My Cloud PR4100 / PR2100 Firmware Analysis


#265

Thanks Tfl, tried but didnt boot. I dont actually see any activity in the USB as if it didnt even tried to read from it. I tested the USB ports and at least they do have power.
Blinking blue led starts almost immediately as turned on, I just tried the mems in my laptop and both banks are fine but I also tried booting the NAS without memory, expecting another behavior or even a different message in the display but again nothing different happened, same blue led almost instantly and Welcome message.
any other suggestion from you or the experts here will be greatly appreciated


#266

The files contained within the rescue.zip file are in a rescue folder, but everything within the rescue folder must be extracted and copied to the root of the USB stick or it won’t boot. This may be the source of your problem while trying to boot the rescue files from USB.

Afterwards, you should be able to boot the NAS from the USB stick and access the rescue firmware upload page via the web browser by typing the NAS IP address into the address bar.

Simply navigate to the latest (as of this date) WD firmware bin file for the PR4100 via the browse button, then click the apply button. Note that the latest PR4100 firmware bin file must first be downloaded to your computer, a direct link is provided below.

WD PR4100 Firmware Release 2.30.193 (05/08/2018)


#267

Thanks dswv42. Correct here is the structure of the USB

I tested the pendrive in a notebook just to make sure that grub is properly configured and I was able to reach the grub menu so the pendrive seems to be fine. Even when trying to boot the NAS from the pendrive I still get the flashing blue led is that normal? it happens almost instantly as I power it on. Also checked my DNS and the NAS is never pulling for an IP. Thanks


#268

My first thought is to try using a different USB flash drive. In some cases there can be certain hardware incompatibilities which can cause it to fail to boot properly. In my experience, small inexpensive USB flash drives tend to work best for booting purposes.

The PR4100 goes through several distinct phases during the boot process. Most notably, it starts out with the fan running at full speed after it’s first powered on, then about half way through the boot process the fan control drivers are loaded and the fan slows to about 1/4 of full speed and sounds much more quiet. Does your fan ever slow down?

The blue power light blinks through virtually the entire PR4100 boot process, so other than the fan speed, there is no way of telling exactly where it’s hanging without using the UART port to gain console access, where a full boot log can be observed to determine exactly what is going wrong. It’s important to note that not every USB to UART adapter will work, and only the one linked in my guide (shown below) has been tested and found to work as expected.


#269

Will try with different pendrive later today. As you mentioned Fan starts at full speed but never slows down, will keep running full speed for hours until I shut it down. I followed your UART guide but im not receiving any data in the terminal app. I do know my board works fine but its based on another processor (CP2102), yours is based on FT232 chip, maybe thats why Im not able to see the boot process.


#270

When you eventually get it to boot via USB and are able to view the console output, look for a line that says “Starting wdhws”, followed by a line that says “wdhws started”, this is roughly the point at which fan control is established. Not long afterwards you should see the lines “Starting wdtms” followed by “wdtms started”. Fan control is established at about 3/4 of the way into the full boot process.

Unfortunately, getting UART adapters to work properly can be a tricky proposition, and it’s quite possible that the CP2102 based devices may not be compatible with the PR4100 hardware. In my experience, the FT232 based devices have been solid performers, especially when interfacing with the PR4100, which I have done on countless occasions. It even saved the day after my PR4100 bricked itself after a power failure during a firmware update. WD support wanted me to send it in using their RMA process, but I wanted no part of that mess. By using the UART adapter, I was able to have it back up and running in minutes.

When using the UART adapter, make sure that you cross the TX and RX lines between the UART adapter and the PR4100 hardware because the TX must be able to talk to the RX and vise versa. The GND pin goes to GND and the VCC pin must remain disconnected. Also, the PR4100 runs on 3.3 volt, not 5 volt… which can potentially cause hardware damage, but not always, depending on the design of the UART adapter and perhaps a bit of luck.

Since your PR4100 is not booting properly, you should see something very similar to the following at the end of the normal boot process, just after it failed. Basically, the Linux kernel gets to a point where it doesn’t know what to do and it simply gives up, resulting in what is known as a kernel panic.

[    4.797935] Kernel panic - not syncing: No working init found.  Try passing init= option to kernel. See Linux Documentation/init.txt for guidance.
[    4.812613] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.1.13 #0
[    4.819225] Hardware name: WesternDigital WDBNFA0000NBK-00/BBC, BIOS 1.10 05/13/2016
[    4.827876]  0000000000000000 0000000000000000 ffffffffa57ae54e ffffffffa597f7e0
[    4.836149]  ffffffffa57ab3d3 0000000000000008 ffffffff00000008 ffff88017aef3f48
[    4.844422]  ffff88017aef3ee8 0000000000000000 ffff88017a958000 0000000000000014
[    4.852679] Call Trace:
[    4.855414]  [<ffffffffa57ae54e>] ? dump_stack+0x40/0x50
[    4.861338]  [<ffffffffa57ab3d3>] ? panic+0xbf/0x1c9
[    4.866883]  [<ffffffffa57a3270>] ? rest_init+0x80/0x80
[    4.872719]  [<ffffffffa57a3352>] ? kernel_init+0xe2/0xf0
[    4.878750]  [<ffffffffa57b59e2>] ? ret_from_fork+0x42/0x70
[    4.884974]  [<ffffffffa57a3270>] ? rest_init+0x80/0x80
[    4.890915] Kernel Offset: 0x24000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[    4.902966] drm_kms_helper: panic occurred, switching back to text console
[    4.910685] ---[ end Kernel panic - not syncing: No working init found.  Try passing init= option to kernel. See Linux Documentation/init.txt for guidance.

The lines preceeding the kernel panic will generally offer clues to what went wrong, but one must have the experience to know exactly what to look for. More often than not, it’s simply easier to boot from a rescue USB flash drive and reload the firmware.


#271

dswv42, Finally I borrowed one Ft232 board but still no getting info from the UART. I also used a different pendrive to check if it will boot into recovery but again nothing happened. I left the UARt connected while reseting (both 4 and 40sec) expecting to get some data but nothing was displayed. After some time I downloaded the debian iso found in other thread wondering if will install it to the first disk but nothing happened. Im wondering if the BIOS may be corrupted. Is there any way to check that? Or any other test suggested? Thanks


#272

Anything is possible, but I find it unlikely that BIOS would be corrupted. Verify that you have the UART adapter connected properly, it’s easy to get the wires crossed. Putty must also be configured correctly for communication to take place, and there is no margin for error. Other than that, I’m not certain what the problem could be. Are you using the UART adapter shown in my guide?

I’ve used the exact configurations in my guides many times, so I know they work.

For the time being, you should focus on getting the UART adapter working, and not worry about booting from USB, which is not required for a simple UART connection to see what is wrong.


#273

Agree. Tested with linux and W10 with putty and also minicom in linux. Also tested continuity in JST 4 connector and cable. Never connected the VCC pin, Actually the righter pin in my JST connector has no cable connected (to avoid any connection by mistake :slight_smile: ). Also tested that pin for VCC.

FT board seems to be working fine (VCC pin also without cable just in case…). tested RX & TX jumping both pins with success. Voltage selector is in 3.3V
I will fine another device at home with UART port to test, already opened 2 old cablemodem but none had UART ports at least easily identifiable.
Will keep checking and keep posting…


#274

Is there any key combination that will eventually stop the boot process? like the repeated “1” in EX2? (never tried but found another EX2 post that mentioned it.


#275

Not that I’m aware of.


#276

Was able to connect to a router using the FT board so “initially” I may discard a board issue. Im wondering if the Tx pin of the PR4100 is actually sending any signal. I only have a digital multimeter for testing, I see ping in 3.3v but sensitivity is not enough to catch any variation. any other suggestion on how to test if Tx is at least changing levels? maybe using a led with a resistor to GND but being a 115200 b port Im not sure if changes will be visible.


#277

The best time to see data on the TX pin is during the beginning of the boot process. A digital multimeter probably won’t show the slight voltage variations, and even an analog meter will only show a very slight needle movement, where one has to know exactly what to look for. Regardless, a logic analyzer is the best tool for the job.

It’s very unlikely that the PR4100 PCB has changed, so you can almost certainly consider the following image as having a valid pinout for the UART port. Don’t forget to cross TX and RX between the USB to UART adapter and the PR4100 PCB.

Otherwise, assuming everything is connected and configured properly, I can only assume that the USB to UART adapter you are using may be the culptit. Just because it works on one device, does not mean it will work on another. The following is the one I used during testing.

There is also the possibility that your PR4100 has a PCB problem, which could be the origin of your boot failure. However unlikely, it is possible.


#278

This is what the output of blkid and gdisk for the /dev/mmcblk0 eMMC flash device looks like on a fully functional PR4100 running WD firmware version 2.30.181. This information may be used to recreate the eMMC flash partitions in the event that they become corrupted.

gdisk

# gdisk /dev/mmcblk0
GPT fdisk (gdisk) version 0.8.10

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): p
Disk /dev/mmcblk0: 7487488 sectors, 3.6 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): DD687020-A775-4038-B95C-FEA0BEE556A6
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 7487454
Partitions will be aligned on 2048-sector boundaries
Total free space is 5072829 sectors (2.4 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048           73727   35.0 MiB    EF00  EFI System
   2           73728           94207   10.0 MiB    0700  kernel
   3           94208          114687   10.0 MiB    0700  ramdisk
   4          114688         2211839   1024.0 MiB  0700  image.cfs
   5         2211840         2293759   40.0 MiB    0700  rescue_fw
   6         2293760         2334719   20.0 MiB    0700  config
   7         2334720         2355199   10.0 MiB    0700  reserve1
   8         2355200         2375679   10.0 MiB    0700  reserve2
   9         2375680         2416639   20.0 MiB    0700  backup

blkid

/dev/mmcblk0: PTTYPE="gpt"
/dev/mmcblk0p1: LABEL="wdnas_efi" UUID="9FE2-0840" TYPE="vfat" PARTLABEL="EFI System" PARTUUID="842f11b3-9959-464f-9481-d57ab38b4287"
/dev/mmcblk0p2: LABEL="wdnas_kernel" UUID="c5d6e030-df55-4731-99e4-cbb2e5b771e2" TYPE="ext4" PARTLABEL="kernel" PARTUUID="20f4b3f3-9c9d-4e3d-a516-66dc8ca88fba"
/dev/mmcblk0p3: LABEL="wdnas_initramfs" UUID="6bab9bea-2650-4944-84ea-a6fc4ba3fdd0" TYPE="ext4"
/dev/mmcblk0p4: LABEL="wdnas_image.cfs" UUID="00035529-6b69-4fca-a0fd-cde0cd805a00" TYPE="ext4"
/dev/mmcblk0p5: LABEL="wdnas_rescue_fw" UUID="8c54a8c2-9055-407c-bab1-5985d107fb3a" TYPE="ext4"
/dev/mmcblk0p6: LABEL="wdnas_config" UUID="43eafe4c-2503-401e-b288-6cba67952ac9" TYPE="ext4"
/dev/mmcblk0p7: LABEL="wdnas_reserve1" UUID="74322663-4865-4609-8c97-437f50179e8f" TYPE="ext4"
/dev/mmcblk0p8: LABEL="wdnas_reserve2" UUID="d2ea041b-c475-41e4-978b-082fc53c47e8" TYPE="ext4"
/dev/mmcblk0p9: LABEL="wdnas_backup" UUID="46330f66-5c9f-4862-9053-6ba3461685be" TYPE="ext4"

The /dev/mmcblk0p7 and /dev/mmcblk0p8 wdnas_reserve devices are removed from the Linux device tree during the boot process so they must be recreated using the mknod command before they become visible using the blkid command.

mknod /dev/mmcblk0p7 b 179 7
mknod /dev/mmcblk0p8 b 179 8

The following is a complete /dev/mmcblk0 eMMC flash device node list, where the Linux major device identifier number is 179.

# ls -l /dev/mmcblk0
brw-rw----    1 root     root      179,   0 Aug  6 14:24 /dev/mmcblk0
# ls -l /dev/mmcblk0p?
brw-rw----    1 root     root      179,   1 Aug  6 14:24 /dev/mmcblk0p1
brw-rw----    1 root     root      179,   2 Aug  6 14:24 /dev/mmcblk0p2
brw-rw----    1 root     root      179,   3 Aug  6 14:24 /dev/mmcblk0p3
brw-rw----    1 root     root      179,   4 Aug  6 14:24 /dev/mmcblk0p4
brw-rw----    1 root     root      179,   5 Aug  6 14:24 /dev/mmcblk0p5
brw-rw----    1 root     root      179,   6 Aug  6 14:24 /dev/mmcblk0p6
brw-r--r--    1 root     root      179,   7 Aug 29 04:44 /dev/mmcblk0p7
brw-r--r--    1 root     root      179,   8 Aug 29 04:44 /dev/mmcblk0p8
brw-rw----    1 root     root      179,   9 Aug  6 14:24 /dev/mmcblk0p9

cat /proc/partitions

major minor  #blocks  name

 179        0    3743744 mmcblk0
 179        1      35840 mmcblk0p1
 179        2      10240 mmcblk0p2
 179        3      10240 mmcblk0p3
 179        4    1048576 mmcblk0p4
 179        5      40960 mmcblk0p5
 179        6      20480 mmcblk0p6
 179        7      10240 mmcblk0p7
 179        8      10240 mmcblk0p8
 179        9      20480 mmcblk0p9
 179       48        128 mmcblk0rpmb
 179       32       2048 mmcblk0boot1
 179       16       2048 mmcblk0boot0

Linux Device Tree Reference:

https://www.kernel.org/doc/html/v4.15/admin-guide/devices.html


#279

This script fails on .tar.gz and .tgz files, but Python is not my specialty so I don’t know why. Possibly a bug? It works fine on uImage, uRamdisk and image.cfs files. The following is the error it generates…

Traceback (most recent call last):
  File "./checksum.py", line 13, in <module>
    check ^= struct.unpack('<I', data)[0]
struct.error: unpack requires a string argument of length 4

#280

I discovered a new PR4100 MCU hardware control command which triggers a previously unknown system buzzer. However, control is erratic and once you get it started it’s hard to turn it off. The sound is very annoying, and sending certain hex values appear to change the pitch or frequency and duration of the sound.

Sending a hex value of 00 results in an ACK response from the MCU, and everything else results in an ALERT response.

echo 'BZR=10' > /dev/ttyS2


#281

Meaningful hardware information for the PR4100. This is required to properly configure a new Linux Kernel for full hardware support.

# lspci -k (Class, Vendor, Device Codes Added)

00:00.0 Class 0600: 8086:2280 - Intel Host bridge SoC Transaction Register (iosf_mbi_pci)
00:02.0 Class 0300: 8086:22b1 - Intel Integrated Graphics Controller (i915)
00:10.0 Class 0805: 8086:2294 - Intel MMC Controller (sdhci-pci)
00:12.0 Class 0805: 8086:2296 - Intel SD Controller (sdhci-pci)
00:13.0 Class 0106: 8086:22a3 - Intel SATA Controller (ahci)
00:14.0 Class 0c03: 8086:22b5 - Intel USB xHCI Controller
00:18.0 Class 0801: 8086:22c0 - Intel LPIO2 DMA Controller
00:18.2 Class 0c80: 8086:22c2 - Intel LPIO2 I2C Controller #2
00:18.3 Class 0c80: 8086:22c3 - Intel LPIO2 I2C Controller #3
00:18.4 Class 0c80: 8086:22c4 - Intel LPIO2 I2C Controller #4
00:18.6 Class 0c80: 8086:22c6 - Intel LPIO2 I2C Controller #6
00:18.7 Class 0c80: 8086:22c7 - Intel LPIO2 I2C Controller #7
00:1a.0 Class 1080: 8086:2298 - Intel Trusted Execution Engine
00:1b.0 Class 0403: 8086:2284 - Intel High Definition Audio Controller
00:1c.0 Class 0604: 8086:22c8 - Intel PCI Express Port #1
00:1c.1 Class 0604: 8086:22ca - Intel PCI Express Port #2
00:1c.2 Class 0604: 8086:22cc - Intel PCI Express Port #3
00:1c.3 Class 0604: 8086:22ce - Intel PCI Express Port #4
00:1e.0 Class 0801: 8086:2286 - Intel LPIO1 DMA Controller
00:1e.3 Class 0780: 8086:228a - Intel LPIO1 HSUART Controller #1 (serial)
00:1e.4 Class 0780: 8086:228c - Intel LPIO1 HSUART Controller #2 (serial)
00:1f.0 Class 0601: 8086:229c - Intel ISA bridge (lpc_ich)
00:1f.3 Class 0c05: 8086:2292 - Intel SMBus Controller (i801_smbus)
01:00.0 Class 0200: 10ec:8168 - Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (r8169)
02:00.0 Class 0200: 10ec:8168 - Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (r8169)
03:00.0 Class 0106: 1b21:0612 - ASMedia ASM1062 Serial ATA Controller (ahci)
04:00.0 Class 0106: 1b21:0612 - ASMedia ASM1062 Serial ATA Controller (ahci)

lspci -v

00:00.0 Host bridge: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SoC Transaction Register (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0
        Kernel driver in use: iosf_mbi_pci
lspci: Unable to load libkmod resources: error -12

00:02.0 VGA compatible controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Integrated Graphics Controller (rev 35) (prog-if 00 [VGA controller])
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 119
        Memory at 80000000 (64-bit, non-prefetchable) [size=16M]
        Memory at 90000000 (64-bit, prefetchable) [size=256M]
        I/O ports at f000 [size=64]
        Expansion ROM at <unassigned> [disabled]
        Capabilities: [d0] Power Management version 2
        Capabilities: [90] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [b0] Vendor Specific Information: Len=07 <?>
        Kernel driver in use: i915

00:10.0 SD Host controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series MMC Controller (rev 35) (prog-if 01)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 16
        Memory at 81626000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3
        Kernel driver in use: sdhci-pci

00:12.0 SD Host controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SD Controller (rev 35) (prog-if 01)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 18
        Memory at 81625000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3
        Kernel driver in use: sdhci-pci

