Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Zyxel PMG3000-D20B firmware image files

The firmware of this GPON ONT SFP module can be updated using the web interface (Management | Update Software):

The web interface only accepts image files with a special header. These can be created by adding the header to a flash dump.

Firmware collection

.img unmodified mtd2 / mtd3 flash dump
.upf with header (can be installed using the web interface)

V1.00 is based on OpenWrt 12.09. Deutsche Telekom (Germany) seems to stick with this branch.

V1.00(ABVJ.0)b3s (2020-12-23)

V1.00(ABVJ.0)b3v (2021-05-08)

V1.00(ABVJ.1)b1e (2023-07-26)

V2.50 is based on OpenWrt 14.07. Wind Tre (Italy) upgraded to this branch at the end of 2022.

V2.50(ABVJ.1)b1d (2023-04-21)

V2.50(ABVJ.1)b1f (2023-07-14)

Both branches are maintained separately, so a 1.00 image can have a later build date than a 2.50 image.

Please leave a comment if you have any other flash dumps.

Creating image files

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

@maurice-w Sorry, I'm an idiot, it's all good!

@maurice-w Thanks for providing those firmwares! Did you notice any difference with ipv6 support in these firmware versions?

Hey @bentau, IPv6 works fine in all of them, >99% of my traffic is IPv6. GPON shouldn't really care about layer 3, it handles Ethernet frames regardless of their contents.

My ISP does use PPPoE though, so any potential bugs regarding plain IPv6-over-Ethernet would have gone unnoticed.

Or do you mean the management (web interface / ssh)? Unfortunately, that's IPv4-only in all versions.

I noticed that this GPON module does not work with my provider with IPv6. I don't get any IPv6 IP with it. v4 just works.
However, the one that I bought from fs.com actually does work with IPv6 (same router and provider).

Also, https://hack-gpon.org/ont-zyxel-pmg3000-d20b/ says that someone also had problems with IPv6.

@bentau Do you use PPPoE or plain IP over Ethernet?

A different SFP working with the same router and ISP might indeed indicate an issue with the Zyxel SFP. Have you tried all firmware versions?

@maurice-w I think I use plain IP over Ethernet. At least I didn't have to configure PPPoE on my mikrotik router

I haven't tested the firmware versions yet. Since I have a working module, getting the Zyxel to work is low priority now.

@bentau That makes sense. Since my module doesn't ever see "naked" IPv6 packets (everything is encapsulated in PPPoE), I wouldn't notice potential bugs with that.

Firmware links are down, anybody has a mirror?

@AyrtonRicardo The links were never down, just a bit... special. But since you're the third person asking for assistance with the download, I've decided to change the way the binaries are embedded in the gist. Should be easier now.

Thank you very much for maintaining this open. I took the file from one of your comments, I honestly appreciate the dedication.