NSA-310 TDC firmware

Marvell Kirkwood based
symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Mon Nov 28, 2011 3:48 pm

I put your system.img (i renamed it to sysdisk.img) on the disk, made the flag file.
Result: http://pastebin.com/ZViZ2RZS

If i don't rename it, it will recover original file from nand flash.

I don't have a shell anymore, and can't access web gui.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Mon Nov 28, 2011 4:29 pm

This looks good! The kernel modules don't load due to the wrong kernel version. Well, that can be fixed.
I don't have a shell anymore
What happens if you just hit 'enter' in the serial terminal?
and can't access web gui.
What do you mean? The webserver is down, or you can't login?
Anyway, try a factory reset. Keep the reset button pressed for about 20 seconds.

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Mon Nov 28, 2011 5:49 pm

How do i fix kernel?

Did reset, no changes.

Nothing happens when i hit enter.

Web server not running, but i can ping the NAS.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Mon Nov 28, 2011 7:01 pm

How do i fix kernel?
The kernel modules, I suppose?
The file sysdisk.img is actually a filesystem.
Is can be mounted by

Code: Select all

mkdir mountpoint
mount -o loop /path/to/sysdisk.img mountpoint
When you mount both the old and the new sysdisk.img, you can copy the contents of lib/modules from the old one to the new one.
symp wrote:Did reset, no changes.
Nothing happens when i hit enter.
Web server not running, but i can ping the NAS.
Hm. not good. This image is from a 4.23 firmware, which uses a 2.6.31.8 kernel, while your box has a 2.6.22.18 kernel. I'll see if I can extract a sysdisk.img from an older firmware.

Another option is to flash the newest 310 firmware (kernel+sysdisk.img), but I don't know if the 310 is identical enough to the TDC. I do have an 'old' GPL source for the 320, which according to the buildscripts can also be used for the TDC. But the first 'real' 310 that hit the market had a new kernel. So maybe something is changed in between.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Mon Nov 28, 2011 7:37 pm

I uploaded sysdisk.401AF01C0.img.gz here

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Tue Nov 29, 2011 11:25 am

with the sysdisk.401AF01C0.img firmware, webserver started and i had a shell, however the admin pw was set to "TDC style" for some reason.
and i was unable to login at the web gui.

the kernel from sysdisk.401AF01C0.img in the system.img file, didn't change anything, still no shell/webserver.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Tue Nov 29, 2011 3:52 pm

According to the Apache configuration file (/etc/service_conf/httpd.conf) the authentication is done by /usr/local/apache/modules/mod_auth_zyxel.so, which is inside sysdisk.img, which is part of the 320 firmware. So I suppose the choice for 'TDC authentication' is done by (the existence of) some files in /etc/ (which is basically in the kernel).

There are lots of tdc_* files in /etc/, so I guess it's a good idea to delete them. Mount sysdisk.img, and edit etc/init.d/rcS2. Add the next lines directly below '#!/bin/sh':

Code: Select all

rm /etc/tdc_*
rm /etc/style_tdc
rm -rf /etc/zyxel/tdc
There is also a file /etc/service_conf/httpd_special.conf which contains some TDC content, but I think we can't just delete the file. So I suggest to leave it alone, for the moment.

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Tue Nov 29, 2011 7:34 pm

I used the sysdisk.401AF01C0.img, changed rcS2: http://i42.tinypic.com/dow388.jpg

result: http://pastebin.com/r1AS8kiX

admin password is chbpSHi5, is that zyxel default?
bootlog with tdc firmware:

Code: Select all

TDC Style Detected, overwrite admin's password
[1424] server write-only FIFO is opened (fd=6)
[1424] server read-only FIFO is opened (fd=7)
[1424] server error read-only FIFO is opened (fd=8)
argc = 6,  func = 190
argid[1]: 363; argv[1]: password
argid[2]: 616; argv[2]: modify
argid[3]: 1122; argv[3]: "admin"
argid[4]: 1144; argv[4]: "chbpSHi5"
argid[5]: 1143; argv[5]: RaidLing
enter smb_db_update_user
webserver running but unable to login, says file missing in log.

