Zyxel NSA 325 / Power on after power failure
November 10, 2019 02:26AM
Hello,

does anyone please know how to configure automatic power on/off after power failure behavior of Zyxel NSA 325?

I cannot find any information about how to set this. My only idea now is to temporarily boot into stock and try to set it there to try if it persists. But I am not sure if booting stock is possible after u-boot upgrade.

Thanks for any ideas or hints,

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 10, 2019 04:51AM
Tomas,

> does anyone please know how to configure automatic
> power on/off after power failure behavior of Zyxel
> NSA 325?

It cannot not be configured that way, since the Power button is needed to be pushed.

However, you can set up a WOL to be sent from another box in the network to wake it up.

etherwake xx:xx:xx:xx:xx:xx
where xx:xx:xx:xx:xx:xx is the MAC address of the NSA325.

For example, if you are located remotely from the NSA325 and cannot physically push the button, you can program another Linux box in the same network to send that etherwake command periodically using cron. It has no effect if the box is running. But if the box is powered down, then it would be woken up.

That would be just an example. You could be more sophisticate about it: sending etherwake only when it failed to respond to mutilple pings,...

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Zyxel NSA 325 / Power on after power failure
November 10, 2019 06:30AM
Hello Bodhi,

thanks for the suggestion but this is not what I am looking for (altough it is a nice alternative).

I am convinced the device is capable of this because the manual NSA325_V4.70 Ed4.pdf explicitly mentions that on page 326 and 327:


Quote

Power On After Power Failure
Select an option to set whether or not the NSA restarts when the power is restored after a power failure.
Note: This feature is not supported on NSA310.

Keep Former
Status Select this option to have the NSA automatically restart only if it was operating when the
power failed. The NSA remains off if it was already off when the power failed.

AlwaysPower On
Select this option to keep the NSA operating as much of the time as possible. The NSA restarts automatically even if it was turned off when the power failed.

Always Power Off
Select this option to keep the NSA from automatically restarting when the power is
restored after a power failure. This is a computer’s “traditional” behavior. Select this if you
have other servers such as a domain controller or DNS server that you want to start or
check after a power failure before the NSA turns on.

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 10, 2019 06:43AM
I have no idea what part of device might be responsible for such feature and how to configure it. uboot maybe?

(This is why placed the question in this part of forum.)

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 10, 2019 05:19PM
Tomas,

I see. That is only available inside stock OS. And the way this box behaves, my guess is that it follows the same design that this is controlled with i2c, like with its fan and temperature.

So what we can do is to search stock rootfs for where that script is executed. Now if you've already installed new u-boot, you cannot boot back to stock easily. There is couple different methods:

1. Not booting directly, but only mount the NAND rootfs while running Debian. And you need to be careful not to mount it R/W, and only mount it as Read-Only.

OR,

2. UART booting (kwboot through serial console) the stock u-boot (mtd0) and that most likely will boot into stock OS (the stock envs were untouched when you installed new u-boot). This is not something permanent, each time you want to boot stock, you would have to kwboot it.

UPDATE: forget that option 2! you have already installed OpenWrt, thus wiped out stock :)

-bodhi
===========================
Forum Wiki
bodhi's corner



Edited 1 time(s). Last edit at 11/10/2019 07:07PM by bodhi.
Re: Zyxel NSA 325 / Power on after power failure
November 10, 2019 11:48PM
Bodhi,

is there a way to unpack/mount the stock firmware 481AALS1C0.bin on my computer to search for the script that might be configuring "Power on after power failure"?

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 03:56AM
Tomas,


> is there a way to unpack/mount the stock firmware
> 481AALS1C0.bin on my computer to search for the
> script that might be configuring "Power on after
> power failure"?

I have never tried that, so don't know what is in that file!

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 03:57AM
I thought that you might have some experience with the original firmware formats :)

https://www.zyxel.com/support/SupportLandingSR.shtml?c=gb&l=en&kbid=M-01820&md=NSA325%20v2

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 04:08AM
Tomas,

I've have not looked inside stock FW at all, other than booting to stock it a couple times to get serial console log!

Zyxel is a very good vendor, they provide GPL quicky when you ask and also give them the serial number for the box. That's all I need to hack this box :)

But I will download this FW and see if I can find anything,

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 05:00AM
Thank you very much. I will try to investigate it myself, but I am total newbie to this.

$ binwalk 481AALS1C0.bin 

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
318           0x13E           uImage header, header size: 64 bytes, header CRC: 0xF3523079, created: 2017-06-23 03:04:04, image size: 5796104 bytes, Data Address: 0x8000, Entry Point: 0x8000, data CRC: 0xDC64AECE, OS: Linux, CPU: ARM, image type: OS Kernel Image, compression type: none, image name: "Linux-2.6.31.8"
382           0x17E           Linux kernel ARM boot executable zImage (little-endian)
13366         0x3436          gzip compressed data, maximum compression, from Unix, last modified: 2017-06-23 03:04:03
5796486       0x587286        gzip compressed data, maximum compression, from Unix, last modified: 2017-06-23 03:04:19
35091415      0x21773D7       EBML file
36932394      0x2338B2A       MySQL ISAM compressed data file Version 11
40849173      0x26F4F15       Cisco IOS experimental microcode, for ""
50181426      0x2FDB532       Executable script, shebang: "/bin/sh"
50181973      0x2FDB755       Unix path: /usr/bin/ipkg-cl -f /etc/zyxel/zy-pkg.conf -t /usr/local/zy-pkgs/tmp list | egrep "(pkgName:)|(status:)" > ${INSTALLED_PKGS}
50183150      0x2FDBBEE       Unix path: /usr/bin/ipkg-cl -f /etc/zyxel/zy-pkg.conf -t /usr/local/zy-pkgs/tmp -recursive remove ${pkgsInstalled}
50183493      0x2FDBD45       Unix path: /usr/bin/ipkg-cl -f /etc/zyxel/zy-pkg.conf -t /usr/local/zy-pkgs/tmp list | egrep "(pkgName:)|(status:)"
50183749      0x2FDBE45       Unix path: /usr/local/zy-pkgs/lib/libssl.*
50183839      0x2FDBE9F       Executable script, shebang: "/bin/sh"
50183903      0x2FDBEDF       Unix path: /etc/zyxel/storage/webdisk.db ]; then
50183956      0x2FDBF14       Unix path: /etc/zyxel/storage/webdisk.db 'update webdisk set upload_bandwidth=250'" > /dev/console
50184053      0x2FDBF75       Unix path: /etc/zyxel/storage/webdisk.db 'update webdisk set upload_bandwidth=250'
50184134      0x2FDBFC6       Unix path: /etc/zyxel/storage/webdisk.db .d > /dev/console 2>&1

Does this help?



Edited 1 time(s). Last edit at 11/11/2019 05:13AM by safarik.
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 02:49PM
I found this article how to extract data from Zyxel firmware and I am trying to follow it.

https://www.pentestpartners.com/security-blog/using-hexdump-analysis-for-firmware-extraction-a-how-to/

But so far I am not successfull as I do not undestand how to count the lenght of data to extract by dd.
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 03:46PM
OK, I was able to extract both zImage and filesystem following the article.

$ dd if=481AALS1C0.bin skip=318 count=5796168 bs=1 of=uimage.bin
$ dd if=481AALS1C0.bin skip=5796486 count=44384940 bs=1 of=filesystem.bin


So I am going to search if I can find what sets this. Any idea what I am looking for? :)



Edited 2 time(s). Last edit at 11/11/2019 03:59PM by safarik.
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 03:53PM
In etc/init.d/rcS2 I found:

###### set auto power-on
if [ -e /etc/zyxel/storage/pwron.status ]; then
	pwrmode=`cat /etc/zyxel/storage/pwron.status`
	zyshclient -p 150 -e "pwron ${pwrmode}"
else
	zyshclient -p 150 -e "pwron former"
fi

What is zyshclient?

UPDATE: Some binary in sbin/

Any idea what it does or how to find what it does?

