|
BUFFALO INC. LinkStation series HS-DHGL(JINMU) HS-DHGLEA2 login: root root@HS-DHGLEA2:~# cd /boot root@HS-DHGLEA2:/boot# ls conf_save.tgz initrd.buffalo lost+found uImage.buffalo root@HS-DHGLEA2:/boot#
root@HS-DHGLEA2:/boot# ftp ude.yamasita.jp Connected to ude.yamasita.jp. 220 ude FTP server (GNU inetutils 1.5) ready. 500 'AUTH GSSAPI': command not understood. 500 'AUTH KERBEROS_V4': command not understood. KERBEROS_V4 rejected as an authentication type Name (ude.yamasita.jp:root): yasunari 331 Password required for yasunari. Password: 230- Linux ude 2.6.16.16-arm1 #37 Tue May 20 10:01:57 JST 2008 armv5tejl 230- 230- The programs included with the Debian GNU/Linux system are free software; 230- the exact distribution terms for each program are described in the 230- individual files in /usr/share/doc/*/copyright. 230- 230- Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent 230- permitted by applicable law. 230 User yasunari logged in. Remote system type is UNIX. Using binary mode to transfer files. ftp> cd /srv/tftp 250 CWD command successful. ftp> ls 200 PORT command sucessful. 150 Opening ASCII mode data connection for '/bin/ls'. total 0 drwxrwxr-x 2 root 48 Jan 24 09:31 LS-CL+HackKit drwxrwxr-x 2 root 48 Mar 20 14:32 LS-GL_1.15 drwxrwxr-x 2 root 48 Feb 20 12:00 LS-QL_1.05+telnet drwxrwxr-x 2 root 48 Jan 24 18:00 LS-XHL_1.02 drwxrwxr-x 2 root 64 Jan 24 22:17 LS-XHL_1.02+telnet 226 Transfer complete. ftp> mkdir HS-DHGL_1.20 257 (unknown absolute name) new directory created. ftp> cd HS-DHGL_1.20 250 CWD command successful. ftp> bin 200 Type set to I. ftp> hash Hash mark printing on (1024 bytes/hash mark). ftp> put initrd.buffalo local: initrd.buffalo remote: initrd.buffalo 200 PORT command sucessful. 150 Opening BINARY mode data connection for 'initrd.buffalo'. ###########################(略） 226 Transfer complete. 4926390 bytes sent in 0.87 seconds (5.5e+03 Kbytes/s) ftp> put uImage.buffalo local: uImage.buffalo remote: uImage.buffalo 200 PORT command sucessful. 150 Opening BINARY mode data connection for 'uImage.buffalo'. ###########################(略） 226 Transfer complete. 1834900 bytes sent in 0.25 seconds (7.3e+03 Kbytes/s) ftp> ls 200 PORT command sucessful. 150 Opening ASCII mode data connection for '/bin/ls'. total 6604 -rw-r----- 1 root 4926390 Mar 22 10:12 initrd.buffalo -rw-r----- 1 root 1834900 Mar 22 10:12 uImage.buffalo # 226 Transfer complete. ftp> bye 221 Goodbye. root@HS-DHGLEA2:/boot#
Debian GNU/Linux 5.0 ude login: yasunari Password: Last login: Sat Mar 21 23:38:59 JST 2009 from uxl.yamasita.jp on pts/0 Linux ude 2.6.16.16-arm1 #37 Tue May 20 10:01:57 JST 2008 armv5tejl The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. yasunari@ude:~$
yasunari@ude:~$ cd /srv/tftp/ yasunari@ude:/srv/tftp$ cd HS-DHGL_1.20/ yasunari@ude:/srv/tftp/HS-DHGL_1.20$ ls -l total 6604 -rw-r----- 1 yasunari root 4926390 Mar 22 10:12 initrd.buffalo -rw-r----- 1 yasunari root 1834900 Mar 22 10:12 uImage.buffalo yasunari@ude:/srv/tftp/HS-DHGL_1.20$ chmod 664 * yasunari@ude:/srv/tftp/HS-DHGL_1.20$ ls -l total 6604 -rw-rw-r-- 1 yasunari root 4926390 Mar 22 10:12 initrd.buffalo -rw-rw-r-- 1 yasunari root 1834900 Mar 22 10:12 uImage.buffalo yasunari@ude:/srv/tftp/HS-DHGL_1.20$
yasunari@ude:/srv/tftp/HS-DHGL_1.20$ cd .. yasunari@ude:/srv/tftp$ ls -l total 0 drwxr-s--- 2 yasunari root 48 Mar 22 10:12 HS-DHGL_1.20 drwxrwxr-x 2 root root 48 Jan 24 09:31 LS-CL+HackKit drwxrwxr-x 2 yasunari root 48 Mar 20 14:32 LS-GL_1.15 drwxrwxr-x 2 root root 48 Feb 20 12:00 LS-QL_1.05+telnet drwxrwxr-x 2 root root 48 Jan 24 18:00 LS-XHL_1.02 drwxrwxr-x 2 root root 64 Jan 24 22:17 LS-XHL_1.02+telnet yasunari@ude:/srv/tftp$ ln HS-DHGL_1.20/* . yasunari@ude:/srv/tftp$ ls -l total 6604 drwxr-s--- 2 yasunari root 48 Mar 22 10:12 HS-DHGL_1.20 drwxrwxr-x 2 root root 48 Jan 24 09:31 LS-CL+HackKit drwxrwxr-x 2 yasunari root 48 Mar 20 14:32 LS-GL_1.15 drwxrwxr-x 2 root root 48 Feb 20 12:00 LS-QL_1.05+telnet drwxrwxr-x 2 root root 48 Jan 24 18:00 LS-XHL_1.02 drwxrwxr-x 2 root root 64 Jan 24 22:17 LS-XHL_1.02+telnet -rw-rw-r-- 2 yasunari root 4926390 Mar 22 10:12 initrd.buffalo -rw-rw-r-- 2 yasunari root 1834900 Mar 22 10:12 uImage.buffalo yasunari@ude:/srv/tftp$
