My Cloud PR4100/PR2100 Information

Temperatures are in celcius. See also the fancontrol -g 0 output.
Compare it with polling address 0x00, 0x01 and 0x23.
Address 0x10 is rubbish, I guess it’s a bug. Who cares about the digits behind the comma…

These are fan related commands I see during startup of wdhws.

get config with 'CFG'       --> CFG=02
set config with 'CFG=2'
set DLS with 'DLS=f'     
get version with 'VER'      --> VER=WD BBC v01
get ISR with 'ISR'          --> ISR=00
set IMR with 'IMR=FF'
get status with 'STA'       --> STA=6a
get temperature with 'TMP'  --> TMP=22 ... 34 degrees celcius

Then it sets fan speed and checks RPM + status.

Polling all possible 3 letter fields results in:

TMP=23   ---> clearly temperature

Then suddenly I got this after sending 'UPD'

========= WDPMC Update Menu v1.0 =============
Reset PMC -------------------------------- 0
Write Image To PMC Internal Flash -------- 1
Read Image From PMC Internal Flash ------- 2
Execute The New Program ------------------ 3
Invalid Number ! ==> The number should be either 1, 2 or 3

I guess I bricked something. Be careful not to spam the poor box with unknown commands!

I had a script running for about an hour that tried all 3 letter combinations… I’ll reboot when I get home.

What a relief. When you do a full power down and pulling the power cable, the module is reloaded.
No damage was done :slight_smile:

Honestly I care little about that chip :slight_smile:
ZFS here I come!

hello,now I created an emmc image with the partition table information in your posts.I booted latest firmware in virtualbox but there is no network.
The GRUB bootloader in the WD firmware could not load the linux kernel ,so I used ubuntu GRUB2 and a modified grub.cfg.
The firmware seems working in virtualbox, and I can see serial outputs from the virtualbox,although lots of device not found.i got a root terminal and using ifconfig ican only see the bonding and loopback interface (there should be two more ,egiga0 and egiga1),

so I wonder how to fix the network problem
and contact me if anyone want these virtualbox images

1 Like

Please find a forum, such as the,34103 link, and keep posting your discoveries. Or start a free Google Blog. Would much like to see your work evolve and get some help. Please post your code collection on github. Thanks for considering.

how do I get this access to my NAS.
firmware recovery in SAFE MODE

My pro4100 is not booting any more, display shows the welcome message but stuck in blinking blue power btn. ethernet port will never go up so theres no connectivity. (BTW I removed all HD from the unit). Tried already all reset procedures with no success. is it possible to share the img of the booting usb so that I can get into recovery? You can imagine that at this point i do have no concern about fan control not working or leds not properly mapped. Just need a valid img which will allow me to boot from usb into recovery to flash the latest firmware. BTW, so far im not having success with UART port, will test later at night…

Here are the rescue files. Put them on a FAT32 formatted USB drive and reinstall the firmware via the rescue wizard in the web interface.

Thanks Tfl, tried but didnt boot. I dont actually see any activity in the USB as if it didnt even tried to read from it. I tested the USB ports and at least they do have power.
Blinking blue led starts almost immediately as turned on, I just tried the mems in my laptop and both banks are fine but I also tried booting the NAS without memory, expecting another behavior or even a different message in the display but again nothing different happened, same blue led almost instantly and Welcome message.
any other suggestion from you or the experts here will be greatly appreciated

Thanks dswv42. Correct here is the structure of the USB

I tested the pendrive in a notebook just to make sure that grub is properly configured and I was able to reach the grub menu so the pendrive seems to be fine. Even when trying to boot the NAS from the pendrive I still get the flashing blue led is that normal? it happens almost instantly as I power it on. Also checked my DNS and the NAS is never pulling for an IP. Thanks

Will try with different pendrive later today. As you mentioned Fan starts at full speed but never slows down, will keep running full speed for hours until I shut it down. I followed your UART guide but im not receiving any data in the terminal app. I do know my board works fine but its based on another processor (CP2102), yours is based on FT232 chip, maybe thats why Im not able to see the boot process.

dswv42, Finally I borrowed one Ft232 board but still no getting info from the UART. I also used a different pendrive to check if it will boot into recovery but again nothing happened. I left the UARt connected while reseting (both 4 and 40sec) expecting to get some data but nothing was displayed. After some time I downloaded the debian iso found in other thread wondering if will install it to the first disk but nothing happened. Im wondering if the BIOS may be corrupted. Is there any way to check that? Or any other test suggested? Thanks

Agree. Tested with linux and W10 with putty and also minicom in linux. Also tested continuity in JST 4 connector and cable. Never connected the VCC pin, Actually the righter pin in my JST connector has no cable connected (to avoid any connection by mistake :slight_smile: ). Also tested that pin for VCC.

FT board seems to be working fine (VCC pin also without cable just in case…). tested RX & TX jumping both pins with success. Voltage selector is in 3.3V
I will fine another device at home with UART port to test, already opened 2 old cablemodem but none had UART ports at least easily identifiable.
Will keep checking and keep posting…

Is there any key combination that will eventually stop the boot process? like the repeated “1” in EX2? (never tried but found another EX2 post that mentioned it.

Was able to connect to a router using the FT board so “initially” I may discard a board issue. Im wondering if the Tx pin of the PR4100 is actually sending any signal. I only have a digital multimeter for testing, I see ping in 3.3v but sensitivity is not enough to catch any variation. any other suggestion on how to test if Tx is at least changing levels? maybe using a led with a resistor to GND but being a 115200 b port Im not sure if changes will be visible.

I guess my checker script doesn’t compensate for alignment errors (size should be multiple of 4 bytes).
Add padding like this:

with open(img, 'rb') as fi, open(img+'.sign', 'wb') as fo:
    data =
    check = 0
    # prepare header
    fo.write('\x00' * 2048)
    while data:
        data = data.ljust(4, '\0')   # added extra padding
        check ^= struct.unpack('<I', data)[0]
        data =

    ln = struct.pack('<I', os.path.getsize(img))
    ck = struct.pack('<I', check)

    # fill in header
    print 'len', ln.encode('hex'), os.path.getsize(img)
    print 'chk', ck.encode('hex')

If the checksum is wrong, use rjust instead.
EDIT: low memory version… the read at the end was dirty code :slight_smile:
EDIT2: but the small writes may be slower… in that case revert to the fo.write(

AMD related params may be irrelevant as it’s an intel processor.
Please add DVB drivers as a module to allow recording with TVHeadend / TV mosaic / … and some extra usb devices e.g. keyboard.
EDIT: I see… you didn’t include modules here :slight_smile:

While SMB1 is insecure and not recommended, sometimes it’s the only option to get your older hardware (e.g. printer, scanner) to work with OS3.
Another example is Kodi on Android: