FieldReport
From Zyxel Wiki
Field Report
In December 2007 I was looking for a network attached storage (NAS) backup solution with the following properties:
- Raid 1 support
- Sata II
- Gigabit ethernet
- SMB support
- NFS support
- Linux OS on the NAS
So I did some research on the web and the Zyxel NSA-220 seemed to be the perfect candidate, especially due to the information I found about the NFS support of the device on the US Zyxel website. So I bought one together with two 500GB harddisks.
Well, to my surprise there was no NFS support at all available for the device and my questions to the German and US American Zyxel support did not give me the feeling, that NFS support was about to be introduced by a new firmware update. A device running a Linux OS and not supporting NFS but only SMB made me angry, so I decided to try to get my own operating system running on it.
First of all the good news: the source code to create a new firmware is available for download. That is: Zyxel was forced by the copyleft nature of GPL to make the source code available, but apart from that they don't seem to be very interested to give further support. So since the sourcecode is available and the NSA-220 offers the possibility to upload new firmware via http, you can build your own kernel and upload it that way.
But be warned:
- Nobody guarantees the new firmware to be runnable on the device, especially Zyxel does not. If it is not, you will brick your device, that is: it won't boot anymore and thus you will loose the possibility to upload new firmware via http!
- It was reported, that someone bricked his device by simply building the new firmware according to the Readme file that comes with the firmware sources and uploading it via http interface. The reason for that is, that the build process needs root permission. If you start it as a non-root-user, the call to mknod in one of the scripts doing the build process will fail and thus create a buggy firmware image. Uploading this image will perfectly sure brick your device. So be careful: I currently have no idea, if there are more pitfalls during the build process. I will upload more detailed information about the build process, as soon as I start to replace the firmware by my own build, but I regret to do so, before I have an alternative access to the device.
To have a fallback you need an alternative access to the device, e.g. via serial interface. The hope is, that this will offer a possibility to up-/download firmware in a more basic way. So, if the device won't boot anymore, you still can upload a new firmware (e.g. the original firmware or your next compilation try) by connecting the NSA-220 via serial interface to another computer. As you surely noticed, there is no serial port to connect a serial cable to on the outside of the NSA-220, so the first thing to do is to find a serial port connector on the device's mainboard.
To locate the serial port connector, I took some photographs of the mainboard and tried to analyze it.
Here you can see the whole mainboard
and a detail of the area, where we think we located a serial port:
Mathuin here with an update on the serial port.
I emailed customer support because I wasn't as smart as the above contributor in that I tried to build and install the firmware. The firmware must be built as root or the mknod calls fail which means there's no useful /dev tree which means you'll brick your device if you're not careful. I was ... not careful. Anyway, I asked support whether that was indeed the serial port and they said that serial port was for factory use only. The second photo above shows a five-pin header with the fourth pin removed. The top pin had voltage, the middle pin oscillated as if it was TxD, the bottom pin I think is RxD, and the last pin is ground. My oscilloscope is acting up so I don't have any real useful information, but it did seem as if the serial port was at 115200 due to the approximate length of the bits. Good luck!
Mathuin, 2008 Mar 18
--
I connected the serial pins to a USB-to-serial adapter, set up Tera Term Pro for 115200 8N1, and started it up. The device spit out roughly 50k of binary spoo. I saved it to a file and will attach it to the wiki once I figure out how. I tried every other baud rate down to 9600 with 8N1 and 7E1 and no combination returned clean text. Work has a nicer oscilloscope which may be able to automatically decode the data that comes across. Stay tuned!
Mathuin, 2008 Mar 23
--
Hi Mathuin,
I posted a message to you to clarify some details.
Nonalignmentpact 17:17, 28 March 2008 (CDT)
I replied to your message, Nonalignmentpact, but I'll include the relevant information here for others:
The pin with voltage appears to have 3.3v as does the transmit data, so I'm going to wire up a small circuit using a [[1][Max3232]] chip to translate it to "normal" RS232 voltage levels. It's my hope that this will allow me to actually decode the values coming across the serial line. Looks like a trip to Fry's is in order!
Mathuin, 2008 Apr 02 --
i have written a little about serial ports on all these embedded devices. it might be helpful for you as well.
nc-main:General_NAS_customisation_guide#Getting_serial_access
Mindbender 20:20, 5 April 2008 (CDT)
--
Well, good news: Today (09.04.2008) I saw my Zyxel-NSA-220 booting via a serial line!
The details: The pin assignment is:
- 1 voltage
- 2 TxD
- 3 RxD
- 4 empty
- 5 ground
(assuming 1 denotes the upper pin on the above detailed photo). You need an adapter with a Max3232 chip to translate the 3.3V serial port on the Zyxel mainboard to a 12V standard serial port of a desktop computer. You only need to connect the lines TxD, RxD and ground to the corresponding pins on the Max3232 (that is: leave out the voltage pin, you don't need it)
Then you can use the minicom program on the desktop computer to see data on the serial line. Setup minicom to use your serial port (e.g. /dev/ttyS0), baudrate 115200 and parity bits 8N1. Then startup the NSA-220 and see the boot log messages fly by.
Next step is to find out about possible commands to be used to read and write the firmware of the Zyxel device. To be continued...
--
I added some more info to nc-main:General_NAS_customisation_guide#Creating_a_backup_of_the_flash regarding identifying the flash partitions and backing them up.
Mindbender 04:34, 11 April 2008 (CDT)
--
Hi, I was about to return my NSA220 when I could not find any information on how to hack it but after looking at your efforts, I have decided otherwise. Pleas take a look at this website as it may help you figure out how to hack this box. This NAS device also uses the Marvell processor and has similar specifications. http://www.openprotium.org/tiki-index.php?page_ref_id=35
