Hello, I downloaded from the Astoria the latest soruce code for the 904LTE. Following the instructions containted into the readme I ran the configurator but I left the default settings and then I ran the make. It worked well except for an #include that I added manually. At the end into the bin folder I found the img file (there was a lot of files).

Following the rescue procedure and TFTP I uploded the img and then, as soon as the router completed the update I restarted the router. The router automatically restarted few times and now I have a message on the LCD saying that the boot is not correct and that I can repeat the rescue procedure.

Any suggestion on this? Are you aware about parameters that need to be enable or disable into the make configuration procedure??

Thank you very much for the information you would like to share.

I will continue my investigation and in case of any update I will post the results here.

Lorenzo

(Last edited by bubusoft on 15 Aug 2014, 10:35)

After some hours I got access with SSH to the box.
I unpack the SquashFS from 3.12, created a RSH-2 key pair and added the public key to the  authorized_keys file in /etc/certs
Then create a new SquashFS added the old header and merge it into the file.
Then flash the file with TFTP method to the box. Now I have root access with putty.

BigDee

[Edit2]
Now I can activate the box without installation code. I think it can be operated on other DSL connections as Vodafone. I can also read/write the whole logins and passwords. You have to use the ccfg_cli command to get and set the properties.
But two things I haven't get realized. USB2Serial driver and add SIP Accounts. After adding Sip Account the log shows an 401 error but I can't find the entries in the file system. I think the whole telephone part is managed from brnsip process. It look like Asterisk...

(Last edited by BigDee on 18 Aug 2014, 09:51)

@bubusoft
I had the same problem here. I tried to build firmware 3.07 and 3.10, but it reboots always after the kernel was loaded into memory and i have no syslog or serial output for debugging. Only the original firmware worked well.
I think something is missing in the makefile, because my final image from source code is about 12 MB and the original is about 23 MB.

Has anyone a solution for this problem?

I think the whole Arcadyan copyrighted material (brnsip , http-brn,ccfg...) is missed. You have to copy it to your created image.

(Last edited by BigDee on 21 Aug 2014, 21:28)

Now I bricked my 904xDSL. I probably set a wrong uboot_env property.
Has someone an idea to unbrick? The TFTP method to flash a fullimage don't work. Because in the 3.16 is no uBoot configuration...
Has someone an older fullimage e.g. 2.06 for xDSL model?
[Edit]
I take a look into to sources of uBoot of the my xDSL and it seems that the password is different to LTE model.
The hash is 554beec588aa530c6723ffedb0e34a8778b1b6dd.

(Last edited by BigDee on 25 Aug 2014, 18:22)

@Morpheu5: same image size, close to 12Mb
@BigDee: do you have any update on how to Arcadyan copyrighted material? I do not know what you mean exactly

I haven't any details because the build always fails on my site. So I can't compare. But take the fullimage and unpack it. Then compare with your squashfs.
I think the best way is to use the fullimage, unpack it, make your changes, pack it into a new squashfs and merge it into the old fullimage. Then transfer the new image to the box. This is the workflow which works on my site.

(Last edited by BigDee on 28 Aug 2014, 11:22)

@BigDee maybe this will help you. I can confirm this hash on my xDSL model. I would be grateful if someone has the corresponding password

When i had built the firmware i noticed that the makefile fails a few times. But after a few attempts it works and there is a fullimage at the \bin folder.

@BigDee: I have tried to modify the fullimage (3.16) according to your description to get ssh access...

But finally after flashing the box, I'm ending up in...

Can somebody share an image where I can reliably recover the box? The orginal fullimages don't work for me.

My Easybox 904 LTE stops and will a restart with 10 seconds reset and then a fullimage.img on TFTP server but the original firmware is not a correct image. Can somebody share an image where I can reliably recover my box?

How did you extract / rebuild the firmware?
I tried  firmware-mod-kit and binwalk but when i flash it, something is wrong with the magic number.
How can i rebuild the firmware with those signatures?

firmware-mod-kit is also using binwalk to identify the individual portions of the firmware.

