[SOLVED] ZyXEL NBG6617 - TFTP flash wont take

Notfast112 · July 28, 2018, 1:26pm

Hi
I followed this : (from https://github.com/chunkeey/LEDE-IPQ40XX/commit/07603a724d5f3d6d7cbba374aa86e637f60ba16c )

first install / debricking / restore stock:
0. Have a PC running a tftp-server @ 192.168.1.99

connect the PC to any LAN-Ports
put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
into the tftp-server root directory and rename it to just "ras.bin".
power-cycle the router and hold down the the WPS button (for 30sek)
Wait (for a long time - the serial console provides some progress
reports. The u-boot says it best: "Please be patient".
Once the power LED starts to flashes slowly and the USB + WPS LEDs
flashes fast at the same time. You have to reboot the device and
it should then come right up.

But still after 30 min only power led is flashing and usb led is lit up all the time.
I´m not connected to serial console, so I cant see progress - should I wait more then 30 min?
If I power off and on, then it just boot original firmware.

TFTP server says upload is suscesful every time I try.

Thank you for your help.

slh · July 28, 2018, 8:19pm

Try to put an unmanaged switch between your router and the tftp server, extrapolating from my experiences with the nbg6817, the tftp window is very small (3s) and link training might take too long - a switch keeps the link to your computer up, even if the router is powered off or rebooting, and might give you some crucial time.

Notfast112 · July 28, 2018, 8:22pm

Thank you for your respond.
The tftp server clearly say success uploading
But I'll try your solution.
I'll report back.

Notfast112 · July 28, 2018, 10:16pm

Okay.
Same result.
TFTP server finish uploading (I see 100% and after a sec or two connection closes).
But still after 30 min only power led is flashing and usb led is lit up all the time.

I tried using Zyxwl's GUI and uploading the same file as the one I tried for tftp, but I get this error:

Firmware upgrade error...
The flash image upload failed. The error messages are as follows:
Wrong Project Name Wrong firmware image header!

Notfast112 · July 29, 2018, 8:18am

Okay a short update.
I tried this again :

connect the PC to any LAN-Ports
put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file
into the tftp-server root directory and rename it to just "ras.bin".
power-cycle the router and hold down the the WPS button (for 30sek)

But this time I let go of WPS button when tftp server starts sending the file (it starts sending after ~10 seconds).

I tried with and with out a switch - still no luck.
Still after 30 min only power led is flashing and usb led is lit up all the time.

chunkeey · July 29, 2018, 1:05pm

I guess you would need to attach a serial console, in order to see what the device is doing. It could be something related to the tftp-server you are using, some have problems with the "binary" mode... I'm using the standard tftpd-hpa server that comes with debian (sid) 5.2+20150808-1+b1.

But... you might as well not bother with tftp. Because David Bauer decided to change the image creation code for the the official openwrt snapshot factory.bin images to make it possible to flash them via the web-interface on the stock firmware. Just follow the steps under the "Installation via Web-UI" topic.

