[Problem] FritzBox 7360 nach Recover ohne Funktion, nur Power LED dauerhaft an

[PeterPawn]

Ohne eine eigene gesicherte Bootloader-Kopie bringt das ohnehin nur dann etwas, wenn man sich zutraut, den Inhalt der Bootloader-Partition vor dem Flashen noch mit einem Hex-Editor so anzupassen, daß er zur eigenen Box paßt ... so man denn eine Kopie des Bootloaders von jemand anderem erhalten hat.

Dort werden bei der Herstellung individuelle Merkmale der Box eingefügt, die auch bei Updates über irgendein Recovery-Programm dann wieder in das dort enthaltene Bootloader-Image übernommen werden, bevor es auf die Box übertragen wird => siehe auch http://freetz.org/wiki/help/howtos/development/adam2

Macht man bei dieser Bearbeitung dann Fehler (oder paßt der Bootloader doch nicht 100% zur eigenen Hardware, meines Wissens wurden unterschiedliche Flash-Bausteine verbaut und ich würde nicht absolut darauf vertrauen, daß der Bootloader-Code die schon richtig identifizieren wird), dann ist auch der FTP-Zugriff dahin und spätestens dann die Box ein Fall für den Abdecker (falls man das Gehäuse noch aufheben will als Deko-Element im Wohn- oder Arbeitszimmer).

Ohne eine solche eigene Sicherungskopie würde ich die Finger davon lassen ... wieder der Aspekt "Ehrgeiz vs. Wirtschaftlichkeit". Insofern sollte man #19 die Information entnehmen, daß das Sichern des kompletten Flash-Inhalts der eigenen Box eigentlich immer der erste Schritt sein sollte, wenn man sich mit dem Thema zu beschäftigen beginnt.

Wobei auch ein originaler Bootloader 1388 eigentlich auf eine recht betagte Box schließen läßt ... hier würde ich auch mal Interesse an einem Image des alten Bootloaders (per E-Mail an eine meiner Adressen, irgendwo in GitHub steht bestimmt eine) anmelden, weil mich der Unterschied zu einer aktuellen Version (die kann ich dann aus dem Recovery-Programm extrahieren) interessieren würde.

 

[werner_666]

@Peter
Ich habe beide Bootloader auf die Reise geschickt, hoffentlich habe ich die richtige Adresse gefunden.

Und noch einmal, was ich mit meiner stillgelegten Box gemacht habe:

Ich habe ein 6.30-freetz Image entpackt, dann die Länge von kernel.image auf
ein Vielfaches von 256 erweitert.
Dieses Image habe ich dann mit "eva_to_memory" geladen.
Im Freetz-Gui habe ich dann einen Firmwareupdate gestartet (6.30-freetz),
aber noch nicht neu gestartet.
Dann habe ich mein originales Bootloader Image nach /var/tmp kopiert,
danach /var/postinstall geändert, so dass flash_update.ko den Bootloader flasht,
danach neustart.

Das größte Problem hier dürfte sein, ohne Backup, einen passenden Bootloader zu finden.
Falls es eine Möglichkeit gibt, ein älteres Recover dazu zu bringen, den Bootloader mit
zu ersetzen, so könnte das eine Möglichkeit sein,
denn die Recover-Images erhalten dabei die Box spezifischen Parameter,
welche jetzt auch in dem "bösen" Bootloader vorhanden sind.

Wie Peter schon gesagt hat, es ist für den Ehrgeiz (Abt. Ich krieg dich schon ...)

 

[PeterPawn]

@werner_666:
Ja, danke ... sind angekommen. Hätte ich per E-Mail später noch bestätigt ... im Moment keine Zeit für den Vergleich, aber Nachschub für die ToDo-Liste.

Die Idee mit dem Schreiben eines älteren Bootloaders über AVM-Recovery funktioniert vermutlich nur, wenn man vorher die Version des vorhandenen passend abändert, damit das Recovery-Programm sich auch traut (also vermutet, es hätte eine neuere). Welches Recovery-Programm welche Bootloader-Version enthält, könnte man mit dem "extract_images" aus der Freetz-Toolchain (tools) ermitteln.

 

[aghino]

Goodmorning, sorry if i wrote in english and for my english too.
I have the same problem of Camel. I have a fritz 7360 artikel num 2000 2522. I've buy this fritz like used. Is nativally DE.
The fritz at first boot was ok in DE, after that i've try to convert to international with ftp_uploader the fritz stop at boot after 3 flash green led power and then stuck on green led power and nothing happen. Don't respond at ping, the webif is unavaible.
This is the report of env:

HWRevision 196
HWSubRevision 2
ProductID Fritz_Box_HW196
SerialNumber 0000000000000000
annex B
autoload yes
bootloaderVersion 1.2473
bootserport tty0
cpufrequency 500000000
firstfreeaddress 0x81133770
flashsize nor_size=32MB sflash_size=0KB nand_size=0MB
maca ------------------
macb ------------------
macwlan -----------------
macdsl ------------------
memsize 0x08000000
modetty0 38400,n,8,1,hw
modetty1 38400,n,8,1,hw
mtd0 0x90000000,0x90000000
mtd1 0x90020000,0x91F80000
mtd2 0x90000000,0x90020000
mtd3 0x91F80000,0x91FC0000
mtd4 0x91FC0000,0x92000000
my_ipaddress 192.168.178.1
prompt Eva_AVM
req_fullrate_freq 250000000
sysfrequency 250000000
tr069_passphrase --------------------
tr069_serial ----------------------
urlader-version 3473
usb_board_mac ------------------
usb_device_id 0x0000
usb_manufacturer_name AVM
usb_revision_id 0x0000
usb_rndis_mac -----------------

It's possible to resolve the problem? I have write at avm and they say me that my model is a 7360 v1 and do not exist a recovery for this model and again a version of firmware for my model is 111.xx.xx. I found, with a help of members of forum, some recovery and older file.image but none is able to repair the fritz. I've just try with recovery 111.06.30 int but stop with alert of incompatibility of hardware 196. Then i try with 124.06.50 DE and 52 int (with modify manually variable firmware_version and firmware_info) and recovery say that is ok but after that the fritz still stop on boot.
I've read that Werner_666 has solve problem with rewrite a bootloader with a good version dumped from a other fritz 7360, it's correct? Is a a good solution? Is usable form me too?
Thanks a lot.

 

[PeterPawn]

Has the environment been tampered with?

If not, your device is a 7360v2 (32 MB Flash, HWRev 196, Major-Version 124) and you need the firmware for this model.

On the other hand, your listing contains neither a "firmware_version" nor a "firmware_info" variable ... that looks strange and which value will be assumed as default, depends on the firmware version installed (in /etc/init.d/rc.conf).

There is a very current international version (06.52) available for the v2 and the german version isn't much older.

If you haven't saved an older copy of your own bootloader, there's only a little chance, you'll get the box working again with a foreign bootloader (if someone would "donate" a copy from his box). (EDIT) No, @werner_666 already had a copy of his own bootloader - he saved it earlier.

But if there's more than one finding in the wild, that updating the bootloader code with AVM's recovery program renders a box unusable, there should be an opportunity to exchange the device - but in your case the support team detects a wrong model? Did they get the same data (as specified above) from the environment listing?

 

[aghino]

Thank you for reply,
The enviroment i've get from ftp with get env in binary mode.
What i've posted above is a first extraction after damage.
No, i haven't a back up of a mtd or best of bootloader. I stupidly think that at today the change of a country and a firmware was a most simply.
I buyed on ebay and when they comes to me i only start the fritz for verify the operativity of device, and all was ok.
Then, without other operation, i've started to upload a 124.06.52 internationl with ftp_uploader, then started the problem. Frist continuosly reboot, then a try to recover with 6.52 recovery and the fritz is bricked.
I can write the enviroment for firmware_version and firmware_info or other but the result is the same, no boot.
I don't know if the recovery contain the bootloader update and i don't know what version was before of first recovery.
If i remember correctly in the bootloader there is a possibility to change a sensible data (on fritz 7170 i was made that) with hex editor. I will hope that this is remain a far solution and hope to resolve with other software tricks.
To Avm i've send first a artikelnum and then a log of recovery and a serialnumber of my fritz.

 

[PeterPawn]

If it's really a problem with an automatic bootloader update from the latest recovery program, you could try to fool an earlier recovery program with the currently installed version, so that it will try to install its own (even older) version again.

But that's not as easy ... any changes to "bootloaderversion" and "urlader-version" settings are discarded at restart of the bootloader and I don't know, if the bootloader version is determined by the mentioned variables or by the output to a "SYST" command, where the version is the 4th word in the answer (only in the text, the message number doesn't count).

But if the recovery program is able to write a new bootloader image, it has to construct such an image with variables read earlier from the environment ... and a "FRITZ!Box emulator" as FTP server should be enough to get the needed files out of vendors program. If you find an earlier recovery program (this forum has a special thread for searching such firmware) containing a (well known) functioning bootloader version and retrieve the customized copy for your box from it, it should be possible to write it to the box yourself ... and if you avoid any further recovery with AVM's utility, there's only a small risk, that it'll be updated again.

Any action taken by the recovery program may be executed with the proper commands ... by yourself - the only exception is the process of building an image (for any partition) from the "template" in its data section together with some values read from the environment (and the counters). This process needs external support (in form of scripts), but I haven't any script to "customize" a bootloader image - it's too dangerous to test it, if you don't have a JTAG interface for the box to neutralize any mistakes. And - last, but not least - it's not as easy to extract a valid bootloader image from the (compressed) data section of the recovery executable.

 

[aghino]

So, what i can do now? With serial consol can i made somthing useful? How can i know wich recoer contain a bootloader? For example, if i try to open a recovery 6.30 (de or int) with 7zip i found a file named .data that is openable too with 7zip and found a structure complete of kernel.image. That is true also with older recovery like 6.20 or 6.03. f i try the same operation with newer recovery (6.50 or 6.52) the .data file seem corrupted and 7zip don't open it. This is a possible simptom of a presence of a boot upgrade on recovery? Or is only my fantasy?
How can i ask for good (for me) recovery if i unknow what is good?

 

[PeterPawn]

There's an older (shell) script in Freetz (http://freetz.org/browser/trunk/tools/extract-images), which should be able to dissect a recovery program into the firmware parts - but I haven't tried it myself. At least it should be possible to detect the presence or absence of an updated bootloader in such a file.

Again ... I would try to contact the support again, tell them my story (using the recovery tool has updated the bootloader partition and now the device doesn't start) and ask for a replacement. The 7360v2 devices are not outdated ... they're still very good supported (the intl. firmware is - as mentioned above - just 10 days old) and the vendor issued a 5 years warranty for them. I can't believe, that there's no chance to find a solution - if you've got the original bill from your eBay seller (to prove the date of first retail sale).

 

[aghino]

Thanks a lot for your support. I've just ask the bill at seller but after a feedback (positive) it's vanished. Without the bill no support hardwrae from avm.

 

[PeterPawn]

Throw the box back to the seller (the head could be a good target, a FRITZ!Box router isn't a deadly weapon, if used this way - if you're shy (or restrained), aim for the feets) ... if this isn't an option, you're free to probe all other possible (even destructive) solutions, if there's nothing to lose (and yes, "freedom is just another word" for it).

Find an older recovery program version with a different bootloader image, prepare a "FRITZ!Box FTP server emulator" and extract the bootloader image with a FTP session (takes some time and you'll get - probably - experiences, how it will not work, but finally you should get a customized bootloader for your device from it) and transfer this image to your box ... this would be my "plan", how to solve it.

I haven't any idea, how much you've paid for the device ... you have to know, if it's worth the trouble/effort. Someone would see this as a challenge and another one wants only a running solution ...

 

[aghino]

Hi to all. I've solved the problem. Recovered and modify to international and all ok.
I explain.
The artikell num 2000 2522 seem to be a hybrid version. Has hardware and boot of 7360V1 but can recive a firmware of V2, but NOT recovery with file over 6.30, because on the recovery 6.50 de and 6.52 int there is a version of bootloader that is no good with hardware of 2000 2522.
At this point i've searched and try older recovery but first change the env urlader-version to minimum version (1111 is good for me) and the HWRevision to 183, then start recovery with the older recovery for V1 111.06.03. They start with write mdt2 but at check of data writing (the last of 3rd pass) return an error and stop the recovery. Now restart another time a fritz with same recovery and wait the process finish correctly.
At auto reboot all is ok. Then i've mod to international version and last 6.52 firmware.
That's all, i hope this can help

 

[KunterBunter]

The artikell num 2000 2522 seem to be a hybrid version. Has hardware and boot of 7360V1 but can recive a firmware of V2

I don't think this is correct. The box contains 32 MB of NAND flash. That means, it is definitely a Fritzbox 7360 V2.

