Help in recovery FRITZ!Box 6842 LTE from Yota

[BucketBot]

Hi folks!

I have in my hands two very strange devices - Fritz! Box 6842 LTE branded by the Russian operator Yota.

These devices differ from the original Fritz! Box 6842 LTE by the presence of an Intel XMM7160 NGFF LTE-module instead of ALT6202-Q1 in original model.

Here's a part of bootlog:
---------------------
[21.016000] cdc_ncm: 14-Mar-2012
[21.116000] usb 1-1.1: MAC-Address: 00: 00: 11: 12: 13: 14
[21.116000] lte0: register 'cdc_ncm' at usb-platform-1.1, CDC NCM, 00: 00: 11: 12: 13: 14
[21.204000] usb 1-1.1: MAC-Address: 00: 00: 11: 12: 13: 16
[21.204000] lte1: register 'cdc_ncm' at usb-platform-1.1, CDC NCM, 00: 00: 11: 12: 13: 16
[21.212000] usb 1-1.1: MAC-Address: 00: 00: 11: 12: 13: 18
[21.216000] lte2: register 'cdc_ncm' at usb-platform-1.1, CDC NCM, 00: 00: 11: 12: 13: 18
[21.220000] usb 1-1.1: MAC-Address: 00: 00: 11: 12: 13: 1a
[21.220000] lte3: register 'cdc_ncm' at usb-platform-1.1, CDC NCM, 00: 00: 11: 12: 13: 1a
[21.224000] usbcore: registered new interface driver cdc_ncm
Jan 1 01:00:21 rpctrl [985]: NOTFOUND (lted)
Intel 7160 connected: / dev / ttyACM0
---------------------

The Yota operator refuses to send me the firmware, citing its absence.

One router is completely working for me. But the second, when loading the bootloader, gives an error <ERROR: FIRMWARE_ILLEGAL_CONFIG>

Here is the layout of the router's memory:

# cat / proc / mtd
dev: size erasesize name
mtd0: 00d94500 00010000 "rootfs"
mtd1: 0014bb00 00010000 "kernel"
mtd2: 00020000 00010000 "urlader"
mtd3: 00080000 00010000 "tffs (1)"
mtd4: 00080000 00010000 "tffs (2 ) "
mtd5: 01000000 00010000" reserved "

# cat / proc / partitions
major minor #blocks name

31 0 13851 mtdblock0
31 1 1380 mtdblock1
31 2 128 mtdblock2
31 3 512 mtdblock3
31 4 512 mtdblock4
31 5 16384 mtdblock5
7 0 284 loop0
254 0 8192 ramzswap0

# uname -a
Linux fritz.fonwlan.box 2.6.32.60 # 1 Fri Nov 22 13:33:34 CET 2013 with GNU / Linux

Here is the environment:

# cat / proc / sys / urlader / environment
HWRevision 207
HWSubRevision 2
ProductID Fritz_Box_HW207
SerialNumber 0000000000000000
annex Without
autoload yes
bootloader version 1.1967
bootserport tty0
cpufrequency 560000000
firstfreeaddress 0x810FD764
firmware_info 135.05.60
firmware_version avm
flashsize nor_size = 0x0 sflash_size = 16MB nand_size = 0MB
maca 08: 96: D7: 5E: 0C: 44
macb 08: 96: D7: 5E: 0C: 45
macwlan 08: 96: D7: 5E: 0C: 46
macdsl 08: 96: D7: 5E: 0C: 47
memsize 0x08000000
modetty0 38400, n, 8.1, hw
modetty1 38400, n, 8.1, hw
mtd0 0x9F000000,0x9F000000
mtd1 0x9F020000,0x9FF00000
mtd2 0x9F000000,0x9F020000
mtd3 0x9FF00000,0x9FF80000
mtd4 0x9FF80000,0xA0000000
my_ipaddress 192.168.178.1
prompt Eva_AVM
req_fullrate_freq 225000000
sysfrequency 225000000
boot version 2967
usb_board_mac 08: 96: D7: 5E: 0C: 48
usb_device_id 0x0000
usb_device_name USB DSL device
usb_manufacturer_name AVM
usb_revision_id 0x0000
usb_rndis_mac 08: 96: D7: 5E: 0C: 49
wlan_key 94022010865955952488

As a radical solution to the problem I tried burn using a programmer a backup copy of mtd5 (whole 16MB of the flashchip), downloaded via tftp from a working router, to the SPI flash memory chip (Winbond 25Q12835F) of a non-working router.

But when booting, the router still gives an error in the console <ERROR: FIRMWARE_ILLEGAL_CONFIG and stay in EVA.

Thanks a lot, Sergei
P.S. I apologize for the English, but I don't understand German at all. Thanks to google translator

 

[BucketBot]

Hi again!

When i replaced parameters in EVA with setenv command:

HWRevision 207 ---> to HWRevision 195

and run recovery from file fritz.box_6842_lte.06.34.recover-image.exe the router was successfully restored with official firmware for original 6842 LTE with interface in German and with support Altair LTE-modem.
After rebooting, the router started working without Intel XMM7160 LTE-modem support :-(

Then I have a second question. As if available kernel.image (mtd1) and rootfs.image (mtd0) from Yota (HWRevision 207) router how i can make firmware.image and flash router?

Thanks a lot!
P.S. From Russia with love

 

[BucketBot]

Hi again!
Attempts to make firmware.image from kernel.image (mtd1) and rootfs.image (mtd0) files was unsuccessful.

So I read the flash memory from the working router with the programmer and wrote it down to the non-working SPI NOR flash.
And voila - the router is working!

Thanks a lot!