Kitz Forum
Broadband Related => Broadband Hardware => Topic started by: ghostivv on June 13, 2018, 02:43:45 PM
-
After updating to latest FW 21 & resetting, now can't login to router. I've tried admin/1234, zyuser/1234 and supervisor/zyad1234 and each time invalid username/password error in GUI. Router is few years old bought off ebay, not sure if locked or not but updating went well and problem happened after using the reset option in GUI. On previous FW, zyuser and supervisor would allow access but not admin/1234.
Already went through reset pinhole and few reboots. Any help would be appreciated.
Thanks.
-
perform this and upload the working firmware: https://forum.kitz.co.uk/index.php/topic,21273.msg373269.html#msg373269
ftp://ftp.zyxel.fr/ftp_download/VMG8324-B10A/firmware/
if it works then i think this is caused by rom-d so we'll clear it
-
I had to hold the pin in for perhaps 20 s, can't remember. A longer time anyway.
If you forget your password or cannot access the Web Configurator, you will need to use the RESET button at the back of the device to reload the factory-default configuration file. This means that you will lose all configurations that you had previously and the password will be reset to “1234”.
1 Make sure the PWR/SYS LED is on (not blinking).
2 To set the device back to the factory default settings, press the RESET button for ten seconds or until the PWR/SYS LED begins to blink and then release it. When the PWR/SYS LED begins to blink, the defaults have been restored and the device restarts.
-
Thanks to both of you for replying. Unfortunately none worked. I tried the procedure as linked by spring before posting here. Power off- > Hold reset pin -> power on -> Red flashing light -> Red solid light -> can't access 192.168.1.1 -> continues to normal boot. Same as before + holding reset pin longer -> boots into normal.
Tried to reset as posted by Weaver and once rebooted to gui, same as before invalid username/password.
-
did you set pc to 192.168.1.100 ? did you browser access 192.168.1.1 when connected to LAN1 port? [errr, sorry that I forgot to mention this xD]
also next time do it while running turning it on normally, letting it stabilize for 1 minute, and then hold it at least 30+ seconds until it went solid red [it will reboot, then it will treat it as if held from boot].
also leave it running for longer even if it didn't work after 2 minutes, just in case, see: https://forum.kitz.co.uk/index.php/topic,20731.msg361030.html#msg361030
also note a green light doesnt mean it boots normal, just ignore that.
Edit: don't follow anything other than flashing firmware on the device, do not reset it under any circumstance as per the link above as it will re-brick it, simply say if the recovery mode came up & flashing went well [if it did you wait 5 minutes, turn it off and back on then try logging in the gui with admin or supervisor and say if that worked then we find the supervisor password. if it didnt work then pin reset it and try logging in with admin or supervisor]
-
Sorry, my fault, if you reboot like that you should get a message allowing you load up a good config file, that will reset the passwords for you I think. But you need someone to give you a good config file.
-
I thought the recovery mode is just for firmware flash, and I assume uses its config until what I assume is another pin reset which would load back the ROM-D.
If he can upload a config, the config to upload would be the .rom from the latest [current] firmware archive file.
-
nope still not getting to recovery miniwebserver.
1) PC set to 192.168.1.100 and cleared browser cache/history
2) turned off zylex, disconnected all cables
3) while holding reset pin, plugged in power cable
4) light sequences: flashing red -> solid red (5s)-> flashing red+orange->solid green(2s)-> no light-> flashing green-> solid red + ethernet connection light(green). This all takes ~20-30s. Release reset pinhole.
5) typed in 192.168.1.1. no response.
6) Red light -> green light + ethernet connection light + wifi 2Ghz light
7) browser displays normal login GUI. All username/password combinations fails.
Am I missing something?
-
try doing it another time while it's running with a green light, just keep holding it through its reboot and until it went solid red. also wait 2 minute before trying to access 192.168.1.1
if not then you can do this: hold it for 30 seconds until it went solid red, turn it off while still holding it for 30 seconds, then keep holding it another 30 seconds until it went solid red again.
hope it works
-
If you get anything other than flashing red -> solid red then the router is booting. I know it sounds dumb, but are you sure you have the reset button firmly depressed? The flashing red to solid red time is ~ 20 seconds on mine.
I also have to wait over 1 minute after the solid red before the webserver becomes available, and the 4th ethernet port does not work, any of the others seem to.
Edit: this is with a VMG1312... maybe the 8324 is different? I cant imagine it as they are so similar. My 8324 is on my line at the moment so cant test.
-
It occurs to me that there are two other button you can try holding while booting, the WPS and LED buttons. I would try holding either while applying power and looking for a long (20s) flashing red to solid.
