ZTE ZXHN H367A

Flash layout
Flash backup: h367n-flash-backup.tar.gz

Bootloader Recovery mode
We can enter into the bootloader recovery mode:
 * 1) Set a static IP on your computer, use 192.168.1.35 (or any compatible), and connect the ethernet cable to the router.
 * 2) Power off the device (unplug the PSU)
 * 3) Puss down Reset and WPS button at the same time
 * 4) Power on the device
 * 5) Wait 5 seconds
 * 6) Release the buttons
 * 7) Browse to http://192.168.1.254, you should see this screen:



Bootloader
We can break into the Bootloader command line by pressing
 * the key 1 while starting up the device.

There are some commands available for unbricking the device: H367AV1.0 login: BGA IC Xtal:1 DDR3 init. DRAMC init done. Calculate size. DRAM size=256MB Set new TRFC. ddr-1066

7512DRAMC V1.2.2 (0) Set SPI Flash Clock to 25 Mhz Memory size 256MB Set SPI Flash Clock to 25 Mhz spi_nand_probe: mfr_id=0xef, dev_id=0xaa Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000 bmt pool size: 81 BMT & BBT Init Success

board ip address:192.168.1.254 no_pci_found error case


 * Press 1 means entering boot mode***
 * Press 2 means entering testing mode***
 * Press 3 means entering norm mode***

Entering boot mode ...


 * start httpd******

PBUF_POOL_BUFSIZE = 256 tcp_bind Local Port = 0 tcp_bind: bind to port 80 PBUF_POOL_BUFSIZE = 256 memtop = 80020000 zteboot_cmdline_init bldr> ? ?                                  Print out help messages. help                               Print out help messages. go                                 Booting the linux kernel. decomp                             Decompress kernel image to ram. memrl                       Read a word from addr. memrls       Read some regs addr. memwl                Write a word to addr. dump                   Dump memory content. jump                        Jump to addr. flash         Write to flash from src to dst(oob: write nand oob if 1). erase                  Erase flash from addr. readflash      read flash from flashaddr to ramaddr. imginfo                            Show images info. bdstore       Do backdoor config store bdshow                             Show backdoor config bdswitch[1|0]                      Enable or disable backdoor function ddrcalswitch[1|0]                  Enable or disable ddr calibration funciton drambistswitch[0|1|2]              disable or enable, and quick or normal test xmdm                   Xmodem receive to addr. miir                Read ethernet phy reg. miiw         Write ethernet phy reg. cpufreq /         Set CPU Freq <156~450>(freq has to be multiple of 6) ipaddr                   Change modem's IP. httpd                              Start Web Server ddrdrv <..>                        Change DDR driving length reset                              reset the system upgrade        upgrade version runemt                             run emt mode bldr>

Command injection
There is a possibility to inject commands via web interface using the URL Filter field at Internet->Security section



Note that here we use a custom script located at the var directory because apparently the scripts at the usb flash drives under the /mnt directory can't be executed. We can write files to /var using a popular samba server bug.

Boot log
{{SCollapse|boot log BGA IC Xtal:1 DDR3 init. DRAMC init done. Calculate size. DRAM size=256MB Set new TRFC. ddr-1066

7512DRAMC V1.2.2 (0) Set SPI Flash Clock to 25 Mhz Memory size 256MB Set SPI Flash Clock to 25 Mhz spi_nand_probe: mfr_id=0xef, dev_id=0xaa Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000 bmt pool size: 81 BMT & BBT Init Success

board ip address:192.168.1.254 no_pci_found error case

............................................................
 * Press 1 means entering boot mode***
 * Press 2 means entering testing mode***
 * Press 3 means entering norm mode***

