NSA325 - Restore to stock firmware

Hello dear community members,

Using various tutorials (https://openwrt.org/toh/zyxel/nsa325) I successfully flashed the new uBoot and the latest OpenWRT on my Zyxel NSA325, but after some playing around I'd like to return to stock firmware because I'll be giving it away.

Could anyone please help me out as I am clueless, and no I unfortunately did not backup anything before flashing....

Thank you,

Dan

Hello guys, anyone could help me out please, my initial request got no reply.

I desperately tried to re-install OpenWRT just to be able to use the NSA325 since no stock FW...

The problem is I can't load the image with anything at this point, tried every possible combination of TFTP, nothing, USB dosen't recognize any storage device, tried different models and sized with a small FAT partition but nothing.

Thanks!

Dan Folea,

Do you have serial console? If you do,

Power up, interrupt serial console at count down and

ver
printenv

And post the entire serial console log here.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hello Bodhi,

Thanks for your reply.

Yes I do have console from the pins on the motherboard, all the things I specified in my last reply like attempted USB/TFTP to load firmware was done through serial console.

Here are the infos from the commands:

NSA325> ver
U-Boot 2019.01 (Jan 29 2020 - 16:05:35 +0000)
ZyXEL NSA325 2-Bay Power Media Server

arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 7.5.0 r10911-c155900f66) 7.5.0
GNU ld (GNU Binutils) 2.31.1

NSA325> printenv
baudrate=115200
bootargs=console=ttyS0,115200 mtdparts=orion_nand:0x0c0000(uboot),0x80000(uboot_env),0x7ec0000(ubi)
bootcmd=setenv bootargs ${console} ${mtdparts} ${bootargs_root}; ubi part root; ubifsmount ubi:rootfs; run ubifinish1
bootdelay=3
console=console=ttyS0,115200
ethact=egiga0
ethaddr=FC:F5:28:31:3D:49
ipaddr=10.0.0.50
mtdids=nand0=orion_nand
mtdparts=mtdparts=orion_nand:0x0c0000(uboot),0x80000(uboot_env),0x7ec0000(ubi)
serverip=10.0.0.211
stderr=serial
stdin=serial
stdout=serial
ubifinish1=ubifsload 0x800000 ${kernel}; ubifsload 0x700000 ${fdt}; ubifsumount; run ubifinish2
ubifinish2=fdt addr 0x700000; fdt resize; fdt chosen; bootz 0x800000 - 0x700000

Environment size: 673/131068 bytes

Thank you,

Dan

Hi Dan,

It looks good. Now if you can boot into OpenWrt then you can restore the NAND mtds partition to a stock backup.

Let me know if you can login to OpenWrt and then we'll find that stock mtds backup. Perhaps some forum members have this back up.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

That is my problem,

OpenWRT is not there anymore, there's nothing to boot from as you can see below:

NSA325> boot
Partition root not found!
UBIFS error (pid: 1): cannot open "ubi:rootfs", error -19
Error reading superblock on volume 'ubi:rootfs' errno=-19!
ubifsmount - mount UBIFS volume

Usage:
ubifsmount <volume-name>
    - mount 'volume-name' volume
UBIFS not mounted, use ubifs mount to mount volume first!
ubifsload - load file from an UBIFS filesystem

Usage:
ubifsload <addr> <filename> [bytes]
    - load file 'filename' to address 'addr'
UBIFS not mounted, use ubifs mount to mount volume first!
ubifsload - load file from an UBIFS filesystem

Usage:
ubifsload <addr> <filename> [bytes]
    - load file 'filename' to address 'addr'
libfdt fdt_check_header(): FDT_ERR_BADMAGIC
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
Unknown command 'bootz' - try 'help'

Thanks,

Dan

Dan,

Power up, interrupt serial console and

setenv partition 'nand0,2'
mtdparts
boot

And post the entire serial console log here.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

I don't even have to interrupt the boot because it just goes straight into uBoot.

Your help & troubleshooting is very much appreciated!

