NSA-310 TDC firmware

Marvell Kirkwood based
symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

NSA-310 TDC firmware

Post by symp » Fri Nov 18, 2011 3:19 pm

Hello,

Since i haven't been able to get FFP-stick to work, i took the hdd out and got the firmware.

If anyone wanna take a look at it, i've uploaded it here: http://www.multiupload.com/W9RFI47YST

I was wondering if it would be possible to change the firmware to the original nsa-310 firmware or just remove some of the TDC stuff?

Mijzelf
Posts: 6251
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Fri Nov 18, 2011 6:53 pm

I *think* it can be done. I wrote some instructions here. Note: This is only the disk-part. You cannot update to later firmwares automatically, I think.

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Sat Nov 19, 2011 2:09 pm

I tried switching my sysdisk.img with your system.img

After putting the hdd back in the box and turning it on, i could see in my router it took the default TDC ip (192.168.1.5),
and accessing the box in browser, it redirects me to https://secure.tdc.dk/homedisk/registration/

edit: it seems it just deletes your file and downloads the TDC file again.

Mijzelf
Posts: 6251
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Sat Nov 19, 2011 3:10 pm

Did you create the mount.sda1.rw.flag file?

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Sat Nov 19, 2011 3:49 pm

Yes, i just made a 0 B file.

If i look in the rcS2 from your file, there is some TDC stuff too.

Mijzelf
Posts: 6251
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Sat Nov 19, 2011 4:55 pm

I extracted the in initramfs from a kernel some other Danish uploaded a while ago. On a first look the /etc/init.d/rcS is identical to the on of 310.

Code: Select all

<snip>
# $1 is extracted image filename (sysdisk.img)
checksum_img()
{
        SYS_CHECKSUM_NOW=`/sbin/md5sum $1 | /bin/awk '{print $1}'`
        SYS_CHECKSUM_INFO=`/zyxel/sbin/info_printenv img_checksum_${CURR_BOOTFROM} 2>/dev/null | awk -F"=" '{print $
2}'`
        echo "Checksum of sysdisk.img : ${SYS_CHECKSUM_NOW}"
        echo "Checksum from INFO  : ${SYS_CHECKSUM_INFO}"

        if [ "x"${SYS_CHECKSUM_INFO} == "x" ]; then
                echo "Checksum from INFO does not exist! Assume the sysdisk image is OK!"
                return 0
        fi

        if [ "x"${SYS_CHECKSUM_NOW} == "x"${SYS_CHECKSUM_INFO} ] || [ -e ${DISK_PATH}/mount.sda1.rw.flag ]; then
                return 0
        else
                return 1
        fi
}                     
<snip>
echo ${Flag_HD_Exists}
if [ "$Flag_HD_Exists" == "0" ]; then
        # check sysdisk.img md5sum
        echo "Boot from disk"
        if [ -f ${DISK_PATH}/sysdisk.img ]; then
                checksum_img ${DISK_PATH}/sysdisk.img
                if [ $? -eq 0 ]; then
                        echo "Checksum pass!"
                else
                        echo "Checksum does NOT match, system may be doing firmware upgrade. Extract new firmware fr
om NAND flash ..."
                        /bin/storage_gen_mntfw.sh ${DISK_PATH} mkfs
                        gzip -cd ${NAND_PATH}/sysdisk.img.gz > ${DISK_PATH}/sysdisk.img
                        /bin/sync
<snip>
I can't read anything else than the sysdisk.img will be overwritten if the checksum doesn't match AND the file /mount.sda1.rw.flag doesn't exist.

Do you have the possibility to hook up a serial port?

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Mon Nov 21, 2011 12:04 am

Can i use USB to serial from the box or do i need to use the internal serial port?

Mijzelf
Posts: 6251
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Mon Nov 21, 2011 9:49 am

You'll have to use the internal port. I think this tutorial also covers the 310.

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Tue Nov 22, 2011 8:15 am

I'm trying to get a TTL-232R-3V3 cable, not really easy in Denmark, might take a week or so..

But what do i do when i've connected to the serial port?

Mijzelf
Posts: 6251
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Tue Nov 22, 2011 8:44 am

Put my image back on the disk, add the mount.sda1.rw.flag file, put it in the NAS, connect the serial (and you've already tested if it works), and boot the box. In your serial output your can see the U-Boot messages, the kernel bootlog, and also the output of the startscripts, like

Code: Select all

        echo "Checksum of sysdisk.img : ${SYS_CHECKSUM_NOW}"
        echo "Checksum from INFO  : ${SYS_CHECKSUM_INFO}"
So this should tell why the sysdisk.img is overwritten.

Ultimately you could flash 310 firmware from the U-Boot prompt, but that's an advanced feature.

sheevalover
Posts: 23
Joined: Wed Nov 02, 2011 2:36 pm

Re: NSA-310 TDC firmware

Post by sheevalover » Wed Nov 23, 2011 5:00 pm

symp wrote:I'm trying to get a TTL-232R-3V3 cable, not really easy in Denmark, might take a week or so..

But what do i do when i've connected to the serial port?
(The cable is afaik the same as the fairly common CA-42 cable for Nokia telephones, based on Pl 2303)

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Mon Nov 28, 2011 8:30 am

So i got the cable now,

anyone knows root password?

Mijzelf
Posts: 6251
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Mon Nov 28, 2011 9:51 am

Maybe the password is the admin password, maybe you have to run http://<ip-of-nas>/zyxel/cgi-bin/remote_help-cgi?type=sshd_tdc first.
Maybe you can open the Telnet backdoor, after which the NsaRescueAngel password is a function of your MAC address.

But did you already try the cable? AFAIK all ZyXEL's just give you a shell.

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Mon Nov 28, 2011 10:51 am

Here's the bootlog http://pastebin.com/auEvLkiG

found the admin password in it, but the shell seems limited..

i'll try putting your firmware on and boot later today.

Mijzelf
Posts: 6251
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Mon Nov 28, 2011 11:40 am

symp wrote:the shell seems limited..
That are the internal commands of busybox ash. That looks limited indeed. Fortunately there are *lots* of external commands. Try <TAB> <TAB>.

Post Reply