DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2007-02-05 16:21:11

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Firmware builder for DNS-323

Little kick ahead!
As we already know that DSM-G600 and DNS-323 share a very similar firmware format with u-boot images inside, we should be able to modify beattie firmware builder to work with DNS-323 firmware.
So people who have some nonage about C might want to look this archive:
http://dns323.kood.org/downloads/people … ld-0.4.tgz


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#2 2007-02-06 09:01:27

Paul
Member
From: Landshut, Germany
Registered: 2007-01-19
Posts: 35
Website

Re: Firmware builder for DNS-323

yeah actually I think that's a great idea... But, maybe it would be better if we know how to recover from a bad flash first?! I mean... what if you screw up ? (I'm propably going to!)

Offline

 

#3 2007-02-06 09:03:50

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Firmware builder for DNS-323

magore has a serial port installed, so he may try some things out.
I think we can recover DNS-323 a very similar way with DSM-G600.


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#4 2007-02-06 18:08:15

cbrunnkvist
Member
From: Helsingborg, Sweden
Registered: 2007-01-20
Posts: 13

Re: Firmware builder for DNS-323

Can you make a short summary of the DSM-G600 recovery procedure for those unfamiliar with that platform? :-)

Offline

 

#5 2007-02-06 19:35:59

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Firmware builder for DNS-323


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#6 2007-02-07 02:50:59

magore
Member
Registered: 2007-01-05
Posts: 25

Re: Firmware builder for DNS-323

Hi,
The good news is that you can break into the u-boot loader. Type "5784468" without the quotes at the bash prompt


This appears to be by design after looking at the u-boot sorce code.

in u-boot-1_1_1/common/main.c - line 409 is the staement:
   s = getenv ("bootcmd");
line 426 runs the result:
    run_command (s, 0);

line 426 runs because CFG_HUSH_PARSER is undefined in
       include/configs/db88f5181.h:#undef CFG_HUSH_PARSER

The boot command is set to a firmware default because the environment has an invalid CRC
See  common/env_flash.c, function env_init starting at line 252
The environment pointer gets set to 0xff800000
Where are the environment strings ???
include/configs/db88f1181.h:#define  CFG_ENV_IS_IN_FLASH   
#define CFG_ENV_IS_IN_FLASH     1
#define CFG_ENV_SIZE            0x8000  /* Total Size of Environment Sector */
#define CFG_ENV_SECT_SIZE       0x10000
#define CFG_ENV_ADDR            (CFG_FLASH_BASE)   1
#define CFG_FLASH_BASE          BOOTDEV_CS_BASE
board/mv88fxx81/mvSysHwConfig.h:#define BOOTDEV_CS_BASE      0xff800000
include/configs/db88f5181.h:#define CFG_MONITOR_BASE  (CFG_FLASH_BASE + 0x10000)

I added code in tools/envcrc.c and compiled with the ARM toolchain on the DNS-323
to dump the following defines  - so they at least are verified and will help trace the code
CFG_ENV_IS_IN_NVRAM: UNDEFINED
CFG_ENV_IS_IN_EEPROM: UNDEFINED
CFG_ENV_IS_IN_FLASH: 1
CFG_ENV_IS_IN_DATAFLASH: UNDEFINED
CFG_ENV_IS_IN_NOWHERE: UNDEFINED
ENV_IS_EMBEDDED - UNDEFINED
MV_TINY_IMAGE: UNDEFINED
CFG_ENV_ADDR: ff800000
CFG_FLASH_BASE: ff800000
BOOTDEV_CS_BASE: ff800000
CFG_ENV_OFFSET: 0
CFG_ENV_SIZE: 8000
ENV_HEADER_SIZE: 4
ENV_SIZE: 7ffc
CFG_ENV_ADDR_REDUND: UNDEFINED
CFG_ENV_OFFSET_REDUND: UNDEFINED
CFG_ENV_SIZE_REDUND: UNDEFINED
CFG_ENVSECT_SIZE: UNDEFINED
CFG_MONITOR_BASE: ff810000
CFG_MONITOR_LEN: 60000
CONFIG_BOOTCOMMAND: bootm FF820000 FF9A0000
CONFIG_BOOTDELAY: 3



I am looking at the the 10pin port and see if this is a JTAG port. I have a spare  DNS-323 and will really start digging... Well it is See JTAG WIKI documentation for details http://dns323.kood.org/hardware:jtag

Last edited by magore (2007-03-04 11:36:31)

Offline

 

#7 2007-03-03 18:57:50

kimhav
Member
From: Klagshamn, Sweden
Registered: 2007-01-08
Posts: 56
Website

Re: Firmware builder for DNS-323

How adaptable is the DSM-G600 fw source code compared to if it going to be re-used to the DNS-323? Asking since I'm really curious if we can expect a customized fw for the DNS-323.