Found image at 0x00200000

Found image at 0x01a00000 decompress_addr 200100 decompress_addr_end 373e04 Decompress to 80002000 free_mem_ptr=80600000 free_mem_ptr_end=80780000 75xx: 0x0 Uncompressing [LZMA] ... done. Linux version 2.6.36 (xialei@localhost.localdomain) (gcc version 4.3.6 (Buildroot 2012.05) ) #1 SMP Tue Jan 2 18:49:54 CST 2018 ISPRAM0: PA=00340000,Size=00010000,enabled Check boot para cksum... aca acaboot para cksum OK! Boot 1'th image bootPara.runmode=3 pdt_verinfo_init: tcVerInfo->RunMode[3] bootPara.bootWhichImg=1 bootPara.img_info_tbl[0].flashOffset=0x 200000 hw_ver=00 sHardVersion=V1.0.00 memsize:256MB EcoNet EN751221 SOC prom init bootconsole [early0] enabled CPU revision is: 00019558 (MIPS 34Kc) Determined physical RAM map: memory: 0ffe0000 @ 00020000 (usable) Wasting 1024 bytes for tracking 32 unused pages Zone PFN ranges: Normal  0x00000020 -> 0x00010000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000020 -> 0x00010000 3 available secondary CPU TC(s) PERCPU: Embedded 7 pages/cpu @81203000 s7232 r8192 d13248 u65536 pcpu-alloc: s7232 r8192 d13248 u65536 alloc=16*4096 pcpu-alloc: [0] 0 [0] 1 [0] 2 [0] 3 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 64992 Kernel command line: es=1 PID hash table entries: 1024 (order: 0, 4096 bytes) Dentry cache hash table entries: 32768 (order: 5, 131072 bytes) Inode-cache hash table entries: 16384 (order: 4, 65536 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00037732 Readback ErrCtl register=00037732 nmi base is 81274200 Memory: 253624k/262016k available (3384k kernel code, 8392k reserved, 937k data, 232k init, 0k highmem) SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 Hierarchical RCU implementation. RCU-based detection of stalled CPUs is disabled. Verbose stalled-CPUs detection is disabled. NR_IRQS:64 CPU frequency 900.00 MHz Using 199.996 MHz high precision timer. console [ttyS0] enabled, bootconsole disabled console [ttyS0] enabled, bootconsole disabled Calibrating delay loop... 598.01 BogoMIPS (lpj=2990080) pid_max: default: 32768 minimum: 301 Mount-cache hash table entries: 512 34K sync es set to 1. Config7: 0x80080500 Limit of 4 TCs set TLB of 64 entry pairs shared by 2 VPEs VPE 0: TC 0 1 2, VPE 1: TC 3 IPI buffer pool of 16 buffers CPU revision is: 00019558 ((null)) TC 1 going on-line as CPU 1 CPU revision is: 00019558 ((null)) TC 2 going on-line as CPU 2 CPU revision is: 00019558 ((null)) TC 3 going on-line as CPU 3 Brought up 4 CPUs NET: Registered protocol family 16 11930:22:53 [KMONITOR][Notice] [monitor.c(938)MonitorInit] cspmonitor init... ! MT7512_pcie_init check pcie link up status: isRC0_LINKUP=1 isRC1_LINKUP=1 registering PCI controller with io_map_base unset bio: create slab  at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb pci 0000:00:00.0: BAR 8: assigned [mem 0x20000000-0x200fffff] pci 0000:00:01.0: BAR 8: assigned [mem 0x20100000-0x203fffff] pci 0000:01:00.0: BAR 0: assigned [mem 0x20000000-0x2001ffff 64bit] pci 0000:01:00.0: BAR 0: set to [mem 0x20000000-0x2001ffff 64bit] (PCI address [0x20000000-0x2001ffff] pci 0000:01:00.0: BAR 6: assigned [mem 0x20020000-0x2002ffff pref] pci 0000:00:00.0: PCI bridge to [bus 01-01] pci 0000:00:00.0:  bridge window [io  disabled] pci 0000:00:00.0:   bridge window [mem 0x20000000-0x200fffff] pci 0000:00:00.0:   bridge window [mem pref disabled] pci 0000:02:00.0: BAR 0: assigned [mem 0x20200000-0x203fffff 64bit] pci 0000:02:00.0: BAR 0: set to [mem 0x20200000-0x203fffff 64bit] (PCI address [0x20200000-0x203fffff] pci 0000:02:00.0: BAR 6: assigned [mem 0x20100000-0x2010ffff pref] pci 0000:00:01.0: PCI bridge to [bus 02-02] pci 0000:00:01.0:  bridge window [io  disabled] pci 0000:00:01.0:  bridge window [mem 0x20100000-0x203fffff] pci 0000:00:01.0:  bridge window [mem pref disabled] PCI: Enabling device 0000:00:00.0 (0000 -> 0002) PCI: Enabling device 0000:00:01.0 (0000 -> 0002) NET: Registered protocol family 8 NET: Registered protocol family 20 11930:22:54 [KQOS][Info] [qos.c(4999)CSPKernel_QoS_I] Qos module init Switching to clocksource MIPS NET: Registered protocol family 2 IP route cache hash table entries: 2048 (order: 1, 8192 bytes) TCP established hash table entries: 8192 (order: 4, 65536 bytes) TCP bind hash table entries: 8192 (order: 4, 65536 bytes) TCP: Hash tables configured (established 8192 bind 8192) TCP: reno registered UDP hash table entries: 128 (order: 0, 4096 bytes) UDP-Lite hash table entries: 128 (order: 0, 4096 bytes) NET: Registered protocol family 1
 * Try the first image...

