Flash process breaks down - "Service not available" (Fritzbox FTP transfer)

Helo,

I try to flash Fritzbox 4040 with the file
openwrt-18.06.4-ipq40xx-avm_fritzbox-4040-squashfs-eva.bin.
Fritzbox has been completely resetted before.
Everything runs fine at first until
"„227 Entering Passive Mode (192,168,178,1,12,0)“,
but then an error message is displayed:
„421 Service not available, remote server timed out. Connection closed.
ftp> quote check mtd1
Not connected."

Anybody who can tell me what is wrong and how to solve this problem? Thanks in advance.

You are not talking about flashing, but about FTP transfer...

AVM devices start a limited ftpd for a short time from the bootloader (ADAM2)[0], which is meant for their windows based recovery programs, but can also be entered with cli ftp clients. This access method is used for flashing OpenWrt on these devices - and yes, it's really (a subset of) ftp, not tftp.

Edit: The tricks are:

  • to hit the right time for invoking the ftp session, as there's only a very small time frame to catch (1-2s during the early boot process, while the bootloader/ ADAM2 is in charge).
  • to only use passive ftp (if your ftp client allows setting this via cli parameter that might be better/ quicker than invoking pasv at runtime).
  • to provide the login credentials (adam2/ adam2) as quickly as possible, as only an established ftp session (login succeeded) intercepts the normal boot process.

it will usually require several attempts to hit the right timing, adding an unmanaged switch between your router and client can help to reduce the time needed for link training.

Once your ftp session is active, you can switch to binary mode, invoke the custom quote MEDIA FLSH command and put the required firmware components directly to the relevant mtds.

--
[0] this ftp window is open during every single boot, it doesn't require pressing any buttons (there are no reset buttons)

2 Likes

Thanks a lot for reply.

Well I know of course there is a short time range you have to hit.
In addition to my post above I can say that I succeeded to hit this when I tried to flash OpenWrt to the Fritzbox the first time.
But as described all ran fine at first but the last step - the flash process itself - didn’t work and has stopped as mentioned above.
After that the box was in disorder and I had to run the rececovery.exe file published by AVM.
Now trying again to flash I could hit the right interval no longer in spite of trying again and again, but had read a good trick before:
Running a wrong recovery file - for another Fritzbox, not the 4040 - in my case in a bridged Windows virtualbox window produces an error message of course, but keeps the ftp-access open.
Now I started the commands line for line as published for OpenWrt and all the commands ran fine again until the confirmation „227 Entering Passive Mode (192,168,178,1,12,0)“. But after a short while again the whole process stopped as quoted above and as happened before.

My host system is OS X Sierra. Maybe it is important to add this.
I can’t recognize any blockings by firewall or other processes, but did disable the firewall for this instead. Fritzbox ist connected to MAC by ethernet cable. Default settings for the box are maintained (IP 192.168.178.1), for for MAC manually set to 192.168.178.2 or by DHCP to 192.168.178.20.

So far I can’t find any faults in my procedure until know and would be very thankful for more help how to cut the knot.

Hello, I believe I've replicated the issue on a linux box. I don't have a solution, but I've tried to collect all of relevant information below.

The laptop is directly connected to Lan1 on the Fritz!Box.
I connected the power supply to the fritz!box and quickly started the ftp session.
I tried both entering in the ftp instructions one by one and piping them in, with the same result.

My next step is to try a different version of ftp. It's interesting that the ftp session makes it so far and then ultimately fails/times out at the file transfer.

#### Model

Fritz!Box Box 4040
2000 2763

#### Version of Fritz OS
FRITZ.Box_4040-07.12.image

#### Laptop Operating System


cat /etc/os-release

VERSION="42.3"
ID=opensuse
ID_LIKE="suse"
VERSION_ID="42.3"
PRETTY_NAME="openSUSE Leap 42.3"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:opensuse:leap:42.3"
BUG_REPORT_URL="https://bugs.opensuse.org"
HOME_URL="https://www.opensuse.org/"

#### Laptop ftp version

ftp about:ftp
This version of ftp has been enhanced by Luke Mewburn <lukem@NetBSD.org>
for the NetBSD project.  Execute `man ftp' for more details.

ftp about:version
Version: tnftp 20141104

###Commands that we ran

./20190901SetupEth0ForFritzBox.sh
(cat commandsToSendToFTP.txt | ftp -n -v -p -d -4 -t ftp://adam2:adam2@192.168.178.1) &> 20190901_1148FTPFritzBox4040OpenWRTLog.txt &

cat 20190901SetupEth0ForFritzBox.sh

ifconfig eth0 up
ifconfig eth0 192.168.178.2
ifconfig eth0 netmask 255.255.255.0
ifconfig eth0 broadcast 192.168.178.254
ifconfig eth0

#### cat commandsToSendToFTP.txt

debug on
status
system
quote SETENV linux_fs_start 0
quote MEDIA FLSH
binary
passive on 
quote PASV
epsv4 off
epsv6 off
sendport off
status
put openwrt-18.06.4-ipq40xx-avm_fritzbox-4040-squashfs-eva.bin mtd1

#### Output from the ftp session
#### cat 20190901_1148FTPFritzBox4040OpenWRTLog.txt

isipv6addr: got 0 for ftp://adam2:adam2@192.168.178.1
fetch_ftp: `ftp://adam2:adam2@192.168.178.1'
parse_url: URL `ftp://adam2:adam2@192.168.178.1'
parse_url: user `adam2' pass `adam2' host 192.168.178.1 port ftp(21) path `'
fetch_ftp: user `adam2' pass `adam2' host 192.168.178.1 port ftp path `' dir `<null>' file `<null>'
setupsockbufsize: rcvbuf_size determined as 87380
setupsockbufsize: sndbuf_size determined as 16384
Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
ftp_login: user `adam2' pass `adam2' host `192.168.178.1'
---> USER adam2
331 Password required for adam2
---> PASS XXXX
230 User adam2 successfully logged in
---> SYST
215 AVM EVA Version 1.3243 0x0 0x240D
Remote system type is AVM.
---> FEAT
502 Command not implemented
features[FEAT_FEAT] = 0
features[FEAT_MDTM] = -1
features[FEAT_MLST] = -1
features[FEAT_REST_STREAM] = -1
features[FEAT_SIZE] = -1
features[FEAT_TVFS] = -1
updatelocalcwd: got `/home/pjones/Documents/2019Spring/20190830FritzBox4040OpenWRT'
---> PWD
502 Command not implemented
---> TYPE I
200 Type set to BINARY
Debugging on (ftp_debug=1).
Connected and logged into 192.168.178.1.
No proxy connection.
Gate ftp: off, server (none), port ftpgate.
Passive mode: on; fallback to active mode: off.
Mode: stream; Type: binary; Form: non-print; Structure: file.
Verbose: on; Bell: off; Prompting: on; Globbing: on.
Store unique: off; Receive unique: off.
Preserve modification times: on.
Case: off; CR stripping: on.
Ntrans: off.
Nmap: off.
Hash mark printing: off; Mark count: 1024; Progress bar: on.
Get transfer rate throttle: off; maximum: 0; increment 1024.
Put transfer rate throttle: off; maximum: 0; increment 1024.
Socket buffer sizes: send 16384, receive 87380.
Use of PORT cmds: on.
Use of EPSV/EPRT cmds for IPv4: on.
Use of EPSV/EPRT cmds for IPv6: on.
Command line editing: off.
Version: tnftp 20141104
---> SYST
215 AVM EVA Version 1.3243 0x0 0x240D
---> SETENV linux_fs_start 0
200 SETENV command successful
---> MEDIA FLSH
200 Media set to MEDIA_FLASH
---> TYPE I
200 Type set to BINARY
Passive mode: on; fallback to active mode: off.
---> PASV
227 Entering Passive Mode (192,168,178,1,12,0)
EPSV/EPRT on IPv4 off.
EPSV/EPRT on IPv6 off.
Use of PORT/LPRT cmds off.
Connected and logged into 192.168.178.1.
No proxy connection.
Gate ftp: off, server (none), port ftpgate.
Passive mode: on; fallback to active mode: off.
Mode: stream; Type: binary; Form: non-print; Structure: file.
Verbose: on; Bell: off; Prompting: on; Globbing: on.
Store unique: off; Receive unique: off.
Preserve modification times: on.
Case: off; CR stripping: on.
Ntrans: off.
Nmap: off.
Hash mark printing: off; Mark count: 1024; Progress bar: on.
Get transfer rate throttle: off; maximum: 0; increment 1024.
Put transfer rate throttle: off; maximum: 0; increment 1024.
Socket buffer sizes: send 16384, receive 87380.
Use of PORT cmds: off.
Use of EPSV/EPRT cmds for IPv4: off.
Use of EPSV/EPRT cmds for IPv6: off.
Command line editing: off.
Version: tnftp 20141104
local: openwrt-18.06.4-ipq40xx-avm_fritzbox-4040-squashfs-eva.bin remote: mtd1
---> PASV
227 Entering Passive Mode (192,168,178,1,12,0)
---> STOR mtd1
421 Service not available, remote server timed out. Connection closed.