ude:~# tail -f /var/log/messages : : Mar 23 17:40:24 ude kernel: usb 2-1: new high speed USB device using ehci_platform and address 6 Mar 23 17:40:24 ude kernel: usb 2-1: configuration #1 chosen from 1 choice Mar 23 17:40:24 ude kernel: scsi6 : SCSI emulation for USB Mass Storage devices Mar 23 17:40:29 ude kernel: Vendor: WDC WD50 Model: WD-WCASY2179139 Rev: 3B01 Mar 23 17:40:29 ude kernel: Type: Direct-Access ANSI SCSI revision: 02 Mar 23 17:40:29 ude kernel: SCSI device sdb: 976773168 512-byte hdwr sectors (500108 MB) Mar 23 17:40:29 ude kernel: sdb: Write Protect is off Mar 23 17:40:29 ude kernel: SCSI device sdb: 976773168 512-byte hdwr sectors (500108 MB) Mar 23 17:40:29 ude kernel: sdb: Write Protect is off Mar 23 17:40:29 ude kernel: sdb: sdb1 sdb2 sdb4 < sdb5 sdb6 > Mar 23 17:40:29 ude kernel: sd 6:0:0:0: Attached scsi disk sdb Mar 23 17:40:29 ude kernel: sd 6:0:0:0: Attached scsi generic sg1 type 0正常に、sdb と認識された。
ude:~# mkdir /tmp/boot mkdir: cannot create directory `/tmp/boot': File exists ude:~# mount /dev/sdb1 /tmp/boot ude:~# ls /tmp/boot conf_save.tgz initrd.buffalo log.tgz uImage.buffalo hddrootfs.buffalo.updated.done initrd.gz u-boot.buffalo ude:~#
ude:~# cd /tmp/boot ude:/tmp/boot# mkdir /srv/tftp/LS-CL_1.07 ude:/tmp/boot# tar cf - initrd.buffalo uImage.buffalo |(cd !$; tar xvf -) tar cf - initrd.buffalo uImage.buffalo |(cd /srv/tftp/LS-CL_1.07; tar xvf -) initrd.buffalo uImage.buffalo ude:/tmp/boot#
ude:/tmp/boot# cd / ude:/# umount /tmp/boot ude:/#USB ケーブルを抜く。
ude:/# cd /srv/tftp/ ude:/srv/tftp# ls -l total 7508 drwxr-s--- 2 yasunari root 48 Mar 22 10:12 HS-DHGL_1.20 drwxrwxr-x 2 root root 48 Jan 24 09:31 LS-CL+HackKit drwxr-sr-x 2 root root 48 Mar 23 17:44 LS-CL_1.07 drwxrwxr-x 2 yasunari root 48 Mar 20 14:32 LS-GL_1.15 drwxr-sr-x 2 root root 48 Mar 23 14:22 LS-HGL_1.07b drwxr-sr-x 2 root root 48 Mar 23 13:31 LS-LGL_2.01 drwxrwxr-x 2 root root 48 Feb 20 12:00 LS-QL_1.05+telnet drwxrwxr-x 2 root root 48 Jan 24 18:00 LS-XHL_1.02 drwxrwxr-x 2 root root 64 Jan 24 22:17 LS-XHL_1.02+telnet -rw-r--r-- 2 root root 5969136 Dec 27 13:23 initrd.buffalo -rw-r--r-- 2 root root 1715900 Dec 30 16:50 uImage.buffalo ude:/srv/tftp# ls -l LS-CL_1.07/ total 8952 -rw-r--r-- 1 root root 7048817 Feb 23 17:14 initrd.buffalo -rw-r--r-- 1 root root 2115636 Mar 15 11:37 uImage.buffalo ude:/srv/tftp#特に問題なく読めそうだ。
ude:/srv/tftp# ls HS-DHGL_1.20 LS-GL_1.15 LS-QL_1.05+telnet initrd.buffalo LS-CL+HackKit LS-HGL_1.07b LS-XHL_1.02 uImage.buffalo LS-CL_1.07 LS-LGL_2.01 LS-XHL_1.02+telnet ude:/srv/tftp# rm initrd.buffalo uImage.buffalo ude:/srv/tftp# ln LS-CL_1.07/* . ude:/srv/tftp# ls -l total 8952 drwxr-s--- 2 yasunari root 48 Mar 22 10:12 HS-DHGL_1.20 drwxrwxr-x 2 root root 48 Jan 24 09:31 LS-CL+HackKit drwxr-sr-x 2 root root 48 Mar 23 17:44 LS-CL_1.07 drwxrwxr-x 2 yasunari root 48 Mar 20 14:32 LS-GL_1.15 drwxr-sr-x 2 root root 48 Mar 23 14:22 LS-HGL_1.07b drwxr-sr-x 2 root root 48 Mar 23 13:31 LS-LGL_2.01 drwxrwxr-x 2 root root 48 Feb 20 12:00 LS-QL_1.05+telnet drwxrwxr-x 2 root root 48 Jan 24 18:00 LS-XHL_1.02 drwxrwxr-x 2 root root 64 Jan 24 22:17 LS-XHL_1.02+telnet -rw-r--r-- 2 root root 7048817 Feb 23 17:14 initrd.buffalo -rw-r--r-- 2 root root 2115636 Mar 15 11:37 uImage.buffalo ude:/srv/tftp#
