Unbranding ZYXEL VMG3625-T20A (Telia/Sonera) Router

This operation can possibly brick your router. So do it only if you know what you are doing. Your router is your own responsibility. There are many so called YouTube videos etc. which have unnecessary and dangerous steps. So use your brain to decide what you need and what you do not. I will stick to bare minimum and as safe as possible steps for this specific router model.

Sometimes ISPs brand the routers and disable features, maybe mess with their settings and perhaps spy on you.

Maybe the router is locked into a specific provider and you need to use it with another. There are many reasons why you may want to install generic ZYXEL firmware to an xDSL router.

Luckily it is rather easy to unbrnad the ZYXEL routers. I have performed this operation on a ZYXEL VMG3625-T20A router which was provided free with (also free) VDSL service. Albeit, free service is limited to 10Mbit/s speed but that is a good enough speed for most people.

What Do We Need?

We need few items for this operation.

• USB TTL Serial adapter
• Putty or any terminal program which supports serial communication
• Tftp client (Windows 10 comes with one!) 

 

Opening The Router Case

This router has only 2 screws under the sticker. Some other routers may have 4 screws. You can feel the placements of he screw holes with your finger if you move on the sticker. You can lift the corners of the sticker with a sharp knife and unscrew the screws. I left the screws under the sticker, so they would not go far.

Once the screws are removed, you can use a plastic prying tool to open the clips. The parts are quite tight, so use patience.

I did not make pictures of this as the operation is vey simple. If you can't manage to open a simple plastic cover, you should stop now.

Here is how the router looks like inside. For our purposes, the most important piece is th 4pin connector.

The 4pin connector...

Connecting Rouer To Serial Adapter

We need to connect the router to serial adapter for communication. As you can see, the 4pin connector pins are marked as GND, NC, RX, TX, and 3.3V. For our purposes, we only need to connect RX, TX, and GND pins.

Important: Now you need to set your TTL adapter to use 3.3v. They usually have a jumper or switch for this purpose.

Modem Side - Serial Adapter Side
RX         - TX
TX         - RX
GND        - GND 

The only thing you need to be careful is to connect TX to RX. There is little which can go wrong.

Open your serial communications program and set it to work with 115200 8N1 setting. If everything is corect, you should see boot messages printed to screen when you turn on the router.

Connecting Router To Ethernet

You will also need to connect the router to ethernet as we will use TFTP to push files to the router. You should set your PCs IP address statically to 192.168.1.10 (or anyting else than 192.168.1.1 in 192.168.1.0/24 network).

Getting Ready To Send Firmware

When you turn on the router, it will give you few seconds to abort the boot process. Press a key to abort it!

You should now be at a prompt which says ZHAL> Now we can start some magic.

First run ATSH command to extract some important information. We will not need this information, but it is good to have in case something goes wrong.

The output will look like following
Firmware Version : V5.30(ABIE.6)b2_E0 Bootbase Version : V1.32 | 03/22/2018 16:56:20 Vendor Name : Zyxel Communications Corp. Product Model : VMG3625-T20A Serial Number : SXXXXXXXXXXXX First MAC Address : XXXXXXXXXXX0 Last MAC Address : XXXXXXXXXXXF MAC Address Quantity : 16 Default Country Code : FF Boot Module Debug Flag : 01 RootFS Checksum : e4d28a4b Kernel Checksum : eeba2049 Main Feature Bits : 00 Other Feature Bits : 840291b4: 04050305 00000100 00000000 00000000 840291c4: 00000000 00000000 00000000 0000
Now we need to get the login code. The login code is required for dangerous operaitons. For this purpose we should feed the Product Model from above output usin ATSE command. We will need to decode this. Luckily some nice people provided a C program which can do it. You can compile it with GCC easily. Obviously this program can be used for other ZYXEL routers! Just see the example in comments section of the program to figure out how to proceed!

/* ZyXEL prestige 660HW series password calculator by brainstorm 
  * Thanks to http://www.adslayuda.com/Zyxel650-9.html authors
  *
  * Example usage:
  *
  * Router:
  * ======
  *
  * ATSE
  * 0028D6DF1C03
  * OK
  *
  * Computer:
  * ========
  *
  * ./zyxel 0028D6DF1C03
  * ATEN 1,221E3111
  *
  * Router:
  * ======
  * ATEN 1,221E3111
  * OK
  *
  * "Dangerous" commands enabled :-)
  *
  * */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

#define magic1  0x10F0A563L
#define magic2  7
#define atse_length 12  /* ATSE command, ZyNOS seed password length */

#define WORD_LENGTH (8*sizeof(value))
int ror(unsigned int value, int places)
{
  return (value>>places)|(value<<(WORD_LENGTH-places));
}


int main (int argc, char* argv[]) {

        char *seed, a[7], c[3];
        unsigned int b,d,e,password;

        if ( argc != 2 ) {
                printf("Only one argument is permitted: 00BDC8667E5B\n");
                exit(-1);

        } else if ( strlen(argv[1]) != atse_length ) {
                printf( "Incorrect parameter length, should be %d characters long\n", atse_length );
                exit (-2);
        }

        seed = argv[1];

        strncpy (a, seed , 6);  //a="ersten" 3Bytes vom seed
        e = strtol(a,NULL,16);  //e=a

        strncpy (c, seed + strlen(seed)-2, 2); //c= last 2 bytes of seed?
        d = strtol(c,NULL,16) & magic2; //d="last byte" AND 7
        b = e + magic1; //

        b = ror(b,d);
        password = b ^ e;
        printf("\nATEN 1,%X\n", password);

        return 0;
}

After entering ATEN command we can finally upload the firmware. If you downloaded the firmware files from ZYXEL site, you will see that there is a BIN file which is about 17Mbyte in size. I renamed this file as zyxel.bin just for easy typing.

Now we need to tell the router that we are about to send it firmware image named, you guessed it, zyxel.bin. The command for tis operation is ZHAL> ATUR zyxel.bin The router will wait you to send the file

Upgrade to rootfs partition 1
TFTP server is started, put your file 'zyxel.bin' to server (IP is 192.168.1.1).

Now from windows we can send the file in binary mode. We need ot use the -i flag for binary transfer with windows tftp client. So the command should look like tftp -i 192.168.1.1 PUT zyxel.bin. We already set the IP address of our machine statically so it should work just fine. So the complete output should look like below:

ZHAL> ATSE VMG3625-T20A
0EA420ED3340
ZHAL> ATEN 1,10F1EDA3
ZHAL> ATUR zyxel.bin
Upgrade to rootfs partition 1
TFTP server is started, put your file 'zyxel.bin' to server (IP is 192.168.1.1).
.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
Total 17498534 (0x10B01A6) bytes received

File download to memory address 0x80020000, length is 17498534

Please be patient, start to upgrade RAS!

...........................................................................................................................................................................................................................................................................................................................................................................................................................................

Update boot flag to 1
...
Auto reboot after 2 seconds
ZHAL>

Router will reboot by itself and you need to wait patiently as this will take few minutes at least. Meanwhile, not forget to remove the static IP setting from your ethernet adapter or you may regret not doing it later.

Next Step

Obviously the next step is closing up the router and tightenin the screws. I first installed 5.30(ABIE.4)C0 firmware from ZYXEL site then used the built-in web based upgrade to upgrade to 5.30(ABIE.5)C0 firmware. Also normal VDSL2 connectivity was working fine, including the 6RD tunnel that Telia/Sonera provides. So everything seems to be working fine. I am not sure why Telia/Sonera decided to make their own image, it is slightly suspicious.

Using same method, you can install any firmware to device (as long as it is compatible). For example if you want to brand it as another provider's device. I don't know why you would want to do this, but it is an option.

Caveats

The only problem is that I do not know how to backup existing firmware from the device. Therefore if you want to return back to old firmware, you will need to have access to it as BIN file. If you know how you can backup firmware from a ZYXEL device using serial communications, drop a line.