Unfortunately no one can be told what fun_plug is - you have to see it for yourself.
You are not logged in.
(It's a bit of a misnomer to call it a "builder", since it doesn't build whole firmware images, hence "assembler")
I just wanted to let everyone who is building custom firmware images for the DNS-323 that I've written a tool to assemble firmware images from a kernel and initrd, so you can upload your custom firmwares via the vendor-provided web interface.
It's based on the info provided by Leschinsky Oleg about the format of the firmware images, but it's a far more useable and maintainable tool than has previously been available.
At the moment there's only a firmware assembler, but I'm planning on adding a disassembler and validator when I get time; either Leschinsky's code, or another rewritten tools.
The code is http://theshed.hezmatt.org/dns323-firmware-tools/ if anyone's interested.
- Matt
Offline
Thanks! Maybe this will make nice alternative firmware available for the DNS323 and the CH3NAS in the future!
Offline
[DrAg] wrote:
Thanks! Maybe this will make nice alternative firmware available for the DNS323 and the CH3NAS in the future!
It's pretty simple to create working initrds from ffp packages. If someone creates a nice web interface, this might make an interesting alternative firmware.
Offline
I would be interested in a "dissassembler" if you are planning on building one.
Also, still trying to figure out whether there is a way to convert the uImage kernel format to a zImage format.
Offline
puterboy wrote:
I would be interested in a "dissassembler" if you are planning on building one.
You can use parseFirmware.py from http://hg.leschinsky.in.ua/makeFirmware … 5934923d15 if you need to split out the various bits. It's not pretty, but it works for the most part (just remember to change LLLLLLLLL to IIIIIIIII if you're running on a 64-bit platform).
puterboy wrote:
Also, still trying to figure out whether there is a way to convert the uImage kernel format to a zImage format.
Strip the first 64 bytes off the uboot image and you'll have whatever it was before uboot got a hold of it. You can do this with dd, like so: dd if=file.uboot of=file bs=64 skip=1
- Matt
Offline
Thanks - that works for me!
Offline
Will this work with the DNS-321? (DNS-323's cheaper, younger brother)
Offline
bklynkid wrote:
Will this work with the DNS-321? (DNS-323's cheaper, younger brother)
I have no idea, but if you point me to an official firmware image I can download, I can tell you (and update the docs if appropriate to give you the magic numbers you need).
Offline
mpalmer wrote:
bklynkid wrote:
Will this work with the DNS-321? (DNS-323's cheaper, younger brother)
I have no idea, but if you point me to an official firmware image I can download, I can tell you (and update the docs if appropriate to give you the magic numbers you need).
Here, is this what you need?
ftp://ftp.dlink.com/GPL/DNS-321
Offline
bklynkid wrote:
mpalmer wrote:
bklynkid wrote:
Will this work with the DNS-321? (DNS-323's cheaper, younger brother)
I have no idea, but if you point me to an official firmware image I can download, I can tell you (and update the docs if appropriate to give you the magic numbers you need).
Here, is this what you need?
ftp://ftp.dlink.com/GPL/DNS-321
No, that's the source for the firmware. I need the compiled, ready-to-upload-to-the-device firmware image. I can't find one from a quick browse around D-Link's site, but you might have more luck.
Offline
Oh ok, it seems they have not yet put one on the site. The 321 is fairly new with no firmware update yet available. I guess a few more weeks and we'll see one as there are a few glaring problems with the device they will need to fix.
Thanks I'll post here when I see one.
Offline
Ok they finally came out with am updated firmware. Can you do anything with this?
ftp://ftp.dlink.com/Multimedia/dns321/F … re_101.zip
Offline
bklynkid wrote:
Ok they finally came out with am updated firmware. Can you do anything with this?
ftp://ftp.dlink.com/Multimedia/dns321/F … re_101.zip
Hmm, OK, so it isn't immediately obvious that it's the same firmware format; there's no mention of FrodoII, but that "Chopper" string looks to be suspiciously similar... it mentions "Linux-2.6.22.7" and there's uBoot signatures at offsets 64 and 1545292 (decimal)... what if I just ignore the change in string and retry? Hey presto! Everything is the same, format wise, except for the signature string. It looks like someone decided that "FrodoII" was getting a bit too well known and decided to mangle it to something else... why do software developers do this shit? It's not as though it takes more than 10 minutes to work it out and work around it. Sheesh.
