Skip to content

Commit 17beda3

Browse files
stich86stich86
authored
Add ZTE F6005v3
add known information about ZTE F6005v3 ONT
1 parent 9d8b4f0 commit 17beda3

1 file changed

Lines changed: 335 additions & 0 deletions

File tree

‎_ont/ont-zte-f6005v3.md‎

Lines changed: 335 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,335 @@
1+
---
2+
title: ZTE F6005v3
3+
has_children: false
4+
layout: default
5+
parent: ZTE
6+
---
7+
8+
# Hardware Specifications
9+
10+
| | |
11+
| ------------ | ----------------------------------------------------------------- |
12+
| Vendor/Brand | ZTE |
13+
| Model | F6005v3 |
14+
| ODM | ✅ |
15+
| CPU | ZTE ZX279133@A53 |
16+
| CPU Clock | 2x1200MHz |
17+
| Chipset | ZTE ZX279133 |
18+
| Flash | 128 MB (SPI NAND FM25S01A) |
19+
| RAM | 128 MB |
20+
| System | Customized Linux by ZTE |
21+
| 2.5GBaseT | No |
22+
| Optics | SC/APC |
23+
| IP address | 192.168.1.1 |
24+
| Web Gui | ✅ user `admin`, password `admin` or defined by ISP |
25+
| SSH | |
26+
| Telnet | ✅ [^1] |
27+
| Serial | ✅ [^2] |
28+
| Form Factor | ONT |
29+
30+
{% include image.html file="f6005v3_tim_1.jpg" alt="F6005v3 TIM" caption="F6005v3 TIM" %}
31+
{% include image.html file="f6005v3_of_1.jpg" alt="F6005v3 OpenFiber" caption="F6005v3 OpenFiber" %}
32+
33+
34+
## List of software versions
35+
### HW V3.0
36+
- V3.0.10P3N2 (OpenFiber)
37+
- V3.0.10N06, internal version is V3.0.10P2N6 (TIM Italy)
38+
39+
## List of partitions
40+
41+
### HW V3.0
42+
43+
| dev | size | erasesize | name |
44+
| ---- | -------- | --------- | ---------------- |
45+
| mtd0 | 08000000 | 00020000 | "whole flash" |
46+
| mtd1 | 00300000 | 00020000 | "uboot" |
47+
| mtd2 | 00400000 | 00020000 | "others" |
48+
| mtd3 | 00400000 | 00020000 | "parameter tags" |
49+
| mtd4 | 00400000 | 00020000 | "wlan" |
50+
| mtd5 | 00800000 | 00020000 | "usercfg" |
51+
| mtd6 | 00400000 | 00020000 | "middle" |
52+
| mtd7 | 02a00000 | 00020000 | "kernel1" |
53+
| mtd8 | 02a00000 | 00020000 | "kernel2" |
54+
| mtd9 | 02500000 | 00020000 | "rootfs1" |
55+
| mtd10 | 029e0000 | 00020000 | "rootfs2" |
56+
57+
58+
This ONT supports dual boot, as visible from the presence of `kernel0` and `kernel1`, which contain the rootfs.
59+
The boot images can be swapped with the following command but currently not works because if U-Boot is updated, a revert will brick ONT:
60+
61+
```sh
62+
upgradetest switchver X
63+
```
64+
65+
Where `X` can be `0/1`, based on the image you want to boot from.
66+
67+
68+
You can also clone the currently running image into the other slot using this command:
69+
70+
```sh
71+
syn_version
72+
```
73+
74+
# Use
75+
{% include alert.html content="Commands have been tested on V3 HW rev. on OpenFiber firmwares" alert="Note" icon="svg-info" color="blue" %}
76+
77+
## Enable Telnet
78+
{% include alert.html content="This is an external script ([ZTE Telnet enabler](https://github.com/douniwan5788/zte_modem_tools)), use at your own risk! Credentials don't survive at reboot!" alert="Note" icon="svg-info" color="blue" %}
79+
80+
{% include alert.html content="For italian users, the script above only works only on V3.0.10P3N2 (OpenFiber)" alert="Note" icon="svg-info" color="blue" %}
81+
82+
```sh
83+
python3 zte_factroymode.py --user CUSTOM_USER --pass CUSTOM_PASS --ip 192.168.1.1 --port 80 telnet open
84+
```
85+
86+
You should get this output and credentials to login over telnet:
87+
88+
```sh
89+
trying user:"CUSTOM_USER" pass:"CUSTOM_PASS"
90+
reset facTelnetSteps:
91+
reset OK!
92+
93+
facStep 1:
94+
OK!
95+
96+
facStep 2:
97+
OK!
98+
99+
facStep 3:
100+
OK!
101+
102+
facStep 4:
103+
OK!
104+
105+
facStep 5:
106+
OK!
107+
108+
done
109+
Username: 2W3iqFVt
110+
Password: Eqb8X8Qt
111+
```
112+
113+
## Enable console redirection
114+
115+
To see omcidebug messages on telnet, execute this command (just the first time of each connection):
116+
117+
```sh
118+
redir printf
119+
```
120+
121+
# GPON ONU status
122+
123+
## Getting the operational status of the ONU
124+
125+
To check the connection status, use the following command:
126+
```
127+
