DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

Announcement

#1 2008-12-27 19:57:53

skydreamer
Member
From: At the Atlantic Coast
Registered: 2007-01-06
Posts: 232

Bricked DNS-323 recovery

While flashing the firmware v1.06 b65 I have managed to brick my DNS-323 probably by pulling the power plug too soon.

Since there is no DNS-323 specific firmware recovery procedure it took me a while to get the right tools and understand the recovery process hence for future reference I have decided to create this brief manual.

If the DNS-323 does not boot up try to perform a hardware reset with the disks and then without the disks. When this does not help, remove the disks and it is time to take the screwdriver out. Using Philips 1 remove the 4 screws from the rear panel under the rubber seals and then 4 more fixing the PCB assembly to the chassis.

Next find the connector J4 which is the serial interface. I could not get the right size connector to fit J4 hence had no choice but to solder 4 telephone wires to the other side of J4 (soldering side of the PCB). It is a fiddly job, for novices use fine PCB grade soldering iron, add some solder to the joints, put some more solder on the wires and then pray for steady hands. Make sure that you have the de-soldering suction pump on standby and do not set the temperature of the soldering iron over 380C.

Using the 4 telephone wires I finally managed to connect RS232 to TTL converter previously made from an old Nokia data cable. With an ohmmeter you can figure out which side of the J4 connector is the ground by measuring the resistance to one of the grounded components such as the enclosure of the Ethernet socket. The opposite end of the J4 connector is 3.3Volts and in between is Rx and Tx. I am not sure if the picture describing these in WiKi is correct, anyway when measured to the ground the TX has lower resistance (in kilo ohms)  than the Rx (mega ohms). 3.3Volts is provided by the DNS-323 so your converter is not expected to feed it back to the DNS-323.

Connect a PC and set the terminal emulation to 115200, 8N1, no flow control. You should see the progress of the DNS-323 boot at this stage. If you get no text, switch over Tx and Rx and try again also make sure that the RS-232/TTL converter is working.

Providing that there is a text output on the screen make note of what it says. If you get CRC errors either with kernel or ramdisk image the rest of this procedure is for you. If the u-boot loader is damaged i.e. it does not come up at all or appears to be damaged make yourself a jtag interface and report back on how to recover the damaged u-boot loader with jtag.

When the kernel or the ramdisk (initrd) image is corrupt you can recover the system using binary (kermit) transfer. Most of the kermit transfer packages are awfully old- they have not been updated for 4 and more years and I could not get any of the free windows ones working. So I had to download the sources of c-kermit from http://www.columbia.edu/kermit/ck80.html and compile them under FC8 by issuing "make linux".

With c-kermit compiled you need to set the serial interface, speed to 115200, 8N1, no control, transfer block size to 1KByte. This can be done from kermit's command line.

When either the kernel or ramdisk image is corrupt the system boots in a loop and can be interrupted within 3 seconds of the u-boot timeout using the SPACE key and the number 1 key pressed consequently.

Next thing you have to download is one of the old firmwares, it has to have the ramdisk size below 6,160,384 Bytes, which ramdisk in firmware v1.05 exceeds. I have opted for the initial release v1.00 as it cuts down on time needed for serial transfer.
When you get the right firmware you need to download splitdns323fw script to extract the kernel and ramdisk from the image. It uses ruby scripting engine that must be installed on your linux machine. You can get the script here http://www.hezmatt.org/~mpalmer/darcs/d … ols.trunk/

Extract both kernel and ramdisk to your kermit directory and run the c-kermit. It defaults to terminal in which you can stop the u-boot process as described above and issue command "loadb k" to switch u-boot to binary transfer of the extracted kernel. The escape character from terminal to file transfer in c-kermit is CTRL+\ followed by c . To upload the kernel issue "send filename" and wait for the transfer to finish. The kernel takes less than 2 minutes, ramdisk just over 8 minutes. When the transfer ends issue "connect" and you are back to the terminal screen where you can watch the progress of the flash. It has two steps- deletes the old image first and then uploads the new image. Wait until you get the command prompt again. Issue "loadb r" to load the ramdisk image and follow the same process as with the kernel. Wait for the flash process to complete and pull the plug on DNS-323.

If you were lucky the CRC error messages disappear and you will be presented with v1.00 firmware configuration page. Unplug the power again, insert into the PCB assembly some old SATA disk, format it and if it hangs there power cycle the DNS-323 after approximately 5 minutes, this time it will boot normally. Head for the tools page and upgrade the firmware to the latest release of your choice. Finally power down the DNS-323, remove the temporary disk and plug in your old disks, they should boot up normally and you should see your old data.

If you are the curious one you can use the magic number 5784468 to break into the shell.

To finish this lengthy work desolder the J4 connector wires and clean the connector soldering joints using isopropyl alcohol or pure alcohol with a soft brush and assemble the unit back.

The whole process takes approximately 2 hours if you need to setup the environment providing that you have the RS-232/TTL converter handy.

Last edited by skydreamer (2008-12-27 20:03:38)

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB