Howto unlock your Eircom F1000

peewee3ie

yuloni wrote: »

This post has been deleted.

I will give that a go as well and will report back how I got on.

yuloni

This post has been deleted.

Dermot McDonnell

peewee3ie wrote: »

... I seem to be missing a menu..

The CFE command ATBR erases the Eircom settings and installs the Zyxel defaults. It was not in v1 of the guide. A software reset to defaults works just as well.

GowlBag

I did this last night and it was a great success. I was never convinced that the wireless performance was up to scratch with the eircom firmware. The interface was terrible too. I found it very sluggish with a tendency towards being completely unresponsive, that's if I could get logged on at all without restarting the router first!

I went for the 7C0 firmware. I used a program called Tera Term (under Windows) to get the job done.

Thanks for doing all the hard work Dermot!

Wireless performance seems better. I don't have any numbers but on Tuesday night I tried streaming a very high quality video over wireless and it failed miserably but last night after the unbrand it worked flawlessly.

These line stats are from 29/08/2014, unfortunately I didn't check them just before I unbranded:

============================================================================
VDSL Training Status: Showtime
Mode: VDSL2 Annex B
VDSL Profile: Profile 17a
Traffic Type: PTM Mode
Link Uptime: 0 day: 13 hours: 8 minutes
============================================================================
VDSL Port Details Upstream Downstream
Line Rate: 8.131 Mbps 30.718 Mbps
Actual Net Data Rate: 8.132 Mbps 30.719 Mbps
Trellis Coding: ON ON
SNR Margin: 9.0 dB 8.6 dB
Actual Delay: 0 ms 0 ms
Transmit Power: 7.2 dBm 12.6 dBm
Receive Power: -8.0 dBm -20.9 dBm
Actual INP: 29.0 symbols 29.0 symbols
Total Attenuation: 15.3 dB 33.6 dB
Attainable Net Data Rate: 8.406 Mbps 30.468 Mbps
============================================================================
VDSL Band Status U0 U1 U2 U3 D1 D2 D3
Line Attenuation(dB): 8.7 48.9 40.8 N/A 21.8 60.5 89.4
Signal Attenuation(dB): 8.7 48.6 N/A N/A 32.1 60.2 N/A
SNR Margin(dB): 9.1 9.0 N/A N/A 8.6 8.6 N/A
Transmit Power(dBm): 0.6 6.2 N/A N/A 11.1 7.4 N/A
============================================================================

And this is what I'm getting now:

============================================================================
VDSL Training Status: Showtime
Mode: VDSL2 Annex B
VDSL Profile: Profile 17a
Traffic Type: PTM Mode
Link Uptime: 0 day: 11 hours: 53 minutes
============================================================================
VDSL Port Details Upstream Downstream
Line Rate: 8.144 Mbps 30.716 Mbps
Actual Net Data Rate: 8.145 Mbps 30.717 Mbps
Trellis Coding: ON ON
SNR Margin: 9.2 dB 10.4 dB
Actual Delay: 0 ms 0 ms
Transmit Power: 7.2 dBm 12.7 dBm
Receive Power: -7.9 dBm -20.3 dBm
Actual INP: 29.0 symbols 30.0 symbols
Total Attenuation: 15.2 dB 33.0 dB
Attainable Net Data Rate: 8.790 Mbps 34.205 Mbps
============================================================================
VDSL Band Status U0 U1 U2 U3 D1 D2 D3
Line Attenuation(dB): 8.4 47.6 40.7 N/A 21.4 59.1 88.6
Signal Attenuation(dB): 8.4 46.9 N/A N/A 31.5 58.7 N/A
SNR Margin(dB): 9.5 9.2 N/A N/A 10.4 10.4 N/A
Transmit Power(dBm): 0.4 6.2 N/A N/A 11.1 7.4 N/A
============================================================================

I'm exactly 1 km from the cab.

Dermot McDonnell

GowlBag wrote: »

I did this last night and it was a great success....Wireless performance seems better. I don't have any numbers but on Tuesday night I tried streaming a very high quality video over wireless and it failed miserably but last night after the unbrand it worked flawlessly...

Well done! Nice to get a positive result
Thank you for the kind words.

Kevinf63

GowlBag wrote: »

I did this last night and it was a great success.....

I went for the 7C0 firmware. I used a program called Tera Term (under Windows) to get the job done.....

Wireless performance seems better. I don't have any numbers but on Tuesday night I tried streaming a very high quality video over wireless and it failed miserably but last night after the unbrand it worked flawlessly....

I'm exactly 1 km from the cab.

I'm looking to dive into this myself but there are two things that are putting me off that I'd like to ask yourself and Dermot as a favour.

Dismantling the case of the F1000 is presumably just unscrewing it from the back and prying it open? Also, the USB-to-TTL adapter I have didn't come with labeled pins and therefore because I'm clueless about TTL I don't want to accidently supply more voltage to the router than needed, corrupt files being transferred over Xmodem etc. So judging from the attached picture I've uploaded which pins are needed and what color goes where? Do I even have the orientation right in the picture.... :rolleyes:

KeRbDoG

Kevinf63 wrote: »

I'm looking to dive into this myself but there are two things that are putting me off that I'd like to ask yourself and Dermot as a favour.

Dismantling the case of the F1000 is presumably just unscrewing it from the back and prying it open? Also, the USB-to-TTL adapter I have didn't come with labeled pins and therefore because I'm clueless about TTL I don't want to accidently supply more voltage to the router than needed, corrupt files being transferred over Xmodem etc. So judging from the attached picture I've uploaded which pins are needed and what color goes where? Do I even have the orientation right in the picture.... :rolleyes:

Yes, just a matter of unscrewing the case and it kinda falls open. Then you need to unscrew the PCB from the outer case. Ensure you don't have anything (screwdrivers, screws etc.) on the surface you place it on while working on it that can short any contacts on the board



The pins on the USB-to-TTL are labeled, so if you use the colour coding from the picture you attached and the original images from Dermot McDonnell, it would be;

Green - <not connected> - Red - Orange - <not connected>

I always get confused if the RX/TX should be reversed from the what the labeling from the USB-to-TTL device. Connect them, if the terminal doesn't so any output when the correct baud rate is selected then reverse RX/TX pins.
As Dermot said, don't connect the Vcc(5v or 3.3v) pins from the USB-to-TTL device, nor the DTR/CTS pins

Kevinf63

KeRbDoG wrote: »

Yes, just a matter of unscrewing the case and it kinda falls open. Then you need to unscrew the PCB from the outer case. Ensure you don't have anything (screwdrivers, screws etc.) on the surface you place it on while working on it that can short any contacts on the board........

Cheers for the help, managed to flash the modem last night using ExtraPuTTY. I was little confused at first whether firmware and bootloader where being used interchangeably as one word in this forum (they shouldn't be!) as the "bootloader" link in the OP was down and had the same .bin extension so I went hunting through the thread and eventually stumbled cross the Google Drive bootloader link.

I flashed the V100AAKL7C0 firmware and I tinkered around with the menus for a bit before I hit a snag with static DHCP causing IP assignment loops (assigns IP to client, suddenly can't connect, assigns IP to client again etc) and like the others have done, I hard reset the device using the button on the back. Works like a charm now.

I will edit this post with the stats when I can, I was up till 4 in the morning working with it (lost track of time configuring the thing!) and forgot to get the xDSL stats after the firmware flash. It would be unfair to judge the before flash statistics taken past midnight against the statistics taken after the flash at peak times.

EDIT: Now that I think of it, I've noticed they fixed a few issues with the firewall and DoS protection that would be handy for any gamers out there. I used to have trouble with Battlefield's Battlelog among other server browsers showing no pings if I didn't turn off the firewall entirely. I thought initially it was a problem with the ICMP protocol being accepted going from LAN-to-WAN but not WAN-to-LAN. So I made ACLs to allow all ICMP based packets from every direction (not the best idea) to troubleshoot the problem. That didn't work. With the modem debranded and the firmware flashed to V100AAKL7C0 however, that is a thing of the past and the firewall is up and running with pings showing clearly on Battlelog. Also the router memory usage used to sit around the 70-75% mark, now it sits at 46%, which is a nice improvement!

