If you like BoxMatrix then please contribute Supportdata, Supportdata2, Firmware and/or Hardware (get in touch).
My metamonk@yahoo.com is not reachable by me since years. Please use hippie2000@webnmail.de instead.


From BoxMatrix

BoxMatrix >> Development >> Recovery-Dump @ BoxMatrix   -   IRC-Chat   -   Translate: de es fr it nl pl
News Selectors Models Accessories Components Environment Config Commands System Webif Software Develop Lexicon Community Project Media

Tarballs GPL-Browser FW-Probes FW-History FW-News Supportdata Hardware SVN Trac Freetz-News Freetz-Timeline Freetz-Releases Freetz-Mirror OpenWRT Research



During development of FIT-Image and to improve push_firmware it is important to see how an AVM Recovery.exe performs the upload to EVA for each model. Currently this is done by running Wireshark during a recovery and analyze the strings in the dump. This is tiredsome work and requires the respective model and/or someone who is willing to perform and dump a recovery.

To save time and to be able to dump all recoveries independently it would be better to have some EVA simulation which directly creates a transscript. The idea of evasim server and its client recdump was born.


This is currently just collecting ideas and may change.

EVA-Simulation server evasim:

  • All server stuff has to run on Linux as root.
  • A virtual network interface has to be created at the default IP 192,168,178,1, as described here.
  • The server will be an extended and also stripped down variant of this full featured Perl FTP server.
  • A wrapper script controls the creation and destruction of the interface and server to simulate the reboot cycle.
  • The server gets a special FTP command to set HWRevision and Branding of the emulated box.
  • It then fetches the Environment of the respective model from BoxMatrix so the recovery could fetch it.

Recovery-Dump client recdump:

  • All client stuff runs as a non privileged user
  • A wrapper script extracts HWRevision and Branding from the recovery and sends it to the server.
  • The Recovery.exe then is executed using WINE.
  • After this the wrapper downloads the dump from the server and stores it as <recoveryname>.txt
  • The formatting should be like this handcrafted recovery transscript.


  • It would be a dream to have recovery transscripts of all recoveries ever, as RecDump listings in the Firmware-History.
  • This task could not be performed on the BoxMatrix server but must be dispatched to my home, like the AVM-Tarballs scans.
  • This would be useful for models which received repartitioning updates, keyword "Zwischenupdate" (intermediate updates).
  • It would be a dream to automate user interactions and timing of the recovery and server using AutoIt for mass dumping.


For a recovery these EVA commands are required:

>> = to EVA
<< = from EVA


Not a command but EVA responds

>> <connect>
<< 220 ADAM2 FTP Server ready


>> USER adam2
<< 331 Password required for adam2


>> PASS adam2
<< 230 User adam2 successfully logged in


<< 215 AVM EVA Version 1.11177 0x0 0x4640D


 >> TYPE I
 << 200 Type set to BINARY


<< 200 Media set to MEDIA_FLASH
<< 200 Media set to MEDIA_SDRAM


>> P@SW
<< 227 Entering Passive Mode (192,168,178,1,95,32)


A recovery first retreives the Bootloader-Environment to get all info about the target model.

>> RETR env
<< 150 Opening BINARY data connection
<< <env-blob>
<< 226 Transfer complete

A recovery retrieves the operating time counter to preserve it before cleaning the config partition[s].

>> RETR count
<< 150 Opening BINARY data connection
<< <counter-blob>
<< 226 Transfer complete


For models which are not recovered by a put mtd memsize and kernel_args_tmp need to be set.

>> SETENV memsize 0x1dee0000
<< 200 SETENV command successful
>> SETENV kernel_args_tmp "avm_fwupdate mtdram1=0x1dee0000,0x20000000 mtdparts_ext=update-image.0:0x2120000@0x0(fit-image)"
<< 200 SETENV command successful


For NAND config models a recovery stores the cleaned config partition.

>> STOR mtdnand
<< 150 Opening BINARY data connection
>> <nandtffs-blob>
<< 226 Transfer complete

For models which are not recovered by a put mtd an absolute put (media SDRAM) is oerformed

<< 227 Entering Passive Mode (192,168,178,1,17,31)
>> STOR 0x1dee0000 0x20000000
<< 150 Opening BINARY data connection
>> <fitimg-blob>
<< 226 Transfer complete


Not a commnd but EVA responds:

<< 221 Thank you for using the FTP service on ADAM2
<< 221 Goodbye.