Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Creating image files for the Update Software feature in the Zyxel PMG3000-D20B web interface

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file (rename to 'header') and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

Firmware collection

Change extension to .zip and extract.
.img: raw mtd2 flash dump
.upf: with header

V1 00(ABVJ 0)b3s (2020-12-23)

V1 00(ABVJ 0)b3v (2021-05-08)

V1 00(ABVJ 1)b1e (2023-07-26)

V2 50(ABVJ 1)b1d (2023-04-21)

Please leave a comment if you have any other flash dumps.

@maurice-w hi and thanks for this gist!
i'm considering an update but my module is getting incredibly hot and maybe it's a lost cause anyway.
could you tell me how hot your module gets? mine gets too hot to touch after a few minutes.

@yogo1212 I think that's normal. Mine currently reports 75°C. And yes, that's too hot for prolonged touching.

It works just fine at these temperatures.

@maurice-w thanks a lot! i'll give it another go, then 🚂