User Tools

Site Tools


inbox:avm:avm_avm_fritz_box_fon_wlan_7113

AVM Fritz!Box Fon WLAN 7113

The Fritz!Box Fon WLAN 7113 is a small DSL router that is also sold with DSL contracts from DSL provider 1&1 in Germany.

Supported Versions

Not supported (April 2017). Try freetz for custom stock firmware.

Hardware Highlights

SoC Ram Flash Network USB Serial JTag
AR7 32 MiB 8 MiB 1x maybe 2x unknown

Manufacturer's site: http://avm.de/service/fritzbox/fritzbox-7113/uebersicht/

Forum: (No forum topics)

Installation

There is no OpenWRT support for this device at the moment.

Flash Layout

This is the MTD layout of the vendor firmware from /proc/mtd

dev size erasesize name
mtd0 0x800000 0x10000 "phys_mapped_flash"
mtd1 0x6d3000 0x10000 "filesystem"
mtd2 0x770000 0x10000 "kernel"
mtd3 0x10000 0x10000 "bootloader"
mtd4 0x40000 0x10000 "tffs (1)"
mtd5 0x40000 0x10000 "tffs (2)"
mtd6 0x200000 0x10000 "jffs2"
mtd7 0x570000 0x10000 "Kernel without jffs2"

MTD partitions as seen in /var/env

partition
mtd0 0x90000000 0x90000000
mtd1 0x90010000 0x90780000
mtd2 0x90000000 0x90010000
mtd3 0x90780000 0x907C0000
mtd4 0x907C0000 0x90800000

Failsafe mode

Buttons

The Fritz!Box Fon WLAN 7113 has one button.

BUTTON Event
WLAN WLAN on/off

Vendor firmware

These are the default settings for the vendor firmware:

  • IP address: 192.168.178.1 (with DHCP server, served IPs start at 192.168.178.20)
  • WLAN SSID: Fritz!Box Fon WLAN 7113
  • password: no password
  • Telnet: disabled

Enable/disable telnet

Telnet access can be enabled by connecting a telephone to one of the telephone ports and dialing the number #96*7*. The Fritz!Box will answer with one dial tone. Disabling telnet can be done with dialing #96*8*.

Hardware

Info

Instruction set: MIPS
Bootloader: EVA (Version 1.310)
System-On-Chip: AR7 OHIO (TNETTD7200DW)
CPU @Frq MIPS 4KEc V4.8 @ 125 MHz
Flash size: 8192 KiB
Flash Chip: MACRONIX Top-MirrorBit-Flash 8MB 32 Bytes WriteBuffer
RAM size: 32 MiB
RAM Chip:
Wireless:
Switch: n/a
Modem: (DSL Annex-B)
USB: No USB port, may be possible
Serial: 2x
JTAG: unknown

Devices/Drivers

Interrupts

  • 1: System timer (OHIO System)
  • 6: OHIO primary (OHIO System)
  • 15: serial (OHIO primary)
  • 23: SAR (OHIO primary)
  • 27: Cpmac driver (OHIO primary)
  • 28: ubki2_swirq (OHIO primary)
  • 31: DSL (OHIO primary)

Ethernet

Driver: avm_cpmac

Clocks

There are several clocks installed as part of the OHIO system. The list below shows their frequencies when using the vendor firmware (found in /proc/clocks)

  • CPU: 125000 kHz
  • System: 125000 kHz
  • USB: 100000 kHz
  • DSP: 211968 kHz
  • VLYNQ: 0 kHz

Photos

Opening the case

Note: This will void your warranty!

To open the case you need a small flat screwdriver. However there are no screws you need to unscrew.

  • First you have to remove the reflecting plastic cover. You need to place the small screwdriver between the cover and the case. Then you need to lever the cover with the screwdriver.

avm_fb7112_open_3.jpg avm_fb7112_open_4.jpg

  • The case is splitted into an upper and lower part. On all sides there is a slit where both parts of the case are put together. You need to place the small screwdriver in one edge at the slit and lever the upper part of the case.

avm_fb7112_open_5.jpg

  • To unmount the PCB you have to use the small screwdriver and lever the pcb on one of the frond edges.

avm_fb7112_open_6.jpg

Photo of PCB

Top

Bottom

Serial

port.serial general information about the serial port, serial port cable, etc.

