VSOL V2802RH teardown and full dump

[tantien11]

Soc: 9601D
Flash: 4MB
Optics: SC/UPC
Image:

Full dump:
v2802rh_full_dump.bin
Firmware update (V1.1.4):
v2802rh_v114.img
Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

[Anime4000]

this ONU bootloader is not encrypted right? it just same as ODI stick?

[ghost]

Does either of you two have firmware version V2802RH_V1.1.4_230628_ S632.img ????

https://www.right.com.cn/forum/thread-8298193-1-1.html

firmware for official support

https://share-b2820b2e832b1cfca838c8e60a7bd62d.fangcloud.cn/share/9e6881484ead2a6c0e18df4352

[cjllin]

you can try this https://v2.fangcloud.com/share/003958dbab72fe08a12b89c662

[arpan-joardar]

latest firmware is 1.1.5

https://drive.google.com/file/d/1ya9ELxmpwkXk1Aajw9rZ144Hea947kci/view?usp=sharing

[ghost]

hey, would you have version 1.1.6 to make available? looks like it came out

[arpan-joardar]

no i don't have that firmware

[ghost]

latest firmware is 1.1.5

https://drive.google.com/file/d/1ya9ELxmpwkXk1Aajw9rZ144Hea947kci/view?usp=sharing

safe?
how to confirm if it's true?

[arpan-joardar]

my one came with the same firmware

and i got it direct from vsol engineer

here is the skype contact live:.cid.821242afac75373f

[tithitoy]

May you get SHA=256 from Vsol engineer for confirming. Thanks

[arpan-joardar]

068af57bfe44cfcdffcdbbed191c6a76c7817cab8a9eb9c52b567888db91bc1a

[arpan-joardar]

also you can get it customized with either APC or UPC if purchased directly from VSOL

[ghost]

also you can get it customized with either APC or UPC if purchased directly from VSOL

Cool
she didn't know. I thought it could only be UPC, here in Brazil it's all APC.
mine is like UPC and I had to convert.

[Elkowak]

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

I used your dump to fix my bricked V2802rh, did you changed the admin password? stdONUi0 pass is not working

Edit: already tried reset button, but seems not working 😢

[arpan-joardar]

how did you fix it?

can you share the steps?

[Elkowak]

you will need a spi programmer and soic8/sop8 adapter i used a ch341 and generic adapter from aliexpress

[arpan-joardar]

my current situation is that even if I reset it's getting reset to my manual config and whenever I am trying to update the firmware or upload the config it throws a file format error

this is the console output whenever I am trying to update
https://justpaste.it/7jlo8

can you help me with it?

[sharjeela4]

admin password not working stdONUi0i

only user password working
username user password user working bit limitid access show please admin password share

[sharjeela4]

please share dump password how to password my onu is off i am not password and not reset please share password

[chundz]

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

Thank for your contribution
Cám ơn Tiến !

[sharjeela4]

dump file admin password

[chundz]

Hi Everyone!
I got new firmware from Vsol Engineering Team
V2802RH V1.1.6

SHA256 - da4107febb6e50e8b249cbdbf8e229dc65f98264634df6d5ece70b645004e0aa

https://drive.google.com/file/d/1l1kiHp6oQaVgvDK8QAwHJ_URjmU0xGFY/view?usp=drivesdk

[sharjeela4]

Orignal Dump File Bin format please i need din file orignal password this dump file password issue my orignal flash is missing please i need help

[alvinv331]

Is it possible modify it to use at Unifi Msia?
TQ

[kendikaku]

custom firmware for vsol v2802RH.

tripleoxygen.net/wiki/ont/vsol/v2802rh

changelog.

1.9.2
Alterado tamanho máximo do campo HW_HWVER/HW version para 18 caracteres (via telnet ou serial; pela GUI Web o máximo são 14 caracteres).
V2802RH_V1.9.2.img (Build date: 03/09/2023 | SHA256: 8a1c432223a6237616d10aea9926b028a34c240ed6fffc4cc9e59e8b401a6111)

1.9.1
Removido validação do MAC pela chave de autorização. Qualquer MAC (ELAN_MAC_ADDR) pode ser utilizado agora.
Baseada no release oficial V1.1.6
V2802RH_V1.9.1.img (Build date: 01/09/2023 | SHA256: f0f56fcc7be1643a45cd3be59e65b276321a3a5c69f9d14619256050834974b5)

[d5aqoep]

Anyone has the latest 1.1.7 firmware?

[viniciuspaes]

https://viniciuspaes.com/redes/tutorial-substituir-modem-fibra-ftth-modem-vsol-v2802rh/#firmware

[sharjeela4]

please V2802RH Dump File Orignal Password This post Dump File Password not working stdONUi0i same time reset but not working My Orignal Flash Flle Currpt Software update time device power flash ic currpt please i need dump file

[sharjeela4]

i am many time your web site post but your website not read my mesg post please i need

[ghost]

Why can't I reset this sh** to default?
I'm using the latest official version and none of the passwords, neither the default nor the one I set, work...
Any ideas or throw away this crap?

[djordjeradovic]

Can anyone confirm what is the actual maximum speed that can be achieved over the 2.5GbE port? Is it at least above 2000 Mbps?

[Anime4000]

try that, the VSOL V2802RH only can bridge VLAN PPPoE, but cannot bridge other VLAN such as VoIP.

[djordjeradovic]

I don't need VoIP, only need internet WAN with dynamic IP bridged to 2.5GbE port. No routing or anythin else, I use pfSense for that.

[dudu15051505]

I was able to use VoIP with this ONU.

In my case with my ISP, I gave vlan tag 100 on the lan2 2.5Gb port for pppoe internet, and vlan tag 200 on the lan1 1Gb port for ipoe voip.

The ideal would be to pass vlan trunk to the lan ports and configure directly in pfsense, but I was unable to configure this mode, and I ended up in this compromise using 2 nics.

[JC-lurker]

my downlink can reach 2.2gbps, by the uplink is 7mbps. Help anyone?

[Anime4000]

Try this on diag

[gpborges]

Could anyone post detailed instructions on how to flash a firmware in a VSOL which is bricked after a firmware update? All LEDs seams to be working fine (as per their manual), but I can't get it to assign an IP and hence, can't logon neither via web nor telnet.

Thanks!

[d5aqoep]

Reset your VSOL, assign IP 192.168.1.2 to your PC, Subnet Mask 255.255.255.0 and default gateway as 192.168.1.1

Then login to 192.168.1.1 with username admin and password stdONUi0i

[sharjeela4]

please share admin password your dump file i am try stdONUi0i but not login device reset but not working

[FullyRemoteDev]

What is the latest firmware now? is there anything after 1.1.8?

[pb36]

Just to confirm this ONU does not support Vlan Transparent Mode like it's available with tp-link onus like G7, G3 right? if it supports how to achieve that as I want to set vlan on my router instead of ONU

[RummaanKhan]

Hello, I'm trying to configure Photon PTF2282 same HW as V2802RH with an indian ISP (Jio) who are using RSYS OLT here and I was able to register by cloning GPON SN using the info from stock ONT but still I'm unable to access internet by I cloning mac address of stock ONT. Is there something else I should do to access internet on this?

[yesrab]

how did you change the mac address ?
can you please tell me?

[brandonn63]

Hello. My Vsol v2801Q device is broken. Can I run shared firmwares to fix the device with SPI programming or is there a suitable firmware? Can you help me?

[kam821]

I noticed that after setting VLAN mapping for the LAN2 port once and returning to port mapping, I cannot then set VLAN mapping again, when trying to confirm the VLAN mapping configuration, the port mapping option remains.
Has anyone encountered this problem?
Or does anyone know of a better way to preserve VLAN tag from the WAN to the one of the LAN ports?

[sharjeela4]

please admin password share stdONUi0i not working password internet service provider username password add onu but how add

[rtsp]

Anyone has idea to persist the custom FwdOp across reboot?

It would be possible if I can put some custom script running at startup (which I can't find) or ... by making a firmware modification.

I tried to decode the firmware images from https://www.tripleoxygen.net/wiki/ont/vsol/v2802rh#firmwares but I have no idea about image layout or how to extract/repack them. Any clues would be greatly appreciated.

[sbm1976]

Hi,
Just got VSOL V2802RH , but after put LOID and LOID password, the webpage is only showing EPON setting
GPON setting and OMCI page not showing in the webpage anymore.
can any one help
Rgds

[xUtsumi]

Any idea how to bridge this with IPOE? I can't seem to successfully bridge it because after I set it up as bridge and on my PC I set DHCP to ask for address, instead of a public IP, I am getting 169.254.203.121 which is a private IP address. Already at O5 Authenticated status and I can view vlans via telnet as well as view config L2-table get entry address valid. The only thing missing is getting a DHCP address and it gives a private one instead of requesting a public one from the OLT. Any help would be appreciated.

[Anime4000]

try BR_STP_ENABLED to 1 and LBD_ENABLE to 0

[enzo1110]

Does someone of you have the Dump of the latest Firmware?
The last ones are Shipping with the 1.1.9 Firmware from AliExpress.

[rfrana28-svg]

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

[rfrana28-svg]

Hi sir Madam
I need vsol 2802gw Firmware with installation tool
Because my modem stuck at power led light
I check hardware all voltages are ok so i think its firmware issue so plz help give me a firmware link and also tell me how to flash thanks.

[nymul8271-hue]

Does anyone have the updated firmware for V-SOL V2801SG hardware version V2.8S ?

[collerok]

i do have firmware from foxgate r2001r. which is looks same as vsol. and report same hardware rev V2.8S

but do not install this fw. if yours ONT is below 6.0.7 it will die if you do so. due to incompatible bootloader

G2001R_all_V6.1.2-250730_GPONOnly.zip

[cxsorious]

some one make dump files for vsol v2801q uboot pls
i need it :(

[yesrab]

just use the full dump
and use dd to get the uboot part

[cxsorious]

ahh i'm ok now

Recovery method for VSOL V2801Q using Realtek RTL9601D

Short SPI Flash PIN5 to GND during power-on to prevent the SoC from reading the flash.
The chip enters Realtek BootROM recovery mode.
BootROM automatically tries to download firmware via TFTP (UDP port 69).
Configure the PC with IP 192.168.1.2 and run a TFTP server.
Place the firmware image (e.g., rtk.bin) in the TFTP directory.

After power-on, the ONU sends a TFTP RRQ to the PC, downloads the firmware, writes it to SPI flash, and then reboots.

Summary:
Force BootROM → serve firmware via TFTP → device reflashes itself automatically.

[collerok]

here is multicast upgrade tool made by realtek
other brand ont verndor given it to me.
i did not ever used it before, but maybe it can help restore dead device.

have no any guides how to use it. so try by you own risk

multicast_upgrade_upx_RTK.zip

[ashikp]

I flash this dump file. now i need the admin login. i try to login with default admin username and password. don't work. do any one know ?