Mount everything, Homebrew with sshfs.

Publié le par
3

This first Homebrew is a Proof of concept for mounting any filesytem network,
even through the internet.

It is not possible to add functionalities to the proprietary WDTV software interface.
The sources of this software are not distributed by Western. Nevertheless, the whole environment around the interface software is open source. We will therefore modify the scripts called by the OSD. When you select the “Local Server” and “NFS” functions,
the OSD uses the /bin/find_nfs_server.sh, then /bin/find_nfs_share_folder.sh scripts.
Modifying these scripts to return other information than the NFS servers, will allow us
to add new servers and protocols / filesystems to the OSD interface. Once all the parameters are recovered by the OSD, everything is sent to the mount command.

Now let me introduce Busybox. Busybox is a toolkit containing many Linux programs. This is a quick and effective way to get a working system. Busybox can be used in two ways: By calling the command wanted behind Busybox, or by creating a symbolic link.
The mount command is a symbolic link to the BusyBox binary.
By replacing the symbolic link mount by a script, it is possible to intercept the parameters passed by the OSD to the mount command, manipulate or override these settings, and finally call the busybox mount command with the modified settings.

This Homebrew integrates all the binaries needed to run sshfs. You don’t need to recompile all the binaries and libraries. The processor architecture is the same as the other WDTV versions, so you can re-use all binaries that do not use a specific hardware.

The /bin/find_nfs_server.sh and /bin/find_nfs_share_folder.sh scripts have been modified to read the file /conf/server and add the resulting contents to the OSD.

The symbolic link mount has been replaced to run sshfs if the server name is given in the /conf/server file. If this is not the case, the busybox mount command is called seamlessly.
Authentification is based on a rsa_id key and must be placed in /conf.
The /etc/ssh/ssh_config file automatically adds new servers in the /conf/known_hosts without prompting.

Files added to the Homebrew from the compilation 1.05.14_G base are available here. There is no need to recompile all sources : just add files in the PALACE_1.05.14_G/build/root folder then the execute the make firmware command to rebuild the firmware.

The complete firmware including sshfs and phpShell is available here.

If something goes wrong, the /tmp/mount file includes the sshfs command executed by the mount script. You can try to execute the command manually.

Warning: Changing the mount command is very dangerous. If it does not work,
your WDTV will be bricked. Test your mount script by creating a clone of the /bin folder on a USB key. Then mount this file instead of the original /bin folder using
the mount -o bind /media/USB/nameofyourkey/bin /bin command.

By using these scripts as an operating model, you can adapt them to mount any local or network file system on any IP, yet controlled by the OSD interface.

Thanks go to Elrick for the mount script tip.

Easy shell : PHPShell

Publié le par
6

The first thing to do to when you want to start developing on the WDTV
is to connect to the shell.

Using telnet or ssh requires a fresh new compiling of Busybox and activating
many options. A much faster way is to use the integrated PHP server to add a web shell. This solution is not perfect but does not require compiling code. The base functions allow you to run most of commands. The only limitation is with commands requesting
a confirmation. The shell input must then be done using the JTAG …

PhpShell is very quick to install. Download and unzip the archive phpShell-2.4.zip in the ~ / wdtvgen3/PALACE_1_05_18_G/build/root/webserver/htdocs/ (see the post First compiled GLP code)

rename the folder phpShell-2.4 to phpShell

Edit config.php to add your login / password
[users]
admin = "wdtvgen3"

Restart the command make firmware

Flash your WDTV Live. You can now connect to the shell with the address http://ip_of_wdtv/phpshell/phpshell.php

Unbrick of the death !

Publié le par
8

If your WDTV reboots or restarts blocked, it is because your flash failed.
But there is a solution (that doesn’t work in all cases but will allow you to take control via JTAG) !

To force the flash, you will have to invalidate the primary file system !

You must remove the motherboard from the case. Then desolder the metal shield.
You must use a high power soldering iron if the heat is absorbed by the metal plate. Personally, I use a mini torch.

Then you have to solder a wire on a pin of the “Chip Enable” flash chipset. (Use a low power iron soldering now).

The wire must be long enough to go around the mainboard and touch the VCC jtag pin.

Now it should boot without touching for now. This is what the JTAG displays :

Reading NAND CS0, addr 0x01280000, size 0x00000800 to 0xb5ffbfc0
Reading NAND CS0, addr 0x01280800, size 0x003aac00 to 0xb5ffc7c0

There are tree reading operations.
Reading NAND CS0, addr 0x00d80000, size 0x00000800 to 0xb63fbfe0
Reading NAND CS0, addr 0x00d80800, size 0x00022400 to 0xb63fc7e0
Reading zboot
....
Reading NAND CS0, addr 0x01280000, size 0x00000800 to 0xb5ffbfc0
Reading NAND CS0, addr 0x01280800, size 0x003aac00 to 0xb5ffc7c0
Reading primary file system
....
Reading NAND CS0, addr 0x00780000, size 0x00000800 to 0x01840000
Reading NAND CS0, addr 0x00780800, size 0x00402400 to 0x01840800
Reading secondary file system

The readings two and tree only take tree second. You must then operate during the second reading, then make the wire touch the VCC for less than a half of a second. The primary filesystem MD5 will be invalid. The WDTV will then directly boot to the secondary file system but will only partially execute the init script.

You should now get the jtag bash. If this is not the case, it’s very bad !
Insert the USB drive with the homebrew and run the command ./init upgrade.
Wait, reboot and flash.

I performed this only two times, but both flawlessly.

Good luck !