Kim Haverblad
Klagshamn, Sweden
http://kim.haverblad.se

Offline

 

#8 2007-03-03 19:04:46

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: Firmware builder for DNS-323

you can expect one. no doubt about that.


First user to fun_plug the dns-323.

Offline

 

#9 2007-03-03 19:31:16

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Firmware builder for DNS-323

Before there is no way to recover from a bad firmware there is not going to be any custom firmware. Putting firmware together is no easy work and doing that device will be bricked maybe multiple times before everything is going to work.
Since there is no way to recover then the other option is to have maybe 5-10 units of DNS-323 for testing big_smile


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#10 2007-03-03 19:34:17

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: Firmware builder for DNS-323

or call d-link and say it just stopped working smile

and ofcose refuse all about using this forum


First user to fun_plug the dns-323.

Offline

 

#11 2007-03-03 19:39:56

sala
Member / Site Admin
From: Estonia
Registered: 2006-07-28
Posts: 731
Website

Re: Firmware builder for DNS-323

You guys may also look for loader.o. If you are lucky then it will work with 2.6 kernel http://dns323.kood.org/dsmg600/howto:loader_o
Getting root file system to hard disk is maybe better option in current situation smile


DSM-G600 - NetBSD hdd-boot - 80GB Samsung SP0802N
NSA-220 - Gentoo armv5tel 20110121 hdd-boot - 2x 2TB WD WD20EADS

Offline

 

#12 2007-12-26 06:03:04

leftkidney
Member
Registered: 2007-12-26
Posts: 54

Re: Firmware builder for DNS-323

KRH wrote:

or call d-link and say it just stopped working smile

and ofcose refuse all about using this forum

yep thats what i do when I hack something and it no longer works

not trying to tell people to commit fraud but maybe Dlink should of made a better product and maybe made it open source so people can do this without the fear of Dlink telling you you voided the warranty with what you did

Offline

 

#13 2008-05-12 19:34:18

bq041
Member
From: USA
Registered: 2008-03-19
Posts: 709

Re: Firmware builder for DNS-323

It is open source.  It is required to be since D-Link uses busybox in it.  Anyway, the source and instructions can be found here:

ftp://ftp.dlink.com/GPL/DNS-323/


DNS-323     F/W: 1.04b84  H/W: A1  ffp: 0.5  Drives: 2X 400 GB Seagate SATA-300
DNS-323     F/W: 1.05b28  H/W: B1  ffp: 0.5  Drives: 2X 1 TB  WD SATA-300
DSM-G600   F/W: 1.02       H/W: B                Drive:  500 GB WD ATA

Offline

 

#14 2008-05-13 15:13:18

mindbender
Member
Registered: 2007-10-29
Posts: 10

Re: Firmware builder for DNS-323

or get it lightning fast from here:
http://gpl.nas-central.org/D-LINK/

dlink throttles it to about 25 KB/second.

i am also very interested in a firmware builder tool for the dns-323. it would be exactly the tool needed so foonas/foonas-em ( http://foonas.org ) can support the dns-323.

Last edited by mindbender (2008-05-13 15:15:55)

Offline

 

#15 2008-05-13 15:50:39

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: Firmware builder for DNS-323

mindbender look here
ftp://ftp.conceptronic.net/conceptronic … L/CH3SNAS/

there are some thing to make the firmware image.


First user to fun_plug the dns-323.

Offline

 

#16 2008-05-18 20:18:17

mindbender
Member
Registered: 2007-10-29
Posts: 10

Re: Firmware builder for DNS-323

i suppose you mean merge.tar.gz ...... are the firmwares of the dns-323 and the CH3SNAS looking similar or are the completely different?

Offline

 

#17 2008-05-18 20:21:50

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: Firmware builder for DNS-323

its pritty similar
some have tryed uploading ch3snas fw to the dns323 and it worked after.


First user to fun_plug the dns-323.

Offline

 

#18 2008-05-20 14:36:47

mindbender
Member
Registered: 2007-10-29
Posts: 10

Re: Firmware builder for DNS-323

i just took a look and it really seems as if everything is there for creating a custom firmware. merge-FrodoII.c is the most important file.

main reason why the guy who uploaded the ch3snas fw to the dns323 could not flash back was probably a slightly different handling of the fw through the running OS....probably there was no md5 or something in one firmware.

so.....custom firmwares should be possible then. the opinion that it is not easily possible to move back to the stock firmware is understandable...but what about tftp then? foonas-em is targets exactly that..its a recent kernel + initramfs which can be loaded via tftp and which is an installer (repartitioning hdd if needed, downloading rootfs from the internet (bootstrapping to debian/ubuntu server/ installing gentoo is planned) and untaring on the rootfs partition)....its not just done for foonas....

but that does not help with the tftp problem.....what happens if a dns-323 is booted with a partitionless hdd? does it request kernel/initrd via tftp or does it do nothing?

