Wow. This thing is going to be easy to hack. No serial console needed. Thanks to [mbm] for helping break up the firmware filesystem images.
filesystem images available here.
Loopback mount them, and they're good to go.
Let the router format the disk, throw it in another system, create a file called "fun_plug" at the root of that disk with execute perms, and your're set. That file is shared on the default samba share from the router, so if you smbmount it you can edit to your heart's content to make it do all kinds of stuff, like:
#!/bin/sh
dmesg > /mnt/HD_a2/dmesg.out
Which produces:
[root@optimus sdc1]# more dmesg.out
Total memory 33554432 MB.
Memory BAT mapping: BAT2=32Mb, BAT3=0Mb, residual: 0Mb
Total memory is 33554432.
CPU = 82xx
Linux version 2.4.21-pre4 (ffna@swtest2) (gcc version 2.95.4 20010319 (prereleas
e)) #480 ¥| 8¤ë 25 17:39:08 CST 2005
OpenPIC_Addr in mpc10x_bridge_init function is fc040000
Motorola SPS Sandpoint Test Platform
Port by MontaVista Software, Inc. (source@mvista.com)
On node 0 totalpages: 8192
zone(0): 8192 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram console=ttyS0,9600
OpenPIC Version 1.2 (1 CPUs and 123 IRQ sources) at fc040000
Calibrating delay loop... 133.12 BogoMIPS
Memory: 27312k available (1560k kernel code, 508k data, 60k init, 0k highmem)
Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)
Inode cache hash table entries: 2048 (order: 2, 16384 bytes)
Mount cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 8192 (order: 3, 32768 bytes)
POSIX conformance testing by UNIFIX
PCI: Probing PCI hardware
PCI fixup irq: (PCI device 1814:0201) got 0
PCI fixup irq: (PCI device 1033:0035) got 1
PCI fixup irq: (PCI device 1033:0035) got -1
PCI fixup irq: (PCI device 1033:00e0) got 2
PCI fixup irq: (PCI device 13f0:1023) got 3
PCI fixup irq: (PCI device 1191:0008) got 4
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Journalled Block Device driver loaded
NTFS driver v1.1.22 [Flags: R/W]
udf: registering filesystem
Serial driver version 5.05c (2001-07-08) with MANY_PORTS SERIAL_PCI enabled
ttyS00 at 0xfc004500 (IOMEM)(irq = 121) is a ST16650
ttyS01 at 0xfc004600 (IOMEM)(irq = 122) is a ST16650
RAMDISK driver initialized: 16 RAM disks of 6144K size 1024 blocksize
loop: loaded (max 8 devices)
ipg : v0.36 10/31/01 Written by Craig Rich, www.sundanceti.com
IC PLUS IP1000 1000/100/10 based NIC found.
Ethernet device registered as: eth0
IPG module loaded.
SCSI subsystem driver Revision: 1.00
atp86x_detect:
ACARD ATP-865 PCI ATA133 2-Channels Host Adapter: 0 IO:FEBFFEF8, IRQ:4.
ID: 0 Maxtor 53073H4 UDMA5 (100)
scsi0 : ACARD ATP86X PCI ATA133 Adapter Driver Ver: 0.78 Date: 2004/01/15
Vendor: Maxtor 5 Model: 3073H4 Rev:
Type: Direct-Access ANSI SCSI revision: 02
Attached scsi disk sda at scsi0, channel 0, id 0, lun 0
SCSI device sda: 60030431 512-byte hdwr sectors (15368 MB)
Partition check:
sda1 sda2
USI AMD/FUJITSU flash: probing 8-bit flash bus
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling fast programming due to code brokenness.
Creating 5 MTD partitions on "USI Intel flash":
0x00000000-0x00010000 : "Linux mtd1"
0x00010000-0x00020000 : "Linux mtd2"
0x00020000-0x00300000 : "Linux Ramdisk"
0x00300000-0x00310000 : "U-BOOT BOOT LOADER"
0x00310000-0x00400000 : "Linux Kernel"
usb.c: registered new driver hub
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 2048)
RAMDISK: Compressed image found at block 0
Freeing initrd memory: 2936k freed
VFS: Mounted root (ext2 filesystem) readonly.
Freeing unused kernel memory: 60k init
EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended
bonding.c:v2.4.20-20021210 (December 10, 2002)
br0 registered with MII link monitoring set to 100 ms, in fault-tolerance (activ
e-backup) mode.
br0 registered without ARP monitoring
br0: released all slaves
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
Link speed = undefined!
br0: enslaving eth0 as a backup interface with a down link.
Link speed = 1000Mbps.
setting full duplex, TX flow control, RX flow control.
br0: link status definitely up for interface eth0.
and making interface eth0 the active one.
br0: releasing active interface eth0 but could not find any backup interface.
br0: now running without any active interface !
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
Link speed = undefined!
br0: enslaving eth0 as a backup interface with a down link.
br0: releasing backup interface eth0.
br0: now running without any active interface !
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
br0: enslaving eth0 as a backup interface with a down link.
Adding Swap: 530104k swap-space (priority -1)
Link speed = 1000Mbps.
setting full duplex, TX flow control, RX flow control.
br0: link status definitely up for interface eth0.
and making interface eth0 the active one.
kjournald starting. Commit interval 5 seconds
EXT3 FS 2.4-0.9.19, 19 August 2002 on sd(8,2), internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with ordered data mode.
ehci_hcd 00:0e.2: PCI device 1033:00e0
ehci_hcd 00:0e.2: irq 2, pci mem c306af00
usb.c: new USB bus registered, assigned bus number 1
ehci_hcd 00:0e.2: USB 2.0 enabled, EHCI 1.00, driver 2003-Dec-29/2.4
hub.c: USB hub found
hub.c: 5 ports detected
usb-ohci.c: USB OHCI at membase 0xc3073000, IRQ 1
usb-ohci.c: usb-00:0e.0, PCI device 1033:0035
usb.c: new USB bus registered, assigned bus number 2
hub.c: USB hub found
hub.c: 3 ports detected
usb-ohci.c: USB OHCI at membase 0xc3075000, IRQ -1
usb-ohci.c: usb-00:0e.1, PCI device 1033:0035
usb.c: new USB bus registered, assigned bus number 3
request_irq irq >= NR_IRQS fail
usb-ohci.c: request interrupt -1 failed
usb.c: USB bus 3 deregistered
Trying to vfree() nonexistent vm area (c3075000)
Initializing USB Mass Storage driver...
my_host_number = 1
usb.c: registered new driver usb-storage
USB Mass Storage support registered.
ra0: at 0xbfffe000, VA 0xc30ab000, IRQ 0.
ra0: RT2500_open() irq 0. MAC = 00:13:46:d9:a4:6f
pAdapter->PortCfg.StaWithEtherBridge.Enable = FALSE
bond_enslave(): MII and ETHTOOL support not available for interface ra0, and arp
_interval/arp_ip_target module parameters not specified, thus bonding will not d
etect link failures! see bonding.txt for details.
br0: enslaving ra0 as a backup interface with an up link.
br0: releasing active interface eth0 and making interface eth0 the active one.
br0: releasing backup interface ra0.
br0: now running without any active interface !
br0: released all slaves
NET4: Ethernet Bridge 008 for NET4.0
device eth0 entered promiscuous mode
mac = 00:13:46:d9:a4:6f
Link speed = undefined!
Link speed = undefined!
br0: port 1(eth0) entering listening state
device ra0 entered promiscuous mode
Current Tx Antenna = Antenna B
Current Rx Antenna = Antenna B
br0: port 2(ra0) entering listening state
br0: port 1(eth0) entering learning state
br0: port 2(ra0) entering learning state
Link speed = 1000Mbps.
setting full duplex, TX flow control, RX flow control.
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
br0: port 2(ra0) entering forwarding state
br0: topology change detected
Anyone got a static elf dropbear for ppc handy?
(Last edited by whm3 on 20 Jan 2006, 04:01)