I recently acquired some odd thin client devices with 4xHDMI ports and some other odd features. The company is long gone so I don't think I'll be getting GPL source or a clean copy of the firmware from anywhere. Fortunately, it has an easily accessible serial header.
I didn't see any obvious way to read the emmc rootfs since it's EXT4 (strangely) and that version of uboot can't read it. The best I came up with was to read the emmc into memory and then print it to the serial console. I then enabled logging in minicom to capture the output.
for x in 0 1 2 3 4 5 6 7; do mmc read 0 0x2000000 0x${x}00000 0x100000 ; md.b 0x2000000 20000000; done
I put together a quick script to convert that to a disk image.
#!/bin/bash
infile="$1"
address_pattern='^[0-9a-fA-F]\{8\}: '
data_pattern='.\{47\}'
ascii_pattern='.*'
sed -e "/${address_pattern}/!d" -e "s/$address_pattern\($data_pattern\)$ascii_pattern/\1/g" "$infile" | xxd -revert -plain > "$infile.bin"
exit
This was downloading ISOs over 14.4k modem levels of slow but I ended up with a working image.
I then:
- wrote it to a usb drive
- mounted the rootfs on my PC
- chroot'd in and changed the root password
- unmounted it and moved it to the device
- changed the cmdline in boot to use /dev/sda2 as the rootfs
- log in with the new root password
- repeat the mount/chroot/passwd to change the root password on the emmc
now I can start poking around in earnest.