ZP100 not booting | Sonos Community

Zacharias · 2013-04-06T08:26:02+00:00

Hi, I've recently acquired a ZP100 however it looks to be stuck in the boot process with a single white light flashing endlessly. It doesn't appear responsive to holding the mute button on bootup. On powerup all of the network port light flash briefly and the connection lights are solid if wired to bridge via ethernet. I know this is an old product and I know it is my fault for purchasing it, but is there any other reset tricks or way to update the firmware to get out of this loop?

I tried to connect to the serial port using a buspirate and was pretty unsuccessful. Mostly because the bootloader and machine name were too difficult to locate without access to the :1400 interface.

Are there ways to bring the ZPT28 CPU board back from an non-pingable state? Got my IP address on my PC in the same range as default on ZP100 so my :1400/status is visible.

Here is my workaround using hardware. With a unit that I was able to ping as the donor, I swapped the top CPU board with a unit that had no IP or ping ability. Once the board was swapped the unit powered, recognized and updated itself. I successfully did this 2 times, yielding 2 working ZP100s. I sliced off the working MAC address sticker on the rear and attached it to the transplant machine so I could keep my MAC addresses tidy on my network. I am VERY interested in swapping or trading 2 non IP devices for 1 working IP/ethernet/cpu ZPT28 card.

My screwdriver and assembly skills are better than my linux.

*moderators please move this to a new topic if you feel this is too far from initial BusPirate/serial port discussion

So I too am having these issues. I have downloaded the latest firmware and currently my system shows

Software Version 3.2-29243-diag

I am willing to purchase the buspirate but need some guidance as to where to hook it up. I have the unit mostly apart at this time and am fairly confident in being able to get this working again. Thanks in advance.

John

So, I am now a pro at opening a buspirate connection in bridge, setting my computer IP to 169.254.1.x to use the same range as the default ZP100, and then pulling out my hair.

I have got bootloader on my local PC, kill ancapa and I can get it to upgrade, but then it just doesn't seem to take. I get command prompt # with no reboot or indication that it wants to stay upgraded.

Also are the http upgrade values after the upd?blahblah=xx&yadda=xxxx&var=x. . .etc specific to the machine or the upgrade? or is it just the serial, sonosid, and householdid that are machine specific?

For some reason my wife doesn't want to discuss sonos with me anymore.

Connected to UART console and was able to see the boot loader message..but it seem to be stuck there. no other message show up.

"Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help."

tried pressing h repeated. no luck

This is the only line of text appearing via Putty Console thru Bus Pirate

Anyone seen or know how to get pass this?

Because of this, I cannot get thru the http://169.254.1.1:1400/status either.

I wonder if all the units have the same root password for accessing via telnet.

Seems the hash is stored in /etc/passwd as you'd expect. The hash on the unit I have is hSmFHLbnzeXIA.

Its probably salted and then hashed, so I dont know if we'll be able to recover it this way.

Regardless, I got 2 ZP100s from ebay which were both non-functional when I got them.

Thanks to the advice in this thread, learned that the one is failing the SDRAM check, and giving up on autoboot. Manually booting it via the bootloader console is enough to get it alive, updated to current firmware, and it links to my Sonosnet and plays music. I suspect replacing the ISSI IS42S16800B-7TI SDRAM chip on the board will make it autoboot once more.

The other was a 3.2.whatever-diag firmwared unit, coming up on 169.254.1.1, with telnet open. Breaking in as root via the UART console let me set its IP to a routable one on my network and get it updated and playing music too. Its dmesg is still showing a bunch of "Empty flash at..." and "Data CRC failed..." messages. It was having issues where after a couple hours of runtime on the diag firmware, it wouldn't boot anymore. Few hours of cooldown would get it running again. I'm currently running it for a few hours to see if the fail to boot comes back.

@soyuppy: If you've successfully upgraded to a non diagnostic firmware the post-boot console goes away. I'd check to see if you can add the unit to your network now as normal. As for pressing 'h' to get the help info, you need to do that immediately as the machine boots, otherwise it continues on to autoboot.

@mrmom: Do you get any errors during the attempted update, or does it just silently fail?

@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.

While I agree with you that it likely is salted -- and therefore difficult to recover, and while I agree that Sonos probably wouldn't be a fan of the password being published, I also think there's little they can do about it. Additionally, we still don't know what the magic is to turn on the telnet daemon on a production firmwared box. Therefore, it would really only be useful to updating firmware on 3.2.whatever-diag firmwared boxes without opening the chassis to get to the serial port.

Lots of case law on gaining root access to devices you own -- see Android cell phones in particular.

So my one unit is failing the RAM check at a single address (but once you force it past that via the serial console, its been running now for some 24hours without issue).

The other is cold booting fine normally, but seems to fail to boot when its warm and you power cycle it. I'm wondering if its RAM chip has a temperature dependent fault the other way, where it fails when warm. Serial console when its warm seems to show a bagload of RAM check failure locations, and yet forcing it past there seems to yield a working unit.

I have a RAM chip (ISSI IS42S16800A-7TL) ordered on ebay to replace the one that wont boot on its own. I guess I should order another one for the temperature failing one.

What's interesting is that these two units are rather different. They contain different WiFi cards, and the PCBs inside are different colors. The -diag firmwared unit has blue solder mask on its PCBs, and the RAM failure one has green. Also, they have small differences on chip part numbers (RAM chips for example, are ISSI IS42S16800A-7TL, and ISSI IS42S16800B-7TL on the two boards)

Hello all,

its been almost 1 week since i cleaned entirely my revived unit. Today, i upgraded to 5.4 version and it has been running perfectly so far.

Im unsure about not having access to the bootloader. Make sure you press the h several times from the very power-on moment. Also, try not to power the serial circuit from the bus pirate but from the sonos unit itself. Just connect TX, RX and ground to keep voltage references OK. Power on the unit and press h several times.

For what its worth: I've managed to get the password back from that hash I posted a couple days ago.

Its...not THAT hard to guess, actually. I mostly just wanted to see if I could get it. Its 6 characters long and is a 6 letter word we know to be related to Sonos with some simple substitutions.

I don't have a unit running the diag firmware to try it out though, now. My diag unit has been updated to the latest.

Hello all,

its been almost 1 week since i cleaned entirely my revived unit. Today, i upgraded to 5.4 version and it has been running perfectly so far.

Im unsure about not having access to the bootloader. Make sure you press the h several times from the very power-on moment. Also, try not to power the serial circuit from the bus pirate but from the sonos unit itself. Just connect TX, RX and ground to keep voltage references OK. Power on the unit and press h several times.

I tried everything...swap the board with one working one. remove wireless card. remove power on pin-1. no budge. one stubborn board. !!! Keep stuck on same message:

Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help.

I tried everything...swap the board with one working one. remove wireless card. remove power on pin-1. no budge. one stubborn board. !!! Keep stuck on same message:

And pressing 'h', power cycling, nothing gives you any more than that? Seems odd.

Could be the bootloader is hosed, I guess. only has the first part of the bootloader program due to aging flash memory or something.

yep...mostly bootload is hosed

For what its worth: I've managed to get the password back from that hash I posted a couple days ago.

Its...not THAT hard to guess, actually. I mostly just wanted to see if I could get it. Its 6 characters long and is a 6 letter word we know to be related to Sonos with some simple substitutions.

I don't have a unit running the diag firmware to try it out though, now. My diag unit has been updated to the latest.

can you give us more info about how to unhash the telnet password?

is the telnet even accessible on a normal unit?

telnet is not accessible normally, unless you do the magic ritual that Sonos support can do via the http interface to turn on the telnet daemon.

It is also possible that they have changed the root password on more recent firmwares.

The diag firmware had telnetd on by default.

Unhashing was possible with johntheripper, using the -incremental:All6 switch. Took my machine about 14 hours to do.

is the telnet even accessible on a normal unit?

no...once unit is auto booted properly with DHCP from your router, telnetd is disable.

ohh ok. nevermind then

hey. just out of a curiosity:

does anybody know if a play 3 unit can be revived the same way we do with zp100? does it have a uart port?

thanks!

Play 5 has one. https://sites.google.com/site/sonosdebug/serial-port

Zp80 has one as well. So very good chance that UART port are common across all Sonos hardware board.

thanks! found it: bottom left part of the metal enclosure.

https://d3nevzfk7ii3be.cloudfront.net/igi/Skqrked2vjiDkt6J

this will be my next revival project. unit will arrive in a couple days. will report back.

All the sudden I lost connection to the ZP100 that was recovered through upgrading the diag firmware.

It was working and running fine, but now it start to act up. The Sonos app just lost/drop it from the device list. Trying to add it again, but still won't show up.

Connecting to UART, the auto boot seem to get executed properly.

Rincon boot loader version 1.0-27270(ZP) (32M SDRAM). Press 'h' for help.

SDRAM test...

Memory test iteration 0

SDRAM test complete

Attempting to autoboot from NAND device

NAND ID is EC:75

32M NAND flash (Samsung K9F5608U0C) detected

Section 0 is provisionally good, kernel on partition 1, generation 9

Section 1 is provisionally good, kernel on partition 4, generation 8

Attempting to boot kernel from partition 1

but I can't see any IP Address assigned from the router. And I can't ping the 169.254.1.1 either.

What could be causing this?

I tried hitting the 'h' to get to bool loader menu. I did run the SDRAM test and it goes for 100+ time, it seems to come back with no problem.

All the sudden I lost connection to the ZP100 that was recovered through upgrading the diag firmware.

It was working and running fine, but now it start to act up. The Sonos app just lost/drop it from the device list. Trying to add it again, but still won't show up.

Connecting to UART, the auto boot seem to get executed properly.

but I can't see any IP Address assigned from the router. And I can't ping the 169.254.1.1 either.

What could be causing this?

I tried hitting the 'h' to get to bool loader menu. I did run the SDRAM test and it goes for 100+ time, it seems to come back with no problem.

Something very very similar happened to my revived unit. I ended up opening it and cleaning all the electric contacts and cables. I moved everything inside it.

After that, I hard resetted the unit and went back from death.

Hope it helps. Please report any news if you can.

What is "hard reset"?

Sorry. Should've said factory reset.

https://sonos.custhelp.com/app/answers/detail/a_id/1107/~/factory-resetting-a-sonos-component

Tried all that. no budge. Something got to give. Ethernet port appear to be engaging with LED flashing. So there are some IP activity going on.

if you hardwire the unit to your router, what do you get when running arp -a in any network device?

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded