DSM-G600, DNS-3xx and NSA-220 Hack Forum

beattie wrote:

Actually if the USB-Serial device has external RS232 level converters, you can bypass them and drop the 74c14.

I got UC-232A adapter with Prolific PL2303 chip and it did require 74C14 to get readable console, without it I did get unreadable characters.

beattie wrote:

I could not find a data sheet for the PL2303 part

http://dns323.kood.org/downloads/people … -A-1.1.pdf

sala wrote:

I test it out after work
I noticed lately that ramdisk has some files that we do not really need, for example /web/path/Thumbs.db (56Kb), which is Microsoft's way of caching thumbnail images in folders, and if we replace all web interface .jpg and .gif files with css or just regular html buttons we gain about 200Kb additional free space.

I looked into this and these files are in the cramfs image that is copied on boot (did I say that I think this firmware is crap).  So it will be another step to remove them, I'll probably wait till I have the pivot root working.

Well I have gotten pivot_root working.  I have released 0.4,  The source tar file is http://www.beattie-home.net/beattie/DSM … SM-0.4.tgz .  There is also a firmware image http://www.beattie-home.net/beattie/DSM … 600-0.4.fw .  Give sala's experinece I would not suggest that anybody who does not have  a working serial console touch this, until it has been tested by others.

sala wrote:

This one works. I guess the main reason (beside 92 byte start offset) why it did fail for me before was that my ramdisk was to big to fit in flash.
Maybe we can add some checks to avoid firmware building if ramdisk or kernel is to big.

Now I am trying to make some more space by replacing some coreutils tools and busybox applets (switch to bb-1.00 final) + new web interface pages.

Also SVN should be up in couple of days

the 92 byte offset never caused me any problems.

The web interface update checks the size of the ramdisk image, that's where I got the ramdisk size, though it is confirmed by the readme which give the layout of the flash.  It may be that it does it wrong, or in the wrong place.  I can certainly add a check, but I'd be surprised if that was the problem (I've been surprised many times in my career ).  I'd suggest that rather than buiding ramdisk images with the new webpages, that you look at placeing those web pages on the hard drive and modify the ramdisk to look on the hard drive.  That would make updqating the web pages quicker and safer.

I've not used SVN before, though I doubt it's all that hard to use.

beattie wrote:

I'm had reports from sala that pehaps his report of a bricked unit was not corrrect, maybe he will post more information on that.

My English problem is actually very big one and it is relatively hard to run this kind of site like that but what the hell, you can always kick my butt and ask me again

OK, I did following things before I did see Bad Data CRC error.
*compiled Build_DSM-0.3.tgz with no problems
*didn't check if ramdisk is oversize or not, because I didn't modify build script and I was thinking it will not produce oversize ramdisk by default.
*flashed the image from web interface
*flashing did fail
*I did say some bad words and I did leave DSM-G600 running
*about 30 minutes latter, I did start to building next firmware image, using Build_DSM-0.3.tgz again
*I did delete old one because I think there was a bug in built script (if old firmware image exists then new one will not be created)
*when new image was ready I did reboot dsmg by pressing restart button in webinterface
*DSM-G600 newer booted up
*then I did look serial output and I did see

U-Boot 0.2.0 (May 11 2005 - 18:56:16)

CPU:   MPC8245 V1.2 at 170.503 MHz:
Board: Sandpoint 8245
DRAM:  32 MB
FLASH: FUJI_DL323BE
In:    serial
Out:   serial
Err:   serial
Hit any key to stop autoboot:  0
## Booting image at fff10000 ...
   Image Name:   Linux-2.4.21-pre4
   Image Type:   PowerPC Linux Kernel Image (gzip compressed)
   Data Size:    853695 Bytes = 833.7 kB
   Load Address: 00000000
   Entry Point:  00000000
 Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
## Loading RAMDisk Image at ffc20000 ...
   Image Name:   default
   Image Type:   PowerPC Linux RAMDisk Image (gzip compressed)
   Data Size:    3072965 Bytes =  2.9 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... Bad Data CRC
*

*after that I newer used Build_DSM-0.3.tgz again, instead I started to use Build_DSM-0.4.tgz and now I have always built flashable images
*I am not sure what was going wrong here but I think it will make a nice novel

Meanwhile I did add a new wiki page how to recover from bad flash.
http://dns323.kood.org/dsmg600/howto:recover
And yes, it works my unit is now up and running. In other words if you have a serial port installed you can safely try firmware images built using beattie build script

And about automatically grabbing a files I didn't meant that we are going to grab them from D-Link. I meant that we can grab them from original source and then patch them. As you are going to see that needed patches is already done (u-boot and busybox patch). Toolchain built script do not need patches.

