Sponsored Links

ZTE MC888 expriments

Same here, 5g stopped working. UK Three branded MC888 router.
I created a new thread HERE. It's possible it's a common issue with the router?
I don't know, I was thinking about a software issue because I've seen it catch a 5G signal when switching bands manually a few times, but it only happened 2 or 3 times in 3 months. Before this time, it was working every time. Also I think it might have happened after forcing 4G bands or some other config using miononno's hack, but really I can't be sure.

I've managed to dump the QCN, but from what I understand there is no loader to do a full firmware dump and flash. I'm not sure if my unit has a locked bootloader, as I don't think it's new. I hope ADB and root access will be able to shed some light into this 🤞🏻
 
Sponsored Links
Hi
I don't know whether you are still working on this, I also bought a MC888 Ultra on Amazon EU with the same model as @R3xiiee, with firmware BD_LIVUKMC888ULTRA1.0.B05, producer ZTE Poland. Do you know whether this model comes with X65 or X62?
This is a very new model since on Amazon only since 1. Feb 2024, and if you search on Amazon.co.uk, two different ultra models (eFones version and this EU version) are available.

I did some research but Information is so confusing:
Since the firmware starts with livewire UK, I check the website and it claims with X65, and with NFC. while the Amazon page of eFones version claims X62 with NFC. However, the most strange part, this Amazon EU model doesn't come with NFC!

Hope anyone has more information
 
Hi
I don't know whether you are still working on this, I also bought a MC888 Ultra on Amazon EU with the same model as @R3xiiee, with firmware BD_LIVUKMC888ULTRA1.0.B05, producer ZTE Poland. Do you know whether this model comes with X65 or X62?
This is a very new model since on Amazon only since 1. Feb 2024, and if you search on Amazon.co.uk, two different ultra models (eFones version and this EU version) are available.
@stich86 any ideas?

@d9y1kk you could ask router-mods, as they've opened one to modify:
 
It should be like VF version, x62. Seems only “A” variants have x65
Actually I just found that in my local online shop, both Vodafone and this ZTE version in stock, https://www.digitec.ch/en/search?q=MC888+ultra
and in QA session, the seller claims x62 for Vodafone and x65 for the ZTE one.
and the big price difference seems justify it...... Any way, do you know anyway to check this? except unlock the bootloader.....
 
Sponsored Links
Actually I just found that in my local online shop, both Vodafone and this ZTE version in stock, https://www.digitec.ch/en/search?q=MC888+ultra
and in QA session, the seller claims x62 for Vodafone and x65 for the ZTE one.
and the big price difference seems justify it...... Any way, do you know anyway to check this? except unlock the bootloader.....
Only way to be sure without opening is to do a combo dump using scat and analyze it. If there are combos that exceed 120mhz of total bandwidth is x65
 
Hi
I don't know whether you are still working on this, I also bought a MC888 Ultra on Amazon EU with the same model as @R3xiiee, with firmware BD_LIVUKMC888ULTRA1.0.B05, producer ZTE Poland. Do you know whether this model comes with X65 or X62?
This is a very new model since on Amazon only since 1. Feb 2024, and if you search on Amazon.co.uk, two different ultra models (eFones version and this EU version) are available.

I did some research but Information is so confusing:
Since the firmware starts with livewire UK, I check the website and it claims with X65, and with NFC. while the Amazon page of eFones version claims X62 with NFC. However, the most strange part, this Amazon EU model doesn't come with NFC!

Hope anyone has more information
Hi. i too had the same query you are now asking regarding which chip the device has. It was my router that Router-Mods used to do their R&D documentation whilst they modded my router. it is indeed the X62 so no NFC.

I am however still attempting to find a method to gain root access to the device somehow, to disable secure boot so custom firmware can be used. this has been a frustrating endeavour...if anyone happens to have any luck at all no matter how small please share it here.
 
Hi. i too had the same query you are now asking regarding which chip the device has. It was my router that Router-Mods used to do their R&D documentation whilst they modded my router. it is indeed the X62 so no NFC.

I am however still attempting to find a method to gain root access to the device somehow, to disable secure boot so custom firmware can be used. this has been a frustrating endeavour...if anyone happens to have any luck at all no matter how small please share it here.
drop me a private msg, let's see if you have some endpoint exposed ;)
 
Sponsored Links
so you have tested already? which URL?
none yet. i have been primarily focused on trying to gain access to the chipset. I have managed to view its contents although much is in unreadable format and read only. im not a tech genius for my methods and knowledge are limited. I have nothing useful to share at this stage.
 
and yes their is another trick discovered you can use zte frame work mf253 and its firmware :cool: thanks to no body dont know why they hiding this trick
 
Hi! There seems to be a bunch of MC888 experts around here ;) So I'll try asking here for a bit of information that I've been unable to find elsewhere so far. Where can I find the system logs in the UI ? I found out that on the MC801A it should be at /index.html#sys_log so I tried that but I get redirected to the page I was previously on. If I cannot access the sys logs in the UI is there any other way? Thanks!

