DSM-G600, DNS-3xx and NSA-220 Hack Forum

kojuharov · 2017-01-29 11:11:10

Hello friends,

i need help. I read all possible tutorials in internet for recovering of D-Link DNS-323 ... but ...

Before couple of mouths I install Debian on my DNS-323. All was fine before my sun to try reflash with stock firmware.
In this moment i can't connect to the device with LAN (can't get IP from DHCP). When I turned on the device start blinking power LED.
By Serial port i see the problem but can't send command to the device (try with TerraTeam, try with Putty ...)
When start device i try to press power button or reset button to stop Autoboot but NAS continue with booting.
I using USB to TTL cable (with CH3400 chip) connecting to R,T and GND
Please help me with any ideas.

Sorry for bad English !

** LOADER **
** MARVELL BOARD: RD-88F5182-NAS-2 LE

U-Boot 1.1.1 (Feb 26 2009 - 11:33:03) Marvell version: 1.7.3.003

DRAM CS[0] base 0x00000000 size 64MB
DRAM Total size 64MB
Detect phy 1118
[8192kB@ff800000] Flash: 8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

Soc: MV88F5182 Rev 2
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode
USB 1: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot: 0
## Booting image at ff820000 ...
Image Name: kernel 3.16.0-4-orion5x
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1560840 Bytes = 1.5 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
## Loading Ramdisk Image at ff9a0000 ...
Image Name: ramdisk 3.16.0-4-orion5x
Image Type: ARM Linux RAMDisk Image (uncompressed)
Data Size: 3186022 Bytes = 3 MB
Load Address: 00800000
Entry Point: 00800000
Verifying Checksum ... OK

Starting kernel ...

