ZP100 not booting

@soyuppy: If you've successfully upgraded to a non diagnostic firmware the post-boot console goes away. I'd check to see if you can add the unit to your network now as normal. As for pressing 'h' to get the help info, you need to do that immediately as the machine boots, otherwise it continues on to autoboot.

@mrmom: Do you get any errors during the attempted update, or does it just silently fail?

@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.

@soyuppy: If you've successfully upgraded to a non diagnostic firmware the post-boot console goes away. I'd check to see if you can add the unit to your network now as normal. As for pressing 'h' to get the help info, you need to do that immediately as the machine boots, otherwise it continues on to autoboot.

@mrmom: Do you get any errors during the attempted update, or does it just silently fail?

@racer26: I'd not imagine that the root password would be easy to recover. The machine is running Linux, so I bet it's salted. Also, if it is shared among different devices Sonos might not be super happy with someone recovering it. As for the RAM issue, I've a unit with similar symptoms as well. The RAM test fails on cold boot, however if you start the RAM test loop in the bootloader it starts to fail less and less as it warms up. My guess is that there is a temperature dependent failure in either the RAM chip, or in the solder joints attaching the chips to the board.

While I agree with you that it likely is salted -- and therefore difficult to recover, and while I agree that Sonos probably wouldn't be a fan of the password being published, I also think there's little they can do about it. Additionally, we still don't know what the magic is to turn on the telnet daemon on a production firmwared box. Therefore, it would really only be useful to updating firmware on 3.2.whatever-diag firmwared boxes without opening the chassis to get to the serial port.

Lots of case law on gaining root access to devices you own -- see Android cell phones in particular.

So my one unit is failing the RAM check at a single address (but once you force it past that via the serial console, its been running now for some 24hours without issue).

The other is cold booting fine normally, but seems to fail to boot when its warm and you power cycle it. I'm wondering if its RAM chip has a temperature dependent fault the other way, where it fails when warm. Serial console when its warm seems to show a bagload of RAM check failure locations, and yet forcing it past there seems to yield a working unit.

I have a RAM chip (ISSI IS42S16800A-7TL) ordered on ebay to replace the one that wont boot on its own. I guess I should order another one for the temperature failing one.

What's interesting is that these two units are rather different. They contain different WiFi cards, and the PCBs inside are different colors. The -diag firmwared unit has blue solder mask on its PCBs, and the RAM failure one has green. Also, they have small differences on chip part numbers (RAM chips for example, are ISSI IS42S16800A-7TL, and ISSI IS42S16800B-7TL on the two boards)

Hello all,

its been almost 1 week since i cleaned entirely my revived unit. Today, i upgraded to 5.4 version and it has been running perfectly so far.
Im unsure about not having access to the bootloader. Make sure you press the h several times from the very power-on moment. Also, try not to power the serial circuit from the bus pirate but from the sonos unit itself. Just connect TX, RX and ground to keep voltage references OK. Power on the unit and press h several times.

For what its worth: I've managed to get the password back from that hash I posted a couple days ago.

Its...not THAT hard to guess, actually. I mostly just wanted to see if I could get it. Its 6 characters long and is a 6 letter word we know to be related to Sonos with some simple substitutions.

I don't have a unit running the diag firmware to try it out though, now. My diag unit has been updated to the latest.

Hello all,

its been almost 1 week since i cleaned entirely my revived unit. Today, i upgraded to 5.4 version and it has been running perfectly so far.
Im unsure about not having access to the bootloader. Make sure you press the h several times from the very power-on moment. Also, try not to power the serial circuit from the bus pirate but from the sonos unit itself. Just connect TX, RX and ground to keep voltage references OK. Power on the unit and press h several times.
I tried everything...swap the board with one working one. remove wireless card. remove power on pin-1. no budge. one stubborn board. !!! Keep stuck on same message:

Rincon boot loader version 0.16-11080(ZP) (32M SDRAM). Press 'h' for help.

I tried everything...swap the board with one working one. remove wireless card. remove power on pin-1. no budge. one stubborn board. !!! Keep stuck on same message:

And pressing 'h', power cycling, nothing gives you any more than that? Seems odd.

Could be the bootloader is hosed, I guess. only has the first part of the bootloader program due to aging flash memory or something.

And pressing 'h', power cycling, nothing gives you any more than that? Seems odd.

Could be the bootloader is hosed, I guess. only has the first part of the bootloader program due to aging flash memory or something.
yep...mostly bootload is hosed

For what its worth: I've managed to get the password back from that hash I posted a couple days ago.

Its...not THAT hard to guess, actually. I mostly just wanted to see if I could get it. Its 6 characters long and is a 6 letter word we know to be related to Sonos with some simple substitutions.

I don't have a unit running the diag firmware to try it out though, now. My diag unit has been updated to the latest.

can you give us more info about how to unhash the telnet password?
is the telnet even accessible on a normal unit?

can you give us more info about how to unhash the telnet password?
is the telnet even accessible on a normal unit?

telnet is not accessible normally, unless you do the magic ritual that Sonos support can do via the http interface to turn on the telnet daemon.

It is also possible that they have changed the root password on more recent firmwares.

The diag firmware had telnetd on by default.

Unhashing was possible with johntheripper, using the -incremental:All6 switch. Took my machine about 14 hours to do.

is the telnet even accessible on a normal unit?
no...once unit is auto booted properly with DHCP from your router, telnetd is disable.