Login into linux running on HD Media Extender + GPL

[bastafidli]

I saw this on avs forums

http://www.avsforum.com/avs-vb/showthread.php?t=955297

"I've just started "exploring" the linux version it is running. You can telnet right into it and log in as root. No password at all."

I have verified it and it works quite nicely.

BTW, is Sage supplying the sources for the Linux in compliance with GPL?

Thanks

[ke6guj]

Originally Posted by bastafidli

BTW, is Sage supplying the sources for the Linux in compliance with GPL?

Thanks

From the STX-HD100 manual:

Third Party Software Libraries

This product contains the following open source software which is covered under their associated licenses: the linux kernal, busybox, udhcp, init, telnetd, inetd, phoneme advanced, libjpeg, libpng and ffmpeg.

For source code availability; please contact support@sagetv.com

A couple people have posted asking Sage for GPL'ed code in the past and that Sage complied.

[SHS]

If I'm rigth you most only get a partial source that available under GPL, the rest is most like can't distributed becuases of NDA from the chipmaker.
Partial source will most likely be linux kernel, busybox, udhcp, init, telnetd, inetd, phoneme advanced, libjpeg, libpng and ffmpeg which listed in the manual on page 10.
email: supportATsagetvDOTcom

[tmiranda]

I posted that over at AVS last night since I was surprised at how open the system was. I was a little disappointed actually, I was settling in behind the keyboard thinking it would take a while to figure out the logon and password and the first thing I tried worked.

[KJake]

Just mounted my USB flash drive...

em86xx[/root]# mkdir /tmp/usb
em86xx[/root]# insmod /lib/ehci-hcd.o
em86xx[/root]# lsmod
Module                  Size  Used by    Tainted: P
ehci-hcd               20080   0 (unused)
em8xxx               1825252   1
llad                   24072   1 [em8xxx]
em86xx[/root]# mount /dev/scsi/host0/bus0/target0/lun0/part1 /tmp/usb
em86xx[/root]# cd /tmp/usb
em86xx[usb]# ls
hpxw9400.zip
pnpRipper3.exe
zPDFCreator-0_9_3-AD_DeploymentPackage-WithoutToolbar.msi
zd700000-arch.zip

[KJake]

I wonder how much we're allowed to discuss on this? I'm not sure where the line is on "reverse engineering" - or is this pretty much wide open since we're talking about linux?

Basically, I have the firmware mounted on my linux system here and could very easily rewrite somethings to automatically mount a usb hard drive when connected to the system, and then repackage that firmware and reflash it to the STX. Just wondering if that info is allowed to be shared...

[KJake]

Looks like the distro is at least based on uClinux.

http://en.wikipedia.org/wiki/%CE%9CClinux

[KJake]

You can get an image of the firmware the STX loads yourself by doing this:

dd if=/dev/mtd/2 of=/tmp/usb/firmware.bin

This assumes that you mounted a usb flash drive like I did above. My drive is 2gb and formatted as FAT so the kernel supports read-write to it (as opposed to NTFS).

From there, you can mount that image like:

mkdir /tmp/firm
mount -o loop /tmp/usb/firmware.bin /tmp/firm

This is read-only, but you can see that this is just a romfs image. If you were to change something in here, and repackage it, you could reflash it using:

/utils/flashcp -v /tmp/usb/newfirmware.bin /dev/mtd/2

There's an easier way to get the firmware...

[bcjenkins]

Any comment on whether we could use binaries from DDWRT or some other ARM based distro? In particular wake on lan.

B

[KJake]

Originally Posted by bcjenkins

Any comment on whether we could use binaries from DDWRT or some other ARM based distro? In particular wake on lan.

B

I don't see why not. As long as it is compiled for ARM and doesn't have dynamic library requirements, it should work. Keep in mind that there is 64Mbyte of flash memory in the unit, but it looks like the system is only setup to create a 8Mbyte partition in memory for the romfs. Please correct me if I'm wrong. If I'm not, there's not a whole lot of room for extra binaries (~1.5Mbyte).

0x00000000-0x00020000 : "BootLoader"
0x00020000-0x007e0000 : "Romfs"
0x007e0000-0x00800000 : "Settings"

This is probably controlled by the bootloader. At this point I'm not sure if it is hardcoded or not.

Looks like the IR driver supports RC6 and NEC encoded signals as well, not sure that Sage will understand them though.

[KJake]

Looks like the bootloader has a restore mode built-in where it can download a firmware image named and flash it. This is probably the recovery mode that people have been talking about but not describing in detail. It looks like with a keypress on boot-up that it will go into recovery mode, send out a DHCP request and look for a TFTP server and download a new stx1000.bin.

The bootloader loads the 4 key .lz files from the flash area, with linux.bin.lz being the main linux kernel. .lz stands for LZMA compression by the way.

Instructions for rolling your own distro for this box...
http://mvixcommunity.com/showtopic.php?tid/46/