Eircom are currently several firmware versions behind ZyXel for the Eircom F1000 Router. The current beta release from ZyXel UK includes a fix for port forwarding bugs, in particular where a resync takes out the applied rules.
For those who are interested, and understand the risk that you may kill your Zyxel Eircom F1000 Router, I attach a full log of an Eircom F1000 unlock followed by flashing both the ZyXel Eircom F1000 Router bootloader and the latest firmware.
To proceed with the flash, you will need a phillips screwdriver, a USB-TTL serial cable, communications software that supports serial and xModem protocols. Soldering skills are not required as the board comes with a serial header. Serial port is 115200baud, 8bit, no parity. Do NOT connect Vcc on the USB-TTL cable. The IP address of your PC ethernet port should be set manually to 192.168.1.100. Your browser will need to open 192.168.1.1 to upload the latest ZyXel firmware – you may need to clear the cache on your browser for this to work.
=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2014.10.05 12:23:36 =~=~=~=~=~=~=~=~=~=~=~=
HELO
CPUI
L1CI
HELO
CPUI
L1CI
DRAM
—-
PHYS
STRF
400H
PHYE
DDR3
NREF
SIZ4
SIZ3
SIZ2
DINT
USYN
LSYN
MFAS
LMBE
RACE
PASS
—-
ZBSS
CODE
DATA
L12F
MAIN
CFE version 1.0.38-112.118 for BCM963268 (32bit,SP,BE)
Build Date: 02/01/2013 (jennifer@msgsw3-i7)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name TOSHIBA TC58NVG0S3E, id 0x98d1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
Checking Reset button on EXT INTR 0
Board IP address : 192.168.1.1:ffffff00
Host IP address : 192.168.1.100
Gateway IP address :
Run from flash/host (f/h) : f
Default host run file name : vmlinux
Default host flash file name : bcm963xx_fs_kernel
Boot delay (0-9 seconds) : 1
Boot image (0=latest, 1=previous) : 0
Board Id (0-14) : 963168VX
Number of MAC Addresses (1-32) : 12
Base MAC Address : ec:43:f6:9f:b7:e0
PSI Size (1-128) KBytes : 128
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0
Voice Board Configuration (0-5) :
*** Press any key to stop auto run (1 seconds) ***
CFE> atsh
FW Version : 1.32(VQG.4)D0
External Version : 1.00(AAHA.4)D0
Bootbase Version : V1.59 | 02/01/2013 17:48:02
Vendor Name : MitraStar Technology Corp.
Product Model : DSL-2492GNU-B1B
Serial Number : S130Y28062906
WPA-PSK : 9ddccce49ae3
First MAC Address : EC43F69FB7E0
Last MAC Address : EC43F69FB7EB
MAC Address Quantity : 12
Default Country Code : EB
Boot Module Debug Flag : 00
RootFS Checksum : af6b7ced
ImageDefaultChecksum : a2095f79
Main Feature Bits : 00
Other Feature Bits :
4d 53 60 09 00 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-00 00 00 00 00 00
*** command status = 0
CFE> athe
Available commands:
ATSE show the seed of password generator
ATEN set BootExtension Debug Flag
ATCR Clear console screen
ATSH dump manufacturer related data in ROM
ATUR xmodem upload router firmware to flash ROM
ATIR Set ImageDefault to ROM-D partition
ATER Erase ROM-D partition
ATBL Print boot line and board parameter info
ATDU Dump memory or registers.
ATBR Reset to default Romfile
ATGO boot router
ATSR system reboot
ATMB Use for multiboot.
ATHE print help
For more information about a command, enter ‘help command-name’
*** command status = 0
CFE> atse DSL-2492GNU-B1B
00012F9FB7E0 aten 1, 10F0A7BD athe atbt 1 ATWZ EC43F6470F58, 01, 01, 00, 0C
CFE> atbt 1
OK
*** command status = 0
CFE> atub atsh
FW Version : 1.32(VQG.4)D0
External Version : 1.00(AAHA.4)D0
Bootbase Version : V1.59 | 02/01/2013 17:48:02
Vendor Name : ZyXEL Communications Corp.
