Installation on AVM Fritz!Box 7530 kills the box

mj69 · February 9, 2023, 4:14pm

Hi,
Since I moved from dsl to cable, if have a spare Fritz!Box 7530.
I tried to install OpenWrt on Fritz!Box 7530. Unfortunately without much success. Also recovery back to AVM firmware did not work.

I am on a windows laptop (Windows 10 Enterprise). To install the openwrt I am using the PowerShell (run as administrator).
Python 3.11.2 is installed.

The command
python eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz7530.bin
ends with a TimeoutError

FTP to the box on 192.168.178.1 is working well. Here are some information I get from the box:

HardwareFeatures:	nand=0x98F1801572,cpu=0x979
HWRevision:		236
ProductID:		Fritz_Box_HW236
SerialNumber:		N16567830627710
annex:			B
autoload:		        yes
bootloaderVersion:	1.11581
firstfreeaddress:	0x882540E8
firmware_info:		164.07.50
firmware_version:	avm
flashsize:		nor_size=0MB sflash_size=0KB nand_size=128MB
maca:		DC:15:C8:CD:B4:86
macb:		DC:15:C8:CD:B4:87
macwlan:		DC:15:C8:CD:B4:88
macwlan2:	DC:15:C8:CD:B4:89
macwlan3:	variable not set
macdsl:		DC:15:C8:CD:B4:83
memsize:		0x10000000
mtd0:		0x0,0x2C00000
mtd1:		0xB00000,0xF00000
mtd2:		0x0,0x2C0000
mtd3:		0x2C0000,0xB00000
mtd4:		0xF00000,0x1300000
mtd5:		0x1300000,0x8000000
my_ipaddress:		192.168.178.1
prompt:		Eva_AVM
usb_rndis_mac:	DC:15:C8:CD:B4:85
wlan_key:	01239336960905727732
wlan_ssid:	FRITZ!Box#7530#ND

Is anybody out there able to help me and let me know, what I could do to get openwrt installed?

Thank you,
Mike

andyboeh · February 9, 2023, 4:34pm

Did you try with the AVM recovery tool? It has always worked for me, but sometimes a few tries were needed.

IMHO it fails to connect to the box. For the sake of completeness: You did run this command directly after connecting the power cable? And you did assign a static IP to your Windows machine? And you connected your notebook directly to the box?

I always run eva_ramboot.py on Linux, immediately after NetworkManager reports the connection as "Up".

mj69 · February 9, 2023, 5:42pm

I tried the recovery tool too, but it was searching the box at 192.168.178.1 again and again...

I've set a static ip for lan connection at 192.168.178.10/24
The box is connected directly to the laptop.

Somehow the box is hanging at the bootloader. I can ftp the box at 192.168.178.1 and login with adam2/adam2. So, this is also the reason, why I am sure that eva_ramboot.py can find the box too..

As of now I do not have linux. But I probably can get a raspberry pi, if that helps.

Any idea what I could do?

andyboeh · February 9, 2023, 5:49pm

I would try to get the recovery tool running first. Under the hood, it does the same thing as eva_ramboot.py, but if it works you can be sure that the device itself is working properly.

The usual things to try:

Hook up a switch between notebook and Fritz, sometimes the Ethernet connection doesn't come up quickly enough
Try a different Ethernet adapter (USB?)
Different notebook, preferably with a different windows version.
Exception to Windows Firewall added or Firewall disabled

That said: You can also try any live Linux, booted from USB, so no installation on your device is necessary. It should work with a Raspberry Pi too.

mj69 · February 10, 2023, 8:28am

I'll try to find another windows machine. There is a firewall installed on my laptop, which I cannot stop (it is a company laptop).

Also I'll try to use raspberry to connect to the box.

It is somehow odd. I can ping the box on 192.168.178.1 from my windows laptop (wifi is off). I can open an ftp session to the box. And I can get all the information on the box using quote GETENV ...
But AVM recovery cannot find the box (probably because of the firewall).
And eva_ramboot.py can find the box, but fail to install openwrt and gets timeout...

mj69 · February 13, 2023, 6:55am

I finally managed to get a raspberry.
This is what I've done:

set eth0 to static 192.168.178.10
from raspberry py try to find the Fritz!Box at 192.168.178.1 (with ping)
try to install uboot with eva_ramboot.

This is the output:

pi@RASPI2:~/Openwrt $ ls
eva_ramboot.py  uboot-fritz7530.bin
pi@RASPI2:~/Openwrt $ eva_ramboot.py
bash: eva_ramboot.py: command not found
pi@RASPI2:~/Openwrt $ sudo python eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz7530.bin
> SETENV memsize 0x00080000
Traceback (most recent call last):
  File "/home/pi/Openwrt/eva_ramboot.py", line 39, in <module>
    adam('SETENV memsize 0x%08x'%(addr))
  File "/home/pi/Openwrt/eva_ramboot.py", line 32, in adam
    resp = ftp.sendcmd(cmd)
  File "/usr/lib/python3.9/ftplib.py", line 279, in sendcmd
    return self.getresp()
  File "/usr/lib/python3.9/ftplib.py", line 242, in getresp
    resp = self.getmultiline()
  File "/usr/lib/python3.9/ftplib.py", line 228, in getmultiline
    line = self.getline()
  File "/usr/lib/python3.9/ftplib.py", line 210, in getline
    line = self.file.readline(self.maxline + 1)
  File "/usr/lib/python3.9/socket.py", line 704, in readinto
    return self._sock.recv_into(b)
ConnectionResetError: [Errno 104] Connection reset by peer
pi@RASPI2:~/Openwrt $

So there is no longer TimeoutError, but there is now a Connection reset by peer. The error came after arround 3 to 4 minutes...

@andyboeh: any further idea?

andyboeh · February 13, 2023, 7:19am

You did unplug your box from the power supply and replug it, right? It's not clear from your description, but all these commands only work directly after plugging-in the power cord, they won't work once the box has booted.
Then you waited until the ehternet connection was up and then you ran eva_ramboot.py immediately, right?

This leads me to believe that you were too late - 3-4 minutes looks like the boot time of the box.

Are you sure about the IP address? Sometimes, the boot loader is at a completely different address. The recovery tool displays this address.

mj69 · February 13, 2023, 7:43am

Yes, I did. I also was able to ftp to the box at 192.168.178.1 then I closed the ftp prior to firing the command eva_ramboot.

I hope, I haven't killed the box entirely

andyboeh · February 13, 2023, 8:01am

Don't. use eva_ramboot directly, no Ping or anything else before required. Just fire the command once the Ethernet connection is up. This has always worked for me, if no on the first try, then on the second

It's relatively hard to kill Fritz!Boxes, but you might have to attach a serial console cable in order to be able to see what's going on.

mj69 · February 13, 2023, 2:27pm

Just did as suggested. But the result is somehow the same:

pi@RASPI2:~/Openwrt $ sudo python eva_ramboot.py --offset 0x85000000 192.168.178.1 uboot-fritz7530.bin 
> SETENV memsize 0x00080000
Traceback (most recent call last):
  File "/home/pi/Openwrt/eva_ramboot.py", line 39, in <module>
    adam('SETENV memsize 0x%08x'%(addr))
  File "/home/pi/Openwrt/eva_ramboot.py", line 32, in adam
    resp = ftp.sendcmd(cmd)
  File "/usr/lib/python3.9/ftplib.py", line 279, in sendcmd
    return self.getresp()
  File "/usr/lib/python3.9/ftplib.py", line 242, in getresp
    resp = self.getmultiline()
  File "/usr/lib/python3.9/ftplib.py", line 228, in getmultiline
    line = self.getline()
  File "/usr/lib/python3.9/ftplib.py", line 210, in getline
    line = self.file.readline(self.maxline + 1)
  File "/usr/lib/python3.9/socket.py", line 704, in readinto
    return self._sock.recv_into(b)
ConnectionResetError: [Errno 104] Connection reset by peer

´´´

I tried to make sure that I can connect to the box. So I did the following after the ConnectionResetError:

pi@RASPI2:~/Openwrt $ ftp 192.168.178.1
Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
Name (192.168.178.1:pi): adam2
331 Password required for adam2
Password:
230 User adam2 successfully logged in
Remote system type is AVM.
ftp> quote GETENV ProductID
ProductID             Fritz_Box_HW236

So it was the prove that Fritz!Box can be found on the 192.168.178.1 and it was the right box (7530 = HW236).

I was also recording the tcp communication on eth0. Here is the dump:

14:54:14.346181 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:54:14.346462 ARP, Reply 192.168.178.1 is-at dc:15:c8:cd:b4:86 (oui Unknown), length 46
14:54:14.346489 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [S], seq 2897405717, win 64240, options [mss 1460,sackOK,TS val 1993322064 ecr 0,nop,wscale 7], length 0
14:54:14.346738 IP 192.168.178.1.ftp > 192.168.178.10.45686: Flags [S.], seq 35900, ack 2897405718, win 23040, options [mss 1440], length 0
14:54:14.346820 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [.], ack 1, win 64240, length 0
14:54:14.350128 IP 192.168.178.1.ftp > 192.168.178.10.45686: Flags [.], seq 1:29, ack 1, win 23040, length 28: FTP: 220 ADAM2 FTP Server ready
14:54:14.350149 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [.], ack 29, win 64212, length 0
14:54:14.350356 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 1:13, ack 29, win 64212, length 12: FTP: USER adam2
14:54:14.350606 IP 192.168.178.1.ftp > 192.168.178.10.45686: Flags [P.], ack 13, win 23028, length 0
14:54:14.350631 IP 192.168.178.1.ftp > 192.168.178.10.45686: Flags [P.], seq 29:62, ack 13, win 23028, length 33: FTP: 331 Password required for adam2
14:54:14.350729 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 13:25, ack 62, win 64179, length 12: FTP: PASS adam2
14:54:14.350977 IP 192.168.178.1.ftp > 192.168.178.10.45686: Flags [P.], ack 25, win 23028, length 0
14:54:14.350990 IP 192.168.178.1.ftp > 192.168.178.10.45686: Flags [P.], seq 62:101, ack 25, win 23028, length 39: FTP: 230 User adam2 successfully logged in
14:54:14.351231 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:14.563731 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:14.993723 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:15.883735 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:17.643732 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:21.083737 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:28.123768 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:42.203794 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:54:47.243697 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:54:48.283731 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:54:49.323732 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:55:09.723803 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:55:10.763724 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:55:11.803705 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:55:36.603814 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:55:37.643739 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:55:38.683742 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:03.483806 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:04.523724 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:05.563748 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:30.363794 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:31.403709 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:32.443698 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:57.243722 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:58.283703 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:56:59.323714 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:57:24.123773 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:57:25.163719 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:57:26.203721 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:58:18.523788 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:58:18.524076 ARP, Reply 192.168.178.1 is-at dc:15:c8:cd:b4:86 (oui Unknown), length 46
14:58:18.524122 IP 192.168.178.10.45686 > 192.168.178.1.ftp: Flags [P.], seq 25:52, ack 101, win 64140, length 27: FTP: SETENV memsize 0x00080000
14:58:18.526958 IP 192.168.178.1.ftp > 192.168.178.10.45686: Flags [R], seq 36001, win 23040, length 0
14:58:38.529604 IP6 fe80::fd24:b53e:14b9:7818.mdns > ff02::fb.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
14:58:43.714595 IP 192.168.178.10.mdns > 224.0.0.251.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
14:59:14.686349 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [S], seq 4267933725, win 64240, options [mss 1460,sackOK,TS val 1993622404 ecr 0,nop,wscale 7], length 0
14:59:14.686717 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [S.], seq 18882, ack 4267933726, win 23040, options [mss 1440], length 0
14:59:14.686838 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 1, win 64240, length 0
14:59:14.693195 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [.], seq 1:29, ack 1, win 23040, length 28: FTP: 220 ADAM2 FTP Server ready
14:59:14.693278 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 29, win 64212, length 0
14:59:19.723710 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
14:59:19.724027 ARP, Reply 192.168.178.1 is-at dc:15:c8:cd:b4:86 (oui Unknown), length 46
14:59:19.830941 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [P.], seq 1:13, ack 29, win 64212, length 12: FTP: USER adam2
14:59:19.831307 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], ack 13, win 23028, length 0
14:59:19.831378 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], seq 29:62, ack 13, win 23028, length 33: FTP: 331 Password required for adam2
14:59:19.831420 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 62, win 64179, length 0
14:59:22.473413 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [P.], seq 13:25, ack 62, win 64179, length 12: FTP: PASS adam2
14:59:22.473808 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], ack 25, win 23028, length 0
14:59:22.473875 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], seq 62:101, ack 25, win 23028, length 39: FTP: 230 User adam2 successfully logged in
14:59:22.473916 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 101, win 64140, length 0
14:59:22.474201 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [P.], seq 25:31, ack 101, win 64140, length 6: FTP: SYST
14:59:22.474514 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], ack 31, win 23034, length 0
14:59:22.474557 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], seq 101:142, ack 31, win 23034, length 41: FTP: 215 AVM EVA Version 1.11581 0x0 0x46409
14:59:22.523822 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 142, win 64099, length 0
14:59:42.531664 IP6 fe80::fd24:b53e:14b9:7818.mdns > ff02::fb.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
14:59:47.715706 IP 192.168.178.10.mdns > 224.0.0.251.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
14:59:56.466437 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [P.], seq 31:49, ack 142, win 64099, length 18: FTP: GETENV ProductID
14:59:56.466999 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], ack 49, win 23022, length 0
14:59:56.467069 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], seq 142:214, ack 49, win 23022, length 72: FTP: ProductID             Fritz_Box_HW236
14:59:56.467110 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 214, win 64027, length 0
15:00:48.291835 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [P.], seq 49:75, ack 214, win 64027, length 26: FTP: GETENV bootloaderVersion
15:00:48.292400 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], ack 75, win 23014, length 0
15:00:48.292477 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], seq 214:278, ack 75, win 23014, length 64: FTP: bootloaderVersion     1.11581
15:00:48.292519 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 278, win 63963, length 0
15:00:53.323697 ARP, Request who-has 192.168.178.1 tell 192.168.178.10, length 28
15:00:53.324009 ARP, Reply 192.168.178.1 is-at dc:15:c8:cd:b4:86 (oui Unknown), length 46
15:01:10.571906 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [P.], seq 75:81, ack 278, win 63963, length 6: FTP: QUIT
15:01:10.572286 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], ack 81, win 23034, length 0
15:01:10.572352 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [P.], seq 278:342, ack 81, win 23034, length 64: FTP: 221 Thank you for using the FTP service on ADAM2
15:01:10.572396 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [.], ack 342, win 63963, length 0
15:01:10.572450 IP 192.168.178.1.ftp > 192.168.178.10.38918: Flags [F.], seq 342, ack 81, win 23034, length 0
15:01:10.573881 IP 192.168.178.10.38918 > 192.168.178.1.ftp: Flags [R.], seq 81, ack 343, win 63963, length 0
15:01:50.531929 IP6 fe80::fd24:b53e:14b9:7818.mdns > ff02::fb.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)
15:01:55.717271 IP 192.168.178.10.mdns > 224.0.0.251.mdns: 0 [2q] PTR (QM)? _ipps._tcp.local. PTR (QM)? _ipp._tcp.local. (45)

