ZTE ZXHN H368N creating OpenWrt image

danieI · December 12, 2019, 9:03am

Hi,

I own a ZTE ZXHN H368N router with original firmware installed. I have a background in assembly and various programming languages, but no knowledge abould building openwrt for routers. I want to build openwrt for this router, can someone give me a list with things to do to create it? I uploaded photos. If the post is in the wrong place please delete it or if you can move it to the right section.

Thank you for all your help,

Update:
It is already running Linux

Host is up (0.017s latency).
Not shown: 97 closed ports
PORT STATE SERVICE
23/tcp open telnet
80/tcp open http
443/tcp open https
MAC Address: xx:xx:xx:xx:xx:xx (zte)
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6
OS details: Linux 2.6.9 - 2.6.30
Network Distance: 1 hop

danieI · December 12, 2019, 9:03am

danieI · December 12, 2019, 9:04am

tmomas · December 12, 2019, 10:18am

This device is currently not supported by OpenWrt.

-> https://openwrt.org/toh/zte/zte_zxhn_h368n

danieI · December 12, 2019, 11:43am

Yes, I already know about it. But the chip is a Broadcom 63... that is supported. What kind of information should I gather so I can build an openwrt image for it?
Thank you for your reply.

tmomas · December 12, 2019, 1:42pm

See https://openwrt.org/faq/how_can_i_add_support_for_a_new_device

danieI · April 19, 2020, 12:26pm

Hi,

So I manage to break into H368N telnet. This is all the commands. Maybe someone can direct me further?

Thank you!

update:
this is another screenshot

Another update:

this is the cpu info:

# cat /proc/cpuinfo
system type             : 963268MBV
processor               : 0
cpu model               : Broadcom4350 V8.0
BogoMIPS                : 399.36
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 8058220
processor               : 1
cpu model               : Broadcom4350 V8.0
BogoMIPS                : 402.43
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
ASEs implemented        :
shadow register sets    : 1
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available

unaligned exceptions            : 8058220

Another update:

I can use wget and pretty much all linux commands.

And this is the kernel version:

Linux version 2.6.30 (xialei@localhost.localdomain) (gcc version 4.4.2 (Buildroot 2010.02-git) ) #2 SMP PREEMPT Thu Feb 21 18:06:33 CST 2013

And these are the modules installed:

ohci_hcd 22336 0 - Live 0xc0e94000
ehci_hcd 36672 0 - Live 0xc0e7c000
wl 1185776 0 - Live 0xc0cc3000 (P)
option 11888 0 - Live 0xc0b4b000
usbserial 30816 1 option, Live 0xc0b37000
si3217x_h201n 85968 0 - Live 0xc085f000
usr_line 19648 5 si3217x_h201n, Live 0xc0838000
endpointdd 3510864 0 - Live 0xc04d2000 (P)
switch_rtl8367b 256512 0 - Live 0xc02cd000 (P)
bcm_enet 141840 1 wl, Live 0xc0262000
adsldd 436976 0 - Live 0xc01c1000 (P)
bcmxtmcfg 71568 1 adsldd, Live 0xc014b000 (P)
bcmfap 118256 1 bcm_enet, Live 0xc00ec000 (P)
bcm_bpm 224896 0 [permanent], Live 0xc006b000 (P)

danieI · April 19, 2020, 2:49pm

This is the entire log:
https://pastebin.com/LJQL8NkN

danieI · April 20, 2020, 10:22am

I created an image for generic board bcm963268bu but when I try to install it, I get this message: Integrity check failed.
I also built a generic image for bc63*** and the result is the same.

What am I doing wrong?

danieI · April 20, 2020, 1:11pm

I made a copy of the file system

https://gofile.io/?c=518tJL

the archive is 60MB, but unarchived shows around 2GB.

Joshua · April 20, 2020, 7:13pm

Can you post the output of dmesg and 'lspci -vvv'?

danieI · April 20, 2020, 7:42pm

Busybox kernel on this router is compiled with very limited commands. It does not have dmesg or lspci.
These are all the commands it has:

Built-in commands:

    . : break cd chdir continue eval exec exit export false hash
    help local pwd read readonly return set shift times trap true
    type ulimit umask unset wait [ ash brctl busybox cat chmod cp
    date df echo free fuser getty hostname ifconfig init insmod kill
    killall linuxrc ln login ls lsmod mkdir mknod mount mv passwd
    ping ping6 ps pwd reboot rm rmdir rmmod sh test tftp top traceroute
    umount wget

I also sent an email to zte to release the kernel source code, being linux, zte is forced to open the source code under GPL.

danieI · April 21, 2020, 9:29am

No luck, they told me to contact the place where I purchased this router. I will contact the online store where I purchased it from but I doubt the online store knows what a linux kernel is.

Too bad because the router would be great for openwrt.
It has 16+16MB flash mem, 128MB RAM, a dual thread 400Mhz MIPS and Gigabit Ethernet.

Joshua · April 22, 2020, 3:47am

You could try building your own BusyBox binary to include those utilities, and maybe more. I know this would be annoying, but it would allow you to collect more info.

danieI · April 22, 2020, 4:31am

I already tried to cross compile those binaries. It gives me an error when I run in router's BusyBox. I haven't really had the time to research the error.

Joshua · April 22, 2020, 4:50am

It's probably because it has dependencies on libraries that are not available on the device. You could take it to the next level and statically link the BusyBox binary.

saladin · May 20, 2023, 5:52am

where are you in the work on this router so far? any progress?

saladin · May 21, 2023, 12:31am

I tried to connect through serial and I only got the following:


HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
----
PHYS
STRF
400H
PHYE
DDR2
SIZ4
SIZ3
SIZ2
DINT
USYN
LSYN
MFAS
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
++++
HEAD
HEAD
FIND
MGIC
LOAD

Nothing else is shown, the router does not show any further boot loader activities. Just blank screen and not responsive to any anything. However the router works fine and I can login to its web interface.

Do you think the boot loader is protected from showing anything?

danieI · May 22, 2023, 3:36pm

Hi Saladin,

I no longer use this router. I got one that supports openwrt.

Good luck!

saladin · May 22, 2023, 5:09pm

I have this router now, but apparently the ISP updated the firmware where no one can login or change anything. Even the recovery web-page does not work and it is password protected
Thank you for response anyway!