VSOL V2802RH teardown and full dump

[tantien11]

Soc: 9601D
Flash: 4MB
Optics: SC/UPC
Image:

Full dump:
v2802rh_full_dump.bin
Firmware update (V1.1.4):
v2802rh_v114.img
Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

[Anime4000]

this ONU bootloader is not encrypted right? it just same as ODI stick?

[ghost]

Does either of you two have firmware version V2802RH_V1.1.4_230628_ S632.img ????

https://www.right.com.cn/forum/thread-8298193-1-1.html

firmware for official support

https://share-b2820b2e832b1cfca838c8e60a7bd62d.fangcloud.cn/share/9e6881484ead2a6c0e18df4352

[cjllin]

the official latest firmware link https://v2.fangcloud.com/share/003958dbab72fe08a12b89c662

[SpeedxThunder001]

latest firmware is 1.1.5

https://drive.google.com/file/d/1ya9ELxmpwkXk1Aajw9rZ144Hea947kci/view?usp=sharing

[ghost]

hey, would you have version 1.1.6 to make available? looks like it came out

[SpeedxThunder001]

no i don't have that firmware

[ghost]

latest firmware is 1.1.5

https://drive.google.com/file/d/1ya9ELxmpwkXk1Aajw9rZ144Hea947kci/view?usp=sharing

safe?
how to confirm if it's true?

[SpeedxThunder001]

my one came with the same firmware

and i got it direct from vsol engineer

here is the skype contact live:.cid.821242afac75373f

[tithitoy]

May you get SHA=256 from Vsol engineer for confirming. Thanks

[SpeedxThunder001]

068af57bfe44cfcdffcdbbed191c6a76c7817cab8a9eb9c52b567888db91bc1a

[SpeedxThunder001]

also you can get it customized with either APC or UPC if purchased directly from VSOL

[ghost]

also you can get it customized with either APC or UPC if purchased directly from VSOL

Cool
she didn't know. I thought it could only be UPC, here in Brazil it's all APC.
mine is like UPC and I had to convert.

[Elkowak]

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

I used your dump to fix my bricked V2802rh, did you changed the admin password? stdONUi0 pass is not working

Edit: already tried reset button, but seems not working 😢

[SpeedxThunder001]

how did you fix it?

can you share the steps?

[Elkowak]

you will need a spi programmer and soic8/sop8 adapter i used a ch341 and generic adapter from aliexpress

[SpeedxThunder001]

my current situation is that even if I reset it's getting reset to my manual config and whenever I am trying to update the firmware or upload the config it throws a file format error

this is the console output whenever I am trying to update
https://justpaste.it/7jlo8

can you help me with it?

[sharjeela4]

admin password not working stdONUi0i

only user password working
username user password user working bit limitid access show please admin password share

[sharjeela4]

please share dump password how to password my onu is off i am not password and not reset please share password

[chundz]

Soc: 9601D Flash: 4MB Optics: SC/UPC Image: Full dump: v2802rh_full_dump.bin Firmware update (V1.1.4): v2802rh_v114.img Env:

