Anime4000 you may read link he use ATA how possible working i don't know
https://forum.lowyat.net/index.php?showtopi...ost&p=111577187

it appears he on FHTT OLT, which Vendor didn't put any limit and push all VLAN to 0x0101 lazily, thus it work without changing anything with the stick firmware

the FHTT uses GPON CTC standard,

other OLT Vendor are not

oh yea tng55 about VoIP

actually very simple, just play with route, any router can do this

VoIP to WAN Group (WAN Group NAT masquerade)

VoIP (Seremban):
IP Address: 10.198.88.75/19
Gateway 10.198.95.254

Route:
10.255.0.1 via 10.198.95.254

I have been testing it's stability using MicroSIP:


for non FHTT OLT, need spoof VLAN400 MAC Address using MACVLAN and spoof few DHCP Option 12 and 61

I just don't make article yet, since busy to porting Unifi PPTP to VEIP, since TM using AIO ONU now, slowly dropping PPTP ME Point 0x0101 stuff to 0x0e01, since VEIP OMCI Type is 48 has no define Ethernet Speed, which good for 2Gbps

as me under ALCL OLT, somehow VLAN 500 exist on VEIP, so I ask them, dropping legacy PPTP slowly, haha

This post has been edited by Anime4000: May 3 2025, 04:42 AM

ohh FHTT OLT = fiberhome right

you under ALCL OLT = Nokia

i am not sure my area under huawei or not i am using old BTU Huawei TM LOGO White color

Well, you need use NIJIKA GPON Stick can know a lot of detail, I put nice WebGUI to monitor as per TM requirements

need wait offering 2GBPS i will buy you GPON Stick

someone 500Mbps RM90 lol mine 500Mbps RM119 was free bill 6 month

i hope tm will offer RM1xx for 2GBPS hopefully

wow, RM90 just for 500Mbps is really great deal!!!
I wish my 2Gbps price to come down too!

you may read link https://forum.lowyat.net/index.php?showtopi...ost&p=111514935

https://forum.lowyat.net/index.php?showtopi...#entry111576374


crazy man RM90 just 500Mbps

i waiting 2GBPS RM1xx i will catch process upgrade
my contract will end November 2025 that since SWU 3.0 activated 07 November 2023

For now, 2Gbps and 1Gbps (Ultra Customer) has nice QoS scheduler which 95% bandwidth priority, this what make ultra plan pricey
if fight with Ultra vs non-Ultra, the Ultra will win the bandwidth and favor, that's what TM guy told me

thus, I modifying both NijikaRTL and NijikaWRT to spawn a lot of T-CONT for download and upload


for Download, I will open two T-CONT per ME Point, (Type 47 x 2) [1Gb + 1Gb]

for Upload, little special, I spawn 16 T-CONT from usual 4 or 8, because ALCL, HWTC and ZTEG OLT support Type 249 (Symmetrical GPON, indicate XGSPON card installed but not active yet)

with a lot more T-CONT, can fight bandwidth with non-Ultra

This post has been edited by Anime4000: May 4 2025, 12:46 AM

Great job! But I suspect only modifying the UL T-CONT is needed

DL is controlled by DBA profile anyways

in deed, the download dont use ME 262, but the ME 278 is required

When I create single ME 278 downstream, it really give ~1Gbps despite 2500 links
This is reasons other like Allo, TIME (GPON) and other ISP only 1Gbps symmetrical, as per ITU-T G.988

Thus, I need create another ME 278 downstream, for 1Gbps + 1Gbps!
This actually CTC Standard that TM follow, can say a hack of G.988

I have verified few TM ONU has this ME 65529 and 65530:
Huawei HG8240H and HG8420H5:


Hex code for 43544300 is "CTC\0"

Nokia ONT, D-Link, Skyworth all TM ONU using CTC Standard

This has been fact check with TM 'friend', TM want cheap deployment now xD

that me using Huawei HG8240H TM LOGO White color BTU

wow, can you access WebGUI and download the XML file? and edit to enable telnet or ssh like this
https://github.com/Anime4000/Hacking_Huawei_HG8240H5_ONT

if you managed login ssh/telnet, do this:
omcicmd mib show meid 131

this tell what OLT are you on

try login WebGUI while fiber is connected

i already pm you

Is it possible to do the same for ZTE F620 ONU? I can login the web GUI though.
But cannot decrypt the ploam password.

check reply

I don't have the ONU, I think you still can get the PLOAM Password by F12 (Web Dev)

If I remember correctly, ZTE ONT display PLOAM Password in plain text

I have the ZTE F620
Hardware Version: V7.0
Software Version: V9.0.10P4N2
Boot Version: V9.0.10P4N2

It is not possible to view password from WebUI. The web app never send the password back for display.
I also don't have the DefAESCBCIV to decrypt the backup config and don't have the equipment to dump the firmware from the board. It uses none of the leaked or known key, at least not those I found.

However, if you just want to check which OLT you are using, you can use the MAC address as proxy:
Go to "Management & Diagnostic" on the top.
Click "Diagnostic" on the left pane.
Click the arrow on the top pane to scroll all the way to the right.
Click "MAC Table"

One of the "Bridge_Default" is the OLT port MAC address.
Just lookup the MAC address for manufacturer name.

EDIT:
You can give this tool a go and see if it works for your ONU:
https://github.com/douniwan5788/zte_modem_tools

I roughly went thru the code for zte_factroymode.py. No malware, no fishy encoding, no backdoor.
Third party library in requirements.txt looks safe too.
But still no warranty. Use at your own risk.

This post has been edited by kwss: May 5 2025, 01:50 AM

hi, sorry to interrupt, can i know what is the purpose of you guys doing this? i meant all the hacking... to get ploam password or voip password? All the passwords can easily get from during TM installation. i meant all those useful info like LOID, Poam/SN, voip user and password etc.

I got both old BTU extra siting in store room, almost want to throw already.



If the purpose is to get some settings to push to 2Gbps, then normal combo also can get easily max speed as long as NIC card, switch, PC is correct.



This post has been edited by mhwee: May 5 2025, 03:10 PM

Same reason why people look at the sky and want to become astronaut.
Same reason for the existence of NASA and CERN.

It's fine if you are not an explorer. Just the same as not everyone is interested to know how their aircond works.

Why even bother to know the password when you can just call TM to fix it for you? Knowing the password don't get you higher speed.

We making our patches on this Lantiq Stick


Since last release was 2023-10-20, so we fork it and make our own patches, ofc I add Unifi ME


the 'omcid' handle the OLT ONT communication, a lot of stuff there when open in Ghidra, there are dormant proprietary ME, we tried enable it cause 'omcid' crash when contact HWTC OLT haha

there are two MIB for PPTP and VEIP, so far PPTP connect to OLT quite fast, meanwhile VEIP take time for ALCL OLT to accept

this NijikaWRT come with a lot of T-CONT Upstream, hope fix issue with stupid OLT like FHTT

This post has been edited by Anime4000: May 6 2025, 01:37 AM