Zyxell Prestige-650R-30
This is a wish project. These routers are thrown away and probably can get a second life.
a peek inside
27570485842752601204759
ZYXEL Prestige 650
U1: ZyDAS (CPU) ZD2001 MFB4007.1 0309 WAVEPLUS TAIWAN
U2: MTC-20156TQ-C1 (PROBABLY SECOND CPU OR SOMETHING ELSE) C156-4AB ARM LAUBT0311 TAIWAN ST
J4: 1-VTREF? 2,4,6,8,10,12,14-GND 3-TRST (pin174) 5-TDI (pin1) 7-TMS (pin175) 9-TCK (pin171) 11-TDO(pin176) 13-VTREF?
U3: MTC20154TGC (ADSL CHIPSET) 1301533 7221F0309 MALTA ST
U4: ALTIMA (LAN CONTROLLER) AC101LKQT TN0310 P11 70850A
U5: MX SO31445 (FLASH ROM) 29LV160BTC-90 2H191700 TAIWAN 16M-BIT [2Mx8/1Mx16] CMOS SINGLE VOLTAGE 3V ONLY FLASH MEMORY
U6: WINBOND (DRAM MODULE 1) 3150G W986432DH-7
U7: WINBOND (DRAM MODULE 2) 311WH W981616BH-7
The serial
without jp21 set
Bootbase Version: V1.11 | 3/4/2003 10:26:13 RAM: Size = 8192 Kbytes DRAM POST: Testing: 8192K OK FLASH: AMD 16M *1 ZyNOS Version: V3.40(GT.5) | 3/16/2005 10:42:52 Press any key to enter debug mode within 3 seconds. ............................................................ Copyright (c) 1994 - 2003 ZyXEL Communications Corp. initialize ch = 0, ethernet address: 00:a0:c5:71:26:ff Wan Channel init ........ done Loading ADSL modem F/W ............................................................... done Press ENTER to continue...
Enter Debug Mode at OK athe ======= Debug Command Listing ======= AT just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k ATENx,(y) set BootExtension Debug Flag (y=password) ATSE show the seed of password generator ATTI(h,m,s) change system time to hour:min:sec or show current time ATDA(y,m,d) change system date to year/month/day or show current date ATDS dump RAS stack ATDT dump Boot Module Common Area ATDUx,y dump memory contents from address x for length y ATRBx display the 8-bit value of address x ATRWx display the 16-bit value of address x ATRLx display the 32-bit value of address x ATGO(x) run program at addr x or boot router ATGR boot router ATGT run Hardware Test Program ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations) ATSH dump manufacturer related data in ROM ATDOx,y download from address x for length y to PC via XMODEM ATTD download router configuration to PC via XMODEM ATUR upload router firmware to flash ROM ATLC upload router configuration file to flash ROM ATXSx xmodem select: x=0: CRC mode(default); x=1: checksum mode
atsh
ZyNOS Version : V3.40(GT.5) | 3/16/2005 10:42:52
Bootbase Version : V1.11 | 3/4/2003 10:26:13
Vendor Name : ZyXEL Communications Corp.
Product Model : Prestige 650R-31
ZyNOS ROM address : bfc08000
System Type : 7
MAC Address : 00A0C5123456
Default Country Code : FF
Boot Module Debug Flag : 00
RomFile Version : 27
RomFile Checksum : 3fcf
ZyNOS Checksum : e1af
Core Checksum : 2175
SNMP MIB level & OID : 060102030405060708091011121314151617181920
Main Feature Bits : 86
Other Feature Bits :
93 02 00 00 00 00 00 00-00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00-00 00 13 00 00 00
with jp21 set
Bootbase Version: V1.11 | 3/4/2003 10:26:13 RAM: Size = 8192 Kbytes DRAM POST: Testing: 8192K OK FLASH: AMD 16M *1 ZyNOS Version: V3.40(GT.5) | 3/16/2005 10:42:52 Press ESC key to enter debug mode within 3 seconds. ............................................................ HTP: build at Mar 04 2003 17:38:20 Hardware Test Start... HTP: Phase 1 HTP: Phase 2 item = 0x04 UART Internal Loopback FAIL 0x01 HTP: Phase 3 HTP_Cmd>
HTP_Cmd>athe
======= HTP Command Listing =======
AT just answer OK
ATHE print help
ATSR system reboot
ATWBx,y write address x with 8-bit value y
ATWWx,y write address x with 16-bit value y
ATWLx,y write address x with 32-bit value y
ATRBx display the 8-bit value of address x
ATRWx display the 16-bit value of address x
ATRLx display the 32-bit value of address x
ATTIx,y test item x, parameter y (in hex)
ATESx,y send a ethernet frame, x=cnts, y=length
AT
item = 0x04 UART Internal Loopback
item = 0x05 LAN Internal Loopback
item = 0x06 ADSL CTRLE Interface
item = 0x08 SAR Internal Loopback
item = 0x09 UART External Loopback
item = 0x0A LAN External LoopbackEOx switch the statistic counting
ATED show receive cnts of Ethernet
ATASx,y send a AAL5 packet, x=cnts, y=length
ATAR display pico meteor's registers
ATAD display pico meteor's on chip sram
ATDUx,y dump memory contents from address x for length y
HTP_Cmd>OK
During flash
start_blk = 0x00000003 end_blk = 0x00000022 start = 0x804BE164 end = 0x8062CE48 end = 0x0016ECE4 Start erase flash rom Finish erase flash rom Start program flash rom Finish program flash rom Start Reboot