Hi Ahmed,

I used the exact same commands that juju and ansir have listed in their posts above. Have you tried following these? What happened? Tell me where you got stuck and I’ll suggest what might be wrong.

There are lots of resources on the web where you can get a basic grounding in Linux admin and shell commands - here’s one that includes a link to a video session on ubuntu.

If you are unfamiliar with ubuntu I suggest you follow the tutorial here to download it and create a bootable USB stick. Run this up and practice. You can do no harm if you use the “Try Ubuntu” option on booting as you just need to reboot to start again.

The instructions presented in this thread do not modify firmware. Firmware resides on an eprom usually, and is ‘baked’ into the hardware itself. Instead they modify files that are part of the Linux operating system which WD has chosen for this product. If you mess up your OS you may make the MCH unbootable. So I suggest you don’t go any further until you are up to speed on the Linux primer I linked above.

Good luck!


1 Like

I will give it a try and if anything goes wrong i will ask here . Thank you very much

It seems that the duo model has a flash card in it for the system, this makes the hack a bit more difficult :(.

grep mmcblk debug_logs/kernel/1553369429_kernel.log
03-23 19:28:12.566 0 0 I mmcblk0 : mmc0:0001 4FPD3R 3.64 GiB
03-23 19:28:12.577 0 0 I mmcblk0boot0: mmc0:0001 4FPD3R partition 1 4.00 MiB
03-23 19:28:12.580 0 0 I mmcblk0boot1: mmc0:0001 4FPD3R partition 2 4.00 MiB
03-23 19:28:12.589 0 0 I mmcblk0rpmb: mmc0:0001 4FPD3R partition 3 512 KiB
03-23 19:28:12.599 0 0 I mmcblk0 : p1 p2 p3 p4 < p5 p6 >
03-23 19:28:12.599 0 0 I : add_partition partition name = mmcblk0p1
03-23 19:28:12.612 0 0 I : add_partition partition name = mmcblk0p2
03-23 19:28:12.619 0 0 I : add_partition partition name = mmcblk0p3
03-23 19:28:12.626 0 0 I : add_partition partition name = mmcblk0p4
03-23 19:28:12.638 0 0 I : add_partition partition name = mmcblk0p5
03-23 19:28:12.638 0 0 I : add_partition partition name = mmcblk0p6
03-23 19:28:12.638 0 0 I rescan_partitions: rescan device mmcblk0 partitions finish.
03-23 19:28:22.543 0 0 I EXT4-fs (mmcblk0p3): mounted filesystem with ordered data mode. Opts: (null)
03-23 19:28:22.543 0 0 I fs_mgr : __mount(source=/dev/block/mmcblk0p3,target=/system,type=ext4)=0
03-23 19:28:22.566 0 0 I EXT4-fs (mmcblk0p5): recovery complete
03-23 19:28:22.572 0 0 I EXT4-fs (mmcblk0p5): mounted filesystem with ordered data mode. Opts: (null)
03-23 19:28:22.580 0 0 I fs_mgr : __mount(source=/dev/block/mmcblk0p5,target=/cache,type=ext4)=0
03-23 19:28:22.732 0 0 I EXT4-fs (mmcblk0p6): 9 orphan inodes deleted
03-23 19:28:22.738 0 0 I EXT4-fs (mmcblk0p6): recovery complete
03-23 19:28:22.760 0 0 I EXT4-fs (mmcblk0p6): mounted filesystem with ordered data mode. Opts: noauto_da_alloc
03-23 19:28:22.769 0 0 I fs_mgr : __mount(source=/dev/block/mmcblk0p6,target=/data,type=ext4)=0

Here are a few notes for anyone wanting to attach a console to the device (a Realtek RTD1295):

I used a UART to USB cable like this one: Raspberry Pi USB Console cable

Connected to the 4-pin header on the board thus:

RED - leave unattached

hint: Remove the little black plastic collar from the UART header first.

Download and install PuTTY from here

Before switching on the power to the board, plug the USB end of the cable into your PC or laptop and let Windows install the driver. Then run the Windows device manager and locate the new serial port. Mine was listed as “Prolific USB-to-Serial Comm Port (COM3)”. I tested driver version on Windows 8.1 and 10.

Create a PuTTY session as follows (in the Session tab):

Connection type: Serial
Serial line: COM3 (in my case)
Speed: 115200

in the Serial tab of the PuTTY dialog I also set Flow Control to None but this may be unnecessary.

Power on the board. On booting, without the HDD attached we get:

hwsetting size: 000005C0
Goto FSBL: 0x10100000
fsbl_main: sys_secure_type = 0x0000BEEE
fsbl_main: sys_boot_type = 0x00000001
fsbl_main: sys_boot_enc = 0x00000000
fsbl_main: sys_bisr_done = 0x00000000






RSA Key Fw:


********** FW_TYPE_BOOTCODE **********
fwInfo->fwType: 00000001
fwInfo->isGolden: 00000001
fwInfo->ddrReadAddr: 00520000
fwInfo->ddrDestAddr: 00020000
fwInfo->flashType: 00000001
fwInfo->flashUnitSize: 00000001
fwInfo->flashOffset: 88120E80
fwInfo->dataSize: 00067460
sha256 Fw
j bootcode jump address:00020000


CPU  : Cortex-A53 quad core - AARCH32
Board: Realtek QA Board
[ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0)
[ERR] get_accessible_ddr_size: hw setting error. (impossible value 0x0)
DRAM:  0 Bytes
Watchdog: Disabled
Cache: Enabled
Non-Cache Region: 1 MB@0x07900000
nor flash id [0x00c84014]
sector 256k en: 0
sector  64k en: 1
sector  32k en: 1
sector   4k en: 1
page_program  : 1
max capacity  : 0x00100000
spi type name : GD25Q80C_08Mbit
[SATA] enable SATA interface
[SATA] spread-spectrum disable
Factory: NOR
Factory: pp:0, seq#:0xa, size:0x2400
------------can't find tmp/factory/000BootParam.h
In:    serial
Out:   serial
Err:   serial
Net:   Realtek PCIe GBE Family Controller mcfg = 0024
*** Reboot-Action invalid ***
Hit Esc or Tab key to enter console mode or rescue linux:  0
------------can't find tmp/factory/recovery
======== Checking into android recovery ====

AHCI 0001.0301 32 slots 2 ports ? Gbps 0x3 impl SATA mode
flags: ncq pm led clo only pmp pio slum part
No port device detected!
Error, SATA device initialization failed!
bootr - boot realtek platform

bootr [u/uz]
        u   - boot from usb
        uz  - boot from usb (use lzma image)
        m   - read fw from flash but boot manually (go all)

Enter console mode, disable watchdog ...

and then the help command gives:

Realtek> help
b2ndbc  - load 2nd stage bootcode
bdinfo  - print Board Info structure
bootm   - boot application image from memory
bootr   - boot realtek platform
dcache  - enable or disable data cache
dhcp    - boot image via network using DHCP/TFTP protocol
env     - environment handling commands
factory - FACTORY sub system
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls   - list files in a directory (default /)
fatwrite- write file into a dos filesystem
fdt     - flattened device tree utility commands
gettime - get timer val elapsed
go      - start application at address 'addr' or start running fw
goru    - start rescue linux from usb
gpt     - GUID Partition Table
help    - print command description/usage
i2c     - I2C sub-system
icache  - enable or disable instruction cache
keyset  - keyset - write keyset file into factory area
loady   - load binary file over serial line (ymodem mode)
md      - memory display
mtest   - simple RAM read/write test
mtest2  - simple RAM read/write test
mw      - memory write (fill)
ping    - send ICMP ECHO_REQUEST to network host
reset   - Perform RESET of the CPU
rtkfat  - Realtek FAT32 format utility v1.0
rtkfdt  - RTK fdt utility
rtkgpt  - rtkgpt utility
rtkrng  - rng utility
rtkspi  - spi flash utility
sata    - SATA sub system
saveenv - save environment variables to persistent storage
source  - run script from memory
tftp    - download image from TFTP server
tftpput - TFTP put command, for uploading files to a server
uart_write- for uart mp tool burn mac and sn key

unzip   - unzip a memory region
usb     - USB sub-system
version - print monitor, compiler and linker version
wdpp    - Western Digital Boot Patition Tool

Hi everybody I managed to hack my MCH I have done every step mentioned by you superior users ( especially Kryten I have learned linux basics because of his help ) but I have a little problem I don not know what to do next with Entware .
Is any GUI server I can install with Entware ?
How could I update / remove and re-install Plex media server for more malleability ?
If you Kryten could help me with some tutorials to dig my way into android world ?
And where are the path to my media files stored on plex shared media folders
Any help will be appreciated , thank u everybody in advance .

1 Like

I managed to install Debian Jessie (CLI) , transmission guiding its download folder to (/data/data/com.plex…/aut0|*******/plex) and it is working flawlessly . I also installed netdata server which is awesome because with it I knew the mounted folders for my hdd
I tried to install emby server but i could not get it working because after installation I did not know how to run it because there is no UI to do so even with adb command i could not make it working
Can someone help with emby/plex server ?
Please guys keep this topic up and running

Finally I found some spare time to prepare Bootable USB with Ubuntu.
I’ve connected the drive to Ubunto pc, changed build.prop, changed files in saata18. But when I connected this drive To LAN, I can;t localise it - i checked on router by MAC adrress and there is no such device. (my cloud app on android says that the drive is not connected to the internet) Any suggestions how can I find it?
Every piece of advice is appriciated.
Thanks in advance

If I understand you correctly I’d say the most likely cause is that the start-up procedure is failing to initialize the Ethernet interface. This happened to me briefly when I was hacking my MCH. There might be a number of reasons and you need to look at the logs to find out what’s gone wrong.

The interface is started in the last stages of the Android init sequence so your file changes may have broken an earlier start-up phase.

Your best bet is to attach a console cable as described in my previous post. You can then watch the start up live in a Putty session and then, probably, you’ll be able to log onto the console and correct the problem or start the interface manually.

Hello Kryten, did you manage to add smb users and personnal shares ?
I’m still stuck @ run the cron task on every boot and lost in using “smbpasswd -a user”
Any help appreciate :innocent::smiling_face_with_three_hearts:
@juju Many many thanks for the sharing: you rocks !

Yes I did get the MCH to work as a very fast samba host, but not the way I originally intended. Details to follow when I get time, but basically I hacked the MCH startup scripts such that it no longer starts up the WD-installed Samba, and instead starts up the ENTWARE Samba (v3.6). Then I created my own smb.conf to share files from my own fileshares directory on /data/wd/diskVolume0/.

When using the ENTWARE Samba all the config files are held in /opt including the password files.

The MCH is now running about 10x the speed of my old LG NAS, mainly due to the much faster modern hardware but also because the O/S is minimal. It’s so good I even bought another MCH -prices are currently low. I’m experimenting with a cheap blank non-WD disk on this one to see if I can network boot Ubuntu Server and install a full distro.

Hell yeah! Brilliant idea!
I’m not this good to do that on a minute, but I will search in that direction:upside_down_face:
Thank you very much for replying and telling us the key paths. :ok_hand:t4: