DSM-G600, DNS-3xx and NSA-220 Hack Forum

I have some good news! - I Booted into the Marvell U-BOOT Monitor mode
  To break into U-BOOT monitor type the two keys SPACE 1 within 3 seconds.
  That is the Space Bar and the number 1
  (Thank you objdump - we disassembled the code! )


How: I updated and I wrote out a valid environment to Flash! (aside: D-LINK was not using the environment from Flash - there was no valid data or CRC for the environment so instead the code loaded hard coded defaults)

Details: I noticed that by design the first 1K of a minix partition is basically not used. The U-BOOT environment structure is a 4 byte CRC32 followed by null terminated environment strings and ending with a double null termination. (here null = 0) While the environment can grow to 0x7ffc bytes in length - we can easily keep it under 1K. The environment, as programmed into the code, wants to live in the first 0x8000 bytes of the MTD1 flash region - but this MTD1 area was used instead as a 0x10000 byte size minix file system by D-LINK.  A long term solution might be to reprogram the U-BOOT loader to use only the first 0x400 bytes - a task best left to a future time if we figure out the JTAG pinout and details. 

I found that by setting a new variable: enaMonExt=yes
will turn on extra features. This turns on Monitor Boot Mode

Aside: The only reason to mess with the U-BOOT loader is if we want to try new kernels without as much fear of "bricking" our units (if we try a kernel that is broken we can always load another via the serial interface - worst case)


Here is the result of printenv from the Marvell U-BOOT prompt
(note: I changed a few of the variables)

Marvell>> printenv
bootcmd=bootm FF820000 FF9A0000
bootdelay=5
baudrate=115200
serverip=172.16.136.38
rootpath=/mnt/ARM_FS/armfs
stdin=serial
stdout=serial
stderr=serial
cpuName=926
enaPT=yes
CASset=min
enaCpuStream=no
enaWrAllo=no
MALLOC_len=4
ethprime=egiga0
bootargs_root=root=/dev/nfs rw
bootargs_end=:::DB88FXX81:egiga0:none
image_name=uImage
standalone=fsload 0x400000 $(image_name);setenv bootargs $(bootargs) root=/dev/mtdblock0 rw ip=$(ipaddr):$(serverip)$(bootargs_end); bootm 0x400000;
disaMvPnp=no
ethaddr=00:00:00:00:51:82
overEthAddr=no
usbMode=host
bootargs=root=/dev/ram=console=ttyS0,115200 :::DB88FXX81:egiga0:none

Environment size: 692/32764 bytes
Marvell>>




I now have two of these units so hopefully the details will be all worked out soon.

Last edited by magore (2007-02-15 00:05:47)