashing OpenWrt 24.10.5 from the stock web interface was not possible, which is expected because there is no compatible factory image.
My next step was to boot an initramfs kernel image via TFTP and then flash a sysupgrade image from there.
After flashing, the device fails to boot and reports LZMA ERROR 1.
For reference, I do have UART access.
At this point I am not certain what the underlying issue is, so I would appreciate any guidance.
As an additional test I flashed the ZBT OS (WG108_V21.08.06.bin) downloaded from:
This firmware boots successfully, but it is unstable: the router reboots randomly without any obvious reason, and no crash information is printed on the serial console. Flashing the current OpenWrt sysupgrade image also fails to flash from the ZBT OS gui with a message: incorrect file type.
The original OEM firmware is built with the following kernel:
Linux version 2.6.36 (root@bd7077da2eec) (gcc version 3.4.2) #1 SMP Sat Nov 26 08:11:34 UTC 2022
The device uses U-Boot 1.1.3 (Nov 7 2018 - 15:28:09), and uses the following MTD partition layout:
root@ralink# cat /proc/mtd
dev: size erasesize name
mtd0: 01000000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00fb0000 00010000 "Kernel"
The ZBT OS (LEDE Reboot (17.01.7, r4030-6028f00df0)) kernel and MTD layout are different:
root@Router:/# uname -a
Linux Router 4.4.182 #0 SMP Thu Jun 20 10:53:53 2019 mips GNU/Linux
root@Router:/# cat /proc/mtd
dev: size erasesize name
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "factory"
mtd3: 00fa0000 00010000 "firmware"
mtd4: 00187635 00010000 "kernel"
mtd5: 00e189cb 00010000 "rootfs"
mtd6: 00730000 00010000 "rootfs_data"
mtd7: 00010000 00010000 "art"
Finally, this is the UART boot log after flashing 24.10.5:
U-Boot 1.1.3 (Nov 7 2018 - 15:28:09)
Board: Ralink APSoC DRAM: 128 MB
rt2880 uboot v0.00e04 05/25/2006
SERIAL_CLOCK_DIVISOR =16
kaiker,,CONFIG_BAUDRATE =57600
SDRAM SIZE:08000000
Top of RAM usable for U-Boot at: 88000000
Reserving 368k for U-Boot at: 87fa0000
Reserving 260k for malloc() at: 87f5f000
Reserving 44 Bytes for Board Info at: 87f5efd4
Reserving 36 Bytes for Global Data at: 87f5efb0
Reserving 128k for boot params() at: 87f3efb0
Stack Pointer at: 87f3ef98
relocate_code Pointer at: 87fa0000
Config XHCI 40M PLL
******************************
Software System Reset Occurred
******************************
Now running in RAM - U-Boot at: 87fa0000
monitor_flash_len =154308
Command "rf": 0xbfc01f38 => 0x87fa1f38
Command "mdio": 0xbfc0be2c => 0x87fabe2c
Command "spi": 0xbfc0d948 => 0x87fad948
Command "erase": 0xbfc0d374 => 0x87fad374
Command "cp": 0xbfc0df50 => 0x87fadf50
Command "nand": 0xbfc133e8 => 0x87fb33e8
Command "reset": 0xbfc1c2cc => 0x87fbc2cc
Command "go": 0xbfc14c9c => 0x87fb4c9c
Command "bootm": 0xbfc150ec => 0x87fb50ec
Command "loadb": 0xbfc15c60 => 0x87fb5c60
Command "tftpboot": 0xbfc1627c => 0x87fb627c
Command "nm": 0xbfc16918 => 0x87fb6918
Command "mm": 0xbfc1697c => 0x87fb697c
Command "md": 0xbfc169e0 => 0x87fb69e0
Command "saveenv": 0xbfc16f58 => 0x87fb6f58
Command "setenv": 0xbfc17974 => 0x87fb7974
Command "printenv": 0xbfc16fa8 => 0x87fb6fa8
Command "?": 0xbfc17c48 => 0x87fb7c48
Command "help": 0xbfc17c48 => 0x87fb7c48
Command "version": 0xbfc17b08 => 0x87fb7b08
flash manufacture id: ef, device id 40 18
find flash: W25Q128BV
============================================
UBoot Version: 1.0
--------------------------------------------
ASIC MT7621A DualCore (MAC to MT7530 Mode)
DRAM_CONF_FROM: Auto-Detection
DRAM_TYPE: DDR2
DRAM bus: 16 bit
Xtal Mode=3 OCP Ratio=1/4
Flash component: SPI Flash
Date:Nov 7 2018 Time:15:28:09
============================================
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:256, ways:4, linesz:32 ,total:32768
##### The CPU freq = 1000 MHZ ####
estimate memory size =128 Mbytes
set LAN/WAN LLLLW
Please choose the operation:
1: Load system code to SDRAM via TFTP.
2: Load system code then write to Flash via TFTP.
3: Boot system code via Flash (default).
4: Entr boot command line interface.
5: Load system code then write to Flash via Httpd.
7: Load Boot Loader code then write to Flash via Serial.
9: Load Boot Loader code then write to Flash via TFTP. 0
3: System Boot system code via Flash.
## Booting image at bfc50000 ...
Image Name: MIPS OpenWrt Linux-6.6.119
Image Type: MIPS Linux Kernel Image (lzma compressed)
Data Size: 3183140 Bytes = 3 MB
Load Address: 80001000
Entry Point: 80001000
Verifying Checksum ... OK
Uncompressing Kernel Image ... LZMA ERROR 1 - must RESET board to recover
hxq:reset
The kernel size is wrong. When booting from TFTP into SDRAM, the kernel size is 6.9 MB.
I can provide additional logs from the serial console if needed.
Any help would be greatly appreciated.
