BLR3-TX4 化(笑)


BLR3-TX4 のファームに戻す。
BLR3-TX4 はもう WHR-G54 のつもりで動いているので、 BLR3F141b.EXE を起動してもファームのアップデート(インストール)は できなくなっている。

ファームの入手

BUFFALO から BLR3-TX4 ファームウェア Ver.1.41β(blr3_141b.exe)を ダウンロードしてきて、実行。
出来上がった BLR3F141b.EXE から ファームを抜き出す。 ファームウェアのサイズは、
-rw-r--r--    1 yasunari root      6173248 Jun 26 04:42 firmimg.bin

BLR3-TX4 へ転送

BLR3-TX4(WHR-G54) の RAM DISK の空き容量は
# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/root                20148     15863      4285  79% /
と相変わらず持ち込めない状態。
無理やり空ける。
# rm -fr /usr/local
# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/root                20148     14617      5531  73% /
# rm -fr /debug
# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/root                20148     14279      5869  71% /
# rm -fr /home/d-yama/
# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/root                20148     14276      5872  71% /
# rm -fr /usr/lib/apache/
# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/root                20148     14268      5880  71% /
# lsmod
Module                  Size  Used by
dummy5                  1664   0  (unused)
dummy4                  1664   0  (unused)
dummy3                  1664   0  (unused)
dummy2                  1664   0  (unused)
dummy1                  1664   0  (unused)
dummy0                  1664   0  (unused)
wl                    270864   1
hnd                    27776   0  [wl]
ip_nat_ipsec            1888   0  (unused)
ip_conntrack_ipsec      2864   0  (unused)
# rmmod dummy0
# rmmod dummy1
# rmmod dummy2
# rmmod dummy3
# rmmod dummy4
# rmmod dummy5
# rmmod ip_nat_ipsec
# rmmod ip_conntrack_ipsec
# rm -fr /lib/modules
# df
Filesystem           1k-blocks      Used Available Use% Mounted on
/dev/root                20148     13715      6433  69% /
こんなところか。

ftp で firmimg.bin を持ち込む

ファームウェアの書き込み

# cat firmimg.bin > /dev/fl1
ついでに、設定の初期化をしておく
# as_flash /dev/fl0 init
# as_flash /dev/fl0 list
flash is empty

リブート

ネットワークケーブルを抜き、電源再投入
No PLD model

******* Product Information *******
----------------------------------
Product Name: BLR3-TX4
          VER: 1.41
         Date: 2004/5/13 10:44:30
----------------------------------
Firmware check:Done.

>>
Now Loading...done.
Now Booting
hwid(0) : CLK_DCR value(0x3878)  -->  unknown hwtype
 value(0x3878) 
Memory BAT mapping: BAT2=64Mb, BAT3=0Mb, residual: 0Mb
HWTYPE:None PLD Model
Linux version 2.4.18_mvl30-sandpoint (root@localhost.localdomain) (gcc version 2.95.3 20010315 (release/MontaVista)) #166 木
 5月 13 10:44:12 JST 2004
PCI Autoconfig: Found Bus 0, Device 11, Function 0
PCI Autoconfig: BAR 0x10, I/O, size=0x100, address=0xbfff00
PCI Autoconfig: BAR 0x14, Mem size=0x400, address=0xbffffc00
PCI Autoconfig: Found Bus 0, Device 12, Function 0
PCI Autoconfig: BAR 0x10, I/O, size=0x100, address=0xbffe00
PCI Autoconfig: BAR 0x14, Mem size=0x400, address=0xbffff800
PCI Autoconfig: Found Bus 0, Device 14, Function 0
PCI Autoconfig: BAR 0x10, Mem size=0x2000, address=0xbfffc000
AirStation Pro Series
802.11b Wireless Access Point
2002 MELCO INC. (c)
On node 0 totalpages: 16384
zone(0): 16384 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: 
OpenPIC Version 1.2 (1 CPUs and 26 IRQ sources) at 80040000
Calibrating delay loop... 130.66 BogoMIPS
Memory: 57220k available (1244k kernel code, 484k data, 184k init, 0k highmem)
Dentry-cache hash table entries: 8192 (order: 4, 65536 bytes)
Inode-cache hash table entries: 4096 (order: 3, 32768 bytes)
Mount-cache hash table entries: 1024 (order: 1, 8192 bytes)
Buffer-cache hash table entries: 4096 (order: 2, 16384 bytes)
Page-cache hash table entries: 16384 (order: 4, 65536 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Disabling the Out Of Memory Killer
pty: 256 Unix98 ptys configured
MELCO WLM-L11G RTC DRIVER ver 1.00
MELCO WLM-L11G INIT SWICH DRIVER ver 1.01
initsw: Done.
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SHARE_IRQ SERIAL_PCI enabled
ttyS00 at 0x80004600 (irq = 22) is a ST16650
ttyS01 at 0x80004500 (irq = 21) is a ST16650
Software Watchdog Timer: 0.05, timer margin: 100 msec
block: 128 slots per queue, batch=32
RAMDISK driver initialized: 16 RAM disks of 20480K size 1024 blocksize
loop: loaded (max 8 devices)
FLASHDISK:Boot From OnBoard Flash
Can't find MiniPCI Board
Initialized [TOSHIBA VT641FT] 
Find Onbord Flash dev_winbond 0
Linux Tulip driver version 1.1.1-NAPI (Feb 16, 2002)
brg0: ADMtek Comet rev 17 at 0xbfff00, 00:07:40:49:xx:yy, IRQ 16.(一部伏字)
tulip1:  MII transceiver #1 config 3100 status 7849 advertising 05e1.
eth1: ADMtek Comet rev 17 at 0xbffe00, 00:07:40:49:xx:yy, IRQ 17.(一部伏字)
PPP generic driver version 2.4.1
Linux Kernel Card Services 3.1.22
  options:  [pci] [cardbus]
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 4096 bind 4096)
ip_conntrack (512 buckets, 4096 max)
* VPN Masqurade -- IPsec Support 
reg isakmp:done
reg ESP protocol:
reg ESP conntrack:done
PPTP netfilter connection tracking: registered
ip_nat_ipsec : isakmp : done.
ip_nat_ipsec : esp    : done.
PPTP netfilter NAT helper: registered
ip_tables: (C) 2000-2002 Netfilter core team
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
ds: no socket drivers loaded!
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 5310k freed
VFS: Mounted root (ext2 filesystem).
Freeing unused kernel memory: 184k init 4k openfirmware
modprobe: modprobe: Can't open dependencies file /lib/modules/2.4.18_mvl30-sandpoint/modules.dep (No such file or directory)
INIT: version 2.78 booting
Activating swap...
Checking all file systems...
Parallelizing fsck version 1.19 (13-Jul-2000)
Setting kernel variables.
Init SW watching daemon starting: done
Mounting local filesystems...
mount: none already mounted or /dev/pts busy
mount: according to mtab, devpts is already mounted on /dev/pts
Cleaning: /tmp /var/lock /var/run.
dmesg: not found
10:44:30: not found
Previous Configuration longing: The image format is not MELCO AS format
not find data in /dev/fl0
Configuration data was not saved.
rm: cannot remove `/etc/ppp/ip-down.d/00delresolv': No such file or directory
ver_up: old version is 0.
Configuration network interface: 
netifctl[68]: Boot up network device

netifctl[68]: lo starts to up
netifctl[68]: brg0 starts to up
****  /sbin/dhcpcd: not running
Stopping Zebra daemons: (bgpd) (ripd) (ripngd) (ospfd) (ospf6d) (zebra).
Starting Zebra daemons (prio:10): zebra ripd.
netifctl[68]: eth1 starts to up
Stopping Zebra daemons: (bgpd) ripddhcpcd[102]: Request: broadcasting DHCP_DISCOVER

 (ripngd) (ospfd) (ospf6d) zebra.
Starting Zebra daemons (prio:10): zebra ripd.
netifctl[68]: Success

done.
Hostname: AP00074049xxyy.(一部伏字)
Initializing random number generator... done.
Checking password and group files... grpck: not found
Starting system log daemon: syslogd  syslogd: /var/log/attack_pipe: No such file or directory
 klogd.
Setting Networking rules..
INIT: Entering runlevel: 2
-ne Starting web server: apache
.
Starting AP serv daemon:AP serv starting on brg0
Starting periodic command scheduler: cron/var/spool/cron: No such file or directory
/var/spool/cron: created
crontabs: No such file or directory
crontabs: created
.
Starting internet superserver: inetd.
[IPTABLES START]
+Packet Filter
 +Enabled
+Easy Filter
 +Disable NBT Routing
 +Reject IDENT Packet
 +Allow ICMP Echo reply
+IP MASQUAREDE
 +Enabled
 +UPnP Settings
[DONE]
Starting Zebra daemons (prio:10): (zebra) (ripd).
Starting DHCP server
Internet Software Consortium DHCP Server 2.0pl5-M_MODIFIED
Copyright 1995, 1996, 1997, 1998, 1999 The Internet Software Consortium.
Modified by MELCO INC. Copyright 2002.

default: not found
ppp0: not found
ppp1: not found
ppp2: not found
ppp3: not found
ppp4: not found
Start DNS Relay Daemon
Notice: caching turned off
$Starting fwlogwatch:
Up UPnP Daemon: upnpd
MELCO Daemon reboot Deamon 'NINJYA'
0: dnsrd /var/run/dnrd.pid /etc/init.d/dns-relay start
1: apservd /var/run/apservd-brg0.pid /etc/init.d/apservd start
2: wcc /var/run/wcc.pid /etc/init.d/wcc restart


MELCO INC. AirStationPro Series BLR3-TX4 Ver 1.41

AP00074049xxyy login: (一部伏字)

ハックの記録 → 設定のバックアップ

Copyright (C) 2004 Yasunari Yamashita. All Rights Reserved.
yasunari @ yamasita.jp 山下康成@京都府向日市