DSM-G600, DNS-3xx and NSA-220 Hack Forum

Grouper · 2006-09-19 16:31:11

Hi folks, you are doing a great job here, I´am kinda new to all this fun_plug stuff but it looks great.
Do you think there will be a way to compile a complete firmware from all these mods? As far as I ´ve read in other forums, the Firmware is a simple .tar-File, so this could work,don´t you think so?
Best regards, Grouper

TheWalt · 2006-09-19 21:28:26

From working with limited resource PDA's for a while (Sharp Zaurus), the biggest drawback of making an actual firmware is space. With the built in HD we can do pretty much anything as long as it will run in the given amount of RAM. With a firmware distro, you are limited by the smaller flash space. Also, a firmware release would never satisfy everyone... it will always have too many things or not enough. Fun_plug lets you add what you want, making things much more suitable to each individuals needs.

The only real firmware that I would see happening is an 'alt boot' loader to boot linux right from the HD bypassing the flash all together.

Just my 2 cents.

Grouper · 2006-09-20 11:41:13

Thanks TheWalt, now I see things a little clearer.
The reason why I was asking for a firmware was the advantage that a noob like me just can upload the file and thats it :-)
Understanding your argument now I´ll drill myself a little deeper into that fun_plug. Do you have any alternative resources for me, since the one posted here is a litle bit too tough for me...
Thanks in advance, googling fun_plug right away, Grouper :-)

sala · 2006-09-20 11:49:54

I totally agree that fun_pluging is not enough.

For now I have good news and bad news for you.
The good news is that we only need a new U-Boot image
So we can boot off from hard disk, if hard disk or kernel on it is not present, booting will continue from flash.
http://www.kurobox.com/mwiki/index.php/HOWTO_U-Boot

And the bad news - I don't know no one who can port this patch to DSM-G600

Finaly the worst news - aec62xx (ide controler) and ip1000a (network) is not supported by U-Boot. IP1000a is not yet even supported by official linux kernel.

sala · 2006-09-22 08:26:40

A word from a guy who patched U-Boot:

U-Boot doesn't have drivers for the controllers in the DSM-G600. Linux, however, does have drivers for all of them and the datasheets are available, at least for the network and disk controller. Porting Linux drivers to U-Boot is feasable. So, yes, it is possible to extend my current port for the DSM-G600.

The question is: Is it worth it? The device already has U-Boot even if a very old version. From my point of view, the device offers less then the LinkStation HG as the RAM is so small. The only extra, the wireless card, can be easily replaced with an USB stick plugged into the LS.

BertrandB · 2006-09-25 21:41:55

I'm trying to understand how the firmware work.

To understand you nedd to get GPL source npack the gohead and look in goahead webs.c
The two interestinf functions are :
extractUploadedFileContent and wrtieFlash.

If i'm not a total idiot the firmware contais the kernel and the ramdisk (but i do not understand exactly the format of the firmware)
the kernel is put in /dev/mtd4 and the ramdisk in /dev/mtd2. /dev/mtd0 contains your configuration and /dev/mtd2 he original parameters.

as you can see here
# more /proc/mtd
dev: size erasesize name
mtd0: 00010000 00002000 "Linux mtd1"
mtd1: 00010000 00010000 "Linux mtd2"
mtd2: 002e0000 00010000 "Linux Ramdisk"
mtd3: 00010000 00010000 "U-BOOT BOOT LOADER"
mtd4: 000f0000 00010000 "Linux Kernel"
# more /etc/fstab
proc /proc proc defaults 0 0
/dev/ram0 / minix defaults 1 1
/dev/mtdblock0 /sys/mtd1 minix defaults 0 0
/image.cfs /sys/crfs cramfs loop 0 0

But i do not understand if the kernel il a compressed kernel or a specila u-boot nor the strucure of the ramdisk

Here the 256 first byte of a firmware
0000000: 0000 0040 000d 071a 000d 075a 002d 4bff ...@.......Z.-K.
0000010: 003a 5359 0000 07ec 57dd 6b13 4e65 0bfd .:SY....W.k.Ne..
0000020: 73b1 a6dc 55aa 5361 6d62 612d 3358 55aa s...U.Samba-3XU.
0000030: 0402 0100 0000 0000 0000 0000 0000 0000 ................
0000040: 2705 1956 43f8 eca7 4407 e2cb 000d 06da '..VC...D.......
0000050: 0000 0000 0000 0000 333f 463f 0507 0201 ........3?F?....
0000060: 4c69 6e75 782d 322e 342e 3231 2d70 7265 Linux-2.4.21-pre
0000070: 3400 0000 0000 0000 0000 0000 0000 0000 4...............
0000080: 1f8b 0808 c9e2 0744 0203 766d 6c69 6e75 .......D..vmlinu
0000090: 7800 e45b 7f70 1455 9eff f6fc 8009 e4b0 x..[.p.U........
00000a0: d589 8c64 9274 2468 2231 3bf2 437b 7e10 ...d.t$h"1;.C{~.
00000b0: 3a21 d40d 86b3 064d 20ea e94e 9844 83a1 :!.....M ..N.D..
00000c0: 74d0 c0b6 f8a6 bb27 3358 b0e7 6d4d 12f0 t......'3X..mM..
00000d0: b815 d741 923e dc63 2d56 a564 4b52 0e0a ...A.>.c-V.dKR..
00000e0: 5642 bc3a dc13 3704 ff88 45a8 8d07 d605 VB.:..7...E.....
00000f0: 8433 2648 dff7 f54c 4216 d9a8 b7ab 4bd5 .3&H...LB.....K.

Last edited by BertrandB (2006-09-25 22:01:31)

sala · 2006-09-25 22:38:16

This should be U-Boot formated and also compressed kernel, because U-Boot can't load standard kernel image.

BertrandB · 2006-09-26 09:19:37

sala wrote:
This should be U-Boot formated and also compressed kernel, because U-Boot can't load standard kernel image.

Yes i think so i found a similar file under ppclinux : vmlinux.PPCBoot so now whe know how to make a new kernel

may be http://www.ertos.nicta.com.au/hardware/ … _howto.pml a good source for information

BertrandB · 2006-09-27 19:41:04

One step behond ....

mkimage from uboot pu à 64byte header on ramdisk
so you can retrieve the orginal ramdisk by this way
on your DSM
cat /dev/mtd2 > ramdisk.uboot
transfer it to your favorite linux box and then
dd bs=64 skip=1 if=ramdisk.uboot of=ramdisk.gz
gunzip ramdisk.gz
mount ramdisk /mnt -o loop

Ok now you can go in the ramdisk (ps ihe fs is an ext2).

to recreate a ramdisk.ubot look at the readme in root diretory of uboot (from GPLed sources)

I'll not use it but now you have all the tools to change the "firmware" (oh yes you need to compile the mkimage utility).

Nest step : understand the u-boot autoboot

BertrandB · 2006-10-06 18:51:37

Mmmmh

Take a look at http://www.freescale.com/files/32bit/do … AN3217.pdf
chapter 1.4

idiotboy · 2006-10-06 20:34:16

Would this mean that instead of the d-link linux loading a version of linux would load that would be more flexible and run applications that a standard linux OS would run?

I hope that makes some sense

BertrandB · 2006-10-06 22:53:42

idiotboy wrote:
Would this mean that instead of the d-link linux loading a version of linux would load that would be more flexible and run applications that a standard linux OS would run?

I hope that makes some sense

Yes i think it possible ...
just modiying the u-boot autoboot command to search a linuxrc file on the ramdisk
compiling a busybox with pivot_root
create the linuxrc file
put them on ramdisk
flash the ramdisk
flash the u-boot
(you keep the same kernel)

but be aware of the space in flash (look at /proc/mtd) if you make an error the dsm is dead.

I show the way but i'll don't use it, my husband and my daughters would not be happy if i crash our dsm.

kevin · 2006-10-16 13:27:11

if you upload a kernel/rootdisk image via u-boot (serial), it will not write it to flash unless it is less then the size limit

BertrandB · 2006-10-16 21:52:04

kevin wrote:
if you upload a kernel/rootdisk image via u-boot (serial), it will not write it to flash unless it is less then the size limit

Ok but i tell about flashing without serial by copying in the apropriate mtd. An with this method there is no protections

sala · 2006-11-05 20:30:26

With DNS-312H GPL sources D-Link has also set available a image builder and instructions. I think we could find something useful there.
http://tsd.dlink.com.tw/temp/download/1268/dns321h.zip (89MB)

kevin · 2006-11-19 00:50:04

making a new u-boot loader shouldn't be necessary to use a new kernel, I was able to replace the kernel and ramdisk images using the existing u-boot and have it load them (but I don't know how to get a proper kernel compiled). of course, an improved u-boot image with tftp support and such would be appreciated, if not strictly required

qn1234 · 2006-11-23 08:40:56

Kevin,

Could you elaborate a bit on your findings. How did you go about having u-boot to load the new kernel and ramdisk? Did you have a serial port wired up to a dumb terminal?

--
Quang

sala · 2006-11-24 20:25:39

qn1234 wrote:
Did you have a serial port wired up to a dumb terminal?

Yep, you need a serial port to interact with u-boot.

qn1234 · 2006-11-25 02:31:56

Do you have information on how to how to solder a serial port on this unit?

