DSM-G600, DNS-3xx and NSA-220 Hack Forum

Unfortunately no one can be told what fun_plug is - you have to see it for yourself.

You are not logged in.

#26 2010-11-28 00:11:53

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

You have to change the init script in initramfs. You *can't* change anything in the firmware. It's readonly.

Offline

 

#27 2010-11-28 10:07:20

black-tiger
Member
Registered: 2010-11-22
Posts: 15

Re: Debian Lenny on the NSA-220

i cant find the initscript in initramfs sad

Code:

root@NSA-220:~/initramfs.d# ls *
init  linuxrc

bin:
[         cat     cmp   df       egrep  free      insmod   ls     mknod       pidof       printf  rmdir  sleep        tee    true    uptime
[[        chgrp   cp    dirname  env    grep      install  lsmod  modprobe    ping        ps      rmmod  sort         test   tty     usleep
awk       chmod   cut   dmesg    expr   halt      kill     mdadm  mount       pivot_root  pwd     sed    switch_root  top    umount  wc
basename  chown   date  du       false  id        killall  mesg   mountpoint  poweroff    reboot  seq    sync         touch  uname   yes
busybox   chroot  dd    echo     fgrep  ifconfig  ln       mkdir  mv          printenv    rm      sh     tail         tr     uniq

dev:
md0  md2  md4   mtd1  mtd3  mtd5       mtdblock1  mtdblock3  mtdblock5  ram0  sda   sdb   sdc   sdc2  sdd   sdd2  sde   sde2  ttyS0
md1  md3  mtd0  mtd2  mtd4  mtdblock0  mtdblock2  mtdblock4  null       ram1  sda1  sdb1  sdc1  sdc3  sdd1  sdd3  sde1  sde3

etc:

firmware:

lib:

mnt:

mnt-ro:

mnt-rw:

proc:

sbin:
[         cat     cmp   df       egrep  free      insmod   ls     mknod       pidof       printf  rmdir  sleep        tee    true    uptime
[[        chgrp   cp    dirname  env    grep      install  lsmod  modprobe    ping        ps      rmmod  sort         test   tty     usleep
awk       chmod   cut   dmesg    expr   halt      kill     mdadm  mount       pivot_root  pwd     sed    switch_root  top    umount  wc
basename  chown   date  du       false  id        killall  mesg   mountpoint  poweroff    reboot  seq    sync         touch  uname   yes
busybox   chroot  dd    echo     fgrep  ifconfig  ln       mkdir  mv          printenv    rm      sh     tail         tr     uniq

sys:

tmp:

var:
locks  log  run

Offline

 

#28 2010-11-28 13:26:08

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

black-tiger wrote:

root@NSA-220:~/initramfs.d# ls *
init  linuxrc

Offline

 

#29 2010-11-28 15:58:47

black-tiger
Member
Registered: 2010-11-22
Posts: 15

Re: Debian Lenny on the NSA-220

ok
there is anything i doesnt untersand.
so i have added the mdadm to /bin and changed the initscript.
so i have to put the initramfs and the reload.sh on an blank USB Stick in the /boot folder?

Code:

root@NSA-220:~# ls /mnt/sdd1/
boot  usb_key_func.sh

/boot/reload.sh:

Code:

CMDLINE="root=/dev/md1 rw md=1,/dev/sda1,/dev/sdb1"

the initscript in initramfs contains the snipped with the /bin/mdadm command
but the NSA is booting the Zyxel OS sad and i cant find whats wrong...

Offline

 

#30 2010-11-28 22:09:49

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

You also need the nsa220_check_file in the root of the stick. You can read a wiki page about usb_key_func.sh here.

Offline

 

#31 2010-11-28 22:48:17

black-tiger
Member
Registered: 2010-11-22
Posts: 15

Re: Debian Lenny on the NSA-220

Thank you, so the file in in the root auf the USB Stick, but the same. The NSA boots the zyxel OS

Offline

 

#32 2010-11-29 12:35:18

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

Ah yes, a checksum file is also needed. It's probably called nsa220_checksum. The real name is inside nsa220_check_file, as you could have read in the wiki page I provided.

Last edited by Mijzelf (2010-11-29 18:07:06)

Offline

 

#33 2010-11-29 17:32:22

black-tiger
Member
Registered: 2010-11-22
Posts: 15

Re: Debian Lenny on the NSA-220

i know the checksum file is also in the usb root. i copied the files from the ffp archive.
so what is wrong?

Offline

 

#34 2010-11-29 18:08:46

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

The checksum is a checksum of the provided usb_key_func.sh. So the ffp checksumfile won't work with the Debian usb_key_func.sh.

Offline

 

#35 2010-11-30 18:36:58

black-tiger
Member
Registered: 2010-11-22
Posts: 15

Re: Debian Lenny on the NSA-220

do you have ICQ, Skype or something like that, than i can show you what i have done via TeamViewer.
I think it was done very faster, then i will try it on my other NSA 220 Plus and make an HowTo.tongue

Is that ok?

Offline

 

#36 2010-12-02 16:23:19

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

No I don't have anything like that. But you can PM me the login data, than I'll look tonight (west European time) what I can do for you.

I understand it still doesn't work?

Offline

 

#37 2010-12-09 13:50:27

black-tiger
Member
Registered: 2010-11-22
Posts: 15

Re: Debian Lenny on the NSA-220

so it works

root@NSA-220:~/initramfs.d# cat /mnt/sdd1/boot/initramfs|gzip -dc | cpio -i
2684 blocks

root@NSA-220:~/initramfs.d# chroot /root/initramfs.d/ /init
starting init
... (removed no errors tongue)
mdadm: /dev/md0 has been started with 2 drives.
mounting /dev/md0
`/mnt/dev/ttyS0' exists
cat: /etc/mtab: No such file or directory
sed: bad option in substitution expression
BusyBox v1.1.1 (2009.11.07-09:00+0000) multi-call binary

Usage: switch_root [-c /dev/console] NEW_ROOT NEW_INIT [ARGUMENTS_TO_INIT]

root@NSA-220:~/initramfs.d#

so that looks fine, but the nas doesnt boot from the stick sad

(PN doesnt work, because your inbox is full!)

Offline

 

#38 2010-12-09 15:43:42

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

I do not like the line 'sed: bad option in substitution expression'. It indicates that ROOTDIR has a strange value. The line 'Usage: switch_root bladibla' could be caused because you're not running this from process 0, but it could also mean that INIT has a strange value.

You can change the last lines of the script:

Code:

# copy mtab
cat /etc/mtab | sed "s/${ROOTDIR}//g" > /mnt/etc/mtab

echo ROOTDIR: \"${ROOTDIR}\"
echo INIT: \"${INIT}\"

# do the real action
cd ${ROOTDIR}
exec switch_root -c /dev/ttyS0 . ${INIT}

emergency_shell "Failed"

to show these values, and re-chroot the script.

Offline

 

#39 2010-12-17 17:58:13

wiiguy1
Member
Registered: 2010-10-28
Posts: 28

Re: Debian Lenny on the NSA-220

when(if ever) will it be possible to install lenny on a nsa-210 ?

Offline

 

#40 2010-12-17 22:21:41

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

When somebody writes the required code to boot it.

Offline

 

#41 2010-12-18 14:19:47

wiiguy1
Member
Registered: 2010-10-28
Posts: 28

Re: Debian Lenny on the NSA-220

Mijzelf wrote:

When somebody writes the required code to boot it.

i guess it aint easy to create such a code

Offline

 

#42 2010-12-18 14:46:11

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

Depends. It took me a few weeks to get it going on the NSA-220, but after knowing the tricks, the same implementation for the EdMini v2 costed only one weekend.
On the other hand, these implementations rely heavily on fonz' reloaded.ko to boot another kernel/rootfs, and I couldn't get that module working for the Iomega Home Media Network Disk, which has the same cpu (OXE810DSE) and kernel (2.6.24.4) as the 210.
But the Iomega kernel is compiled with gcc version 4.3.2, while the ZyXEL kernel is compiled with gcc version 3.4.3, the same one which is used for the 220. Don't know if that matters. Maybe fonz knows.

When your 210 is available for testing, then I want to spend some hours on this problem.

Offline

 

#43 2010-12-18 15:45:46

wiiguy1
Member
Registered: 2010-10-28
Posts: 28

Re: Debian Lenny on the NSA-220

with testing you mean sending the device to you or just give you access to root ?

Last edited by wiiguy1 (2010-12-18 15:46:06)

Offline

 

#44 2010-12-18 16:54:00

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

With testing I mean that I send to software (scripts, modules, kernel) to test, and maybe I'll need rootaccess.

I *think* this is all harmless for your device (it was harmless for the DNS-323, NSA-220 and the EdMini v2), but of course I don't guarantee anything.

