General NAS-Central Forums

Welcome to the NAS community
It is currently Tue Oct 17, 2017 11:23 am

All times are UTC




Post new topic Reply to topic  [ 26 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: I'm all alone?
PostPosted: Wed Apr 30, 2008 6:28 am 
Offline

Joined: Wed Apr 30, 2008 6:02 am
Posts: 4
So am I one of the few to try and hack the older model of EDmini?

Interesting. Well I'll start with what little I have gotten it to do. The root exploit. That is all I can seem to get working. Like I have seen stated elsewhere, when users are created, passwords are never created and -g arguments are ignored. I tried using sed to mod my user files, but I ended up nerfing my EDmini. Luckily resetting the settings doesn't erase files. At any rate, I need to figure out how to get telent to work at least. I'm not sure the CPU in my EDmini is ARM tho. I downloaded the source code and such from LaCie and I think I saw something about PPC.

I'd love to install a Bittorrent client on it. The CPU might not be able to handle it however. At least I could play with it more with telent ssh and such. I followed two guides on the web. One about opening the hardware and modding the filesystem manually. Another about the debian chroot.

Of course I couldn't follow them far. I'm not great at linux stuff or anything so I felt lost. Anyway, only just discovered this forum and hoped someone would like to help.


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Mon May 12, 2008 10:24 am 
Offline

Joined: Thu Mar 06, 2008 12:23 pm
Posts: 58
Location: Vienna
do you know anything about the used hardware/chips? do you have a picture of the mainboard somewhere?

GPL sources are here:
http://gpl.nas-central.org/LACIE/ethernet_disk_mini/


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Thu May 15, 2008 10:27 pm 
Offline

Joined: Thu May 15, 2008 10:16 pm
Posts: 13
You're not alone :D

I got one of these boxes as well, too bad disk has been removed and formatted :roll: , mainboard shoud be okay.

I'd like to try installing debian or something in it but without original partitions nothing will work. Any ideas?

Image

Image

Edit: Btw I should have a serial interface somewhere just in case, I don't understand if there is one on the mainboard... maybe J2? (near the usb port)


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Fri May 16, 2008 9:12 am 
Offline

Joined: Thu Mar 06, 2008 12:23 pm
Posts: 58
Location: Vienna
i put both pictures onto
http://lacie.nas-central.org/index.php/Category:EDmini
(you can both edit this page there btw....use the user/login which you use here).

it seems as if this board actually was made for 3 IDE ports ...but only 1 IDE Port was populated.

whats the white port on the right side of
http://lacie.nas-central.org/index.php/ ... _Front.jpg
?

is this a power cable for the fan?

seems as if the board was designed to have up to 4 of these ports.

ok, now some wild guesses. i guess that the MX (aka macronix) chip on the bottom right is the flash chip. the chip directly next to the ethernet port is the ethernet chip and the chip directly next to the usb-port is the usb chip.

i also guess that the PSC chips are ram chips.
as i can`t read the text on all chips it would be great if someone would fill in the details at http://lacie.nas-central.org/index.php/Category:EDmini ....i started with the CPU but i can`t fully read the read.

ok, now to the interesting things regarding serial/jtag.
J2 indeed could be serial....but with a very uncommon layout. 1x10 ..... usually serial only needs 4 pins
http://nas-central.org/index.php/Genera ... _mandatory
maybe these 1x10 pins are serial + something else. i haven`t identified a microcontroller (which might handle leds/buttons) but one of the chips might be one and then it makes sense as the devs might have needed a connection to the microcontroller for debugging purposes as well.

the pads at the bottom are 2 x 8 .... if you look at http://www.freescale.com/files/32bit/do ... PC5200.pdf , click on JTAG on the left and scroll down to Table 53 you will notice that this is the JTAG port.....headers need to be populated of course.
and the pads at the rear are 2 x 22....2 x 22 aka 44 pin is usually used for special IDE cables....

L2 is the best bet so far i think. fetch your multimeter and measure the voltage of all pins while the box is on....

PS: no i don`t own this box. i just want to help.


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Fri May 16, 2008 11:06 am 
Offline

Joined: Thu May 15, 2008 10:16 pm
Posts: 13
Hello mindbender and thanks for your time.

mindbender wrote:
whats the white port on the right side of
http://lacie.nas-central.org/index.php/ ... _Front.jpg
?
is this a power cable for the fan?


Sorry, I forgot to mention ports.
The one to the right side is hard disk power supply, only one soldered out of four, so... mainboard was designed to support (a maximum of) 3 ide's and 4 disks :?: I don't get it...
White port on top is connected to a very small pcb with just a led, power button and a couple transistors, i'll post a pic of it if that's interesting.
White port on bottom left is fan, seems to be temperature-controlled or delayed.
Edited some details on the wiki and made another pic from one side.


Last edited by smeagle on Fri May 16, 2008 2:14 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Fri May 16, 2008 2:13 pm 
Offline

Joined: Thu May 15, 2008 10:16 pm
Posts: 13
mindbender wrote:
L2 is the best bet so far i think. fetch your multimeter and measure the voltage of all pins while the box is on....


Unit powered on, disk (not the original one) connected:

Let's assume pin #1 as the closest to "JP2"" inscription

1) 5,3 V
2) 0 V (chassis)
3) 3,5V
4) 2,7 V
5) 2,5 V
6) 3,5 V
7) 0,8 V
8) 3,5 V
9) 3,5 V
10) 3,5 V

All voltages measured against pin #2 (chassis)


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Fri May 16, 2008 5:37 pm 
Offline

Joined: Thu Mar 06, 2008 12:23 pm
Posts: 58
Location: Vienna
yep, also post the small PCB. leds + buttons are typically controlled by microcontrollers....maybe its on the small pcb.


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Fri May 16, 2008 6:12 pm 
Offline

Joined: Thu May 15, 2008 10:16 pm
Posts: 13
mindbender wrote:
yep, also post the small PCB. leds + buttons are typically controlled by microcontrollers....maybe its on the small pcb.


I don't think so, anyway i made a pic, please have a look at the wiki. (only one side is populated, the other side is empty)

Are the J2 voltages meaningful to you? I don't know much about serial ports.
BTW I noticed voltages on pins 7,8,9,10 on J2 drop to almost zero when unit is powered down. (But still receives power supply)

I don't have a JTAG, should i buy one?


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Sat May 17, 2008 2:10 am 
Offline

Joined: Thu Mar 06, 2008 12:23 pm
Posts: 58
Location: Vienna
ok, so thats what i can say about J2.

there are 4 traces going away from J2, Pin 3,4 + 6 are connected to the chip directly below, pin 1 might be something else.....i do not see any other traces going away from the 10 pins...maybe these 4 pins are serial?

what can you read on the chip directly under J2? what is this chip?


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Sat May 17, 2008 4:55 am 
Offline

Joined: Thu May 15, 2008 10:16 pm
Posts: 13
mindbender wrote:
ok, so thats what i can say about J2.

what can you read on the chip directly under J2? what is this chip?


That's the XILINX XC9536XL, sorry i could't make the images any clearer...

Other chips i didn't mention:

AT256 (8 pins near nic)

BAARA G58FR (10 pins near power connector)

PT76815 (20 pins between power connector and processor)

LC32A (14 pins betweeen MX and PSC chips)

3X LC245A (20 pins, near PSC chips)

LM 56 (8 pins, near J9)

Looking carefully at mainboard i can't see any other spot that could be serial other than J2...


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Sat May 17, 2008 9:56 am 
Offline

Joined: Thu May 08, 2008 11:23 am
Posts: 112
Location: near Toulouse, France
The pins going to the XC9536 are almost certainly JTAG; the XC9536 data sheet is here:-
http://www.xilinx.com/support/documenta ... /ds058.pdf

This sounds very much like J2 on the EDmini V2 except it is 10 pins instead of 8 :(
They may have arranged to use the same cable for both ;-)
See this thread:-
viewtopic.php?f=146&t=71


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Sun May 18, 2008 10:31 pm 
Offline

Joined: Thu May 15, 2008 10:16 pm
Posts: 13
Ok, i'll try connecting to the serial but this will require some time, i need to check documentation first, i'll be back.


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Mon May 19, 2008 11:57 am 
Offline

Joined: Thu May 15, 2008 10:16 pm
Posts: 13
Seems J2 pinout is the same as the ED mini V2, at least for serial access:

picocom -b 115200 /dev/ttyUSB0
picocom v1.4

port is : /dev/ttyUSB0
flowcontrol : none
baudrate is : 115200
parity is : none
databits are : 8
escape is : C-a
noinit is : no
noreset is : no
nolock is : no
send_cmd is : ascii_xfr -s -v -l10
receive_cmd is : rz -vv

Terminal ready


U-Boot 1.1.1-LaCie1 (Dec 17 2004 - 16:25:41)

CPU: MPC5200 (JTAG ID 0001101d) at 264 MHz
Bus 132 MHz, IPB 132 MHz, PCI 33 MHz
Board: Motorola MPC5200 (IceCube)
I2C: 85 kHz, ready
DRAM: SDRAM_CTRL=0x515f0000
64 MB
FLASH: 0 kB
*** Warning - bad CRC, using default environment

PCI: Bus Dev VenId DevId Class Int
00 1a 1057 5803 0680 00
In: serial
Out: serial
Err: serial
Net: FEC ETHERNET
IDE: Bus 0: not available