Uncompressing Linux... done, booting the kernel.
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Linux version 3.16.0-4-orion5x (debian-kernel@lists.debian.org) ( gcc version 4.8.4 (Debian 4.8.4-1) ) #1 Debian 3.16.7-ckt20-1+deb8u3 (2016-01-17 )
[ 0.000000] CPU: Feroceon [41069260] revision 0 (ARMv5TEJ), cr=a005317f
[ 0.000000] CPU: VIVT data cache, VIVT instruction cache
[ 0.000000] Machine: D-Link DNS-323
[ 0.000000] Clearing invalid memory bank 0KB@0xffffffff
[ 0.000000] Clearing invalid memory bank 0KB@0xffffffff
[ 0.000000] Clearing invalid memory bank 0KB@0xffffffff
[ 0.000000] Ignoring unrecognised tag 0x00000000
[ 0.000000] Ignoring unrecognised tag 0x00000000
[ 0.000000] Ignoring unrecognised tag 0x00000000
[ 0.000000] Ignoring unrecognised tag 0x41000403
[ 0.000000] Memory policy: Data cache writeback
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pag es: 16256
[ 0.000000] Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FX X81:egiga0:none
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Memory: 57300K/65536K available (2834K kernel code, 244K rwdata, 1004K rodata, 144K init, 253K bss, 8236K reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] vector : 0xffff0000 - 0xffff1000 ( 4 kB)
[ 0.000000] fixmap : 0xffc00000 - 0xffe00000 (2048 kB)
[ 0.000000] vmalloc : 0xc4800000 - 0xff000000 ( 936 MB)
[ 0.000000] lowmem : 0xc0000000 - 0xc4000000 ( 64 MB)
[ 0.000000] modules : 0xbf000000 - 0xc0000000 ( 16 MB)
[ 0.000000] .text : 0xc0008000 - 0xc03c7c30 (3840 kB)
[ 0.000000] .init : 0xc03c8000 - 0xc03ec1f4 ( 145 kB)
[ 0.000000] .data : 0xc03ee000 - 0xc042b250 ( 245 kB)
[ 0.000000] .bss : 0xc042b250 - 0xc046a66c ( 254 kB)
[ 0.000000] NR_IRQS:64
[ 0.000018] sched_clock: 32 bits at 166MHz, resolution 6ns, wraps every 25769 803770ns
[ 16.750035] Console: colour dummy device 80x30
[ 16.750073] Calibrating delay loop... 331.26 BogoMIPS (lpj=662528)
[ 16.781570] pid_max: default: 32768 minimum: 301
[ 16.781855] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 16.781883] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 16.783395] Initializing cgroup subsys devices
[ 16.783492] Initializing cgroup subsys freezer
[ 16.783535] Initializing cgroup subsys net_cls
[ 16.783606] Initializing cgroup subsys blkio
[ 16.783666] Initializing cgroup subsys perf_event
[ 16.783703] Initializing cgroup subsys net_prio
[ 16.783852] CPU: Testing write buffer coherency: ok
[ 16.784576] Setting up static identity map for 0x2adaa0 - 0x2adadc
[ 16.787269] devtmpfs: initialized
[ 16.789784] VFP support v0.3: not present
[ 16.790439] pinctrl core: initialized pinctrl subsystem
[ 16.791108] NET: Registered protocol family 16
[ 16.792085] DMA: preallocated 256 KiB pool for atomic coherent allocations
[ 16.793842] Orion ID: MV88F5182-A2. TCLK=166666667.
[ 16.794251] DNS-323: Identified HW revision C1
[ 16.794947] DNS-323: Found ethernet MAC address: 1c:af:f7:02:9d:46.
[ 16.806262] Switched to clocksource orion_clocksource
[ 16.825911] NET: Registered protocol family 2
[ 16.828157] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 16.828222] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 16.828267] TCP: Hash tables configured (established 1024 bind 1024)
[ 16.828404] TCP: reno registered
[ 16.828435] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 16.828484] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 16.828914] NET: Registered protocol family 1
[ 16.829467] Unpacking initramfs...
[ 17.553733] Freeing initrd memory: 3108K (c0800000 - c0b09000)
[ 17.555554] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 17.555735] audit: initializing netlink subsys (disabled)
[ 17.555863] audit: type=2000 audit(0.804:1): initialized
[ 17.557703] VFS: Disk quotas dquot_6.5.2
[ 17.557812] Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)
[ 17.558058] msgmni has been set to 117
[ 17.560099] alg: No test for stdrng (krng)
[ 17.560332] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 2 52)
[ 17.560851] io scheduler noop registered
[ 17.561279] io scheduler cfq registered (default)
[ 17.562753] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 17.564173] console [ttyS0] disabled
[ 17.584264] serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 3, base_baud = 1041 6666) is a 16550A
[ 18.017041] console [ttyS0] enabled
[ 18.022519] physmap platform flash device: 00800000 at f4000000
[ 18.028759] physmap-flash.0: Found 1 x16 devices at 0x0 in 8-bit bank. Manufa cturer ID 0x00007f Chip ID 0x0000cb
[ 18.038993] Amd/Fujitsu Extended Query Table at 0x0040
[ 18.044163] Amd/Fujitsu Extended Query version 1.1.
[ 18.049246] number of CFI chips: 1
[ 18.076613] Creating 5 MTD partitions on "physmap-flash.0":
[ 18.082252] 0x000000000000-0x000000010000 : "MTD1"
[ 18.089104] 0x000000010000-0x000000020000 : "MTD2"
[ 18.095968] 0x000000020000-0x0000001a0000 : "Linux Kernel"
[ 18.103521] 0x0000001a0000-0x0000007d0000 : "File System"
[ 18.110993] 0x0000007d0000-0x000000800000 : "u-boot"
[ 18.119073] mousedev: PS/2 mouse device common for all mice
[ 18.125454] i2c /dev entries driver
[ 18.131497] rtc-m41t80 0-0068: rtc core: registered m41t80 as rtc0
[ 18.139577] ledtrig-cpu: registered to indicate activity on CPUs
[ 18.146378] TCP: cubic registered
[ 18.149728] NET: Registered protocol family 17
[ 18.155502] registered taskstats version 1
[ 18.161488] rtc-m41t80 0-0068: setting system clock to 2017-01-29 08:24:49 UT C (1485678289)
[ 18.171441] Freeing unused kernel memory: 144K (c03c8000 - c03ec000)
Loading, please wait...
[ 18.350731] systemd-udevd[49]: starting version 215
[ 18.371373] random: systemd-udevd urandom read with 3 bits of entropy availab le
[ 18.655897] SCSI subsystem initialized
[ 18.741855] sata_mv sata_mv.0: cannot get optional clkdev
[ 18.779277] sata_mv sata_mv.0: slots 32 ports 2
[ 18.840069] scsi0 : sata_mv
[ 18.857231] scsi1 : sata_mv
[ 18.865016] ata1: SATA max UDMA/133 irq 29
[ 18.869201] ata2: SATA max UDMA/133 irq 29
[ 19.190354] ata1: SATA link down (SStatus 0 SControl 300)
[ 19.514350] ata2: SATA link down (SStatus 0 SControl 300)
Begin: Loading essential drivers ... done.
Begin: Running /scripts/init-premount ... done.
Begin: Mounting root file system ... Begin: Running /scripts/local-top ... done.
Begin: Running /scripts/local-premount ... done.
Begin: Waiting for root file system ... Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
Begin: Running /scripts/local-block ... done.
done.
Gave up waiting for root device. Common problems:
- Boot args (cat /proc/cmdline)
- Check rootdelay= (did the system wait long enough?)
- Check root= (did the system wait for the right device?)
- Missing modules (cat /proc/modules; ls /dev)
ALERT! /dev/disk/by-uuid/0717668a-af3b-4e2d-a5aa-cc9a98f75a7e does not exist. Dropping to a shell!
modprobe: module i8042 not found in modules.dep
modprobe: module ehci-pci not found in modules.dep
modprobe: module ehci-orion not found in modules.dep
modprobe: module ehci-hcd not found in modules.dep
modprobe: module uhci-hcd not found in modules.dep
modprobe: module ohci-hcd not found in modules.dep
modprobe: module usbhid not found in modules.dep

