Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[johnson]

I have a spare VMG3925-B10B lying around and have requested the firmware source from Zyxel.  I'll give it a go and will report back if I succeed!

I cant see any reason why the Olipro patches wont work on the 3925.

Setting up the build environment isnt hard, just follow the instructions that come in the source package. Any questions just ask. If the layout is exactly the same then I can provide a patch file that I use on 1312/8324s, but its probably easier to just go and edit the files yourself using Olipros github as a guide.

[jhm]

I setup the Ubuntu VM and compiled the tool chain (rather than using the binary provided by Olipro) and the firmware (for the VMG1312-B10A).  it seems to be work but I have no VMG1312-B10A to test with.

I will wait for Zyxel to come back to me with the VMG3925-B10B source.

I've set out my notes below in case it's helpful for anyone else.

==
== Files required
==

Ubuntu 10.04.4 server i386 ISO:

http://old-releases.ubuntu.com/releases/10.04.0/ubuntu-10.04-server-i386.iso

==

Zyxel VMG1312-B10A source with Olipro baby jumbo patches:

https://github.com/Olipro/VMG1312-B10A

==

MIPS tool chain source:

https://www.downloads.netgear.com/files/GPL/DGN2200v3_V1.1.00.25_WW_20150526.zip

The MIPs cross compiler source file - uclibc-crosstools-gcc-4.4.2-1-full.tar.bz2 - is inside DGN2200v3_V1.1.00.25_WW_20150526.zip.

==

The six source files required for building the tool chain (which I have taken from - hopefully - "safe" locations):

https://uclibc.org/downloads/old-releases/uClibc-0.9.29.tar.bz2

https://ftp.openbsd.org/pub/OpenBSD/distfiles/binutils/binutils-2.20.tar.bz2

http://www.nic.funet.fi/index/SlackWare/slackware-12.2/source/d/gdb/gdb-6.8.tar.bz2

https://mirrors.edge.kernel.org/pub/linux/kernel/v2.6/linux-2.6.30.tar.bz2

https://www.mpfr.org/mpfr-2.4.1/mpfr-2.4.1.tar.bz2

https://www.mpfr.org/mpfr-2.4.1/patches
(once downloaded, this needs to be renamed to mpfr-2.4.1.patch)

==
== Building
==

Install Ubuntu-10.04.4-server-i386.iso
   I allocated 10G of hard disk space for the VM
   After building tool chain and firmware, 62.9% of 9.15GB was used

Edit /etc/apt/sources.list
   Replace all "gb.archive" with "old-releases"
   Replace all "security.ubuntu" with "old-releases"

sudo apt-get update
sudo apt-get upgrade
sudo apt-get install <list of packages kept back> (force install of packages with new dependencies)
sudo apt-get autoremove

sudo apt-get install gcc
sudo apt-get install libncurses-dev
sudo apt-get install bison
sudo apt-get install texinfo
sudo apt-get install flex
sudo apt-get install g++
sudo apt-get install gawk
sudo apt-get install autoconf
sudo apt-get install zlib1g-dev
sudo apt-get install libcurses-ocaml-dev
sudo apt-get install gettext
sudo apt-get install unzip

Transfer the following files to the Ubuntu VM:
   uclibc-crosstools-gcc-4.4.2-1-full.tar.bz2
   the six files required for building tool chain
   the Olipro git repository files

== ( build tool chain )

sudo bash

mkdir /opt/toolchains

Unpack uclibc-crosstools-gcc_source-4.4.2-1.tar.bz2 in /usr/src

cd /usr/src/buildroot-4.4.2-1

make distclean

make menuconfig

Follow step 6 in
https://community.netgear.com/t5/DSL-Modems-Routers/Compiling-the-toolchain-for-the-DGND3700v2/m-p/1073898
(except that "Tool chain and header file location" should be
"/opt/toolchains/uclibc-crosstools-gcc-4.4.2-1"
and not
"/opt/toolchains/uclibc-crosstools-gcc-4.4.2-1-with-ftw")

mkdir –p output/dl

cd output/dl

Copy in the six files required for building tool chain

cd ../..

make

exit sudo

== ( build Zyxel firmware )

"sudo dpkg-reconfigure dash and say NO (switches /bin/sh to /bin/bash)"

sudo ln -s /opt/toolchains/uclibc-crosstools-gcc-4.4.2-1-with-ftw /opt/toolchains/uclibc-crosstools-gcc-4.4.2-1
(this is not required if the change to step 6 above is followed)

Unpack the Olipro git repository files into a temp directory

cd to the temp directory

make PROFILE=VMG1312-B10A

"You can flash images/ras.bin straight to your device from the device’s Web UI."

[j0hn]

zyxel give you everything you need to build the firmware.

Then for the broken sources simply edit /etc/apt/sources.list and change archive.ubuntu.com and security.ubuntu.com to old-releases.ubuntu.com.

no need to look for a single package anywhere.

edit: to add, that's on a completely fresh install of Ubuntu 10.04

There are clear instructions earlier in the thread. I think anyone attempting to follow your guide is making a lot of work for themselves.

[jhm]

zyxel give you everything you need to build the firmware.

