Hello,
I just have a 3000AX in front of me that does not boot, there is no LED.
The following comes from uart (please take a Look at picture..)
What options do I have to patch this now?
Can someone provide me with a dump?
This is my Dump > 3000AX
MfG
Bow
This could be the output of some rather old version of U-boot. git grep elf_loader_entry in a more recent U-boot source code finds one text file that contains an example of a boot sequence, consisting of messages that are formatted in a similar way.
It seems to me that the flash memory is corrupted, possibly before U-boot has reached a step where it could accept commands or attempt to load an operating system kernel. With luck, a SoC specific tool like https://github.com/PL125/Unbricking_Tools could work. Otherwise, you might have to attach some wires to reprogram the flash via SPI or I2C. Possibly you’d have to desolder the signal wires from the circuit board to allow this kind of in-circuit programming.
Hi @dr-m
Now the problem is that I don't have or can't find a cure or working dump.
It would now be the question of how to get that fixed again. Presumably an update failed with the previous owner.
I could already read the NAND. For this I took it off the board and read it with a T76 programmer.
Oh, okay, so you really only need a working ROM dump that you could upload to the device. At https://firmware-selector.openwrt.org I can find "AVM FRITZ!Repeater 3000". Did you try those, or are they missing the u-boot part?
Exactly I need a working firmware. I have a 3000AX I don't know how far they are compatible. As far as I know, another SoC is installed on the 3000?!
It could be the case that the OpenWrt image never overwrites the original u-boot part of the flash, and therefore doesn’t include it at all. When I built OpenWrt for my router from source code, there were no steps to configure and build u-boot, which should have been something patched by the manufacturer (a different one).
You could indeed need a copy of a full flash ROM image from a working router. I’d expect that it can be dumped somehow from the Linux user space, by invoking dd to read (a part of) a special file in /dev or /sys. Hopefully someone who is able to access a working device via ssh will show up in this thread.
Thanks in advance for your help. Maybe someone here will notice this who can assist me further.
With very few exceptions (mainly x86 and SBCs), and for good reasons, OpenWrt images do not contain bootloaders and rely on whatever proprietary bootloader is on the device. On an AVM device, that would not be U-Boot, but a different environment, EVA (previously ADAM2). Which seems to be missing or corrupted on this device.
@takimata
So the SBL can't load the EVA bootloader?
SBL?
The user noted:
You can't load something that's [possibly] missing or corrupted.
SecondBootLoader
Understood. So - "Can the second boot loader load the first boot loader?"
No, it cannot (not considering the chicken-or-the-egg paradoxical nature of the inquiry). While it it possible to daisy chain bootloaders, they must all be working, and loaded in the correct order.
That is correct.
Qualcomm’s naming convention differs from standard industry terms. What embedded engineers universally call the first-stage bootloader (FSBL), Qualcomm labels SBL1 (Secondary Boot Loader Stage 1). What is usually referred to as the second-stage bootloader (SSBL), like EVA or U-Boot, Qualcomm calls APPSBL (Application Secondary Boot Loader). Don't get too hung up on the semantics, the sequence remains the same.
The Fritz!Repeater 3000 and the Fritz!Repeater 3000AX are not compatible (indeed, the 3000AX is not supported by OpenWrt).
Is there perhaps the possibility of a
1200AX to copy the EVA bootloader area with ECC and then insert it into the dump of the 3000AX?
