• Класс Wi-Fi: AX5400 (до 574 Мбит/с на 2,4 ГГц и до 4804 Мбит/с на 5 ГГц) • Порты: 1× Gigabit WAN, 4× Gigabit LAN, 1× USB 3.0 (поддержка Samba, FTP, Media-сервера и Time Machine) • Антенны: 6 внешних несъемных антенн с поддержкой Beamforming • Аппаратная платформа: процессор Broadcom (3 ядра, 1,5 ГГц), 512 МБ оперативной памяти (RAM) и 128 МБ постоянной памяти (ROM) • Технологии: Wi-Fi 6 (4T4R, HE160), MU-MIMO, OFDMA, OneMesh, HomeShield, WPA3
ATEN Password Generator - простая консольная утилита для расчета значения в команде ATEN для перехода в режим с повышенными привелегиями при работе с UART
ZNXT ZN504XG-D is an operator-customized XG-PON/GPON Optical Network Terminal (ONT). It is based on the Airoha AN7581 platform and supports high-speed fiber broadband connectivity, multi-gigabit Ethernet networking, and OpenWrt-based firmware customization.
The following is an English hardware introduction suitable for a project README, device documentation, or hardware database.
## 1. Hardware specifications
| Component | Specification | | ----------------- | ------------------------------------------------- | | Device Model | ZNXT ZN504XG-D | | Device Type | XG-PON / GPON Optical Network Terminal | | Main SoC | Airoha AN7581 | | CPU | Quad-Core ARM Cortex-A53 | | CPU Architecture | 64-bit ARM | | Network Processor | 8-Core RISC-V NPU | | PON Interface | XG-PON / XGS-PON / GPON (SoC capability) | | Maximum PON Rate | 10 Gbps Downstream / 2.5 Gbps Upstream for XG-PON | | Ethernet Ports | 1 × 2.5GbE + 2 × 1GbE | | LAN1 | 2.5 Gigabit Ethernet | | LAN2–LAN3 | Gigabit Ethernet | | RAM | Configuration-dependent; verify physical device | | Flash | 256 MB SPI NAND | | Flash Chip | ESMT F50L2G41XA | | USB | Not available | | Wi-Fi | Not available | | Power Input | 12V DC, 1A (reported specification) | | Operating System | Linux / OpenWrt / ImmortalWrt |
> ZNXT ZN504XG-D Hardware Overview > > The ZNXT ZN504XG-D is a compact, high-performance optical network terminal (ONT) designed for fiber-optic broadband access. It is powered by the Airoha AN7581 SoC, featuring a quad-core 64-bit ARM Cortex-A53 CPU and an integrated 8-core RISC-V network processor (NPU). > > The device supports next-generation XG-PON connectivity and is backward-compatible with GPON networks. It provides one 2.5GbE Ethernet port and two Gigabit Ethernet ports for high-speed wired networking. > > The platform features SPI NAND flash storage and supports Linux-based networking firmware, including OpenWrt and ImmortalWrt. > > Its hardware architecture makes it suitable for broadband gateway applications, fiber-optic networking experiments, embedded Linux development, and custom router deployments.
Note: The AN7581 chip's advertised capabilities are not necessarily all exposed by this particular device. In particular, XGS-PON support and actual RAM capacity should be verified against the board and firmware configuration. The ZN504XG-D has a dedicated firmware target and should not be treated as identical to the Nokia XG-040G-MD.
OCP network Switch AS6710-32X (P2041 + BCM56850 Trident2) is now running NOSaic — datapath forwards, mgmt + platform + port LEDs are up.
Quick correction for anyone searching: the ASIC is BCM56850 (PCI 14e4:b850), not “BCM58650” — Trident2, same silicon as the x86 AS6712-32X.
