User Tools

Site Tools


toh:zyxel:p-660hn-txa

ZyXEL P-660HN-TxA

802.11n Wireless ADSL2+ with 4xFE ports Gateway

Link to current status hacking of P-660HN-T3A: https://forum.openwrt.org/viewtopic.php?id=61596

Supported Versions

Model Launch Date S/N P/N OpenWrt Version Supported Model Specific Notes
P-660HN-T1A 2011-02 FIXME FIXME - Annex A
P-660HN-T3A 2010-02 FIXME 91-004-989004B - Annex B, supports only IPv4
P-660HN-T3A 2012-02 FIXME 91-004-989010B - Annex B, supports both IPv4 & IPv6

Hardware Highlights

model SoC Ram Flash Network Modem USB Serial JTag Note
P-660HN-T1A TrendChip TC3162U-LQ128G@450MHz 16MiB 2MiB 4x FE 1x DSL (rj11) No Yes No
P-660HN-T3A (IPv4 only) TrendChip TC3162U-LQ128G@450MHz 32MiB 4MiB 4x FE 1x DSL (rj45) No Yes No Official ZyXEL firmware supports only IPv4
P-660HN-T3A (dualstack IPv4/IPv6) :?: 32MiB ??? FIXME 8MiB ??? FIXME 4x FE 1x DSL (rj11) No :?: :?: Official ZyXEL firmware supports dualstack IPv4/IPv6

Manufacturer's site: http://www.zyxel.com/products_services/p_660hn_txa_series.shtml

Hardware

Info

P-660HN-T1A P-660HN-T3A (IPv4 only) P-660HN-T3A (dual stack IPv4/IPv6)
Instruction set: MIPS32 (be specific 34KEc according to https://wikidevi.com/wiki/TrendChip) :?:
Vendor: Mediatek (originally TrendChip) :?:
Bootloader: Bootbase :?:
System-On-Chip: TrendChip TC3162U-LQ128G :?:
CPU @Frq 450MHz :?:
Flash size: 2 MiB 4MiB 8MiB ?? FIXME
Flash Chip: Macronix MX25L6405D Macronix MX25L3206E :?:
RAM size: 16 MiB 32MiB 32MiB ?? FIXME
RAM Chip: Zentel A3V28S40FTP-G6 Winbond W9825G6JH-6 :?:
Wireless No1: SoC-integrated: Ralink RT3390L w/ 2.4GHz antenna for 802.11b/g/n :?:
Switch: TrendChip TC2206F (10/100 Mbit) :?:
Modem: ADSL2+
USB: No
Serial: Yes :?:
JTAG: No :?:

Photos

P-660HN-TxA

Front:

Back: P-660HN-T1A

Opening the case

Note1: This will void your warranty!

Note2: Very problematic opening. The box is bonded together by 10 tough plastic locks and with very high probability you will destroy some of them during opening the case.

  • To remove the cover …

Main PCB

P-660HN-T1A P-660HN-T3A (IPv4 only) P-660HN-T3A (dualstack IPv4/IPv6)
:?:

Serial

port.serial general information about the serial port, serial port cable, etc.

The serial port on this device is labeled J5:

How to connect to the Serial Port of this specific device:

Pin Signal
1 VCC
2 TxD
3 RxD
4 N/A
5 GND

Configure terminal with: baud rate 115200 and 8N1 (8 bits, No parity bit, 1 stop bit)

Debricking

generic.debrick

You can recover your router through serial console using the bootloader command to upload the firmware image to the router via xmodem.

Bootlogs

OEM bootlog

P-660HN-T1A P-660HN-T3A (version IPv4 only) P-660HN-T3A (version IPv4 & IPv6)

Bootbase Version: VTC_SPI1.8 | 2010/4/8 09:32:52 RAM: Size = 16384 Kbytes Found SPI Flash 2MiB MX25L1606E(05D) at 0xbfc00000 RAS Version: 3.40(BYF.10) Press any key to enter debug mode within 3 seconds. ............................................................ Copyright (c) 1994 - 2010 ZyXEL Communications Corp. initialize ch = 0, TC2104ME, TC2206, ethernet address: c8:6c:87:61:8d:e8 initialize ch = 1, AP restart , also restart 802.1x and reset EAPoL queuePhyMode = 9 ethernet address: c8:6c:87:61:8d:e8 Wan Channel init ........ done Initializing ADSL F/W ........ done ==>natTableMemoryInit <==natTableMemoryInit *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* initRadiusSocket[0]: bind socket to 2050 OK *DOT1X* initRadiusSocket[1]: bind socket to 2051 OK *DOT1X* initRadiusSocket[2]: bind socket to 2052 OK *DOT1X* initRadiusSocket[3]: bind socket to 2053 OK *DOT1X* register socket ok - iface-0 *DOT1X* register socket ok - iface-1 *DOT1X* register socket ok - iface-2 *DOT1X* register socket ok - iface-3 ANNEXAL DNS Hijack switch is 1. Success!NAT session reserved is 512,protocol is 2,port is 80! WSC_MANUFACTURE is ZyXEL now AP_WSC_DEVICE_NAME is AMG1202-T10A now AP_WSC_MODEL_NAME is AMG1202-T10A now Testlab 10 set try multimode number to 3 (dropm Erasing 4K Sector... Erasing 4K Sector... writeRomBlock(): Erase OK! ode try num 3) largeD flag=2 (0:maxD=64, 1:maxD=128, 2:maxD=511) Erasing 4K Sector... Erasing 4K Sector... writeRomBlock(): Erase OK! Syncookie switch On! Erasing 4K Sector... Erasing 4K Sector... writeRomBlock(): Erase OK! Press ENTER to continue...