Offline

 

#45 2010-12-18 16:56:49

wiiguy1
Member
Registered: 2010-10-28
Posts: 28

Re: Debian Lenny on the NSA-220

my nsa-210 should be able available for testing in a few days but only if your sure its 90% safe too do
since i cant really risk the device

Offline

 

#46 2010-12-19 22:09:07

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

I don't know what to say. The disclaimer is actually the same as the one in the startpost of this thread. Yet I have the idea that you would have installed it on your NAS, if it was supported.
I really can't give you percentages. I just look at what the code is supposed to do, and what it might do if it fails. For reloading a kernel I *think* it will just work, or freeze the box. In the latter case a powercycle should resolve it. But I can't discard the possibility that it would overwrite the flashrom, bricking the box. I *think* it won't happen, and so far it hasn't happened. None of my own NASses have been bricked,
My 'Debian for NSA-220' package has been downloaded 369 times, but I hardly haven't had any feedback. Maybe 10 times. These 10 times there were problems, but nothing serious. And the other 359? I don't know. Assuming that all these downloads are actually installed, I can say that at least 3% of the installs didn't brick the box.

Last edited by Mijzelf (2010-12-19 22:12:47)

Offline

 

#47 2010-12-19 22:29:30

wiiguy1
Member
Registered: 2010-10-28
Posts: 28

Re: Debian Lenny on the NSA-220

first of all i thank you for taking your time to respond each time smile

but its weird that people dont post feedbacks even though if they are posistive

is it possible to secure the flashrom so it wont get overwritten(or it makes a backup from the nand flash, and when it sees it is getting overwritten(no idea how, a idea) it will put the backup back)(and i take it if its brick the nsa i cant just reinstall the firmware ?) (because as far i know the firmware is installed on the hdd(or is it once a nsa is lcoked in with a hdd it cant be reinstalled or a hdd get replaced ?))

and sry for all these questions

Last edited by wiiguy1 (2010-12-19 22:34:18)

Offline

 

#48 2010-12-21 12:05:06

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

its weird that people dont post feedbacks even though if they are posistive

With a score of 96% non-responding downloaders, I'd conclude it is standard human behavior. Unless you argue that someone who cares about installing Debian on his NAS is weird by definition smile

is it possible to secure the flashrom so ...

The only way I know is desoldering the chips, but I suppose that is more risky than just hoping it won't be erased (unless you have extraordinary soldering skills).
You must take in mind that when the flashrom is overwritten, something has gone out of control. So it's not possible to control that anyway.
And yes, it is possible to backup the flashrom contents. If it is possible to put it back depends on the degree of damage. When the box still boots normal, you can write it back (but why would you?). As long as the bootloader isn't damaged it might be possible to use a serial cable to put it back, but AFAIK nobody has done this yet. (It has been done with the 220, but on the 210 it's not necessarily the same). When the bootloader is damaged it might be possible to reprogram the flash by using a JTAG cable. Again, AFAIK nobody has done this yet.
BTW, a damaged flashrom was only an example. If I had to brick a NAS softwarematically, I'd erase the flashrom. Easy and effective. I suppose it is also possible to brick it by turning off the fan and let the processor and disk work as hard as possible. And maybe there are other ways which need a more in-depth knowledge of the specific NAS.

as far i know the firmware is installed on the hdd

At least the bootloader and the kernel are in flash, and a rootfs. (See the flash mapping here). I don't know if that rootfs is temporary and exchanged on boot by a rootfs on disk, or that only /usr and maybe /sbin are added from disk, but the box boots initially only from flash.

Last edited by Mijzelf (2010-12-21 12:07:50)

Offline

 

#49 2010-12-21 19:08:09

wiiguy1
Member
Registered: 2010-10-28
Posts: 28

Re: Debian Lenny on the NSA-220

well i guess testing wont hurt(i hope :p)

but gimme anotehr few days to think about it

(btw will debian run along the firmware or will it disable teh firmware so that i dont have access to the own nas functions ?)
(btw 2 if all sucseeds just by removing the usb stick it will turn in too a normal nas again just like ffp ?)

Last edited by wiiguy1 (2010-12-21 19:27:04)

Offline

 

#50 2010-12-22 21:17:53

Mijzelf
Member / Developer
Registered: 2008-07-05
Posts: 679

Re: Debian Lenny on the NSA-220

It's my aim to build something that runs completely from stick. So removing the stick will remove every trace of Debian. It will be loaded instead of the firmware, so the firmware services will not be running. (I will try to get the fancontrol running, but all other services have a better Debian equivalent)

Offline

 

Board footer

Powered by PunBB
© Copyright 2002–2010 PunBB