Here is the console:

NSA325> mtdparts

device nand0 <orion_nand>, # parts = 3
 #: name                size            offset          mask_flags
 0: uboot               0x000c0000      0x00000000      0
 1: uboot_env           0x00080000      0x000c0000      0
 2: ubi                 0x07ec0000      0x00140000      0

active partition: nand0,2 - (ubi) 0x07ec0000 @ 0x00140000

defaults:
mtdids  :
mtdparts: mtdparts=orion_nand:0x0c0000(uboot),0x80000(uboot_env),0x7ec0000(ubi)
NSA325> boot
Partition root not found!
UBIFS error (pid: 1): cannot open "ubi:rootfs", error -19
Error reading superblock on volume 'ubi:rootfs' errno=-19!
ubifsmount - mount UBIFS volume

Usage:
ubifsmount <volume-name>
    - mount 'volume-name' volume
UBIFS not mounted, use ubifs mount to mount volume first!
ubifsload - load file from an UBIFS filesystem

Usage:
ubifsload <addr> <filename> [bytes]
    - load file 'filename' to address 'addr'
UBIFS not mounted, use ubifs mount to mount volume first!
ubifsload - load file from an UBIFS filesystem

Usage:
ubifsload <addr> <filename> [bytes]
    - load file 'filename' to address 'addr'
libfdt fdt_check_header(): FDT_ERR_BADMAGIC
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
Unknown command 'bootz' - try 'help'

Dan,

I spoke prematurely before!

The current envs settings is for OpenWrt u-boot-2019. But somehow it was set incorrectly. I am not familiar with OpenWrt new installation. However, I can tell that the envs are wrong.

Without seeing the OpenWrt installation script, I would say that:

Because

Quote

NSA325> mtdparts

device nand0 <orion_nand>, # parts = 3
#: name size offset mask_flags
0: uboot 0x000c0000 0x00000000 0
1: uboot_env 0x00080000 0x000c0000 0
2: ubi 0x07ec0000 0x00140000 0

This command is wrong:

bootcmd=setenv bootargs ${console} ${mtdparts} ${bootargs_root}; ubi part root; ubifsmount ubi:rootfs; run ubifinish1

So, rootfs is the volume inside partition ubi.

Try

setenv bootcmd 'setenv bootargs ${console} ${mtdparts} ${bootargs_root}; ubi part ubi; ubifsmount ubi:rootfs; run ubifinish1'
boot

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hey Bodhi,

I have ran your command and then boot, this is the result:

NSA325> setenv bootcmd 'setenv bootargs ${console} ${mtdparts} ${bootargs_root}; ubi part ubi; ubifsmount ubi:rootfs; run ubifinish1'
NSA325> boot
ubi0: attaching mtd3
ubi0: scanning is finished
ubi0: attached mtd3 (name "ubi", size 126 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 129024 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 512
ubi0: VID header offset: 512 (aligned 512), data offset: 2048
ubi0: good PEBs: 1010, bad PEBs: 4, corrupted PEBs: 0
ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 1062167026
ubi0: available PEBs: 990, total reserved PEBs: 20, PEBs reserved for bad PEB handling: 16
UBIFS error (pid: 1): cannot open "ubi:rootfs", error -19
Error reading superblock on volume 'ubi:rootfs' errno=-19!
ubifsmount - mount UBIFS volume

Usage:
ubifsmount <volume-name>
    - mount 'volume-name' volume
UBIFS not mounted, use ubifs mount to mount volume first!
ubifsload - load file from an UBIFS filesystem

Usage:
ubifsload <addr> <filename> [bytes]
    - load file 'filename' to address 'addr'
UBIFS not mounted, use ubifs mount to mount volume first!
ubifsload - load file from an UBIFS filesystem

Usage:
ubifsload <addr> <filename> [bytes]
    - load file 'filename' to address 'addr'
libfdt fdt_check_header(): FDT_ERR_BADMAGIC
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
Unknown command 'bootz' - try 'help'

It should be relatively easy to load the OpenWrt image into ram and boot the nas. You can then do a 'sysupgrade' to install it in the onboard nand flash. Loading the image in ram can be done either via tftp or an usb drive depending on the available commands in uboot. So can you type 'help' or '?' at the uboot prompt to show what commands are available?

Dan,

The OpenWrt image on NAND was corrupted.

You have 3 choices:

1. So like Koen said above you can load OpenWrt image and boot.
2. Or you can attempt to boot Debian on USB
3. You can flash the back mtds to go back to stock.

Since this u-boot is set up to boot OpenWrt, option 1 is quickest. See this thread:

https://forum.doozan.com/read.php?4,42279

3. Run the following code for starting the process: 
# @bootloader run LEDE from usb pendrive
usb reset; fatload usb 0 0x800000 lede-kirkwood-pogo_e02-initramfs-uImage; bootm 0x800000

Find the NSA325 image similar to lede-kirkwood-pogo_e02-initramfs-uImage at OpenWrt website. And load it and run like above.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Okay I will try that tutorial but idk what is up with my uBoot but it dosen't seem to want to recognize any kind of USB stick and TFTP just sits there "loading" without any response, and usb never worked at all as I did my initial OpenWRT with TFTP but now that stopped working.

- Tried different combinations of addreses.
- With switch, direct cable from PC <> NAS325
- Turned off all firewalls and/or created rules to allow TFTP
And so on.

I'll try the above and see what I can do.

Dan,

Don't spend too much time on the item 1. If it looks like too much trouble to get it working, then do number 2 (a lot simpler, but booting Debian).

Quote

2. Or you can attempt to boot Debian on USB

You can run kwboot using my 2017.07 u-boot image. And load it:

https://forum.doozan.com/read.php?3,51739,51919#msg-51919

And boot into the Debian rootfs Debian-5.2.9-kirkwood-tld-1-rootfs-bodhi.tar.bz2

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Really appreciate your patience with me on this one!

So, no luck to get USB working at all.

Now I tried UART booting, no luck either, I'm honnestly about to launch my NSA325 through my window :)

Here's my console when trying kwboot:

$ ./kwboot -t -B 115200 /dev/ttyS1 -b uboot.2017.07-tld-1.nsa325.mtd0.kwb
Sending boot message. Please reboot the target... /
Sending boot image...
  0 % [+++++++++++++++++xmodem: Bad message

Tried different serial ports and made sure to have the right baud rate and all, tested and screen /dev/ttyS1 115200 works without issues...

Dan,

> Now I tried UART booting, no luck either, I'm
> honnestly about to launch my NSA325 through my
> window :)

Don't :)

> Sending boot image...
> 0 % [+++++++++++++++++xmodem: Bad message
> [/code]

It is a good sign. When you see this "xmodem bad message", use up arrow to recall the kwboot command and then execute it. Do this several times until the handshake occurs.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Amazing, thanks alot, I'd buy you a beer lol!

I finally got it to work and load back OpenWRT as on the spot it seemed slightly faster just to have the device working.

Now at this point what do you suggest that I do, load your Debian image or any chance if going back to stock if anyone has the files.

I just want to use this device as a basic NAS with 2x2TB in mirror.

Dan,

Congrats!

> Now at this point what do you suggest that I do,
> load your Debian image or any chance if going back
> to stock if anyone has the files.

> I just want to use this device as a basic NAS with
> 2x2TB in mirror.

Best to run Debian rootfs on USB and leave your 2 HDDs for that. It is simpler.

And then when you find the back up NAND mtds, you can restore to stock easily, if needed to give it away or sell.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Last post moved here:

https://forum.doozan.com/read.php?3,102424

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)

Hi Everyone!
I have same issue I successfully flashed the new uBoot and the latest OpenWRT on my Zyxel NSA325, but after some playing around I'd like to return to stock firmware because I'll be giving it away.

NSA325> ver
ver
U-Boot 2020.04 (Jan 03 2023 - 00:24:21 +0000)
ZyXEL NSA325 2-Bay Power Media Server

arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 11.2.0 r20028-43d71ad93e) 11.2.0
GNU ld (GNU Binutils) 2.37
NSA325> printenv
printenv
baudrate=115200
bootcmd=run setenv bootargs; ubi part ubi; ubi read 0x800000 kernel; bootm 0x800000
bootdelay=3
console=console=ttyS0,115200
ethact=egiga0
ethaddr=4C:9E:FF:40:92:69
mtdids=nand0=orion_nand
mtdparts=mtdparts=orion_nand:0x00c0000(uboot),0x80000(uboot_env),0x7ec0000(ubi)
stderr=serial
stdin=serial
stdout=serial

Environment size: 327/131068 bytes

As well i have backup that was made by

nanddump --noecc --omitoob -l 0x80000 -f mtd0 /dev/mtd0

Could you please guide me?

Thank you in advance!
A.

pm_angel ,

> mtdparts=mtdparts=orion_nand:0x00c0000(uboot),0x80000(uboot_env),0x7ec0000(ubi)

> As well i have backup that was made by
>

> nanddump --noecc --omitoob -l 0x80000 -f mtd0
> /dev/mtd0
>

The backup you did only save u-boot image in stock mtd0. The stock envs are in stock mtd1, and the stock kernel and rootfs were in other mtds. OpenWrt installation have wiped out all that area. So even after restoring mtd0 u-boot, you will not able to boot into stock (it's all gone).

Can you still boot into OpenWrt? perhaps the OpenWrt installation have save them somewhere. If not, the only way that you can go back to stock is someone are willing to upload the entire NAND backup files (for all original mtds) and then you can flash them back while inside OpenWrt.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)



Edited 1 time(s). Last edit at 01/26/2023 07:10PM by bodhi.

When the position and sizes of the u-boot and u-boot env partitions didn't change, I *think* you only need the stock u-boot environment. The firmware itself is capable of filling the other partitions.
Put back the original u-boot environment, download the right RescueStick here, unzip it to a FAT formatted USB thumb drive. Extract the uImage from the file ras.bin (binwalk can tell you where it is, and what it's size is).
Plug the stick in a back port of the NAS. Upload the uImage using tftp and boot it. The script on the USB stick should do the rest.
Maybe @bodhi knows something about the current u-boot which could block this way of restoring.

But maybe you should rethink the whole operation. The NSA325 is EOL, and ZyXEL doesn't provide any updates/packages anymore. The NAS doesn't support SMB2, while Windows 10 by default doesn't support SMB1. So the original firmware is rather useless, these days. Further there is at least one vulnerability which is/was actively abused, and which only needs you to load a malicious website in a browser in the same network as the NAS to get it infected.
Bottom line, a 325 running well configured OpenWrt is more useful and far more secure than stock firmware.

Mijzelf Wrote:
-------------------------------------------------------
> When the position and sizes of the u-boot and
> u-boot env partitions didn't change, I *think* you
> only need the stock u-boot environment. The
> firmware itself is capable of filling the other
> partitions.
> Put back the original u-boot environment, download
> the right RescueStick
> here,

Nice! I did not know that exists :)

> unzip it to a FAT formatted USB thumb drive.
> Extract the uImage from the file ras.bin (binwalk
> can tell you where it is, and what it's size is).
> Plug the stick in a back port of the NAS. Upload
> the uImage using tftp and boot it. The script on
> the USB stick should do the rest.
> Maybe @bodhi knows something about the current
> u-boot which could block this way of restoring.

If the rescue FW only populates envs, kernel, and rootfs then most likely it will not work. The new uboot does not play well with stock kernel.

> But maybe you should rethink the whole operation.
> The NSA325 is EOL, and ZyXEL doesn't provide any
> updates/packages anymore. The NAS doesn't support
> SMB2, while Windows 10 by default doesn't support
> SMB1. So the original firmware is rather useless,
> these days. Further there is at least
> one
> vulnerability which is/was actively abused,
> and which only needs you to load a malicious
> website in a browser in the same network as the
> NAS to get it infected.

Stock FW should be avoided.

> Bottom line, a 325 running well configured OpenWrt
> is more useful and far more secure than stock
> firmware.

Yes indeed.

-bodhi
===========================
Forum Wiki
bodhi's corner (buy bodhi a beer)