 

[aghino]

You probably right, but can you explan why if i recover a fritz with a official 6.50, the bootloader change to newer version and then the fritz is locked to eva?
I have write to avm and they also has some doubt on model. First they say me is a v1, then i've rewrite to show the fact and they say that is correct, is a v2 but...
I can quote here the mail they send me. Their solution is to open rma with a right bill, but i havn't because the ebay seller don't reply a my message.
Every information are welcome.

 

[PeterPawn]

@werner_666:
Falls Du hier noch mitlesen solltest ... war Deine 7360 von Beginn an in Deinem Besitz oder hattest Du die auch (wie die beiden anderen hier im Thread, soweit ich das verstanden habe) von jemand anderem (und ohne Rechnung, auf der die originale Artikelnummer steht) erhalten?

Meine Theorie ist es, daß es bei den 16 MB-Modellen irgendwann mal keine Firmware mit NAS mehr gab (oder auch von Beginn an nicht, ich habe bei den Modellen nie einen Durchblick erlangt) und dann einige einfach zu einer Änderung der HWRevision gegriffen haben könnten, um die Firmware für die 32 MB-Modelle (so diese in 16 MB paßte, was bei Verzicht auf die jffs2-Partition für TAM durchaus denkbar wäre) auf ihre Box mit nur 16 MB-Flash zu bringen.

Solange man die Box nicht aufmacht, kann man das kaum überprüfen ... nur die immer wieder kolportierte Artikelnummer 2000 2522 steht dieser Theorie entgegen. Nun sollte die ja auf dem Aufkleber auch der Rückseite zu finden sein ... andererseits kann ich mir auch vorstellen, daß jemand beim Verkauf den besseren Preis der 32 MB-Modelle erzielen wollte und auch das schnell noch mit Scanner, Bildbearbeitung und Drucker korrigiert hat.

Ansonsten steht die Flash-Größe auch nur wie jeder andere Wert im Environment und kann dort geändert werden ... das ist also noch keine Garantie dafür, daß da tatsächlich auch 32 MB Flash enthalten sind, Daß eine nachträgliche Aufrüstung durch Austausch des Flash-Chips möglich wäre, will ich nicht ausschließen und dann paßt die Angabe ja auch wieder zum Speicherausbau, aber eben nicht automatisch auch zum Rest des Innenlebens - wenn die korrekte HWRevision eben die 183 wäre.

Das würde auch die Feststellungen von @aghino erklären ... inkl. der ersten Aussage von AVM, daß es sich um eine 7360v1 handeln würde (vermutlich anhand der Seriennummer im Support-Formular). Ich kann eigentlich nicht glauben, daß es bei AVM jemals so durcheinander gegangen sein soll, daß da unter derselben Artikelnummer Geräte mit 16 und 32 MB verkauft wurden - da wäre mir eine Erklärung, daß es unehrliche Verkäufer bei eBay geben könnte, irgendwie angenehmer.

Ansonsten würde es auch Versionen der Artikelnummer 2000 2522 geben, die intern die HWRevision 183 verwenden und (damit untrennbar verbunden) dann eine "major version" von "111" benötigen - allerdings wundert mich bei den verschiedenen Ausstattungen, die irgendwie alle unter "7360" vertrieben wurden, auch fast nichts mehr. Die Bezeichnung v1 und v2 wurde ja wohl auch erst später eingeführt - ob das am Ende noch einmal einen weiteren Unterschied zur internationalen v1 und v2 gibt, darf man trotzdem bezweifeln, wenn AVM selbst die Firmware nur noch unter dem Gesichtspunkt "v1" (HW 183, Mj. 111) und "v2" (HW 196, Mj. 124) separiert.

Meine persönliche Schlußfolgerung ... ein Glück, daß niemand aus meinem direkten Umfeld jemals zu einer 7360 gegriffen hat - bei der 7362SL ist das wieder etwas anderes.