mt7512_pcie_fixup: 0x1438 = 20000014 mt7512_pcie_fixup: 0x3438 = 20100016 mt7512_pcie_rc1_retrain: 70 = 00036c11 80 = 01608c12 TC3162 hardware watchdog module loaded. squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 495 cryptomgr_test used greatest stack depth: 15632 bytes left cryptomgr_test used greatest stack depth: 15496 bytes left cryptomgr_test used greatest stack depth: 15472 bytes left io scheduler noop registered (default) ttyS0 at I/O 0xbfbf0003 (irq = 1) is a TC3162 ttyS20 at I/O 0xbfbf0303 (irq = 17) is a TC3162 brd: module loaded IS_SPIFLASH=0x0, IS_NANDFLASH=0x2, (0xBFA10114)=0x6) SPI_NAND_Flash_init: before init, mtx_mode_tog=0xl9, manaul_en=0x1 spi_nand_probe: mfr_id=0xef, dev_id=0xaa Dected SPI NAND Flash : _SPI_NAND_DEVICE_ID_W25N01G, Flash Size=0x8000000 spi nand flash tc3162: flash device 0x01000000 at 0x1c000000 EN7512 mtd init: spi nand probe enter [spi_nand_setup] : Enter NAND device: Manufacturer ID: 0xef, Chip ID: 0xaa (Unknown _SPI_NAND_DEVICE_ID_W25N01G) nand_scan_ident ok [spi_nand_setup]: chip size = 0x8000000, erase_shift=0x11 calc_bmt_pool_size : need_valid_block_num=0x51, total_block=0x400 bmt pool size: 81 BMT & BBT Init Success Creating 9 MTD partitions on "EN7512-SPI_NAND": 0x000000000000-0x000007000000 : "Wholeflash" 0x000000000000-0x000000040000 : "Bootloader" 0x000000040000-0x000000060000 : "wifi" 0x000000060000-0x0000000a0000 : "tag" 0x0000000a0000-0x000000200000 : "config" 0x000000200000-0x000000600000 : "kernel1" 0x000000600000-0x000001a00000 : "rootfs1" 0x000001a00000-0x000001e00000 : "kernel2" 0x000001e00000-0x000003200000 : "rootfs2" !!!! led bink!!! RT3xxx EHCI/OHCI init. nf_conntrack version 0.5.0 (3962 buckets, 15848 max) ip_tables: (C) 2000-2006 Netfilter Core Team NET: Registered protocol family 10 ip6_tables: (C) 2000-2006 Netfilter Core Team NET: Registered protocol family 17 Bridge firewalling registered Ebtables v2.0 registered PPP generic driver version 2.4.2 NET: Registered protocol family 24 11930:22:55 [KSWETH][Notice] [sweth_core.c(2818)sweth_init] SW&ETH HAL driver initing! 11930:22:55 [KSWETH][Notice] [sweth_core.c(144)CreateSwEthObjs] Create SW & ETH objects 11930:22:55 [KSWETH][Notice] [sweth_core.c(160)CreateSwEthObjs] Failed to get SWITCH attr, iRet=-2 11930:22:55 [KSWETH][Info] [sweth_core.c(167)CreateSwEthObjs] nEmac = 1, nSw = 0, nEth=5. 11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1! 11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj0: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 0 11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1! 11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj1: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 1 11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1! 11930:22:55 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj2: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 2 11930:22:55 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1! 11930:22:56 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj3: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 3 11930:22:56 [KSWETH][Warn] [sweth_core.c(314)CreateSwEthObjs] Failed to get TAG_PARA_MAC1! 11930:22:56 [KSWETH][Info] [sweth_core.c(326)CreateSwEthObjs] ETH obj4: PhyType = 1, Is_assoc_sw = 0, Emac = 0, Phy = 4 11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms 11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms 11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms 11930:22:56 [LEDKEYDRV][Info] [ledkey_mod.c(1163)KeyModuleInit] Warning!The supplied protect time is less than 1000ms,so use the default protect time 1000ms 11930:22:56 [TAGPARAM][Info] [tagparam_mod.c(1348)TagaramodInit] Tagaram module Driver Version 0.0.1. 11930:22:56 [TAGPARAM][Info] [tagparam_mod.c(1381)TagaramodInit] parse tag param success Jiffies_test Driver Init Successfully logger: created 1024K log 'logger_main' major '99'
 * 1) WF watchdog inited!
 * success register character device for /dev/monitor

