Also known as: O2 DSL Surf & Phone

$RAM Section:
  0: BootExt(RAMBOOT), start=94014000, len=18000
  1: HTPCode(RAMCODE), start=9402c000, len=D4001
  2: RasCode(RAMCODE), start=9402c000, len=FD4000
$ROM Section:
  3: BootBas(ROMIMG), start=b0000000, len=10000
  4: DbgArea(ROMIMG), start=b0010000, len=10000
  5: RomDir2(ROMDIR), start=b0020000, len=20000
  6: BootExt(ROMIMG), start=b0040030, len=17FD0
  7: HTPCode(ROMBIN), start=b0058000, len=F000
          (Compressed)
          Version: HTP V1.05, start: b0058030
          Length: 29B5C, Checksum: B313
          Compressed Length: D9E8, Checksum: 671B
  8: MemMapT(ROMMAP), start=b0067000, len=C00
  9: termcap(ROMIMG), start=b0067c00, len=400
 10: tiadsl(ROMBIN), start=b0068000, len=35000
          (Compressed)
          Version: ADSL ATU-R, start: b0068030
          Length: 5B802, Checksum: 89E9
          Compressed Length: 34C7A, Checksum: A6BA
 11: tiwlan(ROMBIN), start=b009d000, len=14C00
          (Compressed)
          Version: WLAN, start: b009d030
          Length: 14B50, Checksum: 4661
          Compressed Length: E1A2, Checksum: ED5C
 12: DSPCode(ROMBIN), start=b00b1c00, len=30000
          (Compressed)
          Version: DSP IMAGE, start: b00b1c30
          Length: 3FD38, Checksum: D8BD
          Compressed Length: 2A336, Checksum: FB1D
 13: RomDefa(ROMIMG), start=b00e1c00, len=20000
 14: TR69Cert(ROMBIN), start=b0101c00, len=2000
          (Compressed)
          Version: TR69Cert, start: b0101c30
          Length: 5A2, Checksum: 9797
          Compressed Length: 418, Checksum: CB80
 15: ivrsys(ROMBIN), start=b0103c00, len=10000
        signature error!
 16: RasCode(ROMBIN), start=b0113c00, len=2DC400
          (Compressed)
          Version: DSL Surf & Phon, start: b0113c30
          Length: C31F0C, Checksum: 39C0
          Compressed Length: 28D955, Checksum: 37CA
 17: EeProm(ROMIMG), start=b03f0000, len=10000                                                                               
 18: Reserved(ROMIMG), start=b0400000, len=10000

Example command for serial connection:

screen /dev/ttyUSB0 9600

Bootup looks like this:

Bootbase Version: V1.09 | 07/29/2004 16:00:00 
RAM: Size = 32768 Kbytes 
DRAM POST: Testing: 32768K 
OK 
FLASH: AMD 32M *1 
 
 ZyNOS Version: V3.40(ADF.1) | 07/12/2005 18:00:00 
 
Press any key to enter debug mode within 3 seconds. 
...............

Typing ATSH for manufacturer related information:

ATSH
NOS Version            : V3.40(AOF.2)D0 | 18.01.2008 17:32:30
Bootbase Version       : V1.07 | 7/31/2006 18:30:00
Vendor Name            : O2
Product Model          : DSL Surf & Phone
NOS ROM address        : b0040000
System Type            : 7
MAC Address            : 000000000000
Default Country Code   : ED
Boot Module Debug Flag : 00
RomFile Version        : B9
RomFile Checksum       : 4613
NOS Checksum           : ed12
Core Checksum          : 37ca
SNMP MIB level & OID   : 060102030405060708091011121314151617181920
Main Feature Bits      : C0                                        
Other Feature Bits     :
          00 77 00 00 00 00 00 00-00 00 00 00 00 00 00 00   
          00 00 00 00 00 00 00 00-04 41 13 00 00 00           
 
OK

You can use the MAC Address to determine the password, which is necessary for enabling advanced features/commands. The last digit of your MAC matches one password in the table below:

...0 or ...8 10F0A563 
...1 or ...9 887852B1 
...2 or ...A C43C2958 
...3 or ...B 621E14AC 
...4 or ...C 310F0A56 
...5 or ...D 1887852B 
...6 or ...E 8C43C295 
...7 or ... F C621E14A 

Then enter the following command:

ATEN1,<PASSWORD>

Now, the help command ATHE displays all available commands. Refer to the Zyxel UClinux documentation (see references) for detailed explaination.

Unfortunately I'm not able to flash an generic OpenWRT-image, which could work on this device due to firmware signature checks :(

• IP-Phone-Forum thread about unbranding, also containing firmware backups (German)
• Zyxel Uclinux documentation (infos about debug console, debug password, etc.)
• PDF explaining debug mode
• OpenWRT wiki article about similar ZyXEL model, instructions on how to flash OpenWRT
• Forum thread about this router