Zyxel NSA 325 / Power on after power failure

Hello,

does anyone please know how to configure automatic power on/off after power failure behavior of Zyxel NSA 325?

I cannot find any information about how to set this. My only idea now is to temporarily boot into stock and try to set it there to try if it persists. But I am not sure if booting stock is possible after u-boot upgrade.

Thanks for any ideas or hints,

Tomas

Tomas,

> does anyone please know how to configure automatic
> power on/off after power failure behavior of Zyxel
> NSA 325?

It cannot not be configured that way, since the Power button is needed to be pushed.

However, you can set up a WOL to be sent from another box in the network to wake it up.

etherwake xx:xx:xx:xx:xx:xx

where xx:xx:xx:xx:xx:xx is the MAC address of the NSA325.

For example, if you are located remotely from the NSA325 and cannot physically push the button, you can program another Linux box in the same network to send that etherwake command periodically using cron. It has no effect if the box is running. But if the box is powered down, then it would be woken up.

That would be just an example. You could be more sophisticate about it: sending etherwake only when it failed to respond to mutilple pings,...

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hello Bodhi,

thanks for the suggestion but this is not what I am looking for (altough it is a nice alternative).

I am convinced the device is capable of this because the manual NSA325_V4.70 Ed4.pdf explicitly mentions that on page 326 and 327:

Quote

Power On After Power Failure
Select an option to set whether or not the NSA restarts when the power is restored after a power failure.
Note: This feature is not supported on NSA310.

Keep Former
Status Select this option to have the NSA automatically restart only if it was operating when the
power failed. The NSA remains off if it was already off when the power failed.

AlwaysPower On
Select this option to keep the NSA operating as much of the time as possible. The NSA restarts automatically even if it was turned off when the power failed.

Always Power Off
Select this option to keep the NSA from automatically restarting when the power is
restored after a power failure. This is a computer’s “traditional” behavior. Select this if you
have other servers such as a domain controller or DNS server that you want to start or
check after a power failure before the NSA turns on.

Tomas

I have no idea what part of device might be responsible for such feature and how to configure it. uboot maybe?

(This is why placed the question in this part of forum.)

Tomas

Tomas,

I see. That is only available inside stock OS. And the way this box behaves, my guess is that it follows the same design that this is controlled with i2c, like with its fan and temperature.

So what we can do is to search stock rootfs for where that script is executed. Now if you've already installed new u-boot, you cannot boot back to stock easily. There is couple different methods:

1. Not booting directly, but only mount the NAND rootfs while running Debian. And you need to be careful not to mount it R/W, and only mount it as Read-Only.

OR,

2. UART booting (kwboot through serial console) the stock u-boot (mtd0) and that most likely will boot into stock OS (the stock envs were untouched when you installed new u-boot). This is not something permanent, each time you want to boot stock, you would have to kwboot it.

UPDATE: forget that option 2! you have already installed OpenWrt, thus wiped out stock :)

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 11/10/2019 07:07PM by bodhi.

Bodhi,

is there a way to unpack/mount the stock firmware 481AALS1C0.bin on my computer to search for the script that might be configuring "Power on after power failure"?

Tomas

Tomas,


> is there a way to unpack/mount the stock firmware
> 481AALS1C0.bin on my computer to search for the
> script that might be configuring "Power on after
> power failure"?

I have never tried that, so don't know what is in that file!

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I thought that you might have some experience with the original firmware formats :)

https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01820&md=NSA325%20v2

Tomas

Tomas,

I've have not looked inside stock FW at all, other than booting to stock it a couple times to get serial console log!

Zyxel is a very good vendor, they provide GPL quicky when you ask and also give them the serial number for the box. That's all I need to hack this box :)

But I will download this FW and see if I can find anything,

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thank you very much. I will try to investigate it myself, but I am total newbie to this.