github.com/openwrt/openwrt

ipq40xx: add support for the ZyXEL NBG6617

committed 06:57AM - 26 Jun 18 UTC

chunkeey

+676 -2

This patch adds support for ZyXEL NBG6617 Hardware highlights: SOC: IPQ4018… / QCA Dakota CPU: Quad-Core ARMv7 Processor rev 5 (v7l) Cortex-A7 DRAM: 256 MiB DDR3L-1600/1866 Nanya NT5CC128M16IP-DI @ 537 MHz NOR: 32 MiB Macronix MX25L25635F ETH: Qualcomm Atheros QCA8075 Gigabit Switch (4 x LAN, 1 x WAN) USB: 1 x 3.0 (via Synopsys DesignWare DWC3 controller in the SoC) WLAN1: Qualcomm Atheros QCA4018 2.4GHz 802.11bgn 2:2x2 WLAN2: Qualcomm Atheros QCA4018 5GHz 802.11a/n/ac 2:2x2 INPUT: RESET Button, WIFI/Rfkill Togglebutton, WPS Button LEDS: Power, WAN, LAN 1-4, WLAN 2.4GHz, WLAN 5GHz, USB, WPS Serial: WARNING: The serial port needs a TTL/RS-232 3.3v level converter! The Serial setting is 115200-8-N-1. The 1x4 .1" header comes pre-soldered. Pinout: 1. 3v3 (Label printed on the PCB), 2. RX, 3. GND, 4. TX first install / debricking / restore stock: 0. Have a PC running a tftp-server @ 192.168.1.99/24 1. connect the PC to any LAN-Ports 2. put the openwrt...-factory.bin (or V1.00(ABCT.X).bin for stock) file into the tftp-server root directory and rename it to just "ras.bin". 3. power-cycle the router and hold down the the WPS button (for 30sek) 4. Wait (for a long time - the serial console provides some progress reports. The u-boot says it best: "Please be patient". 5. Once the power LED starts to flashes slowly and the USB + WPS LEDs flashes fast at the same time. You have to reboot the device and it should then come right up. Installation via Web-UI: 0. Connect a PC to the powered-on router. It will assign your PC a IP-address via DHCP 1. Access the Web-UI at 192.168.1.1 (Default Passwort: 1234) 2. Go to the "Expert Mode" 3. Under "Maintenance", select "Firmware-Upgrade" 4. Upload the OpenWRT factory image 5. Wait for the Device to finish. It will reboot into OpenWRT without any additional actions needed. To open the ZyXEL NBG6617: 0. remove the four rubber feet glued on the backside 1. remove the four philips screws and pry open the top cover (by applying force between the plastic top housing from the backside/lan-port side) Access the real u-boot shell: ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02" When the device is starting up, the user can enter the the loader shell by simply pressing a key within the 3 seconds once the following string appears on the serial console: | Hit any key to stop autoboot: 3 The user is then dropped to a locked shell. |NBG6617> HELP |ATEN x[,y] set BootExtension Debug Flag (y=password) |ATSE x show the seed of password generator |ATSH dump manufacturer related data in ROM |ATRT [x,y,z,u] RAM read/write test (x=level, y=start addr, z=end addr, u=iterations) |ATGO boot up whole system |ATUR x upgrade RAS image (filename) |NBG6617> In order to escape/unlock a password challenge has to be passed. Note: the value is dynamic! you have to calculate your own! First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env) to get the challange value/seed. |NBG6617> ATSE NBG6617 |012345678901 This seed/value can be converted to the password with the help of this bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors): - tool.sh - ror32() { echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) )) } v="0x$1" a="0x${v:2:6}" b=$(( $a + 0x10F0A563)) c=$(( 0x${v:12:14} & 7 )) p=$(( $(ror32 $b $c) ^ $a )) printf "ATEN 1,%X\n" $p - end of tool.sh - |# bash ./tool.sh 012345678901 | |ATEN 1,879C711 copy and paste the result into the shell to unlock zloader. |NBG6617> ATEN 1,0046B0017430 If the entered code was correct the shell will change to use the ATGU command to enter the real u-boot shell. |NBG6617> ATGU |NBG6617# Co-authored-by: David Bauer <mail@david-bauer.net> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: David Bauer <mail@david-bauer.net>

(Never tested it myself though, but I think you can write him a mail, if you run into any issue with the web-ui flash.)

Notfast112 · July 29, 2018, 5:23pm

Thank you for your respond.

Web flash do no work - see previous reply from me.

I tried some other tftp servers - no luck.

Sadly I turned off the router when it was download, and not it wont boot or respond to tftp server
Stupid me!
It will respond to ping.

What is David Bauer handel? I'll like to tag him for the web gui update error.

chunkeey · July 29, 2018, 7:14pm

Wrong Project Name Wrong firmware image header!

Can you upload/link the exact file you have been using there?
(As well as a sha256sum)? I can test it with the NBG6617 and
see what's on the serial console there.

Well, you could try to respond to the github PR. But I don't know if he's reading this forum. When in doubt you could write a mail to the e-mail address he used on the PR.

Notfast112 · July 29, 2018, 8:05pm

Thank you
This is the file I downloaded (and renamed to ras.bin) ras.bin
sha256: 33F3134CF18D0A8417E6F2104091C97E226A2DF128E92826BE4AE5F15C9CBCE3

Both router where on org. firmware V1.00(ABCT.6)C0 I tried downgrade to the oldest one V1.00(ABCT.5)C0
(October 27, 2017) stil no luck in Zyxel web gui or tftp - I have tried 3 different tftp software, and all of the made it to 100% every time.