As far as I can judge eva_ramboot found the box and logging into the box was successful, but the command SETENV memsize did not work.

I do not know much more to do now

andyboeh · February 13, 2023, 3:16pm

I'm sorry, I'm out of ideas then. I have a 7520, so the output of the ENV command is not really comparable. I also have a HWSubRevision set, but still the SETENV memsize command should succeed.

mj69 · February 13, 2023, 3:21pm

Thank you that you tried to help.

I hope that someone else is following our conversation and has some other idea. Let's wait and see...

mj69 · February 24, 2023, 9:14am

Has anyone experienced the same trouble?
I am really considering just to give up and giving the Fritz!Box away...

pstlr78 · February 24, 2023, 9:24am

@mj69 not sure if you have already tried this one exactly step-by-step. If not, maybe give it a try from scratch. It appears to be quite popular nowadays
I saw that you are a Windows user, so it might help you.
Btw, your journey with this box has just started...

mj69 · February 24, 2023, 3:28pm

@pstlr78 Thank you for the proposal. And indeed I found your step by step guideline. It is great.
The thing is that the eva_ramboot.py could not be processed successfully.
I get the following respond:

ConnectionResetError: [Errno 104] Connection reset by peer

pstlr78 · February 24, 2023, 4:51pm

Have you tried 4a or 4b as per this one ?
I do not think it is necessary to put linux/RPi into the equation. With windows it should be possible too, so use windows if you feel more comfortable.
I recall that I had some connection issues too at some point (do not remember exactly what was it) but 4b worked for me.