-
another mention here x.x
https://forum.kitz.co.uk/index.php/topic,21241.msg367947.html#msg367947
try following exactly what he's saying maybe that's it
edit: oh no.....
I suspect b*cat's method may only work with the VMG1312-B10A model.
I've not heard of it working on other Zyxels (happy to be corrected on that).
serial connection? :'(
If after 30 seconds, with the power LED still flashing red, just try to establish a connection via each of the LAN ports in turn. You should be looking for the presence of the GUI when the 192.168.1.1 IPv4 address is accessed via a web-browser.
but then...
Not managed to get this working, returning to seller. Appears this model has no factory hard reset.
Thanks for all your response & help on this.
:'(
-
Looking through saved boot logs from an 8324, it should be the reset button:
CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE)
Build Date: 09/10/2015 (wood@BuildCodeServer)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name TOSHIBA TC58NVG0S3E, id 0x98d1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
Checking Reset button on EXT INTR 0
-
can you guide him on a serial reset or whatever alternative :(
-
can you guide him on a serial reset or whatever alternative :(
There must be a way to get the bootloader webserver without serial, I will take my VMG8324 off my line and find it if necessary.
-
@ghostivv
Let me know when you have tried holding the other available buttons and if not I will inspect the boot process with mine while watching through a serial console.
-
https://forum.kitz.co.uk/index.php/topic,13930.msg308029.html#msg308029
-
I've tried every combination posted here and still failing to get webserver. I've already tried with holding WPS or Wifi button + reset pinhole + power before my first post here. Tried again without success. Will try 30/30/30 reset.
I've looked into serial flash and found youtube video but the pinouts were not very clear. It was late night yesterday and was struggling to see labels on PCB. Still has some time before leaving for work and think that will be the last resort. Need to hunt for easy to follow guide on commands :).
-
first you write "ATHE" and see if you see "ATBT" in the commands list, if not you need to unlock the device with ZynPass [or something else?] according to the thread below, I don't know how to use that on Windows.
if you did see ATBT in the list then write
ATER Erase ROM-D partition
ATBR Reset to default Romfile
ATBT might be required before ATER to enable block0 write, dunno this stuff
https://forum.kitz.co.uk/index.php?topic=13939.0
after that you turn it off with the power button and unplug the serial & try
-
Have mine out of its case and serial console attached. It does seem like the normal method does not work. It still waits if you have the reset button attached, but after 10s or so it just continues to boot normally:
CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE)
Build Date: 09/10/2015 (wood@BuildCodeServer)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name TOSHIBA TC58NVG0S3E, id 0x98d1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
Checking Reset button on EXT INTR 0 .................
*** Reset to Default ***
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
-
Guess it doesnt help as you have probably done this many times already, but after a few times holding various combinations of buttons it did this:
CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE)
Build Date: 09/10/2015 (wood@BuildCodeServer)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name TOSHIBA TC58NVG0S3E, id 0x98d1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
Checking Reset button on EXT INTR 0 ....................
*** Erase ROM-D ***
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
If rom-d is erased then the password should be default.
-
can you list the possible combinations? that is, to be followed if the 30-30-30 didn't work
-
I tried all possible, reset plus each of the two other button, then reset and both others at the same time. I'm pretty sure that was not what caused this, as every time I hold just reset now it still says:
Checking Reset button on EXT INTR 0 ....................
*** Erase ROM-D ***
At I guess I'd say if you have done the reset boot once, the next time it clears rom-d, so maybe try a normal boot and admin/1234.
-
yeah that's why I said to do it while running, turning it off is not required
nice explanation of the hard reset btw :cool:
another possibility could be holding it until solid red, and before it turns to green letting go and holding it in again through the reboot until it goes solid red again, then try logging in
-
yeah that's why I said to do it while running, turning it off is not required
nice explanation of the hard reset btw :cool:
What?
-
I mean that your explanation of the cause for rom-d clearing each time might be the "hard reset" procedure but while running contrary to the on-off-on
-
I have not done the 'hard reset' procedure... if you mean the 30/30/30 thing?
-
the hard reset instructions involve turning it on and off but it might be that you've done it while continuously running so I said you came up with a nice explanation
-
I still dont really follow you.
Anyway I cant replicated the behaviour. Since I got the "erase rom-d" message, everytime I boot holding reset I get it again. Have booted normally and changed settings, set a password etc. Still when I boot again with reset held I get:
Checking Reset button on EXT INTR 0 ....................