The approach turned out simpler than the Ghidra/switchd RE plan in my original post. I did not have to reverse-engineer the vendor switchd/BDE. The key realization: AS6710-32X is an AS6712-32X with a PowerPC CPU module instead of x86. The board controller, ASIC, CPLDs, QSFP cages and LED wiring are identical, so the x86 AS6712’s public platform files port straight over, and only the CPU/boot/endianness half was new work. Concretely:
New NOSaic arch powerpc-e500mc (P2041, e500mc, 32-bit big-endian, CoreNet/QorIQ) + crosstool-NG toolchain. Ported OpenBCM (6.5.x XGS/CMICm) to PPC32 big-endian — this is the real delta vs the AS5610/Trident+ work: CMICm PIO/packet/other endianness config, big-endian PCI-config byte-swap in the userspace BDE. td2 userspace BDE on PowerPC: BAR0 via /dev/mem, DMA carved from a device-tree reserved-memory no-map region (no CMA), BE config access. Device tree = mainline fsl/p2041rdb base + a board overlay (NOR layout, i2c tree, mgmt MAC/PHY, PCIe windows, DMA pool). Reused the AS6712 public artifacts verbatim: config.bcm (portmap_N = 4N-3:40), SONiC port_config.ini, the Accton CPLD register map, and the SONiC led_proc_init.soc LED-processor programs + CMIC_LEDUP0_PORT_ORDER_REMAP. Hardware status (BOM-confirmed, all driven):
P2041 — boots, 4 cores, corenet32 kernel (6.12). BCM56850 Trident2 — nosd-td2 attaches and forwards. NOR 128 MB (JS28F00AM29EWHA) — MTD physmap, 8 partitions. Mgmt PHY BCM54616S — eth1 1G/full, ping OK (U-Boot’s “5461S” is the same family). 4× LM75 temp (behind PCA9548) — hwmon0–3; DS1672 RTC; 24c256 ID EEPROM; USB2514 hub + internal 8 GB USB-NAND; MAX3232 console; EPM570 system CPLD. FMan/QMan/BMan (DPAA) init OK; mgmt NIC rides DPAA. Datapath / bring-up verified:
32×40G QSFP cages enumerate, link up at 40G. L2 hardware forwarding confirmed with a 40G NIC (throughput was host-limited in a single-NIC loopback, not switch-limited — the CPU-punt path can’t reach these rates, so the frames are switching in silicon). L3 hardware routing between two SVIs confirmed (directly-attached subnets covered by host entries, as NOSaic does). Platform HAL working: fans, PSU presence/power-good + PMBus telemetry (e.g. psu1 12.2V/3.4A/41W, psu2 11.9V/4.3A/53W), 4 thermal sensors. QSFP port LEDs driven by the Trident2 LED microprocessors (LEDUP0 = cages 1–16, LEDUP1 = 17–32) using the vendor SONiC programs; per-cage order corrected via the PORT_ORDER_REMAP table. Known/cosmetic gaps: LED green/amber (40G vs 10G) color encoding still being finalized; a few inherited-from-p2041rdb dt warnings (RapidIO/eSPI phantom probes) to clean up; QSFP breakout (4×10G) not yet exercised.
Net: @wrightca1 was right — with a working Trident2 target under NOSaic, matching the AS6712 platform files to a PPC CPU module got it the rest of the way.
1. Optimized memory management mechanisms, improving system efficiency and stability. 2. Strengthened input validation and data processing workflows, further protecting your information security. 3. Improved web rendering engine, enhancing browsing experience and security. 4. Enhanced security of system command processing to guard against potential malicious operations. 5. Perfected JavaScript-related security mechanisms, offering a more secure web interaction environment.
Дамп слит программатором T48 с абсолютно исправного и рабочего роутера Totolink A3300R. Прошивка проверена лично перепрошивкой в аналогичный аппарат, роутер успешно стартует, сеть держит, Wi-Fi 2.4/5 ГГц функционирует корректно. В архиве находится чистый бинарный файл (16 МБ).
Слил с рабочего аппарата. Данные для WiFi: SSID - Tenda_A9_v1 Пароль - 12345678 После залития дампа можно сбросить настройки на заводские. В таком случае SSID будет Tenda_88D3A0 без пароля. Адреса веб интерфейса: 192.168.0.254 и re.tenda.cn
После окирпичивания, считал остатки прошивки и склеил с оригинальной - скачанной с сайта NETIS -V3. После оживления бута - прошил через TFTP. Роутер полностью ожил. Считал программатором CH341A выпаяв флешку. Полный дамп со всеми серийниками и маками!!! Кому необходимо - замените на свои
Управляймый комутатор D-Link DGS 1100-8 HW: B1 В архиве две full прошивки FW 1.00.016 и FW 1.00.028 FW 1.00.016 возможно проблемная в какой-то момент перестали работать порты 1 и 3 После перехода на FW 1.00.028 коммутатор работает в штатном режиме
Its Full Dump from working Archer c9 v1 router. you need UART serial USB Device to flash this image. flash -noheader 192.168.0.66:full.bin flash0 reboot FTTPD Server Change 192.168.X.66 with yours
Прошивка версии 1.0.9 Build 20200708 rel.55037. MAC адрес по смещению 0x4F72030. В дампе есть calibration область, её стоит перенести со своего устройства.
Файлы
Прошивки
Продажа
Литература
Статьи
