unbrick APX120, break bootdelay=0 & recover APX120

Hi,

more information, howto unbrick a APX120

After entering thr default environment for uBoot, the environment is set to default values and the NAND chip is not recogniced.
we now need to do the following

• set the required environment
• set autoboot delay to 5s
• repower APX120
• enter uBoot
• erase nand chip
• tftpload APX.uimage
• boot kernel
• wget desired firmware
• run update_image.sh script
• reboot

So after entering the default mode, just set the environemt with these cmd..

set BASEMAC and SID according your device

setenv BASEMAC 7C:5A:AB:CD:EF:GH
setenv SID P3200341234567
setenv baudrate 115200
setenv bootargs mtdparts=spi0.1:0x8000000(rootfs) ubi.mtd=rootfs loglevel=1
setenv bootcmd apx_check_reset_button\;run ubiboot\;run ubiboot_backup\;reset
setenv bootdelay 10
setenv ethact eth0
setenv flash_type 0
setenv ipaddr192.168.1.1
setenv machid 8010100
setenv mtddevname rootfs
setenv mtddevnum 0
setenv mtdids nand1=nand1
setenv mtdparts mtdparts=nand1:0x10000000(rootfs)
setenv partition nand1,0
setenv radio0_select_5g 0
setenv serverip 192.168.1.8
setenv stderr serial
setenv stdin serial
setenv stdout serial
setenv store_crashdump setenv crashdump_fix 1
setenv ubiboot ubi part rootfs\;ubi read 0x84000000 image\;bootm 0x84000000#config@4
setenv ubiboot_backup ubi part rootfs\;ubi read 0x84000000 image_backup\;setenv bootargs mtdparts spi0.1:0x8000000(rootfs) ubi.mtd rootfs OLD_IMAGE_BOOTED\;bootm 0x84000000#config@4
setenv wipe_config ubi part rootfs\;ubi remove config\;ubi remove dyn_cfg\;ubi remove dyn_cfg_backup

run saveenv

(APX120) # saveenv
Saving Environment to NAND...
Erasing Nand...
Erasing at 0xef000 -- 100% complete.
Writing to Nand... done

Now Restart your device (Power Off/ON)

(APX120) # nand erase.chip
..
(APX120) # tftpboot APX.v2.1.1-1.uimage
..
(APX120) # bootm 0x84000000#config@4
.....

FIRMWARE_VERSION: v2.1.1-1

root@OpenWrt:/# wget http://FQDN/APX.uimage
..
root@OpenWrt:/bin# update_image.sh APX.uimage

# this will take a few minutes and then reboot

root@OpenWrt:/# reboot
..

if you need to clear environment variables use this

setenv SID
saveenv

Just enter the variable with no value and it´s cleared.
Don´t forget to save ...

And if you have ; in a environment variable, use a leading  \ , like \;

Hi, where can I get APX.uimage?

Hi Esrom,

Thank you for reaching out to Sophos Community.

There is no downloadable apx.image.

However, you may check this KB for reference with the flashing tool

support.sophos.com/.../KB-000039314

Hi, can anyone help. The "uimage" files of all apx are in the place where the pattern update is downloaded inside the XG/XGS Firewall.
/content/apfw_1.00/current_version/APX*.uimage

Example: /content/apfw_1.00/11.0.020/APX120.uimage

Hi, can anyone help. The "uimage" files of all apx are in the place where the pattern update is downloaded inside the XG/XGS Firewall.
/content/apfw_1.00/current_version/APX*.uimage

Example: /content/apfw_1.00/11.0.020/APX120.uimage

Hi Esrom,

Apologies for the misunderstanding.

Upon checking, this can only be done in Backup & Firmware > Pattern Updates > AP Firmware 

Hi Esrom,

you can upgrade the APX*.uimage in many ways

• use XG/XGS at Pattern Update -> Firmware

(following will need a serial connection to APX120, APX320 has console port)

• Change autoboot value to 5s (only in a working APX) and enter uBoot  
• use a glitch and break uBoot with a paperclip (shorting NAND and rewrite all uBoot settings)
• use a SOIC-8 Clip from POMONA and read/write a new boot loader from a good APX120
• maybe there is a hidden uBoot escape sequence to break uBoot (i don´t know).

After u entered uBoot you need to setup a tftp environment, clear the NAND in uBoot and load the new image.
This new image needs to be executed and loaded from cli, after a few reboots and a couple of minutes later, the APX (only with 11.0.019) will register in XG and you can enable it. But don´t upgrade to 11.0.020..

I used some of the old APX  images for testing. some didn´t work well, some gave an root logon without any password.

But the last APX 11.0.019 did a recent job in debricking.

If all fails, use APX.image Build v2.3.2-1, Sophos can provide you a link. 

But the new APX 11.0.0.20 will brick some APX320 and APX120 revisions, Sophos will swap these models if they are still under warranty.

Hello Juergen,

do you have the environment for a APX320 or APX320X?
I used your environment for the APX120 and changed some values accordingly, the AP boots from the tftp-loaded image and I can enter the busybox but after a few seconds, a "[" appears and the AP reboots.

I already tried to kill the watchdog processes, but it still reboots.

Do you know where the APX 11.0.019 or APX.image Build v2.3.2-firmware is available? On my firewalls, only the newest image is available.

This is the environment I used.

baudrate=115200
bootargs=mtdparts=spi0.1:0x8000000(rootfs) ubi.mtd=rootfs loglevel=1
bootcmd=apx_check_reset_button;run ubiboot;run ubiboot_backup;reset
bootdelay=10
bootfile=APX.uimage
ethact=eth0
flash_type=0
ipaddr=192.168.1.1
ipaddr=192.168.1.1
machid=8010006
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x20000000(rootfs)
partition=nand0,0
radio0_select_5g=0
serverip=192.168.1.12
stderr=serial
stdin=serial
stdout=serial
store_crashdump=setenv crashdump_fix 1
ubiboot=ubi part rootfs;ubi read 0x84000000 image;bootm 0x84000000#config@1
ubiboot_backup=ubi part rootfs;ubi read 0x84000000 image_backup;setenv bootargs mtdparts spi0.1:0x8000000(rootfs) ubi.mtd rootfs OLD_IMAGE_BOOTED;bootm 0x84000000#config@1
wipe_config=ubi part rootfs;ubi remove config;ubi remove dyn_cfg;ubi remove dyn_cfg_backup

I have a working APX320 on hand, but I cannot access the uboot shell as autoboot is set to 0 and the busybox shell is password protected.

Hi,

if you have a working APX320 just connect to the APX from the firewall and enter the shell.
From the shell you can change autoboot to 10, restart the APX and connect by console.

root@OpenWrt:~# fw_setenv bootdelay 10

Then you could just dump the complete NAND or just the 11.0.020-1 image.

Here is copy of a working APX320

BusyBox v1.23.2 (2022-07-08 11:09:20 UTC) built-in shell (ash)

FIRMWARE_VERSION: 11.0.020-1
root@OpenWrt:~# printenv
-ash: printenv: not found
root@OpenWrt:~# fw_printenv
BASEMAC=7C:**:**:**:**:**
REGDOMAIN=ETSI
SID=P52008*********
baudrate=115200
bootargs=ubi.mtd=rootfs loglevel=1
bootcmd=apx_check_reset_button;run ubiboot;run ubiboot_backup;run flashtool;reset
bootdelay=0
cfg_radio0_2g=setenv radio0_select_5g
cfg_radio0_5g=setenv radio0_select_5g 1
ethact=eth0
flash_type=0
flashtool=setenv ipaddr 169.254.12.34;setenv serverip 169.254.12.35;flashtool sendmagic 125 300000;flashtool check_image;source $loadaddr:script@1
hw_aid=1
hw_majver=1
hw_minver=1
ipaddr=192.168.1.1
loadaddr=0x88000000
machid=8010006
mtddevname=rootfs
mtddevnum=0
mtdids=nand0=nand0
mtdparts=mtdparts=nand0:0x20000000(rootfs)
partition=nand0,0
preboot=ubi part rootfs;sf probe
production_date_utc_unix_timestamp=1663119535
radio0_select_5g=0
serverip=192.168.1.254
stderr=serial
stdin=serial
stdout=serial
ubiboot=ubi read 0x88000000 image;bootm 0x88000000#config@1
ubiboot_backup=ubi read 0x88000000 image_backup;setenv bootargs ${bootargs} OLD_IMAGE_BOOTED;bootm 0x88000000#config@1
wipe_config=ubi remove config;sf erase 0x200000 0x100000;sf erase 0x300000 0x100000

Hi, actualy i have this situation

U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
@machid : 0x8010100
NND:  spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
SF: Detected W25M02GV with page size 2 KiB, tot`@ d5(@▒▒5R▒e▒*▒▒R▒kW.▒KW▒-Y'L'L'L▒,▒*$*▒▒R▒kW.▒KW▒-Y'L'L'L▒,▒*▒'▒UkW.▒KW▒+▒▒▒V▒,]]▒Y▒▒00
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
256 MiB
MMC:
*** Warning - readenv() failed, using default environment

In:    serial
Out:   serial
Err:   serial
machid: 8010100
flash_type: 0
Hit any key to stop autoboot:  0
Creating 1 MTD partitions on "nand1":
0x000000000000-0x000004000000 : "mtd=0"
UBI: attaching mtd1 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI error: ubi_read_volume_table: the layout volume was not found
UBI error: ubi_init: cannot attach mtd1
UBI error: ubi_init: UBI error: cannot initialize UBI, error -22
UBI init error 22

(APX120) #

Stopped the autoboot...but i cant see what i whrite.... can somebody help me ? thanks.

Hi,

if you can‘t see any input you need a different rs232-usb Adapter. And only use TXD,RXD and GND and Power the APX from PSU.

Sometimes a NAND Glitch doesn‘t show any input from RS232.

How did you break uBoot?

don‘t try to change any env settings in this state.

hi, i resolved with 5v power of rs-usb adapter.

now i have this..

eth0 PHY4 up Speed :1000 Full duplex
Using eth0 device
TFTP from server 192.168.1.8; our IP address is 192.168.1.11
Filename 'APX.v2.1.1-1.uimage'.
Load address: 0x84000000
Loading: T T T T T T T T T T T T T T

i conntected the eth cable to windows secondary lan door... and bridge (via win11) ....is ok ? or i make  some error ? thanks.

Hallo Jürgen, heißt mit einem PoE-Injector geht das nicht?

Doch mit einem PoE-Injector geht das auch, habs mit nem Netzteil gemacht.

Man könnte auch die Spannungsversorgung kurzschließen, ist aber absolut nicht zu empfehlen.
Dann lieber ne Reset Leitung auf dem Board suchen.