yasunari@ude:/srv/tftp$ tail -f /var/log/messages : : Mar 22 10:19:40 ude kernel: usb 2-1: new high speed USB device using ehci_platform and address 2 Mar 22 10:19:40 ude kernel: usb 2-1: configuration #1 chosen from 1 choice Mar 22 10:19:40 ude kernel: scsi2 : SCSI emulation for USB Mass Storage devices Mar 22 10:19:45 ude kernel: Vendor: Maxtor 6 Model: ANLE Rev: 1HW0 Mar 22 10:19:45 ude kernel: Type: Direct-Access ANSI SCSI revision: 02 Mar 22 10:19:45 ude kernel: SCSI device sdb: 320173056 512-byte hdwr sectors (163929 MB) Mar 22 10:19:45 ude kernel: sdb: Write Protect is off Mar 22 10:19:45 ude kernel: SCSI device sdb: 320173056 512-byte hdwr sectors (163929 MB) Mar 22 10:19:45 ude kernel: sdb: Write Protect is off Mar 22 10:19:45 ude kernel: sdb: sdb1 sdb2 sdb4 < sdb5 sdb6 > Mar 22 10:19:45 ude kernel: sd 2:0:0:0: Attached scsi disk sdb Mar 22 10:19:45 ude kernel: sd 2:0:0:0: Attached scsi generic sg1 type 0 yasunari@ude:/srv/tftp$
yasunari@ude:/srv/tftp$ su - root Password: ude:~#
ude:~# fdisk /dev/sdb WARNING: GPT (GUID Partition Table) detected on '/dev/sdb'! The util fdisk doesn't support GPT. Use GNU Parted. The number of cylinders for this disk is set to 19929. There is nothing wrong with that, but this is larger than 1024, and could in certain setups cause problems with: 1) software that runs at boot time (e.g., old versions of LILO) 2) booting and partitioning software from other OSs (e.g., DOS FDISK, OS/2 FDISK) Command (m for help): p Disk /dev/sdb: 163.9 GB, 163928604672 bytes 255 heads, 63 sectors/track, 19929 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System /dev/sdb1 1 25 200781 83 Linux /dev/sdb2 26 87 498015 83 Linux /dev/sdb4 88 19929 159380865 5 Extended /dev/sdb5 88 104 136521 82 Linux swap / Solaris /dev/sdb6 105 19929 159244281 83 Linux Command (m for help): d Partition number (1-6): 4 Command (m for help): d Partition number (1-4): 2 Command (m for help): d Selected partition 1 Command (m for help): p Disk /dev/sdb: 163.9 GB, 163928604672 bytes 255 heads, 63 sectors/track, 19929 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Disk identifier: 0x00000000 Device Boot Start End Blocks Id System Command (m for help): w The partition table has been altered! Calling ioctl() to re-read partition table. Syncing disks. ude:~#
Orion1 CPU = Low
=== BUFFALO LS-GL U-Boot. ===
** LOADER **
** BUFFALO BOARD: BUFFALO_BOARD_LS_GL LE (CFG_ENV_ADDR=fffff000)
U-Boot 1.1.1 (Apr 18 2007 - 18:35:44) Marvell version: 1.12.1 - TINY
DRAM CS[0] base 0x00000000 size 128MB
DRAM Total size 128MB
[256kB@fffc0000] [0kB@f8000000] ## Unknown FLASH at f8000000: Size = 0x00000000 = 0 MB
Flash: 256 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done
Soc: 88F5182 A2
CPU: ARM926 (Rev 0) running @ 400Mhz
Orion 1 streaming disabled
SysClock = 200Mhz , TClock = 166Mhz
USB 0: host mode
USB 1: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net: egiga0 [PRIME]
Using 88E1118 phy
Marvell Serial ATA Adapter
Integrated Sata device found
Device 0: OK
Model: Maxtor 6Y160M0 Firm: YAR51HW0 Ser#: Y48CANLE
Type: Hard Disk
Supports 48-bit addressing
Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)
Using device ide0, partition 1
** Bad partition 1 **
Using device ide1, partition 1
** Bad partition 1 **
Lost all init_rd
hit any key to switch tftp boot.
