ZTE MF287Pro

From TechInfoDepot
Jump to navigationJump to search
multiple revisions of this device, use caution
abgn+ac (AC1200)
4G LTE Cat6 Router
3rd Party Firmware
dd-wrt Status Unknown
OpenWrt Supported
Tomato any flavor Incompatible
Gargoyle Status Unknown
Platform
BrandModelRev ZTE MF287Pro
FCC ID (fcc.io) none specified
FCC ID (fcc.report) none specified
Type wireless router
CPU1 checkY Qualcomm IPQ4018
CPU1 Type ARMv7 Cortex-A7
CPU1 Speed 700 MHz ( 4 cores )
Flash1 Chip Brand? Model?
Flash1 Size 128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (SPI NAND)
Flash2 Size 8 MiB8,388,608 B <br />65,536 Kib <br />8,192 KiB <br />64 Mib <br />0.00781 GiB <br /> (SPI NOR)
RAM1 Size 256 MiB 268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br />
RAM1 Chip Brand? Model?
ETH chip1 Qualcomm IPQ4018
Switch Qualcomm Atheros QCA8075
Ethernet Port Count 4-1GbE-LAN
Wired Standard IEEE 802.3i/3u/3ab

802dot11 OUI: none specified

Stock bootloader U-Boot
Expansion IF types Mini PCIe, USB 2.0
Mini PCIe slots 1
USB ports 1
USB Hub Compatible Untested
Power 12 VDC, 1.5 A
Connector type barrel
Serial Port (UART) yes, 3.3V TTL, (115200 8N1)

Flags:
LTE

Other
3rd Party Firmware Support OpenWrt • (List | Dev | DLs)
Radio 1
Chip1 Qualcomm IPQ4018
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 2x2:2
Wireless Standard IEEE 802.11b/g/n
802.11n up to 300 Mbps
802.11g up to 54 Mbps
802.11b up to 11 Mbps
WiFi Operating Frequency 2.4 GHz
Radio 2
Chip1 Qualcomm IPQ4018
Wireless interface OUI none specified
Antenna Connector Type none specified
MIMO status 2x2:2
Wireless Standard IEEE 802.11a/n/ac
802.11ac up to 867 Mbps
802.11n up to 300 Mbps
802.11a up to 54 Mbps
WiFi Operating Frequency 5 GHz
 CPU1 brandRadio1 chip1 brandRadio2 chip1 brand
ZTE MF287 (3Neo)QualcommQualcommQualcomm
ZTE MF287+ (DreiNeo)QualcommQualcommQualcomm
ZTE MF287ProQualcommQualcommQualcomm

For a list of all currently documented Qualcomm chipsets with specifications, see Qualcomm.
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented ZTE devices with specifications, see ZTE.

867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.),
300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = AC1200 class

Flashing

Flashing OpenWrt

Target: ipq40xx
Subtarget: generic
Package architecture: arm_cortex-a7_neon-vfpv4
Supported Since Commit
Support started version: 23.05.0
Current supported version: 24.10.4
LAN Hardware: Qualcomm Atheros QCA8075
WLAN Hardware: Qualcomm Atheros IPQ4018
WLAN Comment: MIMO 2x2:2
Installation method(s):
see git-commit
Recovery method(s):
see git-commit
git • >>
ipq4019: add support for ZTE MF287 Pro aka DreiNeo Pro
The ZTE MF287 Pro is a LTE router used (exclusively?) by the network
operator "3". It is very similar to the MF287+, but the hardware layout
and partition layout have changed quite a bit.

