Table of Contents
ZyXEL P-660HN-TxA
802.11n Wireless ADSL2+ with 4xFE ports Gateway
Link to current status hacking of P-660HN-T3A: https://forum.openwrt.org/viewtopic.php?id=61596
Supported Versions
| Model | Launch Date | S/N | P/N | OpenWrt Version Supported | Model Specific Notes |
|---|---|---|---|---|---|
| P-660HN-T1A | 2011-02 |  | | - | Annex A |
| P-660HN-T3A | 2010-02 | | 91-004-989004B | - | Annex B, supports only IPv4 |
| P-660HN-T3A | 2012-02 | | 91-004-989010B | - | Annex B, supports both IPv4 & IPv6 |
Hardware Highlights
| model | SoC | Ram | Flash | Network | Modem | USB | Serial | JTag | Note |
|---|---|---|---|---|---|---|---|---|---|
| P-660HN-T1A | TrendChip TC3162U-LQ128G@450MHz | 16MiB | 2MiB | 4x FE | 1x DSL (rj11) | No | Yes | No | |
| P-660HN-T3A (IPv4 only) | TrendChip TC3162U-LQ128G@450MHz | 32MiB | 4MiB | 4x FE | 1x DSL (rj45) | No | Yes | No | Official ZyXEL firmware supports only IPv4 |
| P-660HN-T3A (dualstack IPv4/IPv6) | TrendChip TC3162U-LQ128G@450MHz | 32MiB | 8MiB | 4x FE | 1x DSL (rj11) | No | Yes | No | Official ZyXEL firmware supports dualstack IPv4/IPv6 |
Manufacturer's site: http://www.zyxel.com/products_services/p_660hn_txa_series.shtml
Hardware
Info
| P-660HN-T1A | P-660HN-T3A (IPv4 only) | P-660HN-T3A (dual stack IPv4/IPv6) | |
|---|---|---|---|
| Instruction set: | MIPS32 (be specific 34KEc according to https://wikidevi.com/wiki/TrendChip) | ||
| Vendor: | Mediatek (originally TrendChip) | ||
| Bootloader: | Bootbase | ||
| System-On-Chip: | TrendChip TC3162U-LQ128G | ||
| CPU @Frq | 450MHz | ||
| Flash size: | 2 MiB | 4MiB | 8MiB |
| Flash Chip: | Macronix MX25L6405D | Macronix MX25L3206E | Macronix MX25L6406E |
| RAM size: | 16 MiB | 32MiB | 32MiB |
| RAM Chip: | Zentel A3V28S40FTP-G6 | Winbond W9825G6JH-6 | Winbond W9825G6JH-6 |
| Wireless No1: | SoC-integrated: Ralink RT3390L w/ 2.4GHz antenna for 802.11b/g/n | ||
| Switch: | TrendChip TC2206F (10/100 Mbit) | ||
| Modem: | ADSL2+ | ||
| USB: | No | ||
| Serial: | Yes | ||
| JTAG: | No | ||
Photos
P-660HN-TxA
Front:
Back: P-660HN-T1A
Opening the case
Note1: This will void your warranty!
Note2: Very problematic opening. The box is bonded together by 10 tough plastic locks and with very high probability you will destroy some of them during opening the case.
- To remove the cover …
Main PCB
| P-660HN-T1A | P-660HN-T3A (IPv4 only) | P-660HN-T3A (dualstack IPv4/IPv6) |
|---|---|---|
 |  |  |
Serial
→ port.serial general information about the serial port, serial port cable, etc.
The serial port on this device is labeled J5:
How to connect to the Serial Port of this specific device:
| Pin | Signal |
|---|---|
| 1 | VCC |
| 2 | TxD |
| 3 | RxD |
| 4 | N/A |
| 5 | GND |
Configure terminal with: baud rate 115200 and 8N1 (8 bits, No parity bit, 1 stop bit)
Debricking
You can recover your router through serial console using the bootloader command to upload the firmware image to the router via xmodem.
