I have an Internetbox provided by my ISP, made by Sagemcom and managed via TR-69. It is based on OpenWRT and obtaining root access was not difficult after a short internet search.
TL/DR: I have a root-fs, squashfs and mtd "partitions". Where should I modify a file so changes are reverted on cold reboot or factory reset?
Long story:
It has some bugs and annoyances that are easily fixable, once root and the TR-69 supplied configuration is not supposed to change often. Still I would like to keep all modifications easily revertible, as I do not own the box and I do not have a full recovery image.
I need help to safely modify the main configuration, ideally that changes survive a warm reboot, but are otherwise overwritten. Alternatively, all modifications should be lost on factory reset.
Sagem stores the config in an "XMO" database. The central program is called hg6d and the external config is read by the tr69d daemon. xmo-client would be the most direct approach, but I am not sure how to use it.
An initial config is found in /etc/start-cfg.xml and backups of the current config are stored in /opt/conf.
I could for example take a config backup from /opt/conf, modify it to my needs, copy it to /etc/start-cfg.xml, disable the tr-69 daemon and reboot or reset the unit. By my understanding in one of the cases the device should boot with the start-cfg and remain there?
Or can you tell me, how I can safely modify some currenct config values with xmo-client or similar without persistence? Any experience how I could download the current firmware image via TR-69?
Basically, any hints would be welcome.
attached, the partition scheme etc:
~# mount
rootfs on / type rootfs (rw)
/dev/root on /opt/squashfs type squashfs (ro,relatime)
proc on /proc type proc (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,size=116711424,mode=1777)
devfs on /dev type tmpfs (rw,relatime,size=512K)
devpts on /dev/pts type devpts (rw,relatime,mode=600)
ubi!filesystem1 on /opt/filesystem1 type ubifs (rw,sync,relatime)
none on / type unionfs (rw,relatime,dirs=/opt/filesystem1/rootfs=rw:/opt/squashfs=ro)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
none on /proc/bus/usb type usbfs (rw,relatime)
/dev/sda on /tmp/mnt/sda type vfat (rw,nosuid,nodev,noexec,relatime,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
~# cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00020000 "bcmfs"
mtd1: 000a0000 00020000 "bcmfs_update"
mtd2: 0fa40000 00020000 "ubi"
mtd3: 00400000 00020000 "data"
mtd4: 00020000 00020000 "nvram"
mtd5: 00078800 0001f000 "secondaryboot"
mtd6: 000ff660 0001f000 "uboot"
mtd7: 000ff660 0001f000 "uboot-rescue"
mtd8: 000019e8 0001f000 "permanent_param"
mtd9: 022a2000 0001f000 "operational"
mtd10: 0001f000 0001f000 "firm_header"
mtd11: 002c9000 0001f000 "kernel"
mtd12: 01fd9000 0001f000 "rootfs"
mtd13: 020d1000 0001f000 "rescue"
mtd14: 007c0000 0001f000 "filesystem1"
mtd15: 00000000 0001f000 "gui"
mtd16: 00000000 00000000 "gui_header"
mtd17: 00000000 00000000 "guifs"
~# ls -la /opt/
drwxr-xr-x 1 root root 126 May 3 11:29 .
drwxr-xr-x 1 root root 752 May 3 11:32 ..
lrwxrwxrwx 1 root root 16 May 3 11:29 conf -> filesystem1/conf
lrwxrwxrwx 1 root root 16 May 3 11:29 data -> filesystem2/data
drwxr-xr-x 5 root root 352 Jan 1 1970 filesystem1
lrwxrwxrwx 1 root root 11 May 3 11:29 filesystem2 -> filesystem1
drwxr-xr-x 1 root root 3 May 3 11:00 gui-extern
drwxr-xr-x 1 root root 3 May 3 11:00 rootufs
drwxr-xr-x 17 root root 246 May 3 11:32 squashfs
~# cat /proc/cpuinfo
Processor : ARMv7 Processor rev 1 (v7l)
processor : 0
BogoMIPS : 1990.65
processor : 1
BogoMIPS : 1990.65
Features : swp half thumb fastmult edsp tls
CPU implementer : 0x41
CPU architecture: 7
CPU variant : 0x4
CPU part : 0xc09
CPU revision : 1
Hardware : BCM963138
Revision : 0000
Serial : 0000000000000000