I'll send him an email.

thank you for your time.

chunkeey · July 29, 2018, 8:54pm

Ok. I looked at the image and it is clearly broken. I looked up the builder log:

http://phase1.builds.lede-project.org/builders/ipq40xx%2Fgeneric/builds/163/steps/images/logs/stdio

> >/var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 114: "41150" >> 24 | ("41150" & 0xff0000) >> 8 | ("41150" & 0xff00) << 8 | ("41150" & 0xff) << 24 : syntax error: operand expected (error token is ""41150" >> 24 | ("41150" & 0xff0000) >> 8 | ("41150" & 0xff00) << 8 | ("41150" & 0xff) << 24 ")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 114: "20316160" >> 24 | ("20316160" & 0xff0000) >> 8 | ("20316160" & 0xff00) << 8 | ("20316160" & 0xff) << 24 : syntax error: operand expected (error token is ""20316160" >> 24 | ("20316160" & 0xff0000) >> 8 | ("20316160" & 0xff00) << 8 | ("20316160" & 0xff) << 24 ")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 135: "" & 0xff: syntax error: operand expected (error token is """ & 0xff")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 136: >> 8: syntax error: operand expected (error token is ">> 8")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 135: "" & 0xff: syntax error: operand expected (error token is """ & 0xff")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 136: >> 8: syntax error: operand expected (error token is ">> 8")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 114: "53034" >> 24 | ("53034" & 0xff0000) >> 8 | ("53034" & 0xff00) << 8 | ("53034" & 0xff) << 24 : syntax error: operand expected (error token is ""53034" >> 24 | ("53034" & 0xff0000) >> 8 | ("53034" & 0xff00) << 8 | ("53034" & 0xff) << 24 ")
> cp /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx/tmp/openwrt-ipq40xx-zyxel_nbg6617-squashfs-sysupgrade.bin /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/bin/targets/ipq40xx/generic/openwrt-ipq40xx-zyxel_nbg6617-squashfs-sysupgrade.bin
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 114: "2248620" >> 24 | ("2248620" & 0xff0000) >> 8 | ("2248620" & 0xff00) << 8 | ("2248620" & 0xff) << 24 : syntax error: operand expected (error token is ""2248620" >> 24 | ("2248620" & 0xff0000) >> 8 | ("2248620" & 0xff00) << 8 | ("2248620" & 0xff) << 24 ")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 135: "" & 0xff: syntax error: operand expected (error token is """ & 0xff")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 136: >> 8: syntax error: operand expected (error token is ">> 8")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 135: "" & 0xff: syntax error: operand expected (error token is """ & 0xff")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 136: >> 8: syntax error: operand expected (error token is ">> 8")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 135: "" & 0xff: syntax error: operand expected (error token is """ & 0xff")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 136: >> 8: syntax error: operand expected (error token is ">> 8")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 114: "56991" >> 24 | ("56991" & 0xff0000) >> 8 | ("56991" & 0xff00) << 8 | ("56991" & 0xff) << 24 : syntax error: operand expected (error token is ""56991" >> 24 | ("56991" & 0xff0000) >> 8 | ("56991" & 0xff00) << 8 | ("56991" & 0xff) << 24 ")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 135: "" & 0xff: syntax error: operand expected (error token is """ & 0xff")
> /var/lib/buildbot/slaves/slashdirt-02/MAIN/build/scripts/make-ras.sh: line 136: >> 8: syntax error: operand expected (error token is ">> 8")

so it's clear that the builder hit a problem in the make-ras.sh's to_be32. The question is what's the cause? A incompatible bash interpreter, or an obsolete bash? @jow (can you tell me what the distro + packages the slashdirt builder
are running?)

As for a fix: I did update the make-ras.sh script in my LEDE-IPQ40XX (the OpenWrt version is older) a while long ago (maybe 2-3 month now?) to address issues that came up when I was testing the script with OpenWrt's busybox and goodol' Mac OS X 10.5' bash.

I opted to integrate the to_be32 and append_bin into a new append_be32() that worked on all DUTs.

updated make-ras.sh - wait for it to load fully

Notfast112 · July 29, 2018, 9:25pm

Thank you.

So just to make it clear to me, there is a fix for next time it gets build?

Update:
David Bauer provided me with the first firmware he made for NBG6617, and that flashed via tftp no problem!

So now I just need to unbrick the one router I turn off while it was receiving the firmware from tftp server.

Notfast112 · July 30, 2018, 1:46pm

Short update:

This morning powering NBG6617 backup it had returned to ZyXEL's firmware.

I flashed the factory upgrade firmware provided by David Bauer using tftp server - and the router works with openwrt, I did my setting, and I pulled power for 12 mins, and this time it loaded openwrt like it should.

Is this one of them routers that need double firmware upgrading for it to stick?

chunkeey · July 30, 2018, 5:38pm

No? One install should be enough.

As for the issue

webupgrade to last snapshot from openwrt will upload and reboot router, but
it will not come back online!

I think this has been fixed by this:
https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=3dd692cd6b5643a1d3415eedc4f8a6736e9979da

Notfast112 · July 30, 2018, 5:56pm

Thank you.

First one is so fare running fine.

To recap for others : just flash though ZyXEL web gui as normal.

I'll mark as solved.

system · August 6, 2018, 5:56pm

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.