Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

login


user:root
pass:"" (blank, ENTER)


Maybe we can edit /etc/init.d so it stays without hdd?

Maybe possible make scroll.sh to usb key with telnet enable to /etc/init.d

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

sig 340 firmware can imstall mx on usb and start mx from usb. (insider info)

firmware update usb-top
usb -bottom for mx install

we need sig 340 firmware to see- what happening

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

Telnet Works great.

Some mounted filesystems read only.
Unsure about trying remount commands



I cannot get userfs.bin or rootfs.bin to dump properly.

ubuntu->

mkdir /media/userfs
mount -t cramfs -o loop /pathto/userfs.bin /media/userfs


Files show ok, and small (< 4Kb) extract fine. Files over 4KB look corrupted.
any idea?


I do not need to run MX from USB..

my suggestion was to build an upgrade file(scroll.sh) that edits /etc/init.d to enable telnet (is "system" filesystem always read only)
just like the hdd partioner you run before upgrade,
Enable telnet from DOK.

Files already play fine from USB and SMB, I do see why usb mx would be nice for all of you though. No hacking in a hdd! Less fun!

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

из местных линуксоидов мне кто-нибудь обьяснит суть этого взлома?
человек - врубить телнет при помощи апгрейда с усб-диска?
а какие плюсы в использовании телнет без МХ?

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

Cannot dump userfs.bin, rootfs.bin properly
files > 4Kb look corrupt.

I want to rebuild firmware packages with customizations in filesystem, IE: /system/logo.jpg

----------------------------
Here is some output from the STB
----------------------------
Character devices:
1 mem
2 pty/m%d
3 pty/s%d
4 vc/0
5 ptmx
7 vcs
10 misc
13 input
29 fb
90 mtd
101 nled
126 mum0
127 em8xxx
128 ptm
130 ir
136 pts/%d
162 raw
180 usb
204 ttyAM%d
205 cuaam%d

Block devices:
3 ide0
7 loop
31 mtdblock



iSTB-22[/bin]# cat /proc/ioports
00022398-00022398 : ide0
000223c0-000223c0 : ide0
000223c4-000223c4 : ide0
000223c8-000223c8 : ide0
000223cc-000223cc : ide0
000223d0-000223d0 : ide0
000223d4-000223d4 : ide0
000223d8-000223d8 : ide0
000223dc-000223dc : ide0
58000000-580000ff : Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+
58000000-580000ff : 8139too
58000400-5800041f : VIA Technologies, Inc. USB
58000400-5800041f : usb-uhci
58000420-5800043f : VIA Technologies, Inc. USB (#2)
58000420-5800043f : usb-uhci


iSTB-22[/bin]# cat /proc/loadavg
0.00 0.00 0.03 1/37 751



iSTB-22[/bin]# cat /proc/pci
PCI devices found:
Bus 0, device 1, function 0:
Ethernet controller: Realtek Semiconductor Co., Ltd. RTL-8139/8139C/8139C+ (rev 16).
IRQ 14.
Master Capable. Latency=32. Min Gnt=32.Max Lat=64.
I/O at 0x58000000 [0x580000ff].
Non-prefetchable 32 bit memory at 0x60120000 [0x601200ff].
Bus 0, device 2, function 0:
USB Controller: VIA Technologies, Inc. USB (rev 9.
IRQ 15.
Master Capable. Latency=32.
I/O at 0x58000400 [0x5800041f].
Bus 0, device 2, function 1:
USB Controller: VIA Technologies, Inc. USB (#2) (rev 9.
IRQ 15.
Master Capable. Latency=32.
I/O at 0x58000420 [0x5800043f].
Bus 0, device 2, function 2:
USB Controller: VIA Technologies, Inc. USB 2.0 (rev 101).
IRQ 15.
Master Capable. Latency=32.
Non-prefetchable 32 bit memory at 0x60120100 [0x601201ff].


iSTB-22[/bin]# cat /proc/prot
00000000-1fffffff: full access
20000000-3fffffff: full access
40000000-5fffffff: full access
60000000-7fffffff: full access
80000000-9fffffff: full access
a0000000-bfffffff: full access
c0000000-dfffffff: full access
e0000000-ffffffff: full access


iSTB-22[/bin]# cat /proc/stat
cpu 40363 0 174428 536860
cpu0 40363 0 174428 536860
page 114675 10120156
swap 0 0
intr 5888154 500500 4534 0 0 0 751607 2830 0 0 0 6787 0 6456 0 3330684 0 0 0 1284462 0 0 294 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
disk_io: (3,0)1281225,12848,182756,1268377,20240312)
ctxt 3088267
btime 0
processes 754
iSTB-22[/bin]# cat /proc/watchdog
enabled
timeout 500 msec
iSTB-22[/bin]# cat /proc/kmsg
<4>Linux version 2.4.22-em86xx-uc0-sigma (noam@gxk-lnx.softier1.local) (gcc version 3.4.6) #1 Thu Jun 5 12:35:20 IDT 2008
<4>Found bootloader memory map at 0x10000fc0.
<4>Processor: ARM pt110 revision 0
<4>Architecture: EM86XX
<4>Tango15 Rev B (kernel supports Rev B)
<4>Board name is generic2
<4>Linux SVN version: tag-92
<4>Board serial number: XXXXXXXXXXXXXXXX
<4>reserve 0x002100a0 bytes at 0x90090000
<4>reserve 0x00002000 bytes at 0x902a2000
<4>reserve 0x00090000 bytes at 0x90000000
<4>reserve 0x06000000 bytes at 0x91600000
<4>On node 0 totalpages: 15104
<4>zone(0): 14336 pages.
<4>zone(0): Set minimum memory threshold to 2912KB
<4>zone(1): 768 pages.
<4>zone(1): Set minimum memory threshold to 152KB
<4>zone(2): 0 pages.
<4>Kernel command line: root=/dev/mtdblock2 bl_ver=2 mtdroot=2
<4>Console: colour dummy device 80x30
<4>serial_em86xx: setup_console @ 115200
<4>Calibrating delay loop... 100.76 BogoMIPS
<6>System watchdog: early init
<6>Memory: 118MB = 118MB total
<5>Memory: 19152KB available (1416K code, 615K data, 80K init)
<6&gtentry cache hash table entries: 16384 (order: 4, 131072 bytes)
<6>Inode cache hash table entries: 8192 (order: 3, 65536 bytes)
<6>Mount cache hash table entries: 1024 (order: 0, 8192 bytes)
<6>Buffer cache hash table entries: 2048 (order: 0, 8192 bytes)
<4>Page-cache hash table entries: 16384 (order: 3, 65536 bytes)
<4>POSIX conformance testing by UNIFIX
<6>PCI: bus0: Fast back to back transfers disabled
<4>PCI: Configured EM86XX as a PCI slave with 128MB PCI memory
<4>PCI: Each Region size is 16384KB
<4>PCI: Reserved memory from 0x10000000 to 0x17000000 for DMA and mapped to 0x11000000
<6>Linux NET4.0 for Linux 2.4
<6>Based upon Swansea University Computer Society NET3.039
<4>Initializing RT netlink socket
<4>Start pushbutton monitor
<6>System watchdog: enabled and armed
<4>Starting kswapd
<6>devfs: v1.12c (2002081 Richard Gooch (rgooch@atnf.csiro.au)
<6>devfs: boot_options: 0x0
<5>JFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.
<4>pty: 256 Unix98 ptys configured
<6>ir: driver loaded (wait_period = 40ms, buffer_size = 6)
<6>ledman: Copyright (C) SnapGear, 2000-2003.
<6>loop: loaded (max 8 devices)
<6>8139too Fast Ethernet driver 0.9.27
<6>eth0: RealTek RTL8139 at 0x58000000, 00:18:2b:00:17:be, IRQ 14
<7>eth0: Identified 8139 chip type 'RTL-8100B/8139D'
<6>Uniform Multi-Platform E-IDE driver Revision: 7.00beta4-2.4
<6>ide: Assuming 33MHz system bus speed for PIO modes; override with idebus=xx
<4>EM86XX Bus Mastering IDE activated as ide0.
<4>Bounce buffer starts at 0x11580000
<4>hda: ST3320620A, ATA DISK drive
<4>IDE: Set drive 0 to Ultra DMA mode 2
<4>IDE: DMA enabled for ATA DISK hda
<4>ide0 at 0x223c0-0x223c7,0x22398 on irq 18
<4>hda: attached ide-disk driver.
<4>hda: host protected area => 1
<6>hda: 625142448 sectors (320073 MB) w/16384KiB Cache, CHS=38913/255/63
<6>Partition check:
<6> /dev/ide/host0/bus0/target0/lun0: p1 p2 p3
<6>SCSI subsystem driver Revision: 1.00
<6>Probing EM86XX Flash Memory
<5> Amd/Fujitsu Extended Query Table v1.3 at 0x0040