$ binwalk 481AALS1C0.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
318           0x13E           uImage header, header size: 64 bytes, header CRC: 0xF3523079, created: 2017-06-23 03:04:04, image size: 5796104 bytes, Data Address: 0x8000, Entry Point: 0x8000, data CRC: 0xDC64AECE, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.31.8"
382           0x17E           Linux kernel ARM boot executable zImage (little-endian)
13366         0x3436          gzip compressed data, maximum compression, from Unix, last modified: 2017-06-23 03:04:03
5796486       0x587286        gzip compressed data, maximum compression, from Unix, last modified: 2017-06-23 03:04:19
35091415      0x21773D7       EBML file
36932394      0x2338B2A       MySQL ISAM compressed data file Version 11
40849173      0x26F4F15       Cisco IOS experimental microcode, for ""
50181426      0x2FDB532       Executable script, shebang: "/bin/sh"
50181973      0x2FDB755       Unix path: /usr/bin/ipkg-cl -f /etc/zyxel/zy-pkg.conf -t /usr/local/zy-pkgs/tmp list | egrep "(pkgName:)|(status:)" > ${INSTALLED_PKGS}
50183150      0x2FDBBEE       Unix path: /usr/bin/ipkg-cl -f /etc/zyxel/zy-pkg.conf -t /usr/local/zy-pkgs/tmp -recursive remove ${pkgsInstalled}
50183493      0x2FDBD45       Unix path: /usr/bin/ipkg-cl -f /etc/zyxel/zy-pkg.conf -t /usr/local/zy-pkgs/tmp list | egrep "(pkgName:)|(status:)"
50183749      0x2FDBE45       Unix path: /usr/local/zy-pkgs/lib/libssl.*
50183839      0x2FDBE9F       Executable script, shebang: "/bin/sh"
50183903      0x2FDBEDF       Unix path: /etc/zyxel/storage/webdisk.db ]; then
50183956      0x2FDBF14       Unix path: /etc/zyxel/storage/webdisk.db 'update webdisk set upload_bandwidth=250'" > /dev/console
50184053      0x2FDBF75       Unix path: /etc/zyxel/storage/webdisk.db 'update webdisk set upload_bandwidth=250'
50184134      0x2FDBFC6       Unix path: /etc/zyxel/storage/webdisk.db .d > /dev/console 2>&1

Does this help?



Edited 1 time(s). Last edit at 11/11/2019 05:13AM by safarik.

I found this article how to extract data from Zyxel firmware and I am trying to follow it.

https://www.pentestpartners.com/security-blog/using-hexdump-analysis-for-firmware-extraction-a-how-to/

But so far I am not successfull as I do not undestand how to count the lenght of data to extract by dd.

OK, I was able to extract both zImage and filesystem following the article.

$ dd if=481AALS1C0.bin skip=318 count=5796168 bs=1 of=uimage.bin
$ dd if=481AALS1C0.bin skip=5796486 count=44384940 bs=1 of=filesystem.bin

So I am going to search if I can find what sets this. Any idea what I am looking for? :)



Edited 2 time(s). Last edit at 11/11/2019 03:59PM by safarik.

In etc/init.d/rcS2 I found:

###### set auto power-on
if [ -e /etc/zyxel/storage/pwron.status ]; then
	pwrmode=`cat /etc/zyxel/storage/pwron.status`
	zyshclient -p 150 -e "pwron ${pwrmode}"
else
	zyshclient -p 150 -e "pwron former"
fi

What is zyshclient?

UPDATE: Some binary in sbin/

Any idea what it does or how to find what it does?

UPDATE:

$ strings zyshclient | grep pwron
pwron
zysh_pwron_status
zysh_pwron_set



Edited 2 time(s). Last edit at 11/11/2019 04:07PM by safarik.

bodhi,

when I have both zImage and filesystem do you think it would be somehow possile to temporary run it on the device to be able to execute the "zyshclient" utility to set the Power on ?

Thanks,

Tomas

Tomas,

> when I have both zImage and filesystem do you
> think it would be somehow possile to temporary run
> it on the device to be able to execute the
> "zyshclient" utility to set the Power on ?

Have you tried to look at zyshclient in a text editor? sometime it is a script but without file name extension.

The stock kernel is old (2.6.x). If that zyshclient was compiled as a static binary, then you can run it in a modern kernel, but if it was a normal binary that loads shared library then you cannot.

But it's worth a try, copy it to OpenWrt and run it

./zyshclient -p 150 -e "pwron former"

And to check and see if it is static:

ldd zyshclient

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 11/11/2019 05:34PM by bodhi.

Bodhi,

yes I checked it and it is dynamically linked binary:

$ file zyshclient
zyshclient: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 2.6.16, stripped

I have two ideas:

1) dissasemble - but do not have enough knowledge and tools to do it

2) run it in the original evironment - do you know if I could be able too boot the zImage with the filesystem from USB on the NSA325?