00:13.0 SATA controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series SATA Controller (rev 35) (prog-if 01 [AHCI 1.0])
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, 66MHz, medium devsel, latency 0, IRQ 120
        I/O ports at f060 [size=32]
        Memory at 81624000 (32-bit, non-prefetchable) [size=2K]
        Capabilities: [80] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [70] Power Management version 3
        Capabilities: [a8] SATA HBA v1.0
        Kernel driver in use: ahci

00:14.0 USB controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series USB xHCI Controller (rev 35) (prog-if 30 [XHCI])
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, medium devsel, latency 0, IRQ 125
        Memory at 81600000 (64-bit, non-prefetchable) [size=64K]
        Capabilities: [70] Power Management version 2
        Capabilities: [80] MSI: Enable+ Count=1/8 Maskable- 64bit+
        Kernel driver in use: xhci_hcd

00:18.0 DMA controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 DMA Controller (rev 35) (prog-if 02 [EISA DMA])
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 11
        Memory at 81618000 (32-bit, non-prefetchable) [size=16K]
        Capabilities: [80] Power Management version 3

00:18.2 Serial bus controller [0c80]: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #2 (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 10
        Memory at 81623000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3

00:18.3 Serial bus controller [0c80]: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #3 (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 255
        Memory at 81622000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3

00:18.4 Serial bus controller [0c80]: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #4 (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 11
        Memory at 81621000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3

00:18.6 Serial bus controller [0c80]: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #6 (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 10
        Memory at 81620000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3

00:18.7 Serial bus controller [0c80]: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO2 I2C Controller #7 (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 255
        Memory at 8161f000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3

00:1a.0 Encryption controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series Trusted Execution Engine (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 10
        Memory at 81100000 (32-bit, non-prefetchable) [size=1M]
        Memory at 81000000 (32-bit, non-prefetchable) [size=1M]
        Capabilities: [80] Power Management version 3
        Capabilities: [a0] MSI: Enable- Count=1/1 Maskable- 64bit-

00:1b.0 Audio device: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series High Definition Audio Controller (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, fast devsel, latency 0, IRQ 5
        Memory at 81614000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: [50] Power Management version 2
        Capabilities: [60] MSI: Enable- Count=1/1 Maskable- 64bit+

00:1c.0 PCI bridge: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #1 (rev 35) (prog-if 00 [Normal decode])
        Flags: bus master, fast devsel, latency 0, IRQ 115
        Bus: primary=00, secondary=01, subordinate=01, sec-latency=0
        I/O behind bridge: 0000e000-0000efff
        Memory behind bridge: 81500000-815fffff
        Capabilities: [40] Express Root Port (Slot+), MSI 00
        Capabilities: [80] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [90] Subsystem: Intel Corporation Device 7270
        Capabilities: [a0] Power Management version 3
        Capabilities: [100] #00
        Capabilities: [200] L1 PM Substates
        Kernel driver in use: pcieport

00:1c.1 PCI bridge: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #2 (rev 35) (prog-if 00 [Normal decode])
        Flags: bus master, fast devsel, latency 0, IRQ 116
        Bus: primary=00, secondary=02, subordinate=02, sec-latency=0
        I/O behind bridge: 0000d000-0000dfff
        Memory behind bridge: 81400000-814fffff
        Prefetchable memory behind bridge: 0000000081700000-00000000818fffff
        Capabilities: [40] Express Root Port (Slot+), MSI 00
        Capabilities: [80] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [90] Subsystem: Intel Corporation Device 7270
        Capabilities: [a0] Power Management version 3
        Capabilities: [100] #00
        Capabilities: [200] L1 PM Substates
        Kernel driver in use: pcieport

00:1c.2 PCI bridge: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #3 (rev 35) (prog-if 00 [Normal decode])
        Flags: bus master, fast devsel, latency 0, IRQ 117
        Bus: primary=00, secondary=03, subordinate=03, sec-latency=0
        I/O behind bridge: 0000c000-0000cfff
        Memory behind bridge: 81300000-813fffff
        Capabilities: [40] Express Root Port (Slot+), MSI 00
        Capabilities: [80] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [90] Subsystem: Intel Corporation Device 7270
        Capabilities: [a0] Power Management version 3
        Capabilities: [100] #00
        Capabilities: [200] L1 PM Substates
        Kernel driver in use: pcieport

00:1c.3 PCI bridge: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCI Express Port #4 (rev 35) (prog-if 00 [Normal decode])
        Flags: bus master, fast devsel, latency 0, IRQ 118
        Bus: primary=00, secondary=04, subordinate=04, sec-latency=0
        I/O behind bridge: 0000b000-0000bfff
        Memory behind bridge: 81200000-812fffff
        Capabilities: [40] Express Root Port (Slot+), MSI 00
        Capabilities: [80] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [90] Subsystem: Intel Corporation Device 7270
        Capabilities: [a0] Power Management version 3
        Capabilities: [100] #00
        Capabilities: [200] L1 PM Substates
        Kernel driver in use: pcieport

00:1e.0 DMA controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO1 DMA Controller (rev 35) (prog-if 02 [EISA DMA])
        Subsystem: Intel Corporation Device 7270
        Flags: fast devsel, IRQ 5
        Memory at 81610000 (32-bit, non-prefetchable) [disabled] [size=16K]
        Capabilities: [80] Power Management version 3

00:1e.3 Communication controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO1 HSUART Controller #1 (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: fast devsel, IRQ 18
        Memory at 8161e000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3
        Kernel driver in use: serial

00:1e.4 Communication controller: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series LPIO1 HSUART Controller #2 (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: fast devsel, IRQ 19
        Memory at 8161d000 (32-bit, non-prefetchable) [size=4K]
        Capabilities: [80] Power Management version 3
        Kernel driver in use: serial

00:1f.0 ISA bridge: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx Series PCU (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: bus master, medium devsel, latency 0
        Capabilities: [e0] Vendor Specific Information: Len=0c <?>
        Kernel driver in use: lpc_ich

00:1f.3 SMBus: Intel Corporation Atom/Celeron/Pentium Processor x5-E8000/J3xxx/N3xxx SMBus Controller (rev 35)
        Subsystem: Intel Corporation Device 7270
        Flags: medium devsel, IRQ 18
        Memory at 8161c000 (32-bit, non-prefetchable) [size=32]
        I/O ports at f040 [size=32]
        Capabilities: [50] Power Management version 3
        Kernel driver in use: i801_smbus

01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 15)
        Subsystem: Realtek Semiconductor Co., Ltd. Device 0123
        Flags: bus master, fast devsel, latency 0, IRQ 123
        I/O ports at e000 [size=256]
        Memory at 81504000 (64-bit, non-prefetchable) [size=4K]
        Memory at 81500000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: [40] Power Management version 3
        Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit+
        Capabilities: [70] Express Endpoint, MSI 01
        Capabilities: [b0] MSI-X: Enable- Count=4 Masked-
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [140] Virtual Channel
        Capabilities: [160] Device Serial Number 01-00-00-00-68-4c-e0-00
        Capabilities: [170] Latency Tolerance Reporting
        Capabilities: [178] L1 PM Substates
        Kernel driver in use: r8169

02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 15)
        Subsystem: Realtek Semiconductor Co., Ltd. Device 0123
        Physical Slot: 1
        Flags: bus master, fast devsel, latency 0, IRQ 124
        I/O ports at d000 [size=256]
        Memory at 81404000 (64-bit, non-prefetchable) [size=4K]
        Memory at 81400000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: [40] Power Management version 3
        Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit+
        Capabilities: [70] Express Endpoint, MSI 01
        Capabilities: [b0] MSI-X: Enable- Count=4 Masked-
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [140] Virtual Channel
        Capabilities: [160] Device Serial Number 01-00-00-00-68-4c-e0-00
        Capabilities: [170] Latency Tolerance Reporting
        Capabilities: [178] L1 PM Substates
        Kernel driver in use: r8169

03:00.0 SATA controller: ASMedia Technology Inc. ASM1062 Serial ATA Controller (rev 01) (prog-if 01 [AHCI 1.0])
        Subsystem: ASMedia Technology Inc. Device 1060
        Flags: bus master, fast devsel, latency 0, IRQ 121
        I/O ports at c050 [size=8]
        I/O ports at c040 [size=4]
        I/O ports at c030 [size=8]
        I/O ports at c020 [size=4]
        I/O ports at c000 [size=32]
        Memory at 81310000 (32-bit, non-prefetchable) [size=512]
        Expansion ROM at 81300000 [disabled] [size=64K]
        Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [78] Power Management version 3
        Capabilities: [80] Express Legacy Endpoint, MSI 00
        Capabilities: [100] Virtual Channel
        Kernel driver in use: ahci

04:00.0 SATA controller: ASMedia Technology Inc. ASM1062 Serial ATA Controller (rev 01) (prog-if 01 [AHCI 1.0])
        Subsystem: ASMedia Technology Inc. Device 1060
        Flags: bus master, fast devsel, latency 0, IRQ 122
        I/O ports at b050 [size=8]
        I/O ports at b040 [size=4]
        I/O ports at b030 [size=8]
        I/O ports at b020 [size=4]
        I/O ports at b000 [size=32]
        Memory at 81210000 (32-bit, non-prefetchable) [size=512]
        Expansion ROM at 81200000 [disabled] [size=64K]
        Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [78] Power Management version 3
        Capabilities: [80] Express Legacy Endpoint, MSI 00
        Capabilities: [100] Virtual Channel
        Kernel driver in use: ahci