BEFORE:
=======================================================
VDSL Training Status: Showtime
Mode: VDSL2 Annex B
VDSL Profile: Profile 17a
Traffic Type: PTM Mode
Link Uptime: 0 day: 0 hour: 11 minutes
=======================================================
VDSL Port Details Upstream Downstream
Line Rate: 8.135 Mbps 30.718 Mbps
Actual Net Data Rate: 8.136 Mbps 30.719 Mbps
Trellis Coding: ON ON
SNR Margin: 9.0 dB 12.3 dB
Actual Delay: 0 ms 0 ms
Transmit Power: 7.2 dBm 11.9 dBm
Receive Power: -7.6 dBm -10.0 dBm
Actual INP: 29.0 symbols 30.0 symbols
Total Attenuation: 14.9 dB 21.9 dB
Attainable Net Data Rate: 8.375 Mbps 38.568 Mbps
=======================================================
VDSL Band Status U0 U1 U2 U3 D1 D2 D3
Line Attenuation(dB): 8.2 45.8 68.2 N/A 21.0 57.7 86.8
Signal Attenuation(dB): 8.2 44.9 N/A N/A 20.6 57.3 N/A
SNR Margin(dB): 9.5 8.9 N/A N/A 12.3 12.3 N/A
Transmit Power(dBm): 0.5 6.2 N/A N/A 10.5 6.3 N/A
=======================================================
AFTER:
=======================================================
VDSL Training Status: Showtime
Mode: VDSL2 Annex B
VDSL Profile: Profile 17a
Traffic Type: PTM Mode
Link Uptime: 0 day: 15 hours: 49 minutes
=======================================================
VDSL Port Details Upstream Downstream
Line Rate: 8.127 Mbps 30.718 Mbps
Actual Net Data Rate: 8.128 Mbps 30.719 Mbps
Trellis Coding: ON ON
SNR Margin: 9.5 dB 13.1 dB
Actual Delay: 0 ms 0 ms
Transmit Power: 7.2 dBm 11.9 dBm
Receive Power: -7.8 dBm -9.9 dBm
Actual INP: 29.0 symbols 30.0 symbols
Total Attenuation: 15.0 dB 21.9 dB
Attainable Net Data Rate: 8.566 Mbps 39.702 Mbps
=======================================================
VDSL Band Status U0 U1 U2 U3 D1 D2 D3
Line Attenuation(dB): 8.2 45.9 40.8 N/A 21.0 57.7 87.3
Signal Attenuation(dB): 8.2 45.2 N/A N/A 20.6 57.4 N/A
SNR Margin(dB): 9.0 9.6 N/A N/A 13.1 13.1 N/A
Transmit Power(dBm): 0.3 6.2 N/A N/A 10.6 6.1 N/A
=======================================================

Stats are pretty much the same + or - 1 . Really depends on the time. If its stable I don't care! Biggest problem I had was keeping the router from crashing randomly and preventing WAN access (poor stability as a result of long distance from exchange?) and so far so good.

haggster

I finally did it! I first posted into this thread in late December and it took me until today to finally take care of the unbranding! Thanks a lot Dermot and everbody else here, you guys are amazing. It all went smooth - I only lost one of the four screws for the case... it seems to have disappeared, hehehe!

My stats now:

============================================================================
VDSL Training Status: Showtime
Mode: VDSL2 Annex B
VDSL Profile: Profile 17a
Traffic Type: PTM Mode
Link Uptime: 0 day: 5 hours: 55 minutes
============================================================================
VDSL Port Details Upstream Downstream
Line Rate: 20.477 Mbps 92.155 Mbps
Actual Net Data Rate: 20.478 Mbps 92.156 Mbps
Trellis Coding: ON ON
SNR Margin: 14.2 dB 20.4 dB
Actual Delay: 0 ms 0 ms
Transmit Power: -13.9 dBm 12.5 dBm
Receive Power: -25.0 dBm -1.9 dBm
Actual INP: 29.0 symbols 30.0 symbols
Total Attenuation: 11.1 dB 14.3 dB
Attainable Net Data Rate: 29.117 Mbps 130.656 Mbps
============================================================================
VDSL Band Status U0 U1 U2 U3 D1 D2 D3
Line Attenuation(dB): 2.5 13.9 19.9 N/A 8.5 18.6 28.5
Signal Attenuation(dB): 2.5 13.6 18.8 N/A 10.9 18.4 28.5
SNR Margin(dB): 14.1 14.2 14.2 N/A 20.7 20.3 20.3
Transmit Power(dBm):-24.8 -16.0 -19.1 N/A 8.3 7.8 6.9
============================================================================


I'm on a 90mbit/s profile right now - I guess with an attainable value of 130, I should call eircom and ask them to set it to 100, right?