Hit any key to stop autoboot: 0
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##################################
done
Bytes transferred = 1834900 (1bff94 hex)
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'initrd.buffalo'.
Load address: 0x800000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#####################################################
done
Bytes transferred = 4926390 (4b2bb6 hex)
<<stop_sound>>
## Booting image at 00100000 ...
Image Name: Linux-2.6.16.16-arm1
Created: 2008-10-01 1:59:41 UTC
Image Type: ARM Linux Kernel Image (uncompressed)
Data Size: 1834836 Bytes = 1.7 MB
Load Address: 00008000
Entry Point: 00008000
Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00800000 ...
Image Name: initrd
Created: 2008-10-01 1:59:57 UTC
Image Type: ARM Linux RAMDisk Image (gzip compressed)
Data Size: 4926326 Bytes = 4.7 MB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
Starting kernel ...
arg:console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.10 tftpboot=yes
CONFIG_BUFFALO_PLATFORM CONFIG_BUFFALO_LINKSTATION_LSGL ---
Uncompressing Linux....................................................................................................................... done, booting the kernel.
Linux version 2.6.16.16-arm1 (root@I.You) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-2)) #69 Wed Oct 1 10:59:37 JST 2008
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 200000000, Tclk = 166664740
- Warning - This LSP release was tested only with U-Boot release 1.7.3
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.10 tftpboot=yes
PID hash table entries: 1024 (order: 10, 16384 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 110492KB available (3141K code, 539K data, 108K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 15360K
NET: Registered protocol family 16
FLASH boardId = 12
Flash bankwidth 1, base ff800000, size 400000
BUFFALO LS_GL FLASH size 4096[KB]
Marvell Development Board (LSP Version 1.7.8_NAS)-- BUFFALO_BOARD_LS_GL
Detected Tclk 166664740 and SysClk 200000000
Marvell USB EHCI Host controller #0: c16f5e00
Marvell USB EHCI Host controller #1: c16f5c00
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers enabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
usbcore: registered new driver usbfs
usbcore: registered new driver hub
use IDMA acceleration in copy to/from user buffers. used channels 2 and 3
Done.
cesadev_init(c0011314)
mvCesaInit: sessions=640, queue=32, pSram=f0000000
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
SGI XFS with no debug enabled
Initializing Cryptographic API
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 4) is a 16550A
RAMDISK driver initialized: 3 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
o Ethernet descriptors in DRAM
o DRAM SW cache-coherency
o Checksum offload enabled
o Loading network interface ** egiga_init_module (0)
'eth0'
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
** BUFFALO Disable Command Queuing Function [0 0] **
Vendor: Maxtor Model: 6Y160M0 Rev: YAR5
Type: Direct-Access ANSI SCSI revision: 03
Linux IAL (ERROR) : retry command host=0, bus=0 SCpnt = c143fba0
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
sda:
sd 0:0:0:0: Attached scsi disk sda
sd 0:0:0:0: Attached scsi generic sg0 type 0
physmap flash device: 400000 at ff800000
>jedec_probe
Found: SST 39LF020
phys_mapped_flash: Found 1 x8 devices at 0x0 in 8-bit bank
number of JEDEC chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
ehci_platform ehci_platform.4523: EHCI Platform Host Controller
ehci_platform ehci_platform.4523: new USB bus registered, assigned bus number 1
ehci_platform ehci_platform.4523: irq 17, io mem 0x00000000
ehci_platform ehci_platform.4523: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ehci_platform ehci_platform.16781: EHCI Platform Host Controller
ehci_platform ehci_platform.16781: new USB bus registered, assigned bus number 2
ehci_platform ehci_platform.16781: irq 12, io mem 0x00000000
ehci_platform ehci_platform.16781: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
USB Universal Host Controller Interface driver v2.3
Initializing USB Mass Storage driver...
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
mice: PS/2 mouse device common for all mice
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
MICON V2 (C) BUFFALO INC. V.1.00 installed.
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
---- in linuxrc ---
Fri Feb 27 18:15:42 JST 2009
err: >AnalyzeRecvPacket:This is invalid RespCode.(code=244)
CheckDevices
linuxrc:choose operation (timeout 4[s])
1:RamRoot other:HddRoot ? -HddRoot-
mount: you must specify the filesystem type
mount: you must specify the filesystem type
mount: you must specify the filesystem type
mount: you must specify the filesystem type
== fsck_disks ==
e2fsck 1.27 (8-Mar-2002)
fsck.ext3: No such device or address while trying to open /dev/ls_disk1_1
Possibly non-existent or swap device?
dd: /dev/ls_disk1_2: No such device or address
proc /proc proc rw 0 0
sysfs /sys sysfs rw 0 0
Freeing init memory: 108K
init started: BusyBox v1.1.1 (2008.03.07-05:17+0000) multi-call binary
Starting pid 249, console /dev/ttyS0: '/etc/init.d/rcS'
--- rcStart (initrd) ---
mkdir: Cannot create directory `/sys': File exists
===== exec:checkroot.sh =====
chmod: /home: No such file or directory
mkdir: Cannot create directory `/var/lock': File exists
rm: /var/lock/perfmon: is a directory
rm: /var/lock/printing: is a directory
rm: /var/lock/subsys: is a directory
swapon: /dev/ls_disk1_5: No such device or address
create dir : /home
create dir : /var/www
===== exec:create_devlink.sh =====
===== exec:fwupdate.sh =====
umount: /boot: not mounted
mkdir: Cannot create directory `/boot': File exists
mount: you must specify the filesystem type
===== exec:sethostname.sh =====
configure files from Buffalo parameters.
===== exec:restore_config.sh =====
mount: you must specify the filesystem type
Restore previous configuration files
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
unzip fail.
umount: /boot: not mounted
===== exec:networking.sh =====
create network files..
IP=[dhcp], netmask=[], dgw=[], dns1=[], dns2=[]
killall: dhcpcd: no process killed
route: SIOC[ADD|DEL]RT: No such process
Configuration network interface: lo eth0
requesting DHCP tout=30[s]
networking.sh: dhcp requesting...
DontDownIface
alwaysFork
eth0: link down
eth0: link up<5>, full duplex<5>, speed 100 Mbps<5>
sendto: count 6 sync 1
sendto: count 5 sync 0
sendto: count 6 sync 0
dhcpcd.exe: interface eth0 has been configured with new IP=192.168.2.46 GATEWAY=192.168.2.1
** networking.sh dhcp fin.
configure files from Buffalo parameters.
===== exec:create_usblink.sh =====
===== exec:kernelmon.sh =====
Starting kernelmon:===== exec:miconmon.sh =====
err: argCmd: invalid command. (usb_set_power)
miconmon 1.00b3 started (Builddate Sep 11 2008 17:51:20)
===== exec:diskmon.sh =====
===== exec:micon_setup.sh =====
===== exec:clientUtil_servd.sh =====
updating DHCP lease info: eth0
DHCPCSTATE=new
Starting clientUtil_server:starting on eth0
===== exec:daemonwatch.sh =====
Starting daemonwatch:daemonwatch Ver.1.01
watch list file : /etc/daemonwatch.list
===== exec:bootcomplete.sh =====
No need to run drivecheck.sh
/etc/init.d/bootcomplete.sh: line 44: flushqueue: command not found
mount: you must specify the filesystem type
Starting pid 692, console /dev/ttyS0: '/sbin/getty'
BUFFALO INC. LinkStation series HS-DHGL(JINMU)
HS-DHGL-EM385 login:
しばらくして、正常に起動してきた。
'09/5/5 追記
HS-DHGL ファームウェア 1.20 には
セキュリティホールが存在します。
|
|
← まっさらにする |
ハックの記録 LinkStation／玄箱 をハックしよう |
→ まっさらにする |
