ZTE MF287+ (DreiNeo)
From TechInfoDepot
Jump to navigationJump to search
| abgn+ac (AC1200) | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4G LTE Cat6 Router | |||||||||||||||||
|
| |||||||||||||||||
| 3rd Party Firmware | |||||||||||||||||
| dd-wrt | Status Unknown | ||||||||||||||||
| OpenWrt | Supported | ||||||||||||||||
| Tomato any flavor | Incompatible | ||||||||||||||||
| Gargoyle | Status Unknown | ||||||||||||||||
| Platform | |||||||||||||||||
| Brand • Model • Rev | ZTE MF287 + (DreiNeo) | ||||||||||||||||
| FCC ID (fcc.io) | none specified | ||||||||||||||||
| FCC ID (fcc.report) | none specified | ||||||||||||||||
| Type | wireless router | ||||||||||||||||
| CPU1 | Qualcomm IPQ4018 | ||||||||||||||||
| CPU1 Type | ARMv7 Cortex-A7 | ||||||||||||||||
| CPU1 Speed | 700 MHz ( 4 cores ) | ||||||||||||||||
| Flash1 Chip | Brand? Model? | ||||||||||||||||
| Flash1 Size | 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (SPI NAND) | ||||||||||||||||
| Flash2 Size | 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (SPI NOR) | ||||||||||||||||
| RAM1 Size | 256 MiB 268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br /> | ||||||||||||||||
| RAM1 Chip | Brand? Model? | ||||||||||||||||
| ETH chip1 | Qualcomm IPQ4018 | ||||||||||||||||
| Switch | Qualcomm Atheros QCA8075 | ||||||||||||||||
| Ethernet Port Count | 4-1GbE-LAN | ||||||||||||||||
| Wired Standard | IEEE 802.3i/3u/3ab | ||||||||||||||||
|
802dot11 OUI: none specified | |||||||||||||||||
| Stock bootloader | U-Boot | ||||||||||||||||
| Expansion IF types | Mini PCIe, USB 2.0 | ||||||||||||||||
| Mini PCIe slots | 1 | ||||||||||||||||
| USB ports | 1 | ||||||||||||||||
| USB Hub Compatible | Untested | ||||||||||||||||
| Power | 12 VDC, 1.5 A | ||||||||||||||||
| Connector type | barrel | ||||||||||||||||
| Serial Port (UART) | yes, 3.3V TTL, (115200 8N1) | ||||||||||||||||
|
Flags: | |||||||||||||||||
|
| |||||||||||||||||
| Other | |||||||||||||||||
|
| |||||||||||||||||
| 3rd Party Firmware Support |
OpenWrt • (List | Dev | DLs) | ||||||||||||||||
| Radio 1 | |||||||||||||||||
| Chip1 | Qualcomm IPQ4018 | ||||||||||||||||
| Wireless interface OUI | none specified | ||||||||||||||||
| Antenna Connector Type | none specified | ||||||||||||||||
| MIMO status | 2x2:2 | ||||||||||||||||
| Wireless Standard | IEEE 802.11b/g/n | ||||||||||||||||
| 802.11n | up to 300 Mbps | ||||||||||||||||
| 802.11g | up to 54 Mbps | ||||||||||||||||
| 802.11b | up to 11 Mbps | ||||||||||||||||
| WiFi Operating Frequency | 2.4 GHz | ||||||||||||||||
| Radio 2 | |||||||||||||||||
| Chip1 | Qualcomm IPQ4018 | ||||||||||||||||
| Wireless interface OUI | none specified | ||||||||||||||||
| Antenna Connector Type | none specified | ||||||||||||||||
| MIMO status | 2x2:2 | ||||||||||||||||
| Wireless Standard | IEEE 802.11a/n/ac | ||||||||||||||||
| 802.11ac | up to 867 Mbps | ||||||||||||||||
| 802.11n | up to 300 Mbps | ||||||||||||||||
| 802.11a | up to 54 Mbps | ||||||||||||||||
| WiFi Operating Frequency | 5 GHz | ||||||||||||||||
| |||||||||||||||||
For a list of all currently documented Qualcomm chipsets with specifications, see Qualcomm.
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.
For a list of all currently documented ZTE devices with specifications, see ZTE.