Anway, couldn't be happier. I'm only using it in bridge mode, but now it's running with an MTU of 1492 - before the unbranding the maximum MTU value was 1484 - if I'd set it higher, the modem would lose its connection after roughly a minute.

Dermot McDonnell

Kevinf63 wrote: »

...I've noticed they fixed a few issues with the firewall and DoS protection that would be handy for any gamers out there. I used to have trouble with Battlefield's Battlelog among other server browsers showing no pings if I didn't turn off the firewall entirely. I thought initially it was a problem with the ICMP protocol being accepted going from LAN-to-WAN but not WAN-to-LAN. So I made ACLs to allow all ICMP based packets from every direction (not the best idea) to troubleshoot the problem. That didn't work. With the modem debranded and the firmware flashed to V100AAKL7C0 however, that is a thing of the past and the firewall is up and running with pings showing clearly on Battlelog. Also the router memory usage used to sit around the 70-75% mark, now it sits at 46%, which is a nice improvement!

Great work Kevinf63, using later firmware fixes lots of things. Many thanks for your input.

Dermot McDonnell

haggster wrote: »

I finally did it!...

Great work. I envy your VDSL profile

Kevinf63

Dermot McDonnell wrote: »

Great work Kevinf63, using later firmware fixes lots of things. Many thanks for your input.

Cheers, but if it wasn't for yourself, your in-depth guide and @KeRbDoG I wouldn't have a clue what to do; I'd more than likely cause spontaneous modem combustion.... So a major thanks to yourself and KeRb for helping!

ghow

In the guide it says "Do this" for the first "Press any key to stop auto run".
Do you do it everytime that appears or just the first time?
Thanks.

Dermot McDonnell

ghow wrote: »

In the guide it says "Do this" for the first "Press any key to stop auto run".
Do you do it everytime that appears or just the first time?
Thanks.

When you press a key in time, the boot process stops and you are left at the CFE prompt. From there you can type in the commands to unlock your F1000.

You must interrupt each boot until the unlock is finished. Don't panic if you don't press a key in time, just restart the F1000.

ghow

Great, thanks very much Dermot

ghow

Following the superb guide very carefully and slowly I successfully unlocked my modem using firmware V100AAKL7C0.bin and had the modem back up and running in 15 minutes.

For anyone else trying this...

I did it using a windows 8.1 tablet with ExtraPutty software (using the "xmodem 1k" menu option for sending the bootloader)

The usb device I got was amazon.co.uk/dp/B00HG9SSSY (which cost €10 inluding prime next day delivery to parcel motel.) connecting tx to tx and rx to rx.

Thanks again Dermot.

Dermot McDonnell

ghow wrote: »

..I successfully unlocked my modem using firmware V100AAKL7C0.bin and had the modem back up and running in 15 minutes....

..I did it using a windows 8.1 tablet with ExtraPutty software (using the "xmodem 1k" menu option for sending the bootloader)..

Excellent work. If anybody does this on Windows, I would greatly appreciate some screen shots for inclusion in the guide.

Thanks again Dermot.

Happy to help! Let us know how it works out for you.

Bog Standard User

you'll be pleased to know eircom have launched a new fibre modem - F2000 - its a Hauwei Hg659B dual band wireless ac modem. its firmware has been tested considerably unlike the F1000 modem. im using one now have been for quite a while.

AngryDiMaria

Bog Standard User wrote: »

you'll be pleased to know eircom have launched a new fibre modem - F2000 - its a Hauwei Hg659B dual band wireless ac modem. its firmware has been tested considerably unlike the F1000 modem. im using one now have been for quite a while.