So, it *is* just a FrodoII with the serial numbers filed off. Teaching my firmware tools to read and write it appears to be a trivial operation, which I've just done. I've pushed the updates I've made to my darcs repo, so you can try them out. I've also added a splitdns323fw tool, which reads and verifies the metadata and writes out the kernel/initrd/defaults if you want it to.
For the record, the uBoot headers for the kernel and initrd are:
Image Name: Linux-2.6.22.7
Created: Tue Sep 23 13:36:56 2008
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1545164 Bytes = 1508.95 kB = 1.47 MB
Load Address: 0x00008000
Entry Point: 0x00008000
Image Name: Ramdisk
Created: Thu Oct 9 20:22:24 2008
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 8465091 Bytes = 8266.69 kB = 8.07 MB
Load Address: 0x00800000
Entry Point: 0x00800000
So it's an ARM machine, probably runs similar internals to the DNS-323. Without a dmesg I can't be sure, but I suspect that porting something else (like Debian) to run on it won't be a massive undertaking, if that's what you're considering.
Offline
Wow that was quick!
Well I gotto admit, I'm kind of a noob so I doubt I'll be running Debian or anything like that. I was looking to maybe just add a few tools and build some web front-ends for them.
I figured out how to use your tools, they look solid. Thanks.
Offline
bklynkid wrote:
Wow that was quick!
I got curious, and then it turned out that it was a pretty trivial change in the end, so I figured "no time like the present"...
bklynkid wrote:
Well I gotto admit, I'm kind of a noob so I doubt I'll be running Debian or anything like that. I was looking to maybe just add a few tools and build some web front-ends for them.
Hey, send me one and I'll make d-i work for it like I did for the DNS-323...(grin) Then system installation is no harder than it would be on a PC.
I'm not sure if producing a custom firmware is the best way to put a custom tool or web front-end onto the system, though -- I'd be more inclined to go with something based around fun_plug and friends.
Offline
Hello all,
Firstly this may need its own thread as my device is a Dlink DNS-343 ( 4 bay device )
Secondly hoping that mpalmer ( or anyone else ) might be so kind as to take a look at the DNS-343 firmware for me and explain why I am having a hard time saving the root account in an enabled state and saving a _new_ user account at all.
Accounts can be created but are lost during a power cycle.
The current AU firmware can be found here : `ftp://files.dlink.com.au/products/DNS-343/REV_A/Firmware//Firmware_v1.02b10/NS401_DLINKEu_DNS343.1.02b10(1.18.0627.2008)`
NOTE : that link appears to be broken you need the `(1.18.0627.2008)` at the end of the file.
There is also a North American version of the firmware from this link : ftp://ftp.dlink.com//Multimedia/dns343/ … re_102.zip
I have had a quick poke at the both firmwares and found they both have a "Gandolf" string at the start so Dlink have probably made some minor changes from the DNS-323 code with the "FrodoII" and "Chopper" strings.
I have attached a TXT file with my dmesg log, output from `cat /proc/cpuinfo` and `uname -a`
When i try and use the `store-passwd.sh` script that is supplied with FFP it does not appear to be saving anything.
The script runs successfully and the passwd, group and shadow files get updated, however I think the problem is that the 343 is storing its default data in a location that is different from the 323.
The results of running the store-passwd.sh script are as follows:
===
# cat /etc/passwd
root:x:0:0:Linux User,,,:/home/root:/bin/sh
admin:x:500:500:Linux User,,,:/home/admin:/bin/sh
nobody:x:501:501:Linux User,,,:/home/nobody:/bin/sh
sshd:x:33:33:sshd:/:/bin/false
===
Run store-passwd.sh
===
# sh /ffp/sbin/store-passwd.sh
Copying files to mtd1...
Copying files to mtd2...
unmounting file system
Done.
===
Remounting mtdblock5 to confirm the data has been saved
===
# mount -t minix /dev/mtdblock5 /sys/mtd2
# cat /sys/mtd2/passwd
root:x:0:0:Linux User,,,:/home/root:/bin/sh
admin:x:500:500:Linux User,,,:/home/admin:/bin/sh
nobody:x:501:501:Linux User,,,:/home/nobody:/bin/sh
sshd:x:33:33:sshd:/:/bin/false
===
Now that appears all good, but if the device is powered off for any reason the root account is disabled once more, and any other user account I have created is also purged, leaving me with Telnet only access.
Thanks in advance.
Offline
Also here is a TXT file as supplied by Dlink
It has some details regarding the firmware layout and the GPL code that was using for building the 343 Firmware
Offline
After a bit of digging it seems that the DNS-343 is capable of storing some config details in hidden partitions of any disk that may be installed.
In my setup i have 2x 500Gb disks set in a Raid-1 mirror.
Both disks have a hidden partition HD_a4 and HD_b4 respectively, these hidden partitions contain the following directory structure.
*snip*
root@DNS-343:~# ls -la /mnt/HD_b4/.systemfile/AccountFile/
drwxr-xr-x 2 root root 4096 Dec 6 2008 .
drwx------ 3 root root 4096 Dec 6 2008 ..
-rw-r--r-- 1 root root 0 Dec 6 2008 .dlink343
-rw-r--r-- 1 root root 72 Dec 6 2008 group
-rwxr-xr-x 1 root root 421 Dec 6 2008 kdc.conf
-rwxr-xr-x 1 root root 749 Dec 6 2008 krb5.conf
-rw-r--r-- 1 root root 183 Dec 6 2008 passwd
-rwxr--r-- 1 root root 189 Dec 6 2008 pure-ftpd.conf
-rwxr-xr-x 1 root root 141 Dec 6 2008 shadow
-rwxr-xr-x 1 root root 1128 Dec 5 20:49 smb.default
-rwxr-xr-x 1 root root 1406 Dec 5 20:49 smb.default.ads
-rwxr-xr-x 1 root root 105 Dec 6 2008 smbpasswd
Replacing the group, passwd and shadow files in the above path seems to allow Root to remain active with a password of your choice even through power cycling.
Edit : also i am working on a small adjustment to the store-passwd.sh script to check for DNS-323 vs DNS-343 and store the files in the appropriate location.
Last edited by OneArmedMan (2008-12-06 10:08:14)
Offline
OneArmedMan wrote:
I have had a quick poke at the both firmwares and found they both have a "Gandolf" string at the start so Dlink have probably made some minor changes from the DNS-323 code with the "FrodoII" and "Chopper" strings.
I've updated my firmware assembler to support the DNS-343, and made a new release at http://theshed.hezmatt.org/dns323-firmware-tools/ (which is becoming increasingly misnamed, I've realised).
Apart from that, I'd suggest starting a new thread to discuss your other problems; they're completely unrelated to building a new firmware image, and I expect that the people who could help you probably aren't all following this thread.
Offline
Hello and thanks for your job.
I have few questions, I have bricked my DNS 323 (I've got Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)) and so I try to recover it with you tool.
So I do a ./parseFirmware.py NAS202B_DLINKEu_DNS323.1.05b28\(1.47.0505.2008\) (where NAS202B_DLINKEu_DNS323.1.05b28\(1.47.0505.2008\) come from ftp://ftp.dlink.fr/DNS/DNS-323/Firmware … _05b28.zip (french version).