# dmesg | grep tty

serial8250: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
0000:00:1e.3: ttyS1 at MMIO 0x8161e000 (irq = 18, base_baud = 2764800) is a 16550A
0000:00:1e.4: ttyS2 at MMIO 0x8161d000 (irq = 19, base_baud = 2764800) is a 16550A

# ls -l /sys/class/tty/*/device/driver

/sys/class/tty/ttyS0/device/driver -> ../../../bus/platform/drivers/serial8250
/sys/class/tty/ttyS1/device/driver -> ../../../bus/pci/drivers/serial
/sys/class/tty/ttyS2/device/driver -> ../../../bus/pci/drivers/serial
/sys/class/tty/ttyS3/device/driver -> ../../../bus/platform/drivers/serial8250

#282

I guess my checker script doesn’t compensate for alignment errors (size should be multiple of 4 bytes).
Add padding like this:

with open(img, 'rb') as fi, open(img+'.sign', 'wb') as fo:
    data = fi.read(4)
    check = 0
    
    # prepare header
    fo.write('\x00' * 2048)
    
    while data:
        fo.write(data)
        data = data.ljust(4, '\0')   # added extra padding
        check ^= struct.unpack('<I', data)[0]
        data = fi.read(4)

    ln = struct.pack('<I', os.path.getsize(img))
    ck = struct.pack('<I', check)

    # fill in header
    fo.seek(0)
    fo.write(ln)
    fo.write(ck)    
    
    print 'len', ln.encode('hex'), os.path.getsize(img)
    print 'chk', ck.encode('hex')

If the checksum is wrong, use rjust instead.
EDIT: low memory version… the read at the end was dirty code :slight_smile:
EDIT2: but the small writes may be slower… in that case revert to the fo.write(fi.read())


#283

I was thinking the same thing, and tried the changes you suggested, but it results in the same error for .tar.gz and .tgz files.

Traceback (most recent call last):
  File "./checksum.py", line 13, in <module>
    check ^= struct.unpack('<I', data)[0]
struct.error: unpack requires a string argument of length 4

I tried something different and it appears to work now.

Replace this:
data.ljust(4, '\0')

With this:
data = data.ljust(4, '\0')

Or this:
data += "\0" * (4 - len(data))


#284

Scripts to extract and validate the contents of WD My Cloud firmware bin files. Entware and xxd are required to run them on the NAS using SSH. These should work on most modern My Cloud firmware bin files, with slight modifications, but I’ve only tested them on the PR4100 (and a few others) so you’re on your own there.

fw_extract.sh

#!/bin/bash

# Example Usage: ./fw_extract.sh /shares/Public/My_Cloud_PR4100_2.30.193.bin

fw_bin=$1

if [ "$fw_bin" = "" ]; then
	echo "Must supply a valid path and filename.";
else
	if [ -f $fw_bin ]; then
		fw_header=$(xxd -ps -c128 -l128 $fw_bin);
		echo

		echo "File: uImage";
		offset_1=$(printf "%d\n" 0x${fw_header:6:2}${fw_header:4:2}${fw_header:2:2}${fw_header:0:2});
		len_1=$(printf "%d\n" 0x${fw_header:14:2}${fw_header:12:2}${fw_header:10:2}${fw_header:8:2});
		checksum_1=${fw_header:64:2}${fw_header:66:2}${fw_header:68:2}${fw_header:70:2};
		dd if=$fw_bin of=uImage bs=1 count=$len_1 skip=$offset_1;
		checksum_tmp=$(./checksum.py uImage);
		if [ $checksum_tmp = $checksum_1 ]; then echo "Checksum:" $checksum_tmp "(OK)"; else echo "Checksum:" $checksum_tmp "(ERROR)"; fi;
		echo

		echo "File: uRamdisk";
		offset_2=$(printf "%d\n" 0x${fw_header:22:2}${fw_header:20:2}${fw_header:18:2}${fw_header:16:2});
		len_2=$(printf "%d\n" 0x${fw_header:30:2}${fw_header:28:2}${fw_header:26:2}${fw_header:24:2});
		checksum_2=${fw_header:72:2}${fw_header:74:2}${fw_header:76:2}${fw_header:78:2};
		dd if=$fw_bin of=uRamdisk bs=1 count=$len_2 skip=$offset_2;
		checksum_tmp=$(./checksum.py uRamdisk);
		if [ $checksum_tmp = $checksum_2 ]; then echo "Checksum:" $checksum_tmp "(OK)"; else echo "Checksum:" $checksum_tmp "(ERROR)"; fi;
		echo

		echo "File: image.cfs"
		offset_3=$(printf "%d\n" 0x${fw_header:38:2}${fw_header:36:2}${fw_header:34:2}${fw_header:32:2});
		len_3=$(printf "%d\n" 0x${fw_header:46:2}${fw_header:44:2}${fw_header:42:2}${fw_header:40:2});
		checksum_3=${fw_header:80:2}${fw_header:82:2}${fw_header:84:2}${fw_header:86:2};
		dd if=$fw_bin of=image.cfs bs=1 count=$len_3 skip=$offset_3;
		checksum_tmp=$(./checksum.py image.cfs);
		if [ $checksum_tmp = $checksum_3 ]; then echo "Checksum:" $checksum_tmp "(OK)"; else echo "Checksum:" $checksum_tmp "(ERROR)"; fi;
		echo

		echo "File: default.tar.gz";
		offset_4=$(printf "%d\n" 0x${fw_header:54:2}${fw_header:52:2}${fw_header:50:2}${fw_header:48:2});
		len_4=$(printf "%d\n" 0x${fw_header:62:2}${fw_header:60:2}${fw_header:58:2}${fw_header:56:2});
		checksum_4=${fw_header:88:2}${fw_header:90:2}${fw_header:92:2}${fw_header:94:2};
		dd if=$fw_bin of=default.tar.gz bs=1 count=$len_4 skip=$offset_4;
		checksum_tmp=$(./checksum.py default.tar.gz);
		if [ $checksum_tmp = $checksum_4 ]; then echo "Checksum:" $checksum_tmp "(OK)"; else echo "Checksum:" $checksum_tmp "(ERROR)"; fi;
		echo

		next_offset=$(printf "%d\n" 0x${fw_header:254:2}${fw_header:252:2}${fw_header:250:2}${fw_header:248:2});
		ex_header=$(xxd -ps -c96 -l96 -s$next_offset $fw_bin);
		ex_name=$(echo ${ex_header:64:64} | xxd -r -p);
		ex_offset=$(printf "%d\n" 0x${ex_header:166:2}${ex_header:164:2}${ex_header:162:2}${ex_header:160:2});
		ex_len=$(printf "%d\n" 0x${ex_header:174:2}${ex_header:172:2}${ex_header:170:2}${ex_header:168:2});
		ex_checksum=${ex_header:176:2}${ex_header:178:2}${ex_header:180:2}${ex_header:182:2};

		echo "File:" $ex_name
		dd if=$fw_bin of=$ex_name bs=1 count=$ex_len skip=$ex_offset;
		checksum_tmp=$(./checksum.py $ex_name);
		if [ $checksum_tmp = $ex_checksum ]; then echo "Checksum:" $checksum_tmp "(OK)"; else echo "Checksum:" $checksum_tmp "(ERROR)"; fi;
		echo
	else
		echo "File $fw_bin does not exist.";
	fi
fi

checksum.py

#!/usr/bin/python

import sys, struct, os
img = sys.argv[1]

with open(img, 'rb') as fi:
    data = fi.read(4)
    check = 0
    while data:
	data += "\0" * (4 - len(data))
        check ^= struct.unpack('<I', data)[0]
        data = fi.read(4)

ck = struct.pack('<I', check)
print ck.encode('hex')

Script output

# ./fw_extract.sh My_Cloud_PR4100_2.30.193.bin

File: uImage
5793648+0 records in
5793648+0 records out
5793648 bytes (5.5MB) copied, 19.646724 seconds, 288.0KB/s
Checksum: 28821b58 (OK)

File: uRamdisk
3860688+0 records in
3860688+0 records out
3860688 bytes (3.7MB) copied, 13.207806 seconds, 285.5KB/s
Checksum: ec7ec03b (OK)

File: image.cfs
102987776+0 records in
102987776+0 records out
102987776 bytes (98.2MB) copied, 345.090554 seconds, 291.4KB/s
Checksum: 00702306 (OK)

File: default.tar.gz
16733+0 records in
16733+0 records out
16733 bytes (16.3KB) copied, 0.056549 seconds, 289.0KB/s
Checksum: 8b7b8115 (OK)

File: grub.tgz
182605+0 records in
182605+0 records out
182605 bytes (178.3KB) copied, 0.618591 seconds, 288.3KB/s
Checksum: 9646bdcf (OK)