FBF7050 broken bootloader in mtd2

[skalita]

Hello,

Has somebody tried to use JTAG to read/write fbf flash? Maybe there is somebody who has a backup of whole 7050 flash?

Does anybody know how to build JTAG interface (for 7050) and where could I get ADAM2 image? I have only found http://wiki.openwrt.org/AR7Port, but I am not sure whether AR7 in LinkSys is the same as AR7 in 7050.

Best regards,
Sebastian

 

[olistudent]

Hi.
Are you sure that you have deleted your Bootloader?
I haven't heard anything about JTAG on Fritz...

Greets, Oliver

 

[skalita]

Hello,

It is almost the same scenario as described here. My friend executed following commands:
debug
bin
quote MEDIA FLSH
put c:\mtd3 "file mtd3"
put c:\mtd4 "file mtd4"
quote REBOOT (he had error here: unknown command)

and after that he couldn't connect to ftp aymore... It seems that mtd2 was somehow overwritten.

Br, Sebastian

 

[haveaniceday]

Hi Sebastian,

the bootloader are different. But you should not need any bootloader until
you did not type "mtd2" by mistake.

What kind of mtd3/mtd4 did you sent to the box ? I am not sure if a valid IP
inside mtd3 might overwrite the default ADAM2-IP.

But there is an eays way to check if you are able get a LAN connection.
Connect the box to a switch. Power on for Fritz, have a look if the link LED is
detecting anything...

Haveaniceday

PS: A serial console should also help.

 

[skalita]

Hi,

He used mtd3/4 from http://www.akk.org/~enrik/fbox/util/.

Concerning a serial console he does not have cable with max232 but he is working on it.

Br, Sebastian

 

[haveaniceday]

And how is it about a switch ?

You might use the LAN port of a PC if it has a LED for link detected.
You might not need the serial console.

 

[skalita]

Hi,

I wrote to him and I am waiting for the results. In the meantime I have opened mtd3 in hex editor to find a value for env variables. Do you know which variables influence ADAM2 ip? I can see for example my_ipaddress, but it seems that no address is stored there 00 00 00 00 9b 01 00 00.

Br, Sebastian

 

[haveaniceday]

That might be the address. Try http://www.akk.org/~enrik/fbox/util/dumptffs.pl
to decode.

 

[skalita]

Oh my god - my_ipaddress is 127.0.0.1. Do you have any idea what to do next? Is it possible to change env var via serial console?

And, could you tell me, is it possible to use JTAG with fbf? There are so mamy people writing about using it in the worst case scenario but nobody is showing how to build such an interface.

Br, Sebastian

 

[haveaniceday]

It's possible to change this entry with the serial console.
I expect you got a link with a LAN card or switch.

I have not worked with any jtag interface. But I expect it's not required.

A) serial console will help
B) you can use a knoppix cd/dvd
- boot knoppix, e.g. with option: nodhcp 2
- should give a root shell ( I did not test, might need other commands )
- ifconfig lo 126.0.0.1
- ifconfig eth0 127.0.0.2
- unplug fritz power
- type pftp 127.0.0.1 ( without enter )
- plug in power for fritz
- <enter> for the pftp

You should be able to get a connection. Change the IP, try AVM-7050 recovertool,
should be solved...


Haveaniceday

PS: Did not test the 127.0.0.1. Expect a X-Server will freeze, that's why I suggest run level 2.

 

[skalita]

I have to tell that some other variables are undefined too:

HWRevision = <undef>
...
mtd0 = <undef>
mtd1 = <undef>
mtd2 = <undef>
mtd3 = <undef>
mtd4 = <undef>

Is it going to be a problem?

Br, Sebastian

 

[haveaniceday]

No. Just the correct HWRevision is required for the AVM recovery images.

 

[skalita]

Thanks for all your help. I am going to try with knoppix.

Br, Sebastian

 

[olistudent]

With the recover Skript from Enrik's Webpage you can set the Bootip of the box. Maybe you will give it a try. With ethereal or packetyzer you can monitor what is going on...

Greets, Oliver

 

[skalita]

Hi oli,

You are right, there is a section in this perl script:
my $setpacket = pack("vCCVNV", 0, 18, 1, 1, $setip, 0);
$probe->send($setpacket, 0, $broadcast);
which sends broadcast packet with new ipaddress via udp.

So the one thing left is to be in the same subnet, so that my broadcast will be received by fbf... right? I will try with 127.x.x.x and netmask 255.0.0.0. But I do not have access to the broken box, so there will be some delay before we get the result.

Br, Sebastian

 

[olistudent]

The FritzBox will send you an answer from where ever it is. When you don't get an answer it will not be possible to use this method.

Greets, Oliver