11930:22:56 [MIRROR][Notice] [cspmirror.c(1262)mirror_init] ***********mirror_init************ systools version:v0.7.0 errorEPC = f9d31b1c 11930:22:56 [KIGMPSNP][Info] [br_multicast_se(7334)br_mcparam_init] info init! 11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(stb) 11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(srtc) 11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(trtc) 11930:22:56 [KQOS][Info] [qp_meter_api.c(66)QoSPolicerMeter] Register Meter(hard) 11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(null) 11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(drop) 11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_mark) 11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(vlan_prio_mark) 11930:22:56 [KQOS][Info] [qp_act_api.c(66)QoSPolicerActRe] Register Action(dscp_vlan_prio_mark) child_dev_init start child_dev_ioctl_set set[8032a2c8] 11930:22:56 [Kernm255][Info] [ver_info.c(406)ver_info_init] ver_info_init 11930:22:56 [Kernm255][Info] [ver_info.c(195)ReadInfoFromVer] ver_info_init 11930:22:56 [Kernm255][Info] [ver_info.c(202)ReadInfoFromVer] ver_info_init 11930:22:56 [Kernm255][Info] [ver_info.c(218)ReadInfoFromVer] wFirmwareForm is:0x1 11930:22:56 [KSWETH][Notice] [csp_ifinfo.c(221)csp_ifinfo_init] Initializing CSP IFinfo... khelper used greatest stack depth: 15224 bytes left khelper used greatest stack depth: 14824 bytes left kworker/u:1 used greatest stack depth: 14784 bytes left register AF_INET filter failed Shouldn't be in WHILE 11930:22:56 [LEDKEYDRV][Error] [ledkey_callback(26)keycallback_ini] Install WPS KEY Callback Failed! VFS: Mounted root (squashfs filesystem) readonly on device 31:6. Freeing unused kernel memory: 232k freed busybox init and set aff sched_setaffinity cpu all success mount used greatest stack depth: 14144 bytes left init normal mode!!!
 * 1) begin FDB_Notify Reg
 * 2) after FDB_Notify Reg
 * 3) begin FDB_Notify Reg
 * 1) after FDB_Notify Reg

Loading drivers and kernel modules...

