Sponsored Links

ZTE Framework that converts a Three UK branded MF286d to Nordic B11

After more than a day of trying, I can't get the router FOTA updated from Nordic B02.
Just in case there was something wrong with Nordic to Nordic, I tried:
Nordic to Elisa, then Elisa back to Nordic
Nordic to Tim then Tim back to Nordic.
Each time it was back on Nordic, I changed & checked the IMEI, but always get "No new version found".
Maybe Nordic have removed the updates?

-----

Went back to Nordic Framework B11 pw admin. The router has downloaded the update and due to be installed 2-4am. I've changed the time, but am expecting it to fail due to the modem & firmware mismatch.
 
Day 3:
As expected, the update from Nordic B11 failed.
I'm happy to be corrected & if tldr, skip to the last para!

Today, I connected the MF286D via ethernet to another router that runs my home network. The home network has a Rasperry-Pi with Pi-Hole to monitor DNS requests.
When you press the button to check for updates on the MF286D, it sends a DNS query for dmeu.ztems.com a quick search on that shows a Github result for a MF286D delta update checker written in Python and also a link to the forum it came from:
https://eko.one.pl/forum/viewtopic.php?id=21790&p=22 (see post 527 & read onwards)
The delta checker not only looks for updates, it also generates random IMEI numbers that begin with the MF286D prefix.
From looking at the Python script & looking at the MF286D console output from "nv show", it seems that "Nordic" is in fact "Telia".

The bottom line: I think that the delta updates from 2-5 & 5-6 have been removed from the ZTE servers, 7-12 are still there. So, if you want a modem with higher than B02, you have to use the Three firmware, or OpenWRT.
 
This might work?

 
Bricked the router yesterday while flashing the from Elisa to Nordic, no idea why that happened as I've used those frameworks before. Not all was lost as I managed to get OpenWRT flashed via the serial port & initramfs. I did try the TFTP recovery with Nordic & Elisa but for some reason they would not work for me
I think the bottom line is that the frameworks are no longer upgradeable as the delta updates are not found by the router, even though they are still on the upgrade server. I'm guessing that ZTE have totally blocked all or most of the IMEI numbers.
I didn't read all of the Polish or Italian pages by the time that my router bricked, so maybe it's possible to apply the delta updates locally, or find an IMEI that does still work.
 
So, I seem to have somewhat bricked my router :-(

It's an Amazon seller-refurbished MF286D (originally Three branded judging by the sticker on the bottom). It came with Nordic B11 firmware and B02 modem installed.

I decided to try and upgrade the modem firmware, so I attached a serial port, put the incremental Nordic modem updates on a USB drive and proceeded to apply them one by one using adb and picocom per the instructions in this forum. All went well and I ended up with Nordic B11 firmware and B11 modem working fine.

I should probably have stopped at this point, but having got the firmware and modem versions to match I decided to try and FOTA the final update to B12. This failed as I had failed to read the posts about the IMEI verification. I then decided, for reasons I'm not quite sure of, to try a factory reset. I backed up all the MTD partitions to the USB drive and then did the factory reset.

Unfortunately, at this point, the unit went into a boot loop, repeatedly crashing with an error like this:
Code:
[   54.650806] kernel BUG at /home/scl/ci/workspace/Soft4_MF286D_H3GSE_CPE/build_folder/qsdk/build_dir/target-arm_cortex-a7_uClibc-1.0.14_eabi/linux-ipq806x/qca-wifi-gf53cef1-dirty-unified-profile/qca-wifi-gf53cef1-dirty/os/linux/../../qca_ol/../cmn_dev/htc/htc_recv.c:618!

[   54.674675] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM

I first tried restoring just mtd9 as follows:
Code:
- load mtd9 into ram via tftp server by:
    tftp mtd9.bin
 
- erase mtd9 by:
    nand erase 0x1800000 0x1d00000
 
- write ram into mtd9 by:
    nand write 0x84000000 0x1800000 0x1d00000
 
- reboot

To my surprise, the system still went into a boot loop with the same kernel panic, so I tried restoring mtd8 and mtd9:
Code:
tftp mtd8.bin
nand erase 0x1000000 0x0800000
nand write 0x84000000 0x1000000 0x0800000

tftp mtd9.bin
nand erase 0x1800000 0x1d00000
nand write 0x84000000 0x1800000 0x1d00000

Again the system went into a boot loop.

Figuring I didn't have much to lose by this point, I decided to try flashing the Openwrt luci build from eko.one.pl as follows:
Code:
set fdt_high 0x85000000
tftp luci-23.05-snapshot-r23403-736e3b81aa-ipq40xx-generic-zte_mf286d-initramfs-zImage.itb
nand erase 0x1800000 0x1d00000
bootm $loadaddr
followed by:
Code:
scp luci-23.05-snapshot-r23403-736e3b81aa-ipq40xx-generic-zte_mf286d-initramfs-zImage.bin root@192.168.1.1:/tmp
ssh root@192.168.1.1
sysupgade -n /tmp/luci-23.05-snapshot-r23403-736e3b81aa-ipq40xx-generic-zte_mf286d-initramfs-zImage.bin

Somewhat to my surprise the system rebooted into Openwrt and after a bit of configuration I had it all working and connected to the Smarty network.

Anyway, I found Openwrt OK but compared to the Nordic firmware it seems complicated to configure and lacks some features like signal strength display and SMS management in the GUI.

I wondered if my backup images had been corrupted somehow, so I decided to try flashing back to Nordic using the original partition images at https://dl.eko.one.pl/orig/zte_mf286d/NORDIC, and I thought I may as well go for for the latest B12. So I applied them as follows to the running Openwrt system:
Code:
scp mtd8.bin root@192.168.1.1:/tmp
ssh root@192.168.1.1
mtd -r write /tmp/mtd8.bin /dev/mtd8

then after reboot

scp mtd9.bin root@192.168.1.1:/tmp
ssh root@192.168.1.1
mtd -r write /tmp/mtd9.bin /dev/mtd9

I now had Nordic B12 installed but it went into the same boot loop I had experienced before installing Openwrt.

So, it seems I can install Openwrt and it works fine, but every time I try to flash back to Nordic it goes into this boot loop.

I can only assume that something that happened during the factory reset procedure has changed something that isn't being restored when I reflash mtd8 and mtd9.

I guess I could just live with Openwrt but would prefer to get back to the Nordic Firmware. Anyone have any more ideas as I'm just about out of them.

Many thanks, John.
 
So, I seem to have somewhat bricked my router :-(

It's an Amazon seller-refurbished MF286D (originally Three branded judging by the sticker on the bottom). It came with Nordic B11 firmware and B02 modem installed.

I decided to try and upgrade the modem firmware, so I attached a serial port, put the incremental Nordic modem updates on a USB drive and proceeded to apply them one by one using adb and picocom per the instructions in this forum. All went well and I ended up with Nordic B11 firmware and B11 modem working fine.

I should probably have stopped at this point, but having got the firmware and modem versions to match I decided to try and FOTA the final update to B12. This failed as I had failed to read the posts about the IMEI verification. I then decided, for reasons I'm not quite sure of, to try a factory reset. I backed up all the MTD partitions to the USB drive and then did the factory reset.

Unfortunately, at this point, the unit went into a boot loop, repeatedly crashing with an error like this:
Code:
[   54.650806] kernel BUG at /home/scl/ci/workspace/Soft4_MF286D_H3GSE_CPE/build_folder/qsdk/build_dir/target-arm_cortex-a7_uClibc-1.0.14_eabi/linux-ipq806x/qca-wifi-gf53cef1-dirty-unified-profile/qca-wifi-gf53cef1-dirty/os/linux/../../qca_ol/../cmn_dev/htc/htc_recv.c:618!

[   54.674675] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM

I first tried restoring just mtd9 as follows:
Code:
- load mtd9 into ram via tftp server by:
    tftp mtd9.bin
 
- erase mtd9 by:
    nand erase 0x1800000 0x1d00000
 
- write ram into mtd9 by:
    nand write 0x84000000 0x1800000 0x1d00000
 
- reboot

To my surprise, the system still went into a boot loop with the same kernel panic, so I tried restoring mtd8 and mtd9:
Code:
tftp mtd8.bin
nand erase 0x1000000 0x0800000
nand write 0x84000000 0x1000000 0x0800000

tftp mtd9.bin
nand erase 0x1800000 0x1d00000
nand write 0x84000000 0x1800000 0x1d00000

Again the system went into a boot loop.

