[Solved] Safely modify a Sagem-Openwrt Box (rooted, hg6d, tr69, start-cfg)?

I have an Internetbox provided by my ISP, made by Sagemcom and managed via TR-69. It is based on OpenWRT and obtaining root access was not difficult after a short internet search.

TL/DR: I have a root-fs, squashfs and mtd "partitions". Where should I modify a file so changes are reverted on cold reboot or factory reset?

Long story:

It has some bugs and annoyances that are easily fixable, once root and the TR-69 supplied configuration is not supposed to change often. Still I would like to keep all modifications easily revertible, as I do not own the box and I do not have a full recovery image.

I need help to safely modify the main configuration, ideally that changes survive a warm reboot, but are otherwise overwritten. Alternatively, all modifications should be lost on factory reset.

Sagem stores the config in an "XMO" database. The central program is called hg6d and the external config is read by the tr69d daemon. xmo-client would be the most direct approach, but I am not sure how to use it.

An initial config is found in /etc/start-cfg.xml and backups of the current config are stored in /opt/conf.

I could for example take a config backup from /opt/conf, modify it to my needs, copy it to /etc/start-cfg.xml, disable the tr-69 daemon and reboot or reset the unit. By my understanding in one of the cases the device should boot with the start-cfg and remain there?

Or can you tell me, how I can safely modify some currenct config values with xmo-client or similar without persistence? Any experience how I could download the current firmware image via TR-69?

Basically, any hints would be welcome.

attached, the partition scheme etc:

~# mount
rootfs on / type rootfs (rw)
/dev/root on /opt/squashfs type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,size=116711424,mode=1777)
devfs on /dev type tmpfs (rw,relatime,size=512K)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
ubi!filesystem1 on /opt/filesystem1 type ubifs (rw,sync,relatime)
none on / type unionfs (rw,relatime,dirs=/opt/filesystem1/rootfs=rw:/opt/squashfs=ro)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
none on /proc/bus/usb type usbfs (rw,relatime)
/dev/sda on /tmp/mnt/sda type vfat (rw,nosuid,nodev,noexec,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)

~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00020000 00020000 "bcmfs"
mtd1: 000a0000 00020000 "bcmfs_update"
mtd2: 0fa40000 00020000 "ubi"
mtd3: 00400000 00020000 "data"
mtd4: 00020000 00020000 "nvram"
mtd5: 00078800 0001f000 "secondaryboot"
mtd6: 000ff660 0001f000 "uboot"
mtd7: 000ff660 0001f000 "uboot-rescue"
mtd8: 000019e8 0001f000 "permanent_param"
mtd9: 022a2000 0001f000 "operational"
mtd10: 0001f000 0001f000 "firm_header"
mtd11: 002c9000 0001f000 "kernel"
mtd12: 01fd9000 0001f000 "rootfs"
mtd13: 020d1000 0001f000 "rescue"
mtd14: 007c0000 0001f000 "filesystem1"
mtd15: 00000000 0001f000 "gui"
mtd16: 00000000 00000000 "gui_header"
mtd17: 00000000 00000000 "guifs"
~# ls -la /opt/
drwxr-xr-x    1 root     root           126 May  3 11:29 .
drwxr-xr-x    1 root     root           752 May  3 11:32 ..
lrwxrwxrwx    1 root     root            16 May  3 11:29 conf -> filesystem1/conf
lrwxrwxrwx    1 root     root            16 May  3 11:29 data -> filesystem2/data
drwxr-xr-x    5 root     root           352 Jan  1  1970 filesystem1
lrwxrwxrwx    1 root     root            11 May  3 11:29 filesystem2 -> filesystem1
drwxr-xr-x    1 root     root             3 May  3 11:00 gui-extern
drwxr-xr-x    1 root     root             3 May  3 11:00 rootufs
drwxr-xr-x   17 root     root           246 May  3 11:32 squashfs

~# cat /proc/cpuinfo 
Processor       : ARMv7 Processor rev 1 (v7l)
processor       : 0
BogoMIPS        : 1990.65

processor       : 1
BogoMIPS        : 1990.65

Features        : swp half thumb fastmult edsp tls 
CPU implementer : 0x41
CPU architecture: 7
CPU variant     : 0x4
CPU part        : 0xc09
CPU revision    : 1

Hardware        : BCM963138
Revision        : 0000
Serial          : 0000000000000000

That is a proprietary configuration scheme. The open builds of OpenWrt use text files in the /etc/config directory.

If you have a fully overlaid filesystem, any file you change in /etc, /opt, etc (but not /tmp) will be written to flash to persist through reboot, unless some process overwrites it.

1 Like

hints that the persistent configuration is stored in flash which is mounted at /opt/filesystem1 which appears to contain at least rootfs, conf, and data.

You might try examining that file system, and perhaps using a tool like tar to keep a "good" copy of it in a safe place (off the router).

Thank you for the hints. I already made backups to USB from the running system, but I am afraid that it might be difficult to flash them back if something breaks.

In case someone else comes across my problem:
The xmo-client is self-explenatory. My problem was that while looking through the hg6d I accidentaly broke the connection to the XMO server and the error output by xmo-client did not make this obvious.

I should now be pefectly able to modify the configuration, while being able to reset to factory defaults easily.

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.