Hi!
I have a ZyXEL VMG5313-B30A router.
It's based on BCM63168, has XDSL support up to VDSL2 17a profile (BCM6302), 128MiB of DDR3 RAM and 128MiB of flash - surprisingly lot for an budget ISP's router.
I got the source for the latest firmware. Unfortunately I can't post links yet so for now, take a look at the wiki page I wrote today.
Surprise - with the exception of one instance of deprecated Perl syntax used in kernel, there are absolutely no other errors and build succeeds! On my notebook's i5-3337U it compiles under 12 minutes.
As expected, the flashed image doesn't exactly work - Web GUI never shows up, and /dev/console is broken so nothing can be debugged.
However, I'm not interested in modifying original FW so I didn't investigate why it happens - I want OpenWRT to boot.
ATSE doesn't work, but I managed to find the correct ATEN password:
ATEN 1, 10F0A563
After that, I set EngDbgFlag to 1 with ATWZ, and now it boots with red power LED and CFE happily tries to boot/flash anything I serve over TFTP/xmodem.
I even replaced CFE, although it fails to flash any which doesn't have "Release" in its name.
Trying to boot any OpenWrt kernel results in this:
Loading 192.168.1.16:vmlinux ...
Finished loading 3681300 bytes
Code Address: 0x00000000, Entry Address: 0x00000000
Failed on decompression. Corrupted image?
Trying to flash OpenWrt generated CFE image results in:
Firmware tag version [0] is not compatible with the current Tag version [6].
Going further, I found the actual commands executed by Makefile:
/home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/hostTools/bcmZyNandImageBuilder --output bcmVMG5313-B30A_fs_kernel_NAND128 --chip 63268 --board "963168_VMG5313" --internalversion="1.00(AATS.1)C0" --externalversion="1.00(AATS.1)C0" --modelid="4517" --cmodelid="4517" --cfefile /home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/targets/cfe/cfe63268nand128.bin --imgdefaultfile="config.rom" --romdsig 0 --romdfile="" --rootfsfile rootfs128kb.img
######build_image : IMAGE_BASE[bfc00000]##
######build_image : fskerneladdr[bfc20000]##
19 85 e0 1 0 0 0 2b
3e 42 24 27 0 0 0 1
0 0 0 0 0 0 0 2
57 dd 41 ee 3 4 0 0
7d b1 ee 2c 55 66 83 ff
62 69 6e 0 19 85 e0 2
0 0 0 44 a4 ef 22 3e
0 0 0 2 0 0 0 1
######build_image : fsCrc[11be27]##tagVersion 6
signiture_1 MSTC_4517
signiture_2 ver. 2.0
chipId 63268
boardId 963168_VMG5313
bigEndian 1
totalImageLen 23199744
cfeAddress 0, 0x00000000
cfeLen 0
rootfsAddress 3217293312, 0xBFC20000
rootfsLen 23199744
kernelAddress 0, 0xC1240000
kernelLen 0
tagValidationToken [27be1100]
imgdefLen 21767
imgDef imageValidationToken 7b7edc84
imgDef tagValidationToken a090ba61
romdLen
signatureRomd
romd imageValidationToken ffffffff
romd tagValidationToken f5a834a1
bcmZyNandImageBuilder
Model Id : 4517
Custom Model Id : 4517
File tag size : 256
Root filesystem image size : 23199744
ImageDefault image size : 21767
ROM-D signature : 0
Combined image file size : 23221831
/home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/hostTools/bcmZyNandImageBuilder --output bcmVMG5313-B30A_fs_kernel_NAND128 --chip 63268 --board "963168_VMG5313" --internalversion="1.00(AATS.1)C0" --externalversion="1.00(AATS.1)C0" --modelid="4517" --cmodelid="4517" --cfefile /home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/targets/cfe/cfe63268nand128.bin --imgdefaultfile="config.rom" --romdsig 0 --romdfile="" --rootfsfile rootfs128kb.img
######build_image : IMAGE_BASE[bfc00000]##
######build_image : fskerneladdr[bfc20000]##