Flashing
| NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power. |
Flashing OpenWrt
Target: ipq40xx
Subtarget: generic
Package architecture: arm_cortex-a7_neon-vfpv4
Supported Since Commit
Support started version: 23.05.0
Current supported version: 24.10.4
Subtarget: generic
Package architecture: arm_cortex-a7_neon-vfpv4
Supported Since Commit
Support started version: 23.05.0
Current supported version: 24.10.4
LAN Hardware: Qualcomm Atheros QCA8075
WLAN Hardware: Qualcomm Atheros IPQ4018
WLAN Comment: MIMO 2x2:2
Installation method(s):
see git-commit
Recovery method(s):
see git-commit
Comment:
On board Zigbee (Silicon Labs EM3581)
WLAN Hardware: Qualcomm Atheros IPQ4018
WLAN Comment: MIMO 2x2:2
Installation method(s):
see git-commit
Recovery method(s):
see git-commit
Comment:
On board Zigbee (Silicon Labs EM3581)
| git • >> |
|---|
ipq4019: add support for ZTE MF287+ aka DreiNeo The ZTE MF287+ is a LTE router used (exclusively?) by the network operator "3". The MF287 (i.e. non-plus aka 3Neo) is also supported (the only difference is the LTE modem) Specifications ============== SoC: IPQ4018 RAM: 256MiB Flash: 8MiB SPI-NOR + 128MiB SPI-NAND LAN: 4x GBit LAN LTE: ZTE Cat12 (MF287+) / ZTE Cat6 (MF287) WiFi: 802.11a/b/g/n/ac SoC-integrated MAC addresses ============= LAN: from config + 2 WiFi 1: from config WiFi 2: from config + 1 Installation ============ Option 1 - TFTP --------------- TFTP installation using UART is preferred. Disassemble the device and connect serial. Put the initramfs image as openwrt.bin to your TFTP server and configure a static IP of 192.168.1.100. Load the initramfs image by typing: setenv serverip 192.168.1.100 setenv ipaddr 192.168.1.1 tftpboot 0x82000000 openwrt.bin bootm 0x82000000 From this intiramfs boot you can take a backup of the currently installed partitions as no vendor firmware is available for download: ubiattach -m14 cat /dev/ubi0_0 > /tmp/ubi0_0 cat /dev/ubi0_1 > /tmp/ubi0_1 Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save. Once booted, transfer the sysupgrade image and run sysupgrade. You might have to delete the stock volumes first: ubirmvol /dev/ubi0 -N ubi_rootfs ubirmvol /dev/ubi0 -N kernel Option 2 - From stock firmware ------------------------------ The installation from stock requires an exploit first. The exploit consists of a backup file that forces the firmware to download telnetd via TFTP from 192.168.0.22 and run it. Once exploited, you can connect via telnet and login as admin:admin. The exploit will be available at the device wiki page. Once inside the stock firmware, you can transfer the -factory.bin file to /tmp by using "scp" from the stock frmware or "tftp". ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write access - you need to read from one file in /proc. Once done, you need to erase the UBI partition and flash OpenWrt. Before performing the operation, make sure that mtd13 is the partition labelled "rootfs" by calling "cat /proc/mtd". Complete commands: cd /tmp tftp -g -r factory.bin 192.168.0.22 cat /proc/driver/sensor_id flash_erase /dev/mtd13 0 0 dd if=/tmp/factory.bin of=/dev/mtdblock13 bs=131072 Afterwards, reboot your device and you should have a working OpenWrt installation. Restore Stock ============= Option 1 - via UART ------------------- Boot an OpenWrt initramfs image via TFTP as for the initial installation. Transfer the two backed-up files to your box to /tmp. Then, run the following commands - replace $kernel_length and $rootfs_size by the size of ubi0_0 and ubi0_1 in bytes. ubiattach -m 14 ubirmvol /dev/ubi0 -N kernel ubirmvol /dev/ubi0 -N rootfs ubirmvol /dev/ubi0 -N rootfs_data ubimkvol /dev/ubi0 -N kernel -s $kernel_length ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0 ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1 Option 2 - from within OpenWrt ------------------------------ This option requires to flash an initramfs version first so that access to the flash is possible. This can be achieved by sysupgrading to the recovery.bin version and rebooting. Once rebooted, you are again in a default OpenWrt installation, but no partition is mounted. Follow the commands from Option 1 to flash back to stock. LTE Modem ========= The LTE modem is similar to other ZTE devices and controls some more LEDs and battery management. Configuring the connection using uqmi works properly, the modem provides three serial ports and a QMI CDC ethernet interface. |
Categories:
- ZTE
- Embedded system/wireless router
- Embedded System Qualcomm
- Embedded System IPQ4018
- Qualcomm
- Embedded System ARMv7
- Embedded System Cortex-A7
- Embedded System Qualcomm Atheros
- Embedded System QCA8075
- Qualcomm Atheros
- OpenWrt Supported
- Has Mimo Status
- Embedded System IEEE 802.11b/g/n
- Embedded System IEEE 802.11a/n/ac
- Dual-Radio Wireless Embedded System
- Wireless Embedded System
- Dual-Band
- Embedded System
- English Documentation