Unbrick W724v Typ B

For Developers
1

I got a W724V Type B which boots up into some web recovery tool. This is the HTML source:

Welcome to the u-boot web server!
Recovering Tool


Password:

I don't know what went wrong with it.
Now does anyone has a suggestion for the password?
I'm hoping that with the password the recovery tool will let me flash a firmware image from Telekom to get the router up running again.

2

Hello, i have a full nand backup of this router, but u need to write from an oopenwrt uboot. Intryed to port.openwrt on it, but cannot get wifi working

3

I guess this would first require soldering serial access to the box? Or is there any other way to get past the password and use the web interface or maybe something like tftp?

4

Yes, u need uart. And put device to uart mode. Flash uboot for openwrt, erase all nand and flash backup

5

I was hoping that the password of the existing uboot web interface could be found out and recovery would be done via that web interface.

6

I will upload the dump, and u try to inspect with a hex editor, maybe u will find what u need

7

This is the original.uboot, the nand backup is on local pc

8

Thanks. I'll give it a try.

9

When I use binwalk on the binary file I get:

DECIMAL       HEXADECIMAL     DESCRIPTION
----------------------------------------------------------------------------
----
139344        0x22050         CRC32 polynomial table, little endian
141312        0x22800         uImage header, header size: 64 bytes, header C
RC: 0x8E39E6C5, created: 2014-10-29 05:37:15, image size: 75328 bytes, Data
Address: 0xA0400000, Entry Point: 0xA0400000, data CRC: 0x34353F82, OS: Linu
x, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name
: "u-boot image"
141376        0x22840         LZMA compressed data, properties: 0x5D, dictio
nary size: 8388608 bytes, uncompressed size: 212892 bytes

I can extract and decompress the file at 0x22840. Using strings I can see that it does contain the relevant web pages, for example.
It should be some kind of file system image. How can I mount/extract it?

10

I am still unable to mount the extracted image (it's probably a kernel with an included filesystem). However I noticed the following text:
...
Authenticated!!!
/index.html
Fail!
Passord length should be 6, your input is %d
Need password.
...

Then I recalled reading on https://openwrt.org/toh/t-com/spw722vtypb that the access password should be the first four characters of the device password (printed on the sticker on the router's casing). So maybe for the 724vtypeb they went for the first six characters?
Turns out to be correct!
I can access the recovering tool menu now.