Last edited by mindbender (2008-05-20 14:37:23)

Offline

 

#19 2008-05-20 15:21:17

helge9210
Member
Registered: 2008-05-20
Posts: 6

Re: Firmware builder for DNS-323

I think code to receive and flash firmware in DNS-323 is provided within firmware sources. Namely it's in goahead/webs.c file in function extractUploadedFileContent (along with extracting firmware image from multipart data).

Logic in merge-FrodoII.c and webs.c is pretty similar. Main difference lays in goahead/LINUX/custom.h.

Offline

 

#20 2008-05-20 15:27:30

fonz
Member / Developer
From: Berlin
Registered: 2007-02-06
Posts: 1716
Website

Re: Firmware builder for DNS-323

mindbender wrote:

what happens if a dns-323 is booted with a partitionless hdd? does it request kernel/initrd via tftp or does it do nothing?

The firmware root filesystem is on flash (it seems with disk-based extension since 1.05). It will start as usual, and after selecting an option in the web interface, it'll partition and format the disks.

Offline

 

#21 2008-05-21 09:49:55

helge9210
Member
Registered: 2008-05-20
Posts: 6

Re: Firmware builder for DNS-323

Yesterday I tried to build firmware for DNS-323 using merge-FrodoII and pieces extracted from live device (namely kernel image, ramdisk image and default.tar.gz//dev/mtdblock0).

DNS-323 starts uploading created firmware but throws "Firmware Upload Error" when process is 30% complete.

Offline

 

#22 2008-05-21 11:09:04

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: Firmware builder for DNS-323

i think it puts in some hash in that checks what devices it made for.


First user to fun_plug the dns-323.

Offline

 

#23 2008-05-22 19:03:16

mindbender
Member
Registered: 2007-10-29
Posts: 10

Re: Firmware builder for DNS-323

i ask myself what happens if the flash rootfs is corrupted and does not boot.....maybe it then falls back to tftp requests?

how exactly does the 8 MB flash look like?

what does

Code:

cat /proc/mtd

tell?

are the mtd contents easily dumpable and writeable with cat/dd?

are there tools included in the stock dns323 firmware that allow modifying the uboot variables (called maybe "nvram")?

if the above questions are answered with yes then it would be possible to replace the in-flash rootfs with foonas-em which is inspite its name actually nothing more than a rootfs with built-in webserver for automatically repartitioning the hdd, downloading various rootfs from the web, untar them and modify the uboot vars accordingly.

but in contrast to the current system it would change the booting behaviour....it would use the flash only for foonas-em and the actual productive rootfs would be on the hdd. debian/gentoo/ubuntu server/foonas anyway need more space.

and it would completely bypass the current installation method.....the easiest way back to the original firmware would IMHO be similar like a installation of another OS....downloading the stock flash contents together with MD5 sums, verifying the MD5 sums and then flashing them to the right mtd-devices. i might be wrong but i think this would not be a bad way....a simple click on a button in the foonas-em webinterface could trigger this as long as a working internet connection is there.

knowing that the dns323 already has initial support in the vanilla kernel it could automate also prepare everything for (de)bootstrapping debian/gentoo/ubuntu server as this box will be supported like every other machine as well..

my LS Pro is envious ...it only has 256 NOR flash for uboot, everything else is on hdd.

Last edited by mindbender (2008-05-22 19:07:42)

Offline

 

#24 2008-05-22 19:15:08

KRH
Member
From: Denmark
Registered: 2006-10-27
Posts: 219
Website

Re: Firmware builder for DNS-323

mindbender wrote:

i ask myself what happens if the flash rootfs is corrupted and does not boot.....maybe it then falls back to tftp requests?

how exactly does the 8 MB flash look like?

what does

Code:

cat /proc/mtd

tell?

are there tools included in the stock dns323 firmware that allow modifying the uboot variables (called maybe "nvram")?

Code:

/ # cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00010000 00002000 "MTD1"
mtd1: 00010000 00010000 "MTD2"
mtd2: 00180000 00010000 "Linux Kernel"
mtd3: 00630000 00010000 "File System"
mtd4: 00030000 00010000 "u-boot"

And no nvram and have not found any uboot variables program.


First user to fun_plug the dns-323.

Offline

 

#25 2008-05-22 20:04:19

mindbender
Member
Registered: 2007-10-29
Posts: 10

Re: Firmware builder for DNS-323

ok the so called fw_setenv and fw_printenv commands can be compiled from the uboot sourcecode.

this should be possible with the codesourcery toolchain 2005q3

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB