Manual firmware-flashing

Oxnas 810 based
Post Reply
linus
Posts: 5
Joined: Fri Dec 26, 2014 10:52 pm

Manual firmware-flashing

Post by linus » Fri Dec 26, 2014 11:00 pm

I have a NSA 210 device which is running V3.20(AFL.0)D0 firmware. My guess is that this version is specific to the company that sold the device and also why I'm unable to upgrade it using Zyxel-firmwares. My question is related to how I would flash the firmware over like telnet or ssh? This should be possible, right?

Thankful for any help!

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: Manual firmware-flashing

Post by Mijzelf » Sat Dec 27, 2014 10:02 am

Who branded it?

What is the output of

Code: Select all

/zyxel/sbin/mrd_model -p

linus
Posts: 5
Joined: Fri Dec 26, 2014 10:52 pm

Re: Manual firmware-flashing

Post by linus » Sat Dec 27, 2014 11:03 am

Mijzelf wrote:Who branded it?
My device is branded by Telia in Sweden. The only difference in features is another backup utility for the cloud. I was thinking it is a standard 3.20 apart from that. But perhaps I might be wrong.
What is the output of

Code: Select all

/zyxel/sbin/mrd_model -p
The "/zyxel/" path does not exist on my device.

Output for

Code: Select all

/sbin/mrd_model -p
gives me this:

Code: Select all

sh-4.1# /sbin/mrd_model -p
sh: /zyxel/sbin/fw_printenv: not found

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: Manual firmware-flashing

Post by Mijzelf » Sat Dec 27, 2014 12:34 pm

The "/zyxel/" path does not exist on my device.
That complicates it. The scripts/binaries needed to flash the device are stored in /zyxel/sbin/. But maybe it's only renamed? What gives 'ls /' ?

Can you find a fw_printenv anywhere?

linus
Posts: 5
Joined: Fri Dec 26, 2014 10:52 pm

Re: Manual firmware-flashing

Post by linus » Sat Dec 27, 2014 12:50 pm

Can you find a fw_printenv anywhere?
Not that I can find :(

Code: Select all

sh-4.1# find / -name fw_printenv
find: File system loop detected; `/e-data/1580b6c6-a829-4b03-84b0-ca13818f4edc/ffproot' is part of the same file system loop as `/'.
What gives 'ls /' ?

Code: Select all

sh-4.1# ls /
after_booting.sh  dev     etc  home    lib  proc  sys  usr
bin               e-data  ffp  i-data  mnt  sbin  tmp  var
However, /sbin/ contains a few firmware scripts:

Code: Select all

sh-4.1# ls /sbin/
CheckPrinter                          mkdosfs
Decompress_To_HD.sh                   mkfs.ext2
account.sh                            mkfs.ext3
adjtimex                              mkreiserfs
badblocks                             mkswap
blockdev                              modprobe
buzzerc                               monitord
check_key                             mount.fuse
chroot                                mount.ntfs-3g
crond                                 mrd_model
debugreiserfs                         mtools
dhcpcd                                myhotplug
dosfsck                               ntpdate_sync.sh
dumpe2fs                              pivot_root
e2fsck.sh                             poweroff
eject                                 pwr_resume
fanctrld                              quotacheck
flash_eraseall                        quotaoff
flashcp                               quotaon
freeramdisk                           ras2mtd
fsck.ext2                             reboot
fsck.ext3                             reiserfsck
fwupgrade_erase_write_ras.sh          reiserfsck_rebuild_tree.sh
fwupgrade_extract_verify.sh           reiserfstune
fwupgrade_make_ramdisk_at_devram1.sh  repquota
fwupgrade_umount_freeramdisk.sh       resize_reiserfs
getLED                                rmmod
getty                                 route
halt                                  setLED
hotplug                               start-stop-daemon
hotplug_add_PTP.sh                    storage_autoRepair.sh
hotplug_add_SATA.sh                   storage_gen_swap.sh
hotplug_add_storage.sh                storage_gen_swap_usb.sh
hotplug_remove_PTP.sh                 storage_synceSATA_sdx1.sh
hotplug_remove_SATA.sh                swapoff
hotplug_remove_storage.sh             swapon
hwclock                               syslogd
i2cget                                telnetd
i2cset                                todefault.sh
ifconfig                              tune2fs
init                                  usbzync
insmod                                usbzync.sh
klogd                                 usbzync_rm_rf.sh
losetup                               uuidgen
lsmod                                 xfs_repair.sh
makekey                               zcip
makepwd                               zysh.sh
md5sum                                zyshclient
mdadm                                 zyshd
mdir
I would be happy to provide you with direct telnet access if you would care to take a look yourself?

