Zyxell Prestige-650R-30

This is a wish project. These routers are thrown away and probably can get a second life.

a peek inside

27570485842752601204759

ZYXEL Prestige 650

U1: ZyDAS (CPU)
ZD2001
MFB4007.1 0309
WAVEPLUS
TAIWAN 

U2: MTC-20156TQ-C1 (PROBABLY SECOND CPU OR SOMETHING ELSE)
C156-4AB ARM
LAUBT0311
TAIWAN
ST

J4:
1-VTREF?
2,4,6,8,10,12,14-GND
3-TRST (pin174)
5-TDI (pin1) 
7-TMS (pin175)
9-TCK (pin171)
11-TDO(pin176)
13-VTREF?

U3: MTC20154TGC (ADSL CHIPSET)
1301533
7221F0309
MALTA
ST

U4: ALTIMA (LAN CONTROLLER)
AC101LKQT
TN0310 P11
70850A

U5: MX SO31445 (FLASH ROM)
29LV160BTC-90
2H191700
TAIWAN
16M-BIT [2Mx8/1Mx16] CMOS SINGLE VOLTAGE 3V ONLY FLASH MEMORY

U6: WINBOND (DRAM MODULE 1)
3150G
W986432DH-7

U7: WINBOND (DRAM MODULE 2)
311WH
W981616BH-7

The serial

without jp21 set

Bootbase Version: V1.11 | 3/4/2003 10:26:13
RAM: Size = 8192 Kbytes
DRAM POST: Testing:  8192K
OK
FLASH: AMD 16M *1
ZyNOS Version: V3.40(GT.5) | 3/16/2005 10:42:52 
Press any key to enter debug mode within 3 seconds.
............................................................
Copyright (c) 1994 - 2003 ZyXEL Communications Corp.
initialize ch = 0, ethernet address: 00:a0:c5:71:26:ff
Wan Channel init ........ done
Loading ADSL modem F/W
............................................................... done
Press ENTER to continue...

Enter Debug Mode 
at
OK
athe
======= Debug Command Listing =======
AT          just answer OK
ATHE          print help
ATBAx         change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.2k
ATENx,(y)     set BootExtension Debug Flag (y=password)
ATSE          show the seed of password generator
ATTI(h,m,s)   change system time to hour:min:sec or show current time
ATDA(y,m,d)   change system date to year/month/day or show current date
ATDS          dump RAS stack
ATDT          dump Boot Module Common Area
ATDUx,y       dump memory contents from address x for length y
ATRBx         display the  8-bit value of address x
ATRWx         display the 16-bit value of address x
ATRLx         display the 32-bit value of address x
ATGO(x)       run program at addr x or boot router
ATGR          boot router
ATGT          run Hardware Test Program
ATRTw,x,y(,z) RAM test level w, from address x to y (z iterations)
ATSH          dump manufacturer related data in ROM
ATDOx,y       download from address x for length y to PC via XMODEM
ATTD          download router configuration to PC via XMODEM
ATUR          upload router firmware to flash ROM
ATLC          upload router configuration file to flash ROM
ATXSx         xmodem select: x=0: CRC mode(default); x=1: checksum mode

atsh
ZyNOS Version          : V3.40(GT.5) | 3/16/2005 10:42:52
Bootbase Version       : V1.11 | 3/4/2003 10:26:13
Vendor Name            : ZyXEL Communications Corp.
Product Model          : Prestige 650R-31
ZyNOS ROM address      : bfc08000
System Type            : 7
MAC Address            : 00A0C5123456
Default Country Code   : FF
Boot Module Debug Flag : 00
RomFile Version        : 27
RomFile Checksum       : 3fcf
ZyNOS Checksum         : e1af
Core Checksum          : 2175
SNMP MIB level & OID   : 060102030405060708091011121314151617181920
Main Feature Bits      : 86
Other Feature Bits     :
         93 02 00 00 00 00 00 00-00 00 00 00 00 00 00 00
         00 00 00 00 00 00 00 00-00 00 13 00 00 00

with jp21 set

Bootbase Version: V1.11 | 3/4/2003 10:26:13
RAM: Size = 8192 Kbytes
DRAM POST: Testing:  8192K
OK
FLASH: AMD 16M *1
ZyNOS Version: V3.40(GT.5) | 3/16/2005 10:42:52
Press ESC key to enter debug mode within 3 seconds.
............................................................
HTP: build at Mar 04 2003 17:38:20
Hardware Test Start...
HTP: Phase 1
HTP: Phase 2
   item = 0x04 UART  Internal Loopback FAIL 0x01
HTP: Phase 3
HTP_Cmd>

HTP_Cmd>athe
======= HTP Command Listing =======
AT            just answer OK
ATHE          print help
ATSR          system reboot
ATWBx,y       write address x with  8-bit value y
ATWWx,y       write address x with 16-bit value y
ATWLx,y       write address x with 32-bit value y
ATRBx         display the  8-bit value of address x
ATRWx         display the 16-bit value of address x
ATRLx         display the 32-bit value of address x
ATTIx,y       test item x, parameter y (in hex)
ATESx,y       send a ethernet frame, x=cnts, y=length
AT
    item = 0x04 UART  Internal Loopback
    item = 0x05 LAN   Internal Loopback
    item = 0x06 ADSL  CTRLE   Interface
    item = 0x08 SAR   Internal Loopback
    item = 0x09 UART  External Loopback
    item = 0x0A LAN   External LoopbackEOx         switch the statistic counting
ATED          show receive cnts of Ethernet
ATASx,y       send a AAL5 packet, x=cnts, y=length
ATAR          display pico meteor's registers
ATAD          display pico meteor's on chip sram
ATDUx,y       dump memory contents from address x for length y
HTP_Cmd>OK

During flash

start_blk = 0x00000003
end_blk = 0x00000022
start = 0x804BE164
end = 0x8062CE48
end = 0x0016ECE4
Start erase flash rom
Finish erase flash rom
Start program flash rom
Finish program flash rom
Start Reboot

Links

• http://wobbled.org/stuff/prestige/DebugCommandListing
• http://wobbled.org/stuff/prestige/consolecable/