UPDATE:

$ strings zyshclient | grep pwron
pwron
zysh_pwron_status
zysh_pwron_set



Edited 2 time(s). Last edit at 11/11/2019 04:07PM by safarik.
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 04:09PM
bodhi,

when I have both zImage and filesystem do you think it would be somehow possile to temporary run it on the device to be able to execute the "zyshclient" utility to set the Power on ?

Thanks,

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 11, 2019 05:30PM
Tomas,

> when I have both zImage and filesystem do you
> think it would be somehow possile to temporary run
> it on the device to be able to execute the
> "zyshclient" utility to set the Power on ?

Have you tried to look at zyshclient in a text editor? sometime it is a script but without file name extension.

The stock kernel is old (2.6.x). If that zyshclient was compiled as a static binary, then you can run it in a modern kernel, but if it was a normal binary that loads shared library then you cannot.

But it's worth a try, copy it to OpenWrt and run it

./zyshclient -p 150 -e "pwron former"

And to check and see if it is static:

ldd zyshclient

-bodhi
===========================
Forum Wiki
bodhi's corner



Edited 1 time(s). Last edit at 11/11/2019 05:34PM by bodhi.
Re: Zyxel NSA 325 / Power on after power failure
November 12, 2019 12:58AM
Bodhi,

yes I checked it and it is dynamically linked binary:

$ file zyshclient
zyshclient: ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.3, for GNU/Linux 2.6.16, stripped

I have two ideas:

1) dissasemble - but do not have enough knowledge and tools to do it

2) run it in the original evironment - do you know if I could be able too boot the zImage with the filesystem from USB on the NSA325?

Thanks,

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 12, 2019 04:34PM
After some looking around it seems to me that zyshclient is used for communicating with zyshd that actualy does the work. Looking into zyshd I can see:

\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/etc/zyxel/storage/pwron.status\x00\x01\x02LIST;\x03\x0a\x00\x00\x00status: %s\x0a\x00\x04\x0a\x00\x00status: former\x0a\x00former\x00\x00Disable Auto Power-On Setting: %s\x00\x00\x00FAILED\x00\x00Modify Auto Power-On Setting: %s\x00\x00\x00\x00SUCCESS\x00always\x00\x00pwron_enable\x00\x00\x00\x00/sbin/i2cdetect -y 0 | grep 68\x00\x00r\x00\x00\x0068\x00\x00%s -y 0x0 0x0a 0x0a %s07 w\x00\x00/sbin/i2cset\x00\x00\x00\x000x01\x00\x00\x00\x00%s -y 0x0 0x50 0x7 %s b\x00%s(%d):%s\x00\x00\x00%s -y 0x0 0x0a 0x0b 0x07 b\x00\x00%s -y 0x0 0x0a 0x0b b\x00\x00\x00/sbin/i2cget\x00\x00\x00\x00%s -y 0x0 0x50 0x7 b\x00\x00\x00\x00%s(%d):failed\x00\x00\x00pwron_disable\x00\x00\x000x00

So they might be setting this using i2cset after all?

I still welcome any suggestions or tips :)

Thanks,

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 12, 2019 04:46PM
Tomas,

> So they might be setting this using i2cset after
> all?
>

Most likely!

Now let's reformat that string in a readable format.

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Zyxel NSA 325 / Power on after power failure
November 12, 2019 04:51PM
I will install i2c-tools on my current openwrt installation tomorrow and try these command directly.

Definitely will let you know the results.

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 12, 2019 07:10PM
Tomas,

It is probably similar to this:

/usr/sbin/i2cset -y 0x0 0x0a 0x0a 0x0007 w

But please do this at your own risk :)

-bodhi
===========================
Forum Wiki
bodhi's corner



Edited 1 time(s). Last edit at 11/12/2019 07:10PM by bodhi.
Re: Zyxel NSA 325 / Power on after power failure
November 13, 2019 02:27PM
bodhi,

can you please explain me how did come to this command?

Thanks,

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 13, 2019 02:41PM
Is it known what I2C chip are there on NSA325 and what they do?

0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
00:          -- -- -- -- -- -- -- 0a -- -- -- -- -- 
10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
20: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
40: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
50: 50 UU -- -- -- -- -- -- -- -- -- -- -- -- -- -- 
60: -- -- -- -- 64 -- -- -- -- -- -- -- -- -- -- -- 
70: -- -- -- -- -- -- -- --
Re: Zyxel NSA 325 / Power on after power failure
November 13, 2019 07:23PM
Tomas,

The NAS326 set WOL command looks like this:

/usr/sbin/i2cset -y 0x0 0xa 0xa 0x0006 w

If you look at the string for NSA325 above closely, it contains the command parameter:

-y 0x0 0x0a 0x0a 0x0007 w

That's the only part that has w at the end. So my guess is the code 0x0007.

-bodhi
===========================
Forum Wiki
bodhi's corner



Edited 1 time(s). Last edit at 11/13/2019 11:33PM by bodhi.
Re: Zyxel NSA 325 / Power on after power failure
November 14, 2019 12:21AM
I see... unfortunatelly

i2cset -y 0x0 0x0a 0x0a 0x0007 w

did not change the Power on behavior.

But I also see setting values to both chips on address 0x0a and 0x50.

I do not know if it is save to randomly trying to set some values in the chips...

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 14, 2019 07:50PM
Tomas,

I can not recommend :) you will have to decide if you are comfortable doing that.

-bodhi
===========================
Forum Wiki
bodhi's corner
[SOLVED] Zyxel NSA 325 / Power on after power failure
November 15, 2019 02:35PM
I got it working!

TL;DR : The magic is this:

# i2cset -y 0x0 0x50 0x7 0x01 b

After setting this the device alwas powers on after cable reconnecting no matter if it was on of or before. Exactly as I wanted!

Before the value was 0x00

# i2cget -y 0x0 0x50 0x7 b
0x00


And now it is 0x01

# i2cget -y 0x0 0x50 0x7 b
0x01


I guessed it from folowwing code that I disassembled from zyshd fromthe original firmware using https://cutter.re/

;-- aav.0x001a4734:
0x001a4734          .string "sbin_i2cset" ; len=12
0x001a4740      andeq   r0, r0, r0
;-- aav.0x001a4744:
0x001a4744          .string "0x01" ; len=4
0x001a4748      andeq   r0, r0, r0
;-- "%s -y 0x0 0x50 0x7 %s b":
0x001a474c          .string "s__y_0x0_0x50_0x7__s_b" ; len=23
0x001a4763      unaligned
;-- aav.0x001a4764:

Bodhi, thank you very much for your support and for this forum :) I wouldn't probably solve it without it.

Tomas
Re: [SOLVED] Zyxel NSA 325 / Power on after power failure
November 15, 2019 05:33PM
Tomas,

Good works!

I'm collecting Zyxel NAS hacks and will add it to the Wiki.

-bodhi
===========================
Forum Wiki
bodhi's corner
Re: Zyxel NSA 325 / Power on after power failure
November 15, 2019 06:21PM
Thanks for the info about cutter.re to inspect the binary from stock firmware. I'll give that a try to see if I can find out more about fan control.

Koen
Re: Zyxel NSA 325 / Power on after power failure
November 16, 2019 03:26PM
Hello Koen,

I took a quick search but did not find anything about fans there.

And from what Mijzelf wrote here https://forum.openwrt.org/t/zyxel-nsa325-power-on-after-power-failure/48176/6 it seems there is no fan control at all.

Why do you even want to control the fan do you have some problem with them?

Tomas
Re: Zyxel NSA 325 / Power on after power failure
November 16, 2019 05:33PM
Tomas,

For me, It's always nice to be able to control the fan speed. Noise is a problem with Zyxel boxes because stock fan is too small.

-bodhi
===========================
Forum Wiki
bodhi's corner
Author:

Your Email:


Subject:


Spam prevention:
Please, enter the code that you see below in the input field. This is for blocking bots that try to post this form automatically. If the code is hard to read, then just try to guess it right. If you enter the wrong code, a new image is created and you get another chance to enter it right.
Message: