Vendor/Brand	Comtrend
Model	GRG-4284
ODM	Unknown
CPU	Realtek RTL9601D
DRAM	32 MB
Flash Size	16 MB
CPU Arch	MIPSBE Realtek Lexra
CPU Clock	300MHz
Bootloader	U-Boot RSDK 2011
System	Linux 3.10
Optics	SC/APC
IP address	192.168.1.1/24
Web Gui	✅
SSH	✅
Telnet	✅
FTP	✅
Serial	✅
Serial baud	115200
Serial encoding	8-N-1
Form Factor	ONT

Hardware Revisions

• V1.0

External/Internal Photo

Comtrend GRG-4284 PCB

List of software versions

• CTN-1.0.2b51 (Cetin)
• CTN-1.1.4b6 (Cetin)

Useful files and binaries

Useful files

• /var/config/lastgood.xml - Contains the user portion of the configuration

• /tmp/omcilog - OMCI messages logs (must be enabeled, see below)

Useful binaries

• flash - Used to manipulate the config files in a somewhat safe manner
• xmlconfig - Used for low-level manipulation of the XML config files. Called by flash
• nv - Used to manipulate nvram storage, including persistent config entries via nv setenv/nv getenv
• omcicli - Used to interact with the running OMCI daemon
• omci_app - The OMCI daemon
• diag - Used to run low-level diagnostics commands on the stick

GPON ONU status

Getting the operational status of the ONU

diag gpon get onu-state

Querying a particular OMCI ME

# omcicli mib get MIB_IDX

GPON/OMCI settings

Getting/Setting ONU GPON Serial Number

# flash get GPON_SN
GPON_SN=TMBB00000000
# flash set GPON_SN TMBB0A1B2C3D

Getting/Setting ONU GPON PLOAM password

Note

The PLOAM password can be saved in either ASCII or HEX format, without any 0x or separators

# flash get GPON_PLOAM_PASSWD
GPON_PLOAM_PASSWD=AAAAAAAAAA
# flash set GPON_PLOAM_PASSWD AAAAAAAAAA
# flash set GPON_PLOAM_PASSWD 41414141414141414141

Getting/Setting OMCI software version (ME 7)

# nv setenv sw_custom_version0 YOURFIRSTSWVER
# nv setenv sw_custom_version1 YOURSECONDSWVER

Getting/Setting OMCI hardware version (ME 256)

# flash get HW_HWVER
HW_HWVER=V2.0
# flash set HW_HWVER MYHWVERSION

Getting/Setting OMCI vendor ID (ME 256)

# flash get PON_VENDOR_ID  
PON_VENDOR_ID=ZTEG
# flash set PON_VENDOR_ID HWTC

Getting/Setting OMCI equipment ID (ME 257)

# flash get GPON_ONU_MODEL
GPON_ONU_MODEL=DFP-34X-2C2
# flash set GPON_ONU_MODEL DFP-34X-XXX

Getting/Setting OMCI OLT Mode and Fake OMCI

Configure how ONT Stick handle OMCI from OLT:

# flash get OMCI_OLT_MODE
OMCI_OLT_MODE=1
# flash set OMCI_OLT_MODE 2

Value	Note	OMCI Information
0	Default Mode	Stock setting, some values cannot be changed
1	Huawei OLT Mode	Huawei MA5671a
2	ZTE OLT Mode	ZTE
3	Customized Mode	Custom Software/Hardware Version, OMCC, etc...

Some vendors/wholesale providers/ISPs have explicit LAN Port Number provisioning or proprietary OMCI that the stick cannot understand, this will make the stick reply OK to whatever the OLT sends it via OMCI.

0 = Disable, 1 = Enable, Default is 0

# flash get OMCI_FAKE_OK
OMCI_FAKE_OK=0
# flash set OMCI_FAKE_OK 1

Advanced settings

Setting management IP

# flash get LAN_IP_ADDR
LAN_IP_ADDR=192.168.2.1
# flash set LAN_IP_ADDR 192.168.1.1

Getting/Setting the L2 Bridge MTU

Note

Settings given via diag are not permanent after reboot

Getting/Setting the MTU of the L2 bridge

# diag switch get max-pkt-len port all 
Port Speed 
---------- 
0 1538 
2 2031 
# diag switch set max-pkt-len port all length 2000

Checking the currently active image

# nv getenv sw_active
sw_active=1
# nv getenv sw_version0
sw_version0=V1_7_8_210412
# nv getenv sw_version1
sw_version1=V1_7_8_210412

Booting to a different image

# nv setenv sw_commit 0|1
# reboot

Unlocking full shell

Although the option to enter linux shell is displayed in help command, it silently fails until per-firmware password is provided.

This string is stored plaintext and hardcoded into /bin/cli and can be easily dumped.

# Example commands for firmware CTN-1.1.4b6
version --debug 23KcykMddk
factorymode --password y0S4QbPhAD96GYp
shell

Extracting and repacking the rootfs

Warning

Make sure you run both commands as root, otherwise you might get a damaged rootfs image

# unsquashfs mtd5.bin
# mksquashfs squashfs-root rootfs -b 131072 -comp lzma -no-recovery

Firmware patch

Simple change with a hex editor can be done to enable full shell, inside /lib/libmib.so, change /bin/cli to /bin/ash

Then add /bin/ash to /etc/shells to enable normal shell.

In case device contains locked default configuration /etc/config_default.xml can be modified to undo any unwanted restrictions.

Flashing new firmware

U-Boot has working network and commands provided to load kernel and rootfs over TFTP.

It's recommended you preserve old firmware with md.b, SPI base address and size can be found in env.

TFTP requested filenames:

• uImage - U-Boot OS Kernel image
• rootfs - SquashFS root

# Update image0
run upk;run upr;
# Update image1
run upk1;run upr1

Or from linux system

# tftp <IP>
tftp> mode octet
tftp> get rootfs.img /tmp/rootfs.new 
tftp> quit
# flash_eraseall /dev/mtd7
# cat /tmp/rootfs.new > /dev/mtd7

Miscellaneous Links

• Hacking RTL960x
• Modded firmware for GRG4284