INFO added 20151223: into Normal booting part it has been added available list of hidden AT cmds after enabling DebugFlag and also memMapTab.
The device has available two various Bootbase into which you can boot.
1) Normally booting mode:
Bootbase detects and initiates only 16MiB RAM.
Bootbase Version: VTC_SPI_4M1.10 | 2010/06/03 09:32:52
RAM: Size = 16384 Kbytes
DRAM POST: Testing: 16384K
OK
Found SPI Flash 4MiB MX25L3205D(06E) at 0xbfc00000
RAS Version: 3.40(TSP.4)b2
Press any key to enter debug mode within 3 seconds.
.........................
Enter Debug Mode
atsh
RAS Version : 3.40(TSP.4)b2
Bootbase Version : VTC_SPI_4M1.10 | 2010/06/03 09:32:52
Vendor Name : ZyXEL Communications Corp.
Product Model : P-660HN-T3A
RAS ROM address : bfc30000
System Type : 6
MAC Address : 5067F0C8B8F0
Default Country Code : 08
Boot Module Debug Flag : 00
RomFile Version : BC
RomFile Checksum : 7439
RAS Checksum : cda0
Core Checksum : f4a7
SNMP MIB level & OID : 050000000100000002000000030000000400000005
Main Feature Bits : 86
Other Feature Bits :
93 17 00 00 00 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-00 00 13 00 00 00
OK
athe
======= Debug Command Listing =======
AT just answer OK
ATHE print help
ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k
ATENx,(y) set BootExtension Debug Flag (y=password)
ATSE show the seed of password generator
ATRLx display the 32-bit value of address x
ATGO(x) run program at addr x or boot router
ATGR boot router
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)
ATSH dump manufacturer related data in ROM
ATTD download router configuration to PC via XMODEM
ATUR upload router firmware to flash ROM
ATLC upload router configuration file to flash ROM
ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode
ATLD Upload Configuration File and Default ROM File to Flash
ATCD Convert Running ROM File to Default ROM File into Flash
OK
atse
0911CDC8B8F0
OK
ATEN1,A1217D5E
OK
athe
======= Debug Command Listing =======
AT just answer OK
ATHE print help
ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k
ATENx,(y) set BootExtension Debug Flag (y=password)
ATSE show the seed of password generator
ATWLx,y write address x with 32-bit value y
ATRLx display the 32-bit value of address x
ATGO(x) run program at addr x or boot router
ATGR boot router
AT%Tx Enable Hardware Test Program at boot up
ATBTx block0 write enable (1=enable, other=disable)
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)
ATCB copy from FLASH ROM to working buffer
ATCL clear working buffer
ATSB save working buffer to FLASH ROM
ATSH dump manufacturer related data in ROM
ATBS show the bootbase seed of password generator
ATLBx xmodem upload bootbase,x is password
ATFLx set EngDebugFlag in working buffer
ATMP check & dump memMapTab
ATTD download router configuration to PC via XMODEM
ATUPx,y upload to RAM address x for length y from PC via XMODEM
ATUR upload router firmware to flash ROM
ATDC hardware version check disable during uploading firmware
ATLC upload router configuration file to flash ROM
ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode
ATWZa(,b,c,d) write ZyXEL MAC addr, Country code, EngDbgFlag, FeatureBit to flash ROM
ATLD Upload Configuration File and Default ROM File to Flash
ATBR Reset to default Romfile
ATCD Convert Running ROM File to Default ROM File into Flash
OK
ATMP
ROMIO image start at bfc30000
code version:
code start: 80008000
code length: 18E972
memMapTab: 17 entries, start = bfc44000, checksum = BF73
$RAM Section:
0: BootExt(RAMBOOT), start=80030000, len=18000
1: HTPCode(RAMCODE), start=80048000, len=E0000
2: RasCode(RAMCODE), start=80048000, len=570000
$ROM Section:
3: BootBas(ROMIMG), start=bfc28000, len=4000
4: DbgArea(ROMIMG), start=bfc2c000, len=2000
5: RomDir2(ROMDIR), start=bfc2e000, len=2000
6: BootExt(ROMIMG), start=bfc30030, len=13FD0
7: MemMapT(ROMMAP), start=bfc44000, len=C00
8: HTPCode(ROMBIN), start=bfc44c00, len=8000
(Compressed)
Version: HTP_TC V 0.05, start: bfc44c30
Length: 10508, Checksum: 0268
Compressed Length: 41E7, Checksum: E942
9: termcap(ROMIMG), start=bfc4cc00, len=400
10: RomDefa(ROMIMG), start=bfc4d000, len=2000
11: LedDefi(ROMIMG), start=bfc4f000, len=400
12: LogoImg(ROMIMG), start=bfc4f400, len=2000
13: LogoImg2(ROMIMG), start=bfc51400, len=2000
14: StrImag(ROMIMG), start=bfc53400, len=32000
15: Rt11nE2p(ROMIMG), start=bfc85400, len=400
16: RasCode(ROMBIN), start=bfc85800, len=278C00
(Compressed)
Version: ADSL ATU-R, start: bfc85830
Length: 562710, Checksum: 38CD
Compressed Length: 13916F, Checksum: F4A7
$USER Section:
Msecs 128
Heap0 16 300 16
Heap1 32 64 4
Heap2 64 64 4
Heap3 128 160 4
Heap4 192 256 4
Heap5 256 80 4
Heap6 320 20 4
Heap7 384 4 2
Heap8 448 20 2
Heap9 512 34 2
Heap10 1024 52 4
Heap11 2048 20 2
Heap12 3172 4 2
Heap13 4096 2 2
Heap14 0 0
Heap15 0 0
MbufInt 20 20 20
MbufIO 160 160 1300 95 0 0
Queue 90
Cbuf 160
FuncId 30
Proc 40
Timer 64
DNS 128
Model 3 6035 333 0
FilterSet 12
IpRoute 16
IpxRoute 4
IpMaxRt 128
IpxMaxRt 128
IpxMaxSap 128
FwTos300 16 16 16
AclType0 2048 8 10
AclType1 2048 8 100
AclType2 2048 8 20
AclType3 2048 8 128
AclType4 2048 8 128
AclType5 32768 8 128
AppleTalkRoute 0
Bridge 4
RemoteNode 8
Profile 8
Endpoint 4
NATServerSet 10
DHCPEntry 254
PoeSvrCnt4
ScheduleSet 12
AclBuffer1
IPSecManualSA8
IPSecIkePeer8
IPSecIkeSA8
IPSecAclBuffer1
IPSecSPD5
NatAclBuffer1
CustomPort10
NatSessions2048
cwmpTxBufLen 56000
IpPolicySet 12
CoeFixedPart0
MiscFirewallBuffer 1
CyberPatrolBuffer 1
CyberPatrolListBuffer 1
TrustedIPNum 0
AccessSecHost16
NatRulePerSet24
UPNPNum 1
IPBUFixpart 1
VCHuntSet10
VCHuntMang1
TCDMT32
WLANEXT4
CHINANM 2
VlanCtl 1
QosCtl 1
Features1
CWMPATTR1
NatVirSvrApp9
HTTPURLs 1
WLANWDSEXT1
TimeOfDay1
WLANWPSOOBEXT1
FilterRuleName50
SecondUser 1
DHCPMac8
AccessSecHostExt16
ServerExt1
Reserve_1 1
CWMPATTR_11
WlanIEEE8021X1
MailAccountInfo 1
ftpAuthInfo1
telnetAuthInfo1
IP_Filter_Enhancement1
tcCwmp_IP_Filter1
tcCwmp_Enhancement1
NatSessCtrl1
Reserve_21
PPP_Ext1
WlanIEEE8021X_Ext1
TimeOfDayExt1
ScheduleRule35
WlanExt_21
LanIEEE8021X1
IP6Route16
RemoteNodeIP68
EtherIP61
IP6QosCtl1
accessRange_ext5
CwmpAttr21
Reserve_31
OK
2) Recovery mode:
You can get here if you press and hold Reset button for a few seconds at at switch on the device. Then the device start with different Bootbase detects and initiates 32MiB RAM (this space matches real RAM chip on PCB).
Bootbase Version: VTC_ROM_1.16 | 2009/12/18 14:28:26
RAM: Size = 32768 Kbytes
DRAM POST: Testing: 32768K
OK
done
So 32MiB RAM and 4MiB FLASH should be enough for running openwrt.
Now I would like to proceed according to http://www.ixo.de/info/zyxel_uclinux/ to make dump of RAM to debrick the current firmware and prepare a new one. But the main current problem is with enabling Debug Flag.
Neither of common procedure combination of cmds ATSE and ATEN nor only cmd ATEN with typical password derived from MAC does work :-(
Do you have any idea what can I do or how can I proceed to enable it?
Thanks in advanced.
(Last edited by comix on 1 Jan 2016, 20:17)