Specifications
==============

SoC: IPQ4018
RAM: 256MiB
Flash: 8MiB SPI-NOR + 128MiB SPI-NAND
LAN: 4x GBit LAN
LTE: ZTE Cat12
WiFi: 802.11a/b/g/n/ac SoC-integrated
USB: 1x 2.0

MAC addresses
=============

LAN: from config + 2
WiFi 1: from config
WiFi 2: from config + 1

Installation
============

Option 1 - TFTP
---------------

TFTP installation using UART is preferred. Disassemble the device and
connect serial. Put the initramfs image as openwrt.bin to your TFTP server
and configure a static IP of 192.168.1.100. Load the initramfs image by
typing:

  setenv serverip 192.168.1.100
  setenv ipaddr 192.168.1.1
  tftpboot 0x82000000 openwrt.bin
  bootm 0x82000000

From this intiramfs boot you can take a backup of the currently installed
partitions as no vendor firmware is available for download:

  ubiattach -m17
  cat /dev/ubi0_0 > /tmp/ubi0_0
  cat /dev/ubi0_1 > /tmp/ubi0_1

Copy the files /tmp/ubi0_0 and /tmp/ubi0_1 somewhere save.

Once booted, transfer the sysupgrade image and run sysupgrade. You might
have to delete the stock volumes first:

  ubirmvol /dev/ubi0 -N ubi_rootfs
  ubirmvol /dev/ubi0 -N kernel

Option 2 - From stock firmware
------------------------------

The installation from stock requires an exploit first. The exploit consists
of a backup file that forces the firmware to download telnetd via TFTP from
192.168.0.22 and run it. Once exploited, you can connect via telnet and
login as admin:admin.

The exploit will be available at the device wiki page.

Once inside the stock firmware, you can transfer the -factory.bin file to
/tmp by using "scp" from the stock frmware or "tftp".

ZTE has blocked writing to the NAND. Fortunately, it's easy to allow write
access - you need to read from one file in /proc. Once done, you need to
erase the UBI partition and flash OpenWrt. Before performing the operation,
make sure that mtd13 is the partition labelled "rootfs" by calling
"cat /proc/mtd".

Complete commands:

  cd /tmp
  tftp -g -r factory.bin 192.168.0.22
  cat /proc/driver/sensor_id
  flash_erase /dev/mtd17 0 0
  dd if=/tmp/factory.bin of=/dev/mtdblock17 bs=131072

Afterwards, reboot your device and you should have a working OpenWrt
installation.

Restore Stock
=============

Option 1 - via UART
-------------------

Boot an OpenWrt initramfs image via TFTP as for the initial installation.
Transfer the two backed-up files to your box to /tmp.

Then, run the following commands - replace $kernel_length and $rootfs_size
by the size of ubi0_0 and ubi0_1 in bytes.

  ubiattach -m 17
  ubirmvol /dev/ubi0 -N kernel
  ubirmvol /dev/ubi0 -N rootfs
  ubirmvol /dev/ubi0 -N rootfs_data
  ubimkvol /dev/ubi0 -N kernel -s $kernel_length
  ubimkvol /dev/ubi0 -N ubi_rootfs -s $rootfs_size
  ubiupdatevol /dev/ubi0_0 /tmp/ubi0_0
  ubiupdatevol /dev/ubi0_1 /tmp/ubi0_1

Option 2 - from within OpenWrt
------------------------------

This option requires to flash an initramfs version first so that access
to the flash is possible. This can be achieved by sysupgrading to the
recovery.bin version and rebooting. Once rebooted, you are again in a
default OpenWrt installation, but no partition is mounted.

Follow the commands from Option 1 to flash back to stock.

LTE Modem
=========

The LTE modem is similar to other ZTE devices and controls some more LEDs
and battery management.

Configuring the connection using uqmi works properly, the modem
provides three serial ports and a QMI CDC ethernet interface.

Other Notes
===========

Contrary to the stock firmware, the USB port on the back can be used.

There is one GPIO Switch "Power button blocker" which, if enabled, does not
trigger a reset of the SoC if the modem reboots. If disabled, the SoC is
rebooted along with the modem. The modem can be rebooted via the exported
GPIO "modem-reset" in /sys/class/gpio.