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: Manual firmware-flashing

Post by Mijzelf » Sat Dec 27, 2014 2:38 pm

You are running chrooted ffp, which makes it impossible to see the root directory directly. You can use execute_outside_chroot to see if /zyxel exists, and to start a telnet daemon outside the chroot. (Use the -p option of telnetd to start it on a different port. The default port is already in use by ffp telnetd).

linus
Posts: 5
Joined: Fri Dec 26, 2014 10:52 pm

Re: Manual firmware-flashing

Post by linus » Sat Dec 27, 2014 3:15 pm

Ah, my bad. I should have discovered that.

Code: Select all

/ # /zyxel/sbin/mrd_model -p
DB01

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: Manual firmware-flashing

Post by Mijzelf » Sat Dec 27, 2014 6:09 pm

Good. The upgrade script /zyxel/sbin/fwupgrade_extract_verify.sh checks the nas hardware tag against some tag in the firmware. When it doesn't fit, it refuses to install the firmware. On a 'genuine' 210 the tag is D401, on your box it is DB01. So if you change the tag, I expect you to be able to install the 'normal' 210 firmware.

You can change the tag by executing

Code: Select all

/zyxel/sbin/mrd_model -s D401
This stores the value in the u-boot environment.

After a reboot you should be able to install genuine firmware. I recommend you to not directly install the latest, as I don't know if the flash partition sizes are stable over all versions, but first 3.20, then 4.10, then 4.40, and finally 4.41. The firmware can be found here.

linus
Posts: 5
Joined: Fri Dec 26, 2014 10:52 pm

Re: Manual firmware-flashing

Post by linus » Sat Dec 27, 2014 11:49 pm

Changed the tag and tried updating. Everything works!

Thanks a lot for your help. You rock!

zlatan01
Posts: 3
Joined: Mon Feb 19, 2018 2:42 pm

Re: Manual firmware-flashing

Post by zlatan01 » Mon Feb 19, 2018 3:05 pm

Can someone explain how to run this command? Telnet or something else? I have exact the same issue, NSA210 branded by Telia Sweden.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: Manual firmware-flashing

Post by Mijzelf » Tue Feb 20, 2018 8:43 am

Have a look at the Telnet backdoor.

zlatan01
Posts: 3
Joined: Mon Feb 19, 2018 2:42 pm

Re: Manual firmware-flashing

Post by zlatan01 » Tue Feb 20, 2018 5:39 pm

Mijzelf wrote:Have a look at the Telnet backdoor.
Thanks a lot. Solved :)

EDIT
But, I have faced a little problem. When connect to NSA210 by web browser (Chrome) I have got this message:
"The latest firmware requires all pre-existing packages to be removed, but your configuration will still be saved. You will need to re-install all packages to the latest version to enable them again."

And I can´t do any change through the web interface. Should I downgrade firmware?

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: Manual firmware-flashing

Post by Mijzelf » Wed Feb 21, 2018 6:27 pm

zlatan01 wrote:Should I downgrade firmware?
Don't know. You have to delete/upgrade all installed packages. (The old pre-fw4 packages use an other kernel interface than the new ones. They are completely incompatible). But I don't know why you 'can´t do any change through the web interface'. Have you already tried a factory reset?

zlatan01
Posts: 3
Joined: Mon Feb 19, 2018 2:42 pm

Re: Manual firmware-flashing

Post by zlatan01 » Thu Feb 22, 2018 8:06 pm

Solved due to clean web browser cash.

Post Reply