--
Quang

beattie · 2006-11-26 09:56:46

To add a serial console you need to convert the logic levels to RS232 levels, I have ordered an A232DBH3v from http://www.compsys1.com/workbench/On_to … apter.html

Check out thread on serial Interface in this forum for the location to hook it up to, you will probably need to do some soldering.

kevin · 2006-11-29 13:58:11

the serial port on the device already has socket to plug in to, provided you can find the matching connector (which is advised, due to the rather small size), it is 3.3v cmos/ttl, so you will indeed need a converter if you intend to connect it to a normal serial port. I just connected some wires to carefully chosen points on a usb-serial converter to get the proper interface, and avoid buying extra parts online

http://forum.openwrt.org/viewtopic.php?id=4275 - here's some more info on the pinout and such, although I think tx/rx are reversed

I don't know anyone who still has a dumb terminal, I just used a computer

beattie · 2006-11-29 22:46:39

My DSM-G600 does snot have a serial port connector, just holes.

Last edited by beattie (2006-11-29 22:47:21)

sala · 2006-11-30 08:15:09

Some units have it and some don't, for example mine do not have it also.

beattie · 2006-12-11 20:58:01

I've done some analysis of the DSM G600. I have found that the various pieces of firmware, u-boot, kernel and ramdisk are all pretty tightly wedged in with very little(no) room left for new features in the flash. Much of the "user level" code, such as the daemon that looks for button presses, does not appear to be supplied in source form by D-Link.

Since the flash is pretty full, what I was going to do, is to work on implementing a scheme to allow overriding the ramdisk system. Basicaly, I would modify initialization sequence, such that if there is a particular file or directory on the disk or maybe a usbkey (not decided yet), the system would bring that up as the firmware instead of the ramdisk.

Also I would like to implement a wireless mesh which probably requires a new wireless card and maybe a 2.6 kernel.

I have not decided:
where I would look for the ramdisk override
would the ramdisk override be a filesystem or an actual filesystem or something else.

BertrandB · 2006-12-12 09:34:45

beattie wrote:
I've done some analysis of the DSM G600. I have found that the various pieces of firmware, u-boot, kernel and ramdisk are all pretty tightly wedged in with very little(no) room left for new features in the flash. Much of the "user level" code, such as the daemon that looks for button presses, does not appear to be supplied in source form by D-Link.

Since the flash is pretty full, what I was going to do, is to work on implementing a scheme to allow overriding the ramdisk system. Basicaly, I would modify initialization sequence, such that if there is a particular file or directory on the disk or maybe a usbkey (not decided yet), the system would bring that up as the firmware instead of the ramdisk.

Also I would like to implement a wireless mesh which probably requires a new wireless card and maybe a 2.6 kernel.

I have not decided:
where I would look for the ramdisk override
would the ramdisk override be a filesystem or an actual filesystem or something else.

I think it woud be a nice idea to put the new ramdisk on a usb key. If you make an error you just put off the key an the dsm still work.
Do you invetigate on pivotroot ?
I thin it's harder to change uboot to boot a new kernel on usb key or ide

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2006-09-19 16:31:11

New Firmware instead of Fun_Plug

#2 2006-09-19 21:28:26

Re: New Firmware instead of Fun_Plug

#3 2006-09-20 11:41:13

Re: New Firmware instead of Fun_Plug

#4 2006-09-20 11:49:54

Re: New Firmware instead of Fun_Plug

#5 2006-09-22 08:26:40

Re: New Firmware instead of Fun_Plug

#6 2006-09-25 21:41:55

Re: New Firmware instead of Fun_Plug

#7 2006-09-25 22:38:16

Re: New Firmware instead of Fun_Plug

#8 2006-09-26 09:19:37

Re: New Firmware instead of Fun_Plug

sala wrote:

#9 2006-09-27 19:41:04

Re: New Firmware instead of Fun_Plug

#10 2006-10-06 18:51:37

Re: New Firmware instead of Fun_Plug

#11 2006-10-06 20:34:16

Re: New Firmware instead of Fun_Plug

#12 2006-10-06 22:53:42

Re: New Firmware instead of Fun_Plug

idiotboy wrote:

#13 2006-10-16 13:27:11

Re: New Firmware instead of Fun_Plug

#14 2006-10-16 21:52:04

Re: New Firmware instead of Fun_Plug

kevin wrote:

#15 2006-11-05 20:30:26

Re: New Firmware instead of Fun_Plug

#16 2006-11-19 00:50:04

Re: New Firmware instead of Fun_Plug

#17 2006-11-23 08:40:56

Re: New Firmware instead of Fun_Plug

#18 2006-11-24 20:25:39

Re: New Firmware instead of Fun_Plug

qn1234 wrote:

#19 2006-11-25 02:31:56

Re: New Firmware instead of Fun_Plug

#20 2006-11-26 09:56:46

Re: New Firmware instead of Fun_Plug

#21 2006-11-29 13:58:11

Re: New Firmware instead of Fun_Plug

#22 2006-11-29 22:46:39

Re: New Firmware instead of Fun_Plug

#23 2006-11-30 08:15:09

Re: New Firmware instead of Fun_Plug

#24 2006-12-11 20:58:01

Re: New Firmware instead of Fun_Plug

#25 2006-12-12 09:34:45

Re: New Firmware instead of Fun_Plug

beattie wrote:

Board footer