Debian on 325

This page provides a series of simple steps which new hacker can follow to turn their Zyxel NSA325 into a cost effective Hacking platform.

=NSA325=

The NSA325 is a very nice piece of hardware. It has:
 * Marvell Kirkwood CPU running at 1600MHz.
 * 512MiB RAM
 * 128MiB Flash ROM
 * Gigabit NIC
 * 1 USB 3.0 Port and 2x USB 2.0 ports
 * Room for 2 Internal HDDS with SATA II

For those experienced with the Raspberry PI or BeagleBone Black you will see many similarities.

Serial Cable
A serial cable is necessary to this project for two reasons:
 * 1) It gives us access to the boot loader so we can boot from a flash drive or hard drive instead of the internal ROM.
 * 2) If we screw up it is much easier to fix if we have access to a serial console for debugging.

Zyxel has set us up for success, so even that can be done without a soldering iron.

Equipment needed:
 * NSA325
 * Srewdriver
 * USB to TTL Serial Cable - Debug / Console Cable - 3.3 Volts

For this project I will be using a cable from adafruit.com. It has nice pin plugs which allow you to easily connect to any board with pins:
 * Red --power
 * Black -- ground
 * White -- RX into USB port
 * Green -- TX out of USB port

Disassemble Case
TODO

Connect Serial Cable
Once you are down to the bare PCB board you can look for a set of pins as seen below.

Pinning: +++                     |    |    | ++++++ |    | TX | RX |    | GND| ++++   ++

Connect:
 * Red wire unconnected.
 * Black wire to ground.
 * White wire to TX.
 * Green wire to RX.

Remember to cross connect the TX and RX wires. The pin the NSA325 is transmitting on is the pin the USB cable is receiving on and vis versa.

Test Serial Cable
I like to use a program called screen on ubuntu. To start screen enter:

Power on your NSA325. The board is self contained so you don't need to put it back together again before testing. As the device powers up you should see something similar to the following scroll by:

__ __                      _ _         |  \/  | __ _ _ ____   _____| | |         | |\/| |/ _` | '__\ \ / / _ \ | |         | |  | | (_| | |   \ V /  __/ | |         |_|  |_|\__,_|_|    \_/ \___|_|_|  _   _     ____              _ | | | |   | __ )  ___   ___ | |_ | | | |___| _ \ / _ \ / _ \| __|  | |_| |___| |_) | (_) | (_) | |_   \___/    |____/ \___/ \___/ \__|   ** MARVELL BOARD: DB-88F6282A-BP LE  U-Boot 1.1.4 (Jun 14 2011 - 21:40:09) Marvell version: 3.5.9 U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00 Soc: 88F6282 A1CPU running @ 1600Mhz L2 running @ 533Mhz SysClock = 533Mhz, TClock = 200Mhz  DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7 DRAM CS[0] base 0x00000000   size 512MB  DRAM Total size 512MB  16bit width Addresses 10M - 0M are saved for the U-Boot usage. Mem malloc Initialization (10M - 7M): Done NAND:128 MB ....

Success!!

If you use windows, Mac, or need more help with Linux please see https://learn.adafruit.com/adafruits-raspberry-pi-lesson-5-using-a-console-cable?view=all

Boot Loader
Modifying the bootloader is necessary for this project so that we can:
 * 1) Boot Debian from a external flash drive.
 * 2) Switch back to the stock firmware as a failsafe.

The bootloader gets your chip into a known state from which you can load an OS. Usually the OS will never call the bootloader again once your system is running. For this project we are not going to go too deep into the boot loader. All we want to do is modify some bootloader variables so that we switch back and forth between running debian and the stock firmware.

Equipment needed:
 * NSA325 with attached serial cable
 * USB flash drive formatted as Fat32

One way to modify the bootloader is to create a flashdrive containing a modification scripts.

Prepare Bootloader Flash Drive

 * 1) Download the bootloader scripts from usb-debian-uboot.tar.gz.
 * 2) Extract the compressed file.
 * 3) Copy the the four files to the parent directory of the Fat32 flash drive.

Enter the bootloader

 * 1) Insert the Fat32 flash drive in the rear of the NSA325.
 * 2) Make sure the serial cable is connected and there is an open serial connection.
 * 3) Boot the NSA325.
 * 4) Watch for a message "Press any key to to stop auto-boot" in the serial console.
 * 5) Press Key

You should now see the following prompt:

Configure the bootloader
At the Marvell>> Prompt enter the following commands

The device will reboot itself. Watch for the "stop auto-boot" message to enter the bootloader again.

At the Marvell>> Prompt enter the following commands

The device will reboot itself. Watch for a message about "Bad magic number." This means the bootloader is looking for the operating system on a USB flash drive... but cannot find it. Success!!!

Power off the device and remove the bootloader flash drive.

Operating System
For this project we will download a prebuilt copy of Debian Wheezy for NSA325. This is minimal Debian Wheezy image with a few patches to work on the NSA325 and a custom kernel to run on the Marvell Kirkwood CPU.

Equipment needed:
 * NSA325 with attached serial cable
 * Unformatted USB flash drive larger than 8GB


 * 1) Insert Unformatted USB flash drive.
 * 2) Download the Debian Wheezy Tarball from Debian Wheezy for NSA325.
 * 3) Extract the compressed file.

Boot Partition

 * 1) Create a first partition of 100MB
 * 2) Format with ext2.
 * 3) Set label to "boot"
 * 4) Set flag to bootable
 * 5) Move the files in Debian-3.14.0-kirkwood-tld-1-rootfs-bodhi/boot/ to this partition.

Rootfs Partition

 * 1) Create a second partition of using the rest of the available space on the flash drive.
 * 2) Format with ext4.
 * 3) Set label to "rootfs"
 * 4) Move the files in Debian-3.14.0-kirkwood-tld-1-rootfs-bodhi/ to this partition.

Test Operating System

 * 1) Insert the Operating System flash drive in the rear of the NSA325.
 * 2) Make sure the serial cable is connected and there is an open serial connection.
 * 3) Boot the NSA325.
 * 4) After a few minutes of messages you should now see the following prompt:

Success!!!

For Help

 * Debian on NSA325

Background Reading
Several Forums provided invaluable code and information to help me get started on this, my first NSA325 hacking project.
 * General Zyxel information
 * Debian on NSA325 information
 * kirkwood kernel and root filesystem