BusyBox v1.22.1 (Debian 1:1.22.0-9+deb8u1) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/bin/sh: can't access tty; job control turned off
(initramfs)

Mijzelf · 2017-01-29 22:47:52

By Serial port i see the problem but can't send command to the device (try with TerraTeam, try with Putty ...)

Make sure that you don't use hardware handshake. Handshake should be 'none'.

kojuharov · 2017-01-30 15:00:03

Hello,

thank you for feedback !

Setting is correct, I think
So, may be the problem is in my ttl cable. I use arduino nano like a usb cable. I see the boot log, but can't send command to device.
Or the problem is in Debian OS. All worked long time, but i removed HDD (and deep formated). After removing HDDS start with problem.

I will continue with searching.

Last edited by kojuharov (2017-01-30 16:50:48)

Attachments:

settings.png, Size: 32,101 bytes, Downloads: 143

Mijzelf · 2017-01-30 21:08:11

kojuharov wrote:
After removing HDDS start with problem.

You bet.

ALERT! /dev/disk/by-uuid/0717668a-af3b-4e2d-a5aa-cc9a98f75a7e does not exist. Dropping to a shell!

The system wants to mount a filesystem containing a Debian rootfs, with UUID 0717668a-af3b-4e2d-a5aa-cc9a98f75a7e. If you prepare a disk to offer that I think your box will boot again.

kojuharov · 2017-02-19 11:04:17

Hello Mijzelf,

i can't offer filesystem containing a Debian rootfs, with UUID 0717668a-af3b-4e2d-a5aa-cc9a98f75a7e, because HDD is broken. I try kermit upload of stock firmware, but box not recieve command stop autobooting.
On step "Hit any key to stop autoboot: 0" i try to pressed power button, reset button of box, but nothing. I try to pressing space, esc, enter and more from keyboard of linked pc again nothing ...
any ideas.

