DSM-G600, DNS-3xx and NSA-220 Hack Forum

Mijzelf · 2010-01-03 20:12:41

What it is
This is a Debian distro (Lenny) which will run completely from usbstick, putting aside the firmware. The firmware is untouched, when you remove the stick and reboot, the box will happily run the firmware again.
It is possible to install Lenny on harddisk, but you'll need the usbstick as bootloader.

How to install
[list]
[*]Download the package here.
[*]Format an usbstick (at least 256MB) ext2 or ext3 (no reiserfs). You can do this using the webinterface, using the Create External Volume button.
[*]Extract the package, and put the contents on the stick. Users of firmware 2.20 or older will have to rename nsa220_check_file.fw220_and_older to nsa220_check_file.
[list]The stick should (at least) contain
[*]nsa220_check_file
[*]usb_key_func.sh
[*]usb_key_func.salted_md5sum
[*]extract_me.tgz
[/list]
usb_key_func.sh should be executable. When you use the samba interface of the NAS to put the files on the stick, this is automatically done.
[*]Plug the stick in the NAS, and reboot the box.
[/list]

The first time it will last several minutes before the box is booted, because the Lenny package has to be extracted.
The box will use DHCP to get an IP address. Maybe the webinterface of your router can tell you which ip address is assigned. If you want a static address you'll have to edit /etc/network/interfaces (I have put an example of a static address inside.)
The default MAC address is 12:34:56:78:9a:bc. When you want another one, again, edit /etc/network/interfaces
The box is running a telnet server. There is one user configured, root with password root.
I suggest you to install sshd, and remove telnetd, when ssh has proven to work:

Code:

apt-get update
apt-get install openssh-server
apt-get remove telnetd

The harddisks are not yet mounted. You'll have to install mdadm:

Code:

apt-get update
apt-get install mdadm

The install script will automatically recognize and assemble your array(s). To mount them use 'mount -a' (or 'reboot'). When you've got a reiserfs system, the kernelmodule has to be loaded first:

Code:

modprobe reiserfs
# let it load at boot:
echo reiserfs >>/etc/modules

The box has no NAS functions, at the moment. Install samba and/or nfsd:

Code:

apt-get update
apt-get install samba
apt-get install nfs-kernel-server

Go nuts, there are more than 21000 packets available.

How to install on harddisk
The file /boot/reload.sh creates the commandline, which is read by initramfs to mount the rootfilesystem. To boot from the raidarray, extract extract_me.tgz in /mnt/md0, and edit /boot/reload.sh (on the stick)

Code:

<snip>
echo Generate commandline...
# in case you want to boot from the usbstick
# CMDLINE="root=${USBDEVICE} rw"
# in case you want to boot from an raidarray
CMDLINE="root=/dev/md0 rw md=0,/dev/sda2,/dev/sdb2"

initramfs will mount the firmware to use mdadm to assemble the array.
The kernel doesn't support reiserfs, so if your harddisk is formatted reiserfs, initramfs will have to load a kernelmodule before it can mount the disk. This is currently not supported.

How it works
usb_key_func.sh is used to let the firmware start Lenny.
A modified version of fonz' reloaded.ko is used to reboot the box, with a new kernel, an initramfs and a modified commandline. This kernel boots Lenny. The firmware kernel cannot run Lenny due to wrong kernel configuration.

Known issues
You can't use the powerbutton to shutdown. Instead open a shell and use the 'halt' command.
The kernel only works after a reboot. Because of that /boot/reload.sh will first reboot the box before it reloads the kernel. /boot/reload.status is used to keep track of this.

Disclaimer
As far as I know this hack is harmless for your hardware and data. But I do not take any responsibility for damage caused by this software.
Use at own risk

fvdw · 2010-01-05 21:48:37

nice work Mijzelf and thanks for sharing

Mijzelf · 2010-01-13 14:09:23

It turned out that fanctrld is not started, and the flashing sysled is not stopped, when booting with newer (>3.10?) firmwares. The reason is that the firmware /sbin directory is on harddisk, so the debian /sbin/fanctrld symlink points to nothing. I'll remedy this in next update. In the meantime you can change script /etc/init.d/nsa220.sh, function do_start(). After the check if fanctrld is running, but before it's actually started, add:

Code:

DECOMPRESS_PATH=/usr/AllPack

if [ -f /mnt/firmware/AllPack.lzma ]; then
    if [ ! -d ${DECOMPRESS_PATH} ]; then 
        mkdir ${DECOMPRESS_PATH} 
        cd ${DECOMPRESS_PATH} 
        lzma d /mnt/firmware/AllPack.lzma -c | tar x -C ${DECOMPRESS_PATH} 
        rm AllPack.tar 
        cd / 
   fi 
   mount --bind ${DECOMPRESS_PATH}/usr/ /mnt/firmware/usr/ 
   mount --bind ${DECOMPRESS_PATH}/sbin/ /mnt/firmware/sbin/
fi

In the beginning of the script is checked for the existance of fanctrld. Comment that out:

Code:

# [ -x "$DAEMON" ] || exit 0

sala · 2010-02-16 16:39:43

As I see you managed to make kernel to boot rootfs from usb stick
I think I will move gentoo off from disk and make it boot from usb. Before I dig in do you know if zyxel kernel accepts root=LABEL=USB-STICK parameter (where USB-STICK is label name set by e2label, xfs_admin or other utility according to fs type)?

Mijzelf · 2010-02-16 17:06:19

No, I don't know. Sorry.

BTW, the Debian package actually doesn't boot directly from usbstick, it uses an initramfs, and there is a script in it which mounts the rootfs.
The kernel *can* load the rootfs directly, but you'll need a fixed delay (rootdelay=x), because the stick (mine) is not yet up when the kernel is ready, and rootwait is not supported.

sala · 2010-02-16 18:54:54

There is patch for wait. Will try this soon. But first I want to make LABEL parameter work, so I would not need to worry about root parameter.
http://bugs.gentoo.org/154197

freakz · 2010-03-30 17:10:00

I would like to say thank you for making this possible. You have actually helped me get one of the features that i wanted from the nas that i read on about it that didn't work fully. This was the bitTorrent feature.

This is a general thank you to the developement of this, and i hope you continue working on it to make these sorts of things better, espically as it gives us more control over the devices that we paid for running freeware software with some extra closed source parts.

sw4280 · 2010-05-26 13:27:07

hello,

very nice work!!

If have an zyxel nsa 210, is it also possible to use debian lenny on that nas?

black-tiger · 2010-11-24 10:05:49

I have Debian running on a USB Stick is the perfect system is a bit slow, I would like to have Debian on my RAID1. So I have mdadm installed on the stick and the line
CMDLINE = "root = / dev/md0 md rw = 0, / dev/sda2, / dev/sdb2"
in the / boot / reload.sh changed and the unpacked extract_me.tgz in / mnt/mod0. Now does not boot the system.
I have tried several times to no avail.
I hope you can help me

======================================================================

ich habe Debian auf einem USB Stick das System läuft perfekt ist aber etwas langsam, ich möchte nun Debian auf meinem RAID1 haben. Somit habe ich mdadm auf dem Stick installiert und die Zeile
CMDLINE="root=/dev/md0 rw md=0,/dev/sda2,/dev/sdb2"
in der /boot/reload.sh geändert und die extract_me.tgz in /mnt/mod0 entpackt. Nun bootet das System nicht mehr.
ich habe es schon mehrmals versucht leider ohne erfolg.
ich hoffe ihr könnt mir helfen

Mijzelf · 2010-11-24 12:32:11

Well, at least the commandline should be:
"root=/dev/md0 rw md=0,/dev/sda2,/dev/sdb2"

Then, here is a part of the initscript in initramfs:

Code:

mount -t squashfs /dev/mtdblock1 firmware -o ro
mount --bind /firmware/lib /lib

extract_cmdline_param root
ROOT=${VALUE}
extract_cmdline_param init
INIT=${VALUE}
extract_cmdline_param rootdir
ROOTDIR=${VALUE}

if echo ${ROOT} | grep /dev/md ; then
    echo We\'ll have to assemble a raid array
    extract_cmdline_param md
    MDCMD=${VALUE}
    # exchange comma's by spaces
    MDCMD=` echo ${MDCMD} | sed 's/,/\ /g' `
    for argument in ${MDCMD}
    do
        if echo ${argument} | grep /dev/ ; then
            # This is a device
            wait_for_partition ${argument}
        fi
    done
    echo assemble md
    /firmware/sbin/mdadm --assemble /dev/md${MDCMD}
    if [ $? -ne 0 ] ; then
        emergency_shell "Could not assemble raid array md${MDCMD}."
    fi
else
    wait_for_partition ${ROOT}
fi

As you can see, it mounts /dev/mtdblock1 on /firmware, and then uses /firmware/sbin/mdadm to assemble the raidarray. It is possible that something changed in the firmware, which breaks this code.
Try to do it by hand:

Code:

mkdir testdir
mkdir testdir/firmware
mkdir testdir/lib
mount -t squashfs /dev/mtdblock1 testdir/firmware -o ro
mound --bind testdir/firmware/lib testdir/lib
chroot testdir /firmware/sbin/mdadm

When this fails, mdadm cannot be used this way from initramfs. In that case you'll have to locate mdadm in your firmware, and change the initscript accordingly.

By the way, unless you have got a very slow usb-stick, I don't think Debian will run much faster from harddisk. The transferrate may be lower, but the accesstime is much faster.

Last edited by Mijzelf (2010-11-24 12:43:18)

black-tiger · 2010-11-24 23:10:52

So i mounted mtdblock1 to /tmp/testdir

Code:

root@NSA-220:/tmp/testdir/firmware/sbin# ls -lah
total 2.0K
drwxr-xr-x  2 root root   3 Sep 24  2009 .
drwxr-xr-x 19 root root 252 Sep 24  2009 ..

so no mdadm in this folder. i tried to find it on the System find /* |grep mdadm but no result.
i need an other initramfs with mdadm to boot from /dev/md0 or /dev/md1.
a howto where the best way and i want to boot without USB Stick

sorry for that terrible english :p i tried to type it myway without translator...
i hope you anderstand what i mean.

thank you for the help.

Mijzelf · 2010-11-24 23:58:56

When the /sbin folder is empty, than I suppose it is just a mountpoint. On the NSA-210 there is a file sysdisk.img in sda1, which is loopmounted on - I thought - /usr. Maybe a similar trick is done here? In that case I wouldn't know where the image could be. On my 220 there are 4 partitions, 2 swap, and 2 parts of a raid image, so no place to store mdadm. (It cannot be in a file on a raid array, right?).
Maybe the newer firmware sacrificed one of the swap partitions, and put it there? Can you mount sda1 or sda2?

About initramfs, you can extract your current one:

Code:

mkdir initramfs.d
cd initramfs.d
su
cat /boot/initramfs.universal | gzip -dc | cpio -i

Then you can change what you want (presumably only /init), and create a new one:

Code:

cd initramfs.d
su
find . | cpio -H newc -o > /tmp/initramfs.cpio
cd ..
cat /tmp/initramfs.cpio | gzip > myinitramfs

Last edited by Mijzelf (2010-11-25 00:00:25)

black-tiger · 2010-11-25 14:35:06

very nice, but there is no mdadm in the sbin folder, so i have the file from debain but i think is doesent work when i copy the file into the /sbin folder and write it to the iniramfs.

that should you do? or kann you upload your mdadm file?

Mijzelf · 2010-11-25 16:09:54

No the Debian version won't work indeed, because it's dependent on files in /lib. And you can't add the lib files, because your initramfs would become too big.
For the same reason my mdadm might not work. It's from a different firmware, so it could have different libfiles.

But your firmware *must* have mdadm, else it shouldn't be able to manage the raid array. It's only not located in mtdblock1/sbin. So you have to find where it is. Have a look in mtdblock1/etc/init.d/rcS. I suppose the rootfs of the firmware is assembled there, so you can see where it gathers its pieces.

black-tiger · 2010-11-25 16:45:07

the etc is empty, the most folders are empty
but look yourself

so i have to upload an other initramfs? or have you an initramfs witch is running on the NSA220 Plus?

Last edited by black-tiger (2010-12-11 12:12:37)

Mijzelf · 2010-11-25 17:15:36

Mijzelf wrote:
Have a look in mtdblock1/etc/init.d/rcS

black-tiger · 2010-11-25 17:25:15

there isnt anything with mdadm in /etc/init.d/rcS
there isnt anything with sda1 or sda2
i have read the file

Mijzelf · 2010-11-25 20:13:21

Create a [url=http://zyxel.nas-central.org/wiki/FFP-stick]FFP-stick[/url, boot the NAS to the firmware, log in via telnet, and grab mdadm from the firmware. I *think* you will find it in /sbin.

Mind you, when you add this mdadm to initramfs, you still need to mount mtdblock1 and bind /bin, like it's done now. mdadm needs the lib files.

black-tiger · 2010-11-26 09:08:00

so i have created a directory /tmp/firmware/ and copied the files from /testdir/firmware in it.
Then i uploadet the mdadm file from die firmware (got with ffp )
then i created the iniramfs:

-rw-r--r-- 1 root root 16M Nov 26 07:07 initramfs.cpio
-rw-r--r-- 1 root root 14M Nov 26 07:07 myinitramfs

and now how i can put the file in the flash ROM?

Mijzelf · 2010-11-26 11:11:00

black-tiger wrote:
and now how i can put the file in the flash ROM?

You can't. You have to add mdadm to initramfs (in bin), and change the init:

Code:

<snip>
if echo ${ROOT} | grep /dev/md ; then
    echo We\'ll have to assemble a raid array
    extract_cmdline_param md
    MDCMD=${VALUE}
    # exchange comma's by spaces
    MDCMD=` echo ${MDCMD} | sed 's/,/\ /g' `
    for argument in ${MDCMD}
    do
        if echo ${argument} | grep /dev/ ; then
            # This is a device
            wait_for_partition ${argument}
        fi
    done
    echo assemble md
    /bin/mdadm --assemble /dev/md${MDCMD}
    if [ $? -ne 0 ] ; then
        emergency_shell "Could not assemble raid array md${MDCMD}."
    fi
else
    wait_for_partition ${ROOT}
fi
<snip>

black-tiger · 2010-11-26 11:32:41

ok but whats with the new created file myinitramfs
with the files from initramfs.d and with mdadm in the bin folder.
So i have to import the myinitramfs file or not? but i dont know where?

thanks for your help:)

Mijzelf · 2010-11-26 13:55:31

Well, rename it to replace the original, or edit reload.sh, the line starting with insmod, to take your initramfs instead of the original.

black-tiger · 2010-11-26 15:25:32

Sorry do you mean /dev/mtdblock1/etc/init.d/rcS as initscript.
i have the backuped the initramfs and copied my initramfs in the /boot/ folder.
Sorry for the questions but im to be upset

Mijzelf · 2010-11-26 23:32:54

black-tiger wrote:
Sorry do you mean /dev/mtdblock1/etc/init.d/rcS as initscript.

I don't understand the question.

black-tiger · 2010-11-27 16:20:37

you mean i have to change the initscript, the initscript in this file (/dev/mtdblock1/etc/init.d/rcS) or not?
so i cant find the codesinpped from post #20.
i dont know witch script i have to change...

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2010-01-03 20:12:41

Debian Lenny on the NSA-220

Code:

Code:

Code:

Code:

Code:

#2 2010-01-05 21:48:37

Re: Debian Lenny on the NSA-220

#3 2010-01-13 14:09:23

Re: Debian Lenny on the NSA-220

Code:

Code:

#4 2010-02-16 16:39:43

Re: Debian Lenny on the NSA-220

#5 2010-02-16 17:06:19

Re: Debian Lenny on the NSA-220

#6 2010-02-16 18:54:54

Re: Debian Lenny on the NSA-220

#7 2010-03-30 17:10:00

Re: Debian Lenny on the NSA-220

#8 2010-05-26 13:27:07

Re: Debian Lenny on the NSA-220

#9 2010-11-24 10:05:49

Re: Debian Lenny on the NSA-220

#10 2010-11-24 12:32:11

Re: Debian Lenny on the NSA-220

Code:

Code:

#11 2010-11-24 23:10:52

Re: Debian Lenny on the NSA-220

Code:

#12 2010-11-24 23:58:56

Re: Debian Lenny on the NSA-220

Code:

Code:

#13 2010-11-25 14:35:06

Re: Debian Lenny on the NSA-220

#14 2010-11-25 16:09:54

Re: Debian Lenny on the NSA-220

#15 2010-11-25 16:45:07

Re: Debian Lenny on the NSA-220

#16 2010-11-25 17:15:36

Re: Debian Lenny on the NSA-220

Mijzelf wrote:

#17 2010-11-25 17:25:15

Re: Debian Lenny on the NSA-220

#18 2010-11-25 20:13:21

Re: Debian Lenny on the NSA-220

#19 2010-11-26 09:08:00

Re: Debian Lenny on the NSA-220

#20 2010-11-26 11:11:00

Re: Debian Lenny on the NSA-220

black-tiger wrote:

Code:

#21 2010-11-26 11:32:41

Re: Debian Lenny on the NSA-220

#22 2010-11-26 13:55:31

Re: Debian Lenny on the NSA-220

#23 2010-11-26 15:25:32

Re: Debian Lenny on the NSA-220

#24 2010-11-26 23:32:54

Re: Debian Lenny on the NSA-220

black-tiger wrote:

#25 2010-11-27 16:20:37

Re: Debian Lenny on the NSA-220

Board footer