|
Hacking into a stock GoFlexHome unit January 29, 2018 05:07PM |
Registered: 7 years ago Posts: 337 |
|
Re: Hacking into a stock GoFlexHome unit January 29, 2018 11:58PM |
Admin Registered: 13 years ago Posts: 19,204 |
Quote
ssh USERNAME_hipserv2_seagateplug_XXXX-XXXX-XXXX-XXXX@GOFLEX_HOME_IP
Gain root access:
sudo -E -s
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 08:36AM |
Registered: 11 years ago Posts: 1,303 |
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 11:04AM |
Registered: 7 years ago Posts: 337 |
>Quote
ssh
> USERNAME_hipserv2_seagateplug_XXXX-XXXX-XXXX-XXXX@GOFLEX_HOME_IP
> Gain root access:
> sudo -E -s
Connected
-- NAS EXPLORER --
_ _ ____ _
| | | | | __ ) ___ ___ | |_
| | | |___| _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/ |____/ \___/ \___/ \__|
** QSI BOARD: NAS-PLUG LE
U-Boot 1.1.4 (Jun 10 2010 - 08:28:13) Marvell version: 3.4.27
QSI NAS version: 1.0.4
U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006CFB00
Soc: 88F6281 A1 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz
DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000 size 128MB
DRAM Total size 128MB 16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash: 0 kB
CPU : Marvell Feroceon (Rev 1)
Streaming disabled
Write allocate disabled
USB 0: host mode
PEX 0: interface detected no Link.
Net: egiga0 [PRIME]
Hit any key to stop autoboot: 0
NAND read: device 0 offset 0x100000, size 0x600000
Reading data from 0x6ff800 -- 100% complete.
6291456 bytes read: OK
## Booting image at 00800000 ...
Image Name: Linux-2.6.22.18
Created: 2010-06-17 5:37:59 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2095148 Bytes = 2 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
Starting kernel ...
Uncompressing Linux.................................................................................................................................... done, booting the kernel.
Linux version 2.6.22.18 (ramang@es5x86.axentra.com) (gcc version 4.3.2 (sdk3.2rc1-ct-ng-1.4.1) ) #16 Thu Jun 17 01:37:53 EDT 2010
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists. Total pages: 32512
Kernel command line: console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 125568KB available (3844K code, 261K data, 128K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB
PEX0_IO ....base f2000000, size 1MB
INTER_REGS ....base f1000000, size 1MB
NFLASH_CS ....base fa000000, size 2MB
SPI_CS ....base f4000000, size 16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size 2MB
Marvell Development Board (LSP Version KW_LSP_4.3.4_patch22)-- SHEEVA PLUG Soc: 88F6281 A1 LE
Detected Tclk 200000000 and SysClk 400000000
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c057b600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
RTC has been updated!!!
RTC registered
XOR registered 2 channels
XOR 2nd invalidate WA enabled
cesadev_init(c0011854)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Warning: TS unit is powered off.
MV Buttons Driver Load
JFFS2 version 2.2. (NAND) ���� 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: module loaded
Loading Marvell Ethernet Driver:
o Cached descriptors in DRAM
o DRAM SW cache-coherency
o Single RX Queue support - ETH_DEF_RXQ=0
o Single TX Queue support - ETH_DEF_TXQ=0
o TCP segmentation offload enabled
o Receive checksum offload enabled
o Transmit checksum offload enabled
o Network Fast Processing (Routing) supported
o Driver ERROR statistics enabled
o Driver INFO statistics enabled
o Proc tool API enabled
o SKB Reuse supported
o SKB Recycle supported
o Rx descripors: q0=128
o Tx descripors: q0=532
o Loading network interface(s):
o register under eth%d platform
o eth0, ifindex = 1, GbE port = 0
Warning: Giga 1 is Powered Off
mvFpRuleDb (c7e17000): 1024 entries, 4096 bytes
Intel(R) PRO/1000 Network Driver - version 7.3.20-k2-NAPI
Copyright (c) 1999-2006 Intel Corporation.
e100: Intel(R) PRO/100 Network Driver, 3.5.17-k4-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit)
Scanning device for bad blocks
Using static partition definition
Creating 3 MTD partitions on "nand_mtd":
0x00000000-0x00100000 : "u-boot"
0x00100000-0x00700000 : "uImage"
0x00700000-0x10000000 : "root"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: sub-page size: 512
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd2 to ubi0
UBI: MTD device name: "root"
UBI: MTD device size: 249 MiB
UBI: number of good PEBs: 1992
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 1
UBI: available PEBs: 0
UBI: total number of reserved PEBs: 1992
UBI: number of PEBs reserved for bad PEB handling: 38
UBI: max/mean erase counter: 4/0
UBI: background thread "ubi_bgt0d" started, PID 296
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v3.0
usb 1-1: new high speed USB device using ehci_marvell and address 2
usb 1-1: configuration #1 chosen from 1 choice
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
scsi2 : SCSI emulation for USB Mass Storage devices
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
Linux telephony interface: v1.00
Marvell Telephony Driver:
Warning Tdm is Powered Off
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1 91 MB/s
raid6: int32x2 109 MB/s
raid6: int32x4 119 MB/s
raid6: int32x8 94 MB/s
raid6: using algorithm int32x4 (119 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
arm4regs : 1084.400 MB/sec
8regs : 822.000 MB/sec
32regs : 803.200 MB/sec
raid5: using function: arm4regs (1084.400 MB/sec)
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
dm_crypt using the OCF package.
usbcore: registered new interface driver usbhid
drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
UBIFS: recovery needed
UBIFS error (pid 1): layout_cnodes: LPT out of space
[<c00f2e84>] (dump_stack+0x0/0x14) from [<c021d0a8>] (ubifs_lpt_start_commit+0x700/0x764)
[<c021c9a8>] (ubifs_lpt_start_commit+0x0/0x764) from [<c0211058>] (do_commit+0xc8/0x6f8)
[<c0210f90>] (do_commit+0x0/0x6f8) from [<c0211714>] (ubifs_run_commit+0x8c/0xa0)
r8:c0561c18 r7:c7e78000 r6:00000678 r5:c7ed0084 r4:c7ed0000
[<c0211688>] (ubifs_run_commit+0x0/0xa0) from [<c021a008>] (ubifs_rcvry_gc_commit+0x218/0x228)
r5:c7ed0000 r4:00000000
[<c0219df0>] (ubifs_rcvry_gc_commit+0x0/0x228) from [<c0206f4c>] (ubifs_get_sb+0xc50/0xfe8)
r8:c7e78200 r7:00000000 r6:0001e5a0 r5:00000001 r4:00000000
[<c02062fc>] (ubifs_get_sb+0x0/0xfe8) from [<c01664cc>] (vfs_kern_mount+0x58/0x94)
[<c0166474>] (vfs_kern_mount+0x0/0x94) from [<c0166564>] (do_kern_mount+0x3c/0xd8)
r8:c03f8648 r7:c7f51000 r6:00000000 r5:c7f53000 r4:00008000
[<c0166528>] (do_kern_mount+0x0/0xd8) from [<c017c8ac>] (do_mount+0x578/0x5c8)
r9:00000000 r8:00008000 r7:c7f53000 r6:00000000 r5:00000000
r4:00008000
[<c017c334>] (do_mount+0x0/0x5c8) from [<c017c988>] (sys_mount+0x8c/0xd4)
[<c017c8fc>] (sys_mount+0x0/0xd4) from [<c0008d84>] (do_mount_root+0x28/0xb0)
r7:00008000 r6:c05e7000 r5:c0023858 r4:c05e7000
[<c0008d5c>] (do_mount_root+0x0/0xb0) from [<c000900c>] (mount_block_root+0x100/0x220)
r4:c05e7000
[<c0008f0c>] (mount_block_root+0x0/0x220) from [<c00092cc>] (prepare_namespace+0xa4/0x170)
r8:00000000 r7:c0560000 r6:00000000 r5:c0023858 r4:c0023864
[<c0009228>] (prepare_namespace+0x0/0x170) from [<c00085fc>] (kernel_init+0x240/0x29c)
r5:c00223a4 r4:c040e300
[<c00083bc>] (kernel_init+0x0/0x29c) from [<c01256f8>] (do_exit+0x0/0x7f0)
UBIFS error (pid 1): do_commit: commit failed, error -28
UBIFS warning (pid 1): ubifs_ro_mode: switched to read-only mode, error -28
VFS: Cannot open root device "ubi0:rootfs" or unknown-block(0,0)
Please append a correct "root=" boot option; here are the available partitions:
1f00 1024 mtdblock0 (driver?)
1f01 6144 mtdblock1 (driver?)
1f02 254976 mtdblock2 (driver?)
Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 01:27PM |
Admin Registered: 13 years ago Posts: 19,204 |
Quote
I tried a serial connection but nothing showed up, but eventually I jiggled the wires around which seemed to wake the thing up.
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 01:29PM |
Admin Registered: 13 years ago Posts: 19,204 |
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 03:04PM |
Registered: 7 years ago Posts: 337 |
>Quote
I tried a serial connection but nothing
> showed up, but eventually I jiggled the wires
> around which seemed to wake the thing up.
Quote
Hit any key to stop autoboot: 0
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 03:15PM |
Registered: 7 years ago Posts: 375 |
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 04:22PM |
Admin Registered: 13 years ago Posts: 19,204 |
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 06:37PM |
Registered: 7 years ago Posts: 337 |
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 07:34PM |
Registered: 7 years ago Posts: 375 |
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 09:42PM |
Admin Registered: 13 years ago Posts: 19,204 |
|
Re: Hacking into a stock GoFlexHome unit January 30, 2018 10:53PM |
Registered: 11 years ago Posts: 1,303 |
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 12:52AM |
Registered: 7 years ago Posts: 337 |
-- NAS EXPLORER -- _ _ ____ _ | | | | | __ ) ___ ___ | |_ | | | |___| _ \ / _ \ / _ \| __| | |_| |___| |_) | (_) | (_) | |_ \___/ |____/ \___/ \___/ \__| ** QSI BOARD: NAS-PLUG LE U-Boot 1.1.4 (Jun 10 2010 - 08:28:13) Marvell version: 3.4.27 QSI NAS version: 1.0.4 U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006CFB00 Soc: 88F6281 A1 (DDR2) CPU running @ 1200Mhz L2 running @ 400Mhz SysClock = 400Mhz , TClock = 200Mhz DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6 DRAM CS[0] base 0x00000000 size 128MB DRAM Total size 128MB 16bit width Addresses 8M - 0M are saved for the U-Boot usage. Mem malloc Initialization (8M - 7M): Done NAND:256 MB Flash: 0 kB CPU : Marvell Feroceon (Rev 1) Streaming disabled Write allocate disabled USB 0: host mode PEX 0: interface detected no Link. Net: egiga0 [PRIME] <Explorer> Enter USB firmware instllation by RESET IO. USB: scanning bus for devices... 2 USB Device(s) found 1 Storage Device(s) found reading uImage ... ............................................................................................................................................................................................................... Device NOT ready Request Sense returned 00 00 00 2359296 bytes read Device NOT ready Request Sense returned 00 00 00 ** Can't read from device 0 ** ** Unable to use usb 0:1 for fatload ** <Explorer> Firmware installation error(4)! <Explorer> Please power off system retry again!
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 01:03AM |
Registered: 7 years ago Posts: 337 |
-- NAS EXPLORER --
_ _ ____ _
| | | | | __ ) ___ ___ | |_
| | | |___| _ \ / _ \ / _ \| __|
| |_| |___| |_) | (_) | (_) | |_
\___/ |____/ \___/ \___/ \__|
** QSI BOARD: NAS-PLUG LE
U-Boot 1.1.4 (Jun 10 2010 - 08:28:13) Marvell version: 3.4.27
QSI NAS version: 1.0.4
U-Boot code: 00600000 -> 0067FFF0 BSS: -> 006CFB00
Soc: 88F6281 A1 (DDR2)
CPU running @ 1200Mhz L2 running @ 400Mhz
SysClock = 400Mhz , TClock = 200Mhz
DRAM CAS Latency = 5 tRP = 5 tRAS = 18 tRCD=6
DRAM CS[0] base 0x00000000 size 128MB
DRAM Total size 128MB 16bit width
Addresses 8M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (8M - 7M): Done
NAND:256 MB
Flash: 0 kB
CPU : Marvell Feroceon (Rev 1)
Streaming disabled
Write allocate disabled
USB 0: host mode
PEX 0: interface detected no Link.
Net: egiga0 [PRIME]
Hit any key to stop autoboot: 0
NAND read: device 0 offset 0x100000, size 0x600000
Reading data from 0x6ff800 -- 100% complete.
6291456 bytes read: OK
## Booting image at 00800000 ...
Image Name: Linux-2.6.22.18
Created: 2010-06-17 5:37:59 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 2095148 Bytes = 2 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
Starting kernel ...
Uncompressing Linux.................................................................................................................................... done, booting the kernel.
Linux version 2.6.22.18 (ramang@es5x86.axentra.com) (gcc version 4.3.2 (sdk3.2rc1-ct-ng-1.4.1) ) #16 Thu Jun 17 01:37:53 EDT 2010
CPU: ARM926EJ-S [56251311] revision 1 (ARMv5TE), cr=00053977
Machine: Feroceon-KW
Using UBoot passing parameters structure
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
CPU0: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Built 1 zonelists. Total pages: 32512
Kernel command line: console=ttyS0,115200 ubi.mtd=2,2048 root=ubi0:rootfs rootfstype=ubifs init=/linuxrc
PID hash table entries: 512 (order: 9, 2048 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 125568KB available (3844K code, 261K data, 128K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
CPU Interface
-------------
SDRAM_CS0 ....base 00000000, size 128MB
SDRAM_CS1 ....disable
SDRAM_CS2 ....disable
SDRAM_CS3 ....disable
PEX0_MEM ....base e8000000, size 128MB
PEX0_IO ....base f2000000, size 1MB
INTER_REGS ....base f1000000, size 1MB
NFLASH_CS ....base fa000000, size 2MB
SPI_CS ....base f4000000, size 16MB
BOOT_ROM_CS ....no such
DEV_BOOTCS ....no such
CRYPT_ENG ....base f0000000, size 2MB
Marvell Development Board (LSP Version KW_LSP_4.3.4_patch22)-- SHEEVA PLUG Soc: 88F6281 A1 LE
Detected Tclk 200000000 and SysClk 400000000
MV Buttons Device Load
Marvell USB EHCI Host controller #0: c057b600
PEX0 interface detected no Link.
PCI: bus0: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
Time: kw_clocksource clocksource has been installed.
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
RTC registered
XOR registered 2 channels
XOR 2nd invalidate WA enabled
cesadev_init(c0011854)
mvCesaInit: sessions=640, queue=64, pSram=f0000000
Warning: TS unit is powered off.
MV Buttons Driver Load
JFFS2 version 2.2. (NAND) ���� 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 33) is a 16550A
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
loop: module loaded
Loading Marvell Ethernet Driver:
o Cached descriptors in DRAM
o DRAM SW cache-coherency
o Single RX Queue support - ETH_DEF_RXQ=0
o Single TX Queue support - ETH_DEF_TXQ=0
o TCP segmentation offload enabled
o Receive checksum offload enabled
o Transmit checksum offload enabled
o Network Fast Processing (Routing) supported
o Driver ERROR statistics enabled
o Driver INFO statistics enabled
o Proc tool API enabled
o SKB Reuse supported
o SKB Recycle supported
o Rx descripors: q0=128
o Tx descripors: q0=532
o Loading network interface(s):
o register under eth%d platform
o eth0, ifindex = 1, GbE port = 0
Warning: Giga 1 is Powered Off
mvFpRuleDb (c7da7000): 1024 entries, 4096 bytes
Intel(R) PRO/1000 Network Driver - version 7.3.20-k2-NAPI
Copyright (c) 1999-2006 Intel Corporation.
e100: Intel(R) PRO/100 Network Driver, 3.5.17-k4-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
Integrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
NFTL driver: nftlcore.c $Revision: 1.98 $, nftlmount.c $Revision: 1.41 $
NAND device: Manufacturer ID: 0x2c, Chip ID: 0xda (Micron NAND 256MiB 3,3V 8-bit)
Scanning device for bad blocks
Using static partition definition
Creating 3 MTD partitions on "nand_mtd":
0x00000000-0x00100000 : "u-boot"
0x00100000-0x00700000 : "uImage"
0x00700000-0x10000000 : "root"
UBI: attaching mtd2 to ubi0
UBI: physical eraseblock size: 131072 bytes (128 KiB)
UBI: logical eraseblock size: 126976 bytes
UBI: smallest flash I/O unit: 2048
UBI: sub-page size: 512
UBI: VID header offset: 2048 (aligned 2048)
UBI: data offset: 4096
UBI: attached mtd2 to ubi0
UBI: MTD device name: "root"
UBI: MTD device size: 249 MiB
UBI: number of good PEBs: 1992
UBI: number of bad PEBs: 0
UBI: max. allowed volumes: 128
UBI: wear-leveling threshold: 4096
UBI: number of internal volumes: 1
UBI: number of user volumes: 1
UBI: available PEBs: 0
UBI: total number of reserved PEBs: 1992
UBI: number of PEBs reserved for bad PEB handling: 38
UBI: max/mean erase counter: 1/0
UBI: background thread "ubi_bgt0d" started, PID 296
ehci_marvell ehci_marvell.70059: Marvell Orion EHCI
ehci_marvell ehci_marvell.70059: new USB bus registered, assigned bus number 1
ehci_marvell ehci_marvell.70059: irq 19, io base 0xf1050100
ehci_marvell ehci_marvell.70059: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v3.0
usbcore: registered new interface driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
i2c /dev entries driver
Linux telephony interface: v1.00
Marvell Telephony Driver:
Warning Tdm is Powered Off
md: linear personality registered for level -1
md: raid0 personality registered for level 0
md: raid1 personality registered for level 1
raid6: int32x1 91 MB/s
raid6: int32x2 109 MB/s
raid6: int32x4 119 MB/s
raid6: int32x8 94 MB/s
raid6: using algorithm int32x4 (119 MB/s)
md: raid6 personality registered for level 6
md: raid5 personality registered for level 5
md: raid4 personality registered for level 4
raid5: measuring checksumming speed
arm4regs : 1072.400 MB/sec
8regs : 822.000 MB/sec
32regs : 803.200 MB/sec
raid5: using function: arm4regs (1072.400 MB/sec)
device-mapper: ioctl: 4.11.0-ioctl (2006-10-12) initialised: dm-devel@redhat.com
dm_crypt using the OCF package.
usbcore: registered new interface driver usbhid
drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
md: Autodetecting RAID arrays.
md: autorun ...
md: ... autorun DONE.
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "rootfs"
UBIFS: file system size: 239857664 bytes (234236 KiB, 228 MiB, 1889 LEBs)
UBIFS: journal size: 9023488 bytes (8812 KiB, 8 MiB, 72 LEBs)
UBIFS: media format: 4 (latest is 4)
UBIFS: default compressor: zlib
UBIFS: reserved for root: 0 bytes (0 KiB)
VFS: Mounted root (ubifs filesystem).
Freeing init memory: 128K
Failed to execute /linuxrc. Attempting defaults...
INIT: version 2.86 booting
Welcome to HipServ
Press 'I' to enter interactive startup.
Setting clock : Sun Jan 2 08:31:05 EST 2000 [ OK ]
Starting udev: [ OK ]
Setting hostname axentraserver.localdomain: [ OK ]
Setting up Logical Volume Management: No volume groups found
[ OK ]
Checking filesystems
Checking all file systems.
[ OK ]
Mounting local filesystems: mount: sysfs already mounted or /sys busy
mount: according to mtab, /sys is already mounted on /sys
[FAILED]
Enabling /etc/fstab swaps: [ OK ]
INIT: Entering runlevel: 3
Entering non-interactive startup
HipServ startup:[ OK ]
Starting reset: [ OK ]
Starting seagate-lifecycle:[ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0:
Determining IP information for eth0... done.
/etc/init.d/iptables: line 42: /etc/sysconfig/networking/oe-profiles/default/ifcfg-eth0: No such file or directory
Flushing all current rules and user defined chains: [ OK ]
Clearing all current rules and user defined chains: [ OK ]
Applying iptables firewall rules:
[ OK ]
[ OK ]
check_igd.pl: no process killed
Starting igd-daemon:sh: /usr/sbin/oe-gateway-check: No such file or directory
sh: /usr/sbin/oe-gateway-check: No such file or directory
error reading information on service transmission.init: No such file or directory
[ OK ]
Starting system logger: [ OK ]
Starting kernel logger: [ OK ]
Starting locator:[ OK ]
Starting system message bus: [ OK ]
Starting sshd: [ OK ]
Starting cups: [ OK ]
Starting vsftpd for vsftpd: [ OK ]
Starting httpd: [ OK ]
Starting appserver: [ OK ]
Starting crond: [ OK ]
Starting Netatalk services:
Starting cnid_metad:[ OK ]
Starting afpd:[ OK ]
Starting SMB services: [ OK ]
Starting NMB services: [ OK ]
Starting OEone System Proxy: SPD starting....log level=1, uid=0
[ OK ]
Starting access-patrol:[ OK ]
Starting Avahi daemon... [ OK ]
Starting /usr/sbin/minidlna ...