<5>number of CFI chips: 1
<7>cfi_cmdset_0002: using buffer write method
<5>cfi_cmdset_0002: Disabling fast programming due to code brokenness.
<4>mtd: active boot index:2
<5>Creating 6 MTD partitions on "EM86XX mapped flash":
<5>0x00480000-0x005c0000 : "RomFS"
<5>0x005c0000-0x008c0000 : "RootFS"
<5>0x00040000-0x00480000 : "Upgrade"
<5>0x00fe0000-0x01000000 : "Userpref"
<5>0x008c0000-0x00ec0000 : "UserFS"
<5>0x00ec0000-0x00fc0000 : "CfgFS"
<6>usb.c: registered new driver hub
<6>ehci_hcd 00:02.2: VIA Technologies, Inc. USB 2.0
<6>ehci_hcd 00:02.2: irq 15, pci mem 60120100
<6>usb.c: new USB bus registered, assigned bus number 1
<7>EHCI: Enabling VIA 6212 workarounds
<6>ehci_hcd 00:02.2: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
<6>hub.c: USB hub found
<6>hub.c: 4 ports detected
<6>host/usb-uhci.c: $Revision: 1.275 $ time 12:36:02 Jun 5 2008
<6>host/usb-uhci.c: High bandwidth mode enabled
<7>UHCI: Enabling VIA 6212 workarounds
<6>host/usb-uhci.c: USB UHCI at I/O 0x58000400, IRQ 15
<4>host/usb-uhci.c: Detected 2 ports
<6>usb.c: new USB bus registered, assigned bus number 2
<6>hub.c: USB hub found
<6>hub.c: 2 ports detected
<7>UHCI: Enabling VIA 6212 workarounds
<6>host/usb-uhci.c: USB UHCI at I/O 0x58000420, IRQ 15
<4>host/usb-uhci.c: Detected 2 ports
<6>usb.c: new USB bus registered, assigned bus number 3
<6>hub.c: USB hub found
<6>hub.c: 2 ports detected
<6>host/usb-uhci.c: v1.275:USB Universal Host Controller Interface driver
<6>usb.c: registered new driver hid
<6>hid-core.c: v1.8.1 Andreas Gal, Vojtech Pavlik <vojtech@suse.cz>
<6>hid-core.c: USB HID support drivers
<6>Initializing USB Mass Storage driver...
<6>usb.c: registered new driver usb-storage
<6>USB Mass Storage support registered.
<6>mice: PS/2 mouse device common for all mice
<6>Initializing Cryptographic API
<6>NET4: Linux TCP/IP 1.0 for NET4.0
<6>IP Protocols: ICMP, UDP, TCP, IGMP
<6>IP: routing cache hash table of 1024 buckets, 8Kbytes
<6>TCP: Hash tables configured (established 16384 bind 16384)
<6>NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
<4>VFS: Mounted root (cramfs filesystem) readonly.
<4>Freeing init memory: 80K
<3>Unknown IRQ10 happening, disabled (may get re-enabled later).
<4>mumk_register_tasklet: (0) tasklet 0x9132b640 status @0x9710a00c
<6>Journalled Block Device driver loaded
<7>jbd: max transaction buffers 8192 -> 1024
<6>kjournald starting. Commit interval 5 seconds
<6>EXT3-fs: mounted filesystem with ordered data mode.
<7>jbd: max transaction buffers 8192 -> 1024
<6>kjournald starting. Commit interval 3 seconds
<4>EXT3-fs warning: maximal mount count reached, running e2fsck is recommended
<6>EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,2), internal journal
<6>EXT3-fs: mounted filesystem with journal data mode.
<7>jbd: max transaction buffers 8192 -> 1024
<6>kjournald starting. Commit interval 3 seconds
<4>EXT3-fs warning: maximal mount count reached, running e2fsck is recommended
<6>EXT3 FS 2.4-0.9.19, 19 August 2002 on ide0(3,3), internal journal
<6>EXT3-fs: mounted filesystem with journal data mode.
<6>fb0: Mambo/Tango frame buffer device, not bound to any physical buffer yet
<6>Mambo/Tango frame buffer unbound.
<6>fb0: Mambo/Tango frame buffer device, using 1518K of video memory (17c840f4)
<7>ir: Enable NEC decoder (0x00000000)
<6>eth0: link down
<6>eth0: link up, 100Mbps, full-duplex, lpa 0xC5E1
<3> CIFS VFS: Send error in SessSetup = -13
<3> CIFS VFS: cifs_mount failed w/return code = -13