Eircom tech support told me they had a new router coming soon but they wouldn't say when! I would recommend sticking with the unlocked f1000, its a great upgrade from eircoms caveman efforts.

jca

Bog Standard User wrote: »

you'll be pleased to know eircom have launched a new fibre modem - F2000 - its a Hauwei Hg659B dual band wireless ac modem. its firmware has been tested considerably unlike the F1000 modem. im using one now have been for quite a while.

Have you any pics or links to the latest creation? The dual band would be a nice feature.

Bog Standard User

AngryDiMaria wrote: »

Eircom tech support told me they had a new router coming soon but they wouldn't say when! I would recommend sticking with the unlocked f1000, its a great upgrade from eircoms caveman efforts.

my f2000 is alot better than the f1000 unlocked or not. dual band wireless ac means really good wifi speeds on 5ghz.

also port forwarding actually works great now.

while mine is white, the production models are black and have the efibre logo on them and look similar to the f1000 but the led's are slightly different.

Eircom launched the F2000 last week.

here is what mine looks like

http://telecom.custhelp.com/euf/assets/images/ibase/modem/HG659/HG659b/hg659b-front-large.jpg

http://telecom.custhelp.com/euf/assets/images/ibase/modem/HG659/HG659b/hg659b-back-large.jpg

yuloni

This post has been deleted.

Bog Standard User

yuloni wrote: »

This post has been deleted.

i doubt they could give a damn

peewee3ie

I was on to eircom last week to get them to up the speed of my fiber and he asked was I and home and said no. Then he said "you will have to restart the modem when you get home as I cannot do it from here as you non eircom modem". My modem is unbranded, so I asked what do you mean "you can not restart it". He said "we can access modem from remote to help people out and also check to setting if your having problems".

I ended the call say "how dare you access or even try and access my modem without asking me" I then hung up.

I think Hauwei lock the branded firmware down so you cannot flash back to there firmware.

yuloni

This post has been deleted.

AngryDiMaria

Bog Standard User wrote: »

my f2000 is alot better than the f1000 unlocked or not. dual band wireless ac means really good wifi speeds on 5ghz.

also port forwarding actually works great now.

while mine is white, the production models are black and have the efibre logo on them and look similar to the f1000 but the led's are slightly different.

Eircom launched the F2000 last week.

here is what mine looks like

My port forwarding on the f1000 is excellent since I unlocked it and WiFi is perfect with no reboots required at all. I also get 60 meg on my crappy chinese phone in the worst blackspot in my home thanks to a WiFi extender, eircom just lost again!

dxhound2005

Dermot McDonnell wrote: »

Eircom are currently several firmware versions behind ZyXel for the F1000. The current beta release from ZyXel UK includes a fix for port forwarding bugs, in particular where a resync takes out the applied rules.

For those who are interested, and understand the risk that you may kill your F1000, I attach a full log of an F1000 unlock followed by flashing both the ZyXel bootloader and the latest firmware. Commands are in blue, comments in red in the PDF.

You will need a phillips screwdriver, a USB-TTL serial cable, communications software that supports serial and xModem protocols, but no soldering skills as the board comes with a serial header.


I do not encourage anyone to do this, I simply pass on the know how to those who wish to do it. You know who you are

NB: Do NOT use the Vcc connector on the header. Serial is 115200baud, 8bits, no parity.

Just going back to the start, what is the reason that Eircom do not offer the latest firmware? I have read parts of the thread from time to time but I can't remember seeing that explained. Apologies in advance if I missed it.

jca

Bog Standard User wrote: »

my f2000 is alot better than the f1000 unlocked or not. dual band wireless ac means really good wifi speeds on 5ghz.

also port forwarding actually works great now.

while mine is white, the production models are black and have the efibre logo on them and look similar to the f1000 but the led's are slightly different.

Eircom launched the F2000 last week.

here is what mine looks like

http://telecom.custhelp.com/euf/assets/images/ibase/modem/HG659/HG659b/hg659b-front-large.jpg

http://telecom.custhelp.com/euf/assets/images/ibase/modem/HG659/HG659b/hg659b-back-large.jpg

Only one USB port.. Does the USB port work as a print or media server? I'm delighted with my unlocked F1000 tbh.

Paul Thomas Rowland

Bog Standard User wrote: »

you'll be pleased to know eircom have launched a new fibre modem - F2000 - its a Hauwei Hg659B dual band wireless ac modem. its firmware has been tested considerably unlike the F1000 modem. im using one now have been for quite a while.

Yeah, right. Bogman is first person in the country to have Eircoms newest router. This thread is about the F1000, Bogman, if you ever have anything to contribute, why dont you start your own thread on how to unlock the HG659B.

Readers of this thread should note that Bogman is a well known attention seeker who likes to pretend he has some router expertise. His previous claims include:

Bog Standard User wrote: »

bad idea

the f1000 has only half the hardware the retail version has, the firmware for the retail version will brick your f1000

eircom had lots of the good bits removed to make it cheaper to mass produce

f1000 is not the same as the retail version zyxel offer

hardware in it is different

trust me i have done extensive testing and bug fixing for the f1000. it is not the same modem as the retail zyxel offering

the only similarity is the casing

Bog Standard User wrote: »

the modem is not locked down by eircom.

you can change any setting you like. even had a customer change the default dns server on his modem to use his own linux machine for dns by editing a firmware bin file then uploading it to the modem. not for the faint hearted to go editing bin files but it can be done.

there are many isps using the same modem as the f1000 but just call it different names. the retail full price modem is not the same it also has 2 antennae

the reason why the wifi sucks on the f1000 is down to the single crap antenna. changing the firmware wont change that.

F1000 bugs Bogman has personally fixed during his lengthy career with Eircom - I kid you not, these are his claims:

Bog Standard User wrote: »

bugs fixed

1. ipv6 with mac osx 10.6.8 or older freezing bug fixed in 1.00(aaha.3)do
2. wifi isolation bug + iptv qos bug fixed in 1.00(aaha.4)do
3. dns proxy bug fixed in 1.00(aaha.4)do_20140623

bugs + workarounds still to be patched into a firmware update

1. admin password change on log in because "enable local access variable remains set to false bug - workaround reset modem then log into modem skip password change offer then go to maintenance > users and change it there ensure enable local access is ticked

2. restore config file fails when port forward rules are created bug - works with chrome fails on any other browsers

My retort to Bogman's nonsense:

Paul Thomas Rowland wrote: »

..
Why should I trust you? You have your own agenda clearly. Almost everything you have written here is untrue.

1. You mistake the F1000 for the wrong ZyXel device. The F1000 never had 5Ghz wifi.
2. Three wifi antennae are CLEARLY visible in the F1000 picture you posted, which you lifted from the TJWorld site. Do you know what a wifi antenna looks like?
3. The F1000 is locked by Eircom. You cannot flash any firmware but Eircoms unless you unlock it. Once you install the OEM retail firmware, you get VOIP, a much better sync rate and additional options in maintenance menu.
4. Installing the retail firmware will not brick your F1000. Can you point to a single incident of a bricked F1000 as a result of a firmware flash that can be independently verified?
5. Why would your customer need to hexedit a firmware to change the default DNS server on an unlocked router? He might have to do that on a locked router.
6. F1000 firmwares are both digitally signed and checksummed. Once you edit it in any way, it is rejected as an illegal image by the GUI and bootloader. You can test that yourself - I have.
7. You claim to have made bug fixes which do not exist in any available firmware and for which I can find no bug reports. Why not just read the readily available firmware release notes from ZyXel and claim you fixed those bugs also. Is you name Cj Lai? That person in named as maintainer in the most recent notes I have seen.

You clearly do not know what you are talking about.

I am getting really fed up with self proclaimed experts who are nothing but sad fools in need of lengthy sessions with a competent psychiatrist.

jspuds

Want to add my thanks as well, I bridged my unlocked F1000 over the weekend and I'm delighted with the setup now.
Have the full benefit of a bridged setup and can still access the DSL stats on my F1000.

I followed this guide http://www.kitz.co.uk/routers/zyxel_VMG8324-B10A_bridge.htm as posted previously. One thing though I had to setup the Interface Group PTM Type differently than in the guide. I set it up as eth3G/eth3G in case anybody else has the same difficulty.