Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[_jjjj]

Hello,

Could someone point me in the right direction to reset a ZyXEL VMG1312-B10D so I can set it up from scratch please?

I bought a "new" unit recently but it turns out the seller had lost the admin password despite it appearing to be in its original packaging. The online user guide states the password is on the back of unit but it only lists the SSID and code. I've had a good search here and elsewhere online for an answer but have draw a blank after trying various factory reset options with default passwords (both for admin and supervisor) - in desperation I even tried the s/n and other numbers on the packaging but with no joy. The http, ssh and telnet services are all accessible but all want a username/password.

Thanks in advance

J

[burakkucat]

Welcome to the kitz forum. 

The ZyXEL VMG1312-B10D does not rate highly on my list of CPEs (I owned one back in 2017 but it went "weird on me" and I was not happy with recovering it) but they are still competent, usable, devices.

I strongly suspect that you will need to open up the unit, connect to the serial console header pins on the PCB, power the unit on, interrupt the boot process and proceed to reset the device from the Broadcom Common Firmware Environment (CFE>) prompt.

Code: [Select]

HELO
CPUI
L1CI
HELO
CPUI
L1CI
4.1602A-1.0.38-116.140
PMCI
PMCM
DRAM
----
PHYS
PHYE
DDR1
400H
SIZ4
SIZ3
LMBE
RACE
PASS
----
ZBSS
CODE
DATA
L12F
MAIN
NDCK
NDB0
. . .  <snip> . . .
FPS0
BT10
0001
BT11
0480
NAN3
RFS2
NAN5


Base: 4.16_02A
CFE version 1.0.38-116.140 for BCM963381 (32bit,SP,BE)
Build Date: 08/03/2015 (root@ZT01605-LINUX)
Copyright (C) 2000-2013 Broadcom Corporation.

Chip ID: BCM63381B0, MIPS: 600MHz, DDR: 400MHz, Bus: 300MHz
Main Thread: TP0
Total Memory: 67108864 bytes (64MB)
Boot Address: 0xb8000000

NAND ECC Hamming, page size 0x800 bytes, spare size used 64 bytes
NAND flash device: ESMT F59L1G81MA, id 0xc8d1 block 128KB size 131072KB
pmc_init:PMC using DQM mode
Board IP address                  : 192.168.1.1:ffffff00 
Host IP address                   : 192.168.1.33 
Gateway IP address                :   
Run from flash/host/tftp (f/h/c)  : f 
Default host run file name        : vmlinux 
Default host flash file name      : bcm963xx_fs_kernel 
Boot delay (0-9 seconds)          : 1 
Boot image (0=latest, 1=previous) : 0 
Default host ramdisk file name    :   
Default ramdisk store address     :   
Board Id (0-8)                    : 963381_VMG1312 
Number of MAC Addresses (1-32)    : 12 
Base MAC Address                  : U:V:W:X:Y:Z 
PSI Size (1-64) KBytes            : 64 
Enable Backup PSI [0|1]           : 0 
System Log Size (0-256) KBytes    : 0 
Auxillary File System Size Percent: 0 
Main Thread Number [0|1]          : 0 
WLan Feature                      : 0x00 

*** Press any key to stop auto run (1 seconds) ***
Auto run second count down: 1
CFE> ATEN 1 10f0a563

OK
*** command status = 0
CFE>
web info: Waiting for connection on socket 0.
CFE> ATHE
Available commands:

ATMB                Use for multiboot.
ATBB                Mark/unmark the Block X to be bad block.
ATCMP               Compare the contents at start address X and Y with
                    Length Z
ATLD                Download data with file name X to memory address Y
                    from PC via TFTP
ATRB                Load the CFERAM to run by TFTP or UART!
ATDS                Dump data of spare area in block X`s page Y
ATRF                Read/Dump flash data
ATER                Erase NAND flash from block X to block Y
ATWF                Write data from RAM to flash
ATRT                Test memory.
ATCR                reset to default, erase Data partition
ATCD                Erase ROM-D partition
ATWZ                write (a)MAC addr, (b)Country code, (c)EngDbgFlag,
                    (d)FeatureBit, (e)MAC Number to NVRAM
ATCO                set Country Code to NVRAM.
ATSN                set Series Number to NVRAM.
ATSH                dump manufacturer related data from NVRAM
ATGO                Run program from flash image or from host depend on
                    [f/h] flag.
ATSE                show the seed of password generator
ATEN                set BootExtension Debug Flag
ATBT                block0 write enable
ATPH                Set/Get PHY`s registers.
ATWW                Set memory or registers.
ATDU                Dump memory or registers.
ATBL                Print boot line and board parameter info
ATIP                Change booline parameters
ATAF                Change board AFE ID
ATBP                Change board parameters
ATSR                System reboot
ATUD                Upload ROM-D to flash from TFTP
ATUB                Upload bootloader to flash from TFTP
ATUR                Upload router firmware to flash from TFTP
ATUW                Write the whole image start from beginning of the flash from TFTP
ATHE                print help

For more information about a command, enter 'help command-name'
*** command status = 0
CFE> ATCD
Erase ROM-D partition? (y/n):y
*** command status = 0
CFE> ATCR
Erase Data partition? (y/n):y
*** command status = 0
CFE> ATSH

Firmware Version       : V5.11(AAXA.4)C0
Bootbase Version       : V1.53 | 08/03/2015 10:57:41
Vendor Name            : ZyXEL Communications Corp.
Product Model          : VMG1312-B10D
Serial Number          : S162E13030040
First MAC Address      : xxxxxxxxxxxx
Last MAC Address       : xxxxxxxxxxxx
MAC Address Quantity   : 12
Default Country Code   : 02
Boot Module Debug Flag : 00
Kernel Checksum        : 0000468C
RootFS Checksum        : 0000D827
Rom-D Checksum         : N/A
Main Feature Bits      : 00
Other Feature Bits     :
8075758c: 04050202 ffffffff ffffffff ffffffff    ................
8075759c: ffffffff ffffffff ffffffff ffff         ..............

*** command status = 0
CFE> ATSR

Resetting board in 0 seconds...
HELO
. . .  <snip> . . .


[burakkucat]

Something was niggling away, far in the depths of my mind. 

Finally, I managed to recall the threads responsible for that niggle. So please consult --

• [SOLVED] VMG1312-B10D Locked by ISP - No Admin Password.
• VMG1312-B10D - Guide to unlock unbrand

[_jjjj]

Thanks for the welcome, the quick reply and pointers.

It looks like I was sold a unit as "new but opened" but was actually a "used and tied to an isp" - I'll just have to put that down to experience.

The Zyxel now needs opening up to reset it back to something usable but I'm grateful someone has already written up a guide so I'll have a go!

Thanks

J

[jelv]

Before you start messing about with it, where did you buy it from? Could you return and ask for your money back as it is not as described?

[tiffy]

Thanks for the welcome, the quick reply and pointers.

It looks like I was sold a unit as "new but opened" but was actually a "used and tied to an isp" - I'll just have to put that down to experience.

The Zyxel now needs opening up to reset it back to something usable but I'm grateful someone has already written up a guide so I'll have a go!

Thanks

J

Yes, I had exactly the same experience with a 1312-B10D bought on e-bay, had to resort to the serial interface method to unlock.
The links provided by "b*cat" contain all the necessary information, just have to work through the steps.

I found the biggest problem was getting the case open, very difficult without breaking some of the plastic catches.
My (unlocked) unit is still working perfectly on my daughters PN VDSL 40/10 line, not state of the art by any means but adequate with a good stat's interface via a RPi ZW & DSLStats for remote monitoring.

Plenty of help available if you get stuck, good luck with the project.

Cross post acknowledged:

[_jjjj]

Before you start messing about with it, where did you buy it from? Could you return and ask for your money back as it is not as described?

I have thought about returning it as it did niggle me that the seller is adamant they listed it correctly even though the unit obviously isn't "New" physically or let alone a config point of view.

However, it really isn't worth my time as it cost me less than a tenner and will be one less bit of ewaste if I recover it.

So I'll treat it as a learning opportunity - I'll just buy a new one from the ISP as I originally planned if it all goes bad and I can use the serial/USB cable again for various Pi projects I keep meaning to start.

On the topic of cables, before I order one, could someone confirm that either of these two would do the job please?
https://shop.cyntech.co.uk/products/usb-rb-ttl-cable?variant=443456833
https://www.ebay.co.uk/itm/Universal-PL2303TA-USB-to-TTL-RS232-4-Pin-Serial-Converter-Cable-for-Win-7-8-8-1/153533708713?hash=item23bf5279a9:m:mykrnRB7Ely2zfRe4B_XQNA

Thanks

J

[burakkucat]

On the topic of cables, before I order one, could someone confirm that either of these two would do the job please?
https://shop.cyntech.co.uk/products/usb-rb-ttl-cable?variant=443456833
https://www.ebay.co.uk/itm/Universal-PL2303TA-USB-to-TTL-RS232-4-Pin-Serial-Converter-Cable-for-Win-7-8-8-1/153533708713?hash=item23bf5279a9:m:mykrnRB7Ely2zfRe4B_XQNA

Yes, either of those two will be appropriate for the task.

[tiffy]

@_jjjj:

Further to the post links supplied by "b*cat", have found a further (rather long) post relating by experience with a 1312-B10D which you may fine helpful:
https://forum.kitz.co.uk/index.php/topic,22543.msg384263.html#msg384263

Regarding the USB to serial TTL adaptor:
See reply #40 in the post which lists the unit I used.
I did buy a more costly RPi recommended unit prior to that but it didn't work, all the details are in the referenced post.

[_jjjj]

Hi again,

Update:
Thank you all for the pointers - I've now successfully opened the case, connected a USB/serial adaptor cable (but not VCC, I just use the regular power supply), putty'ed into the device and used ZynPass to make all commands available.

Before I issue the ATCD command to remove the ROM-D partition, I would like to work out which ISP the unit is tied to. This is partly out of curiosity and also wanting to tell the sell once and for all that they incorrectly listed the unit.

Could someone give me some pointers to dump or similar the data on the ROM-D partition please?

Update2:
I gave up trying to read the contents of the ROM-D partition as I had to get the unit into service.

Something worth noting for anyone buying the USB/serial cable - the one I ordered turned out the have an obsolete version of the embedded Prolific USB to Serial bridge controller chip (PL-2303HX or PL-2303X), which meant the drivers only worked under Windows 7 and older. Fortunately the laptop I use for playing/hacking is still on Windows 7 32 bit but there is no way to tell the version of the embedded chip (no markings etc.) until you try using it.

Thanks

J