Figuring I didn't have much to lose by this point, I decided to try flashing the Openwrt luci build from eko.one.pl as follows:
Code:
set fdt_high 0x85000000
tftp luci-23.05-snapshot-r23403-736e3b81aa-ipq40xx-generic-zte_mf286d-initramfs-zImage.itb
nand erase 0x1800000 0x1d00000
bootm $loadaddr
followed by:
Code:
scp luci-23.05-snapshot-r23403-736e3b81aa-ipq40xx-generic-zte_mf286d-initramfs-zImage.bin root@192.168.1.1:/tmp
ssh root@192.168.1.1
sysupgade -n /tmp/luci-23.05-snapshot-r23403-736e3b81aa-ipq40xx-generic-zte_mf286d-initramfs-zImage.bin

Somewhat to my surprise the system rebooted into Openwrt and after a bit of configuration I had it all working and connected to the Smarty network.

Anyway, I found Openwrt OK but compared to the Nordic firmware it seems complicated to configure and lacks some features like signal strength display and SMS management in the GUI.

I wondered if my backup images had been corrupted somehow, so I decided to try flashing back to Nordic using the original partition images at https://dl.eko.one.pl/orig/zte_mf286d/NORDIC, and I thought I may as well go for for the latest B12. So I applied them as follows to the running Openwrt system:
Code:
scp mtd8.bin root@192.168.1.1:/tmp
ssh root@192.168.1.1
mtd -r write /tmp/mtd8.bin /dev/mtd8

then after reboot

scp mtd9.bin root@192.168.1.1:/tmp
ssh root@192.168.1.1
mtd -r write /tmp/mtd9.bin /dev/mtd9

I now had Nordic B12 installed but it went into the same boot loop I had experienced before installing Openwrt.

So, it seems I can install Openwrt and it works fine, but every time I try to flash back to Nordic it goes into this boot loop.

I can only assume that something that happened during the factory reset procedure has changed something that isn't being restored when I reflash mtd8 and mtd9.

I guess I could just live with Openwrt but would prefer to get back to the Nordic Firmware. Anyone have any more ideas as I'm just about out of them.

Many thanks, John.
I had a problem when using a Framework moving from Elisa to Nordic and ended up using the 'Factory' tftp recovery method that's documented at the beginning of the 'Rough Guide' >here<
The problem with the above is it will also downgrade your modem firmware.

Have you tried the tftp method to install MTD8&9? It works at the lower level than the rootfs by pressing the esc key as soon at the router starts booting.

Take a read from >here< the post I've linked also has a link to the MTD archive.

One thing I noticed with tftp is that it does not always work, so make sure you see a string of '++++++++' showing that the file you're trying to upload has actually uploaded.

Like you, I prefer the look & feel of the Nordic software, so after updating my modem to B12 , I flashed Nordic B12 MTD8&9 this morning.
 
..
I had a problem when using a Framework moving from Elisa to Nordic and ended up using the 'Factory' tftp recovery method that's documented at the beginning of the 'Rough Guide' >here<
The problem with the above is it will also downgrade your modem firmware.

Have you tried the tftp method to install MTD8&9? It works at the lower level than the rootfs by pressing the esc key as soon at the router starts booting.

Take a read from >here< the post I've linked also has a link to the MTD archive.

One thing I noticed with tftp is that it does not always work, so make sure you see a string of '++++++++' showing that the file you're trying to upload has actually uploaded.

Like you, I prefer the look & feel of the Nordic software, so after updating my modem to B12 , I flashed Nordic B12 MTD8&9 this morning.
Yes, I've tried tftp flashing mtd8 and mtd9 from the B12 archive. The kernel boots but then crashes in exactly the same place as my backups did. Very strange. I can only think the factory reset screwed something that isn't fixed by reflashing mtd8 and mtd9.
 
..

Yes, I've tried tftp flashing mtd8 and mtd9 from the B12 archive. The kernel boots but then crashes in exactly the same place as my backups did. Very strange. I can only think the factory reset screwed something that isn't fixed by reflashing mtd8 and mtd9.
Sorry, just re-read your original post and see that you did mention the tftp method. As you say, it may well be another partition that needs replacing. Perhaps try the belt & braces method that's documented in the 'rough guide'? Using the 'rough guide' method you should be able to find a B12 image to save going through the upgrades again, I did have one but can't find it at the moment.
 
