Gaining console access to the Gearbox

[BadIntentions]

So, after a bit of tinkering, I have managed to get console access to the gearbox. Using the proper tools, and gentle persuasion, I couldn't get it open. So I hit it with a mallet.

Either way, once you are inside, you will find an 8 pin header. 1 pin is ground, another 3.3+, the other four are JTAG (yay!) and the final 2 are serial. Using the J7 label as pin 1, Serial TX is on pin 7 and RX is on pin 8. You need a TTL converter, such as a nokia data cable.

Set your console application to 115200 baud, standard 8N1, and you are met with the console.



-==================================-
Boot Loader [LOADER32 1.20b]
Press <ESC> to enter extra mode
-==================================-

SB PCI reg 0x48 = 00078006
CPU ID: 0x0
Default MAC: 00:25:DD:00:15:91
Initialize MAC & PHY...OK.
Default IP: 169.254.0.1

Boot the kernel from 0x00F51000 ...




==========================================
CodeTek R32XX [NET Disk] R3282NTFS-1.06o
Hardware Version : 1007 Speed 150MHz
==========================================
System running!....
HTTPS_Task(): HTTPS Initial done, port 80.
SEARCH_Task(): SEARCH Initial done.
<UPNP> UPNPAV is UP.
CMD>DHCPS_Start:Detect another DHCP Server!
ITUNES_Task: Initial done.
UPNP_Task(): UPNP AV Initial done.
DHCPC: Bind IP (192.168.1.115) OK.
High Speed Device Attach
USB HUB device found at addr 1
ls
unknow commands - try [help]
CMD>help
Commands:
sys mem config help dir del cd
md rd pwd pci flash if ping
route arp net dhcps sntpc smtpc ide
ftps bt smb nas http usb


The firmware is most certainly NOT Linux. It appears to be a custom embedded OS. The boot loader seems specific to these chips. 'extras' mode let your TFTP data into it. Dangerous as all heck, since the boot loader is utterly unintelligent. Also, this firmware is broken, formatting a drive to NTFS causes it to segfault :D

[BadIntentions]

When upgrading firmware:


-==================================-
Boot Loader [LOADER32 1.20b]
Press <ESC> to enter extra mode
-==================================-

SB PCI reg 0x48 = 00078006
CPU ID: 0x0
Default MAC: 00:25:DD:00:15:91
Initialize MAC & PHY...OK.
Default IP: 169.254.0.1

Boot the kernel from 0x00F51000 ...




==========================================
CodeTek R32XX [NET Disk] R3282NTFS-1.06o
Hardware Version : 1007 Speed 150MHz
==========================================
System running!....
HTTPS_Task(): HTTPS Initial done, port 80.
SEARCH_Task(): SEARCH Initial done.
<UPNP> UPNPAV is UP.
CMD>DHCPS_Start:Detect another DHCP Server!
ITUNES_Task: Initial done.
UPNP_Task(): UPNP AV Initial done.
DHCPC: Bind IP (192.168.1.115) OK.
High Speed Device Attach
USB HUB device found at addr 1
High Speed Device Attach
USB Mass Storage device found at addr 2
USBMS_DataErrorHandle -32
clearing endpoint halt for pipe 0xC0008280
USBMS_DataErrorHandle(): device NAKed or unknown error
USBMS CSW error US_BULK_STAT_FAIL
out err: 0 4
IDE_Read: lba over HD's limit 6291519?
IDE_GetRBuf: read fail!!
NTFS_GetINODEByID: magic 0x7FEF33FF error nid 0!
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0xB737B33F error nid 3!
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
NTFS_GetBoot: cannot get root cluster!
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x81BA20A3 error nid 6!
NTFS_GetBoot: cannot get bitmap cluster!
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
fail!
NTFS initial done.
SOAP_Task(): SOAP Initial done.
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
<FTPS> create C:\PUBLIC folder fail! -1
SMB_Task(): SMB Initial done.
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
warning!!, read lba 60003F not complete
NTFS_GetINODEByID: magic 0x21313322 error nid 5!
NTFS_GetDirNodeByID: buf error
HTTPS_Input(): file favicon.ico not found!
HTTPS_Input(): file favicon.ico not found!
HandlePost(): cgi redirect=man_firm.htm.
HandlePost(): cgi failure=fail.htm.
HandlePost(): cgi type=file_upload.
HandlePost(): cgi filename=GearBox_FW_1.3.bin.
HandlePost(): Kernel Size is 524284.
Write to flash 0xFFF50000
Start programming 524284..........ok 0
HandlePost(): Web Size is 250325.
Write to flash 0xFFF00000
Start programming 250325......ok 0
HTTPS_Input(): file favicon.ico not found!
HTTPS_Input(): file favicon.ico not found!
HTTPS_Input(): file favicon.ico not found!
HTTPS_Input(): file favicon.ico not found!
System rebooting!...