FW : BD_LIVEUKMC888V1.0.0B04 (up to date on router)
 
Sponsored Links
@badaz I can access logs at the URL you specified, but I'm on a different firmware (South African)

I was also able to pull logs by setting up an ACS server on my laptop using GenieACS, then pointing the router at it from e.g. http://192.168.1.1/index.html#tr069config – but I'm not sure if you can access that page either...
I can access that page. I'll give it a try, thanks. By the way, I found out that there seems to be quite a few hidden pages like that one, is there a way to list them? If not, how do people posting some of those urls in forums know about them? I haven't been able to find an official documentation about those pages either.
 
so... i little bird gave me a precious gift :)

Code:
dump_info full_nand_mc888u_vfit_b09.bin
Partition layout found at offset: 2625536
ZTE FW Info found at offset: 12283904
Name                Alignm  Offset  +Fix Length   Size RAW
-----------------------------------------------------------
sbl                 good    00000000  +0 00000640   2.50 MB
mibib               good    00000640  +0 00000640   2.50 MB
efs2                        00001280  +0 00002816  11.00 MB
efsbak                      00004096  +0 00001536   6.00 MB
ztefile                     00005632  +0 00012800  50.00 MB
tz                  good    00018432  +0 00000448   1.75 MB
tz_devcfg           good    00018880  +0 00000256   1.00 MB
ddr                 good    00019136  +0 00000384   1.50 MB
apdp                good    00019520  +0 00000256   1.00 MB
xbl_config          good    00019776  +0 00000256   1.00 MB
xbl_ramdump         good    00020032  +0 00000256   1.00 MB
multi_image         good    00020288  +0 00000256   1.00 MB
multi_image_qti     good    00020544  +0 00000256   1.00 MB
aop                 good    00020800  +0 00000256   1.00 MB
qhee                good    00021056  +0 00000256   1.00 MB
abl                 good    00021312  +0 00000256   1.00 MB
uefi                good    00021568  +0 00000640   2.50 MB
toolsfv             BAD     00022208 -64 00000384   1.50 MB
loader_sti                  00022592  +0 00000384   1.50 MB
boot                good    00022976  +0 00004864  19.00 MB
scrub                       00027840  +0 00000256   1.00 MB
logfs               good    00028096  +0 00000256   1.00 MB
modem               good    00028352  +0 00027456 107.25 MB
misc                        00055808  +0 00000448   1.75 MB
devinfo             good    00056256  +0 00000384   1.50 MB
recovery            good    00056640  +0 00004864  19.00 MB
fota                        00061504  +0 00000448   1.75 MB
recoveryfs          good    00061952  +0 00012288  48.00 MB
sec                         00074240  +0 00000256   1.00 MB
ipa_fw              good    00074496  +0 00000256   1.00 MB
usb_qti                     00074752  +0 00000256   1.00 MB
ART                         00075008  +0 00001280   5.00 MB
ZTERW               good    00076288  +0 00120320 470.00 MB
system              good    00196608  +0 00065536 256.00 MB
------------------------------------------------------------------
Total NAND size: 1024.00 MB - Total Sectors 262144
*** Output is in sectors based on the NAND parameters, read the help to pass correct one ***
----------------------- ZTE FIRMWARE INFO ------------------------
FW Version: CR_VDFITMC888ULTRAV1.0.0B09
HW Name: MC888 Ul
HW Vers: Ver.AT1
Customer Vers: VDF_IT_MC888ULTRAV1.0.0B14
Build Date: 2023-10-25 14:17:19
------------------------------------------------------------------

