I have a few sophos APX120 laying arround.
I was digging around with some APX.uimages and got one image, that boots the APX into a OpenWrt root shell without a password.
I think, it should be possible to get some information about the sources from this image and i would like to build one by myself.
Is there any walkthough for a generic model?
this device https://fccid.io/2ACTO-APX120 ?
who's the actual chip maker, it's hard to see in the photos ...
Hi,
from the Boot log and the Link you provided...
This is a Qualcom IPQ4019 (i have not removed the cooler yet).
The OEM bootlog seems the same as GL-iNet GL-S1300.
With an early uImage 2.0** i have root access to OpenWrt running on this AP.
Is there any information, i could get from the file system?
Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00120
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B - 261 - PBL, Start
B - 1338 - bootable_media_detect_entry, Start
B - 1678 - bootable_media_detect_success, Start
B - 1691 - elf_loader_entry, Start
B - 5068 - auth_hash_seg_entry, Start
B - 7209 - auth_hash_seg_exit, Start
B - 577087 - elf_segs_hash_verify_entry, Start
B - 694221 - PBL, End
B - 694245 - SBL1, Start
B - 785250 - pm_device_init, Start
D - 7 - pm_device_init, Delta
B - 786695 - boot_flash_init, Start
D - 52830 - boot_flash_init, Delta
B - 843665 - boot_config_data_table_init, Start
D - 3831 - boot_config_data_table_init, Delta - (419 Bytes)
B - 850863 - clock_init, Start
D - 7570 - clock_init, Delta
B - 862907 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:1,Subtype:0
B - 866321 - sbl1_ddr_set_params, Start
B - 871419 - cpr_init, Start
D - 2 - cpr_init, Delta
B - 875801 - Pre_DDR_clock_init, Start
D - 4 - Pre_DDR_clock_init, Delta
D - 13175 - sbl1_ddr_set_params, Delta
B - 889540 - pm_driver_init, Start
D - 2 - pm_driver_init, Delta
B - 959698 - sbl1_wait_for_ddr_training, Start
D - 27 - sbl1_wait_for_ddr_training, Delta
B - 975316 - Image Load, Start
D - 152333 - QSEE Image Loaded, Delta - (297752 Bytes)
B - 1128076 - Image Load, Start
D - 1446 - SEC Image Loaded, Delta - (2048 Bytes)
B - 1138496 - Image Load, Start
D - 224138 - APPSBL Image Loaded, Delta - (458523 Bytes)
B - 1363032 - QSEE Execution, Start
D - 60 - QSEE Execution, Delta
B - 1369252 - SBL1, End
D - 677115 - SBL1, Delta
S - Flash Throughput, 2008 KB/s (758742 Bytes, 377712 us)
S - DDR Frequency, 537 MHz
U-Boot 2012.07 [Chaos Calmer unknown,unknown] (Nov 02 2018 - 08:13:09)
smem ram ptable found: ver: 1 len: 3
DRAM: 256 MiB
@machid : 0x8010100
NAND: spi_nand: spi_nand_flash_probe SF NAND ID 0:ef:ab:21
SF: Detected W25M02GV with page size 2 KiB, total 256 MiB
SF: Detected MX25L1605D with page size 4 KiB, total 2 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x200000
258 MiB
you probably want to post the whole boot log, output of lspci, and cat /proc/mtd
interrupting u-boot, and posting printenv and help, won't hurt.
if it's similar to the GL-S1300, you could try to create an initramfs, and try to bootm it via uboot, to see what works, and what doesn't.
but be aware, you'll be the guy adding the support for this device, since you own it.
Hi!
You could also ask sophos. I had success with a GPL request.
I have also acquired some APX120s.. And would love to put in the work to get OpenWRT running on these..
https://www.sophos.com/en-us/support/downloads/firewall-installers
has at least some gpl components..
argp-standalone-1.3.tar
base-files.tar
binutils-2.24.tar
busybox-1.23.2.tar
dnsmasq-nodhcpv6.tar
dtc-1.4.4.tar
elfutils-0.155.tar
ethtool-3.4.1.tar
fstools-2015-04-14.tar
gettext.tar
iftop-1.0pre2.tar
iproute2-4.0.0.tar
ipset-6.24.tar
iptables-1.4.21.tar
kernel-packages.tar
kismet-2010-07-R1.tar
libcap-2.22.tar
libiconv-1.11.1.tar
libmnl-1.0.3.tar
libnl-3.2.21.tar
libnl-tiny-0.1.tar
librpc-2015-04-10.tar
linux-3.14.43.tar
lzo-2.08.tar
mbedtls-1.3.10.tar
mtd.tar
mtd-utils-1.5.0.tar
netifd-2015-04-21.tar
perf-3.14.43.tar
procd-2015-04-10.tar
swconfig.tar
toolchain.tar
trace-cmd-v2.4.tar
ubi-utils-1.5.1.tar
u-boot-2014.10.tar
uboot-ipq40xx_120-.tar
uboot-ipq40xx-.tar
uboot-ipq806x-.tar
ubox-2015-04-02.tar
ubus-2015-01-22.tar
uci-2015-08-27.1.tar
uClibc++-0.2.4.tar
util-linux-2.25.2.tar
wireless_tools.29.tar
A lot of them seems to be old, but probably useful..
If i find more time, i´ll try to break a default apx120 image.
most image boot OpenWrt and switch to a sophos specific.
If i boot into failsafe (some OpenWrt) it will reboot after a while.
There is some watchdog, that will trigger the reboot.
@JuergenB Did you ever get the time to get back to this?
Hi,
i tried to get some information from a working APX and a few NAND Dumps, but most of my OpenWrt compiled image failed.
I tested a few Default Releases, but these fail with
Verifying Hash Integrity ... Failed to verify required signature 'key-prod'
Unable to verify required signature for '' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
So i tried some of the older APX.uimage Releases.
v2.3.2-1/APX.uimage
v1.15.0-7/APX.uimage
v2.0.1.2-5/APX.uimage
v2.0.1.3-0/APX.uimage
v2.0.2.1-4/APX.uimage
vprerelease-APX-0.1-10/APX.uimage
vprerelease-APX-0.1-8/APX.uimage
v2.0.0-1/APX.uimage
v2.0.0-10/APX.uimage
v2.0.0-12/APX.uimage
v2.0.0-4/APX.uimage
v2.0.0-6/APX.uimage
v2.0.0-7/APX.uimage
v2.0.0-8/APX.uimage
v2.0.0-9/APX.uimage
v2.1.0-1/APX.uimage
v2.1.0-2/APX.uimage
v2.1.0-3/APX.uimage
v2.1.1-1/APX.uimage
But most of them do not boot fine or fail at failsafe
The only image that enables an OpenWrt root login (No Password) without any connection to a XG Firewall ist v2.1.1-1
from here you get an OpenWrt root shell and a watchdog running.
root@OpenWrt:/etc# ubus call system watchdog
{
"status": "running",
"timeout": 30,
"frequency": 5
}
But still stuck here
Sophos has cancelled the APX series for next year (2025). It would be nice to save this working hardware from pointless disposal.
Is there already a sub-project at OpenWRT? Is it possible to pay developers somewhere to create an executable and official ROM version for OpenWRT?
Hi,
in the past i tried the official pre release (APX-0.1-8.uimage, APX-0.1-10.uimage) and some of the early releases (1.15, 2.00).
But most of them do not boot at all or have problems.
I tried to compile some OpenWrt sources, but failed.
I think i need to get a proper setup for compiling.
With a working Sophos firewall it´s releay easy to get root access.
Even if you boot into failsafe mode, you can set uBoot autoboot to 10 sec.
But i (still) have not enough knowledge in compiling...
OK, i tried a few of the early images, all fail.
The APX120/320 needs a signed image, so withouth any certificates for signing, there will be no OpenWrt.
Maybe if the uBoot loader has the same bug as the Meraki Z3, this could be done..
Danke für den Trick mit dem kurzschließen des Nor Flash!
Ich habe jetzt ein funktionierendes Image, hättest du Interesse Beta Tester zu sein?
Thanks for your Trick shorting the nor.
I have a Working Image, would you Like to be Beta Tester?
The preferred language of the OpenWrt forums is English, as this helps maximize the number of people who can participate in the conversation. Accordingly, please be sure to post in English.
You may use an online translator, and you're welcome to also include your native language in addition to English.
Thank you.
Thanks,
I haven’t worked with Sophos in a while since we switched to Fortinet. And I’m thrilled with how easily everything works.
The documentation and support are fantastic.
Up until now, I’d assumed that Sophos only allowed signed firmware images for the APX, so I hadn’t done anything further with the APX120.
I’ve been working a bit more on the SD-RED 20 and 60; on those, you can read and modify the firmware using a Pogo Plug.
Unfortunately, Sophos seems to have removed the failsafe.
W25M161AVEIT is a staked NAND/NOR chip.
But you can read/write data from it.
The platform seems to perform better on Linux to me…
But I’d also test your beta and see what’s possible with the APX.
Many thanks,
Juergen
Actually thats right, but the used u-boot has a secure boot "bypass". you can load any image if its a legacy u-boot image.
https://limewire.com/d/mH8yB#9iyNQ2bAck
you have to adjust a few u-boot variables before you are able to boot
setenv bootargs ubi.mtd=ubi root=/dev/ubiblock0_1 rootfstype=squashfs rootwait console=ttyMSM0,115200n8 earlyprintk earlycon=msm-uartdm,0x78af000 loglevel=7
setenv bootcmd 'apx_check_reset_button;run ubiboot'
setenv ethact eth0
setenv flash_type 0
setenv mtddevname ubi
setenv mtddevnum 0
setenv mtdids nand1=nand1
setenv mtdparts mtdparts=nand1:0x10000000(ubi)
setenv partition nand1,0
setenv wipe_config 'ubi part ubi;ubi remove rootfs_data'
setenv ubiboot 'ubi part ubi;ubi read 0x84000000 kernel;bootm 0x84000000 - 0x844E0000'
setenv rootfs_data_max 0xc800000
i had a problem with one apx, i was not able to boot anything because the nand was degraded so much.
with rootfs_data_max i adjusted the size of the ubi partition to have enough spare lebs or pebs
thanks for trying and thanks in advanced for your feedback