b0=setenv bootargs ${bootargs_base} ${mtdparts0} ${rst2dfl_flg}; bootm ${img0_kernel}
b1=setenv bootargs ${bootargs_base} ${mtdparts1} ${rst2dfl_flg}; bootm ${img1_kernel}
baudrate=115200
boot_by_commit=if itest.s ${sw_commit} == 0;then run set_act0;run b0;else run set_act1;run b1;fi
boot_by_tryactive=if itest.s ${sw_tryactive} == 0;then setenv sw_tryactive 2;setenv sw_active 0;saveenv;run en_wdt;run b0;else setenv sw_tryactive 2;setenv sw_active 1;saveenv;run en_wdt;run b1;fi
bootargs_base=console=ttyS0,115200
bootcmd=bootm 9fc27000
bootcmd_try_osk=bootm 9fc50000
bootcmd_try_osk_1M=bootm 9fd00000
bootcmd_try_osk_2M=bootm 9fe00000
bootcmd_try_osk_4M=bootm 94400000
bootcmd_try_osk_8M=bootm 94800000
bootdelay=3
en_wdt=mw b8003268 e7c00000
erase_cfgfs=sf erase ${fl_cfgfs} +${fl_cfgfs_sz}
erase_env=sf erase ${fl_env} +${fl_env_sz};sf erase ${fl_env2} +${fl_env_sz}
ethact=LUNA GMAC 
ethaddr=00:E0:4C:86:70:01
fl_boot_sz=21000
fl_cfgfs=44000
fl_cfgfs_sz=34000
fl_env=21000
fl_env2=23000
fl_env_sz=2000
fl_kernel1=78000
fl_kernel1_sz=140000
fl_kernel2=0
fl_kernel2_sz=0
fl_rootfs1=1b8000
fl_rootfs1_sz=248000
fl_rootfs2=0
fl_rootfs2_sz=0
fx1000_init=mw bb000084 00000048
img0_kernel=94078000
img1_kernel=94000000
ipaddr=192.168.1.3
mtdparts0=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0)ro,2336K(r0)ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,1280K@480K(linux),2336K@1760K(rootfs) root=31:5
mtdparts1=mtdparts=rtk_spi_nor_mtd:132K(boot),8K(env),132K(env2),208K(config),1280K(k0),2336K(r0),4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,4K@0ro,0G@0G(linux),0G@0G(rootfs)
mupgrade_en=1
netmask=255.255.255.0
serverip=192.168.1.7
set_act0=if itest.s ${sw_active} != 0;then setenv sw_active 0;saveenv;fi
set_act1=if itest.s ${sw_active} != 1;then setenv sw_active 1;saveenv;fi
sgmii_init=mw bb000084 00000044
stderr=serial
stdin=serial
stdout=serial
sw_active=0
sw_commit=0
sw_tryactive=2
sw_valid0=1
sw_version0=V1.1.3
sw_version1=V1.1.3
tftp_base=80dc0000
up_osk=tftp 80000000 router.img;crc32 ${fileaddr} ${filesize};sf erase 27000 +${filesize};sf write ${fileaddr} 27000 ${filesize}
upb=tftp ${tftp_base} plr.img && crc32 ${fileaddr} ${filesize} && sf erase 0 +${fl_boot_sz} && sf write ${fileaddr} 0 ${filesize}
upb_osk=tftp 80000000 plr.img;crc32 ${fileaddr} ${filesize};sf erase 0 +${filesize};sf write ${fileaddr} 0 ${filesize}
upe=tftp ${tftp_base} uboot-env-98d-eng.bin && sf erase ${fl_env} +${fl_env_sz} && sf write ${fileaddr} ${fl_env} ${fl_env_sz} && sf erase ${fl_env2} +${fl_env_sz} && sf write ${fileaddr} ${fl_env2} ${fl_env_sz}
upk=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write ${fileaddr} ${fl_kernel1} ${filesize}
upk1=tftp ${tftp_base} uImage && crc32 ${fileaddr} ${filesize} && sf erase ${fl_kernel2} +${fl_kernel2_sz} && sf write ${fileaddr} ${fl_kernel2} ${filesize}
upr=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write ${fileaddr} ${fl_rootfs1} ${filesize}
upr1=tftp ${tftp_base} rootfs && crc32 ${fileaddr} ${filesize} && sf erase ${fl_rootfs2} +${fl_rootfs2_sz} && sf write ${fileaddr} ${fl_rootfs2} ${filesize}
upt=tftp 80000000 img.tar && upimgtar ${fileaddr} ${filesize}
upv=tftp 80000000 vm.img;upvmimg ${fileaddr}
yk=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_kernel1} +${fl_kernel1_sz} && sf write 80000000 ${fl_kernel1} ${filesize}
yr=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase ${fl_rootfs1} +${fl_rootfs1_sz} && sf write 80000000 ${fl_rootfs1} ${filesize}
yu=loady 80000000 && cp.b 80000000 81000000 ${filesize} && cmp.b 80000000 81000000 ${filesize} && sf erase 0 +${fl_boot_sz} && sf write 80000000 0 ${filesize}

Environment size: 3970/8187 bytes\

Thank for your contribution
Cám ơn Tiến !

[sharjeela4]

dump file admin password

[chundz]

Hi Everyone!
I got new firmware from Vsol Engineering Team
V2802RH V1.1.6

SHA256 - da4107febb6e50e8b249cbdbf8e229dc65f98264634df6d5ece70b645004e0aa

https://drive.google.com/file/d/1l1kiHp6oQaVgvDK8QAwHJ_URjmU0xGFY/view?usp=drivesdk

[sharjeela4]

Orignal Dump File Bin format please i need din file orignal password this dump file password issue my orignal flash is missing please i need help

[alvinv331]

Is it possible modify it to use at Unifi Msia?
TQ

[kendikaku]

custom firmware for vsol v2802RH.

tripleoxygen.net/wiki/ont/vsol/v2802rh

changelog.