To extract the rootfs FMK is fine. The problem is the structure of the firmware which consist of the rootfs + signature and the kernel + signature. Afaik the FMK is not able to handle that properly, so I have split the firmware after the uImage, keeping the rest (signature + kernel + signature) in a separate file and only processing the uImage with FMK. Do my changes and create a new "firmware" with FMK. Then afterwards I attach the rest file to new firmware.
This firmware is flashable (no complain during TFTP), but the rootfs signature is for sure invalid. I assume BigDee has done something similar.

My device is currently bricked, I'm not able to recover it, flashing any (even official) firmware via the TFTP method. Hopefully BigDee can give some input...

(Last edited by tafkas on 9 Sep 2014, 23:06)

My Easybox 904xDSL is bricked as well. I can still flash via TFTP method, but the device is in a reboot loop even if i flashing the (unmodified) original firmware. Serial terminal shows that the reset is happening right after the Starting Kernel message.

any ideas?

@chipmunk

To fix the box with original firmware you must rename the original firmware file  to fullimage.img and place it in TFTP folder.
Pot the box in to recovery mode, etc.... It will work and reboot normally. Tested.

@BigDee

Can you share  the image which you have created to fix root access with putty ?

I have 2.07  firmware file if you need!

Hello,

this is my first post in this forum.
I am a proud owner of an easybox 904 LTE and want to change, like a lot of people too, the apn. Has anybody found a possibility to do this?
The firmware is just on my computer.
Middey, you posted, that you can send a firmware with this i can change the apn over a shell. Is this right?

Greetings, Mathias

Thanks for your reply. Flashing an unmodified and correct renamed version 3.12 image doesn't help. Although it says that flashing was successful the router is still in a reboot loop. But i like to try your firmware file as well. Can you share a link to your 2.07 ? (Is it really 2.07 or do you have a 3.07 ?)

https://www.dropbox.com/s/cpgyctri6irtp … 6.BIN?dl=0

Hello @all!
I'm new to OpenWrt and my linux experiences is more like a power user willing to experiment a little. With a little pain I managed to compile OpenWrt 904lte specific with the sources uwehermann supplied (https://github.com/uwehermann/easybox-904-xdsl-firmware). The compilation process ended up without any errors.
Here's the problem I ran into: After compilation I have a new folder "bin" in the folder I was running the build/make. There are three files (md5sums, openwrt-ltqcpe-squashfs.image, openwrt-ltqcpe-ulmage) and two folders (packages, platform_vr9) and an archive (kernel-debug.tar.bz2). Within "platform_vr9" I have a file named "fullimage.bin" with 10.3 MB. I used this file for the recovery procedure running a TFTP Server on my Mac (192.168.2.100) and attached the 904lte directly via an ethernet cable. I held the reset button for more than 5 secs after poweron and the box came up with the message regarding the recovery mode. After a blink of an eye it said that the fullimage.bin was downloaded and that I should poweroff to restart. Now it's caught in a boot loop. Bricked, grrr…
So, what did I do wrong? I tried to use "UEfullimage_AT904L-03.07.01.08.bin" (latest firmware from vodafone) renamed to "fullimage.bin" but the box wouldn't use this stating it's the wrong type of image.
Any hints are highly appreciated. Have I used the right file? Do I need to process the compilation output any further to have a correct "fullimage.bin"? Many, many thanks in advance!

@celenhein
Thank you very much for sharing the link. I flashed that image, but i'm still having a boot loop. Here is the serial output after flashing:

NAND Read OK

ROM VER: 1.1.4
CFG 06
NAND
NAND Read 
OK
nand_read_page - 00000008
DDR autotuning Rev 0.3c
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...




U-Boot 2010.06-Lv2.0.40-A0.5 (Nov 22 2012 - 15:40:12)

CLOCK CPU 500M RAM 250M
DRAM:  128 MiB

NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x000014740000

In:    serial
Out:   serial
Err:   serial
Net:   
Internal phy(GE) firmware version: 0x040b
vr9 Switch

Type "run flash_nfs" to mount root filesystem over NFS


Hit any key to stop autoboot:  1 
\0x08\0x08\0x08 0 

Uncompressing LCD bootup images ............... 
NAND read: device 0 o
ffset 0x0000000004700000, size 0x0000000000300000

 0x300000 bytes read: OK

1. bootid : 0, bootnum : 0
Writing to Nand... 
Erasing at 0x4540000 --  50% complete.
Erasing at 0x4560000 -- 100% complete.

done
2. bootid : 0, bootnum : 1

NAND read: device 0 offset 0x0000000003c40000, size 0x0000000000500000

 0x500000 bytes read: OK
## Booting kernel from Legacy Image at 80800000 ...

   Image Name:   MIPS LTQCPE Linux-2.6.32.32
   Created:      2013-07-24   4:23:47 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572800 Bytes = 1.5 MiB
   Load Address: 80002000
   Entry Point:  800061b0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 
OK

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2


ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
nand_read_page - 00000008
DDR aut
otuning Rev 0.3c
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...




U-Boot 2010.06-Lv2.0.40-A0.5 (Nov 22 2012 - 15:40:12)

CLOCK CPU 500M RAM 250M

DRAM:  128 MiB
NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x000014740000
In:    serial
Out:   serial
Err:   serial
Net:   
Internal phy(GE) firmware version: 0x040b
vr9 Switch

Type "run flash_nfs" to mount root filesystem over NFS


Hit any key to stop autoboot:  1 
\0x08\0x08\0x08 0 

Uncompressing LCD bootup images ............... 
NAND read: device 0 offset 0x0000000004700000, size 0x0000000000300000

 0x300000 bytes read: OK

1. bootid : 0, bootnum : 1
Writing to Nand... 
Erasing at 0x4540000 --  50% complet
e.
Erasing at 0x4560000 -- 100% complete.
done
2. bootid : 0, bootnum : 2

NAND read: device 0 offset 0x0000000003c40000, size 0x0000000000500000

 0x500000 bytes read: OK
## Booting kernel from Legacy Image at 80800000 ...
   Image Name:   MIPS LTQCPE Linux-2.6.32.32
   Created:      2013-07-24   4:23:47 UTC
   Im
age Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572800 Bytes = 1.5 MiB
   Load Address: 80002000
   Entry Point:  800061b0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 
OK

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2


ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
nand_read_page - 00000008
DDR autotuning Rev 0.3c
DDR size from 0xa0000000 - 0xa7ffffff

DDR check ok... start booting...




U-Boot 2010.06-Lv2.0.40-A0.5 (Nov 22 2012 - 15:40:12)

CLOCK CPU 500M RAM 250M
DRAM:  128 MiB

NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x000014740000
In:    serial
Out:   serial
Err:   serial
Net:   
Internal phy(GE) firmware version: 0x040b
vr9 Switch

Type "run flash_nfs" to mount root filesyst
em over NFS


Hit any key to stop autoboot:  1 
\0x08\0x08\0x08 0 

Uncompressing LCD bootup images ............... 
NAND read: device 0 offset 0x0000000004700000, size 0x0000000000300000

 0x300000 bytes read: OK

1. bootid : 0, bootnum : 2
Writing to Nand... 
Erasing at 0x4540000 --  50% complete.
Erasing at 0x4560000 -- 100% complete.

done
2. bootid : 0, bootnum : 3

NAND read: device 0 offset 0x0000000003c40000, size
 0x0000000000500000

 0x500000 bytes read: OK
## Booting kernel from Legacy Image at 80800000 ...
   Image Name:   MIPS LTQCPE Linux-2.6.32.32
   Crea
ted:      2013-07-24   4:23:47 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572800 Bytes = 1.5 MiB
   Load Address: 80002000
   Entry Point:  800061b0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 
OK

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2


ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
nand_read_page - 00000008
DDR autotuning Rev 0.3c
DDR size from 0xa0000000 - 
0xa7ffffff
DDR check ok... start booting...




U-Boot 2010.06-Lv2.0.40-A0.5 (Nov 22 2012 - 15:40:12)

CLOCK CPU 500M RAM 250M
DRAM:  128 MiB

NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x000014740000

In:    serial
Out:   serial
Err:   serial
Net:   
Internal phy(GE) firmware version: 0x040b
vr9 Switch

Type "run flash_nfs" to moun
t root filesystem over NFS


Hit any key to stop autoboot:  1 
\0x08\0x08\0x08 0 

Uncompressing LCD bootup images ............... 
NAND read: device 0 offset 0x0000000004700000, 
size 0x0000000000300000

 0x300000 bytes read: OK

1. bootid : 0, bootnum : 3
Writing to Nand... 
Erasing at 0x4540000 --  50% complete.
Erasing at 0x4560000 -- 100% complete.

done
2. bootid : 0, bootnum : 4

NAND read: device 0 offset 0x0000000003c40000, size 0x0000000000500000

 0x500000 bytes read: OK
## Booting kernel from Legacy Image at 80800000 ...
   Image Name:   MIPS L
TQCPE Linux-2.6.32.32
   Created:      2013-07-24   4:23:47 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572800 Bytes = 1.5 MiB
   Load Address: 80002000
   Entry Point:  800061b0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 
OK

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, co
unter_resolution = 2


ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
nand_read_page - 00000008
DDR autotuning Rev
 0.3c
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...




U-Boot 2010.06-Lv2.0.40-A0.5 (Nov 22 2012 - 15:40:12)

CLOCK CPU 500M RAM 250M
DRAM:  128 MiB

NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x000014740000

In:    serial
Out:   serial
Err:   serial
Net:   
Internal phy(GE) firmware version: 0x040b
vr9 Switch

Type "run flash_nfs" to mount root filesystem over NFS


Hit any key to stop autoboot:  1 
\0x08\0x08\0x08 0 

Uncompressing LCD bootup images ............... 
NAND read: devic
e 0 offset 0x0000000004700000, size 0x0000000000300000

 0x300000 bytes read: OK

1. bootid : 0, bootnum : 4
Writing to Nand... 
Erasing at 0x4540000 --  50% complete.
Erasing at 0x4560000 -- 
100% complete.
done
2. bootid : 0, bootnum : 5

NAND read: device 0 offset 0x0000000003c40000, size 0x0000000000500000

 0x500000 bytes read: OK
## Booting kernel from Legacy Image at 8080000
0 ...
   Image Name:   MIPS LTQCPE Linux-2.6.32.32
   Created:      2013-07-24   4:23:47 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572800 Bytes = 1.5 MiB
   Load Address: 80002000
   Entry Point:  800061b0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 
OK

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2


ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
nand_read_page 
- 00000008
DDR autotuning Rev 0.3c
DDR size from 0xa0000000 - 0xa7ffffff
DDR check ok... start booting...




U-Boot 2010.06-Lv2.0.40-A0.5 (Nov 22 2012 - 15:40:12)

CLOCK CPU 500M RAM 250M
DRAM:
  128 MiB
NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x000014740000
In:    serial
Out:   serial
Err:   serial
Net:   
Internal phy(GE) firmware version: 0x040b
vr9 Switch

Type "run flash_nfs" to mount root filesystem over NFS


Hit any key to stop autoboot:  1 
\0x08\0x08\0x08 0 

Uncompressing LCD bootup images ............... 
NAND read: device 0 offset 0x0000000004700000, size 0x0000000000300000

 0x300000 bytes read: OK

1. bootid : 0, bootnum : 5
Writing to Nand... 
Erasing at 0x4540000 --  50% compl
ete.
Erasing at 0x4560000 -- 100% complete.
done
2. bootid : 0, bootnum : 6

NAND read: device 0 offset 0x0000000003c40000, size 0x0000000000500000

 0x500000 bytes read: OK
## Booting kernel from Legacy Image at 80800000 ...
   Image Name:   MIPS LTQCPE Linux-2.6.32.32
   Created:      2013-07-24   4
:23:47 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1572800 Bytes = 1.5 MiB
   Load Address: 80002000
   Entry Point:  800061b0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... 
OK

Starting kernel ...

Lantiq xDSL CPE VR9
mips_hpt_frequency = 250000000, counter_resolution = 2


ROM VER: 1.1.4
CFG 06
NAND
NAND Read OK
nand_read_page - 00000008
DDR autotuning Rev 0.3c
DDR size from 0xa0000000 - 0xa7ffffff

DDR check ok... start booting...




U-Boot 2010.06-Lv2.0.40-A0.5 (Nov 22 2012 - 15:40:12)

CLOCK CPU 500M RAM 250M
DRAM:  128 MiB

NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0xdc (Samsung NAND 512MiB 3,3V 8-bit)
512 MiB
Bad block table found at page 262080, version 0x01
Bad block table found at page 262016, version 0x01
nand_read_bbt: Bad block at 0x000014740000
In:    serial
Out:   serial
Err:   serial
Net:   
Internal phy(GE) firmware version: 0x040b
vr9 Switch

Type "run flash_nfs" to mount root fil
esystem over NFS


Hit any key to stop autoboot:  1 
\0x08\0x08\0x08 0 

Uncompressing LCD bootup images ............... 
NAND read: device 0 offset 0x0000000004700000, size 0x0000000000300000

 0x300000 bytes read: OK

1. bootid : 0, bootnum : 6
Writing to Nand... 
Erasing at 0x4540000 --  50% complete.
Erasing at 0x4560000 -- 1
00% complete.
done
2. bootid : 2, bootnum : 7

NAND read: device 0 offset 0x000000001fa00000, size 0x0000000000500000

 0x500000 bytes read: OK
Wrong Image Format for bootm command
ERROR: 
can't get kernel image!
Writing to Nand... 
Erasing at 0x4540000 --  50% complete.
Erasing at 0x4560000 -- 100% complete.
done
Uncompressing LCD bootup images ............... 
NAND read: device 0 offset 0x0000000004700000, size 0x0000000000300000

 0x300000 bytes read: OK



please input password : 

@the_m-pire
Please check your file names. In recovery mode it should be named "fullimage.img". But i think you got it right, because you bricked the box. ;-) At the moment it is not known how to get out of the boot loop and the serial output doesn't help either. You can try the image from celenhein. But that didn't worked for me. Maybe it does for you?

@all
Did anyone found a jtag connector on the board?

Checked it. Filenames are correct. Would have loved a solution as easy as this ;-)

Whoohooo! I feel like a hacker now. Bought the box together with an antenna I was looking for. So it's not too sad. But I'm looking forward to unbricking it anytime…

Tried it and it doesn't work. Box says that it was the wrong image. The only image it really accepts is the OpnWrt Image I compiled.

@all: Is anyone of you in touch with uwehermann who put that stuff on github. I'ld like to think that he might know more about it, what you think?

Sorry, I did not read all posts before writing this post, so I might repeat something, but here we go

The provided source is based on backfire openwrt. Since then, some tools have changed which causes the archive to be impossible to build. On an older system however, it builds just fine. I tried building all released source files, all of them failed to boot in the way described by chipmunk.

Then, I tried to integrate the changes made back into a fresh checkout of the backfire branch. Especially tricky is the fact that they use an external kernel tree and additionally provide some patches, which do not cover all changes made to the kernel.
Right now, I already have a booting kernel, but no periphery at all works, not even a link on the ethernet ports.

About the bootloader:
The password entered is compared to a SHA1 hash. However, the input to the hash function is always 16 Bytes. If the password has less then 16 Bytes, it is padded with \0 bytes. This will make it impossible to find the hash in any common rainbow table.

I also dumped the bootloader partition and tried to see if the source provided matches the actual code on the device. Part of the bootloader in compressed by LZMA but binwalk extracts that part just fine. While the binary "u-boot" contains the bytes in the sourcecode, the dumped binary does not contain it. I therefore think, that the actual hash is not the same as in the released source.

any news about this topic ?
someone have open source image and can share ?

Push

Is there a bootable self compiled Bin file?

Did someone locate the jtag pins?

It would be nice to have the boot log of the boxes that are in a bootloop.

Oh i see you have already posted an bootlog it seems that the Image you have flashed had disabled the output for the kernel messages to the console.
How have you created the image ? Have you added a script at the autorun which enables the serial output ?
I modified the bootloader of the Easybox 904 so that it allows to access it with any password. I flashed it and it works without a Problem
Have somebody created an Image from the GPL Sources that have drivers for the LAN or WLAN interfaces ?

Best regards