まっさらにする

LS-HGL

セキュリティホールをまっさらな状態から確認してみる。
今度は LS-HGL

まっさらな状態にするには

まっさらな状態にするには、
パーティションを削除して
tftpboot して、
ファームウェアアップデート
する。

uImage.buffalo, uboot.buffalo の吸出し

まずは、tftpboot するために、標準ファームの HDD を tftp サーバである旧型 LS-GL に接続し、 標準ファームの HDD の /boot にある uImage.buffalo, uboot.buffalo を 旧型 LS-GL の /srv/tftp に置く。

標準ファームの HDD を USB で旧型 LS-GL に接続

ude:~# tail -f /var/log/messages
Mar 23 14:20:03 ude kernel: usb 2-1: new high speed USB device using ehci_platform and address 4
Mar 23 14:20:03 ude kernel: usb 2-1: configuration #1 chosen from 1 choice
Mar 23 14:20:03 ude kernel: scsi4 : SCSI emulation for USB Mass Storage devices
Mar 23 14:20:08 ude kernel:  Vendor: SAMSUNG   Model: JDWQ100470        Rev: 0-05
Mar 23 14:20:08 ude kernel:  Type:   Direct-Access                      ANSI SCSI revision: 02
Mar 23 14:20:08 ude kernel: SCSI device sdb: 488397168 512-byte hdwr sectors (250059 MB)
Mar 23 14:20:08 ude kernel: sdb: Write Protect is off
Mar 23 14:20:08 ude kernel: SCSI device sdb: 488397168 512-byte hdwr sectors (250059 MB)
Mar 23 14:20:08 ude kernel: sdb: Write Protect is off
Mar 23 14:20:08 ude kernel: sdb: sdb1 sdb2 sdb4 < sdb5 sdb6 >
Mar 23 14:20:08 ude kernel: sd 4:0:0:0: Attached scsi disk sdb
Mar 23 14:20:08 ude kernel: sd 4:0:0:0: Attached scsi generic sg1 type 0

正常に、sdb と認識された。

マウント

/tmp/boot にマウント
ude:~# mkdir /tmp/boot
mkdir: cannot create directory `/tmp/boot': File exists
ude:~# mount /dev/sdb1 /tmp/boot
ude:~# ls /tmp/boot
conf_save.tgz   log.tgz     u-boot.buffalo      uImage.buffalo
initrd.buffalo  lost+found  u-boot.buffalo.org
ude:~#

/srv/tftp にコピー

ude:~# cd /tmp/boot
ude:/tmp/boot# mkdir /srv/tftp/LS-HGL_1.07b
ude:/tmp/boot# tar cf - initrd.buffalo uImage.buffalo |(cd !$; tar xvf -)
tar cf - initrd.buffalo uImage.buffalo |(cd /srv/tftp/LS-HGL_1.07b; tar xvf -)
initrd.buffalo
uImage.buffalo
ude:/tmp/boot#

アンマウント

ude:/tmp/boot# cd /
ude:/# umount /tmp/boot
ude:/#
USB ケーブルを抜く。

tftp サーバの準備

tftp サーバである旧型 LS-GL で tftpboot できるよう準備する。

モードの確認

ude:/# cd /srv/tftp/
ude:/srv/tftp# ls -l
total 2712
drwxr-s--- 2 yasunari root      48 Mar 22 10:12 HS-DHGL_1.20
drwxrwxr-x 2 root     root      48 Jan 24 09:31 LS-CL+HackKit
drwxrwxr-x 2 yasunari root      48 Mar 20 14:32 LS-GL_1.15
drwxr-sr-x 2 root     root      48 Mar 23 14:22 LS-HGL_1.07b
drwxr-sr-x 2 root     root      48 Mar 23 13:31 LS-LGL_2.01
drwxrwxr-x 2 root     root      48 Feb 20 12:00 LS-QL_1.05+telnet
drwxrwxr-x 2 root     root      48 Jan 24 18:00 LS-XHL_1.02
drwxrwxr-x 2 root     root      64 Jan 24 22:17 LS-XHL_1.02+telnet
-rw-r--r-- 2 root     root 1490384 Sep  9  2008 initrd.buffalo
-rw-r--r-- 2 root     root 1284160 Jan 10  2015 uImage.buffalo
ude:/srv/tftp# ls -l LS-HGL_1.07b/
total 7508
-rw-r--r-- 1 root root 5969136 Dec 27 13:23 initrd.buffalo
-rw-r--r-- 1 root root 1715900 Dec 30 16:50 uImage.buffalo
ude:/srv/tftp#
特に問題なく読めそうだ。

リンク

LS-HGL 用にリンクを張りなおす。
ude:/srv/tftp# ls
HS-DHGL_1.20   LS-HGL_1.07b       LS-XHL_1.02         uImage.buffalo
LS-CL+HackKit  LS-LGL_2.01        LS-XHL_1.02+telnet
LS-GL_1.15     LS-QL_1.05+telnet  initrd.buffalo
ude:/srv/tftp# rm initrd.buffalo uImage.buffalo
ude:/srv/tftp# ln LS-HGL_1.07b/* .
ude:/srv/tftp# ls -l
total 7508
drwxr-s--- 2 yasunari root      48 Mar 22 10:12 HS-DHGL_1.20
drwxrwxr-x 2 root     root      48 Jan 24 09:31 LS-CL+HackKit
drwxrwxr-x 2 yasunari root      48 Mar 20 14:32 LS-GL_1.15
drwxr-sr-x 2 root     root      48 Mar 23 14:22 LS-HGL_1.07b
drwxr-sr-x 2 root     root      48 Mar 23 13:31 LS-LGL_2.01
drwxrwxr-x 2 root     root      48 Feb 20 12:00 LS-QL_1.05+telnet
drwxrwxr-x 2 root     root      48 Jan 24 18:00 LS-XHL_1.02
drwxrwxr-x 2 root     root      64 Jan 24 22:17 LS-XHL_1.02+telnet
-rw-r--r-- 2 root     root 5969136 Dec 27 13:23 initrd.buffalo
-rw-r--r-- 2 root     root 1715900 Dec 30 16:50 uImage.buffalo
ude:/srv/tftp#

まっさらな HDD の用意

実験用 HDD として、今回も MAXTOR DiamondMax Plus 9 160GB を使う。

USB で接続

旧形 LS-GL に USB で接続

パーティションの削除

取り外し

USB ケーブルを抜き、HDD への電源を絶つ。

まっさらな HDD の接続

パーティションを削除した MAXTOR DiamondMax Plus 9 160GB を LS-HGL にセットする。

tftpboot

LS-HGL のコンセントを刺す。
Orion1   CPU =  Low

Checking DATA BUS
Checking ADDRESS BUS

> Checking hardware info ...
=== Strap status : 0x00800030 ===
=== H/W boardId  :       0x23 ===
=== boardId      :       0x1b ===
=== micon_support:        off ===
> OK.
=== BUFFALO LS-HGL U-Boot. ===
 ** LOADER **
 ** BUFFALO BOARD: BUFFALO_BOARD_LS_HGL LE (CFG_ENV_ADDR=fffff000)


U-Boot 1.1.1 (May 27 2008 - 19:18:26) Marvell version: 1.12.1 - TINY
Buffalo Version: 1.17-1.00

DRAM CS[0] base 0x00000000   size 128MB
DRAM Total size 128MB
[256kB@fffc0000] Flash: 256 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5182 A2
CPU: ARM926 (Rev 0) running @ 400Mhz
Orion 1 streaming disabled
SysClock = 250Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Using 88E1118 phy
buffalo_change_power_status > Read 0x00
buffalo_IsStopAtUbootStatus > MagicKey=0x00
buffalo_change_power_status > Read 0x00
buffalo_change_power_status > Read 0x00
buffalo_change_power_status > Writing 0x5c

Please Press HDD power button to continue ...

電源 SW を ON にする。
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x3a

Marvell Serial ATA Adapter
Integrated Sata device found
  Device 0: OK
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
Lost all init_rd
ん?
tftpboot しない。

func ボタンを押してみる


func switch pushed, and exited loop
wait until func switch released.

Marvell Serial ATA Adapter
Integrated Sata device found

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
hit any key to switch tftp boot.
Hit any key to stop autoboot:  0
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.2.44
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: ##T #T #
Retry count exceeded; starting again
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.2.44
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: ##T T #
Retry count exceeded; starting again
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.2.44
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: #
何でこんな IP アドレスになっているの?

電源を入れなおし、ファンクションボタンを押して、 すかさずキーを押して U-Boot のコマンドモードに入る。

Orion1   CPU =  Low

Checking DATA BUS
Checking ADDRESS BUS

> Checking hardware info ...
=== Strap status : 0x00800030 ===
=== H/W boardId  :       0x23 ===
=== boardId      :       0x1b ===
=== micon_support:        off ===
> OK.
=== BUFFALO LS-HGL U-Boot. ===
 ** LOADER **
 ** BUFFALO BOARD: BUFFALO_BOARD_LS_HGL LE (CFG_ENV_ADDR=fffff000)


U-Boot 1.1.1 (May 27 2008 - 19:18:26) Marvell version: 1.12.1 - TINY
Buffalo Version: 1.17-1.00

DRAM CS[0] base 0x00000000   size 128MB
DRAM Total size 128MB
[256kB@fffc0000] Flash: 256 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5182 A2
CPU: ARM926 (Rev 0) running @ 400Mhz
Orion 1 streaming disabled
SysClock = 250Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Using 88E1118 phy
buffalo_change_power_status > Read 0x3a
buffalo_IsStopAtUbootStatus > MagicKey=0x3a
buffalo_change_power_status > Read 0x3a
buffalo_change_power_status > Read 0x3a
buffalo_change_power_status > Writing 0x5c

Please Press HDD power button to continue ...
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x3a

Marvell Serial ATA Adapter
Integrated Sata device found
  Device 0: OK
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
Lost all init_rd

func switch pushed, and exited loop
wait until func switch released.

Marvell Serial ATA Adapter
Integrated Sata device found

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
hit any key to switch tftp boot.
Hit any key to stop autoboot:  0
Marvell>>
とりあえず、自 IP をデフォルトに戻す。
Marvell>> printenv
bootargs=$(bootargs_base) $(bootargs_root)
baudrate=115200
loads_echo=0
serverip=192.168.11.1
rootpath=/nfs/arm
cpuName=926
CASset=min
MALLOC_len=4
bootargs_end=:::DB88FXX81:eth0:none
ethact=egiga0
ethaddr=00:1D:73:3F:04:87
buffalo_ver=BOOTVER=1.17
buffalo_minor_ver=BOOT_MINOR_VER=1.00
build_time=19:18:23
initrd=initrd.buffalo
kernel=uImage.buffalo
bootargs_base=console=ttyS0,115200
bootargs_root=root=/dev/sda2 rw initrd=0x00800040,15M panic=5
def_tftp=tftp 0x00100000 $(kernel); tftp 0x00800000 $(initrd); setenv bootargs $(bootargs_base) $(bootargs_root) $(buffalo_ver) tftpboot=yes; bootm 0x00100000 0x00800000
filesize=5ACAE3
ipaddr=192.168.2.44
stdin=serial
stdout=serial
stderr=serial
enaMonExt=no
enaFlashBuf=yes
enaCpuStream=no
ethprime=egiga0
bootdelay=3
disaMvPnp=no
overEthAddr=no
usb0Mode=host
usb1Mode=host
bootargs_func=func=0
force_tftp=1
bootcmd=tftp 0x00100000 $(kernel); tftp 0x00800000 $(initrd); setenv bootargs $(bootargs_base) $(bootargs_root) $(buffalo_ver) tftpboot=yes; bootm 0x00100000 0x00800000

Environment size: 1027/4092 bytes
Marvell>> setenv ipaddr 192.168.11.150
Marvell>> printenv
bootargs=$(bootargs_base) $(bootargs_root)
baudrate=115200
loads_echo=0
serverip=192.168.11.1
rootpath=/nfs/arm
cpuName=926
CASset=min
MALLOC_len=4
bootargs_end=:::DB88FXX81:eth0:none
ethact=egiga0
ethaddr=00:1D:73:3F:04:87
buffalo_ver=BOOTVER=1.17
buffalo_minor_ver=BOOT_MINOR_VER=1.00
build_time=19:18:23
initrd=initrd.buffalo
kernel=uImage.buffalo
bootargs_base=console=ttyS0,115200
bootargs_root=root=/dev/sda2 rw initrd=0x00800040,15M panic=5
def_tftp=tftp 0x00100000 $(kernel); tftp 0x00800000 $(initrd); setenv bootargs $(bootargs_base) $(bootargs_root) $(buffalo_ver) tftpboot=yes; bootm 0x00100000 0x00800000
filesize=5ACAE3
stdin=serial
stdout=serial
stderr=serial
enaMonExt=no
enaFlashBuf=yes
enaCpuStream=no
ethprime=egiga0
bootdelay=3
disaMvPnp=no
overEthAddr=no
usb0Mode=host
usb1Mode=host
bootargs_func=func=0
force_tftp=1
bootcmd=tftp 0x00100000 $(kernel); tftp 0x00800000 $(initrd); setenv bootargs $(bootargs_base) $(bootargs_root) $(buffalo_ver) tftpboot=yes; bootm 0x00100000 0x00800000
ipaddr=192.168.11.150

Environment size: 1029/4092 bytes
Marvell>> saveenv
Saving Environment to Flash...
.
Un-Protected 1 sectors
Erasing Flash...
.
Erased 1 sectors
Writing to Flash... done
.
Protected 1 sectors
Marvell>>
コンセントを抜いて、最初からやり直し。
Orion1   CPU =  Low

Checking DATA BUS
Checking ADDRESS BUS

> Checking hardware info ...
=== Strap status : 0x00800030 ===
=== H/W boardId  :       0x23 ===
=== boardId      :       0x1b ===
=== micon_support:        off ===
> OK.
=== BUFFALO LS-HGL U-Boot. ===
 ** LOADER **
 ** BUFFALO BOARD: BUFFALO_BOARD_LS_HGL LE (CFG_ENV_ADDR=fffff000)


U-Boot 1.1.1 (May 27 2008 - 19:18:26) Marvell version: 1.12.1 - TINY
Buffalo Version: 1.17-1.00

DRAM CS[0] base 0x00000000   size 128MB
DRAM Total size 128MB
[256kB@fffc0000] Flash: 256 kB
Addresses 20M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (20M - 16M): Done

Soc: 88F5182 A2
CPU: ARM926 (Rev 0) running @ 400Mhz
Orion 1 streaming disabled
SysClock = 250Mhz , TClock = 166Mhz


USB 0: host mode
PCI 0: PCI Express Root Complex Interface
PCI 1: Conventional PCI, speed = 33000000
Net:   egiga0 [PRIME]
Using 88E1118 phy
buffalo_change_power_status > Read 0x3a
buffalo_IsStopAtUbootStatus > MagicKey=0x3a
buffalo_change_power_status > Read 0x3a
buffalo_change_power_status > Read 0x3a
buffalo_change_power_status > Writing 0x5c

Please Press HDD power button to continue ...
buffalo_change_power_status > Read 0x5c
buffalo_change_power_status > Writing 0x3a

Marvell Serial ATA Adapter
Integrated Sata device found
  Device 0: OK
Model: Maxtor 6Y160M0                           Firm: YAR51HW0 Ser#: Y48CANLE   
            Type: Hard Disk
            Supports 48-bit addressing
            Capacity: 156334.5 MB = 152.6 GB (320173056 x 512)

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
Lost all init_rd

func switch pushed, and exited loop
wait until func switch released.

Marvell Serial ATA Adapter
Integrated Sata device found

Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 0
Using device ide0, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 0
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (185)>No kernel_file 1
Using device ide1, partition 1
** Bad partition 1 **
serch_boot_drv (240)>No init_file 1
hit any key to switch tftp boot.
Hit any key to stop autoboot:  0
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'uImage.buffalo'.
Load address: 0x100000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###########
done
Bytes transferred = 1715900 (1a2ebc hex)
Using egiga0 device
TFTP from server 192.168.11.1; our IP address is 192.168.11.150
Filename 'initrd.buffalo'.
Load address: 0x800000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############################################################
done
Bytes transferred = 5969136 (5b14f0 hex)
## Booting image at 00100000 ...
   Image Name:   Linux-2.6.16.16-arm1
   Created:      2008-12-27   4:21:16 UTC
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    1715836 Bytes =  1.6 MB
   Load Address: 00008000
   Entry Point:  00008000
   Verifying Checksum ... OK
OK
## Loading Ramdisk Image at 00800000 ...
   Image Name:   initrd
   Created:      2008-12-27   4:23:28 UTC
   Image Type:   ARM Linux RAMDisk Image (gzip compressed)
   Data Size:    5969072 Bytes =  5.7 MB
   Load Address: 00000000
   Entry Point:  00000000
   Verifying Checksum ... OK

Starting kernel ...

arg:console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.17 tftpboot=yes
CONFIG_BUFFALO_PLATFORM CONFIG_BUFFALO_LINKSTATION_LSHGL ---
Uncompressing Linux................................................................................................................ done, booting the kernel.
Linux version 2.6.16.16-arm1 (root@build.dd-hot24.nas.buffalo.local) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-2)) #131 Sat Dec 27 13:21:07 JST 2008
CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)
Machine: MV-88fxx81
Using UBoot passing parameters structure
Sys Clk = 250000000, Tclk = 166664740


- Warning - This LSP release was tested only with U-Boot release 1.7.3

Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.17 tftpboot=yes
PID hash table entries: 1024 (order: 10, 16384 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 128MB 0MB 0MB 0MB = 128MB total
Memory: 110720KB available (2912K code, 550K data, 108K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 15360K
NET: Registered protocol family 16
FLASH boardId = 1a
Flash bankwidth 1, base ff800000, size 40000
BUFFALO LS_HGL FLASH size 256[KB]

  Marvell Development Board (LSP Version 1.7.8_NAS)-- BUFFALO_BOARD_LS_HGL

 Detected Tclk 166664740 and SysClk 250000000
Marvell USB EHCI Host controller #0: c16f5e00
Marvell USB EHCI Host controller #1: c16f5c00
pexBarOverlapDetect: winNum 2 overlap current 0
mvPexInit:Warning :Bar 2 size is illigal
it will be disabled
please check Pex and CPU windows configuration
PCI: bus0: Fast back to back transfers enabled
PCI: bus1: Fast back to back transfers enabled
SCSI subsystem initialized
use IDMA acceleration in copy to/from user buffers. used channels 2 and 3
Done.
cesadev_init(c0011434)
Fast Floating Point Emulator V0.9 (c) Peter Teichmann.
SGI XFS with large block numbers, no debug enabled
Initializing Cryptographic API
io scheduler noop registered (default)
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 3) is a 16550A
serial8250: ttyS1 at MMIO 0x0 (irq = 4) is a 16550A
RAMDISK driver initialized: 3 RAM disks of 16384K size 1024 blocksize
loop: loaded (max 8 devices)
Marvell Gigabit Ethernet Driver 'egiga':
  o Ethernet descriptors in DRAM
  o DRAM SW cache-coherency
  o Checksum offload enabled
  o Loading network interface ** egiga_init_module (0)
'eth0'
Intergrated Sata device found
scsi0 : Marvell SCSI to SATA adapter
scsi1 : Marvell SCSI to SATA adapter
** BUFFALO Disable Command Queuing Function [0 0] **
  Vendor: Maxtor    Model: 6Y160M0           Rev: YAR5
  Type:   Direct-Access                      ANSI SCSI revision: 03
Linux IAL (ERROR) : retry command host=0, bus=0 SCpnt = c142fba0
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
SCSI device sda: 320173056 512-byte hdwr sectors (163929 MB)
sda: Write Protect is off
SCSI device sda: drive cache: write back
 sda:
sd 0:0:0:0: Attached scsi disk sda
sd 0:0:0:0: Attached scsi generic sg0 type 0
physmap flash device: 40000 at ff800000
>jedec_probe
Found: SST 39LF020
phys_mapped_flash: Found 1 x8 devices at 0x0 in 8-bit bank
number of JEDEC chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
cmdlinepart partition parsing not available
RedBoot partition parsing not available
mice: PS/2 mouse device common for all mice
Kernel event proc (C) BUFFALO INC. V.1.00 installed.
MICON ctrl (C) BUFFALO INC. V.1.00 installed.
Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed.
mvGppValueSet: Err. An attempt to set output value to GPP 2 in input mode.
Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.0.01 installed.
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 3, 32768 bytes)
TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
TCP bic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
RAMDISK: Compressed image found at block 0
VFS: Mounted root (ext2 filesystem).
---- in linuxrc ---
Thu Nov  1 00:00:00 JST 2007
Thu Nov  1 00:00:00 JST 2007
CheckDevices
linuxrc:choose operation (timeout 4[s])
 1:RamRoot other:HddRoot  ? -HddRoot-
Starting :fsck_disks(boot) ...         [Failed. ]
Starting :fsck_disks(rootfs) ...       [Success.]
Starting :mount(boot) ...              [Failed. ]
mount: you must specify the filesystem type
mount: you must specify the filesystem type
Freeing init memory: 108K
init started:  BusyBox v1.1.1 (2008.12.27-02:40+0000) multi-call binary
Starting pid 377, console /dev/ttyS0: '/etc/init.d/rcS'
--- rcStart (initrd) ---
chmod: /home: No such file or directory
mkdir: Cannot create directory `/var/lock': File exists
rm: /var/lock/perfmon: is a directory
rm: /var/lock/printing: is a directory
rm: /var/lock/subsys: is a directory
swapon: /dev/sda5: No such device or address
create dir : /home
create dir : /var/www
umount: /boot: not mounted
mkdir: Cannot create directory `/boot': File exists
mount: you must specify the filesystem type
configure files from Buffalo parameters.
mount: you must specify the filesystem type
Restore previous configuration files
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory
/bin/tar: Error is not recoverable: exiting now
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
/bin/tar: Child returned status 2
/bin/tar: Error exit delayed from previous errors
unzip  fail.
umount: /boot: not mounted
rootfs on / type rootfs (rw)
/dev/root.old on / type ext2 (rw,nogrpid)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw)
/dev/ram1 on /mnt/ram type tmpfs (rw)
  PID  Uid     VmSize Stat Command
    1 root        564 S   init
    2 root            SWN [ksoftirqd/0]
    3 root            SW< [events/0]
    4 root            SW< [khelper]
    5 root            SW< [kthread]
   11 root            SW< [kblockd/0]
   37 root            SW  [pdflush]
   38 root            SW  [pdflush]
   40 root            SW< [aio/0]
   39 root            SW  [kswapd0]
   41 root            SW< [xfslogd/0]
   42 root            SW< [xfsdatad/0]
   43 root            SW  [crypto]
   44 root            SW  [crypto_ret]
  167 root            SW< [scsi_eh_0]
  168 root            SW< [scsi_eh_1]
  177 root            SW  [mtdblockd]
  376 root        228 S   init
  377 root        656 S   /bin/sh /etc/init.d/rcS
  762 root        712 R   /bin/sh /etc/init.d/restore_config.sh start
  797 root        792 R   ps
#[miconapl.usb_set_power]
/sbin/hotplug [module]
/sbin/hotplug [drivers]
usbcore: registered new driver usbfs
/sbin/hotplug [drivers]
usbcore: registered new driver hub
/sbin/hotplug [drivers]
/sbin/hotplug [module]
/sbin/hotplug [drivers]
ehci_platform ehci_platform.4523: EHCI Platform Host Controller
/sbin/hotplug [usb_host]
ehci_platform ehci_platform.4523: new USB bus registered, assigned bus number 1
ehci_platform ehci_platform.4523: irq 17, io mem 0x00000000
ehci_platform ehci_platform.4523: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
/sbin/hotplug [usb]
usb usb1: configuration #1 chosen from 1 choice
/sbin/hotplug [usb]
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
/sbin/hotplug [usb_device]
ehci_platform ehci_platform.16781: EHCI Platform Host Controller
/sbin/hotplug [usb_host]
ehci_platform ehci_platform.16781: new USB bus registered, assigned bus number 2
ehci_platform ehci_platform.16781: irq 12, io mem 0x00000000
ehci_platform ehci_platform.16781: USB 0.0 started, EHCI 1.00, driver 10 Dec 2004
/sbin/hotplug [usb]
usb usb2: configuration #1 chosen from 1 choice
/sbin/hotplug [usb]
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
/sbin/hotplug [usb_device]
/sbin/hotplug [drivers]
/sbin/hotplug [module]
Initializing USB Mass Storage driver...
/sbin/hotplug [drivers]
usbcore: registered new driver usb-storage
USB Mass Storage support registered.
/sbin/hotplug [module]
/sbin/hotplug [drivers]
usbcore: registered new driver usblp
drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver
create network files..
IP=[dhcp], netmask=[], dgw=[], dns1=[], dns2=[]
killall: dhcpcd: no process killed
route: SIOC[ADD|DEL]RT: No such process
Configuration network interface: lo eth0
requesting DHCP  tout=30[s]
networking.sh: dhcp requesting...
DontDownIface
alwaysFork
eth0: link down
eth0: link up<5>, full duplex<5>, speed 100 Mbps<5>
sendto:  count 6   sync 1
sendto:  count 5   sync 0
sendto:  count 6   sync 0
dhcpcd.exe: interface eth0 has been configured with new IP=192.168.2.44 GATEWAY=192.168.2.1
** networking.sh dhcp fin.
configure files from Buffalo parameters.
Starting kernelmon:Starting clientUtil_server:starting on eth0
Starting daemonwatch:daemonwatch Ver.1.01
watch list file : /etc/daemonwatch.list
KERNELMOn (PSW_on)
No need to run drivecheck.sh
#[miconapl.boot_end]
Starting pid 1163, console /dev/ttyS0: '/sbin/getty'e.sh: 46: /usr/lo
KERNELMOn (lanact 0 half)
                         KERNELMOn (lanact 100 full)

BUFFALO INC. LinkStation series LS-HGL(SUININ)
LS-HGL-EM487 login: **** request DHCP
                                     PING 192.168.2.1 (192.168.2.1): 56 data bytes
  84 bytes from 192.168.2.1: icmp_seq=0 ttl=255 time=1.2 ms
                                                           84 bytes from 192.168.2.1: icmp_seq=1 ttl=255 time=0.4 ms
                                    84 bytes from 192.168.2.1: icmp_seq=2 ttl=255 time=0.4 ms
             84 bytes from 192.168.2.1: icmp_seq=3 ttl=255 time=0.4 ms
                                                                      84 bytes from 192.168.2.1: icmp_seq=4 ttl=255 time=0.4 ms

                                               --- 192.168.2.1 ping statistics ---
  5 packets transmitted, 5 packets received, 0% packet loss
                                                           round-trip min/avg/max = 0.4/0.5/1.2 ms
                  **** update DHCP IP

ファームウェアアップデータの実行

lshgl-107b.exe を実行し、
表示されたページにリンクされている LSUpdater.exe を実行、
LS-HGL-EM487 が見つかるので、「ファームウェア更新」を実行する。
「HDD のパーティション情報が確認できませんでした・・」には「はい」
しばらくして、、、
「LS-HGL のアップデートは完了しました」

セキュリティホールの確認

クラックを試みたが、LS-HGL ファームウェア 1.07 に 当該セキュリティホールはない

'09/5/6 追記
LS-HGL ファームウェア 1.07β には セキュリティホールが存在します。



LS-HGL
バッファローダイレクト
楽天市場
livedoor デパート
Sofmap
Yahoo!ショッピング
パソQ
ムラウチドットコム
ヤマダ電機WEB


まっさらにする
ハックの記録
LinkStation/玄箱 をハックしよう

まっさらにする

Copyright (C) 2003-2009 Yasunari Yamashita. All Rights Reserved.
yasunari @ yamasita.jp 山下康成@京都府向日市