Bootbase Version: VTC_SPI_4M1.10 | 2010/06/03 09:32:52 RAM: Size = 16384 Kbytes DRAM POST: Testing: 16384K OK Found SPI Flash 4MiB MX25L3205D(06E) at 0xbfc00000 RAS Version: 3.40(TSP.1) Press any key to enter debug mode within 3 seconds. ............................................................ Copyright (c) 1994 - 2010 ZyXEL Communications Corp. initialize ch = 0, TC2104ME, TC2206, ethernet address: 50:67:f0:c8:b8:f0 initialize ch = 1, AP restart , also restart 802.1x and reset EAPoL queuePhyMode=9, DesiredPhyMode=9 ethernet address: 50:67:f0:c8:b8:f0 Wan Channel init ........ done Initializing ADSL F/W ........ done ==>natTableMemoryInit <==natTableMemoryInit *DOT1X* initRadiusSocket[0]: bind socket to 2050 OK *DOT1X* initRadiusSocket[1]: bind socket to 2051 OK *DOT1X* initRadiusSocket[2]: bind socket to 2052 OK *DOT1X* initRadiusSocket[3]: bind socket to 2053 OK *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* radius_srv_num = 1 *DOT1X* register socket ok - iface-0 *DOT1X* register socket ok - iface-1 *DOT1X* register socket ok - iface-2 *DOT1X* register socket ok - iface-3 ANNEXB current nmPing URL: www.zyxel.cn WSC_MANUFACTURE is ZyXEL now AP_WSC_DEVICE_NAME is P-660HN-T3A now AP_WSC_MODEL_NAME is P-660HN-T3A now MAC Address : 50:67:F0:C8:B8:F0 The cmd : wan tcif set sysser 50:67:F0:C8:B8:F0 system_sirial_no_eoc[0]=35 system_sirial_no_eoc[1]=30 system_sirial_no_eoc[2]=3a system_sirial_no_eoc[3]=36 system_sirial_no_eoc[4]=37 system_sirial_no_eoc[5]=3a system_sirial_no_eoc[6]=46 system_sirial_no_eoc[7]=30 system_sirial_no_eoc[8]=3a system_sirial_no_eoc[9]=43 system_sirial_no_eoc[10]=38 system_sirial_no_eoc[11]=3a system_sirial_no_eoc[12]=42 system_sirial_no_eoc[13]=38 system_sirial_no_eoc[14]=3a system_sirial_no_eoc[15]=46 system_sirial_no_eoc[16]=30 serial_len=17 Testlab 30 system_version_no_eoc[0]=32 system_version_no_eoc[1]=30 system_version_no_eoc[2]=31 system_version_no_eoc[3]=30 system_version_no_eoc[4]=30 system_version_no_eoc[5]=39 system_version_no_eoc[6]=30 system_version_no_eoc[7]=38 system_version_no_eoc[8]=30 system_version_no_eoc[9]=30 system_version_no_eoc[10]=30 system_version_no_eoc[11]=30 system_version_no_eoc[12]=30 system_version_no_eoc[13]=30 system_version_no_eoc[14]=30 system_version_no_eoc[15]=30 enter sys version len=16 2605443544e00 set try multimode number to 3 (dropmode try num 3) largeD flag=2 (0:maxD=64, 1:maxD=128, 2:maxD=511) Syncookie switch On! Press ENTER to continue...

FIXME

OEM bootlog (Recovery/Emergency Mode)

NOTE: You will get there while you hold RESET button and switch on the modem (tested at least with P-660HN-T3A version IPv4 only): In this mode there is no help (list of available commands) and you can enable XMODEM by press key "x". Unfortunate, it is not clear what data modem expects in this mode. If I tried to send firmware image file in this mode, then data are transfered into modem and then as you can see below only "jump to 80008000" is dispalyed.

P-660HN-T1A P-660HN-T3A (version IPv4 only) P-660HN-T3A (version IPv4 & IPv6)

FIXME

Bootbase Version: VTC_ROM_1.16 | 2009/12/18 14:28:26 RAM: Size = 32768 Kbytes DRAM POST: Testing: 32768K OK done Starting XMODEM upload (CRC mode).... CCCCCCjump to 80008000

FIXME

Notes

Tags

toh/zyxel/p-660hn-txa.txt · Last modified: 2016/01/03 22:21 by comixf1