OpenWrt Forum Archive

Topic: ZTE ZXHN H108N help with flashing

The content of this topic has been archived on 5 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

I'd like to install openwrt on a ZTE H108N following the instructions of
wiki. openwrt. org /toh/zte/zxhnh108n

1) The above instructions describe a process of powering up the router holding the reset button for 20 seconds, and then accessing the web interface, however in my case, this does not work. If I start the router as indicated, it is not possible to access it at all (the power led remains red, no other led turns on), unless I power it off and on again.

Is it possible to flash the openwrt firmware using the normal procedure of firmware upgrade via the standard web interface?

As a side note, it is not possible to access the router via telnet as indicated in other websites. The web interface shows the following info:
Model     ZXHN H108N V2.5
Hardware Version     V1.3
Software Version     V2.5.6_GR5T10
Boot Loader Version     V1.3.1
DSL Firmware Version     4926d722

2) Is it possible to save the old/standard firmware already found in the router? For some reason, I was not able to download from ZTE or other website the standard firmware and I would like to keep the option of returning back, just in case.

To add, this version of H108N misses the USB port. The PCB appears to have the pins for the USB connector, however the box has no opening - the firmware is probably a modified version that excludes the related USB functionality.

neos21 wrote:

Is it possible to flash the openwrt firmware using the normal procedure of firmware upgrade via the standard web interface?

Most likely not. The web interface of OEM firmware usually has some sort of a protection scheme that validates the file you are uploading for the flash operation. It checks the file checksum, or assumes that there's a file header somewhere with specific magic numbers that identify the file as a valid firmware image.

When these conditions are not met, the flash process will be aborted. If there's an image file in the OpenWRT downloads are for your router that has the name "factory" in it, then these images can be flashed through the OEM upgrade procedure as they have been masqueraded to look like OEM-provided firmwares.

neos21 wrote:

As a side note, it is not possible to access the router via telnet as indicated in other websites.

The telnet daemon in your router might be off, or the firewall might be blocking access to it.

neos21 wrote:

Is it possible to save the old/standard firmware already found in the router? For some reason, I was not able to download from ZTE or other website the standard firmware and I would like to keep the option of returning back, just in case.

Yes, this is possible. How to do it exactly depends on what hardware features the router has and how the firmware currently running on the router is implemented.

If your router has a serial port, and you can access the bootloader environment through the serial port, then you might be able to copy the raw data off the flash chip and store it somewhere. This is often quite difficult as the bootloader environments are limited in what commands are available and what operations are possible. For example, most of the time a bootloader environment has no concept of file systems or even files: you'd need to load the raw data from the flash memory into the RAM, and then find some way to copy the data from RAM into an external storage medium.

Most Linux-based OEM-provided firmwares are running in a jailed environment where any access to the "root" user is prohibited. If this is true for your router, and the MTD device objects created by the kernel are protected so that only "root" can read from them, then there's no way in the Linux environment to read from them. You'd need to resort to a JTAG, or other low-level interface and read the data off the flash chip directly.

Sometimes it is possible to create an alternative firmware that can be run from RAM directly. You'd need a serial console access to the bootloader, interrupt the boot process and then find some way to upload your alternative RAM-based firmware into the router's memory before executing it. Then you'd essentially be running the firmware in "live" mode where you can access the hardware resources on the router, but your changes will not be persisted over power cycles. If you manage to build a suitable firmware image for your router and start it up, then you can read data from the MTD device objects and store them into a temporary file in the memory-based file system that the "live" image is using. Then start up a TFTP server and transfer the file away.

The discussion might have continued from here.