github/sowbug

Linkstation 145/146/147 password

I wanted to add a few features to my Linkstation HD-H120LAN, but the newer versions of the 1.4x firmware are password-protected and don’t have the same vulnerabilities as earlier versions that allowed hobbyists to tinker with them.

So this is what I did. (These instructions assume you’re already experienced with Linkstation/Kuro Box hacking.)

  • Download the 145_13 firmware update and extract firminfo.txt, ramdisk.image.gz, and vmlinux.gz from the firmimg.bin in it.
  • gunzip ramdisk.image.gz and mount it using sudo mount -o loop ramdisk.image /mnt/linkstation/.
  • cd to /mnt/linkstation/bin, and move unzip to real_unzip.

  • Add a new unzip with the following contents:

     #!/bin/bash

    echo “$*” >> /cmdline real_unzip $*

  • chmod a+x unzip

  • umount the image and gzip -9 it back up again.

  • Using setsum from the Kuro/Linkstation GPL toolchain, create a new firmimg.bin: linux-2.4.17_mvl21-sandpoint/arch/ppc/boot/utils/setsum/setsum firminfo.txt vmlinux.gz -r ramdisk.image.gz -o firmimg.bin

  • Flash firmimg.bin to /dev/fl3.

  • Replace the original firmimg.bin in the firmware update download and re-run HD-HLAN FWUpdate.exe.

  • When the setup is done, telnet into the Linkstation and cat /cmdline.

  • See the command line used to unzip image.dat: -P NFM_TUPSBHFNFM_TUPSBHF /mnt2/image.zip -d /mnt2

I confirmed the password works with 145_13, 146_10, and 147. Have fun.