Orion1 CPU = Low Checking DATA BUS Checking ADDRESS BUS > Checking hardware info ... === CPU-ID : 0x00005182 === === Strap status : 0x01000030 === === H/W boardId : 0x43 === === boardId : 0x1e === === micon_support: off === > OK. === BUFFALO LS-CL/CHL U-Boot. === ** LOADER ** ** BUFFALO BOARD: BUFFALO_BOARD_LS_CL LE (CFG_ENV_ADDR=fffff000) U-Boot 1.1.1 (Sep 16 2008 - 14:54:32) Marvell version: 1.12.1 - TINY Buffalo Version: 1.22-1.00 DRAM CS[0] base 0x00000000 size 128MB DRAM Total size 128MB [256kB@fffc0000] Flash: 256 kB Addresses 20M - 0M are saved for the U-Boot usage. Mem malloc Initialization (20M - 16M): Done Soc: 88F5182 A2 CPU: ARM926 (Rev 0) running @ 400Mhz --------------------------- init_board_info(0) Orion 1 streaming disabled SysClock = 200Mhz , TClock = 166Mhz USB 0: host mode PCI 0: PCI Express Root Complex Interface PCI 1: Conventional PCI, speed = 33000000 Net: egiga0 [PRIME] Using 88E1118 phy buffalo_change_power_status > Read 0x00 buffalo_IsStopAtUbootStatus > MagicKey=0x00 buffalo_change_power_status > Read 0x00 buffalo_change_power_status > Read 0x00 buffalo_change_power_status > Writing 0x5c Please Press HDD power button to continue ...電源 SW を ON にする。
buffalo_change_power_status > Read 0x5c buffalo_change_power_status > Writing 0x3a Marvell Serial ATA Adapter Integrated Sata device found Device 0: OK Model: Maxtor 6Y160M0 Firm: YAR51HW0 Ser#: Y48CANLE Type: Hard Disk Supports 48-bit addressing Capacity: 156334.5 MB = 152.6 GB (320173056 x 512) Using device ide0, partition 1 ** Bad partition 1 ** serch_boot_drv (194)>No kernel_file 0 Using device ide0, partition 1 ** Bad partition 1 ** serch_boot_drv (249)>No init_file 0 Using device ide1, partition 1 ** Bad partition 1 ** serch_boot_drv (194)>No kernel_file 1 Using device ide1, partition 1 ** Bad partition 1 ** serch_boot_drv (249)>No init_file 1 Lost all init_rdfunc SW を押す。
func switch pushed, and exited loop wait until func switch released. Marvell Serial ATA Adapter Integrated Sata device found Using device ide0, partition 1 ** Bad partition 1 ** serch_boot_drv (194)>No kernel_file 0 Using device ide0, partition 1 ** Bad partition 1 ** serch_boot_drv (249)>No init_file 0 Using device ide1, partition 1 ** Bad partition 1 ** serch_boot_drv (194)>No kernel_file 1 Using device ide1, partition 1 ** Bad partition 1 ** serch_boot_drv (249)>No init_file 1 hit any key to switch tftp boot. Hit any key to stop autoboot: 0 Using egiga0 device TFTP from server 192.168.2.38; our IP address is 192.168.2.47 Filename 'uImage.buffalo'. Load address: 0x100000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ######################## done Bytes transferred = 2115636 (204834 hex) Using egiga0 device TFTP from server 192.168.2.38; our IP address is 192.168.2.47 Filename 'initrd.buffalo'. Load address: 0x800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############ done Bytes transferred = 7048817 (6b8e71 hex) ## Booting image at 00100000 ... Image Name: Linux-2.6.22.7 Created: 2009-02-23 8:13:25 UTC Image Type: ARM Linux Kernel Image (uncompressed) Data Size: 2115572 Bytes = 2 MB Load Address: 00008000 Entry Point: 00008000 Verifying Checksum ... OK OK ## Loading Ramdisk Image at 00800000 ... Image Name: initrd Created: 2009-02-23 8:14:29 UTC Image Type: ARM Linux RAMDisk Image (gzip compressed) Data Size: 7048753 Bytes = 6.7 MB Load Address: 00000000 Entry Point: 00000000 Verifying Checksum ... OK Starting kernel ... arg:console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.22 tftpboot=yes CONFIG_BUFFALO_PLATFORM --- Uncompressing Linux..................................................................................................................................... done, booting the kernel. Linux version 2.6.22.7 (root@build2.dd-hot24.nas.buffalo.local) (gcc version 4.2.0 20070413 (prerelease)) #369 Mon Feb 23 17:13:17 JST 2009 CPU: ARM926EJ-S [41069260] revision 0 (ARMv5TEJ), cr=a0053177 Machine: Feroceon Using UBoot passing parameters structure Memory policy: ECC disabled, Data cache writeback CPU0: D VIVT write-back cache CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets Built 1 zonelists. Total pages: 32512 Kernel command line: console=ttyS0,115200 root=/dev/sda2 rw initrd=0x00800040,15M panic=5 BOOTVER=1.22 tftpboot=yes PID hash table entries: 512 (order: 9, 2048 bytes) Console: colour dummy device 80x30 Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 128MB 0MB 0MB 0MB = 128MB total Memory: 110136KB available (3828K code, 294K data, 120K init) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16 env_format_version = 0x00000006 product_id = 0x0000000F Sys Clk = 200000000, Tclk = 166664740 CPU Interface ------------- SDRAM_CS0 ....base 00000000, size 128MB SDRAM_CS1 ....disable SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e0000000, size 128MB PEX0_IO ....base f2000000, size 1MB PCI0_MEM ....base e8000000, size 128MB PCI0_IO ....base f2100000, size 1MB INTER_REGS ....base f1000000, size 1MB DEVICE_CS0 ....no such DEVICE_CS1 ....base f4000000, size 32MB DEVICE_CS2 ....no such DEV_BOOCS ....base ff800000, size 8MB CRYPT_ENG ....base f0000000, size 64KB Marvell Development Board (LSP Version 3.0.5_NAS_GDP_p8)-- BUFFALO_BOARD Soc: 88F5182 A2 Detected Tclk 166664740 and SysClk 200000000 Marvell USB EHCI Host controller #0: c055b600 Marvell USB EHCI Host controller #1: c055b400 IO Request resource failed - Pci If 0 PCI: bus0: Fast back to back transfers enabled PCI: bus1: Fast back to back transfers enabled SCSI subsystem initialized Time: orion_clocksource clocksource has been installed. NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) TCP reno registered checking if image is initramfs...it isn't (no cpio magic); looks like an initrd Freeing initrd memory: 15360K RTC has been updated!!!RTC registered mvCesaInit: sessions=640, queue=64, pSram=f0000000 Use the XOR engines (acceleration) for enhancing the following functions: o RAID 5 Xor calculation o kernel memcpy o kenrel memzero o copy user to/from kernel buffers Number of XOR engines to use: 2 Use IDMA channels 2 and 3 for enhancing the following function: VFS: Disk quotas dquot_6.5.1 Dquot-cache hash table entries: 1024 (order 0, 4096 bytes) SGI XFS with ACLs, large block numbers, no debug enabled SGI XFS Quota Management subsystem io scheduler noop registered (default) io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled serial8250: ttyS1 at MMIO 0x0 (irq = 4) is a 16550A serial8250.0: ttyS0 at MMIO 0xf1012000 (irq = 3) is a 16550A serial8250.0: ttyS2 at MMIO 0xf1012100 (irq = 4) is a 16550A RAMDISK driver initialized: 3 RAM disks of 32768K size 1024 blocksize loop: module loaded Marvell Ethernet Driver 'mv_ethernet': o Uncached descriptors in DRAM o DRAM SW cache-coherency o TCP segmentation offload enabled o Checksum offload enabled o Rx desc: 128 o Tx desc: 256 o Loading network interface ** eth_init_module (0) 'eth0' Intergrated Sata device found scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter scsi 0:0:0:0: Direct-Access Maxtor 6Y160M0 YAR5 PQ: 0 ANSI: 5 sd 0:0:0:0: [sda] 320173056 512-byte hardware sectors (163929 MB) sd 0:0:0:0: [sda] Write Protect is off sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA sd 0:0:0:0: [sda] 320173056 512-byte hardware sectors (163929 MB) sd 0:0:0:0: [sda] Write Protect is off sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA sda: sd 0:0:0:0: [sda] Attached SCSI disk sd 0:0:0:0: Attached scsi generic sg0 type 0 physmap platform flash device: 01000000 at f0000000 physmap-flash physmap-flash.0: map_probe failed Found: SST 39LF020 cfi_flash_0: Found 1 x8 devices at 0x0 in 8-bit bank number of JEDEC chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. cmdlinepart partition parsing not available mice: PS/2 mouse device common for all mice md: raid0 personality registered for level 0 md: raid1 personality registered for level 1 raid6: int32x1 20 MB/s raid6: int32x2 28 MB/s raid6: int32x4 35 MB/s raid6: int32x8 31 MB/s raid6: using algorithm int32x4 (35 MB/s) md: raid6 personality registered for level 6 md: raid5 personality registered for level 5 md: raid4 personality registered for level 4 raid5: measuring checksumming speed arm4regs : 304.000 MB/sec 8regs : 249.200 MB/sec 32regs : 270.800 MB/sec raid5: using function: arm4regs (304.000 MB/sec) Kernel event proc (C) BUFFALO INC. V.1.00 installed. MICON ctrl (C) BUFFALO INC. V.1.00 installed. Buffalo CPU Inerupts Driver (C) BUFFALO INC. Ver.0.01 alpha1 installed. Buffalo Gpio Control Driver (C) BUFFALO INC. Ver.0.02 installed. TCP cubic registered NET: Registered protocol family 1 NET: Registered protocol family 17 md: Autodetecting RAID arrays. md: autorun ... md: ... autorun DONE. RAMDISK: Compressed image found at block 0 VFS: Mounted root (ext2 filesystem). ---- in linuxrc --- Version 1.00 2008/ 7/ 1 Thu Nov 1 00:00:00 JST 2007 Thu Nov 1 00:00:00 JST 2007 CheckDevices grep: /var/tmp/devlink: No such file or directory linuxrc:choose operation (timeout 4[s]) 1:RamRoot other:HddRoot ? -HddRoot- Starting :fsck_disks(boot) ... [Failed. ] Starting :fsck_disks(rootfs) ... [Success.] Starting :mount(boot) ... [Failed. ] mount: mounting /dev/sda2 on /mnt failed: No such device or address mount: mounting /dev/sda2 on /mnt failed: No such device or address umount: cannot open /proc/mounts Freeing init memory: 120K init started: BusyBox v1.7.0 (2007-10-15 19:49:46 IST) starting pid 327, tty '': '/etc/init.d/rcS' --- rcStart (initrd) --- chmod: /home: No such file or directory grep: /var/tmp/devlink: No such file or directory swapon: /dev/sda5: No such device or address create dir : /home create dir : /var/www This model doesn't support raid!!! umount: cannot umount /boot: Invalid argument mkdir: cannot create directory '/boot': File exists mount: mounting /dev/sda1 on /boot failed: No such device or address mdadm: error opening /dev/sda1: No such device or address mdadm: error opening /dev/sda2: No such device or address mdadm: error opening /dev/sda5: No such device or address configure files from Buffalo parameters. mount: mounting /dev/sda1 on /boot failed: No such device or address Restore previous configuration files /bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory /bin/tar: Error is not recoverable: exiting now /bin/tar: Child returned status 2 /bin/tar: Error exit delayed from previous errors /bin/tar: /boot/conf_save.tgz: Cannot open: No such file or directory /bin/tar: Error is not recoverable: exiting now /bin/tar: Child returned status 2 /bin/tar: Error exit delayed from previous errors unzip fail. umount: cannot umount /boot: Invalid argument rootfs on / type rootfs (rw) /dev/root.old on / type ext2 (rw) proc on /proc type proc (rw) sysfs on /sys type sysfs (rw) devpts on /dev/pts type