Sorry, just re-read your original post and see that you did mention the tftp method. As you say, it may well be another partition that needs replacing. Perhaps try the belt & braces method that's documented in the 'rough guide'? Using the 'rough guide' method you should be able to find a B12 image to save going through the upgrades again, I did have one but can't find it at the moment.
Thanks, but as I understand it, even the belt and braces method of tftp'ing root_UIImage only restores mtd8 and mtd9, so I'm not sure why the result would be any different. Or have I misunderstood?
 
Thanks, but as I understand it, even the belt and braces method of tftp'ing root_UIImage only restores mtd8 and mtd9, so I'm not sure why the result would be any different. Or have I misunderstood?
I'm not sure exactly what it will do, but it does change the modem firmware too so thought it might do more than just mtd8&9. Probably worth posting on the end of eko,one it's easy enough to use google translate into Polish.
 
I'm not sure exactly what it will do, but it does change the modem firmware too so thought it might do more than just mtd8&9. Probably worth posting on the end of eko,one it's easy enough to use google translate into Polish.
Interesting. I know the framework method (which I don't think I can use on a bricked unit?) resets the modem firmware, but tftp'ing root_uImage? I thought root_uImage was just the concatenation of mtd8 and mtd9 so where is the modem firmware coming from? I know that FOTA updates contain modem deltas too, but I can't use that method either. I'll try posting on eko one. Thanks.
 
Interesting. I know the framework method (which I don't think I can use on a bricked unit?) resets the modem firmware, but tftp'ing root_uImage? I thought root_uImage was just the concatenation of mtd8 and mtd9 so where is the modem firmware coming from? I know that FOTA updates contain modem deltas too, but I can't use that method either. I'll try posting on eko one. Thanks.
It was a few weeks ago when I used the 'rough guide' recovery from a bad flash while using a Framework, so maybe I'm mistaken about the modem, if so you won't have to upgrade the modem again. In any case, it'll be interesting to know how you get on with your recovery from OpenWRT to Nordic.
 
Has anyone seen a way to disable the 5G WiFi with the Nordic firmware? You can disable the SSID broadcast but the 5G is still active.
 
Looks like i broke my MF286D router :(

First i changed my stock firmware to Nordic (Play to Nordic) using framework. Then i run Nordic To Maxis from here:
mega.nz/folder/q98SUIrL#oKTAYrYxVD1mUkBL0E41iw


Now i cant use framework because ZTE app says No connection by rj45. LEDs are working but wifi is deactivated. Router IP addreses from Nordic and Maxis dont work., also hard reset is not possible. Is it chance to repair that without connect to serial?

What I did wrong?
 
Looks like i broke my MF286D router :(

First i changed my stock firmware to Nordic (Play to Nordic) using framework. Then i run Nordic To Maxis from here:
mega.nz/folder/q98SUIrL#oKTAYrYxVD1mUkBL0E41iw


Now i cant use framework because ZTE app says No connection by rj45. LEDs are working but wifi is deactivated. Router IP addreses from Nordic and Maxis dont work., also hard reset is not possible. Is it chance to repair that without connect to serial?

What I did wrong?
Sometimes the Frameworks do not work properly, I had a problem with Elisa to Nordic. I think your only option will be the serial port recovery unless you can make a connection via RJ45. Do you know what the router IP should be with Maxis? Maybe you can put a fixed IP with the same subnet on the PC interface that you use to connect to the ZTE.
 
Top
Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £24.00 - 26.00
150Mbps
Gift: None
NOW UK ISP Logo
NOW £24.00
100Mbps
Gift: None
Plusnet UK ISP Logo
Plusnet £25.99
145Mbps
Gift: £50 Reward Card
Large Availability | View All
Cheapest ISPs for 100Mbps+
Gigaclear UK ISP Logo
Gigaclear £17.00
200Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
Large Availability | View All
Sponsored Links
The Top 15 Category Tags
  1. FTTP (6024)
  2. BT (3638)
  3. Politics (2720)
  4. Business (2439)
  5. Openreach (2405)
  6. Building Digital UK (2330)
  7. Mobile Broadband (2143)
  8. FTTC (2083)
  9. Statistics (1899)
  10. 4G (1813)
  11. Virgin Media (1762)
  12. Ofcom Regulation (1582)
  13. Fibre Optic (1467)
  14. Wireless Internet (1462)
  15. 5G (1404)
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms  ,  Privacy and Cookie Policy  ,  Links  ,  Website Rules