1.9.2
Alterado tamanho máximo do campo HW_HWVER/HW version para 18 caracteres (via telnet ou serial; pela GUI Web o máximo são 14 caracteres).
V2802RH_V1.9.2.img (Build date: 03/09/2023 | SHA256: 8a1c432223a6237616d10aea9926b028a34c240ed6fffc4cc9e59e8b401a6111)

1.9.1
Removido validação do MAC pela chave de autorização. Qualquer MAC (ELAN_MAC_ADDR) pode ser utilizado agora.
Baseada no release oficial V1.1.6
V2802RH_V1.9.1.img (Build date: 01/09/2023 | SHA256: f0f56fcc7be1643a45cd3be59e65b276321a3a5c69f9d14619256050834974b5)

[d5aqoep]

Anyone has the latest 1.1.7 firmware?

[viniciuspaes]

https://viniciuspaes.com/redes/tutorial-substituir-modem-fibra-ftth-modem-vsol-v2802rh/#firmware

[sharjeela4]

please V2802RH Dump File Orignal Password This post Dump File Password not working stdONUi0i same time reset but not working My Orignal Flash Flle Currpt Software update time device power flash ic currpt please i need dump file

[sharjeela4]

i am many time your web site post but your website not read my mesg post please i need

[ghost]

Why can't I reset this sh** to default?
I'm using the latest official version and none of the passwords, neither the default nor the one I set, work...
Any ideas or throw away this crap?

[djordjeradovic]

Can anyone confirm what is the actual maximum speed that can be achieved over the 2.5GbE port? Is it at least above 2000 Mbps?

[Anime4000]

try that, the VSOL V2802RH only can bridge VLAN PPPoE, but cannot bridge other VLAN such as VoIP.

[djordjeradovic]

I don't need VoIP, only need internet WAN with dynamic IP bridged to 2.5GbE port. No routing or anythin else, I use pfSense for that.

[dudu15051505]

I was able to use VoIP with this ONU.

In my case with my ISP, I gave vlan tag 100 on the lan2 2.5Gb port for pppoe internet, and vlan tag 200 on the lan1 1Gb port for ipoe voip.

The ideal would be to pass vlan trunk to the lan ports and configure directly in pfsense, but I was unable to configure this mode, and I ended up in this compromise using 2 nics.

[JC-lurker]

my downlink can reach 2.2gbps, by the uplink is 7mbps. Help anyone?

[Anime4000]

Try this on diag

[gpborges]

Could anyone post detailed instructions on how to flash a firmware in a VSOL which is bricked after a firmware update? All LEDs seams to be working fine (as per their manual), but I can't get it to assign an IP and hence, can't logon neither via web nor telnet.

Thanks!

[d5aqoep]

Reset your VSOL, assign IP 192.168.1.2 to your PC, Subnet Mask 255.255.255.0 and default gateway as 192.168.1.1

Then login to 192.168.1.1 with username admin and password stdONUi0i

[sharjeela4]

please share admin password your dump file i am try stdONUi0i but not login device reset but not working

[umf137]

Anyone got this flash dump? I accidentally brick my converter

[normtomlins]

They also have these for SC/APC (green) now as well

[collerok]

(in the future) Do not plug blue connector to green outlet, you'll break the fiber glass at the end of green outlet, and will get +3-5 dB to the signal levels

[longthanhtran]

I left my v2802rh for a few weeks and now seems I can't use its lan2 (2.5Gb) (led still light up with cable plugged in). LAN ACL checked but I can't see any issue as I open connection from LAN subnet (same setting as usual) so maybe the LAN port no longer work.
Anyway, I try a latest custom fw from tripleoxygen, and it works for my case.

[sharjeela4]

Dear Please V2802RH Dump file orignal Password bin file please share with me i request

[Yazeed-Momani]

After updating my V2802RH to firmware V1.1.8, it keeps rebooting right after the PON LED turns solid green. It’s stuck in this loop. I managed to fix it by disconnecting the fiber cable, then it booted normally. I had to roll it back to V1.9.4 by O3labs. Has anyone else experienced this?