Starting S99lld2: [ OK ]
0
Starting DAAP server: [ OK ]
Starting mynetworkd:[ OK ]
HipServ - Checking if RAID needs to be rebuilt
HipServ - No RAID found
HipServ - Bringing up iptables
HipServ - Updating date...
success
HipServ - Enabling swap
HipServ - Cleaning USB mountpoints
HipServ - Mounting USB devices
HipServ - Checking for FTPS certificate
HipServ - Found vsftpd key file
HipServ - Ensuring that table structures are up-to-date
HipServ - Starting usbreaderd: [ OK ]
HipServ - Checking for updates...
success
HipServ - boot complete
Starting spindownd.init: [ OK ]
Starting xMySyncMount.php: [FAILED]
axentraserver.localdomain login: root
Password:
Login incorrect
login: ~
[EOT]
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 01:58AM |
Registered: 7 years ago Posts: 337 |
Method 2 Through a serial connection using the Arch Linux ARM image: 1. Unpack the latest Arch Linux ARM armv5te files (from ArchLinuxARM-armv5te-latest.tar.gz) to a USB drive 2. Insert the USB drive into the device 3. Establish a serial connection with the device 4. Enter the UBoot environment by hitting a key when prompted with: CODE: SELECT ALL Hit any key to stop autoboot: 5. Set the architect number and mainlineLinux environment variables (if they are not already set): CODE: SELECT ALL NAS>> setenv arcNumber 3089 NAS>> setenv mainlineLinux yes NAS>> saveenv NAS>> reset NOTE: The mainlineLinux ?and arcNumber? settings are only checked when U-Boot first starts, so if you change their values you must reset the device. 6. After the reset, enter the UBoot environment and boot the Arch Linux ARM image by running the following commands: CODE: SELECT ALL NAS>> usb start NAS>> setenv bootargs console=ttyS0,115200 root=/dev/sda1 rootdelay=10 usb_rootfstype=ext2 mtdparts=orion_nand:1M(u-boot),4M(uImage),32M(rootfs),-(data) NAS>> ext2load usb 0:1 0x800000 /boot/uImage NAS>> bootm 0x800000
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 02:46AM |
Admin Registered: 13 years ago Posts: 19,204 |
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 02:50AM |
Admin Registered: 13 years ago Posts: 19,204 |
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 05:53AM |
Registered: 7 years ago Posts: 337 |
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 10:38AM |
Registered: 7 years ago Posts: 337 |
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 11:30AM |
Admin Registered: 13 years ago Posts: 19,204 |
Quote
At this point you should:
1. kwboot it using uboot.2017.07-tld-1.goflexhome.bodhi.tar. And while this u-boot running, boot the rootfs Debian-4.12.1-kirkwood-tld-1-rootfs-bodhi.tar.bz2
2. Inside the Debian rootfs, flash this uboot.2017.07-tld-1 image and its default env image.
Once you have this Debian rootfs running, and the new u-boot in NAND working, you can then proceed to play with booting FreeBSD (kwboot the version that has the bootelf and API).
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 12:16PM |
Registered: 7 years ago Posts: 337 |
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 01:20PM |
Admin Registered: 13 years ago Posts: 19,204 |
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 05:45PM |
Registered: 7 years ago Posts: 337 |
fatdev=usb 0:1
loaderdev=usb 0:1
bootfile=ubldr
fdtfile=db88f6281.dtb
kernel_addr_r=0x01000000
loadaddr=0x02000000
pxefile_addr_r=0x00100000
ramdisk_addr_r=0x02100000
scriptaddr=0x00000000
bootcmd=usb start;fdt addr 0x100;fatload ${fatdev} ${loadaddr} ${bootfile} && bootelf ${loadaddr}
setenv load_bsdenv 'usb start; load usb 0:1 0x810000 /boot/uEnv.txt; env import -t 0x810000 $filesize' setenv boot_bsd 'run load_bsdenv; boot' printenv run boot_bsd
Sending boot message. Please reboot the target.../
Sending boot image...
