Zte zxhn h369a


I got ZTE ZXHN H369A, there is no much information about it on Openwrt or other sources except some information on Tech Info Depot, You can check this link for basic information, but it does not have info about CPU, WLAN / Eth Chips, RAM, Flash, etc.

So, I opened the case and her below the additional information I have so far:

CPU: Broadcom BCM63138 VKFSBG
RAM: 512MB - NANYA DDR3L 1625 NT5CC256M16DP-DI 616589WDEF 3 TW (Memory Word = 16)
Flash: 512MB - Micron NAND 29F4G08ABADA WP
Bootloader: CFE (I guess)

There is Serial pins already so no soldering is needed.
Such serial pins can be found behind the USB port, the one close to the two green PSTN ports.

I connected the serial to the laptop, but only the following was shown:


I do not know why there is no more boot logs shown, is it because of bootloader security feature or something else??!!

Here below the fotos I took for the router.

Uh, another Broadcom-based device...
According to this (i don't know if this page is up-to-date) , this SoC ist still not supported in OpenWrt.
And considering the lack of open source drivers for Broadcom chips, i don't know if it's a good idea to spend too much time with devices like these...

Well, that's just my humble opinion.

I know the issue with Broadcom,

My main issue at the moment is: why I do not get boot-loader logs? what is the problem? Any Idea?

No, sorry no idea from my side.

If i remember right, i think i've seen something like this some years ago on a Broadcom-based set-top-box.
My guess is, they just disabled the normal boot messages or send them straight to /dev/nul.

Just found this one.
It seems, that's the typical Broadcom boot log
I was missing the part where there were additional boot messages on other devices, an none on this one...
Either a "security" measure (to secure their intellectual property?) or just "You do not need to know this".

That is also my guess, especially the same problem happens on ZXHN H368N router I have.

In the beginning; I thought it was a serial-TTL cable issue, but when I changed the cable, the problem still there. So it is not a cable issue. I guess they made something with boot-loader security.

The boot-loader is CFE (I think) not U-Boot!

EDIT (1):
Now I am sure it is CFE boot-loader. What I did is I turned off the router then pressed Reset button at start-up for 6 seconds. the router has very tiny webserver in this case (micro_httpd), with telnet to the router on port 80 I got the following

it is clear that it is CFE based bootloader router.

also, when the router is in this mode, you can try on web-browser but it asked for username and password which are unknown. I tried many combinations of username/password but in vain :frowning:


I got the firmware dump from a NAND programmer, the binary file, I made some investigations and I got the following information

Architecture: ARM Cortex A9 Dual Core
Board IP address :[:ffffff00]
Host IP address :
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel

I would like to run SNAPSHOT image on this router but i do not know how, can someone help.

Any suggestions are appreciated

Here below the full text of some string command run on dump binary file of the firmware

I have successfully extracted some partitions from firmware using binwalk utility,

:~/Documents/ZTE$ binwalk -B flashdata.bin 

1310720       0x140000        JFFS2 filesystem, little endian
11882872      0xB55178        Copyright string: "Copyright (C) 2000-2013 Broadcom Corporation."
11884000      0xB555E0        HTML document header
11884135      0xB55667        HTML document footer
11889708      0xB56C2C        PEM DSA private key
11971644      0xB6AC3C        CRC32 polynomial table, little endian
11976636      0xB6BFBC        HTML document header
11978141      0xB6C59D        HTML document footer
11978156      0xB6C5AC        HTML document header
11979582      0xB6CB3E        HTML document footer
13799848      0xD291A8        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 8269518 bytes, 1236 inodes, blocksize: 131072 bytes, created: 2016-06-09 05:09:52
52777336      0x3255178       Copyright string: "Copyright (C) 2000-2013 Broadcom Corporation."
52778464      0x32555E0       HTML document header
52778599      0x3255667       HTML document footer
52784172      0x3256C2C       PEM DSA private key
52866108      0x326AC3C       CRC32 polynomial table, little endian
52871100      0x326BFBC       HTML document header
52872605      0x326C59D       HTML document footer
52872620      0x326C5AC       HTML document header
52874046      0x326CB3E       HTML document footer
54694312      0x34291A8       Squashfs filesystem, little endian, version 4.0, compression:xz, size: 8269518 bytes, 1236 inodes, blocksize: 131072 bytes, created: 2016-06-09 05:09:52

Afterwards; I was able to extract what is seemed to be the root file system, it is XZ compressed file which can be decompressed by 7z utility

the output of 7z l extractedfs is detailed in this link

If some one interested to help in exploring and trying to port Openwrt to this router, feel free to send me a PM or reply to me here.

I think source code of CFE and Linux Kernel development for H369A may be deduced / speculated from following repo.

It is true that the Repo is for Asus but the source code needs to be investigated further to see if modifications help in porting OpenWrt to this device

Work in progress ........

1 Like