ZTE MF286D - Feature Unlock Rough Guide for H3G units

[Gandi69]

Ok so here is quick guide for what is needed to unlock some much needed features in your ZTE MF286D that other firmware versions have but H3G decide to lock out for whatever reason
Caveat:

I'm not saying this will 100% work for you but it did for me and my ZTE286D is a "Three" branded unit but naturally I hold no responsibility if you end up bricking your device so only follow this if you are confident about the work involved. This work also invalidates any warranty you have as you need to break warranty seals to open it up.


First off make sure you have a few things to hand here to do this job:


Plastic spudgers (for mobile phone repairs are good)
Small cross head screwdriver
Soldering iron
4 steel pins (I used staple wire) but anything study will do even paperclips which ive used in the past on OpenWRT project.
PL2303 cable to usb
USB flash drive (at least 500mb to be safe)
Putty terminal software
TFTPx64 software
LAN cable
Windows based laptop or PC (you could use linux/mac but I wont cover that here)
Elisa Firmware for ZTE MF286D downloaded - link: https://mega.nz/file/vVwUkZCY#NM_XrNSVXyefKcco-d5LPcyB-_xQ2315uPau2rpec9I



Get the casing off your ZTE MF286D open using your plastic spudger tools and cross head screwdriver, the back white plastic piece pops off the other is held in with screws. Same goes for the internal board, also held in with screws. Remove board from blue casing.

Solder on your GPIO pins, 4 of them are needed and they are up near the top of the board in a line all with holes filled with solder. From the top they are 3.3v, RX, TX and Ground (RX, TX maybe be the other way round but at this stage it doesnt matter).
A small tipped soldering iron really helps here as you can heat up the holes as they are blocked with solder from the factory and you can slip in your metal pins and let the solder harder when removing the heat and it makes a nice solid connection.

Connect the Pl2303 cable to your PC/laptop via usb and look in device manager to find its COM port reference - usually COM3 or COM4. Some PL2303 cables require an old driver from 2006/8 to work so be aware of this, the supplier of the cable should provide this to you.


Open Putty and select serial, then enter COM3/4 or whatever your PL2303 is in the serial line and set the board rate at 115200. Select "Open" and the black console window will appear but be blank/empty for now.

Plug in your ZTE board to power, being careful as its unsheilded and free from its plastic housing but dont power it on just yet.

Connect your GPIO pins to your Pl2303 cable, I didnt bother with power 3.3v (red) but did connect white, green and black (black being the bottom most pin and the ground pin). You may need to swap green and white over to get a feed in putty (those pins being RX and TX)

Fire up the ZTE board using the onboard power switch. If everything is connected properly, your wiring good and the soldering in order you should see the uboot console doing its thing and then it'll boot the kernel for the OS. Pressing Enter will let you into a password-free console session once booted.

Now plug in your flash drive to the ZTE usb port (flash drive has to be pre formatted with FAT or NTFS formatting, I used NTFS)

now for reference this forum and its users are great so take a look, as it helped me a lot and we will take some of the info from there:

ZTE MF286 zmiana FW (Strona 7) — Sprzęt / Hardware — eko.one.pl

ZTE MF286 zmiana FW (Strona 7) — Sprzęt / Hardware — eko.one.pl — OpenWrt, Linux, USB, notebooki i inne ciekawe rzeczy

eko.one.pl

Make a backup of your partitions so you can restore if things go wrong.


mkdir /tmp/usb_disk
mount /dev/sda1 /tmp/usb_disk
cat /dev/mtd0 > /tmp/usb_disk/mtd0.bin

I also did to be safe:

cat /dev/mtd8 > /tmp/usb_disk/mtd8.bin
cat /dev/mtd9 > /tmp/usb_disk/mtd9.bin


Now to get where you need to for the upgrade power the zte board off and then on again and in the putty console window you'll see an option to cancel the kernel boot process in uboot by pressing escape, you have to be fast to catch this though so if you miss it power off and then try again.


Now you should be at a uboot menu and this is where we need to be and where the things I did differ slightly to the very helpful guide on the link a few lines above.

I ran this command in uboot console to erase the NAND memory on the ZTE:

nand erase 0x1800000 0x1d00000

Now, after doing this, if you reboot your ZTE it shouldn't boot at all as there is no OS for it to boot into however it should begin to look for a TFTP boot server (ip 192.0.0.1, subnet 255.0.0.0) as a fall back as this is properly how they flash them at the factory.

Power the ZTE off again here.

Now what you need to do is download a TFTP program (TFTP64 is my choice) and disable any wifi on your PC/laptop. Set the ethernet port of your laptop/pc to the ipv4 address above (192.0.0.1, subnet 255.0.0.0).

Connect a LAN cable to port 1 on the ZTE and to the ethernet port on your pc/laptop.

Find your Elisa firmware download folder and in the various subdirectories (there are many but from memory mine was in "..\UPDATE\3.Download_Filen") but if you search you will find a file called "root_uImage" and its 37888kb in size.
**NB** A user below stated that they ran into problems with this file and used a root_UImage from /Bin/UPDATE/ instead so I would recommend you use the file in the latter location**
You are best off copying or moving this to a new empty folder somewhere on your PC/laptop.

Fire up TFTPx64 and point it the folder where you just moved your root_uImage file to, then set the server interface in TFTPx64 to the LAN card your just set with the ip of 192.0.0.1.


Power on the ZTE.

All being well after a few seconds it should then find this firmware file on your TFTP server, download it and flash it to the onboard memory.

