In this post, I will explain some things about armboot boot loader that I have understood. The boot loader on NCB3AST is based on the open source Armboot, but modified by Star technology (unfortunately they don’t share their modification). You need to connect to the serial port using 38400N1. I am using kermit to connect, but you can use cu or other programs. To enter the Armboot boot menu, you must hold and press USB EXIT button while powering it on. You will start seeing delay tim 0 until 9, and after that, the device will try to connect to mass production server (I don’t know what the protocol is, but if we can reverse engineer this, this can potentially be used for unbricking the device without opening the device).
The first thing that I want to do today is to unbrick my NCB3AST. To unbrick it, I need to have a RS232 TTL converter. After waking up late, and doing some other weekend business, I went to Icon in Chiang Mai. I bought a data cable for Alcatel 511 (actually almost any data cable that isn’t mini USB would be fine, this is the one that I found), and after looking around, I found the schematics for the data cable. It helps me to decide where should I connect each cable guided by the close up photo from Chris.
I still doesn’t understand why my new image won’t boot, it always stops with:
pc : [<00500004>] lr : [<0d05ae60>]
sp : 0d05af00 ip : 00500000 fp : 0cf00000
r10: e8bd0070 r9 : 00000000 r8 : 00000108
r7 : 00613226 r6 : 00900000 r5 : 54420005 r4 : 00000004
r3 : 0cf00000 r2 : 0003a530 r1 : 00000001 r0 : 0003a7d4
Flags: nZcv IRQs off FIQs off Mode SVC_32
The default boot command is
cp.l 0x10020000 0xcf00000 0x1f0000;go cf00000
After quite a long time, I realized that if i just type:
The kernel will be loaded just fine. I don’t understand why the firmware won’t work when the kernel is copied to cf00000 and then booted. If i have a debugger, then this memory debugging stuff can be much easier to solve.
I will consider yesterday as day 1 in hacking the the my NAS drive NCB3AST, since I just started concentrating on this. Chris Baird gave me some pointer to look at WRVS440N Linux kernel source code and also gave me some info about the boot loader and serial port (this will be useful in Day2). What I did on Day 1 was looking at several firmware files and comparing it to the /dev/mtd0-3. My conclusion was:
- The size of the binary file is always 8 mb
- The first 128 kb is the ARMBoot boot loader
- After the boot loader is the kernel image, which is init.o + bzImage + initrd.gz
- There is no special header
- There are some offsets where you need to put some "0101" and "Supercom" string (It seems the location is constant)
- Looking at the source code of init.o (init).S I can know where to get and put the initrd to modify the firmware
- Unfortunately if I made init.gz that is larger than the original firmware, the device won’t boot.
So at the end of day one, my NAS was bricked. It is not completely bricked as I can still use it as a "harddisk casing". When it is bricked, I can still access my data in the harddrive, the USB mass storage device is recognized as JM20337 USB2.0 to SATA & PATA Bridge.
I found this quite cheap NAS (around 87 USD) few days ago when buying a new hard drive. This is cheap by Chiang Mai’s standard, because if you buy cheaper stuff from the Internet, you will need to pay a lot for shipping cost and tax. This NAS runs Linux but unfortunately they don’t provide the source code. Someone have managed to open this NAS, and connect serial port to it, while another guy find a way to access the shell by modifying samba configuration. I have managed to compile a simple hello world application and run it on the device using http://sources.nslu2-linux.org/sources/arm-920t_le.tar.bz2. I am planning to do more hacking on this device this weekend, and will write more about it.
Any geek having the LinkSys WRT54GL will definitely install Linux on it. I bought this device on September 2007, and a week after using it, I started to hack it. First it was just installing DD-WRT, then I tried to add an SD card to it. The DD-WRT mmc driver has the limitation of only supporting SD card up to 1 GB (My 2GB kingston can not be detected), so I reflash using OpenWRT.
DD-WRT is very easy to use. The web interface is great, but as a former Linux administrator, I’d rather handle things trough command line. If you are a command line lover like me, then OpenWRT is better. With OpenWRT driver, I can use my 2GB SD card with higher speed. Now I can use my router for downloading some stuff that takes a long time to download (such as things that are in the Torrent with few seeders).
I connect this router to 2 of my PCs. One of the PC is used for my everyday task, and the other one is my media center. I can wake one or both of my computer through this router (very useful and convenient for me).