Bootlogs
OEM bootlog
| P-660HN-T1A | P-660HN-T3A (version IPv4 only) | P-660HN-T3A (version IPv4 & IPv6) |
|---|---|---|
| Bootbase Version: VTC_SPI1.8 | 2010/4/8 09:32:52 RAM: Size = 16384 Kbytes Found SPI Flash 2MiB MX25L1606E(05D) at 0xbfc00000 RAS Version: 3.40(BYF.10) Press any key to enter debug mode within 3 seconds. ............................................................ Copyright (c) 1994 - 2010 ZyXEL Communications Corp. initialize ch = 0, TC2104ME, TC2206, ethernet address: c8:6c:87:61:8d:e8 initialize ch = 1, AP restart , also restart 802.1x and reset EAPoL queuePhyMode = 9 ethernet address: c8:6c:87:61:8d:e8 Wan Channel init ........ done Initializing ADSL F/W ........ done ==>natTableMemoryInit <==natTableMemoryInit *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* initRadiusSocket[0]: bind socket to 2050 OK *DOT1X* initRadiusSocket[1]: bind socket to 2051 OK *DOT1X* initRadiusSocket[2]: bind socket to 2052 OK *DOT1X* initRadiusSocket[3]: bind socket to 2053 OK *DOT1X* register socket ok - iface-0 *DOT1X* register socket ok - iface-1 *DOT1X* register socket ok - iface-2 *DOT1X* register socket ok - iface-3 ANNEXAL DNS Hijack switch is 1. Success!NAT session reserved is 512,protocol is 2,port is 80! WSC_MANUFACTURE is ZyXEL now AP_WSC_DEVICE_NAME is AMG1202-T10A now AP_WSC_MODEL_NAME is AMG1202-T10A now Testlab 10 set try multimode number to 3 (dropm Erasing 4K Sector... Erasing 4K Sector... writeRomBlock(): Erase OK! ode try num 3) largeD flag=2 (0:maxD=64, 1:maxD=128, 2:maxD=511) Erasing 4K Sector... Erasing 4K Sector... writeRomBlock(): Erase OK! Syncookie switch On! Erasing 4K Sector... Erasing 4K Sector... writeRomBlock(): Erase OK! Press ENTER to continue... | Bootbase Version: VTC_SPI_4M1.10 | 2010/06/03 09:32:52 RAM: Size = 16384 Kbytes DRAM POST: Testing: 16384K OK Found SPI Flash 4MiB MX25L3205D(06E) at 0xbfc00000 RAS Version: 3.40(TSP.1) Press any key to enter debug mode within 3 seconds. ............................................................ Copyright (c) 1994 - 2010 ZyXEL Communications Corp. initialize ch = 0, TC2104ME, TC2206, ethernet address: 50:67:f0:c8:b8:f0 initialize ch = 1, AP restart , also restart 802.1x and reset EAPoL queuePhyMode=9, DesiredPhyMode=9 ethernet address: 50:67:f0:c8:b8:f0 Wan Channel init ........ done Initializing ADSL F/W ........ done ==>natTableMemoryInit <==natTableMemoryInit *DOT1X* initRadiusSocket[0]: bind socket to 2050 OK *DOT1X* initRadiusSocket[1]: bind socket to 2051 OK *DOT1X* initRadiusSocket[2]: bind socket to 2052 OK *DOT1X* initRadiusSocket[3]: bind socket to 2053 OK *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* register socket ok - iface-0 *DOT1X* register socket ok - iface-1 *DOT1X* register socket ok - iface-2 *DOT1X* register socket ok - iface-3 ANNEXB current nmPing URL: www.zyxel.cn WSC_MANUFACTURE is ZyXEL now AP_WSC_DEVICE_NAME is P-660HN-T3A now AP_WSC_MODEL_NAME is P-660HN-T3A now MAC Address : 50:67:F0:C8:B8:F0 The cmd : wan tcif set sysser 50:67:F0:C8:B8:F0 system_sirial_no_eoc[0]=35 system_sirial_no_eoc[1]=30 system_sirial_no_eoc[2]=3a system_sirial_no_eoc[3]=36 system_sirial_no_eoc[4]=37 system_sirial_no_eoc[5]=3a system_sirial_no_eoc[6]=46 system_sirial_no_eoc[7]=30 system_sirial_no_eoc[8]=3a system_sirial_no_eoc[9]=43 system_sirial_no_eoc[10]=38 system_sirial_no_eoc[11]=3a system_sirial_no_eoc[12]=42 system_sirial_no_eoc[13]=38 system_sirial_no_eoc[14]=3a system_sirial_no_eoc[15]=46 system_sirial_no_eoc[16]=30 serial_len=17 Testlab 30 system_version_no_eoc[0]=32 system_version_no_eoc[1]=30 system_version_no_eoc[2]=31 system_version_no_eoc[3]=30 system_version_no_eoc[4]=30 system_version_no_eoc[5]=39 system_version_no_eoc[6]=30 system_version_no_eoc[7]=38 system_version_no_eoc[8]=30 system_version_no_eoc[9]=30 system_version_no_eoc[10]=30 system_version_no_eoc[11]=30 system_version_no_eoc[12]=30 system_version_no_eoc[13]=30 system_version_no_eoc[14]=30 system_version_no_eoc[15]=30 enter sys version len=16 2605443544e00 set try multimode number to 3 (dropmode try num 3) largeD flag=2 (0:maxD=64, 1:maxD=128, 2:maxD=511) Syncookie switch On! Press ENTER to continue... | FIXME |
OEM bootlog (Recovery/Emergency Mode)
NOTE: You will get there while you hold RESET button and switch on the modem (tested at least with P-660HN-T3A version IPv4 only): In this mode there is no help (list of available commands) and you can enable XMODEM by press key "x". Unfortunate, it is not clear what data modem expects in this mode. If I tried to send firmware image file in this mode, then data are transfered into modem and then as you can see below only "jump to 80008000" is dispalyed.
| P-660HN-T1A | P-660HN-T3A (version IPv4 only) | P-660HN-T3A (version IPv4 & IPv6) |
|---|---|---|
| FIXME | Bootbase Version: VTC_ROM_1.16 | 2009/12/18 14:28:26 RAM: Size = 32768 Kbytes DRAM POST: Testing: 32768K OK done Starting XMODEM upload (CRC mode).... CCCCCCjump to 80008000 | FIXME |
Notes
Tags