Now please be aware, you may have to quickly go into TFTPx64 after you've booted the ZTE device to reselect the LAN interface as the ethernet ports going up and down during the ZTE power on process can throw things off a little - alternatively rig up a network hub/switch to mitigate this however with a swift hand its easy to sort this out. This kind of thing is fairly commonplace when flashing routers/devices.


Once the flash process is done I found then entering the command "bootipq" at the uboot prompt in putty made the ZTE boot. It will still be using the H3G "look" but with all the features unlocked, though you may be able to just power off and on to do the same thing.

All being well, it should come up normally and the admin password will be as per factory but with all the "better" Elisa firmware style features unlocked.

To restore to factory spec you'd need to copy the mtd9.bin file from your flash drive to your PC/laptop folder location and rename it "root_uImage" and follow the TFTP steps again.

 

[Adam2173]

Thank you very much for the detailed guide Gandi! Look forward to trying it

 

[Gandi69]

No problem, I'm glad I found a breakthrough so I hope it works for people.

Id recommend turning auto updates off though as I dont know if those will overwrite the changes

 

[Lucian]

@Gandi69 great write-up!
I don't have this router, but I read it anyway.

One thing is not clear to me though, which pins do you need to solder? I mean from which to which? A picture would have been great.

 

[Gandi69]

@Gandi69 great write-up!
I don't have this router, but I read it anyway.

One thing is not clear to me though, which pins do you need to solder? I mean from which to which? A picture would have been great.

Thanks! I didn’t take many pics whilst doing this work however I will get some pictures up of where the pins need to be added. Once you see where they are it’ll make perfect sense

 

[Gandi69]

 

[Gandi69]

Another shot of the board head on

 

[Buggerlugz]

Gandi69, a relatively simple process then! :/ (You are braver than me for even attempting it dude!)

 

[Gandi69]

As long as you make backups on your partitions and don’t short things on the board when soldering then it’s easy enough.

 

[twocats]

Hi Gandi69, thought I would give it a go as doing nothing with the MF286D anyway, but after flashing it fails to boot.

The flashing seemed to go ok

Bytes transferred = 38797312 (2500000 hex)

NAND erase: device 0 offset 0x1000000, size 0x800000
Erasing at 0x17e0000 -- 100% complete.
OK

NAND write: device 0 offset 0x1000000, size 0x800000
 8388608 bytes written: OK

NAND erase: device 0 offset 0x1800000, size 0x1d00000
Erasing at 0x34e0000 -- 100% complete.
OK

NAND write: device 0 offset 0x1800000, size 0x1d00000
 30408704 bytes written: OK
zte_set_download_led(1) is called
blank download is done. send fin to PC...
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 Down Speed :10 Half duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 up Speed :100 Full duplex
Volume kernel not found!
(IPQ40xx) #

But when I reboot I get

Creating 1 MTD partitions on "nand0":
0x000001800000-0x000003500000 : "mtd=0"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI error: ubi_read_volume_table: the layout volume was not found
UBI error: ubi_init: cannot attach mtd2
UBI error: ubi_init: UBI error: cannot initialize UBI, error -22
UBI init error 22
(IPQ40xx) # <INTERRUPT>
(IPQ40xx) #

 

[Gandi69]

Strange that, did you back up your mtd9 partition? Try restoring that in and see if it boots.

Or perhaps pull the root_Uimage from the TIM firmware and flash that in as a test?

 

[twocats]

Yea, tried the mtd9 but same result.

 

[Gandi69]

strange, it refers to partition Mtd2. Might be worth a manual reflash of that partition?
Or even try the TIM version of root_uimage.
Probably might be worth a post on the polish forum to see what they say, they are very good at replying quickly and in English too.
I’ll probably be pulling my zte286d apart again to install extra sma antennas the next few days so will be more than happy to back up all the mtd partitions to a flash drive to distribute, maybe these can be rewritten to yours?

 

[twocats]

I used TFTP to transfer the file from the PC to the ZTE and then manually flashed it and it is back up and running again.

 

[Gandi69]

Which file did you flash to it? Your backup?

 

[twocats]

Yea, the mtd9 , don't have any WEBUI but on the console I can see USB in and out actions and ethernet, ping doesn't seem to work either.

I'll have another look in the morning, cheers.

Just noticed on that Polish forum post #145 Mig25 had exactly the same issue as me.

 

[twocats]

Back up and running again, noticed during the TFTP server update it had also updated the mtd8 partition

NAND erase: device 0 offset 0x1000000, size 0x800000
Erasing at 0x17e0000 -- 100% complete.
OK
NAND write: device 0 offset 0x1000000, size 0x800000
8388608 bytes written: OK

So i just updated the mtd8 and the mtd9 partitions with my backups manually.

All working again as original.

 

[Gandi69]

Great news! Are you are going to try the Elisa flash again or leave it?
You could always manually flash root_Uimage_s.bin (which is mtd9 partition) and web.img (mtd8 partition) manually and see if that works.
Root_Uimage (the 37mb file) contains both of the above you see

 

[twocats]

Yes that was my mistake, I thought the root_uImage was mtd9 only, next time I'll "read the question"

I tried using the FTP srever again with root_uImage but got the same failure.

 

[twocats]

The original root_uImage file I used was in /UPDATE/3.Download_Filen/ and that is the one that failed.

However I found another in /Bin/UPDATE/ which works, both are the same size but the CRCs are different.

All the new options are now visible