iSTB-22[/bin]# cat /proc/filesystems
nodev rootfs
nodev bdev
nodev proc
nodev sockfs
nodev pipefs
ext2
cramfs
nodev ramfs
vfat
nodev devfs
jffs2
nodev cifs
ext3

iSTB-22[/bin]# cat /proc/modules
mambolfb 7428 64
ext3 59892 3
jbd 43072 3 [ext3]
cifs 165256 0
em8xxx 1825676 1
llad 23712 1 [mambolfb em8xxx]

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

To: nitrogen14
Cуть простая - отрубить винт от приставки, подключить к линуховому компу и поправить один файл.
Я сделал это проще - через свой scroll.sh. Проблема в том, что у меня телнет не стартует и ошибку не пишет.

To: Emerica
Thanks for the info, good to know it is possible. I managed to make the first step in even more elegant way without the removal of the HDD, using my custom scroll.sh. So now I have full read/write access to /etc, /boot, /tmp and hidden /.system directories. The directory /system (without dot in front) is read-only internal flash memory and so far I haven't found a way to re-mount it read/write. My problem is - whatever I do, telnet does not start. Editing /boot/config.ini.ext as you suggested doesn't help either. How would you start it from the init script (e.g. /etc/init.d/S25custom)?

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

Can you please post me your scroll.sh file so I can test with that?

I have not had much luck with scroll file for other things and do not have jtag yet, or know if box is putting out serial info, inittab looks like serial getty is commented out.
But might still prove to be active?

I think looking at it now i added the lines to makesettings ext not config.ini

you can remount some partitions ie:usb and hdd

mount -o remount,rw /path/

Cramfs is readonly filesystem so userfs.bin and rootfs.bin can be mounted under linux

mount --o loop -t cramfs /path/to/userfs/userfs.bin /mountpath/

I have been able to mount, but files over 4KB are corrupted, can anyone verify?
You can use mkcramfs to generate files but feel it's unsafe if the above is true.
Maybe custom cramfs is used or special options need to be passed.

you can also edit the samba conf to enable access to / and other dirs as well as make some of them writable.

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

I think if you know how to free up or add a loop device the you could copy userfs.bin to STB HDD and mount it there, then dump the files.
take the files as is back into mkcramfs and md5 the result.

I tried to do the above but no loop device were availiable
i tried to umount /system in hopes it might free up one, but I'm not a linux guru :/

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

To: Emerica
Sorry for keeping silence that long, didn't have a chance to properly setup my new Linux box.
Can't upload my scroll.sh yet as it is very experimental at this stage and requires several reboots with different commands to make it working. Eventually I will make it available.
Regarding your >4k files issue - yes, I confirm that they are corrupted.
But there is a reason behind, straight from the README of CRAMFS:
Currently, cramfs must be written and read with architectures of the
same endianness, and can be read only by kernels with PAGE_CACHE_SIZE
== 4096.
So far I didn't manage to find out how to adjust the kernel's PAGE_CACHE_SIZE. Pls let me know if you did.

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

Thanks for the reply, I have been busy with work so havent had too much time to work on the box.

The page cache limit is somthing i think the kernel has to be compiled with or possibly patched? I could be totally wrong.

I had a quick Idea, though I'm not sure if it would work and don't have a setup right now to test. Would mounting to or from a ramdrive with a blocksize of 4096 do the trick?

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

Unfortunately I was wrong as the default PAGE_CACHE_SIZE is 4096 (at lest on my PC) and this could not be the reason for the files corruption. Must be something else...

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

To: Emerica
Finally managed to make telnet working. Your direct instructions did not work for my setup, but many thanks again for the info. It helped a lot. It seems that there is no problem to make telnet available via scroll.sh. It already works after a few steps, but I have to find out how to make it withing a single scroll.sh.

To: all
Телнет заработал, теперь все возможно, за исключением того, что смонтированно read-only.

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

а что смонтировано рид онли?
инструкцию по активации напишешь?

Re: Unlock Telnet on Sig-220 - HDD upgrade , usb possibly?

Ну, корневая директория смонтирована read-only. Ну вот собственно они все:
Те, которые (ro) - read-only, /dev/hda1 можно перемонтировать rw.

А насчет инструкции по активации, я уже точно не помню, но попробовать можно.
Копируешь приэттаченный scroll.sh на usb stick, вставляешь и перезагружаешь. Все должно делаться в MX_Engline режиме.
Ждешь минуты 2-3 и пробуешь пингануть приставку. Если все хорошо:
то можно идти дальше. При вытаскивании usb stick произойдет рестарт с правильным демонтированием всего, это лучше, чем отрубать питание. Редактируем scroll.sh и декомментируем эти 3 строчки:
, должно получится:
Вставляешь usb stick и перезагружаешь.
Ждешь минуты 3-4 и вытаскиваешь usb stick. После загрузки приставки, с PC идешь в ее самбин Video фолдер. Там должен появиться фолдер root а в нем etc.
Если все появилось, открываем etc/init.d/S80startapp в каком-нибудь нормальном редакторе (например http://notepad-plus.sourceforge.net), добавляем 2 строчки в конце после $ETC_PATH/makesettings и перед exit 0. Конец файла должен выглядеть так:
Крестимся и перезагружаем приставку.

Естественно, что никакой ответственности за вышеизложенное я не несу...
Тем более, что может я чего и забыл. Шансы убить приставку хоть и очень малы, но теоретически есть.