TC3162 LED Manager 0.1 init tcledctrl version: tcledctrl V1.1.0.0 (Jan 2 2018-18:50:15). tccicmd V1.1.0.0 (Jan 2 2018-18:50:19) fe_core: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint macType = 0 qdma_lan: physical_size is 0x00200000 insmod used greatest stack depth: 14120 bytes left ether.c:v1.00-NAPI 29.Mar.2015 rasw: FE MAC Ethernet address: 00:00:AA:BB:CC:FF 11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth0. 11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth1. 11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth2. 11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth3. 11930:22:58 [KSWETH][Info] [eth_virtual_if.(539)csp_create_vpor] register_netdev ETH obj: eth4. 11930:22:58 [KSWETH][Notice] [econet_mac_adap(579)Register_econet] Register econet EMAC driver 11930:22:58 [KSWETH][Notice] [sweth_core.c(604)RegisterEmacDrv] Register EMAC driver 11930:22:58 [KSWETH][Notice] [sweth_core.c(433)InitSwEthObjs] Initialise SW & ETH objects User External switch ,type 10 EN7512 TRGMII V1.0external port 6 reg=2604,value=16712704 queue0: queue1: queue2: queue3: insmod used greatest stack depth: 13808 bytes left 7530 Ge, 0x1 MCM MT7530 7530 Ge, 0x1 MCM MT7530 7530 Ge, 0x1 MCM MT7530 7530 Ge, 0x1 MCM MT7530 7530 Ge, 0x1 MCM MT7530 MCM MT7530 MCM MT7530 MCM MT7530 MCM MT7530 MCM MT7530 MCM MT7530 MCM MT7530 7512 Ge, MCM MT7530 [adslTimer (1508)18:50:20] ADSL_MODEM_STATE_DOWN GE Tx amp AnaCal Done! (pair-0)(0x12)(0x1c20) GE Tx amp AnaCal Done! (pair-1)(0x17)(0xc20) GE Tx amp AnaCal Done! (pair-2)(0x19)(0xd20) GE Tx amp AnaCal Done! (pair-3)(0x21)(0xb20) MCM MT7530 MCM MT7530 MCM MT7530 MCM MT7530 macType = 0 qdma_wan: qdma_bmgr.c [2581]: HW_FWD physical size is not illegal, force setting to 4MB qdma_wan: physical_size is 0x00400000 Dying Gasp 0.31 init oenmap 0 oenmap2 0 PCM V2.4 (Aug 12 2016 17:56:04) Major Num:255, device: spi init mod-slic3,interface:,devNum:1,gpio:2000 spi &pcm

Silabs SLIC type selected by SW makefile compile option

SPI_Reset pcm1 ch num:3 pcm2 ch num:0 Init fxsNum(3) + fxoNum(0) = slic_ch_num(:3), deviceNum(1) init mod-ksocket task init init mod-acodec init mod-foip3 task init task init task init

=
==================
 * MTK DSP init successfully ||

=
==================

dbgTool_init init v2.0 pid 94's current affinity mask: (null) pid 94's new affinity mask: 8 pid 91's current affinity mask: (null) pid 91's new affinity mask: 8 pid 101's current affinity mask: (null) pid 101's new affinity mask: 8 pid 99's current affinity mask: (null) pid 99's new affinity mask: 8 pid 100's current affinity mask: (null) pid 100's new affinity mask: 8 taskset: invalid number '0x8'