Thanks,

Tomas

After some looking around it seems to me that zyshclient is used for communicating with zyshd that actualy does the work. Looking into zyshd I can see:

\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/etc/zyxel/storage/pwron.status\x00\x01\x02LIST;\x03\x0a\x00\x00\x00status: %s\x0a\x00\x04\x0a\x00\x00status: former\x0a\x00former\x00\x00Disable Auto Power-On Setting: %s\x00\x00\x00FAILED\x00\x00Modify Auto Power-On Setting: %s\x00\x00\x00\x00SUCCESS\x00always\x00\x00pwron_enable\x00\x00\x00\x00/sbin/i2cdetect -y 0 | grep 68\x00\x00r\x00\x00\x0068\x00\x00%s -y 0x0 0x0a 0x0a %s07 w\x00\x00/sbin/i2cset\x00\x00\x00\x000x01\x00\x00\x00\x00%s -y 0x0 0x50 0x7 %s b\x00%s(%d):%s\x00\x00\x00%s -y 0x0 0x0a 0x0b 0x07 b\x00\x00%s -y 0x0 0x0a 0x0b b\x00\x00\x00/sbin/i2cget\x00\x00\x00\x00%s -y 0x0 0x50 0x7 b\x00\x00\x00\x00%s(%d):failed\x00\x00\x00pwron_disable\x00\x00\x000x00

So they might be setting this using i2cset after all?

I still welcome any suggestions or tips :)

Thanks,

Tomas

Tomas,

> So they might be setting this using i2cset after
> all?
>

Most likely!

Now let's reformat that string in a readable format.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I will install i2c-tools on my current openwrt installation tomorrow and try these command directly.

Definitely will let you know the results.

Tomas

Tomas,

It is probably similar to this:

/usr/sbin/i2cset -y 0x0 0x0a 0x0a 0x0007 w

But please do this at your own risk :)

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 11/12/2019 07:10PM by bodhi.

bodhi,

can you please explain me how did come to this command?

Thanks,

Tomas

Is it known what I2C chip are there on NSA325 and what they do?

0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- 0a -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: 50 UU -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- 64 -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --

Tomas,

The NAS326 set WOL command looks like this:

/usr/sbin/i2cset -y 0x0 0xa 0xa 0x0006 w

If you look at the string for NSA325 above closely, it contains the command parameter:

-y 0x0 0x0a 0x0a 0x0007 w

That's the only part that has w at the end. So my guess is the code 0x0007.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 11/13/2019 11:33PM by bodhi.

I see... unfortunatelly

i2cset -y 0x0 0x0a 0x0a 0x0007 w

did not change the Power on behavior.

But I also see setting values to both chips on address 0x0a and 0x50.

I do not know if it is save to randomly trying to set some values in the chips...

Tomas

Tomas,

I can not recommend :) you will have to decide if you are comfortable doing that.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I got it working!

TL;DR : The magic is this:

# i2cset -y 0x0 0x50 0x7 0x01 b

After setting this the device alwas powers on after cable reconnecting no matter if it was on of or before. Exactly as I wanted!

Before the value was 0x00

# i2cget -y 0x0 0x50 0x7 b
0x00

And now it is 0x01

# i2cget -y 0x0 0x50 0x7 b
0x01

I guessed it from folowwing code that I disassembled from zyshd fromthe original firmware using https://cutter.re/

;-- aav.0x001a4734:
0x001a4734          .string "sbin_i2cset" ; len=12
0x001a4740      andeq   r0, r0, r0
;-- aav.0x001a4744:
0x001a4744          .string "0x01" ; len=4
0x001a4748      andeq   r0, r0, r0
;-- "%s -y 0x0 0x50 0x7 %s b":
0x001a474c          .string "s__y_0x0_0x50_0x7__s_b" ; len=23
0x001a4763      unaligned
;-- aav.0x001a4764:

Bodhi, thank you very much for your support and for this forum :) I wouldn't probably solve it without it.

Tomas

Tomas,

Good works!

I'm collecting Zyxel NAS hacks and will add it to the Wiki.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Thanks for the info about cutter.re to inspect the binary from stock firmware. I'll give that a try to see if I can find out more about fan control.

Koen

Hello Koen,

I took a quick search but did not find anything about fans there.

And from what Mijzelf wrote here https://forum.openwrt.org/t/zyxel-nsa325-power-on-after-power-failure/48176/6 it seems there is no fan control at all.

Why do you even want to control the fan do you have some problem with them?

Tomas

Tomas,

For me, It's always nice to be able to control the fan speed. Noise is a problem with Zyxel boxes because stock fan is too small.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)