Getting current Fritz!Box image from device?

[okrasz]

Hi,
I have Fritz!Box 7240 with modified firmware. I currently need to create a new image but I wanted to be able to switch back to current one in case something goes wrong. Unfortunately I've lost the current image so the only copy is running on the router.

Is there any way of getting the current image from the router?

Thank you,
Marcin

BTW.
Where can I download speed-to-fritz from? I used it to change language but now I cannot find anything else than VM on sourceforge.net.

 

[linuxkasten]

Hi, if reading German is not a problem for you, have a look at http://trac.freetz.org/wiki/help/howtos/development/save_mtd_1 and http://trac.freetz.org/wiki/help/howtos/development/save_mtd_2#AllgemeineInformationenzurDatensicherung.
Else: I will try to translate

 

[okrasz]

Thank you for the links. I don't know German enough to read such text, but Google Translate usually is enough to get the idea.

Thank you!

 

[linuxkasten]

Quick steps in english:
1. Switch Box off.
2. Switch Box on. Now there´s a ~4 seconds time window, where the bootloader listens for incoming ftp connections. You have to ftp 192.168.178.1 within that window (user/pw: adam2). Retry steps 1 and 2 several time until you get a connection (Tip: set computer´s ip to 192.168.178.5).
3. Now issue the neccessary commands to save mtd1 (firmware), mtd3/4 (settings), optionally mtd2 (bootloader).

 

[okrasz]

Seems I wasn't successful with any of the approaches. When I do

cat /dev/mtdblock2 > ...

I get just 128kB in result file, which is on my USB hard drive. I also tried dd instead of cat, but the result was exactly the same.

Then with the procedure with FTP I get "command not implemented", when I do get.

# ftp -n -p 192.168.178.1
Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
ftp> user adam2
331 Password required for adam2
Password: 
230 User adam2 successfully logged in
Remote system type is AVM.
ftp> debug
Debugging on (debug=1).
ftp> bin
---> TYPE I
200 Type set to BINARY
ftp> quote MEDIA FLSH
---> MEDIA FLSH
200 Media set to MEDIA_FLASH
ftp> get mtd1
local: mtd1 remote: mtd1
---> PASV
227 Entering Passive Mode (192,168,178,1,6,75)
---> RETR mtd1
502 Command not implemented
ftp> bye
---> QUIT

Any ideas what might be wrong?

Thank you,
Marcin

 

[RalfFriedl]

It seems that the newer bootloaders no longer support reading the firmware.

Try "cat /proc/partitions", mtdblock2 should be much larger then 128kB.

 

[linuxkasten]

Didn´t know about that.
Maybe just try to save all mtd(block)* and then compare the filesizes.

 

[okrasz]

I tried copying all /dev/mtdblock files and I think first 2 were 128kB, next 2 were 256kB and the later mtdblocks it was claiming that device does not exist.

I will try with partitions in the evening - I don't have access to the box now.

 

[Feuer-Fritz]

Maybe there is a chance to download everything with the ruKernelTool, look at the attached picture......

 

[linuxkasten]

I don´t think that this will work, but you could try to use /dev/mtd* instead of mtdblock.
If "n" is the mtd you want to read, use "mtd(2n+3)" as explained in the link above.

 

[RalfFriedl]

... download everything with the ruKernelTool

This also depends on the FTP-support in the firmware. This tools doesn't do some magic, it just makes it simpler then with an ftp client.

As this firmware doesn't support RETRieve for mtd, it won't work.

 

[Feuer-Fritz]

Which firmware is installed? There is no information about that.

 

[okrasz]

The firmware is 73.04.80freetz-1.1-stable, which was then converted from German to English with Speed To Fritz.

The output of partitions is as follows:

  31     0      14833 mtdblock0
  31     1        910 mtdblock1
  31     2        128 mtdblock2
  31     3        256 mtdblock3
  31     4        256 mtdblock4
  31     5       3200 mtdblock5

Is it possible that the image is actually on mtdblock0 or mtd0? As I understood the http://trac.freetz.org/wiki/help/howtos/development/save_mtd_1 the mtdblock0 was supposed to have infinite read and mtdblock2 was supposed to be image with kernel. But when I copied through dd or cat the mtd0 and mtdblock0 they have about 14.5MB (15189248 - mtd0 and 15188992 - mtdblock0) which was size of my image as I remember.

Is mtdblock0 the image? If yes, should I take mtdblock or mtd? Do I then simply use "push_firmware" script to get the image back?

Thank you,
Marcin

 

[RalfFriedl]

I vaguely remember that the infinite read might only affect the older kernels. You can try it, in the worst case you just reboot your box.

You have a strange layout, mine looks like this, from a W900V

  31     0       8192 mtdblock0
  31     1       6925 mtdblock1
  31     2       7616 mtdblock2
  31     3         64 mtdblock3
  31     4        256 mtdblock4
  31     5        256 mtdblock5
  31     6        192 mtdblock6
  31     7       7424 mtdblock7

Maybe someone with a 7270 or 7240 can show their partitions.

I would recommend to save all partitions, a few MB more won't matter.

You can examine the start of the partitions

# hexdump -C /dev/mtdblock1 | head -2
00000000  68 73 71 73 42 0a 00 00  00 00 00 00 00 00 00 00  |hsqsB...........|
00000010  00 00 00 00 00 00 00 00  00 00 00 00 03 00 4c 00  |..............L.|

But I'm not sure whether push_firmware will work with your flash layout.

 

[Chatty]

Helfe ja gerne (7270v2):

# cat /proc/partitions
major minor  #blocks  name

  31     0      14746 mtdblock0
  31     1        997 mtdblock1
  31     2        128 mtdblock2
  31     3        256 mtdblock3
  31     4        256 mtdblock4
  31     5       3200 mtdblock5
   7     0       4096 loop0

 

[okrasz]

OK. Thank you all for helping me. I have copied all the partitions and we will see what happens. In worst case I'll need to go back to original firmware and try with Freetz as long as I finally get the right new image

Thanks again!
Marcin

 

[RalfFriedl]

So that seems to be a normal layout for a 7240/7270.

From the sizes it is possible that mtdblock1 contains the kernel while mtdblock0 contains the filesystem.