Code: Select all

~ $ Nov 29 20:32:28 (none) httpd[2080]: [error] [client 192.168.1.100] File does not exist: /usr/local/apache/htdocs/zyxel/cgi-bin, referer: http://192.168.1.5/zyxel/loginwrap.html

Code: Select all

~ $ ls /usr/local/apache/htdocs/zyxel/[J
/usr/local/apache/htdocs/zyxel/FlowPlayer.swf 
/usr/local/apache/htdocs/zyxel/Help/
/usr/local/apache/htdocs/zyxel/addURL.html 
/usr/local/apache/htdocs/zyxel/admin/
/usr/local/apache/htdocs/zyxel/css/
/usr/local/apache/htdocs/zyxel/disable.html 
/usr/local/apache/htdocs/zyxel/dojo/
/usr/local/apache/htdocs/zyxel/index.html 
/usr/local/apache/htdocs/zyxel/iui/
/usr/local/apache/htdocs/zyxel/js/
/usr/local/apache/htdocs/zyxel/login.html 
/usr/local/apache/htdocs/zyxel/loginwrap.html 
/usr/local/apache/htdocs/zyxel/musicplayer.swf 
/usr/local/apache/htdocs/zyxel/pkg/
/usr/local/apache/htdocs/zyxel/res/
/usr/local/apache/htdocs/zyxel/updateAdminInfo.html 
/usr/local/apache/htdocs/zyxel/updateinfowrap.html 
/usr/local/apache/htdocs/zyxel/user/
sysdisk.img before starting NAS

Code: Select all

$ ls sys/usr/local/apache/cgi-bin/
access.cgi         export-cgi         file_upload-cgi    remote_help-cgi    weblogin.cgi
dlnotify           file_download.cgi  file_upload-cgic   setuser.cgi        zysh-cgi

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Tue Nov 29, 2011 9:08 pm

Hm. In /etc/service_conf/httpd_zld.conf is a ScriptAlias defined, which maps zyxel/cgi-bin on apache/cgi-bin. This alias is subtle different for the TDC firmware and the 4.01 firmware. I uploaded all the apache conf files here. You can put them in sysdisk.img/etc/init.d, and add next line to the start rcS2:

Code: Select all

tar xzf /ram_bin/etc/init.d/service_conf.tar.gz -C /etc/init.d/service_conf/
Then apache should run with all 4.01 settings.
admin password is chbpSHi5, is that zyxel default?
No. The default weblogin has password 1234, and until recent admin didn't have a shell, and so couldn't login via telnet or ssh.

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Tue Nov 29, 2011 9:40 pm

No changes

http://pastebin.com/A2ftvcvf


i copied cgi-bin folder to htdocs/zyxel/
web gui now says "Failed to login, please try again."
and log says:

Code: Select all

Nov 29 23:02:26 (none) weblogin.cgi: PAM _pam_init_handlers: no default config /etc/pam.d/other
Nov 29 23:02:26 (none) httpd[2149]: [error] [client 192.168.1.100] can't open console device: /dev/ttyS0, referer: http://192.168.1.5/zyxel/loginwrap.html
Nov 29 23:02:26 (none) PAM_smbpass[2966]: Cannot access samba password database, not running as root.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Wed Nov 30, 2011 7:07 pm

I suppose the default settings of the 320 have to be copied. I uploaded zyxel.tar.gz. Put them in sda1/etc/init.d, and add to the start of rcS2 the lines

Code: Select all

if [ -f /etc/zyxel/320_conf ]; then
	echo /etc/zyxel is already a 320 conf
else
	echo going to copy the 320 conf to /etc/zyxel...
	rm -rf /etc/zyxel/*
	tar xzf /ram_bin/etc/init.d/zyxel.tar.gz -C /etc/zyxel/
	touch /etc/zyxel/320_conf
fi

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Thu Dec 01, 2011 12:54 pm

Result: http://pastebin.com/UCkEtDET

now it gets IP from DHCP.

same problem with samba password db,

and i can't login at the shell anymore.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Thu Dec 01, 2011 4:10 pm

tar: Couldnt chdir to /etc/init.d/service_conf/: No such file or directory
The line about service_conf.tar.gz should be

Code: Select all

tar xzf /ram_bin/etc/init.d/service_conf.tar.gz -C /etc/service_conf/
i can't login at the shell anymore.
Don't you get a login prompt, or don't you know the password?

symp
Posts: 14
Joined: Fri Nov 18, 2011 3:12 pm

Re: NSA-310 TDC firmware

Post by symp » Thu Dec 01, 2011 10:42 pm

I just c/p what you wrote, looks like this http://i42.tinypic.com/2lxxvkx.jpg

Wrong password, not 1234 or the tdc default.

Mijzelf
Posts: 6207
Joined: Mon Jun 16, 2008 10:45 am

Re: NSA-310 TDC firmware

Post by Mijzelf » Fri Dec 02, 2011 11:05 am

symp wrote:I just c/p what you wrote
I know. I made a mistake.
I originally wrote

Code: Select all

tar xzf /ram_bin/etc/init.d/service_conf.tar.gz -C /etc/init.d/service_conf/
but that was wrong. It had to be

Code: Select all

tar xzf /ram_bin/etc/init.d/service_conf.tar.gz -C /etc/service_conf/

Post Reply