By now I got working
*built in telnet with login
*I had to remove upnp stuff to get more flash space
*couple of tools are recompiled and stripped to get more flash space
*using busybox 1.00 final
*hotplug script syntax cleanup (empty if statements)
*new busybox applets: chroot, mknod, telnetd, ash (tabcomplete+history), sed (not vi, because sed can be more useful), pivot_root and some more that I cant remember right now

work in progress
*new admin interface web pages (here we can get enough free space to put back upnp stuff and maybe also vi)
*tinylogin patchset port for busybox login
*nologin option
*test out pivot root and add a wiki page
*modify build script to do all mentioned before automatically

Last edited by sala (2007-01-18 15:53:39)

So far so good
*telnetd (by default has same password with admin. if password is somehow not working then try to restore default settings. if you don't want telnetd running then kill it using fun_plug)
*upnp stuff completely removed, including upnp related web pages
*new cramfs image (image.cfs) without upnp files
*kernel has now domain socket support, CONFIG_UNIX and additionally CONFIG_FILTER (this means screen, dtach and udhcpd will work)
*dtach included in firmware
*busybox 1.00 final with many applets

[, arping, ash, autoip, awk, basename, bunzip2, busybox, bzcat,
cat, chgrp, chmod, chown, chroot, clear, cmp, cp, crond, crontab,
cut, date, df, dmesg, dumpleases, echo, egrep, env, expr, false,
fgrep, find, free, freeramdisk, fsck.minix, goweb, grep, gunzip,
gzip, head, hexdump, hostname, hwclock, id, ifconfig, init, insmod,
kill, killall, ln, login, losetup, ls, lsmod, mkdir, mkfs.minix,
mknod, mkswap, modprobe, more, mv, netstat, pidof, ping, pipe_progress,
pivot_root, poweroff, ps, pwd, rdate, reboot, reset, rm, rmmod,
route, sed, sh, sleep, sort, swapoff, swapon, sync, tail, tar,
telnetd, test, top, touch, true, udhcpc, udhcpd, uname, uptime,
vi, yes, zcat

*syntax typo fixes for hotplug scripts and rc.sh
*has all modifications that beattie did add in build script 0.4 (pivot_root lines in rc.sh)

Still missing:
*upnp (maybe we can add all needed files to hard disk and run it from there)
*new web pages (if done then we might be able to fit upnp back in firmware)
*get the latest NTFS driver working
*built script which does all above automaticaly

Full reboot log captured with serial port:
http://dns323.kood.org/downloads/people/sala/putty.log

Firmware image:
http://dns323.kood.org/downloads/people … a-20070128

Big fat warning!
Although this firmware works for me, there is still slight chance that you may brick your device. And only way to recover is using a serial port!


//edit
Bugs discovered so far:
*mounting fat file systems using hotplug scripts will give errors because of iocharset=cp850 parameter.
*image.cfs produces double mount loop0 & loop1 (this bug will not affect functionality).
*usb hard drives fail to mounted automatically (use fun_plug or telnet to mount them manually)

Last edited by sala (2007-02-02 17:51:21)

smarchini wrote:

Any risk flashing back to dlink 1.02us?

None as far as I know, at least not any extra risk.

SystemR89,

Does vfat show up in /proc/filesystems? 
Is the module fat or vfat loaded?

Also try mounting it with the -t vfat flag and see what happens.

--
Quang

To address this kernel problem little closer I have made kernel patchset for 2.4.21-pre4. It is almost clean but it needs some final touch (make mrproper because of old modversions) before we can use it for compiling kernel.

//edit
look this topic for mrpropered patch.

Last edited by sala (2007-01-31 09:01:38)

Sala,

I successfully updated it using your prebuilt firmware 0.4.  However, I keep getting an error using the firmware that I build.  I'm building it on Ubuntu Server 6.10 using your Sala_DSM-0.4 as the source.  The build process ran just fine, and the fwimage file is built.  I use the "kernel" file in ramdisk-0.2 as is, even though I successfully built the kernel as well.

I'm using gcc 3.3.6, btw.  Give me any hints you might have.

Thanks,
Quang

I may be wrong, but it seems this firmware lacks support for USB external HDD ? At least, my USB EXT2-formatted HD is not recognized since I tried Sala's firmware.
Just to be sure...