FB WLAN 7050 - Dead

[gaurav]

Hi,

Sorry, I don't speak German and hope that somebody will be able to help me. I have a FB WLAN 7050 on which the info light stays on all the time. Connecting to the FB via a console, I noticed that the FB is getting stuck after a message:

change 'mtd4' to 0x903E0000,0x90400000

Below is the complete boot log:
ADAM2 Revision TI:0.18.01 AVM: Version:97
(C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved.
(C) Copyright 2003 Telogy Networks, Inc.
(C) Copyright 2003-2004 AVM
change 'mtd0' to 0x900C0000,0x903C0000
change 'mtd1' to 0x90010000,0x900C0000
change 'mtd2' to 0x90000000,0x90010000
change 'mtd3' to 0x903C0000,0x903E0000
change 'mtd4' to 0x903E0000,0x90400000

Can anybody please help me with getting out of this error?

Thanks,
- Gaurav

 

[haveaniceday]

Hi Gaurav,

What did you do with the box before this happened ?

Can you interrupt the boot procedure with any key and get a prompt ?

Haveaniceday

 

[gaurav]

Hi Haveaniceday,

I did the following:
$ touch empty

ftp into FB

bin
quote MEDIA FLSH
put empty "0x0 mtd3"
put empty "0x0 mtd4"
quote REBOOT

The info light on the box stayed on and the box did not boot up. Was not able to get it into recovery mode either.

Connecting to the fritz box via a serial console, gave the following and the
router was hung:

ADAM2 Revision TI:0.18.01 AVM: Version:97
(C) Copyright 1996-2003 Texas Instruments Inc. All Rights Reserved.
(C) Copyright 2003 Telogy Networks, Inc.
(C) Copyright 2003-2004 AVM
change 'mtd0' to 0x900C0000,0x903C0000
change 'mtd1' to 0x90010000,0x900C0000
change 'mtd2' to 0x90000000,0x90010000
change 'mtd3' to 0x903C0000,0x903E0000
change 'mtd4' to 0x903E0000,0x90400000

Why did I clear the configuration in mtd3 and mtd4? Because I was getting a 404 NOT FOUND error when trying to access the FB web page.

How I got to this stage?

I can't understand German and I thought it might be possible to change the html files and eventually change the text on the screen so I put in the telnet image, logged into the box via telnet and followed (I guess not properly) http://www.wehavemorefun.de/fritzbox/Hilfsprogramme_/_Tipps_&_Tricks#Firmware_wieder_herstellen

I wanted to mount /usr/www/html in read-write mode. In the whole process, I rebooted the fritzbox and landed into the situation which gives me 404 error.

I am sure if I open a ticket with AVM, they will ask me politely to get lost.

Thanks,
- Gaurav

Edit: I tried different keys to interrupt the boot process but I am unable to get the prompt.

 

[HfX]

Recover should be possible - email with AVM for necessary tools

Hi Gaurav,

you should contact AVM via Mail (use their contact form on their page)
http://www.avm.de/de/Service/Support/index.php

You only need some clicks to reach the contact form.

Ask them for a recovery utility for your fritzbox model.
They have an application you can start that will:

- active the network card to "always active"
- searches for your restarted Fritzbox
- stops the FritzBox Boot Process
- recovers the box
- resets the network card to standard

This software is only available through AVM Support.

If your Box has no hardware damage this is the official and
working way to recover!

Best regards

Peter

 

[gaurav]

Hi Peter,

The box came with a CD, which has the recovery util. I tried that as well as the recovery.pl util from Enrik but none of them work as they don't see the FB at 192.168.100.2 (this was my_ipaddress in my env by default). I can't ftp to the box either.