H367AV1.0 login: 11930:23:03 [User][Info] [cspd_main.c(791)main] CALL SetSystemTimeInit main[791] 11930:23:03 [User][Info] [cspd_main.c(727)SetSystemTimeIn] SetSystemTimeInit[727] 11930:23:03 [User][Info] [cspd_main.c(747)SetSystemTimeIn] SetSystemTimeInit dateStr[20180102190105] 11930:23:03 [User][Info] [db_shm_mgr.c(121)DBShmSrvInit] iShmId:65538 11930:23:03 [User][Info] [db_shm_mgr.c(136)DBShmSrvInit] pShmBuf:60000000 11930:23:04 [dhcp4c][Warn] [dhcp4c_inst.c(4548)_dhcp4cRegSendO] Send code[60]fun[0x5b57ec] is replaced by fun[0x5be25c] 11930:23:04 [dhcps][Info] [dhcps.c(160)DHCPSInit] module init success!dhcp server 11930:23:04 [ipif_mgr][Info] [ipv4_addr_mgr.c(1402)ipv4AddrInit] [ipv4AddrInit] success 11930:23:04 [ipif_mgr][Info] [ifs_ipif.c(2110)ifsIPIFInit] [ifsIPIFInit] success 11930:23:04 [ipif_mgr][Error] [oss_subscribe.c(526)SubScribPublish] SubScribPublish server 10002 already exist! 11930:23:04 [ipif_mgr][Error] [oss_subscribe.c(526)SubScribPublish] SubScribPublish server 10008 already exist! 11930:23:04 [qos_mgr][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[3] Handle[0x4eedc8] [log_file.c(1978)ProcLogConf] Set LOG_FILE_CONF_SET_PDTCONF. [log_file.c(2042)ProcLogConf] Set cAutoSave = 1 11930:23:04 [DB][Notice] [dbc_core.c(364)_dbInit] Check whether the proc file started successfully 11930:23:04 [DB][Notice] [dbc_core.c(370)_dbInit] the proc file started successfully 11930:23:04 [DB][Error] [dbc_mgr_tbl.c(504)dbCreateDomainN] create table fail (ParentControlUser) domain(FilterMode) error default value 11930:23:04 [qos_mgr][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[3], pHandle[0x4eedc8], Event[6] 11930:23:04 [route_mgr][Info] [policy_route.c(1596)policyRtTableIn] policyRtTableInit ok 11930:23:04 [route_mgr][Info] [policy_route.c(1511)defPolicyRtChai] defPolicyRtChainInit ok 11930:23:04 [route_mgr][Info] [route_mgr.c(488)routeInit] SubScribPublish DefGW Service OK 11930:23:04 [bridge][Warn] [bridge.c(2267)bridgeInit] SubScribPublish Bridge Service OK 11930:23:04 [bridge][Info] [bridge.c(2275)bridgeInit] module init success!(bridge_mgr) 11930:23:04 [eth_mgr][Info] [eth_mgr.c(1350)ethInit] module init success!ethernet mgr 11930:23:04 [prefix_mgr][Info] [prefix_mgr.c(2686)prefixInit] Prefix Init Success! 11930:23:04 [sntp_mgr][Info] [time_policy.c(102)TpInit] module init success!2 11930:23:04 [sntp_mgr][Info] [sntp_mgr.c(1519)sntpInit] module init success!SNTP mgr 11930:23:04 [binding_mgr][Info] [binding_mgr.c(1493)bindingInit] [bindingInit] end 11930:23:04 [dhcp6c][Info] [dhcp6c_inst.c(2221)_DHCP6CInit] SubScribPublish DHCP6C OPT Service OK 11930:23:04 [slaac_mgr][Info] [slaac_mgr.c(2098)slaacInit] SubScribPublish SLAAC OPT Service OK 11930:23:04 [kernelmonitor][Info] [cspd_monitor.c(436)MonitorMain] monitor init success 11930:23:04 [PingTracert_mgr][Info] [tracert_mgr.c(1281)tracertInit] module init success!tracert mgr 11930:23:04 [ppp_mgr][Info] [ppp_mgr.c(7821)PPPInit] module init success! 11930:23:04 [dsl_mgr][Info] [dsl_mgr.c(3575)dsl_init] dsl init ok 11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4487)xtmInit] [xtmInit] start 11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4513)xtmInit] xtm init ok 11930:23:04 [xtm_mgr][Info] [xtm_mgr.c(4515)xtmInit] xtm support dynamic add/del interface 11930:23:04 [ptry_mgr][Info] [ptry_mgr.c(478)ptryMgrInit] module init success!(PTry mgr) 11930:23:04 [ddns_mgr][Info] [ddns_mgr.c(1419)ddnsInit] module init success!ddns_mgr 11930:23:04 [dns_mgr][Info] [dns_mgr.c(459)dnsInit] SubScribPublish NetIF Service OK 11930:23:04 [dns_mgr][Info] [comp_dns_mgr.c(75)CompDnsInit] Init Comp_Dns_Mgr Success! 11930:23:04 [fm_mgr][Info] [fm_mgr.c(2494)fmServerInit] module init success!Enter FmServer Init! 11930:23:04 [fm_mgr][Info] [fm_mgr.c(4139)fmMgrInit] module init success!fm mgr 11930:23:04 [tr143_mgr][Info] [tr143_mgr.c(548)tr143Init] module init success!tr143 mgr 11930:23:04 [ipif_mgr][Info] [ifs_netif.c(2530)interfaceNotify] [interfaceNotifyHook] start, to pid[cspd.cspd.qos_mgr] open file failed 11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(WANDCfg) 11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSHostCfg) 11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSPool) 11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(DHCPSBind) 11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrVlan) 11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrVlanport) 11930:23:04 [DB][Error] [dbc_mgr_view.c(428)dbMgrCommViewAd] db view init fail(BrFilter) 