This command give me 3 files :
Ramdisk.gz
uImage
default.tar.gz
To finish, I load kernel and ramdisk via kermit :
For the kernel
loadb k + send uImage --> seems to be OK
And for ramdisk
loadb r + send Ramdisk.gz (I also try ungzipped Ramdisk) --> NOK
## Total Size = 0x0060d613 = 6346259 Bytes ## Start Addr = 0x00100000 Un-Protect Flash Bank # 1 Erase Ramdisk from 0xff9a0000 to 0xfff7ffff .......................................... done Erased 1 sectors .......................................... done Erased 1 sectors ............................................ done Erased 1 sectors .......................................... done Erased 1 sectors Ramdisk Size = 6346259 error,Ramdisk size > 005e0000 byesMarvell>>
I 'm probably make a mistake, so can you help me ?
Thanks
Sorry for my bad english ;-)
Arnaud
My boot log
Marvell>> bootm FF820000 ## Booting image at ff820000 ... Image Name: Linux-2.6.12.6-arm1 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1429256 Bytes = 1.4 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK Starting kernel ... Uncompressing Linux............................................................................................... done, booting the kernel. Linux version 2.6.12.6-arm1 (jack@SWTEST2) (gcc version 3.3.3) #29 Wed Apr 30 10:03:59 CST 2008 CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ) CPU0: D VIVT write-back cache CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets Machine: MV-88fxx81 Using UBoot passing parameters structure Sys Clk = 166000000, Tclk = 166000000 - Warning - This LSP release was tested only with U-Boot release 1.7.3 Memory policy: ECC disabled, Data cache writeback Built 1 zonelists Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none PID hash table entries: 512 (order: 9, 8192 bytes) Console: colour dummy device 80x30 Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 64MB 0MB 0MB 0MB = 64MB total Memory: 61824KB available (2470K code, 453K data, 112K init) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 Marvell Development Board (LSP Version 1.7.6_NAS)-- RD-88F5181-88SX7042-2xSATA Detected Tclk 166000000 and SysClk 166000000 Marvell USB EHCI Host controller #0: c03c3b00 pexBarOverlapDetect: winNum 2 overlap current 0 mvPexInit:Warning :Bar 2 size is illigal it will be disabled please check Pex and CPU windows configuration PCI: bus0: Fast back to back transfers disabled PCI: bus1: Fast back to back transfers enabled SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub cesadev_init(c0012498) Fast Floating Point Emulator V0.9 (c) Peter Teichmann. VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) Initializing Cryptographic API Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled ttyS0 at MMIO 0x0 (irq = 3) is a 16550A io scheduler noop registered io scheduler deadline registered RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize loop: loaded (max 8 devices) Marvell Gigabit Ethernet Driver 'egiga': o Ethernet descriptors in DRAM o DRAM SW cache-coherency o Checksum offload enabled o Loading network interface 'egiga0' scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter scsi2 : Marvell SCSI to SATA adapter scsi3 : Marvell SCSI to SATA adapter Vendor: SAMSUNG Model: HD501LJ Rev: CR10 Type: Direct-Access ANSI SCSI revision: 03 Vendor: SAMSUNG Model: HD501LJ Rev: CR10 Type: Direct-Access ANSI SCSI revision: 03 Attached scsi generic sg0 at scsi0, channel 0, id 0, lun 0, type 0 Attached scsi generic sg1 at scsi1, channel 0, id 0, lun 0, type 0 physmap flash device: 800000 at ff800000 phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank Amd/Fujitsu Extended Query Table at 0x0040 number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. cmdlinepart partition parsing not available RedBoot partition parsing not available Using physmap partition definition Creating 5 MTD partitions on "phys_mapped_flash": 0x00000000-0x00010000 : "MTD1" 0x00010000-0x00020000 : "MTD2" 0x00020000-0x001a0000 : "Linux Kernel" 0x001a0000-0x007d0000 : "File System" 0x007d0000-0x00800000 : "u-boot" ehci_platform ehci_platform.20865: EHCI Host Controller ehci_platform ehci_platform.20865: new USB bus registered, assigned bus number 1 ehci_platform ehci_platform.20865: irq 17, io mem 0x00000000 ehci_platform ehci_platform.20865: park 0 ehci_platform ehci_platform.20865: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected mice: PS/2 mouse device common for all mice md: linear personality registered as nr 1 md: raid0 personality registered as nr 2 md: raid1 personality registered as nr 3 md: md driver 0.90.1 MAX_MD_DEVS=256, MD_SB_DISKS=27 device-mapper: 4.4.0-ioctl (2005-01-12) initialised: dm-devel@redhat.com NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) NET: Registered protocol family 1 NET: Registered protocol family 17 md: Autodetecting RAID arrays. md: autorun ... md: ... autorun DONE. Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)
Offline
arnaud35770 wrote:
I have few questions, I have bricked my DNS 323 (I've got Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0)) and so I try to recover it with you tool.
So I do a ./parseFirmware.py NAS202B_DLINKEu_DNS323.1.05b28\(1.47.0505.2008\) (where NAS202B_DLINKEu_DNS323.1.05b28\(1.47.0505.2008\) come from ftp://ftp.dlink.fr/DNS/DNS-323/Firmware … _05b28.zip (french version).
Aaah, parseFirmware.py isn't my tool -- it's Leschinsky Oleg's. The problem with his script, for your purposes, is that the ramdisk file that is produced isn't a uBoot file, but is instead just a regular tarball.
I'd recommend one of several courses of action:
1. Use mkimage to put the uBoot header back onto the Ramdisk.gz file you've got (something like mkimage -A arm -O linux -T ramdisk -C gzip -e 0x00800000 -a 0x00800000 -n "ramdisk" -d uRamdisk.gz Ramdisk.gz should do the trick)
2. Use my parsedns323fw program, from http://theshed.hezmatt.org/dns323-firmware-tools, which leaves the uBoot header intact;
3. Hack parseFirmware.py not to strip the uBoot header, and rerun it on your firmware (this is pretty easy to do, just reverse the last patch in Leschinsky's hg repo)
- Matt
Offline
Hi
Sorry for the mistake and thanks for your fast answer.
I try your 2nd purpose, with your tools ;-)
I do
splitdns323fw -k uKernel NAS202B_DLINKEu_DNS323.1.05b28(1.47.0505.2008) and splitdns323fw -i uRamdisk NAS202B_DLINKEu_DNS323.1.05b28(1.47.0505.2008)
After with kermit
loadb k send uKernel --> OK and loadb r send uRamdisk --> OK
But now I have this logs at boot
Init usb device. PCI 0: PCI Express Root Complex Interface PCI 1: Conventional PCI, speed = 33000000 Hit any key to stop autoboot: 0 ## Booting image at ff820000 ... Image Name: Linux-2.6.12.6-arm1 Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 1429256 Bytes = 1.4 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK ## Loading Ramdisk Image at ff9a0000 ... Image Name: Ramdisk Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 6346259 Bytes = 6.1 MB Load Address: 00800000 Entry Point: 00800000 Verifying Checksum ... Bad Data CRC˙ ** LOADER ** ** MARVELL BOARD: RD-88F5181-POS-NAS LE U-Boot 1.1.1 (Nov 13 2006 - 14:01:34) Marvell version: 1.4.2 DRAM CS[0] base 0x00000000 size 64MB DRAM Total size 64MB [8192kB@ff800000] Flash: 8 MB Addresses 20M - 0M are saved for the U-Boot usage. Mem malloc Initialization (20M - 16M): Done *** Warning - bad CRC, using default environment Soc: MV88F5181 Rev 3 CPU: ARM926 (Rev 0) running @ 500Mhz SysClock = 166Mhz , TClock = 166Mhz
Thanks for your advices
Arnaud
Offline
It's good now !!!
I have done the same operations with the firmware 1.0.1 (which is write on the sticker under my DNS 323).
This link http://dns323.kood.org/start says uboot 1.1 isn't compatible with firmware 1.0.5
Thanks you very much for your tools and help mpalmer
A++
Last edited by arnaud35770 (2008-12-10 01:12:32)
Offline