19 85 e0 1 0 0 0 2b
3e 42 24 27 0 0 0 1
0 0 0 0 0 0 0 2
57 dd 41 ee 3 4 0 0
7d b1 ee 2c 55 66 83 ff
62 69 6e 0 19 85 e0 2
0 0 0 44 a4 ef 22 3e
0 0 0 2 0 0 0 1
######build_image : fsCrc[11be27]##tagVersion 6
signiture_1 MSTC_4517
signiture_2 ver. 2.0
chipId 63268
boardId 963168_VMG5313
bigEndian 1
totalImageLen 23330816
cfeAddress 3217031168, 0xBFC00000
cfeLen 131072
rootfsAddress 3217293312, 0xBFC20000
rootfsLen 23199744
kernelAddress 0, 0xC1240000
kernelLen 0
tagValidationToken [27be1100]
imgdefLen 21767
imgDef imageValidationToken 7b7edc84
imgDef tagValidationToken a090ba61
romdLen
signatureRomd
romd imageValidationToken ffffffff
romd tagValidationToken f5a834a1
bcmZyNandImageBuilder
Model Id : 4517
Custom Model Id : 4517
CFE image size : 131072
File tag size : 256
Root filesystem image size : 23199744
ImageDefault image size : 21767
ROM-D signature : 0
Combined image file size : 23352903
/home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/hostTools/createZyNandimg --boardid="963168_VMG5313" --voiceboardid="ZL88601" --numbermac=12 --macaddr="CC:5D:4E:00:00:01" --countrycode="FF" --tp=0 --psisize=128 --gponsn= --gponpw= --backuppsi="" --inputfile=bcmVMG5313-B30A_cfe_fs_kernel_NAND128 --outputfile=bcmVMG5313-B30A_flash_image_"963168_VMG5313"_NAND128
createimg: Creating image with the following inputs:
Board id : 963168_VMG5313
Voice board id : ZL88601
Number of Mac Addresses : 12
Base Mac Address: : CC:5D:4E:00:00:01
Country Code: : ff
Main Thread Number: : 0
PSI Size: : 128
USING BACKUP PSI: : 0
Input File Name : bcmVMG5313-B30A_cfe_fs_kernel_NAND128
Output File Name : bcmVMG5313-B30A_flash_image_963168_VMG5313_NAND128
Image components offsets
cfe offset : 0xbfc00000 -- Length: 131072
file tag offset : 0xbfc20000 -- Length: 131072
rootfs offset : 0xbfc40000 -- Length: 23199744
imgdef offset : 0xc1260020 -- Length: 21767
rom-d offset : 0xc1265527 -- Length: 0
The size of the entire flash image is 23483687 bytes.
The flash space remaining for a 2 MB flash part: -21386535 bytes.
The flash space remaining for a 4 MB flash part: -19289383 bytes.
bcmVMG5313-B30A_flash_image_963168_VMG5313_NAND128 flash image file is
successfully created.
/home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/hostTools/bcmZyNandImageBuilder --output bcmVMG5313-B30A_cfe_fs_kernel_NAND128_TE --chip 63268 --board "963168_VMG5313" --internalversion="1.00(AATS.1)C0" --externalversion="1.00(AATS.1)C0" --modelid="4517" --cmodelid="4517" --cfefile /home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/targets/cfe/cfe63268nand128_TE.bin --imgdefaultfile="config.rom" --romdsig 0 --romdfile="" --rootfsfile rootfs128kb.img --include-cfe
######build_image : IMAGE_BASE[bfc00000]##
######build_image : fskerneladdr[bfc20000]##
19 85 e0 1 0 0 0 2b
3e 42 24 27 0 0 0 1
0 0 0 0 0 0 0 2
57 dd 41 ee 3 4 0 0
7d b1 ee 2c 55 66 83 ff
62 69 6e 0 19 85 e0 2
0 0 0 44 a4 ef 22 3e
0 0 0 2 0 0 0 1
######build_image : fsCrc[11be27]##tagVersion 6
signiture_1 MSTC_4517
signiture_2 ver. 2.0
chipId 63268
boardId 963168_VMG5313
bigEndian 1
totalImageLen 23330816
cfeAddress 3217031168, 0xBFC00000
cfeLen 131072
rootfsAddress 3217293312, 0xBFC20000
rootfsLen 23199744
kernelAddress 0, 0xC1240000
kernelLen 0
tagValidationToken [27be1100]
imgdefLen 21767
imgDef imageValidationToken 7b7edc84
imgDef tagValidationToken a090ba61
romdLen
signatureRomd
romd imageValidationToken ffffffff
romd tagValidationToken f5a834a1
bcmZyNandImageBuilder
Model Id : 4517
Custom Model Id : 4517
CFE image size : 131072
File tag size : 256
Root filesystem image size : 23199744
ImageDefault image size : 21767
ROM-D signature : 0
Combined image file size : 23352903
/home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/hostTools/createZyNandimg --boardid="963168_VMG5313" --voiceboardid="ZL88601" --numbermac=12 --macaddr="CC:5D:4E:00:00:01" --countrycode="FF" --tp=0 --psisize=128 --gponsn= --gponpw= --backuppsi="" --inputfile=bcmVMG5313-B30A_cfe_fs_kernel_NAND128_TE --outputfile=bcmVMG5313-B30A_flash_image_"963168_VMG5313"_NAND128_TE
createimg: Creating image with the following inputs:
Board id : 963168_VMG5313
Voice board id : ZL88601
Number of Mac Addresses : 12
Base Mac Address: : CC:5D:4E:00:00:01
Country Code: : ff
Main Thread Number: : 0
PSI Size: : 128
USING BACKUP PSI: : 0
Input File Name : bcmVMG5313-B30A_cfe_fs_kernel_NAND128_TE
Output File Name : bcmVMG5313-B30A_flash_image_963168_VMG5313_NAND128_TE
Image components offsets
cfe offset : 0xbfc00000 -- Length: 131072
file tag offset : 0xbfc20000 -- Length: 131072
rootfs offset : 0xbfc40000 -- Length: 23199744
imgdef offset : 0xc1260020 -- Length: 21767
rom-d offset : 0xc1265527 -- Length: 0
The size of the entire flash image is 23483687 bytes.
The flash space remaining for a 2 MB flash part: -21386535 bytes.
The flash space remaining for a 4 MB flash part: -19289383 bytes.
bcmVMG5313-B30A_flash_image_963168_VMG5313_NAND128_TE flash image file is
successfully created.
ima_len_no_oob 22935
#########################################
~~~~~the NAND information below list~~~~~
#########################################
the NAND_FLASH name is bcmVMG5313-B30A_flash_image_963168_VMG5313_NAND128_TE
the NAND_FLASH product version is 1.00(AATS.1)C0
the NAND_FLASH image version is 160917
the NAND_FLASH start_addr is 0x0
the NAND_FLASH system type is jffs2
the NAND_FLASH imgSize is 23483687
the NAND_FLASH imgQty is 1
the NAND_FLASH cleanmark is on
the NAND_FLASH partition size is 134217728
the NAND_FLASH page size is 2048
the NAND_FLASH oob size is 64
the NAND_FLASH block size is 128K
the NAND_FLASH oob placement is brcom
the NAND_FLASH oob ecc_algorithm is 512/3
the NAND_FLASH swap_flag is 0
the NAND_FLASH allow_bad_blocks is 512
addvtoken: Output file size = 23483707 with image crc = 0x47591f18
Done! Image VMG5313-B30A has been built in /home/danijel/src/vmg5313/bcm963xx_4.12L.06B_consumer_release/bcm963xx_router/targets/VMG5313-B30A.
So, the kernel is vmlinux.lz file placed on rootfs, and bcmZyNandImageBuilder and createZyNandimg tools do their magic to place the kernel correctly and indicate it in image header, which can't be read with any of the available tools.
Example:
Broadcom Consumer Router Firmware Header Dump
Version: 1.05
Copyright 2015-2016 TJ <hacker@iam.tj>
Licensed on the terms of the GNU General Public License version 3
Header Offset: 0x00000000 (0)
Image Offset: 0x00020000 (131072)
0000 Tag Version:
0004 Signature 1: (Model: )
0018 Signature 2: �
0026 Chip ID:
002c Board ID:
003c Big Endian: No
003e Image Len: 2x� (0x00000002)
0048 CFE Address: � (0x00000000)
0054 CFE Len: � (0x00000000)
005e Root FS Address: %
� (0x00000000)
� (0x00000000)n:
0074 Kernel Address: (0x00000000)
0080 Kernel Len: (0x00000000)
008a Image Sequence: �$� !<� (0x00000000)
008e External Version: !<�
00ae Internal Version: �!<�
00ce Image Next: 0
00d8 Image Validation Token: 0x3c1b8000
00ec Tag Validation Token: 0x04110001
Calculated Image CRC32: 0x373a7c75
Calculated Tag CRC32: 0x1ffd2e13
Any clues or ideas, anyone?