Product Model : VMG8924-B10A
Serial Number : S090Y00000000
WPA-PSK : 1234567890AB
First MAC Address : CC5D4E000001
Last MAC Address : CC5D4E00000C
MAC Address Quantity : 12
Default Country Code : FF
Boot Module Debug Flag : 01
RootFS Checksum : af6b7ced
ImageDefaultChecksum : a2095f79
Main Feature Bits : 00
Other Feature Bits :
4d 53 60 06 00 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-00 00 00 00 00 00
*** command status = 0
CFE>
web info: Waiting for connection on socket 1.
web info: Waiting for connection on socket 0.
web info: Upload 24008989 bytes, Broadcom image format.
CFE>
Flashing root file system and kernel at
0xb8020000: …………………………………………………………………
………..CFE> atsh
FW Version : V1.00(AAKL.6)b1
Bootbase Version : V1.60 | 05/10/2013 10:23:51
Vendor Name : ZyXEL Communications Corp.
Product Model : VMG8924-B10A
Serial Number : S090Y00000000
First MAC Address : CC5D4E000001
Last MAC Address : CC5D4E00000C
MAC Address Quantity : 12
Default Country Code : FF
Boot Module Debug Flag : 01
RootFS Checksum : 2cc62fa4
ImageDefaultChecksum : a61e601e
Main Feature Bits : 00
Other Feature Bits :
4d 53 60 06 00 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-00 00 00 00 00 00
*** command status = 0
CFE> atbt 1
OK
*** command status = 0
CFE> atbp
Press: to use current value
‘-‘ to go previous parameter
‘.’ to clear the current value
‘x’ to exit this command
963268SV1 —— 0
963268MBV(obsolete) —— 1
963168VX —— 2
963268BU —— 3
963268BU_P300 —— 4
963168MBV_17A —— 5
963168MBV_30A —— 6
963168XH —— 7
963168MP —— 8
963268V30A —— 9
963168MEDIA —— 10
963268SV2 —— 11
963168XFG3 —— 12
963168XF —— 13
963168MXH_17A —— 14
Board Id (0-14) : 2
Number of MAC Addresses (1-32) : 12
Base MAC Address : cc:5d:4e:00:00:01 ec:43:f6:9f:b7:e0 PSI Size (1-128) KBytes : 128
Enable Backup PSI [0|1] : 0
System Log Size (0-256) KBytes : 0
Main Thread Number [0|1] : 0
Press: to use current value
‘-‘ to go previous parameter
‘.’ to clear the current value
‘x’ to exit this command
SI3217X — 0
VE890_INVBOOST — 1
LE88506 — 2
SI32267 — 3
LE88536_ZSI — 4
LE88266 — 5
Voice Board Configuration (0-5) : 1CFE> atsh
FW Version : V1.00(AAKL.6)b1
Bootbase Version : V1.60 | 05/10/2013 10:23:51
Vendor Name : ZyXEL Communications Corp.
Product Model : VMG8924-B10A
Serial Number : S090Y00000000
First MAC Address : EC43F69FB7E0
Last MAC Address : EC43F69FB7EB
MAC Address Quantity : 12
Default Country Code : FF
Boot Module Debug Flag : 01
RootFS Checksum : 2cc62fa4
ImageDefaultChecksum : a61e601e
Main Feature Bits : 00
Other Feature Bits :
4d 53 60 06 00 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-00 00 00 00 00 00
*** command status = 0
CFE>
I do not encourage anyone to do this who is not efficient with electronics, I simply pass on the know how to those who wish to do it.
NB: Do NOT use the VCC connector on the header. Serial is 115200baud, 8bits, no parity.
Leave A Comment