@aghino:
I can't believe, that you've updated the device with "HWRevision 183" in the environment to version 06.52 (which wasn't published for 7360v1 models) without tampering with some other settings or using other tools ... or you made it with a bootloader FTP session yourself. The recovery program for version 124.06.52 should never accept a box with HWRevision 183 and the same rule should apply for an image-based update.

Maybe you've omitted some steps in your description ... currently I'd assume, that your seller had modified the item number, but kept the serial number on the sticker at the back of your device. This would explain, why AVM stated first, it's a 7360v1 model ... I'm sure, you had to enter the serial number to submit the support request form.

If your device was originally a HWRevision 183 and was changed to 196 by the previous owner, you should hope, it has really 32 MB of flash storage built in. If it lacks the larger flash memory, flash write operations above the 16 MB boundary have two opportunities ... they may fail silently, because there's no flash, but the absent storage cells still return "all ones" as an erased flash would do - or (the bad option) they "wrap around" due to only one different high-order address bit and overwrite the flash content in the first 16 MB again. But if your device is really running version 124.06.52, it would prove, there's really more than 16 MB flash, because the firmware is larger than this. I can't check personally, if it was the same for older versions, because I do not own or administrate such a device and my firmware archive contains (mostly) only the really needed versions.

The other possibility would be a device with item number 2000 2522, 32 MB flash (as other "2000 2522" models) but an original HWRevision of 183 ... which was still changed by the previous owner to use the other firmware, because the 183-versions didn't support some NAS options (afaik).

 

[aghino]

Sorry, you are right, for describe in little words i have lost something.
I can cofirm that now run correctly a firmware 124.06.52. i tried some feature and seems to be all ok without problem. One thing that in the internet conenction don't appear the possibility of wifi provider but i don't know if a limitation of firmware or other thng, for now no problem.
Recap a step.
With fritz blocked to eva i'm start fritz and connect to ftp with windows cmd, set the env HWRevision to 183 (at restart of fritz they return to it's orignal setting 196), the urlader-version to 1111 (i try with 0123 but the 0 skipped and the version is too high), firmware_version to avm and firmware_info to 111.06.01 quit ftp cmd and without restart a fritz start a 111.06.03 recovery that run to write mdt2 (delete mtd2, write mtd2 ad check mtd2), they stop on check with error.
Close recovery window, reset the fritz and reconnect it again in ftp, change the same env (except the urlader-version) same as previous. Quit cmd ftp and without reset fritz start same recovery. At this time the recovery finish correctly and the fritz start to boot. With the bad boot blink the power led at fisrt and then stop, with this boot blink the red info boot 3 times, then stop with no led on, and then start blinkin the power led green.
This is the correct step. All operation are mxed from ftp command line, to modify the env, and recovery to write the correct data like boot.
seeng the bottom of fritz don't seems to be altered and the sticker seem the original. Some people use ebay to
Is one week that i try with more trick to recover it.
Many people use eBay to defraud buyers and I can not be excluded that this is one of those cases, I solved now, perhaps not so elegant, but at least the fritz is usable.
I wanted to share my experience of recovery so that it can possibly be of help to others, only in this topic there are three cases, that of a camel weder and mine.

 

[PeterPawn]

@aghino:
I still can't find the step(s), where you've set the HWRevision back to 196 and where you've updated the FRITZ!OS to 06.52 - and that means, that you should share/explain this step too. I was (and I'm still) in doubt, that you were able to update a device with HWRevision 183 with the provided firmware versions without any "dirty tricks" and that's why I asked for further information, how you did it - if you want to share your experiences (and it's nice to do this, kudos), a reader should be able to reproduce the important steps and - beneath the reanimation of an older bootloader version - the question, how you've got the device to the running version, is the most important one (at least I think it is).

The different blinking of LED lights seems to be a new (and better) approach to signal a starting device. The slow blinking green INFO light is used for many other purposes and it's hard to distinct between a "normal" blinking LED and a (even locked-up) device during restart. I've got the same behaviour (3 times blinking of the red INFO LED, while EVA is ready to accept a FTP connection - it keeps blinking red, as long as a session is active or I should better write "while the server is running") with an update of the bootloader for a 7390 device some months ago.

 

[aghino]

To update to 6.52 i follow the classical step, change the firmware_version to avme and firmware_info to 124.06.01 (in ftp, that to use international recovery 6.30) then in webif update to 6.52 with file .image, obviously that before to do that i'm wait that the fritz boot up correctly with firmware.
This is the step. If i can't explain correctly i'm sorry but this is what i do. with all the attempts it is possible that now I do not remember exactly the steps, partly because once you have arranged have not repeated all the steps. For safety before performing the full recovery with 6:30 you can reset the HWRevision to 196, although I remember, perhaps wrongly, that automatically restarts the eva this back to its original setting
Obviously is a dirty trick beacause forcing a system to work not in normal mode, btw if avm don't release a workaround or solution, this is the only way that i found instead solder, serial, jtag, dump and similar thing.
I know that the blinik led can assume various meanings, but i mean that with bad boot blink green power, with good boot blink red info, it's so differnt for me. And again, with bad boot only LAN4 is usable for operation, with good boot LAN1 (i try other port and none can reply other that).
Probably, but is only my idea, at release of this hardware came with correct loader shared with other hardware version, like 183, but set to 196 and firmware follow correct numbering of 124.xx.xx. But this information is handle only by avm.

 

[PeterPawn]

Only as a summary, what I understood so far ... you've changed the HWRevision (temporary, because the changed setting is volatile), installed bootloader from 06.03 (after setting urlader-version to a value lower than the version of the contained bootloader in your recovery program) and with the new bootloader the device stiill starts and the bootloader written to a "HWRevision 183"-device once again switches back to 196 automatically ... so you were able to run a recovery program (in #38 you wrote "06:30" and in #36 it's "06.52" - perhaps only a mistake) next without any further preparations. Did I summarize it right?

Have some other values been changed by the new bootloader during this process? As long as the "urlader-version" isn't read from the loader image itself, it can only be read from the TFFS settings (MTD3/4) and I'm longing to know, if it was changed and what was the new value in case of a change. The recovery program writes a new TFFS image to MTD3/MTD4, containing the "environment values" read from the box. If the "urlader-version" setting is read from the old settings (by EVA) and sent to the recovery program, this program should use the provided value to build the new TFFS image ... your (reported) bootloader version number should remain as "3473" (or 1.2473), even after all previous actions. The real bootloader version will be displayed in the answer to a SYST command after FTP login. Is there a difference?

I'm trying hard to learn from your findings ... that's why I have so many questions. The better we understand the process, the better we can help others.

 

[aghino]

This procedure is useful for groped to recover a Fritzbox 7360 Art num 2000 2522 stuck to the boot as a result of a recovery not compatible. This procedure is used to write a bootloader compatible in order to restore the full functionality of the fritz.

Starting from the fritz stuck at boot, enter the FTP within the first 5 seconds from power (LED flashing green power).
Change veriabili as follows:

quote SETENV HWRevision 183
quote firmware_version avm
quote firmware_info 111.06.00
quote urlader-version 1111

Logout but without restarting the Fritzbox.
Start the recovery 6.03 normally, at the start of the recovery process will immediately try to write the boot loader, proceed first with the cancellation of mtd2, then with the writing of the "new" mtd2 and then with the check of what is written. At this point will give the error check. Do not worry. Close the recovery.
(I think that at this point is possible to run recovery directly without restart the fritz, but i'm not tested this)

Restart the Fritzbox and jump right still ftp.
Check HWRevision variable (should be back to 196, if not change it as per previous point), the other variables, and firmware_version firmware_info, they should be left to the preceding setting. The urlader-version variable should never be touched again.

If everything is ok again to proceed with the recovery 6.03 that at this point will regularly until the end. To restart the fritz will be operational again.

Then you can proceed or a recovery, up 6.30, or with aggironamento from web interface using .image file.

Being delicate and risky operations do not take any responsibility if something goes wrong. Any operation is at your own risk.


My final result is 6.52 internationl version, for that i need to made some middle step. 6.30 is latest official recovery that i've tested not change again a bootloader. Than i update from webinterface to 6.52 with a proper file downloaded from avm repository.
I try to explain best that i can made.