-==================================-
Boot Loader [LOADER32 1.20b]
Press <ESC> to enter extra mode
-==================================-

SB PCI reg 0x48 = 00078006
CPU ID: 0x0
Default MAC: 00:25:DD:00:15:91
Initialize MAC & PHY...OK.
Default IP: 169.254.0.1

Boot the kernel from 0x00F51000 ...




==========================================
CodeTek R32XX [NET Disk] R3282-1.56b
Hardware Version : 1007 Speed 150MHz
==========================================
System running!....
PPP software module initialization
HTTPS_Task(): HTTPS Initial done, port 80.
Line print server listening at port 515...
SEARCH_Task(): SEARCH Initial done.
Wait IDE device ready...DHCPS_Start:Detect another DHCP Server!
DHCPC: Bind IP (192.168.1.115) OK.
High Speed Device Attach
USB HUB device found at addr 1
High Speed Device Attach
USB Mass Storage device found at addr 2
IDE[0] Can not handle partition with NTFS id=07
IDE[0] Master without any partition (== 0)
USBMS unformated

<UPNP> UPNPAV is UP.
CMD>ITUNES_Task: Initial done.
SOAP_Task(): SOAP Initial done.
UPNP_Task(): UPNP AV Initial done.
FS_OpenDir: device not found!
SMB_Task(): SMB Initial done.
<FTPS> create C:\PUBLIC folder fail! -1021

[crackedatom]

Nice job there ;).Considered doing that with mine after I cracked it open a few months ago, but forgot about it after I put together a FreeNAS box.
Still hoping someone can get another OS working on it similar to SnakeOS tho

[BadIntentions]

Nice job there ;).Considered doing that with mine after I cracked it open a few months ago, but forgot about it after I put together a FreeNAS box.
Still hoping someone can get another OS working on it similar to SnakeOS tho

Rather unlikely. SnakeOS is made for a different architecture, and there is essentially no storage on the damn thing. I built redboot, and have it booting OpenEmbedded Linux. It requires JTAG cabling and a vendor only JTAG tool (which i doubt patriot has) to change the loader out. The internal flash is 512KB, so i have to boot from a USB stick. Then it rather quickly runs out of RAM :P At this point, there isn't anywhere to go. Getting this far is already beyond what most users have the ability to do, and going further requires even more specialized tools (i guess i COULD solder some more ram chips to it...)

[ne1]

Good work. Interesting to see the errors in the NTFS stuff.

Anyway to see what they are doing with the "itunes" stuff. I have never gotten it to work the way I thought it should.


Please post anymore info you find.

[BadIntentions]

Good work. Interesting to see the errors in the NTFS stuff.

Anyway to see what they are doing with the "itunes" stuff. I have never gotten it to work the way I thought it should.


Please post anymore info you find.

In the NTFS firmware, attempting for format my test drive resulted in an instant segfault. Essentially, it is the blue screen of death for embedded devices. It would stop responding until restarted.

Attempting to scan a properly NTFS formatted drive resulted in the unit segfaulting.

The Itunes stuff (properly called DAAP) is not something i use, but i will investigate it some when i get time. At this point, modifying the firmware to do anything interesting seems to be out of the question.