0 % [......................................................................]
1 % [......................................................................]
3 % [......................................................................]
5 % [......................................................................]
6 % [......................................................................]
8 % [......................................................................]
10 % [......................................................................]
11 % [......................................................................]
13 % [......................................................................]
15 % [......................................................................]
17 % [......................................................................]
18 % [......................................................................]
20 % [......................................................................]
22 % [......................................................................]
23 % [......................................................................]
25 % [......................................................................]
27 % [......................................................................]
29 % [......................................................................]
30 % [......................................................................]
32 % [......................................................................]
34 % [......................................................................]
35 % [......................................................................]
37 % [......................................................................]
39 % [......................................................................]
41 % [......................................................................]
42 % [......................................................................]
44 % [......................................................................]
46 % [......................................................................]
47 % [......................................................................]
49 % [......................................................................]
51 % [......................................................................]
53 % [......................................................................]
54 % [......................................................................]
56 % [......................................................................]
58 % [......................................................................]
59 % [......................................................................]
61 % [......................................................................]
63 % [......................................................................]
64 % [......................................................................]
66 % [......................................................................]
68 % [......................................................................]
70 % [......................................................................]
71 % [......................................................................]
73 % [......................................................................]
75 % [......................................................................]
76 % [......................................................................]
78 % [......................................................................]
80 % [......................................................................]
82 % [......................................................................]
83 % [......................................................................]
85 % [......................................................................]
87 % [......................................................................]
88 % [......................................................................]
90 % [......................................................................]
92 % [......................................................................]
94 % [......................................................................]
95 % [......................................................................]
97 % [......................................................................]
99 % [....................................]
[Type Ctrl-\ + c to quit]
U-Boot 2017.05-tld-2 (Jul 26 2017 - 02:37:42 -0700)
Seagate GoFlex Home
SoC: Kirkwood 88F6281_A1
DRAM: 128 MiB
WARNING: Caches not enabled
NAND: 256 MiB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
Net: egiga0
88E1116 Initialized on egiga0
Hit any key to stop autoboot: 0
GoFlexHome> setenv load_bsdenv 'usb start; load usb 0:1 0x810000 uenv.txt; env import -t 0x810000 $filesize'
GoFlexHome> setenv boot_bsd 'run load_bsdenv; boot'
GoFlexHome> printenv
api_address=7b12860
arcNumber=3338
baudrate=115200
boot_bsd=run load_bsdenv; boot
bootcmd=run bootcmd_uenv; run scan_disk; run set_bootargs; run bootcmd_exec; reset
bootcmd_exec=run load_uimage; if run load_initrd; then if run load_dtb; then bootm $load_uimage_addr $load_initrd_addr $load_dtb_addr; else bootm $load_uimage_addr $load_initrd_addr; fi; else if run load_dtb; then bootm $load_uimage_addr - $load_dtb_addr; else bootm$load_uimage_addr; fi; fi
bootcmd_uenv=run uenv_load; if test $uenv_loaded -eq 1; then run uenv_import; fi
bootdelay=10
bootdev=usb
console=console=ttyS0,115200
device=0:1
devices=usb ide
disks=0 1 2 3
dtb_file=/boot/dts/kirkwood-goflexhome.dtb
ethact=egiga0
ethaddr=52:3b:20:9c:11:51
if_netconsole=ping $serverip
ipaddr=192.168.0.231
led_error=orange blinking
led_exit=green off
led_init=green blinking
load_bsdenv=usb start; load usb 0:1 0x810000 uenv.txt; env import -t 0x810000 $filesize
load_dtb=echo loading DTB $dtb_file ...; load $bootdev $device $load_dtb_addr $dtb_file
load_dtb_addr=0x1c00000
load_initrd=echo loading uInitrd ...; load $bootdev $device $load_initrd_addr /boot/uInitrd
load_initrd_addr=0x1100000
load_uimage=echo loading uImage ...; load $bootdev $device $load_uimage_addr /boot/uImage
load_uimage_addr=0x800000
mainlineLinux=yes
mtdids=nand0=orion_nand
mtdparts=mtdparts=orion_nand:1M(u-boot),4M(uImage),32M(rootfs),-(data)
partition=nand0,2
preboot_nc=run if_netconsole start_netconsole
scan_disk=echo running scan_disk ...; scan_done=0; setenv scan_usb "usb start"; setenv scan_ide "ide reset"; setenv scan_mmc "mmc rescan"; for dev in $devices; do if test $scan_done -eq 0; then echo Scan device $dev; run scan_$dev; for disknum in $disks; do if test $scan_done -eq 0; then echo device $dev $disknum:1; if load $dev $disknum:1 $load_uimage_addr /boot/uImage 1; then scan_done=1; echo Found bootable drive on $dev $disknum; setenv device $disknum:1; setenv bootdev $dev; fi; fi; done; fi; done
serverip=192.168.0.220
set_bootargs=setenv bootargs console=ttyS0,115200 root=LABEL=rootfs rootdelay=10 $mtdparts $custom_params
start_netconsole=setenv ncip $serverip; setenv bootdelay 10; setenv stdin nc; setenv stdout nc; setenv stderr nc; version;
stderr=serial
stdin=serial
stdout=serial
uenv_addr=0x810000
uenv_import=echo importing envs ...; env import -t $uenv_addr $filesize
uenv_init_devices=setenv init_usb "usb start"; setenv init_ide "ide reset"; setenv init_mmc "mmc rescan"; for devtype in $devices; do run init_$devtype; done;
uenv_load=run uenv_init_devices; setenv uenv_loaded 0; for devtype in $devices; do for disknum in 0; do run uenv_read_disk; done; done;
uenv_read=echo loading envs from $devtype $disknum ...; if load $devtype $disknum:1 $uenv_addr /boot/uEnv.txt; then setenv uenv_loaded 1; fi
uenv_read_disk=if test $devtype -eq mmc; then if $devtype part; then run uenv_read; fi; else if $devtype part $disknum; then run uenv_read; fi; fi
usb_ready_retry=15
Environment size: 3043/131068 bytes
GoFlexHome> run boot_bsd
starting USB...
USB0: USB EHCI 1.00
scanning bus 0 for devices... 2 USB Device(s) found
scanning usb for storage devices...
Use USB retry period from the environment: 15 second(s)
1 Storage Device(s) found
reading uenv.txt
287 bytes read in 63 ms (3.9 KiB/s)
libfdt fdt_check_header(): FDT_ERR_BADMAGIC
reading ubldr
295973 bytes read in 90 ms (3.1 MiB/s)
CACHE: Misaligned operation at range [01000098, 01030c04]
CACHE: Misaligned operation at range [01030c04, 01031707]
CACHE: Misaligned operation at range [01031708, 010330f0]
CACHE: Misaligned operation at range [010330f0, 0103558b]
CACHE: Misaligned operation at range [01035590, 01036c98]
CACHE: Misaligned operation at range [01036c98, 01036cf4]
CACHE: Misaligned operation at range [01036cf4, 01036d5c]
CACHE: Misaligned operation at range [01036d5c, 01036e30]
CACHE: Misaligned operation at range [01036e30, 01036e3c]
## Starting application at 0x01000098 ...
Consoles: U-Boot console
Compatible U-Boot API signature found @0x7b12860
FreeBSD/arm U-Boot loader, Revision 1.2
(Thu Nov 30 14:06:37 GMT 2017 root@Test)
DRAM: 128MB
Number of U-Boot devices: 2
U-Boot env: loaderdev='usb 0:1'
Found U-Boot device: disk
Checking unit=0 slice=1 partition=<auto>... good.
Booting from disk0s1:
-
can't load 'kernel'
Type '?' for a list of commands, 'help' for more detailed help.
loader> ?
Available commands:
boot boot a file or loaded kernel
autoboot boot automatically after a delay
help detailed help
? list commands
show show variable(s)
set set a variable
unset unset a variable
echo echo arguments
read read input from the terminal
more show contents of a file
lsdev list all devices
include read commands from a file
ls list files
load load a kernel or module
load_geli load a geli key
unload unload all modules
lsmod list loaded modules
heap show heap usage
reboot reboot the system
devinfo show U-Boot devices
sysinfo show U-Boot system info
ubenv show or import U-Boot env vars
loader> reboot
|
Re: Hacking into a stock GoFlexHome unit January 31, 2018 10:52PM |
Admin Registered: 13 years ago Posts: 19,204 |