Hit any key to stop autoboot: 0

** Device 0 not available
## Booting image at 00200000 ...
Bad Magic Number
=> help
? - alias for 'help'
autoscr - run script from memory
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and informations
cp - memory copy
crc32 - checksum calculation
diskboot- boot from IDE device
echo - echo args to console
eeprom - EEPROM sub-system
erase - erase FLASH memory
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
flinfo - print FLASH memory information
go - start application at address 'addr'
help - print online help
icrc32 - checksum calculation
ide - IDE sub-system
iloop - infinite loop on address range
imd - i2c memory display
iminfo - print header information for application image
imls - list all images found in flash
imm - i2c memory modify (auto-incrementing)
imw - memory write (fill)
inm - memory modify (constant address)
iprobe - probe to discover valid I2C chip addresses
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
md - memory display
mm - memory modify (auto-incrementing)
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
pci - list and access PCI Configuraton Space
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
tftpboot- boot image via network using TFTP protocol
usb - USB sub-system
usbboot - boot from USB device
version - print monitor version
=> bdinfo
memstart = 0x00000000
memsize = 0x04000000
flashstart = 0xFF000000
flashsize = 0x00000001
flashoffset = 0x00034000
sramstart = 0x00000000
sramsize = 0x00000000
bootflags = 0x00000001
intfreq = 264 MHz
busfreq = 132 MHz
ethaddr = 00:00:00:00:00:00
IP addr = 0.0.0.0
baudrate = 115200 bps
=> flinfo

Bank # 1: missing or unknown FLASH type

Bank # 2: missing or unknown FLASH type

=> printenv
bootcmd=run disk_disk
bootdelay=1
baudrate=115200
preboot=echo
netdev=eth0
kernel_addr=0x200000
partition=0:6
diskargs=setenv bootargs root=/dev/hda7
disk_disk=disk $(kernel_addr) $(partition);run diskargs;bootm $(kernel_addr)
stdin=serial
stdout=serial
stderr=serial
ethact=FEC ETHERNET
bootargs=root=/dev/hda7

Environment size: 312/65532 bytes

###################################

pinounts i've been able to find on pcb:

3) -> pin 10 on Xilinx chip
4) -> pin 11 on Xilinx chip
5) -> pin 24 on Xilinx chip
6) -> pin 9 on Xilinx chip

Now what :?:


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Mon May 19, 2008 12:57 pm 
Offline

Joined: Thu Mar 06, 2008 12:23 pm
Posts: 58
Location: Vienna
-> i put the info to http://lacie.nas-central.org/index.php/Category:EDmini

well.....you now have full control over the bootloader....i suppose you have no linux OS which you could load on the hdd? it looks like as if it tries to boot and then fails (Bad magic number?)

usually it would be next to find out some more info about this box by executing the commands at
http://nas-central.org/index.php/Genera ... the_device

has nobody a copy of the original OS? if not maybe you could try to boot a powerpc debian rootfs from hdd. a rootfs (customized to work on the Buffalo Linkstation) can be downloaded here:
http://buffalo.nas-central.org/download ... 21-LS1.tgz
the rootfs itself should work.....but you still need a kernel to boot to the Linux OS.

download the gpl-sources and try to recompile the kernel ....you will need a powerpc crosstoolchain for this. crosstool might help...there are some links on my Nas customization guide...

someone has a copy of the original OS and the kernel? some more info about the stock partition layout also would be good...it seems that it boots from an /dev/hda7 in stock condition....but everything else is unknown. but well, if someone is able to compile a working kernel it should be possible to boot to debian.

and who knows, maybe mpc5200 is already supported in the vanilla kernel....
http://www.246tnt.com/mpc52xx/ and http://ozlabs.org/pipermail/linuxppc-em ... 27870.html actually look promising.


Top
 Profile  
 
 Post subject: Re: I'm all alone?
PostPosted: Mon May 19, 2008 7:03 pm 
Offline

Joined: Thu May 08, 2008 11:23 am
Posts: 112
Location: near Toulouse, France
smeagle wrote:
Seems J2 pinout is the same as the ED mini V2, at least for serial access:

pinounts i've been able to find on pcb:

3) -> pin 10 on Xilinx chip
4) -> pin 11 on Xilinx chip
5) -> pin 24 on Xilinx chip
6) -> pin 9 on Xilinx chip

Now what :?:

3) Xilinx pin 10 = TMS
4) Xilinx pin 11 = TCK
5) Xilinx pin 24 = TDO
6) Xilinx pin 9 = TDI

Same as the EDmini V2 ;-)


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 26 posts ]  Go to page 1, 2  Next

All times are UTC


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group