Public/ZTE_ZXHN_F670L
1
0
Fork 0
Code Issues Pull requests Projects Releases 9 Packages Wiki Activity Actions
X279128S — Flash partition map & versions Versions discovered Version Value Source Bootloader (U-Boot) V9.0.10P10N2 (Dec 16 2022) printenv versioninfo Software (firmware) V9.0.10P1N12A (SoftWareVerExt=07e5P1N12A0324) /etc/zte_ver_num, ver_num_des CSP (driver package) V3.1.00P01T04 bspdriver.ko string Kernel Linux 4.1.25 (SMP ARMv7) module vermagic Build date Wed Aug 4 22:17 CST 2021 /etc/version Region Manufacturing default (India/Viettel/Indonesia/Manufacture variants in image) /etc/regioncode GPON FW BOB_GN25L95_GPONZX279128S{27,28,29,30,31,32,76}.bin /etc Partition table (SPI NAND, 256 MB)
26 commits 1 branch 9 tags 261 KiB
  • Python 37.5%
  • C 34.9%
  • Shell 23.1%
  • Makefile 4.5%
Find a file
Exact
gitops 92e4c721b4 HANDOVER: document full bring-up - 5GHz, English default, size-agnostic bootloader 
Status 2026-10-31: persistent OpenWrt boot + English LuCI + LAN + 5GHz all working.
Records the v0.2.x release history, the bypass-fsload boot fix, the 5GHz firmware
resolution (kmod-mt7663-firmware-ap baked in; mt7916-firmware disabled), the baked
English default (luci lang en), and open items (random MACs, LAN-LED GPIO sweep).
2026-10-31 07:48:57 +05:30
openwrt
tools
.gitignore
BRINGUP-F670L.md
BUILD-MILESTONE.md
F670L-BUILD.md
F670L-FLASH-RE.md
FINDINGS.md
FLASH-F670L.md
FLASHING.md
HANDOVER.md
README.md
REPORT.md
zx279128s-vendor-kernel-config.txt

README.md

ZTE Router Reverse Engineering — OpenWrt Driver Porting Lab

Goal: reverse engineer the WiFi, LAN (switch/PHY), and USB drivers from a ZTE fiber router so they can be ported to OpenWrt.

📥 Flash OpenWrt on the F670L: see FLASHING.md — the safe dual-slot install/restore procedure. Firmware release: tag v0.1.0 (attached assets: openwrt-f670l-slot.bin, f670l-flash, docs).

Target

  • Bootloader: ZTE U-Boot V9.0.10P10N2 (Dec 16 2022), ARM (LE v7)
  • Flash: SPI NAND, 256 MB (0x10000000), 2 KB page / 128 KB erase block
  • Storage: NAND via custom zx_* SPI-NAND / OneNAND drivers
  • Partitions (mtddebug): boot, env, kernel, kernel1, other, all
  • Console: ttyAMA0,115200n8 (SoC UART)

Environment / Toolset

Windows (installed)

Tool Purpose
Ghidra 12.2 + JDK 25 Decompilation / disassembly of ARM firmware & drivers
JDK 21 (backup JVM)
Git for Windows 2.56 source control / clone OpenWrt
Python 3.12+ custom scripts (tools/)
7-Zip / tar archive extraction

WSL2 + Ubuntu (pending — needs reboot + BIOS virtualization)

To be installed after the firmware dump finishes:

  • binwalk — carve partitions / kernel / rootfs
  • squashfs-tools (unsquashfs) — extract OpenWrt-style squashfs rootfs
  • device-tree-compiler (dtc) — read the board .dts (reveals exact WLAN/ switch/PHY/USB chips)
  • binutils (readelf/objdump), file, strings
  • vmlinux-to-elf — recover vmlinux from the zImage for Ghidra kernel analysis
  • OpenWrt SDK / git checkout of openwrt/openwrt — build host toolchain

Firmware material

  • bootloader.bin (1.5 MB) — U-Boot (dumped & Ghidra-imported)
  • full_firmware.bin (256 MB) — full NAND dump (in progress on COM5)

Workflow

  1. Dump → full_firmware.bin (running in background, ~24 h).
  2. Confirm layout via live-boot /proc/mtd or mtddebug probing; fill in partition_split.py config.
  3. Split the 256 MB image into boot/env/kernel/kernel1/other.
  4. Extract the kernel image and squashfs rootfs (binwalk/unsquashfs).
  5. Identify chips: read the device-tree .dts → WLAN MAC, Ethernet switch (e.g. RTL/MTK/single-SoC GPHY integrated), USB host (DWC3/EHCI) controllers.
  6. Locate driver .ko for WiFi (e.g. mt76, ath9k, brcmfmac, vendor), LAN/switch, and USB in the extracted modules dir.
  7. Decompile those drivers (Ghidra, ARM LE) and the corresponding kernel driver code to learn register programming, DMA, and DTS bindings.
  8. Port to OpenWrt target (SoC-specific target in target/linux/), write the .dts, add drivers/Kconfig, build with the SDK.

Tools in this repo (Windows side)

  • tools/fw_scan.py — scan image for kernel/FS/compression signatures
  • tools/partition_split.py — carve named partitions (config TBD)

Notes / gotchas

  • Reboot required after WSL2 install; virtualization must be enabled in BIOS.
  • The full dump owns COM5; do not kill/restart it (interrupting U-Boot's md.b corrupts subsequent captures).