gpontest -gstate
128+
```
129+
`[gpontest] gpon state is [O5]` for O5 state
130+
131+
## Getting OLT vendor information
132+
133+
```sh
134+
sendcmd 132 omcidebug showmedata 131
135+
```
136+
137+
This command will print the following output:
138+
139+
```sh
140+
##################################
141+
MIB INFO:
142+
ME CLASS: 131
143+
DB NAME: olt_g, DBHandle: 32
144+
##################################
145+
146+
<-----MeID[ 0x0000,0 ], Addr[ 0x19a2b1]----->
147+
Vendorid:48 57 54 43
148+
EquipmentID:00 00 00 00 00 00 00 00 00 00
149+
00 00 00 00 00 00 00 00 00 00
150+
Version:31 30 00 00 00 00 00 00 00 00
151+
00 00 00 00
152+
TimeofDay:00 00 00 00 00 00 00 00 00 00
153+
00 00 00 00
154+
---------------------------------------------------------------------
155+
```
156+
157+
## Querying a particular OMCI ME
158+
159+
```sh
160+
sendcmd 132 omcidebug showmedata ID_MIB (eg. 7 for Firmware version)
161+
```
162+
163+
This command will print the following output:
164+
165+
```sh
166+
167+
##################################
168+
MIB INFO:
169+
ME CLASS: 7
170+
DB NAME: soft_image, DBHandle: 14
171+
##################################
172+
173+
<-----MeID[ 0x0000,0 ], Addr[ 0x19a011]----->
174+
Version:V3.0.10P3N2
175+
Is committed:01
176+
Is active:01
177+
Is valid:01
178+
179+
<-----MeID[ 0x0001,1 ], Addr[ 0x19a031]----->
180+
Version:V3.0.10P3N2
181+
Is committed:00
182+
Is active:00
183+
Is valid:01
184+
---------------------------------------------------------------------
185+
```
186+
187+
# GPON/OMCI settings
188+
189+
## Setting ONU GPON Serial Number
190+
191+
{% include alert.html content="Both S/N and VID have to be changed. 2176 is for the VID (first 4 letters of the S/N) and 2177 is for the last 8 digits of the S/N" alert="Note" icon="svg-info" color="blue" %}
192+
```sh
193+
setmac 1 2176 ZTEG
194+
setmac 1 2177 AABBCCDD
195+
```
196+
197+
## Setting ONU GPON PLOAM password
198+
199+
{% include alert.html content="The PLOAM password is stored in the ASCII format." alert="Note" icon="svg-info" color="blue" %}
200+
This can be done easily via the web UI. To do it via the shell use:
201+
```sh
202+
setmac 1 2181 1234567890
203+
setmac 1 2178 1234567890
204+
```
205+
206+
## Setting ONU GPON Equipment ID
207+
```sh
208+
setmac 1 32770 "5::F6005V3.0:"
209+
```
210+
211+
## Persistent telnet access
212+
213+
{% include alert.html content="This procedure was only tested on OF V3.0.10P3N2 firmware and it's persistent after an upgrade from OLT" alert="Note" icon="svg-info" color="blue" %}
214+
215+
216+
Needed tools:
217+
218+
- Linux VM or WSL with Python >3.3
219+
- [ZTE Telnet enabler](https://github.com/douniwan5788/zte_modem_tools)
220+
221+
222+
After the ONT has rebooted and you can access again, telnet can be enabled on each reboot. To do this, run again `zte_factroymode.py` to open new session to it. When you are in, execute these commands:
223+
224+
```sh
225+
sendcmd 1 DB set TelnetCfg 0 TS_Enable 1
226+
sendcmd 1 DB set TelnetCfg 0 Lan_Enable 1
227+
sendcmd 1 DB set TelnetCfg 0 TS_UName root
228+
sendcmd 1 DB set TelnetCfg 0 TS_UPwd root
229+
sendcmd 1 DB set TelnetCfg 0 TSLan_UName root
230+
sendcmd 1 DB set TelnetCfg 0 TSLan_UPwd root
231+
sendcmd 1 DB set TelnetCfg 0 InitSecLvl 2
232+
sendcmd 1 DB saveasy
233+
sendcmd 1 DB addr FWSC 0
234+
sendcmd 1 DB set FWSC 0 ViewName IGD.FWSc.FWSC1
235+
sendcmd 1 DB set FWSC 0 Enable 1
236+
sendcmd 1 DB set FWSC 0 INCName LAN
237+
sendcmd 1 DB set FWSC 0 INCViewName IGD.LD1
238+
sendcmd 1 DB set FWSC 0 Servise 8
239+
sendcmd 1 DB set FWSC 0 FilterTarget 1
240+
sendcmd 1 DB saveasy
241+
```
242+
243+
Reboot the ONT and a telnet interface will be available. You can login using `root\root` as credentials.
244+
245+
**Just for OpenFiber firmware**
246+
247+
In case you want add new a admin user instead of using the embedded credentials, run these commands before rebooting the ONT:
248+
249+
```sh
250+
sendcmd 1 DB set DevAuthInfo 5 Enable 1
251+
sendcmd 1 DB set DevAuthInfo 5 User superadmin
252+
sendcmd 1 DB set DevAuthInfo 5 Pass superadmin
253+
