[Gelöst] eva_to_memory failing for 7530

[gedia]

Hello all,

I've been trying to convert a German Fritzbox 7530 to international, but uploading the in-memory image seems to fail using eva_to_memory. More specifically, the process seems to start successfully:

~/avm/YourFritz/eva_tools $ ./eva_to_memory 7530_07.02.en_20181104-031602.image.in-memory 192.168.178.1
Found AVM bootloader: AVM EVA Version 1.3540 0x0 0x46409
Found hardware revision: 236
Memory size is 0x10000000 (256 MB)
Memory size limited to 128 MB
Image size is 0x1673d00 (22 MB)
Setting temporary memory size to: 0x0698c300
Setting temporary kernel args to: mtdram1=0x8698c300,0x88000000

But i hangs at "Setting temporary kernel args". The fritzbox the reboots and loads the original firmware.

Are there any known workarounds? Is bootloader 1.3540 different and won't allow loading unsigned images? Thanks.

P.S. I'm using latest Yourfritz git master and the image was prepared using latest freetz git master (fwmod unpack, edit, then fwmod pack - freetz was configured for 7530 with in-memory image creation option enabled)

 

[PeterPawn]

The used KSEG1 addresses are a little bit special for MIPS processors (the first two bits of an address are used to "classify" it) ... maybe it works, if you set the "startaddress" in line 33 to zero. If it does not work, I need a packet dump of the network activities (recorded with Wireshark and a proper recording filter) from AVM's recovery program on this box, to search for the correct values myself ... or you may find the correct values (and share them with us here) yourself.

 

[gedia]

Thanks for the reply! I've made the capture using the recovery tool under wine, which failed, but I believe the initial steps in the ftp transfer are included in the capture file.

One thing I noticed is the use of the "STOR mtdnand" command instead of mtdram. Could this be related? Or is it a load-to-memory vs. load to flash thing?

I've shared the pcap with cloudshark: https://www.cloudshark.org/captures/9c93fe92a5ed

Also, editing the startaddress to "startaddress = 0x00000000" did not seem to work ...

 

[PeterPawn]

No, "mtdnand" is the target for the (mainly empty) configuration settings (aka TFFS image) and has nothing in common with the installed OS.

Your dump is far too short ... it contains the reading of environment values and counters and the writing of the new TFFS image (which is built from the read values) - but I'm missing the part, where the new image is loaded into RAM.

This step will follow after storing the new (and empty) settings - because the new image gets started immediately after a successful transfer.

I've not really an idea, whether you've cut the wrong dialog or if this model is really, really different than others ... but I'd bet, that there's another (TCP) "dialog" with the right upload.

 

[gedia]

Hello again,

I was a little quick to assume success the last time. I repeated the recovery process on a Windows machine this time. Here's the resulting pcap:

https://www.cloudshark.org/captures/395f72f90136

Thanks again for taking the time to review this!

BR,
George

### Zusammenführung Doppelpost by stoney ###

Is this the one, by any chance?

STOR 0x8eb33400 0x90000000

 

[PeterPawn]

Yes, it's the required STOR command.

It looks like this box has 256 MB of RAM, starting at 0x80000000 and ending at 0x90000000 - the MIPS models used only the first 128 MB here, even if they had more. That's the reason, why the used memory was limited in "eva_to_,memory".

You may try it once again with a call like this

eva_to_memory <filename> <ip_address> 0

The third parameter (which defaults to "1", while you need a "0" here) blocks the memory limitation and the upload should use all of the available 256 MB of RAM, resulting in an upper limit of 0x90000000 (the start address has to stay on 0x80000000, reverse any own changes here), as shown in your packet dump.

If the device has only 128 MB of memory, set the "startaddress" value to 0x88000000 instead, to reach the 0x90000000 as upper limit.

 

[gedia]

Yes! This worked! Thanks so much!

 

[prisrak1]

mit welchen Befehlen kann man per FTP manuel eine ." *.image.in-memory" flashen? z.B. wenn die Box schon im Bootloader gefangen wurde.

wenn ich im Bootloader die Ram-inhalte manuel beschreiben möchte
z.B. so: MEDIA SDRAM..
zuvor MEDIA FLSH, PASV; TYPE 1.

 

[NDiIPP]

Folgend wurde mal dem Recovery-Tool von AVM (quasi als Referenz) für eine 7530 beim letzten Schritt (also hochladen des Firmware-Images in den RAM) "zugesehen":

220 ADAM2 FTP Server ready
USER adam2
331 Password required for adam2
PASS adam2
230 User adam2 successfully logged in
SYST
215 AVM EVA Version 1.10211 0x0 0x46409
SETENV memsize 0xeb33400
200 SETENV command successful
SETENV kernel_args_tmp mtdram1=0x8eb33400,0x90000000
200 SETENV command successful
TYPE I
200 Type set to BINARY
MEDIA SDRAM
200 Media set to MEDIA_SDRAM
P@SW
227 Entering Passive Mode (169,254,19,1,12,0)
STOR 0x8eb33400 0x90000000
150 Opening BINARY data connection
226 Transfer complete

 

[PeterPawn]

Gar nicht ... die wird nämlich nur ins RAM geladen und dort gestartet. In den Flash schreibt sie sich selbst ... das ist dann das, was landläufig als "Flashen" bekannt ist.

Die Abläufe beim Laden eines solchen Images ins RAM habe ich erst vor kurzem (irgendwann in diesem Jahr würde ich sagen (aber ohne Garantie) und ich habe noch nicht wirklich viel geschrieben in diesem Zeitraum) noch einmal erklärt - die konkreten Kommandos kann man sich selbst in einer meiner Skript-Dateien ansehen oder in einem (alten) Protokoll so einer Aktion nachlesen. Solche Protokolle stehen ab und an auch mal in irgendwelchen IPPF-Beiträgen (oder auch in meinen Anleitungen), wenn jemand Probleme hatte und z.B. ein falsches Image laden wollte - die Kommandos dabei sind aber natürlich dieselben und die Speicheradressen muß man ohnehin konkret für das eigene Image berechnen, wenn man das von Hand selbst im FTP-Dialog ausführen wollte.

War leichter zu finden, als ich zunächst dachte: https://www.ip-phone-forum.de/threa...d-7590-flashen-stand-2019.305468/post-2352710

 

[prisrak1]

den
.\EVA-FTP-Client.ps1, ./eva_to_memory..
hab mir schon angesehen, deshalb frag ich auch, weils noch nicht ganz klar ist. Der Ablauf ist bei mir eben auf die FB 7590 focussiert. Noch bin ich am Durchwälzen des geschriebenes...