11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml 11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml 11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml 11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml 11930:23:04 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_user_cfg.xml 11930:23:04 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_user_cfg.xml 11930:23:04 [DB][Info] [dbc_mgr_file.c(1295)dbFileLoadCfg] find file /var/tmp/db_Decry_cfg.xml 11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml 11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml 11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml 11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml 11930:23:05 [Kernel][Info] [proc_file_mod.c(1286)file_open] open file: /proc/cfg/db_backup_cfg.xml 11930:23:05 [Kernel][Info] [proc_file_mod.c(1416)file_close] close file: /proc/cfg/db_backup_cfg.xml 11930:23:05 [DB][Info] [dbc_mgr_file.c(2289)dbInitSignVal] szCfgSignVal= ZXHN H367A V1.0,iRet:0 11930:23:05 [DB][Warn] [env_api.c(225)GetEnvPara_proc] GetEnvPara: ParaName=SIPLineUserCfg, ParaSize = 1 GiB, RealLen = 0 11930:23:05 [DB][Info] [dbc_core.c(1084)dbEndTm] (ALL) end, use 121 tick 11930:23:06 [dnsurl_policy][Info] [route_api.c(579)RegisterDefGWNo] RegisterDefGWNotify sucessed, ipType[3] event[3] Handle[0x485214] 11930:23:06 [dhcp6s][Info] [ipif_api.c(2330)RegAddr6Notify] RegAddr6Notify start, event[3] IF_ID[] WanLan[2] Handle[0x4724ec] 11930:23:06 [dhcp6s][Info] [dhcp6c_api.c(55)RegDHCP6COptNot] szModuleName:DHCP6S 11930:23:06 [dhcp6s][Info] [dhcp6c_api.c(68)RegDHCP6COptNot] Reg DHCP6C Notify ok, IF_ID[(null)], wOptCode[0], pHandle[0x46b624], Event[1], Module[DHCP6S] 11930:23:06 [dhcp6s][Info] [slaac_api.c(15)RegSLAACOptNoti] RegSLAACOptNotify start, event[1] IF_ID[(null)] wOptCode[0] Handle[0x46b530] 11930:23:06 [dhcp6s][Info] [slaac_api.c(39)RegSLAACOptNoti] szModuleName:DHCP6S [log_file.c(1714)ProcLogConf] Set SaveEnable=0 11930:23:06 [dhcp6s][Info] [slaac_api.c(52)RegSLAACOptNoti] Reg SLAAC Notify ok, IF_ID[(null)], wOptCode[0], pHandle[0x46b530], Event[1] 11930:23:06 [log_mgr][Notice] [log_file.c(1704)ProcLogConf] [Log File] disable. 11930:23:06 [dhcps][Info] [ipif_api.c(2174)RegisterV4AddrN] RegisterV4AddrNotify start, event[1] IF_ID[DEV.IP.IF1] WanLan[2] Handle[0x5a5e58] 11930:23:06 [dhcps][Warn] [interface_api.c(682)GetIFBaseInfo] call dbAPIQryView failed!IF_ID[DEV.IP.IF1], count[0] 11930:23:06 [dhcps][Warn] [dhcpsinst.c(462)getIFInfoAndCre] Call function failed!GetWANLANBaseInfo, IF_ID[DEV.IP.IF1] 11930:23:06 [dhcps][Info] [dhcpsinst.c(548)dhcp4sIFRegiste] dhcps start inst,dhcp4sIFRegister fail 11930:23:06 [dhcps][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[] WanLan[2] Handle[0x5a5f40] 11930:23:06 [dhcps][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[], WanLan[2], pHandle[0x5a5f40], Event[6] 11930:23:06 [dhcp4c][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF3] WanLan[3] Handle[0x5bce0c] 11930:23:06 [dhcp4c][Info] [interface_api.c(1508)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF3] 11930:23:06 [dhcp4c][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF3], WanLan[3], pHandle[0x5bce0c], Event[6] 11930:23:06 [dhcp4c][Info] [interface_api.c(1495)RegisterNetIFNo] RegisterNetIFNotify start, event[6] IF_ID[DEV.IP.IF5] WanLan[3] Handle[0x5bce0c] 11930:23:06 [dhcp4c][Info] [interface_api.c(1508)RegisterNetIFNo] IF_ID Not Null[DEV.IP.IF5] 11930:23:06 [dhcp4c][Info] [interface_api.c(1538)RegisterNetIFNo] Reg NetIF Notify ok, IF_ID[DEV.IP.IF5], WanLan[3], pHandle[0x5bce0c], Event[6] 11930:23:06 [adev_mgr][Info] [access_dev_mgr.(285)adevStart] module start success!(Adev mgr) 11930:23:06 [srm_mgr][Info] [srm_mgr.c(230)SrmInit] module init success!use SRM_DBVIEW data 11930:23:06 [wwan_mgr][Info] [wwan_mgr.c(1091)WwanMgrInit] module init success!wwan mgr 11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.POTS1 11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.DT1 11930:23:06 [wwan_mgr][Info] [ifs_netif.c(957)lowlayerIFChang] oldcount 0, newcount 1 11930:23:06 [wwan_mgr][Info] [ifs_netif.c(1182)AllocNetIF] AllocNetIF start,IF_ID DEV.DT2 11930:23:06 [wwan_mgr][Info] [ifs_netif.c(957)lowlayerIFChang] oldcount 0, newcount 1 11930:23:06 [OSS][Warn] [oss_event_handl(149)OssEventListCal] OssEventListCallChain id = 0x1103!! 11930:23:06 [log_mgr][Info] [log_mgr.c(1276)logSetSerialEna] logGetVerDate str = 20180102. [log_file.c(3540)logFileProcMsg] operation result --- Success [log_file.c(3395)logRegisterToLogcat] RegisterToLogcat success.