Already i've access to busybox console with any commands:

. : [ [[ alias bg break cd chdir command continue echo eval exec
exit export false fg getopts hash help history jobs kill let
local printf pwd read readonly return set shift source test times
trap true type ulimit umask unalias unset wait [ [[ acpid adjtimex
ar arp arping ash awk basename blockdev brctl bunzip2 bzcat bzip2
cal cat chgrp chmod chown chroot chvt clear cmp cp cpio cttyhack
cut date dc dd deallocvt depmod devmem df diff dirname dmesg
dnsdomainname dos2unix du dumpkmap dumpleases echo egrep env
expand expr false fgrep find fold free freeramdisk fstrim ftpget
ftpput getopt getty grep groups gunzip gzip halt head hexdump
hostid hostname httpd hwclock id ifconfig init insmod ionice
ip ipcalc kill killall klogd last less ln loadfont loadkmap logger
login logname logread losetup ls lsmod lzcat lzma lzop lzopcat
md5sum mdev microcom mkdir mkfifo mknod mkswap mktemp modinfo
modprobe more mount mt mv nameif nc netstat nslookup od openvt
patch pidof ping ping6 pivot_root poweroff printf ps pwd rdate
readlink realpath reboot renice reset rev rm rmdir rmmod route
rpm rpm2cpio run-parts sed seq setkeycodes setsid sh sha1sum
sha256sum sha512sum sleep sort start-stop-daemon stat strings
stty swapoff swapon switch_root sync sysctl syslogd tac tail
tar taskset tee telnet test tftp time timeout top touch tr traceroute
traceroute6 true tty udhcpc udhcpd umount uname uncompress unexpand
uniq unix2dos unlzma unlzop unxz unzip uptime usleep uudecode
uuencode vconfig vi watch watchdog wc wget which who whoami xargs
xz xzcat yes zcat

** LOADER **
** MARVELL BOARD: RD-88F5182-NAS-2 LE

U-Boot 1.1.1 (Feb 26 2009 - 11:33:03) Marvell version: 1.7.3.003

DRAM CS[0] base 0x00000000 size 64MB
DRAM Total size 64MB
Detect phy 1118
[8192kB@ff800000] Flash: 8 MB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
*** Warning - bad CRC, using default environment

Soc: MV88F5182 Rev 2
CPU: ARM926 (Rev 0) running @ 500Mhz
SysClock = 166Mhz , TClock = 166Mhz

USB 0: host mode
USB 1: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Hit any key to stop autoboot: 0
## Booting image at ff820000 ...
Image Name: kernel 3.16.0-4-orion5x
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1560840 Bytes = 1.5 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
## Loading Ramdisk Image at ff9a0000 ...
Image Name: ramdisk 3.16.0-4-orion5x
Image Type: ARM Linux RAMDisk Image (uncompressed)
Data Size: 3186022 Bytes = 3 MB
Load Address: 00800000
Entry Point: 00800000
Verifying Checksum ... OK

Starting kernel ...

Mijzelf · 2017-02-19 23:22:16

What is your goal?

i can't offer filesystem containing a Debian rootfs, with UUID 0717668a-af3b-4e2d-a5aa-cc9a98f75a7e, because HDD is broken.

A nas without harddisk is pretty useless.

On step "Hit any key to stop autoboot: 0" i try to pressed power button, reset button of box, but nothing. I try to pressing space, esc, enter and more from keyboard of linked pc again nothing ...

You don't get a count-down? In that case I guess the timeout is set to 0 seconds, making it (almost?) impossible to intercept the boot.

any ideas.

Your busybox contains all tools to bring up the network interface, and wget and ftpget. So it should be possible to download the firmware from some server, and write it to the right mtdblocks. Don't know if you can simply dd it to /dev/mtdblockX, or that you have to (download and) use flash_eraseall & nandwrite. Maybe the install scripts for Debian or Alt-F can tell you that.

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2017-01-29 11:11:10

Bricked DNS-323 ver. C1

#2 2017-01-29 22:47:52

Re: Bricked DNS-323 ver. C1

#3 2017-01-30 15:00:03

Re: Bricked DNS-323 ver. C1

#4 2017-01-30 21:08:11

Re: Bricked DNS-323 ver. C1

kojuharov wrote:

#5 2017-02-19 11:04:17

Re: Bricked DNS-323 ver. C1

#6 2017-02-19 23:22:16

Re: Bricked DNS-323 ver. C1

Board footer