Hi,
I've recently acquired a ZP100 however it looks to be stuck in the boot process with a single white light flashing endlessly.
It doesn't appear responsive to holding the mute button on bootup. On powerup all of the network port light flash briefly and the connection lights are solid if wired to bridge via ethernet.
I know this is an old product and I know it is my fault for purchasing it, but is there any other reset tricks or way to update the firmware to get out of this loop?
This topic has been closed for further comments. You can use the search bar to find a similar topic, or create a new one by clicking Create Topic at the top of the page.
Page 5 / 8
Userlevel 2
its been almost 1 week since i cleaned entirely my revived unit. Today, i upgraded to 5.4 version and it has been running perfectly so far.
Im unsure about not having access to the bootloader. Make sure you press the h several times from the very power-on moment. Also, try not to power the serial circuit from the bus pirate but from the sonos unit itself. Just connect TX, RX and ground to keep voltage references OK. Power on the unit and press h several times.
I tried everything...swap the board with one working one. remove wireless card. remove power on pin-1. no budge. one stubborn board. !!! Keep stuck on same message:
Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help.
Userlevel 2
And pressing 'h', power cycling, nothing gives you any more than that? Seems odd.
Could be the bootloader is hosed, I guess. only has the first part of the bootloader program due to aging flash memory or something.
Userlevel 2
Could be the bootloader is hosed, I guess. only has the first part of the bootloader program due to aging flash memory or something.
yep...mostly bootload is hosed
Userlevel 2
Its...not THAT hard to guess, actually. I mostly just wanted to see if I could get it. Its 6 characters long and is a 6 letter word we know to be related to Sonos with some simple substitutions.
I don't have a unit running the diag firmware to try it out though, now. My diag unit has been updated to the latest.
can you give us more info about how to unhash the telnet password?
is the telnet even accessible on a normal unit?
Userlevel 2
is the telnet even accessible on a normal unit?
telnet is not accessible normally, unless you do the magic ritual that Sonos support can do via the http interface to turn on the telnet daemon.
It is also possible that they have changed the root password on more recent firmwares.
The diag firmware had telnetd on by default.
Unhashing was possible with johntheripper, using the -incremental:All6 switch. Took my machine about 14 hours to do.
Userlevel 2
is the telnet even accessible on a normal unit?
no...once unit is auto booted properly with DHCP from your router, telnetd is disable.
Userlevel 2
ohh ok. nevermind then
Userlevel 2
hey. just out of a curiosity:
does anybody know if a play 3 unit can be revived the same way we do with zp100? does it have a uart port?
thanks!
does anybody know if a play 3 unit can be revived the same way we do with zp100? does it have a uart port?
thanks!
Userlevel 2
does anybody know if a play 3 unit can be revived the same way we do with zp100? does it have a uart port?
thanks!
Play 5 has one. https://sites.google.com/site/sonosdebug/serial-port
Zp80 has one as well. So very good chance that UART port are common across all Sonos hardware board.
Userlevel 2
Zp80 has one as well. So very good chance that UART port are common across all Sonos hardware board.
thanks! found it: bottom left part of the metal enclosure.
https://d3nevzfk7ii3be.cloudfront.net/igi/Skqrked2vjiDkt6J
this will be my next revival project. unit will arrive in a couple days. will report back.
Userlevel 2
All the sudden I lost connection to the ZP100 that was recovered through upgrading the diag firmware.
It was working and running fine, but now it start to act up. The Sonos app just lost/drop it from the device list. Trying to add it again, but still won't show up.
Connecting to UART, the auto boot seem to get executed properly.
but I can't see any IP Address assigned from the router. And I can't ping the 169.254.1.1 either.
What could be causing this?
I tried hitting the 'h' to get to bool loader menu. I did run the SDRAM test and it goes for 100+ time, it seems to come back with no problem.
It was working and running fine, but now it start to act up. The Sonos app just lost/drop it from the device list. Trying to add it again, but still won't show up.
Connecting to UART, the auto boot seem to get executed properly.
Rincon boot loader version 1.0-27270(ZP) (32M SDRAM). Press 'h' for help.
SDRAM test...
Memory test iteration 0
SDRAM test complete
Attempting to autoboot from NAND device
NAND ID is EC:75
32M NAND flash (Samsung K9F5608U0C) detected
Section 0 is provisionally good, kernel on partition 1, generation 9
Section 1 is provisionally good, kernel on partition 4, generation 8
Attempting to boot kernel from partition 1
but I can't see any IP Address assigned from the router. And I can't ping the 169.254.1.1 either.
What could be causing this?
I tried hitting the 'h' to get to bool loader menu. I did run the SDRAM test and it goes for 100+ time, it seems to come back with no problem.
Userlevel 2
It was working and running fine, but now it start to act up. The Sonos app just lost/drop it from the device list. Trying to add it again, but still won't show up.
Connecting to UART, the auto boot seem to get executed properly.
but I can't see any IP Address assigned from the router. And I can't ping the 169.254.1.1 either.
What could be causing this?
I tried hitting the 'h' to get to bool loader menu. I did run the SDRAM test and it goes for 100+ time, it seems to come back with no problem.
Something very very similar happened to my revived unit. I ended up opening it and cleaning all the electric contacts and cables. I moved everything inside it.
After that, I hard resetted the unit and went back from death.
Hope it helps. Please report any news if you can.
Userlevel 2
After that, I hard resetted the unit and went back from death.
Hope it helps. Please report any news if you can.
What is "hard reset"?
Userlevel 2
Sorry. Should've said factory reset.
https://sonos.custhelp.com/app/answers/detail/a_id/1107/~/factory-resetting-a-sonos-component
https://sonos.custhelp.com/app/answers/detail/a_id/1107/~/factory-resetting-a-sonos-component
Userlevel 2
https://sonos.custhelp.com/app/answers/detail/a_id/1107/~/factory-resetting-a-sonos-component
Tried all that. no budge. Something got to give. Ethernet port appear to be engaging with LED flashing. So there are some IP activity going on.
Userlevel 2
if you hardwire the unit to your router, what do you get when running arp -a in any network device?
Userlevel 2
connecting ZP directly to my computer. And computer is set to static ip address of 169.254.1.2/24 default gateway of 169.254.1.1
Here's the output from arp -a
arp -a
Interface: 169.254.1.2 --- 0xb
Internet Address Physical Address Type
169.254.255.255 ff-ff-ff-ff-ff-ff static
224.0.0.2 01-00-5e-00-00-02 static
224.0.0.22 01-00-5e-00-00-16 static
224.0.0.252 01-00-5e-00-00-fc static
239.255.255.250 01-00-5e-7f-ff-fa static
255.255.255.255 ff-ff-ff-ff-ff-ff static
Userlevel 2
apparently, there is no ethernet traffic at all from the unit.
what happens when you try to factory reset it?
also, when you connect it to your network, are there any dhcp requests?
what happens when you try to factory reset it?
also, when you connect it to your network, are there any dhcp requests?
Userlevel 2
what happens when you try to factory reset it?
also, when you connect it to your network, are there any dhcp requests?
On a working unit, when I hold mute button and plug in the power, the LED eventually flash in amber/orange. After release the mute button, LED eventually shows constant white.
On this problematic unit, LED continue to flash white immediate after plug in AC. event with me pressing and holding the mute button, LED never change to amber...it continue to flash white.
I'll take a look at my router log to see if DHCP request is made from the device.
Userlevel 2
On this problematic unit, LED continue to flash white immediate after plug in AC. event with me pressing and holding the mute button, LED never change to amber...it continue to flash white.
I'll take a look at my router log to see if DHCP request is made from the device.
nothing on router DHCP log. Consistent with no ethernet activity analysis from arp -a
Userlevel 2
I press h to get into boot loader menu
There's Boot diagnostics, but press d only result in the bad page magic.
Does anyone know what this mean? Has anyone try this option with success?
Rincon boot loader version 1.0-27270(ZP) (32M SDRAM). Press 'h' for help.
h - help
m - SDRAM test
i - print NAND device ID
n - NAND device scan
x - NAND device destructive test
y - NAND device dump first page
p - Program NAND device
b - Boot the Linux kernel from NAND device
d - Boot diagnostics from NAND device
> nand_load: bad page magic, page 0
There's Boot diagnostics, but press d only result in the bad page magic.
Does anyone know what this mean? Has anyone try this option with success?
Userlevel 2
Never seen that before.
But as I can see, maybe the nand is fried? 😞
But as I can see, maybe the nand is fried? 😞
None of the production units (or indeed the diagnostic unit) that I have worked on have a diagnostic partition. A quick look at the bootloader assembly indicates that it refers to a different type of partition that I've never seen before. My guess is that it is a remnant from the development process (remember that the bootloader wasn't designed for us), that's been left in.
Userlevel 2
I have a RAM chip (ISSI IS42S16800A-7TL) ordered on ebay to replace the one that wont boot on its own. I guess I should order another one for the temperature failing one.
Did you ever get the RAM chip replace? was it easy to do?
Userlevel 2
Haven't received the chip from China yet. Replacement, well, there's certainly a technique to replacing a 54 pin SMT chip.
Page 5 / 8
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.