Regards,
- Gaurav

 

[JSchling]

I had some problems with my Fritzbox some days ago and played with FTP. The information I found was:
mtd0: squash fs image ("filesystem.image")
mtd1: kernel zimage ("kernel.image")
mtd2: ADAM2 ("urlader")
mtd3: environment?
mtd4: config (TTFS)?
I was able to write MTD0 and MTD1 via FTP. The files are included in a normal image-file for the Fritzbox but MTD3 and MTD4 are only included in the recovery executable file from AVM.
If you have safed your MTD3 and MTD4 you should be able to install it on the box via FTP. If you can still reach the box via telent connection to ADAM2 you should also be able to connect to the box using FTP. Both "options" are included in MTD2 what should not be damaged.
I found this "manual" how to move files to the box using FTP:
$ ftp 192.168.178.1
Connected to 192.168.178.1.
220 ADAM2 FTP Server ready.
Name (192.168.178.1:enrik): adam2
331 Password required for adam2.
Password: adam2
230 User adam2 successfully logged in.
Remote system type is UNIX.
ftp> debug
Debugging on (debug=1).
ftp> bin
---> TYPE I
200 Type set to I.
ftp> quote MEDIA FLSH
---> MEDIA FLSH
200 Media set to FLSH.
ftp> put kernel.image "kernel.image mtd1"
local: kernel.image remote: kernel.image mtd1
---> PORT 192,168,178,20,128,67
200 Port command successful.
---> STOR kernel.image mtd1
150 Opening BINARY mode data connection for file transfer.
226 Transfer complete.
655368 bytes sent in 5.96 secs (107.4 kB/s)
ftp> quote REBOOT
---> REBOOT
221-Thank you for using the FTP service on ADAM2.
221 Goodbye.
ftp> quit
---> QUIT
I used the command
put c:\Path\filesystem.image "filesystem.image mtd0"
MTD1 and MTD0 can be extracted from a normal AVM-image file using Winrar but I was not able to open an executable recovery-image with Winzip
You should be able to get a recovery image directly from AVM. Otherwise you can contact me again (private message), I can also sent you a recovery image for the 7050, I think its image version 85

The default IP address of the box should be 192.168.178.2 - thats the ip the recovery tool is searching and at the end that was the ip my box had after it was not starting up.
At least you should be able to establish a telnet connection via ADAM2 and it might be neccessary to specify the IP of the box (also from this manual, I used Ip 192.168.178.2):

$ telnet 192.168.178.1 21
Trying 192.168.178.1...
Connected to 192.168.178.1
Escape character is '^]'.
220 ADAM2 FTP Server ready.
USER adam2
331 Password required for adam2.
PASS adam2
230 User adam2 successfully logged in.
SETENV my_ipaddress,192.168.128.28
200 SETENV command successful
GETENV 192.168.128.28
my_ipaddress 192.168.128.28

200 GETENV command successful
REBOOT
221-Thank you for using the FTP service on ADAM2.
221 Goodbye.
Connection closed by foreign host.

 

[HfX]

Hi Peter,

The box came with a CD, which has the recovery util. I tried that as well as the recovery.pl util from Enrik but none of them work as they don't see the FB at 192.168.100.2 (this was my_ipaddress in my env by default). I can't ftp to the box either.

Regards,
- Gaurav

I read in another post that a user found his box with Ip 169.x.x.x I don't know that much about the box, but is it possible, that your box maybe needs a working DHCP in the network to get an IP?
Maybe you can monitor network traffic when you connect your box to your local network and find out the IP.
I think other guys here with more knowledge about recovering a box can help you in a step by step guide?

Best regards

Peter

 

[gaurav]

Thanks. But currently IP is not an option that I have. If the box was accessible over ftp or booted properly into the console, I would have (hopefully) managed to fix it.

What I can't understand is how would earsing mtd3 and mtd4 partitions corrupt the boot loader?

Regards,
- Gaurav

 

[haveaniceday]

Hi Gaurav,

Your problem is the following:
- bootloader starts
- bootloader tries to read "double buffered environment" from mtd3 + mtd4
- => nothing found
- => boot aborted.

Regular boot order:
- boot loader adam2 starts
- read env settings from "mtd3/mtd4"
- if not confused by "env" => boot kernel from mtd1 + filesystem from mtd0

The bootloader itself does not contain box specific configurations. So for multiple box types the bootloader is the same.

So the following will work:
- put proper settings to the environment. ( e.g. get mtd3 from another 7050)
- or enter basic settings via SETENV ... .... for IP adress and HW revision, (+ ?)
=> basic IP connection will work...
+ use the "all inclusive" recovery tool from AVM for a 7050.

recover.exe to recover only the firmware will not help !

Best regards,

haveaniceday

PS: I might be offline for the rest of the day.

 

[gaurav]

Thanks for the detailed explaination, haveaniceday. Couple of things:

1) I assume I did a mistake of not setting the env variables after I did the "put empty" into mtd3 and mtd4.

2) The all inclusive recovery tool from AVM works over IP. right? My FB came with a CD, which has the following util in it.

FRITZ.Box_Fon_WLAN_7050.03.89.recover-image.exe

If I run this and I did this before I landed into the won't boot situation, I get the following error:

Auslesen der version gescheitert

which translates to: "Selections of the version failed"

3) If I am able to get the mtd3 from another 7050, how can I put it on mine?

Sorry, Too many questions...Thanks for all your help. This forum is awesome!

Regards,
- Gaurav

 

[JSchling]

I was also unable to use the recovery tool from AVM with the same message. In this case I believe you are able to use TCP/IP (telnet or FTP) to connect to the box, because with the error "Auslesen der version gescheitert" (unable to read version from box) I believe the recovery tool has a connection. But because all hardwareinformations stored in MTD3 is missing the recovery tool can not determan what type of box you have, as the box answers with nothing to the request.
I believe the recovery tool also shows the ip address it is using to connect to the box ?! however, I have installed a tool called Netlimiter, which is designed to configure maximum up and download seperatly for each program. Within this program you can see every process accessing network and it also shows the used IP, so you can see to which ip-address the recovery tool connects. My box used the ip 192.168.178.2 so you should not use this IP on your local computers, I use the IP 192.168.178.33 and had no problems to connect to the box.
In my case I had only a damaged ENV-file within MTD3 and the whole problem was completly fixed after using telnet on on adam2 and the command "SETEVN HWRevision,76" and "SETENV firmware_version,avm". I am not sure which information is required to run the recovery tool, but I think at least this one. Otherwise you can try tzo set some other options, when I start telnet on my 7050 it shows my:
HWRevision='76'
ANNEX='B'
ANNEX_PTEST_FILE='ptest-results-0'
ANNEX_PTEST_HOST='192.168.178.20'
ANNEX_TEST='0'
OEM='avm'
Language='de'
Country='049'
TZ='CET-1CEST,M3.5.0,M10.5.0'
CONFIG_AB_COUNT='3'
CONFIG_ANNEX='B'
CONFIG_ASSIST='y'
CONFIG_ATA='y'
CONFIG_ATA_FULL='n'
CONFIG_AUDIO='n'
CONFIG_BLUETOOTH='n'
CONFIG_BLUETOOTH_CTP='n'
CONFIG_BUTTON='n'
CONFIG_CAPI='y'
CONFIG_CAPI_MIPS='n'
CONFIG_CAPI_UBIK='y'
CONFIG_CAPI_XILINX='n'
CONFIG_CDROM='y'
CONFIG_CDROM_FALLBACK='n'
CONFIG_DECT='n'
CONFIG_DSL='y'
CONFIG_ETH_COUNT='2'
CONFIG_FIRMWARE_URL='http://www.avm.de/fritzbox-firmware-update.php?hardware=76
oem=avm&language=de&country='
CONFIG_FON='y'
CONFIG_HOMEI2C='n'
CONFIG_HOSTNAME='fritz.fonwlan.box'
CONFIG_I2C='n'
CONFIG_INSTALL_TYPE='ar7_ubik2_4MB_2eth_3ab_isdn_nt_te_pots_wlan_50494'
CONFIG_NFS='n'
CONFIG_OEM_DEFAULT='avm'
CONFIG_PRODUKT='Fritz_Box_7050'
CONFIG_PRODUKT_NAME='FRITZ!Box Fon WLAN 7050'
CONFIG_RAMSIZE='32'
CONFIG_ROMSIZE='4'
CONFIG_SERVICEPORTAL_URL='http://www.avm.de/fritzbox-service-portal.php?hardwar
=76&oem=avm&language=de&country='
CONFIG_STOREUSRCFG='y'
CONFIG_SUBVERSION=''
CONFIG_UBIK2='y'
CONFIG_USB='y'
CONFIG_USB_HOST_AVM='n'
CONFIG_USB_HOST_TI='n'
CONFIG_USB_PRINT_SERV='n'
CONFIG_USB_STORAGE='n'
CONFIG_USB_WLAN_AUTH='n'
CONFIG_VERSION='03.89'
CONFIG_VERSION_MAJOR='14'
CONFIG_VLYNQ0='1'
CONFIG_VLYNQ1='0'
CONFIG_VPN='n'
CONFIG_WLAN='y'
CONFIG_WLAN_WDS='n'
CONFIG_XILINX='n'
ermittle die aktuelle TTY
but I have no idea how to set the CONFIG values by telnet. Perhaps it is not really needed, and the recovery tool will run with configured hardware and oem version
I also expirienced that telnet is a little bid tricky. While there is "many time" to start an FTP connection to adam2, I was only able to access the box by telnet pressing return for the connect command directly after pluging in the box to mains

 

[haveaniceday]

The recover image sounds fine.

First, do not do misstyping ! Unplug power in case of problems.
( I do not know if backspace works or give some escape sequences )
Everything should be case sensitive !

I expect the following settings will make the recover work: ( Warning for others: Only valid for 7050 !, currently, might change for later firmware version, ask if you are in doubt, a beginner or ...)
.... as described above....
SETENV mtd0,0x900C0000,0x903C0000
SETENV mtd1,0x90010000,0x900C0000
SETENV mtd2,0x90000000,0x90010000
SETENV mtd3,0x903C0000,0x903E0000
SETENV mtd4,0x903E0000,0x90400000
SETENV HWRevision,76
SETENV firmware_version,avm
SETENV my_ipaddress,192.168.178.1
... Do not reboot.
Run your FRITZ.Box_Fon_WLAN_7050.03.89.recover-image.exe now.

1.) yes. ;-)
2.) HWRevision=76 is missing => recover does not find the right box
3.) put mtd3.image "mtd3.image mtd3"
Will create a mtd3.image on a box accessible via telnet: cat /dev/mtdblock/3 > /var/tmp/mtd3.image
But ! => will contain keys, Has to be a 7050 !

Yes, the forum is a little overloaded/unsorted...

Haveaniceday

 

[gaurav]

Hi JSchling,

Thanks for your response. One can use the SETENV command to configure most of the environment variables either via a serial console or via the telnet to ftp port.

In my case, I had a connection to the FB over 192.168.100.2 rather than 192.168.178.2. Does not really matters as I have gone beyond that point and do not have telnet or serial console access.

BTW, I noticed you are using voipbuster. Are they good? I want to get an account with them once I have this issue sorted and looking for reviews.

Regards,
- Gaurav

 

[gaurav]

Haveaniceday,

Thanks for the reply. One basic problem Without access to the prompt how do I send the commands to the FB?

SETENV mtd0,0x900C0000,0x903C0000
SETENV mtd1,0x90010000,0x900C0000
SETENV mtd2,0x90000000,0x90010000
SETENV mtd3,0x903C0000,0x903E0000
SETENV mtd4,0x903E0000,0x90400000
SETENV HWRevision,76
SETENV firmware_version,avm
SETENV my_ipaddress,192.168.178.1

Thanks,
- Gaurav

 

[voipmustbe]

1) I assume I did a mistake of not setting the env variables after I did the "put empty" into mtd3 and mtd4.

2) The all inclusive recovery tool from AVM works over IP. right? My FB came with a CD, which has the following util in it.

FRITZ.Box_Fon_WLAN_7050.03.89.recover-image.exe

If I run this and I did this before I landed into the won't boot situation, I get the following error:

Auslesen der version gescheitert
- Gaurav

Hi,

Under some conditions (still access to box by ftp - Adam method - ) you can still revive your box easily. I did it some time ago used the tips here from the forum.

1. Download mtd3 and mtd4 from http://www.akk.org/~enrik/fbox/util/
2. Get access to the box by ftp then use these commands
debug
bin
quote MEDIA FLSH
put x:\mtd3 "file mtd3"
put x:\mtd4 "file mtd4", where x is the folder where the files are located
quote REBOOT
quit

It should work for you too.

 

[haveaniceday]

Can you interrupt the box at the serial console ?
If not try:
- set your PC to _fixed_ IP: 192.168.178.2
- type "ftp 192.168.178.1" but no enter
- power off/on for the box
- type enter at the ftp session, within 5 seconds after power on
( try multiple if you do not have success )

Should work.

You might use a boot cd with damned small linux of knoppix if you are not able to change the IP setting from e.g. your windows.
- ...boot linux
- su
- ifconfig eth0 192.168.178.2
- telnet 192.168.178.1 21

Haveaniceday

 

[haveaniceday]

1. Download mtd3 and mtd4 from http://www.akk.org/~enrik/fbox/util/

Should be wrong HWRevision for 7050 . Recovertool will be confused.

Haveaniceday

 

[gaurav]

I am unable to stop the boot sequence. I will give the suggestions a shot this evening. I use Linux on my laptop.

My colleague here has a FB WLAN 7050 (same as mine). I will get the mtd3 and mtd4 off his box.

Thanks...Will let you know how it goes.

Regards,
- Gaurav

 

[JSchling]

But the recovery tool still ends in this problem to "get hardware version" error ?
I think there is also an errormessage if no connection to the box is possible at all, your error seems "only" be related to empty MTD3 and the fact, that the box will not sent an answer to a hardware version check request.
Using Linux might help to get access easier, on Windows system you should disable firewalls, virusscanners and it might also be neccessary to disable auto-media-sensing for your LAN-card using Windows.
And you have to use the normal LAN-cable, USB and of course WLan is not an option.
As my box, normally configured to LAN IP 192.168.178.1 was using IP 192.168.178.2, I would suggest that you should try any other IP besite the *.2. I have no idea why my box uses the IP 192.168.178.2, I had never configured this number before but also the recovery tool starts searching for a box using this IP address.
Using adam2 access to telnet or ftp, the box is not responding to ping commands or any other requests, but as long as you have not ereased MTD2 the adam2 option should be available. On the other hand the message you saw, this "change 'mtd2' to 0x90000000,0x90010000" might have also damaged the MTD2 part of the box
Because I believe this 3 or 4 SETENV commands will not really be enough to get the recovery tool started (at least the Annex-version (by default B) should also be specified. I think the best you can do is to install a MTD3 and MTD4 from another 7050 box, I think this way will have the best chance

 

[gaurav]

I have not erased MTD2 for sure. The only two partitions that I erased were 3 and 4. I will be trying the Windows recovery tool later in the evening but yesterday, I was using the recovery.pl script from Enrik, which was unable to find a FB on the network. I also ran ethereal to check for traffic on the LAN interface but could not find anything coming from the FB.

My Fritzbox had a default IP for adam2 as 192.168.100.2, I configured my ethernet interface to 192.168.100.10 and also tried the same process with 192.168.178.x segment. I also tried accessing the FB on IP 192.168.178.1 and 192.168.178.254.

After I had connected the serial interface I noticed that the FB was not getting pass the

"change 'mtd4' to 0x903E0000,0x90400000"

The above makes me believe that boot process is being terminated some where in the loading of the ADAM2 bootloader.

- Gaurav