FBF7140 "Dead". How to bring it back ?

[Snikethopy]

Hello,

As a none german native, I am requesting your assistance in english.

I have tryed for switch my box from an annexB to an annexA, but I mess it up badly.

My problem is that the box has become unreachable. Cannot ping nor telnet it.
When I power up to bow, the Power/DSL led do flash 4 times, then stays on.

I have tryed several times the recovery images x.04, x.15, x.25, and x.29
For the 15 25 and 29, the recovery tool said that the frim is incompatible.
For the 04, the recovery is successfully applyed, but the box still doesn't work.

I have noticed that the last firmware is not read when the recovery tool read the box in the first phase.

I thing I read somewhere a procedure to "JTAG" the box.

Any suggestion will be more than welcome.

 

[MaxMuster]

Hi,

For the 04, the recovery is successfully applyed, but the box still doesn't work.

If the recovery claims to be successful, what is the behavior after the recover? Maybe you just have to reset the box via phone (dialing #991*15901590*) afterwards?

Joerg

 

[Marsupilami]

Can you use ftp to reach your box?

• Connect cable to your box the same way you did for the recover.
• Enter "ftp 192.168.178.1" without pressing Return.
• Power on the box.
• Directly after powering on FritzBox press Return.
• If asked for user name and password enter "adam2" for both.

Does that work?

 

[Snikethopy]

Hi,

First, my mistake for the thread's title, it's fbf 7170 and not 7140.

Here is the log of the recovery:
FRITZ!Box FON WLAN 7170 suchen an: 192.168.178.3
Eine Anlage gefunden! - Ermitteln der aktuellen Version.
Version erfolgreich ermittelt!
Hardware: FRITZ!Box FON WLAN 7170
Urlader: 1128
Firmware:
Flashbereich (mtd1)
Lösche Flashbereich (mtd1)
Restauriere Flashbereich (mtd1)
Überprüfe Flashbereich (mtd1)
Erfolgreich
Flashbereich (mtd3)
Lösche Flashbereich (mtd3)
Restauriere Flashbereich (mtd3)
Flashbereich (mtd4)
Lösche Flashbereich (mtd4)
Restauriere Flashbereich (mtd4)
FRITZ!Box FON WLAN 7170 erfolgreich wiederhergestellt!

My NIC is set with a static ip: 192.168.178.2 (SubMsk:255.255.255.0 DftGtw:192.168.178.1 DNS:192.168.178.1)
Also tryed with DynIP, and gives the same result.

MaxMuster,
The reset code did not solve it. Thanks anyway.

Marsupilami,
FTP the box as you said returns an unknow destination error.

 

[MaxMuster]

Hi,

maybe it is just the IP? There is one thread saying the box might have the 192.168.178.2. So maybe you change your address to 192.168.178.123 or so to be sure. And then you could also try the 192.168.178.254 which should be the "fallback-IP" for the boxes.

Joerg

 

[Marsupilami]

That's really strange. The log says that the recover procedure has been absolutely successful.
FTP does work only a very short time after powering on the box. Try it some time. It should be working as the recover program does work.

 

[Snikethopy]

Ok guys, we are one step closer to the solution, I hope

What I did ?
Change the IP of the NIC to 192.168.178.254
Then recovery procedure, again.

Then ftp 192.168.178.2 , followed by username and password. And I am in ADAM2 ftp server.
(when ftp to 192.168.178.1, I could not get the username and password prompt)

Since that moment, the Power/DSL light keeps flashing. And I can now ping the 192.168.178.2.

What should I do now?
When I ls or dir in ADAM2 session, error is returned "502 Command not implemented"

I have found THIS , but I am not sure if it does apply to me.
I already have the image file for my fbf7170 firm relase 29.04.01 , but if cannot find the kernel.image file.

So I am waiting for your feedback.

 

[heini66]

just untar by tar xf (name.of.firmware.file) the firmware, then you will find inside the folder you untared it the following folders var/tmp, inside the tmp kernel and filesystem image.

 

[MaxMuster]

Hi,

Just some more words to the next steps:

As Heini says, just untar the firmware and do the two lines with the put command. Do not enter the setenv part, this would make your box "think" it was an ordinary "FritzBox Fon classic"!

So for you it should be sufficient to do:

debug
bin
quote MEDIA FLSH
put c:\kernel.image "kernel.image mtd1"
put c:\filesystem.image "filesystem.image mtd0"
quote REBOOT

But the result should be the same than the recover process! So if there is something not working with your box now, I'm quite sure it will remain after the "manual recover".

Another point to mention: The IP 192.168.178.254 is usually reserved for the Box as a fallback-IP. So for "normal operation" your PC should never use this IP!

How does your box operate now, after the recover: Are the lights showing the "usual" behaiviour or is there no change to the "broken" behaiviour?

A question to the "other experts": Was there also a change in the kernel history (and bootloader) of the 7170 firmwares? Can anybody confirm the kernel of fritz.box_fon_wlan_7170.04.29.recover-image.exe he used is working with his bootloader (Urlader: 1128)?
From the signature I see his box had the 29.04.29, which surely has a 2.6 kernel, but what about the 29.04.04?

So maybe (just to be safe) you should try the kernel and firmware of the original version.


Joerg

 

[Snikethopy]

Thanks for the feedback. I will give it a try after work.

To be on the safe side, I will static IP my NIC with 192.168.178.123. Then try to ftp the box.

Untar the firmware file for FBF7170 29.04.29 (original), then

debug
bin
quote MEDIA FLSH
put c:\kernel.image "kernel.image mtd1"
put c:\filesystem.image "filesystem.image mtd0"
quote REBOOT

I will keep you posted on the outcome.

 

[Snikethopy]

Unfortunatly, it did not work. I tryed with firm 29.04.29, 29.04.01, and 29.04.21
Also tryed with DynIP and Static IP 192.168.178.123 , 3, 254
Always the same error, take a look:

Connecté à 192.168.178.2.
220 ADAM2 FTP Server ready
Utilisateur (192.168.178.2:(none)) : adam2
331 Password required for adam2
Mot de passe :
230 User adam2 successfully logged in
ftp> debug
Débogage activé.
ftp> bin
---> TYPE I
200 Type set to BINARY
[B][COLOR="Red"]ftp> put c:\kernel.image "kernel.image mtd1"
---> PORT 192,168,178,123,5,35
502 Command not implemented
---> STOR kernel.image mtd1
501 Syntax error: Invalid number of parameters
ftp> put c:\filesystem.image "filesystem.image mtd0"
---> STOR filesystem.image mtd0
501 Syntax error: Invalid number of parameters[/COLOR][/B]
ftp> quote REBOOT
---> REBOOT
221 Thank you for using the FTP service on ADAM2
221 Goodbye.

I found a thread with a liste of ENV var, and thought it could be usefull to understand the box:
(note that the firmware_version and firmware_info looks unusual)

Connecté à 192.168.178.2.
220 ADAM2 FTP Server ready
Utilisateur (192.168.178.2:(none)) : adam2
331 Password required for adam2
Mot de passe :
230 User adam2 successfully logged in
ftp> quote GETENV HWRevision
HWRevision            94.1.0.0

200 GETENV command successful
ftp> quote GETENV ProductID
ProductID             Fritz_Box_7170

200 GETENV command successful
ftp> quote GETENV SerialNumber
SerialNumber          0000000000000000

200 GETENV command successful
ftp> quote GETENV annex
annex                 B

200 GETENV command successful
ftp> quote GETENV autoload
autoload              yes

200 GETENV command successful
ftp> quote GETENV bootloaderVersion
bootloaderVersion     1.128

200 GETENV command successful
ftp> quote GETENV bootserport
bootserport           tty0

200 GETENV command successful
ftp> quote GETENV bluetooth
bluetooth             00:04:0E:FF:FF:07

200 GETENV command successful
ftp> quote GETENV cpufrequency
cpufrequency          211968000

200 GETENV command successful
ftp> quote GETENV firstfreeaddress
firstfreeaddress      0x946AD150

200 GETENV command successful
ftp> quote GETENV firmware_version
firmware_version      avm $

200 GETENV command successful
ftp> quote GETENV firmware_info
501 environment variable not set
ftp> quote GETENV flashsize
flashsize             0x00800000