sendcmd 1 DB set DevAuthInfo 5 Level 0
254+
sendcmd 1 DB set DevAuthInfo 5 AppID 1
255+
sendcmd 1 DB saveasy
256+
```
257+
Reboot the ONT and you can login to the WebUI using `superadmin\superadmin` as credentials with full unlocked menus.
258+
259+
# Advanced settings
260+
261+
## Backing up ONT partitions using hardware flasher
262+
263+
As we currently known, only firmware V3.0.10P3N2 from OpenFiber are able to open telnet (and make it persistent).
264+
It's possible to swap RAW dump between ONTs and enable access over telnet to modify some ONT parameters.
265+
266+
Needed tools:
267+
268+
- Windows, Linux or macOS with [SNANDer](https://github.com/McMCCRU/SNANDer)
269+
- [CH341a programmer with 3.3V voltage](https://it.aliexpress.com/item/1005004637577204.html?spm=a2g0o.productlist.main.1.21ad51c1Lmyq6Z&algo_pvid=0aade75d-7f57-4fe7-b0f4-b3f2f56af9f1&algo_exp_id=0aade75d-7f57-4fe7-b0f4-b3f2f56af9f1-0&pdp_npi=4%40dis%21EUR%214.25%214.25%21%21%214.56%214.56%21%4021039cc717284006273332970e47ea%2112000029927819932%21sea%21IT%211864988329%21X&curPageLogUid=Xuv1aOCo58M9&utparam-url=scene%3Asearch%7Cquery_from%3A)
270+
- [Pogo-Pin Probe for WSON8 8x6mm chip](https://it.aliexpress.com/item/1005006666230520.html?spm=a2g0o.order_list.order_list_main.21.11e236965SstMd&gatewayAdapt=glo2ita)
271+
272+
Connect all needed cable from the probe to the programmer, then attach the probe to the chip (use some rubbers to make it stable) and run this command to dump the NAND:
273+
274+
```sh
275+
/SNANDer -r f6005v3_dump_X.bin
276+
```
277+
278+
Do at least 3 dumps and compare their md5 to be sure that are good.
279+
280+
If you want to flash this dump to another ONT, just run these commands:
281+
282+
```sh
283+
/SNANDer -e
284+
/SNANDer -w f6005v3_dump_X.bin -v
285+
```
286+
```
287+
288+
## Changing region code
289+
290+
{% include alert.html content="Be aware that changing the region code may break features such as PPPoE depending on your ISP, and remove telnet access!" alert="Note" icon="svg-info" color="blue" %}
291+
292+
ZTE has created various region codes that load default values based on the local ISP. This configuration can be changed using this command:
293+
294+
```sh
295+
upgradetest sfactoryconf X
296+
```
297+
298+
Where X is the number of supported regioncode into file `/etc/init.d/regioncode`, here is an example from TIM `V3.0.10N06` firmware:
299+
300+
```sh
301+
# cat /etc/init.d/regioncode
302+
14:Thailand
303+
97:ItalyTi
304+
116:Tescali
305+
154:Izzi
306+
163:BrazilClaroHome
307+
188:HollandKpnSfu
308+
198:Manufacture
309+
2074:ItalyFastwebSFU
310+
```
311+
312+
# Random notes
313+
- Both F601v6 and F601v7 read the software version exposed through the gpon_omci deamon from each kernel partition header, so the only way to spoof this parameter is to change the version in the header and recalculate CRC, otherwise the bootloader will refuse to load the image.
314+
- TIM's F601v6s use HWVer `VDF`, this can be changed back to `V6.0` issuing this command via telnet: `setmac 1 32770 3`
315+
- The F601v7 is mounted 'upside down' to save on waveguides, the LEDs would be on the bottom of the PCB, so it would have to be turned upside down to make it cooler...
316+
- The F601v6 turns on and runs even with 9V input.
317+
- The F601v7 turns on and runs even with 5V input.
318+
319+
# Miscellaneous Links
320+
321+
- [ZTE Telnet enabled](https://github.com/douniwan5788/zte_modem_tools)
322+
323+
# Teardown and other photos
324+
325+
## HW V3.0
326+
327+
{% include image.html file="f6005v3_2.jpg" alt="Top of the F6005v3" caption="Top of the F6005v3" %}
328+
{% include image.html file="f6005v3_3.jpg" alt="Bottom of the F601 v6" caption="Bottom of the F6005v3" %}
329+
330+
331+
332+
---
333+
334+
[^1]: Credentials are randomly generated by zte_factroymode.py, they are not persistent and will change at reboot.
335+
[^2]: Serial console is read-only mode on most of U-Boot, and no output after kernel load. For OF V3.0.10P3N2 is possible after pressing ESC during the boot to access U-Boot Console.

0 commit comments

Comments
 (0)