*** Erase ROM-D ***
-
This thread is getting super cluttered ;D
So what I have found so far is that holding reset with powering on and keeping it held till boot results in:
Checking Reset button on EXT INTR 0 ....................
*** Erase ROM-D ***
But holding it for some time less than 10s, say 5, results in:
Checking Reset button on EXT INTR 0 ...........
*** Reset to Default ***
Its a long shot, but maybe you have cleared rom-d @ghostivv, but not cleared to default by letting go of reset before the full rom-d clear to get rid of the previously stored config. I know its grasping at straws. :-\
-
from what I understood you say to hold the reset button while off, hold it for another 10 seconds after powering on, and let go [before it booted]: no longer or it won't work.
then he needs to let it boot normally, let it stabilize for a minute, then just hold it until the red light started blinking for a reset to default, then let it reboot and try logging.
I think this will be solved :) great work johnson
-
So what I have found so far is that holding reset with powering on and keeping it held till boot results in:
But holding it for some time less than 10s, say 5, results in:
Its a long shot, but maybe you have cleared rom-d @ghostivv, but not cleared to default by letting go of reset before the full rom-d clear to get rid of the previously stored config. I know its grasping at straws. :-\
I'v attached serial and looked into output. For some reason I'm failing to halt the booting process..maybe it's usb keyboard and don't have usb at home. Anyway with long press of reset, I'm also getting "ERASE ROM-D" . Once started booting, I let go of the reset button. Not sure I should be holding it until full reboot? After 3 mins, I switched off the router and the output this time is "Checking Reset button on EXT INTR 0" and board info immediately thereafter. Do i need to "reset to default" (pressing less than 10s)?
-
I'v attached serial and looked into output. For some reason I'm failing to halt the booting process..maybe it's usb keyboard and don't have usb at home. Anyway with long press of reset, I'm also getting "ERASE ROM-D" . Once started booting, I let go of the reset button. Not sure I should be holding it until full reboot? After 3 mins, I switched off the router and the output this time is "Checking Reset button on EXT INTR 0" and board info immediately thereafter. Do i need to "reset to default" (pressing less than 10s)?
What program are you using to attach to the serial device? Using 'screen' on linux any keypress halts the boot, but has to be pretty much immediately as you apply power.
You could try a sub 10s hold on boot as well though.
-
just let it boot normally, after it stabilized on green lights for half a minute, hold reset button a few secs until lights blinked, and done
aka this procedure
1 Make sure the PWR/SYS LED is on (not blinking).
2 To set the device back to the factory default settings, press the RESET button for ten seconds or until the PWR/SYS LED begins to blink and then release it. When the PWR/SYS LED begins to blink, the defaults have been restored and the device restarts.
after this you can log in and I hope you know your supervisor password. if not you login to telnet with admin/1234 type "dumpmdm" & search for "supervisor" [can select all & copy to notepad]. in windows command prompt before you send dumpmdm, you need to right click the title bar > properties > layout > screen buffer size height to 9999.
-
Terra Term VT for serial on W10. 20s reset hold gets "Erase ROM-D" and 11s reset hold for "Reset to default". Still getting login errors.
-
just let it boot normally, after it stabilized on green lights for half a minute, hold reset button a few secs until lights blinked, and done
aka this procedure
after this you can log in and I hope you know your supervisor password. if not you login to telnet with admin/1234 type "dumpmdm" & search for "supervisor" [can select all & copy to notepad]. in windows command prompt before you send dumpmdm, you need to right click the title bar > properties > layout > screen buffer size height to 9999.
Spring, he does not have login, these things you keep posting are of no help.
-
Spring, he does not have login, these things you keep posting are of no help.
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
-
Terra Term VT for serial on W10. 20s reset hold gets "Erase ROM-D" and 11s reset hold for "Reset to default". Still getting login errors.
Can you try a different serial program, does Terra Term have setting for encoding or bitrate you can mess with? You should be able to interrupt the boot with a keypress.
-
My apologies to the OP the weapon-poking-timing instructions I posted back there were from the ZyXEL docs for a VMG 1312-B10A, not the correct model. :-[ I don’t know if they are all the same or not?
-
My apologies to the OP the weapon-poking-timing instructions I posted back there were from the ZyXEL docs for a VMG 1312-B10A, not the correct model. :-[ I don’t know if they are all the same or not?
turns out the problem is not rom-d so johnson is guiding him on serial de-bricking
-
Can you try a different serial program, does Terra Term have setting for encoding or bitrate you can mess with? You should be able to interrupt the boot with a keypress.
Tried on putty and same thing as won't interrupt the booting. Anyother you recommend?