200 GETENV command successful
ftp> quote GETENV maca
maca                  00:15:0C:4C:1B:E7

200 GETENV command successful
ftp> quote GETENV macb
macb                  00:15:0C:4C:1B:E8

200 GETENV command successful
ftp> quote GETENV macwlan
macwlan               00:15:0C:4C:1B:E9

200 GETENV command successful
ftp> quote GETENV macdsl
macdsl                00:15:0C:4C:1B:EA

200 GETENV command successful
ftp> quote GETENV memsize
memsize               0x02000000

200 GETENV command successful
ftp> quote GETENV modetty0
modetty0              38400,n,8,1,hw

200 GETENV command successful
ftp> quote GETENV modetty1
modetty1              38400,n,8,1,hw

200 GETENV command successful
ftp> quote GETENV mtd0
mtd0                  0x90000000,0x90000000

200 GETENV command successful
ftp> quote GETENV mtd1
mtd1                  0x90010000,0x90780000

200 GETENV command successful
ftp> quote GETENV mtd2
mtd2                  0x90000000,0x90010000

200 GETENV command successful
ftp> quote GETENV mtd3
mtd3                  0x90780000,0x907C0000

200 GETENV command successful
ftp> quote GETENV mtd4
mtd4                  0x907C0000,0x90800000

200 GETENV command successful
ftp> quote GETENV my_ipaddress
my_ipaddress          192.168.178.2

200 GETENV command successful
ftp> quote GETENV prompt
prompt                AVM_Ar7

200 GETENV command successful
ftp> quote GETENV reserved
reserved              00:04:0E:FF:FF:00

200 GETENV command successful
ftp> quote GETENV req_fullrate_freq
req_fullrate_freq     125000000

200 GETENV command successful
ftp> quote GETENV sysfrequency
sysfrequency          125000000

200 GETENV command successful
ftp> quote GETENV urlader-version
urlader-version       1128

200 GETENV command successful
ftp> quote GETENV usb_board_mac
usb_board_mac         00:15:0C:4C:1B:EB

200 GETENV command successful
ftp> quote GETENV usb_rndis_mac
usb_rndis_mac         00:15:0C:4C:1B:EC

200 GETENV command successful
ftp> quote GETENV usb_device_id
usb_device_id         0x3D00

200 GETENV command successful
ftp> quote GETENV usb_revision_id
usb_revision_id       0x0200

200 GETENV command successful
ftp> quote GETENV usb_device_name
usb_device_name       USB DSL Device

200 GETENV command successful
ftp> quote GETENV usb_manufacturer_name
usb_manufacturer_name  AVM

200 GETENV command successful
ftp> quote GETENV wlan_key
wlan_key              9033197652349901

200 GETENV command successful

 

[MaxMuster]

Hi,

if you are starting the ftp session from the directory, where the image-files are located (e.g. c: ), then you might also try

...
quote MEDIA FLSH
put kernel.image mtd1
...
put filesystem.image mtd0
...

Maybe you should also try a passive bofore starting the put.

EDIT: Just saw this: did you miss the quote MEDIA FLSH ?

Good luck!

Joerg

 

[Snikethopy]

Little piggy is almost at the farm

Here is what I've done.

C:\Fritz>dir
 Le volume dans le lecteur C n'a pas de nom.
 Le numéro de série du volume est BC9F-523E

 Répertoire de C:\Fritz

29/05/2007  20:59    <REP>          .
29/05/2007  20:59    <REP>          ..
02/02/2006  14:01                 0 filesystem.image
02/02/2006  14:01         4 186 120 kernel.image
               2 fichier(s)        4 186 120 octets
               2 Rép(s)  58 588 803 072 octets libres

C:\Fritz>ftp 192.168.178.2
Connecté à 192.168.178.2.
220 ADAM2 FTP Server ready
Utilisateur (192.168.178.2:(none)) : adam2
331 Password required for adam2
Mot de passe :
230 User adam2 successfully logged in
ftp> debug
Débogage activé.
ftp> bin
---> TYPE I
200 Type set to BINARY
ftp> quote MEDIA FLSH
---> MEDIA FLSH
200 Media set to MEDIA_FLASH
ftp> put kernel.image mtd1
---> PORT 192,168,178,123,4,22
502 Command not implemented
---> STOR mtd1
425 can't open data connection
ftp> put filesystem.image mtd0
---> STOR mtd0
120 Service not ready, please wait

After hitting ENTER on "put kernel.image mtd1" instruction , the Power/DSL LED begame flashing slowly. The following return "STOR mtd1" did stay more than 2 minutes on the screen, then the error "425 can't open data connection" was returned.

At that point, the INFO led did start flashing at a regular tempo.

I did send the "put filesystem.image mtd0" instruction afterwards. And the error message "120 Service not ready, please wait" was returned directly.

I waited 20 minutes but the Service was NEVER ready.
I ended the cmd session.

Any suggestion ?

MaxMuster,
I know how to passive FTP with a client FTP software.
How can I do it with DOS ftp ?
I tryed the PASV command, when on the ADAM2 session. But command is unknown.

 

[Snikethopy]

Woooooooooooooooooooaaaaaaa......
:dance: :dance: :dance: :dance:

Thanks to MaxMuster, Marsupilami, heini66 and all the contributors of IP-PHONE-Forum.de my problem is fixed and my box is back to life.

:groesste: YOU ALL ARE MASTERS :rock: :rock: :rock:

So, as a contribution, the solution was provided in this post.

I did not "put the filesystem.image mtd0", but I set passive as explained in linked post above.

So now, I am back to switching annexB to AnnexA.