H367AV1.0 login: }}

Pictures
User Images 

Specifications

 * Wi-Fi: AC1200, 2.4GHz (300Mbps), 5GHz (867Mbps)

Models

 * ZTE • Vodafone


 * ZTE ZXHN H208N • ADSL Home Gateway
 * MasMovil • 2016 (14:60:80,70:9F:2D,74:B5:7E)


 * ZTE ZXHN H218N • QCA QCA9558 • ISP
 * ZTE ZXHN H267A (v1/v2) • MediaTek MT7511
 * ZTE ZXHN H267N • ADSL Home Gateway
 * FCC ID: Q78-ZXHNH267N (2017-05-11)
 * MasMovil • 2016 (00:4A:77,64:13:6C,8C:68:C8)


 * ZTE ZXHN H268A • Broadcom BCM63168/BCM4360
 * FCC ID: Q78-ZXHNH268A (2016-06-30)


 * ZTE ZXHN H298A • MediaTek MT7612EN/MT7592N
 * Digi (DIGIFIBRA) • 2018 (44:FF:BA, 2C:95:7F)


 * ZTE ZXHN H298N • Realtek RTL8192CE • ISP
 * ZTE ZXHN H367A (V1.0) • FTTH (MasMovil) • 2017
 * ZTE ZXHN F680 • FTTH • QCA QCA9880-BR4A
 * MasMovil • 2018 (00:4A:77,44:FF:BA,8C:E1:17)