2 files changed, 138 insertions, 24 deletions

diff --git a/ont-Zyxel-PMG3000-D20B.md b/ont-Zyxel-PMG3000-D20B.md
index a56da20..a69be64 100644
--- a/ont-Zyxel-PMG3000-D20B.md
+++ b/ont-Zyxel-PMG3000-D20B.md
@@ -22,6 +22,9 @@ parent: ONT
 | SSH         | ✅ username `admin`, password `1234` |

 | Form Factor | miniONT SFP                          |

 

+Once you access the stick via ssh you will be challenged with a second tier login. The credentials to access the zyxel shell are: username: `twmanu` , password: `twmanu`.

+From the zyxel shell you can escape to a standard linux shell via the `linuxshell` command

+

 ## Interchangeable firmware with

 

 - [Zyxel PMG3000-D20B](ont-Zyxel-PMG3000-D20B)

@@ -30,10 +33,124 @@ parent: ONT
 - Zisa

 - T&W

 

-## List of software version

-## List of partition

-## List of firmware and files

+# List of software version

+

+# List of partitions

+ 

+| dev  | size     | erasesize | name           |

+| ---- | -------- | --------- | -------------- |

+| mtd0 | 00060000 | 00010000  | "Boot"         |

+| mtd1 | 00010000 | 00010000  | "Env"          |

+| mtd2 | 00390000 | 00010000  | "ImageA"       |

+| mtd3 | 00390000 | 00010000  | "ImageB"       |

+| mtd4 | 00060000 | 00010000  | "Config"       |

+| mtd5 | 00010000 | 00010000  | "SECTION_EGIS" |

+| mtd6 | 00250000 | 00010000  | "rootfs"       |

+| mtd7 | 00020000 | 00010000  | "rootfs_data"  |

+

+

+This stick supports dual boot from `ImageA` and `ImageB` witch contains the rootfs.

+

+

+# List of firmware and files

+## Useful files

+- `/var/config/ont.sys` used to customize various settings on the stick

+

+# Useful commands

+

+# Useful commands

+*Note: all commands start from the twmanu shell*

+

+## Change the ONT S/N

+*Note  the S/N is in ACII format*

+```sh

+manufactory

+set sn ALCLf0f0f0f0

+exit

+hal

+set sn ALCLf0f0f0f0

+```

+

+## Change the ONT PLOAM password

+*Note: the PLOAM is in ACII format*

+This can be done easily via web ui. If you prefer to do it via the shell use:

+```sh

+manufactory

+set password PLOAMPASS

+```

+

+## Change the ONT equipment ID

+*Note: model number must be 20 no more than chars total*

+```sh

+manufactory

+set equipment id MYEQUIPMENTID

+exit

+omci

+equipment id MYEQUIPMENTID

+```

+

+## Change the ONT hardware version

+```sh

+manufactory

+set hardware version 3FE49165BFAA01

+```

+

+## Change the software version

+Edit the /var/config/ont.sys via vi directly on the stick itself. The file is CRLF terminated, one entry per line.

+The entries for the software version are:

+```

+SW_VER0:0xabcdef

+SW_VER1:0xabcedf

+```

+*Note: it's better to enter the software version in hex format, all lowercase precedeed by 0x.* 

+

+## Query a particular OMCI ME

+Query via OMCI ME Class Name

+```sh

+omci

+show me classname OmciClassName (e.g Ont2g)

+```

+

+Query via OMCI ME ID

+```sh

+omci

+show me id OmciClassId (e.g 7)

+```

+

+

+# Low level modding

+

+## Create a new rootfs

+The stick has a tricky image packing method, fortuntaly it has been reverse engineered. A script to help you create a custom rootfs can be found here: [https://github.com/nanomad/zyxel-pmg-3000-mod-kit](https://github.com/nanomad/zyxel-pmg-3000-mod-kit)

+

+## Flash a new rootfs

+*Note: all commands start from the twmanu shell*

+

+- Transfer the new mtd on the stick via tftp

+```

+linuxshell

+tftp -gr mtd2.mod.bin TFTP_SERVER_IP

+```

+- Flash it on the standby partition. 

+You can use `system` and then `show actimage` to get the current active image. Check `/proc/mtd` for the right mtds. Usually:

+- if the currect active image is A the mtd in use is mtd2

+- If the current active image is B the mtd in use is mtd3

+```

+linuxshell

+mtd -e /dev/mtd2 write /tmp/mtd2.mod.bin /dev/mtd2

+```

+- Switch to the new image

+```

+system

+set actimage a

+```

+- Reboot the ONT

+```

+system

+reboot

+```

+

 # Miscellaneous Links

 

 - [https://github.com/xvzf/zyxel-gpon-sfp](https://github.com/xvzf/zyxel-gpon-sfp)

-

+- [https://github.com/nanomad/zyxel-pmg-3000-mod-kit](https://github.com/nanomad/zyxel-pmg-3000-mod-kit)

diff --git a/ont-technicolor-afm0002.md b/ont-technicolor-afm0002.md
index 92fd915..4512a1d 100644
--- a/ont-technicolor-afm0002.md
+++ b/ont-technicolor-afm0002.md
@@ -35,9 +35,6 @@ parent: ONT
 {% include info.html content="The AFM0002FWB can be transformed into AFM0002TIM. The AFM0002FWB has an older sw version." %}
 
 
-# Serial
-
-
 # List of software versions
 - V1_7_8_180122 
 - V1_7_8_180725
@@ -84,6 +81,23 @@ This stick supports dual boot.
 
 # Useful commands
 
+## Get/Set the ONT S/N
+```sh
+# /etc/scripts/bin flash get GPON_SN
+GPON_SN=TMBB00000000
+# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D
+```
+
+## Get/Set the ONT PLOAM password
+
+{% include info.html content="The PLOAM password is in ASCII format" %}
+
+```sh
+# /etc/scripts/bin flash get GPON_PLOAM_PASSWD
+GPON_PLOAM_PASSWD=AAAAAAAAAA
+# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA
+```
+
 ## Enable the Web UI
 ```sh
 # /bin/iptables -D INPUT -p tcp --dport 80 -j DROP
@@ -105,23 +119,6 @@ sw_version1=V1_7_8_210412
 # reboot
 ```
 
-## Get/Set the ONT S/N
-```sh
-# /etc/scripts/bin flash get GPON_SN
-GPON_SN=TMBB00000000
-# /etc/scripts/bin flash set GPON_SN TMBB0A1B2C3D
-```
-
-## Get/Set the ONT PLOAM password
-
-{% include info.html content="The PLOAM password is in ASCII format" %}
-
-```sh
-# /etc/scripts/bin flash get GPON_PLOAM_PASSWD
-GPON_PLOAM_PASSWD=AAAAAAAAAA
-# /etc/scripts/bin flash set GPON_PLOAM_PASSWD AAAAAAAAAA
-```
-
 ## Query a particular OMCI ME
 ```sh
 # omcicli mib get MIB_IDX