devpts (rw) /dev/ram1 on /mnt/ram type tmpfs (rw) PID Uid VSZ Stat Command 1 root 3364 S init 2 root SW< [kthreadd] 3 root SWN [ksoftirqd/0] 4 root SW< [events/0] 5 root SW< [khelper] 32 root SW< [kblockd/0] 45 root SW [crypto] 46 root SW [crypto_ret] 49 root SW [pdflush] 50 root SW [pdflush] 51 root SW< [kswapd0] 52 root SW< [aio/0] 53 root SW< [xfslogd/0] 54 root SW< [xfsdatad/0] 242 root SW< [scsi_eh_0] 243 root SW< [scsi_eh_1] 253 root SW< [mtdblockd] 326 root 3364 S init 327 root 2400 S /bin/sh /etc/init.d/rcS 607 root 2740 R /bin/sh /etc/init.d/restore_config.sh start 623 root 3368 R ps mv: cannot rename '/tmp/info': No such file or directory /etc/init.d/networking.sh : Clear /etc/dhcpc/dhcpcd-eth0.pid eth0 /etc/init.d/networking.sh : Read dhcpc file eth0 /etc/init.d/networking.sh : configure : eth0 create network files.. (eth0) IP=[dhcp], netmask=[], dgw=[], dns1=[], dns2=[] /etc/init.d/networking.sh : Delete /etc/dhcpc/dhcpcd-eth0.pid route: SIOCDELRT: No such process Configuration network interface: eth0 /sbin/ifconfig eth0 mtu 1500 multicast /etc/init.d/networking.sh: line 373: /proc/sys/net/ipv4/conf/eth1/arp_ignore: No such file or directory requesting DHCP tout=30[s] networking.sh: dhcp requesting... DontDownIface alwaysFork eth reg(9) val=0x0300 eth0: link down eth0: link up, full duplex, speed 100 Mbps sendto: count 6 sync 1 sendto: count 5 sync 0 sendto: count 6 sync 0 dhcpcd.exe: interface eth0 has been configured with new IP=192.168.2.47 GATEWAY=192.168.2.1 ** eth0 : networking.sh dhcp fin. configure files from Buffalo parameters. Starting system logger: Starting kernel logger: Starting kernelmon:usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb ehci_marvell ehci_marvell.4523: Marvell Orion EHCI ehci_marvell ehci_marvell.4523: new USB bus registered, assigned bus number 1 ehci_marvell ehci_marvell.4523: irq 17, io base 0xf1050100 ehci_marvell ehci_marvell.4523: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb1: configuration #1 chosen from 1 choice hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected KERNELMOn (lanact 0 half) ehci_marvell ehci_marvell.167817: Marvell Orion EHCI ehci_marvell ehci_marvell.167817: new USB bus registered, assigned bus number 2 ehci_marvell ehci_marvell.167817: irq 12, io base 0xf10a0100 ehci_marvell ehci_marvell.167817: USB 2.0 started, EHCI 1.00, driver 10 Dec 2004 usb usb2: configuration #1 chosen from 1 choice hub 2-0:1.0: USB hub found hub 2-0:1.0: 1 port detected USB Universal Host Controller Interface driver v3.0 Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. usbcore: registered new interface driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver KERNELMOn (lanact 100 full) Starting clientUtil_server:starting on eth0 Starting daemonwatch:daemonwatch Ver.1.01 watch list file : /etc/daemonwatch.list No need to run drivecheck.sh /etc/init.d/networking.sh : Clear /etc/dhcpc/dhcpcd-eth0.pid eth0 /etc/init.d/networking.sh : Read dhcpc file eth0 /etc/init.d/bootcomplete.sh: line 54: /usr/local/bin/sendmail.sh: No such file or directory starting pid 844, tty '': '/sbin/getty' BUFFALO INC. LinkStation series LS-CL-EM701 login: KERNELMOn (PSW_on) cat: can't open '/var/run/pmcd.pid': No such file or directory kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec] killall: pmcd_exec.sh: no process killed Shutting down pwrmgr: killall: pwrmgr: no process killed
'09/5/6 追記
LS-CL ファームウェア 1.07 には
セキュリティホールが存在します。
|
← まっさらにする |
ハックの記録 LinkStation/玄箱 をハックしよう |
→ まっさらにする |