I own an over 5 years old AVM FritzBox 7270 router which is after all that time becoming slightly unstable. (The capacitors might be wearing out.) The router uses the CWMP (TR-069) protocol to authenticate itself at my cable provider Vodafone (Kabel Deutschland). As these settings are tied to the box and the FritzBox 7270 is neither sold nor supported anymore I bought two cheap 7270_v2 boxes (identical hardware, different branding) on eBay and successfully transferred the authentication credentials from my old box onto the two new ones.

Warning: Please keep in mind that the following steps worked for me but I do not feel responsible if you brick your FritzBox by trying them out yourself. I tested it on two spare routers I’ve explicitly bought for this purpose.

0. Debranding & serial connection

Opening the cases of the routers allowed direct access to the serial interfaces on the PCBs. This might not be necessary as all (following) steps, at least the debranding (here: “1und1” to “AVM”), can be done without access to the serial interface. I have not tested that. But the serial interface allowed the “deepest” access to the routers’ system.

I will not describe how to set-up a terminal connection and how USB to RS232 adapter work. This is sufficiently covered by other tutorials. It is also not necessary to solder pins onto the RS232 interface on the PCB. For me it worked perfect to just stick a few pin headers into the pads as seen on the following two images. (It’s best to not touch the cable during the process though.)

1.Test: Directly connecting the two new boxes to the cable modem

After a factory reset (“Werkseinstellungen”) via the web interface I’ve first connected the two boxes to the cable modem. As expected they were able to fetch the general provider settings but not the VoIP (telephone) settings.

Comment: The VoIP settings can be extracted by hand from a fully authenticated FritzBox but I wanted them to also do that for me.

2.Backups: Storing the environment settings and MTDs

It is always a good idea to make backups of the devices you are going to hack. I attached an USB stick to the box and changed into a newly created directory on it.  You will need to backup the following file on all of your FritzBox routers. (Adapt the destination filename as necessary.)

cp /proc/sys/urlader/environment environment-source-fritzbox.txt

It’s also a good idea to make backups of the block devices… just in case. (The FritzBox 7270 there should have 6 block device “mtd0” to “mtd5”.)

dd if=/dev/mtd0 of=mtd0.bin

3.Cloning the CWMP settings

I once again ran a factory reset while having the serial interface connected to the box. I halted the boot process directly after the reset when the bootloader (“urlader” / Eva_AVM) appeared. The bootloader shows a prompt for 5 seconds and the boot process can be interrupted by entering a command, e.g. “h<enter>” for help.

[...]
system is going down ..
The system is going down NOW!
Sent SIGTERM to all processes
Requesting system reboot

(AVM) EVA Revision: 1.455 Version: 1455
(C) Copyright 2005 AVM Date: Apr 1 2008 Time: 13:07:03 (1) 2 0x0-0x41D

[FLASH:] ST Uniform-MirrorBit-Flash 16MB 64 Bytes WriteBuffer
[FLASH:](Eraseregion [0] 128 sectors a 128kB) 
[SYSTEM:] UR8 on 360MHz/120MHz syncron

 Commands Description
 -------- -----------
 help help
 dm dump mem <addr> <range>
 cm change mem <addr> <value>
 erase Erase Flash <mtd>
 printenv print Env. Variables
 restart reboot Device
 setenv set Env. variable <var> <value>
 unsetenv unset Env. variable <var>
 go load & start kernel from mtd1
 setmac set mac addresses <addr> (like 12:23:40)
 memtest test memory

To really erase all settings from the FritzBox 7270 I’ve used the “Erase Flash” option. The settings are stored in two TFFS blocks: mtd3 and mtd4.

Warning: stay away from mtd2 (the bootloader)! Erasing this block device will brick your router.

Eva_AVM >erase mtd3
erase from 0x90F80000 to 0x90FC0000

Eva_AVM >..
Eva_AVM >erase mtd4
erase from 0x90FC0000 to 0x91000000

Eva_AVM >..
Eva_AVM >restart
<create new TFFS>

[...break here! ...]

After a restart the TFFS partitions are recreated based on the hardcoded settings in the bootloader. Again interrupt the boot process directly after the TFFS blocks were restored. Now you have to look into the previously stored environment settings from the original FritzBox and add (or overwrite) the CWMP settings in the destination box. It might be necessary to also set the MAC addresses as they might have been set to default values. (The default MAC addresses possibly won’t let you connect at all – I’ve had that problem with one of my boxes.)

Eva_AVM >setenv tr069_passphrase XPASSPHRASEX

Eva_AVM >setenv tr069_serial 00040E-XXXSERIALXXX

Eva_AVM >restart

Comment: You can check with the “printenv” command if the settings were successful and if the default environment (MAC) settings were set.

Eva_AVM >printenv

In my case that was all I had to do. I then let the router boot as normal and connected it to the cable modem. After a minute or so it fetched all necessary settings (including the VoIP settings) and pre-configurated the FritzBox.

Surprisingly it was not necessary to transfer the MAC addresses or any other settings from the original FritzBox to the other two boxes. (Something I expected based on various forum posts.).

I’ve later also tried the same steps on a FritzBox 7390 but failed to receive the VoIP settings. The ProductID (FritzBox 7270) and the software version is additionally transmitted along with the tr-069 credentials. In a second post I’m providing a possible solution on how to achieve an auto-update via TR-069 on other FritzBoxes.