I'm not sure because I don't have what Zyxel provide (but I hopefully will in a day or so!) but as I seem to make out, I think Olipro added the tool chain binaries (the MIPS cross compiler).  That's why he wrote in the README file:

Toolchain binaries are not provided for distribution, they are purely here "unintentionally". You can get the source for it off ZyXeL anyway if you want it or I'll go bug them for sources - for a fee.

So it's a case of either (i) using the tool chain binaries as provided by Olipro or (ii) compiling from source (my instructions above).  Maybe I'm just a bit paranoid but I prefer to compile from source code if I can.

[johnson]

Indeed, though its admirable you have put one together yourself, the source package comes with everything you need. I would also be hesitant to flash what comes out of your self rolled chain if I didn't have a usb to serial converter at hand to debrick, just in case.

What Olipro means is he is redistributing what zyxel gave him.

Edit: For fun if you throw the VMG1312 firmware you have compiled up on dropbox or similar I will flash it, have one on the desk right now.

[Weaver]

@jhm welcome jhm - I am another Firebrick FB2700 and FB2500, four-way IP-bonded AA user. I use ZyXEL VMG 1312-B10A modems with user johnson’s MTU 1508 modified firmware.

By some good fortune I have not bumped into the packet accelerator caching bug. It must be due to my particular usage pattern.

[jhm]

Ah, if I'd not misunderstood and realised that Zyxel provide the tool chain binaries, I would not have spent a good part of today working on this!

Edit: For fun if you throw the VMG1312 firmware you have compiled up on dropbox or similar I will flash it, have one on the desk right now.

Thank you!  Here you go:

https://www.dropbox.com/s/i0zgs2yp5gd06l9/ras.bin

but as you say, I hope you have a USB to serial converter handy just in case...

[johnson]

Flashed and it boots just fine

Obviously have not tried it on a line, but it has all the MTUs set as expected.

[jhm]

Excellent - that's a relief!

I will wait for the VMG3925-B10B firmware from Zyxel so that I can try the same on my box then.

[johnson]

They are usually pretty prompt about responding, should have it by tomorrow evening.

I dont know how much you have messed with your VMG3925, but last time I spoke to someone with one they had to gain the supervisor password in order to get DSLStats working with it, the top thread over in the Modem Unlocking section has a fairly comprehensive guide, does involve cracking a hash which isnt much fun without a GPU.

[jhm]

@jhm welcome jhm - I am another Firebrick FB2700 and FB2500, four-way IP-bonded AA user. I use ZyXEL VMG 1312-B10A modems with user johnson’s MTU 1508 modified firmware.

By some good fortune I have not bumped into the packet accelerator caching bug. It must be due to my particular usage pattern.

Thank you, weaver.  Do you mean that you bond the four lines using two FireBricks at your end ?  Or one at your end and the other at A&A (although I thought this configuration is only required if you're bonding lines from more than one ISP) ?

From what I read, I think the packet accelerator caching bug affects mainly (or only ?) those running VPNs.

[jhm]

I dont know how much you have messed with your VMG3925, but last time I spoke to someone with one they had to gain the supervisor password in order to get DSLStats working with it, the top thread over in the Modem Unlocking section has a fairly comprehensive guide, does involve cracking a hash which isnt much fun without a GPU.

I haven't touched my VMG3925 since receiving it from A&A as a freebie when I signed up for a 12-month contract with them on my second line.  I have A&A on my main line and was with BT on the second line - both using a HG612.

If the VMG3925 with new firmware works in bridge mode with baby jumbo frames, I'll get another one and replace the two HG612s.

In relation to the supervisor password and without looking into it yet, I wonder if it's possible to just fix this in the firmware rather than cracking the hash ?  I see this in the VMG1312 firmware:

VMG1312-B10A/targets/fs.src/etc/profile:  echo
"supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd

This is what presumably gives you the fixed supervisor password on the VMG1312 so I wonder if it's possible to make a change to the firmware of the VMG3925 to do something like this.

[johnson]

Thats a good shout, but the reason special measures are required to obtain the supervisor password on the 3925 is a firmware change to obfuscate it. On the 1312s and 8324/8924s its given up in plain text by issuing a "dumpmdm" command.

Not to say there isnt a similarly simple target area in the 3925, just maybe it resides somewhere else in this modems source.

[j0hn]

Newer Zyxels don't have the dumpmdm command and the Supervisor pass isn't available without cracking the hash.

It's not a method that's used for the fun of it 

[burakkucat]

In relation to the supervisor password and without looking into it yet, I wonder if it's possible to just fix this in the firmware rather than cracking the hash ?  I see this in the VMG1312 firmware:

VMG1312-B10A/targets/fs.src/etc/profile:  echo
"supervisor:3Gnc.CJE1790M:0:0:Administrator:/:/bin/sh" > /var/passwd

This is what presumably gives you the fixed supervisor password on the VMG1312 so I wonder if it's possible to make a change to the firmware of the VMG3925 to do something like this.

Look a little closer and you will see that is only an initial set-up of the "passwd" file with a descrypt() encrypted string. Further manipulation then takes place.

Now, if what you imply is true, someone who knows their descrypt() from many years ago would recognise "3G" as the salt and "nc.CJE1790M" as the perturbation resulting from an operation with a string of length no more than eight characters.