-
Really? Putty was what I was going to recommend... No idea why it isnt working, just to check, you have an open serial connection to your usb to serial converter, as you power on you mash keys as the initial boot messages come up, and it just ignores them?
Edit: this is me mashing enter on boot, then accessing the webserver after 1 minute:
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0
Voice Board Configuration (0-5) :
*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
Port 4 link UP 1
web info: Waiting for connection on socket 0.
CFE>
CFE>
CFE>
CFE>
CFE>
CFE>
CFE>
web warning: Unexpected TCP disconnect.
web info: Waiting for connection on socket 0.
web info: Waiting for connection on socket 1.
CFE>
-
I've CP210x USB and in the past used it on linksys router. I've setup COM7-115200-8-1-none-none. hit the power button + keys on keyboard as madly and fast I can ;D, the router just continues on normal boot. **Auto run second count down:1**
Maybe due to usb keyboard?
-
Are you sure you have the pins connected right? If you have the tx pin from device connected ok you could see the output, but if the rx pin is wrong then no giving it commands.
From the bottom of the header its:
GND...... NOPIN...... TX...... RX....... 3.3V
I have a usb keyboard as well so doubt its that.
Edit: should specify, you should have no need to connect to the 3.3V if your converter is already powered over USB.
Edit2: HA! I got the TX RX pins swapped, my bad its:
GND...... NOPIN...... RX...... TX....... 3.3V
From the modem, the connections to your serial adapter are obviously swapped.
-
*** I want to hide**** yes pins were wrong :-X. OK I'm now on cfe.
ok I issued ATHE and don't have ATBT. From ATSH I've got product model as VMG8324-B10A with which I tried to generate seed but getting error **command status = -1
-
Ah great stuff! ;D
-
*** I want to hide**** yes pins were wrong :-X. OK I'm now on cfe.
ok I issued ATHE and don't have ATBT. From ATSH I've got product model as VMG8324-B10A with which I tried to generate seed but getting error **command status = -1
Have you tried uploading a firmware (maybe the old one you were using before) via the bootloader web interface?
-
Sorry trying now :)
Edit: Flashed earlier version and still failing on login :(
-
Jebus man, thats infuriating!
Whats the provenance of this router? You had access before this firmware upgrade?
-
ha..yes but I feel for you all guys here who spent hours trying to help me and really sorry for that but also appreciate deep from my heart for all of your efforts and time. Not sure of the history as had this for few years after buying off from ebay, used on BT then moved to virgin and now back to BT.
-
what ATHE commands are available?
also try uploading firmware in the web as close to the date of the device / that you got it: ftp://ftp.zyxel.fr/ftp_download/VMG8324-B10A/firmware/
-
When you issue:
CFE> ATSH
Does it give you any clue to what ISP branding it has that would set the default to something else?
I just cant understand how after flashing stock firmwares and clearing things it still has a non default password.
-
I'm trying the method posted on youtube and uploading the file. I've gone through ATBR (Erase Storage Data), ATER(Erase ROM-D data) and currently on uploading via ATUR(XMODEM). Will report back once finished.
Nope...no clue as to the branding of router.
-
ATBR would be after ATER not before, after you upload firmware do ATBR again
edit: also would help to show output of "help ATSE" / "help FWSELECT" and "ATSH", "ATBL"
-
Are you sure? double checked the tut on YT and the guy had ATBR->ATER after uploading.
-
might not matter but the logical way is that
edit: i know why atse didin't work for you, type just "ATSE VMG8324" use zynpass from here http://www.stkaiser.de/anleitung/zynpass/ZynPass.exe
ATSE VMG8324
generate pass in zynpass
ATEN 1, zynpassword
after that im waiting for outputs of the commands above
without ATBT it may be that firmware flashes have no effect for ATUR
edit: alright i dont know if the problem is solved but if it is + you have the full command list [with ATBT in there] then serial time is over, btw i had to re-read the same pages a whole lot as it was my first serial time xd
also note if ATUR indeed worked for you, ATBT was already set to 1
-
success!!!!!! :drink: :drink:
leaving for work. Will post updates tomorrow morning.
-
Phew that was tense reading. :)
-
;D yeah it's been hell of a trip going round in circle ending up on where started. Special thanks to Johnson, spring & weaver for all their time, very swift instructions and more importantly patience to resolve issue. Hats off to you gentlemen :drink:.
I'm currently on 1.00(AAKL.18)CO. Changed both admin and supervisor password which I found using dumpmdm. Zylex will be on bridge mode with linksys EA6900 (running on asus merlin fork xwrt FW).