Zyxel PMG3000-D20B firmware image files

Zyxel PMG3000-D20B firmware image files.md

Zyxel PMG3000-D20B firmware image files

The firmware of this GPON ONT SFP module can be updated using the web interface (Management | Update Software):

The web interface only accepts image files with a special header. These can be created by adding the header to a flash dump.

Firmware collection

.img unmodified mtd2 / mtd3 flash dump
.upf with header (can be installed using the web interface)

V1.00 is based on OpenWrt 12.09. Deutsche Telekom (Germany) seems to stick with this branch.

V1.00(ABVJ.0)b3s (2020-12-23)

V1.00(ABVJ.0)b3v (2021-05-08)

V1.00(ABVJ.1)b1e (2023-07-26) (no ssh)

V1.00(ABVJ.1)b1i (2026-02-06) (no ssh, known compatibility issues)

V2.50 is based on OpenWrt 14.07. Wind Tre (Italy) upgraded to this branch at the end of 2022.

V2.50(ABVJ.1)b1d (2023-04-21)

V2.50(ABVJ.1)b1f (2023-07-14)

Both branches are maintained separately, so a 1.00 image can have a later build date than a 2.50 image.

Please leave a comment if you have any other flash dumps.

Creating image files

Create flash dump of mtd2 or mtd3 (Image A / Image B):

dd if=/dev/mtd2 of=/tmp/mtd2

Download flash dump from SFP (e. g. using TFTP).

Download header file and add it to flash dump:

cat header mtd2 > firmware.upf

Copy software version string from flash dump to header:

dd if=firmware.upf of=firmware.upf bs=1 skip=632 seek=124 count=32 conv=notrunc

Get CRC32 of firmware.upf:

v=$(cat firmware.upf | gzip | tail -c 8 | head -c 4 | hexdump -e '1/4 "%08x"')

Convert CRC32 to binary and write it to header:

echo -e -n "\x${v:0:2}\x${v:2:2}\x${v:4:2}\x${v:6:2}" | dd of=firmware.upf bs=1 seek=104 conv=notrunc

header

Zyxel_PMG3000-D20B_V1.00(ABVJ.0)b3s_2020-12-23.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.0)b3v_2021-05-08.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.1)b1e_2023-07-26.zip

Zyxel_PMG3000-D20B_V1.00(ABVJ.1)b1i_2026-02-06.zip

Zyxel_PMG3000-D20B_V2.50(ABVJ.1)b1d_2023-04-21.zip

Zyxel_PMG3000-D20B_V2.50(ABVJ.1)b1f_2023-07-14.zip

@github-tomster
The module has two firmware partitions, an active and an inactive one. Performing an upgrade / downgrade writes the new image to the inactive partition and then makes it active. So there are always two images installed and you can dump both of them, no matter which one is currently active.

Example:
V1.00(ABVJ.1)b1i is in mtd2 (Image A) and currently active. You then downgrade to V1.00(ABVJ.0)b3v using the web interface, which will write the image to mtd3 (Image B). After the reboot, mtd3 (Image B) is active and V1.00(ABVJ.0)b3v is running. But V1.00(ABVJ.1)b1i is still in mtd2 and can be dumped.
Of course it can be the other way around (V1.00(ABVJ.1)b1i in mtd3 and V1.00(ABVJ.0)b3v in mtd2), this you'll have to check.

omci
show me classid 7

@maurice-w
if it works i can provide the dump next week. 🤞

@maurice-w
let us know if this is the right data:
https://nowtransfer.de/ac7846389c90

@github-tomster
Looks good, thanks a lot! I added it to the collection. Didn't test it yet though. I'm a bit worried I might lock myself out.

@github-tomster
I updated my module and it works fine in a MikroTik hEX S (first generation).

@maurice-w
happy to see it was useful 🥳

you wrote you are using the 2.50 branch. so can you confirm these
have ssh and can be cross-flashed with the 1.00 ❓

I was using V2.50(ABVJ.1)b1f, yes. This has SSH and worked just fine (Deutsche Telekom infrastructure / ISP Telefonica o2). Switching between V1.00 and V2.50 images works just like any other update.

I've now switched to V1.00(ABVJ.1)b1i and will probably keep using this. Works fine for me and I don't really need SSH (although it would be nice of course).

I was using V2.50(ABVJ.1)b1f, yes. This has SSH and worked just fine (Deutsche Telekom infrastructure / ISP Telefonica o2). Switching between V1.00 and V2.50 images works just like any other update.

I've now switched to V1.00(ABVJ.1)b1i and will probably keep using this. Works fine for me and I don't really need SSH (although it would be nice of course).

Does V1.00(ABVJ.1)b1i handle 2.5G ? Currently running V1.00(ABVJ.0)b3v and trying to get 2.5G working which does not seem to work correctly on that version.

Also strange that I am still on V1.00(ABVJ.0)b3v even though Telekom is my ISP.

@digaus I never tried 2.5G since I use the module in a "traditional" SFP slot (1G only).
But I think 2.5G needs to be enabled via SSH and since b1i doesn't have this, your chances are probably better with b3v.
Or you could try a V2.50 image.

Who gets automatic updates and who doesn't does indeed seem to be somewhat random.

@digaus I never tried 2.5G since I use the module in a "traditional" SFP slot (1G only). But I think 2.5G needs to be enabled via SSH and since b1i doesn't have this, your chances are probably better with b3v. Or you could try a V2.50 image.

Who gets automatic updates and who doesn't does indeed seem to be somewhat random.

Used last 2.50 firmware which now works nicely with 2.5G out of the box. No settings changes necessary👍🏻

Now getting full bandwidth of my 1000/500 connection 🙂