ZyXEL ZyWALL 2WG

Links of Interest

 * Manual • Datasheet


 * ZyXEL ZyWALL 2WG Review on PCmag
 * CPU: Intel XScale IXP422 (PRIXP422ABB) @266MHz

Firmware

 * 404AQI8C0.bin - The stock OS seems to be ZyNOS

{{SCollapse|System Info • >>

System Info
ZyWALL 2WG> atsh ZyNOS Version         : V4.04(AQI.8) | 04/09/2010 08:59:04 Bootbase Version      : V1.08 | 11/01/2006 12:17:09 Vendor Name           : ZyXEL Communications Corp. Product Model          : ZyWALL 2WG ZyNOS ROM address     : 50080000 System Type           : 10 MAC Address           : ************ Default Country Code  : E1 Boot Module Debug Flag : 00 RomFile Version       : 45 RomFile Checksum      : 3f90 ZyNOS Checksum        : cfc1 Core Checksum         : 3780 SNMP MIB level & OID  : 060102030405060708091011121314151617181920 Main Feature Bits     : C0 Other Feature Bits     : 01 22 00 00 00 00 00 00-00 00 00 00 00 00 00 00         00 00 00 00 00 00 00 00-00 41 13 00 00 00

MemTab
ROMIO image start at 50080000 code version: code start: 00028000 code length: 36BA7C memMapTab: 18 entries, start = 500cf000, checksum = 2481 $RAM Section: 0: BootExt(RAMBOOT), start=00028000, len=20000 1: BootData(RAM), start=00048000, len=20000 2: HTPCode(RAMCODE), start=00068000, len=498000 3: HTPData(RAM), start=00500000, len=3B00000 4: RasCode(RAMCODE), start=00068000, len=CF4000 5: RasData(RAM), start=00d5c000, len=12A4000 $ROM Section: 6: BootBas(ROMIMG), start=50000000, len=20000 7: DbgArea(ROMIMG), start=50020000, len=2000 8: RomDir2(ROMDIR), start=50040000, len=40000 9: BootExt(ROMIMG), start=50080030, len=27FD0 10: HTPCode(ROMBIN), start=500a8000, len=27000 (Compressed) Version: HTP_ZW2WG V 0.5, start: 500a8030 Length: 567D2, Checksum: F6CA Compressed Length: 1114F, Checksum: 01AB 11: MemMapT(ROMMAP), start=500cf000, len=C00 12: termcap(ROMIMG), start=500cfc00, len=400 13: RomDefa(ROMIMG), start=500d0000, len=40000 14: RasCode(ROMBIN), start=50110000, len=5F0000 (Compressed) Version: RAS zw2wg, start: 50110030 Length: CDE620, Checksum: A2F9 Compressed Length: 2DBA7C, Checksum: 8037 15: cwmpData(ROMBIN), start=50700000, len=20000 signature error! 16: BgtCtrl(ROMBIN), start=50720000, len=20000 signature error! 17: RomExt1(ROMDIR), start=50740000, len=C0001

binwalk dump
DECIMAL  	HEX       	DESCRIPTION --- 163840   	0x28000   	ZynOS header, header size: 48 bytes, load address 0x0, rom image type: ROMBIN, uncompressed size: 354258, compressed size: 69967, uncompressed checksum: 0xF6CA, compressed checksum: 0x1AB, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0 163888   	0x28030   	LZMA compressed data, properties: 0x5D, dictionary size: 262144 bytes, uncompressed size: 354257 bytes 589824   	0x90000   	ZynOS header, header size: 48 bytes, load address 0x0, rom image type: ROMBIN, uncompressed size: 13493792, compressed size: 2996860, uncompressed checksum: 0xA2F9, compressed checksum: 0x8037, flags: 0xE0, uncompressed checksum is valid, the binary is compressed, compressed checksum is valid, memory map table address: 0x0 589872   	0x90030   	LZMA compressed data, properties: 0x5D, dictionary size: 262144 bytes, uncompressed size: 13493792 bytes }}