There are two serial ports available: tty0 and tty1. tty0 is for booting. The serial mode for both ports is: 38400,n,8,1,hw

How to connect to the Serial Port of this specific device:

FritzBox7112 3V3 RX TX GND serial mode
Board square cirlce cirlce cirlce
Siemens Data Cable white blue black sudo screen /dev/ttyUSB0 38400
Cutecom: Rate: 38400, Flow: none, Data: 8, Stop: 1, Parity: none → got no input @BoxFTPMode

Photo of PCB with markings

JTAG

port.jtag general information about the JTAG port, JTAG cable, etc.

How to connect to the JTAG Port of this specific device: TODO

Photo of PCB with markings

Backup Firmware

FTP

connection to FritzBox: Lan, Serial (optional)

It is possible to do a "blind backup" without Serial connected:

  • set PC-Lan-IP to: 192.168.178.3, Sub: 255.255.255.0, Gateway: 192.168.178.1
  • start serial terminal
  • power on FritzBox → interrupt boot immediately pressing a key in serial terminal, then start FTP connection
  • OR power on FritzBox → immediately start FTP connection (did not work - try again connecting a bit later), first 5seconds it accepts ftp connections - ping 192.168.178.1 for 5sec can help

ftp 192.168.178.1
Connected to 192.168.178.1.
220 ADAM2 FTP Server ready
Name (192.168.178.1:..): adam2
331 Password required for adam2
Password: adam2
230 User adam2 successfully logged in
Remote system type is AVM.
ftp> quote MEDIA FLSH
200 Media set to MEDIA_FLASH
ftp> passive
Passive mode on.
ftp> binary
200 Type set to BINARY
ftp> get mtd2 urloader_backup.image
227 Entering Passive Mode (192,168,178,1,6,193)
150 Opening BINARY data connection
^C                                            <-- press: CTRL-C, not too early - wait for data beeing transferred
receive aborted
waiting for remote to finish abort
226 Transfer complete
502 Command not implemented
65536 bytes received in 67.12 secs (1.0 kB/s) <-- size of "65536 bytes received" matters, kB/s is faulty if CTRL-C was used
ftp> get mtd1 firmware_backup.image
227 Entering Passive Mode (192,168,178,1,6,193)
150 Opening BINARY data connection
^C                                            <-- press: CTRL-C, not too early - wait for data beeing transferred
receive aborted
waiting for remote to finish abort
226 Transfer complete
502 Command not implemented
xxxxxxxx bytes received in xx.xx secs (xx.x kB/s) <-- size of "xxxxxxxx bytes received" matters, kB/s is faulty if CTRL-C was used
ftp> quote REBOOT
ftp> quit

TFTP

connection to FritzBox: Serial & Lan

  • get a TFTP Server, e.g. tftpgui version 2.2 - version 3.1 (did not work on Ubuntu 16.10, April2017), check required packages: sudo apt-get install python python-tk
  • set PC-Lan-IP to: 192.168.178.3, Sub: 255.255.255.0, Gateway: 192.168.178.1
  • start tftpgui: sudo python tftpgui.py
  • start serial terminal, power on FritzBox and wait till boot finished, press Enter to activate BusyBox console
  • BusyBox - backup Bootloader: cat /dev/mtdblock3 | tftp -p -l - -r urlader.image 192.168.178.3
  • BusyBox - backup Firmware: cat /dev/mtdblock7 | tftp -p -l - -r firmware.image 192.168.178.3
  • images should be in ../tftpgui/tftproot

Flash Firmware

Web Interface

Default IP: 192.168.178.1

Emergency IP: Box is always available on http://169.254.1.1. Set PC-IP address manually in range of 169.254.1.x

If a default password is set try: 0000

Web Interface works in most cases if image fits.

FTP

connection to FritzBox: Lan, Serial (optional)

Use FTP if Web Interface is unreachable or image is not accepted. Flashing a non fitting image causes Box not to boot showing "Invalid PC Value. <ERROR: FIRMWARE_CHECK_SUM>" seen at serial console. Flashing back firmware backup or stock kernel.image via FTP helps.

It is possible to do a "blind flash" without Serial connected. Flashing back Bootloader not tested & recommended (watch out for mtd2).

  • set PC-Lan-IP to: 192.168.178.3, Sub: 255.255.255.0, Gateway: 192.168.178.1
  • start serial terminal
  • power on FritzBox → interrupt boot immediately pressing a key in serial terminal, then start FTP connection
  • OR power on FritzBox → immediately start FTP connection (did not work - try again connecting a bit later), first 5seconds it accepts ftp connections - ping 192.168.178.1 for 5sec can help

ftp 192.168.178.1
User: adam2
Pwd: adam2
bin
passiv
quote MEDIA FLSH
put kernel.image mtd1
quote REBOOT
quit
Important: while flashing wait for ftp promt showing up again ("blind flash") or watch in serial terminal: erase mtd1 …. flash …..

(optional) erase configuration partition mtd3 & mtd4 @serial terimal:

erase mtd3
erase mtd4
restart

Debricking

→ get stock firmware → rename it to .tar → find and extract kernel.image → flash kernel.image

→ bootloop of a faulty device → build a minimal firmware.image:

  • make menuconfig
  • check everything @ "Removal patches" except "Remove WLAN"
  • @ "Other patches" disable all "AVM daemons"
  • rename firmware to .tar → find and extract kernel.image → flash kernel.image

generic.debrick

Bootloader Mods

Currently none.

Hardware mods

Currently none.

Bootlogs

OEM bootlog

Bootloop @ DSL :-(

(AVM) EVA Revision: 1.310 Version: 1310 (C) Copyright 2005 AVM Date: Aug 22 2007 Time: 16:35:53 (3) 2 0x0-0x41D [FLASH:] MACRONIX Top-MirrorBit-Flash 8MB 32 Bytes WriteBuffer [FLASH:](Eraseregion [0] 127 sectors a 64kB) [FLASH:](Eraseregion [1] 8 sectors a 8kB) [SYSTEM:] OHIO on 125MHz/125MHz syncron Eva_AVM > [cpmac]<no link> AVM decompress Kernel: ..............executeProgram on 0x941B5000 [ohio_pre_init] System Clk = 62500000 Hz LINUX started... 3init started: BusyBox v1.1.2 (2008.02.13-13:24+0000) multi-call binary init started: BusyBox v1.1.2 (2008.02.13-13:24+0000) multi-call binary Starting pid 98, console /dev/ttyS0: '/etc/init.d/rc.S' HWRevision 129 ProductID Fritz_Box_7113 SerialNumber 0000000000000000 annex B autoload yes bootloaderVersion 1.310 bootserport tty0 cpufrequency 125000000 firstfreeaddress 0x946C0D14 firmware_version 1und1 firmware_info 60.04.68 flashsize 0x00800000 maca 00:1C:4A:45:EE:C4 macb 00:1C:4A:8F:6E:18 macwlan 00:1C:4A:8F:6E:19 macdsl 00:1C:4A:8F:6E:1A memsize 0x01000000 modetty0 38400,n,8,1,hw modetty1 38400,n,8,1,hw mtd0 0x90000000,0x90000000 mtd1 0x90010000,0x90780000 mtd2 0x90000000,0x90010000 mtd3 0x90780000,0x907C0000 mtd4 0x907C0000,0x90800000 my_ipaddress 192.168.178.1 prompt Eva_AVM ptest req_fullrate_freq 125000000 sysfrequency 125000000 urlader-version 1310 usb_board_mac 00:1C:4A:8F:6E:1B usb_rndis_mac 00:1C:4A:8F:6E:1C usb_device_id 0x0000 usb_revision_id 0x0000 usb_device_name USB DSL Device usb_manufacturer_name AVM wlan_key 7715198445792621 wlan_cal 0008,03FA,001E,00C0,010A,00BE,010A,02A2,028F mknod: /var/flash/ar7.cfg: File exists checkempty: : No such file or directory PigletMode: 0 insmod: cannot insert `/lib/modules/2.6.13.1-ohio/kernel/drivers/char/Piglet_noemif/Piglet_noemif.ko': Success (512): Success modprobe: failed to load module Piglet_noemif attempting to load DSL Firmware '/lib/modules/microvoip-dsl.bin' **** ANNEX: 'B' ************************************* setting DSL Firmware to Annex B


Freetz bootlog

Freetz-devel-14237, minimal config → fixed DSL bootloop, Box workin again :-)

(AVM) EVA Revision: 1.310 Version: 1310 (C) Copyright 2005 AVM Date: Aug 22 2007 Time: 16:35:53 (0) 2 0x0-0x41D [FLASH:] MACRONIX Top-MirrorBit-Flash 8MB 32 Bytes WriteBuffer [FLASH:](Eraseregion [0] 127 sectors a 64kB) [FLASH:](Eraseregion [1] 8 sectors a 8kB) [SYSTEM:] OHIO on 125MHz/125MHz syncron Eva_AVM > [cpmac]<no link> AVM decompress Kernel: ..............executeProgram on 0x941B5000 [ohio_pre_init] System Clk = 62500000 Hz LINUX started... 3init started: BusyBox v1.24.2 (2017-04-17 16:09:23 CEST) rootdir=/ table='/etc/device.table' HWRevision 129 ProductID Fritz_Box_7113 SerialNumber 0000000000000000 annex B autoload yes bootloaderVersion 1.310 bootserport tty0 cpufrequency 125000000 firstfreeaddress 0x946C0D14 firmware_info 60.04.68 flashsize 0x00800000 maca 00:1C:4A:45:EE:C4 macb 00:1C:4A:8F:6E:18 macwlan 00:1C:4A:8F:6E:19 macdsl 00:1C:4A:8F:6E:1A memsize 0x01000000 modetty0 38400,n,8,1,hw modetty1 38400,n,8,1,hw mtd0 0x90000000,0x90000000 mtd1 0x90010000,0x90780000 mtd2 0x90000000,0x90010000 mtd3 0x90780000,0x907C0000 mtd4 0x907C0000,0x90800000 my_ipaddress 192.168.178.1 prompt Eva_AVM req_fullrate_freq 125000000 sysfrequency 125000000 urlader-version 1310 usb_board_mac 00:1C:4A:8F:6E:1B usb_rndis_mac 00:1C:4A:8F:6E:1C usb_device_id 0x0000 usb_revision_id 0x0000 usb_manufacturer_name AVM wlan_cal 0008,03FA,001E,00C0,010A,00BE,010A,02A2,028F mknod: /var/flash/ar7.cfg: File exists Loading /var/flash/freetz ... done. Loading users, groups and passwords ... done. Loading hosts ... done. Loading config ... done. Loading modules ... done. checkempty: : No such file or directory PigletMode: 1 modprobe: can't load module Piglet_noemif (/lib/modules/2.6.13.1-ohio/kernel/drivers/char/Piglet_noemif/Piglet_noemif.ko): No such file or directory attempting to load DSL Firmware '/lib/modules/dsp_ur8/ur8-B-dsl.bin' Error: '/lib/modules/dsp_ur8/ur8-B-dsl.bin' not found **** ANNEX: 'B' ************************************* setting DSL Firmware to Annex B modprobe: can't load module tiatm (/lib/modules/2.6.13.1-ohio/kernel/drivers/atm/avm_atm/tiatm.ko): No such file or directory modprobe: can't load module kdsldmod (/lib/modules/2.6.13.1-ohio/kernel/drivers/dsld/kdsldmod.ko): No such file or directory MAC WLAN: 00:1C:4A:8F:6E:19 WSTART (Apr 21 2008 12:53:03)Wstart - no WEP/WPA key set - no WLAN encryption libwlanparam: config ok(1) Wstart - made configure_wpa_authenticator [Wstart] wlan_cal ist gesetzt: NVS DATEI WIRD MIT KALIBRIERUNGSWERTEN GEPATCHT!!! [Wstart] 9 Parameter werden gepatcht: [Wstart] NVS DATEI WURDE GEPATCHT. NVS File loaded. wlan started (OK) Wstart - made configure_and_start_ap_driver WSTART: done(0) WLAN is enabled AVMMULTID: Starting AVM multid ... discarded libmultid, no enabled dns server ... done. /etc/init.d/rc.net: line 1: dsld: not found error: could not load /usr/bin/capiotcp_server /etc/init.d/rc.S: line 1296: can't create /proc/sysrq-trigger: nonexistent directory rc.mod version freetz-devel-14237 Firmware with remote access vulnerability detected. Remote access via https will be disabled. Create /tmp/flash/mod/dont_touch_https if you don't want this behavior. crond is disabled. AVM telnetd is disabled. Starting Freetz webinterface ... done. swap is disabled. Starting AVM webinterface ... done. syslogd is disabled. rc.mod finished. Please press Enter to activate this console. BusyBox v1.24.2 (2017-04-17 16:09:23 CEST) multi-call binary. Usage: stun-ip HOST discover external address get_ip error BusyBox v1.24.2 (2017-04-17 16:09:23 CEST) multi-call binary. Usage: stun-ip HOST discover external address get_ip error BusyBox v1.24.2 (2017-04-17 16:09:23 CEST) built-in shell (ash) <0x1b>[50;132qroot@fritz:/var/mod/root# reboot root@fritz:/var/mod/root# SHUTDOWN: initiated SHUTDOWN: executing /mod/etc/init.d/rc.mod stop Stopping all packages: crond: Stopping crond ... not running. telnetd: Stopping AVM telnetd ... not running. webcfg: Stopping Freetz webinterface ... done. multid: Stopping AVM multid ... done. Stopping all packages finished. SHUTDOWN: executing /var/post_install unload dsl and dependend driver .. rmmod: can't unload 'rfcntl': unknown symbol in module, or unknown parameter rmmod: can't unload 'capi_codec': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon5': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon4': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon3': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon2': unknown symbol in module, or unknown parameter rmmod: can't unload 'isdn_fbox_fon': unknown symbol in module, or unknown parameter rmmod: can't unload 'userman': unknown symbol in module, or unknown parameter rmmod: can't unload 'kdsldmod': unknown symbol in module, or unknown parameter rmmod: can't unload 'ubik2': unknown symbol in module, or unknown parameter rmmod: can't unload 'tiatm': unknown symbol in module, or unknown parameter PID USER VSZ STAT COMMAND 1 root 1000 S init 2 root 0 SWN [ksoftirqd/0] 3 root 0 SW< [events/0] 4 root 0 SW< [khelper] 5 root 0 SW< [kthread] 6 root 0 SW< [kblockd/0] 23 root 0 SW< [pdflush] 24 root 0 SW< [pdflush] 26 root 0 SW< [aio/0] 25 root 0 SW [kswapd0] 62 root 0 SW [pm_info] 69 root 0 SW [mtdblockd] 95 root 0 SW [tffsd_mtd_0] 375 root 2044 S wpa_authenticator 623 root 988 S {busybox} httpd-websrv -P /var/run/websrv.pid -p 80 -h /usr/www/all/ 750 root 1008 S -/bin/sh 751 root 996 S {ip_watchdog} /bin/sh /sbin/ip_watchdog 797 root 984 S {busybox} sleep 60 832 root 996 S /bin/sh -c /etc/inittab.shutdown 833 root 996 S {inittab.shutdow} /bin/sh /etc/inittab.shutdown 910 root 992 S {busybox} ash /var/post_install 911 root 1020 S {busybox} ash /etc/init.d/rc.dsl.sh stop 944 root 992 R {busybox} ps Module Size Used by Tainted: P tiap 370960 0 system is going down .. SHUTDOWN: unmounting SHUTDOWN: unmounting 'sysfs' on '/sys' SHUTDOWN: unmounting 'devpts' on '/dev/pts' SHUTDOWN: umount rootfs (on /) failed, trying to remount readonly... SHUTDOWN: still rw mounted: rootfs (on /) SHUTDOWN: still ro mounted: /dev/root (on /) SHUTDOWN: still rw mounted: dev (on /dev) SHUTDOWN: still rw mounted: proc (on /proc) SHUTDOWN: still rw mounted: tmpfs (on /var) SHUTDOWN: finished The system is going down NOW! Sent SIGTERM to all processes Sent


Notes

This device is not supported anymore by AVM.

Sources

Tags

inbox/avm/avm_avm_fritz_box_fon_wlan_7113.txt · Last modified: 2017/04/17 19:31 by everloop