Debian on 325

From NAS-Central Zyxel Wiki
Jump to: navigation, search

This page provides a series of simple steps which new hacker can follow to turn their Zyxel NSA325 into a cost effective Hacking platform.

NSA325

The NSA325 is a very nice piece of hardware. It has:

  • Marvell Kirkwood CPU running at 1600MHz.
  • 512MiB RAM
  • 128MiB Flash ROM
  • Gigabit NIC
  • 1 USB 3.0 Port and 2x USB 2.0 ports
  • Room for 2 Internal HDDS with SATA II

For those experienced with the Raspberry PI or BeagleBone Black you will see many similarities.

Serial Cable

A serial cable is necessary to this project for two reasons:

  1. It gives us access to the boot loader so we can boot from a flash drive or hard drive instead of the internal ROM.
  2. If we screw up it is much easier to fix if we have access to a serial console for debugging.

Zyxel has set us up for success, so even that can be done without a soldering iron.

Equipment needed:

  • NSA325
  • Srewdriver
  • USB to TTL Serial Cable - Debug / Console Cable - 3.3 Volts

For this project I will be using a cable from adafruit.com[1]. It has nice pin plugs which allow you to easily connect to any board with pins:

  • Red --power
  • Black -- ground
  • White -- RX into USB port
  • Green -- TX out of USB port

Disassemble Case

TODO

Connect Serial Cable

Once you are down to the bare PCB board you can look for a set of pins as seen below.


Nsa325 serial port.jpg
Pinning:

          +----+----+           
          |    |    |
+----+----+----+----+----+
|    | TX | RX |    | GND|
+----+----+----+    +----+

Connect:

  • Red wire unconnected.
  • Black wire to ground.
  • White wire to TX.
  • Green wire to RX.

Remember to cross connect the TX and RX wires. The pin the NSA325 is transmitting on is the pin the USB cable is receiving on and vis versa.

Test Serial Cable

I like to use a program called screen[2] on ubuntu. To start screen enter:

sudo screen /dev/ttyUSB0 115200

Power on your NSA325. The board is self contained so you don't need to put it back together again before testing. As the device powers up you should see something similar to the following scroll by:

         __  __                      _ _
        |  \/  | __ _ _ ____   _____| | |
        | |\/| |/ _` | '__\ \ / / _ \ | |
        | |  | | (_| | |   \ V /  __/ | |
        |_|  |_|\__,_|_|    \_/ \___|_|_|
 _   _     ____              _
| | | |   | __ )  ___   ___ | |_ 
| | | |___|  _ \ / _ \ / _ \| __| 
| |_| |___| |_) | (_) | (_) | |_ 
 \___/    |____/ \___/ \___/ \__| 
 ** MARVELL BOARD: DB-88F6282A-BP LE 

U-Boot 1.1.4 (Jun 14 2011 - 21:40:09) Marvell version: 3.5.9

U-Boot code: 00600000 -> 0067FFF0  BSS: -> 006CFB00

Soc: 88F6282 A1CPU running @ 1600Mhz L2 running @ 533Mhz
SysClock = 533Mhz , TClock = 200Mhz 

DRAM (DDR3) CAS Latency = 7 tRP = 7 tRAS = 20 tRCD=7
DRAM CS[0] base 0x00000000   size 512MB 
DRAM Total size 512MB  16bit width
Addresses 10M - 0M are saved for the U-Boot usage.
Mem malloc Initialization (10M - 7M): Done
NAND:128 MB
....

Success!!

If you use windows, Mac, or need more help with Linux please see https://learn.adafruit.com/adafruits-raspberry-pi-lesson-5-using-a-console-cable?view=all

Boot Loader

Modifying the bootloader is necessary for this project so that we can:

  1. Boot Debian from a external flash drive.
  2. Switch back to the stock firmware as a failsafe.

The bootloader gets your chip into a known state from which you can load an OS. Usually the OS will never call the bootloader again once your system is running. For this project we are not going to go too deep into the boot loader. All we want to do is modify some bootloader variables so that we switch back and forth between running debian and the stock firmware.

Equipment needed:

  • NSA325 with attached serial cable
  • USB flash drive formatted as Fat32

One way to modify the bootloader is to create a flashdrive containing a modification scripts.

Prepare Bootloader Flash Drive

  1. Download the bootloader scripts from usb-debian-uboot.tar.gz.
  2. Extract the compressed file.
  3. Copy the the four files to the parent directory of the Fat32 flash drive.

Enter the bootloader

  1. Insert the Fat32 flash drive in the rear of the NSA325.
  2. Make sure the serial cable is connected and there is an open serial connection.
  3. Boot the NSA325.
  4. Watch for a message "Press any key to to stop auto-boot" in the serial console.
  5. Press Key

You should now see the following prompt:

Marvell>>

Configure the bootloader

At the Marvell>> Prompt enter the following commands

Marvell>> resetenv
Marvell>> reset

The device will reboot itself. Watch for the "stop auto-boot" message to enter the bootloader again.

At the Marvell>> Prompt enter the following commands

Marvell>> saveenv
Marvell>> reset

The device will reboot itself. Watch for a message about "Bad magic number." This means the bootloader is looking for the operating system on a USB flash drive... but cannot find it. Success!!!

Power off the device and remove the bootloader flash drive.

Operating System

For this project we will download a prebuilt copy of Debian Wheezy for NSA325. This is minimal Debian Wheezy image with a few patches to work on the NSA325 and a custom kernel to run on the Marvell Kirkwood CPU.

Equipment needed:

  • NSA325 with attached serial cable
  • Unformatted USB flash drive larger than 8GB
  1. Insert Unformatted USB flash drive.
  2. Download the Debian Wheezy Tarball from Debian Wheezy for NSA325.
  3. Extract the compressed file.

Boot Partition

  1. Create a first partition of 100MB
  2. Format with ext2.
  3. Set label to "boot"
  4. Set flag to bootable
  5. Move the files in Debian-3.14.0-kirkwood-tld-1-rootfs-bodhi/boot/ to this partition.

Rootfs Partition

  1. Create a second partition of using the rest of the available space on the flash drive.
  2. Format with ext4.
  3. Set label to "rootfs"
  4. Move the files in Debian-3.14.0-kirkwood-tld-1-rootfs-bodhi/ to this partition.

Test Operating System

  1. Insert the Operating System flash drive in the rear of the NSA325.
  2. Make sure the serial cable is connected and there is an open serial connection.
  3. Boot the NSA325.
  4. After a few minutes of messages you should now see the following prompt:

root@debian

Success!!!

For Help

Background Reading

Several Forums provided invaluable code and information to help me get started on this, my first NSA325 hacking project.