[Yazeed-Momani]

@rdlvm, as I mentioned earlier, I get great upload and download speeds. I'm not entirely sure, but it might be because I've always disabled port speed negotiation on my main TP-Link router. Before the VSOL V2802RH, I used a Nokia G-140W-C bridge and forced the WAN port on my TP-Link router to "1000Mbps Full Duplex." Now, with the VSOL V2802RH, it's set to "2500Mbps Full Duplex".
If you have this option on your (MT6000 GLINET OPENWRT main router), try to force the WAN port to "2500Mbps Full Duplex"

[rdlvm]

@rdlvm, como mencioné anteriormente, obtengo excelentes velocidades de carga y descarga. No estoy del todo seguro, pero podría deberse a que siempre he desactivado la negociación de velocidad de puerto en mi router TP-Link principal. Antes del V2802RH VSOL, usé un puente Nokia G-140W-C y forcé el puerto WAN en mi enrutador TP-Link a "1000Mbps Full Duplex". Ahora, con el V2802RH VSOL, está configurado en "2500Mbps Full Duplex".Si tiene esta opción en su router principal (MT6000 GLINET OPENWRT), intente forzar el puerto WAN a "2500Mbps Full Duplex"

I don't know where that option is in openwrt but I see 2.5gbe in the interface

[Yazeed-Momani]

I just found this on "forum.openwrt.org"

The switch configuration page in the GUI, or swconfig dev switch0 show on the CLI, should show the actual negotiated link speed on each Ethernet port that is linked.

[Yazeed-Momani]

Also check this https://forum.openwrt.org/t/how-do-i-force-an-ethernet-speed/139985/12
How do I force an Ethernet speed?

[rdlvm]

wconfig dev switch0 show

As I said, my router indicates 2.5GBE, also my download is 970MBs and my upload is slower, for some reason with this ONT, I am not the only one with this problem, it is a common problem in this REALTEK ONT chipset

[JediBUZ]

Does the VSOL V2802RH allow you to type in a different GPON serial number?

[longthanhtran]

Does the VSOL V2802RH allow you to type in a different GPON serial number?

yes, by using flash set GPON xxxxnnnnnnnn as usual via telnet

[100apps]

Does the VSOL V2802RH allow you to type in a different GPON serial number?

yes, by using flash set GPON xxxxnnnnnnnn as usual via telnet

but the max length is limited to 12, my sn's length is 16, set failed:

AP#flash set GPON_SN 48575443ADDB04AE

AP#cfg get GPON_SN
<Name="GPON_SN" Value="48575443ADDB"/>

[tantien11]

AP#flash set GPON_SN HWTCADDB04AE

try "HWTCADDB04AE"

[100apps]

AP#flash set GPON_SN HWTCADDB04AE

try "HWTCADDB04AE"

thank you very much，it works。

[sudozid]

Anyone know how to do transparent vlan on this so i can setup vlans on my router instead of onu?

[Anime4000]

you can't, you need untag it

[MNGermann]

Mudei de ISP e Vsol estava em bridge... não tinha ideia que perderia acesso e botão de reset não funcionaria. depois de queimar um usb pra UART mandando voltagem do vsol pra ele... vonsegui usar um raspberry pi como ponte uart... a boa noticia é que consigo ver toda sequencia de boot, a má é que não consigo mandar comandos ou resetar o aparelho. Alguma recomendação ou virou lixo eletronico?

[FullyRemoteDev]

What is the latest firmware now? is there anything after 1.1.8?

[pb36]

Just to confirm this ONU does not support Vlan Transparent Mode like it's available with tp-link onus like G7, G3 right? if it supports how to achieve that as I want to set vlan on my router instead of ONU

[RummaanKhan]

Hello, I'm trying to configure Photon PTF2282 same HW as V2802RH with an indian ISP (Jio) who are using RSYS OLT here and I was able to register by cloning GPON SN using the info from stock ONT but still I'm unable to access internet by I cloning mac address of stock ONT. Is there something else I should do to access internet on this?

[yesrab]

how did you change the mac address ?
can you please tell me?

[brandonn63]

Hello. My Vsol v2801Q device is broken. Can I run shared firmwares to fix the device with SPI programming or is there a suitable firmware? Can you help me?

[kam821]

I noticed that after setting VLAN mapping for the LAN2 port once and returning to port mapping, I cannot then set VLAN mapping again, when trying to confirm the VLAN mapping configuration, the port mapping option remains.
Has anyone encountered this problem?
Or does anyone know of a better way to preserve VLAN tag from the WAN to the one of the LAN ports?

[sharjeela4]

please admin password share stdONUi0i not working password internet service provider username password add onu but how add

[rtsp]

Anyone has idea to persist the custom FwdOp across reboot?

It would be possible if I can put some custom script running at startup (which I can't find) or ... by making a firmware modification.

I tried to decode the firmware images from https://www.tripleoxygen.net/wiki/ont/vsol/v2802rh#firmwares but I have no idea about image layout or how to extract/repack them. Any clues would be greatly appreciated.

[sbm1976]

Hi,
Just got VSOL V2802RH , but after put LOID and LOID password, the webpage is only showing EPON setting
GPON setting and OMCI page not showing in the webpage anymore.
can any one help
Rgds