Code:
dump_info full_nand_mc888u_livewuk_b05.bin
Partition layout found at offset: 2625536
ZTE FW Info found at offset: 11075584
Name                Alignm  Offset  +Fix Length   Size RAW
-----------------------------------------------------------
sbl                 good    00000000  +0 00000640   2.50 MB
mibib               good    00000640  +0 00000640   2.50 MB
efs2                        00001280  +0 00002816  11.00 MB
efsbak                      00004096  +0 00001536   6.00 MB
ztefile                     00005632  +0 00012800  50.00 MB
tz                  good    00018432  +0 00000448   1.75 MB
tz_devcfg           good    00018880  +0 00000256   1.00 MB
ddr                 good    00019136  +0 00000384   1.50 MB
apdp                good    00019520  +0 00000256   1.00 MB
xbl_config          good    00019776  +0 00000256   1.00 MB
xbl_ramdump         good    00020032  +0 00000256   1.00 MB
multi_image         good    00020288  +0 00000256   1.00 MB
multi_image_qti     good    00020544  +0 00000256   1.00 MB
aop                 good    00020800  +0 00000256   1.00 MB
qhee                good    00021056  +0 00000256   1.00 MB
abl                 good    00021312  +0 00000256   1.00 MB
uefi                good    00021568  +0 00000640   2.50 MB
toolsfv             BAD     00022208 -64 00000384   1.50 MB
loader_sti                  00022592  +0 00000384   1.50 MB
boot                good    00022976  +0 00004864  19.00 MB
scrub                       00027840  +0 00000256   1.00 MB
logfs               good    00028096  +0 00000256   1.00 MB
modem               good    00028352  +0 00027456 107.25 MB
misc                        00055808  +0 00000448   1.75 MB
devinfo             good    00056256  +0 00000384   1.50 MB
recovery            good    00056640  +0 00004864  19.00 MB
fota                        00061504  +0 00000448   1.75 MB
recoveryfs          good    00061952  +0 00012288  48.00 MB
sec                         00074240  +0 00000256   1.00 MB
ipa_fw              good    00074496  +0 00000256   1.00 MB
usb_qti                     00074752  +0 00000256   1.00 MB
ART                         00075008  +0 00001280   5.00 MB
ZTERW               good    00076288  +0 00120320 470.00 MB
system              good    00196608  +0 00065536 256.00 MB
------------------------------------------------------------------
Total NAND size: 1024.00 MB - Total Sectors 262144
*** Output is in sectors based on the NAND parameters, read the help to pass correct one ***
----------------------- ZTE FIRMWARE INFO ------------------------
FW Version: BD_LIVUKMC888ULTRAV1.0.0B05
HW Name: MC888 Ul
HW Vers: MC888ULTRA_HW1.0
Customer Vers: LIV_UK_MC888ULTRAV1.0.0B06
Build Date: 2024-02-06 15:43:13
------------------------------------------------------------------

I was able to fully dump 888Ultra, but fastboot doesn't seem to work on these unit. After erase boot partition it goes in the classic ZTE Download mode (19d2/0076), only way to bring it back to life is to put in 9008 mode and restore using EDL.

I leave there the pic where is located the boot-point, you need to remove radiator to get access :(



Dump tested also on these units:

MC889 (X62 - PL Firmware)
MC889A (X65 - A1 Firmware) - EDL boot point is under the shield near CPU and NAND, the pins near antenna like MC7010 doesn’t boot it into 9008
MC888 Ultra - (X62 - VF IT and Livewire UK Firmware)
MC888A (X65 - A1 Firmware)
MC888A Ultra - (X65 - STC UA Firmware)
MC888Pro (internal module, X62 - Telia Firmware)
MU5120 mobile hotspot - (X62 - Livewire UK Firmware)

Updated list to all models I was able to dump :)
 
Last edited:
I bought MC888 Ultra which is branded to Vodafone.
No idea in which country it was working before.

HW version: Ver.A(T1)
WEB version: WEB_VDFEUMC888ULTRAV1.0.0B14
WA INNER version: CR_VDFEUMC888ULTRAV1.0.0B06

However, I am looking for firmware which will debrand it as much as possible and give me more functionality than limited Vodafone UI.
My ISP operates on N78 band, if this matters.
 
I bought MC888 Ultra which is branded to Vodafone.
No idea in which country it was working before.

HW version: Ver.A(T1)
WEB version: WEB_VDFEUMC888ULTRAV1.0.0B14
WA INNER version: CR_VDFEUMC888ULTRAV1.0.0B06

However, I am looking for firmware which will debrand it as much as possible and give me more functionality than limited Vodafone UI.
My ISP operates on N78 band, if this matters.
Looks like Gigacube Dutch

I currently have dump of MC888U VF Italy and Livewire UK, but not sure that swap sysfs and NON-HLOS can work. Don’t have a unit to play with it.. sorry
 
Last edited:
Top
Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £24.00 - 26.00
150Mbps
Gift: None
NOW UK ISP Logo
NOW £24.00
100Mbps
Gift: None
Plusnet UK ISP Logo
Plusnet £25.99
145Mbps
Gift: £50 Reward Card
Large Availability | View All
Cheapest ISPs for 100Mbps+
Gigaclear UK ISP Logo
Gigaclear £17.00
200Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: None
Virgin Media UK ISP Logo
Virgin Media £22.99
132Mbps
Gift: None
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
Large Availability | View All
Sponsored Links
The Top 15 Category Tags
  1. FTTP (6024)
  2. BT (3638)
  3. Politics (2720)
  4. Business (2439)
  5. Openreach (2405)
  6. Building Digital UK (2330)
  7. Mobile Broadband (2143)
  8. FTTC (2083)
  9. Statistics (1899)
  10. 4G (1813)
  11. Virgin Media (1762)
  12. Ofcom Regulation (1582)
  13. Fibre Optic (1467)
  14. Wireless Internet (1462)
  15. 5G (1404)
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms  ,  Privacy and Cookie Policy  ,  Links  ,  Website Rules