Unbricking without opening

Hi all,

NEWS:

I have setup a github for my experiments.

So you can find all my information here:

https://github.com/utessel/mycloud

Most important:

This posting is about how to unbrick a MyCloud without opening it.

At least: Some important steps to do this…

Disclaimer:

1.) It is not a complete walkthrough how to do this.

2.) I cannot (and will not) explain or help how to unbrick your device.

3.) I hope someone else will clean this up, improve it and create something even more useful out of it:

I just wrote down the steps I did, (ok, with a little bit of cleanup already)

If there is a wiki or something like that for this: feel free to use my information.

4.) I will not provide any binaries I created for myself.

My background:

I bought a broken MyCloud (in fact to have a second one, just to be able try this) and started to “unbrick” that, and I was trying it the hard way: Not connecting the disk to anything else.

So in fact my MyCloud was open: This allowed me to use a serial console to watch what is happening. But that is finally not required at all.

The final result works like this:

  1. you need a working DHCP server that sends a TFTP Server address: I use dnsmasq for this. (don’t ask me how to configure that!)

  2. Setup a tftp folder with two files “startup.sh” and “uImage” (more about these files below)

  3. Execute (my) rawping command to send the magic ICMP packet (you find it in my other posting about the serial interface)

  4. Power your MyCloud device (I expect you already have a working LAN connection).

  5. Wait a bit and you can connect via telnet to your device and you can start to repair it.

So how does this work:

After power on the device starts the first and the second barebox loader.

The second barebox sees the “magic packet” and now tries to download startup.sh from the tftp server:

Mine looks like this:

startup.sh

echo Will boot via tftp
timeout -c 2
addpart /dev/mem 8M@0x3008000(uImage)
tftp uImage /dev/mem.uImage
bootargs="console=ttyS0,115200n8, "
bootargs="$bootargs mac_addr=$eth0.ethaddr panic=3"
bootm /dev/mem.uImage

This will now load the kernel (=uImage) via tftp and start it.

The kernel boots and will use its “initramfs” that I compiled into it:

My “initramfs” contains just the network modules, a busybox installation and a few scripts:

These scripts will start the network, make a dhcp request (again) and finally start telnetd:

Now I can connect via telnet to my box.

The whole procedure does not need anything on the disk at all.

I expect it would work even without having a disk, but I didn’t try that.

I now can mount partitions, communicate via network, whatever busybox allows.

So it should be possible to download new images to the disk etc.

Or simply repair the broken script you have changed?

You now might ask “how can i create that uImage file?”

For that I used two things:

  1. The kernel from the GPL package

  2. and the busybox sources (I used busybox-1.22.1 I already had from an openwrt installation).

For busybox I used “defconfig”, and changed (via menuconfig) to build it “static” (that is important).

For the kernel I changed (via menuconfig) to use initramfs and added the path to my initramfs.cpio.gz.

(in fact I tried a lot of other changes, but finally was able to remove all of them for this…)

Here is my script I used to compile busybox and the kernel and generating the scripts in the initramfs:

Disclaimer:

I know I don’t have all steps repeatable with this script. As I tried this several times, I know I copied the modules from the _bin folder (created during kernel compile) to the _install folder of busybox once.

Maybe I forgot other steps I did. But I hope someone else can fill this gap.

export ARCH=arm
export CROSS_COMPILE=arm-linux-gnueabi-
cd busybox-1.22.1
make -j8 install
cd _install
mkdir {bin,dev,sbin,etc,proc,sys,lib}
mkdir lib/modules
mkdir dev/pts
mkdir -p usr/share/udhcpc

echo "#!/bin/sh" >init
echo "mount -t proc proc /proc" >>init
echo "mount -t sysfs sysfs /sys" >>init
echo "mount -t devpts none /dev/pts" >>init
echo "echo /sbin/mdev >/proc/sys/kernel/hotplug" >>init
echo "mdev -s" >>init
echo "insmod /lib/modules/3.2.26/pfe.ko lro_mode=1 tx_qos=1 alloc_on_init=1" >>init
echo "ifconfig eth0 up" >>init
echo "udhcpc -b" >>init
echo "telnetd -l/bin/sh" >>init
echo "exec /sbin/init" >>init
chmod +x init
echo "T0:2345:respawn:/sbin/getty -L ttyS0 115200 vt100" >etc/inittab
echo "ttyS0::askfirst:-/bin/sh" >etc/inittab

echo "#!/bin/sh" >usr/share/udhcpc/default.script
echo "case \"\$1\" in" >>usr/share/udhcpc/default.script
echo " renew|bound)" >>usr/share/udhcpc/default.script
echo " /sbin/ifconfig \$interface \$ip \$BROADCAST \$NETMASK" >>usr/share/udhcpc/default.script
echo " ;;" >>usr/share/udhcpc/default.script
echo "esac" >>usr/share/udhcpc/default.script
echo "exit 0" >>usr/share/udhcpc/default.script
chmod +x usr/share/udhcpc/default.script

sudo mknod dev/null c 1 3
sudo mknod dev/tty c 5 0
sudo mknod dev/console c 5 1find . | cpio -H newc -o > ../../initramfs.cpio

cd ../..
cat initramfs.cpio | gzip > initramfs.cpio.gz
cp initramfs.cpio.gz packages/kernel_3.2/
cd packages/kernel_3.2

make uImage
cp _bld/arch/arm/boot/uImage /home/tftp/

Oh:

I used the compiler I got from the ubuntu 14.04 installation (sudo apt-get install gcc-arm-linux-gnueabi),

not the one wd uses.

In fact I think I will now try to setup a clean debian system on my device, as I don’t need all the cloud things…

Ciao,

  Baerle

5 Likes

nice

This can be useful to test custom built kernels too

for WD_ICMP_ENCODE_MSG check :

http://community.wd.com/t5/WD-My-Cloud/Hardware-hacking/td-p/733364

Related hack , have you managed to setup netconsole ?

This looks like a promising means. With the serial display involved, is it possible at all to connect a USB Keyboard onto the device and log in to the terminal prompt during a normal boot? I’d like to try a number of things involving manually retrace commamds to fix a problem I’m currently having, which involves with the network interface configuration breaking any means of connecting to the device.

Hi,

If you are connected to the internal serial interface you don’t need a usb keyboard connected to the disk, at least to its USB port. There is nothing like “serial display”: There is a serial connector internally: So you need to open the device, and create your own connector for that port. It also has a Rx Pin.

If you connect a 3,3V serial adapter  you can log in and type any commands you want via that serial port.

Ciao,

  Baerle

Ahh fair enough.  In any case, with the help of @Fox_exe, it looks like he also managed to reproduce the booting into the myCloud device by means of the special ping (although he used a method using WinPCap; I’m also using a Windows environment which is really convenient this is possible, but would have been happy to manage via a Linux Guest).

Given that it is indeed possible to browse the filesystem on the BusyBox ramfs environment, was it ever possible to mount the full hard disk itself?   Although there are no issues mounting /dev/md126 or /dev/md127 which houses the device’s flash memory holding the OS and such, it didn’t look like any of the /dev/sda# partitions would play ball with mount.

Currently, without opening up the physical enclosure, I’m trying to investigate the means of tracing what is happening at standard boot (somehow my device decided to isolate itself from being visible on the LAN - even after adding the eth0 entry back into /etc/network/interfaces)

Looking in BusyBox on the MyCloud via Telnet, I can see the following:

/mnt # fdisk -l
fdisk: device has more than 2^32 sectors, can't use all of them
Found valid GPT with protective MBR; using GPT

Disk /dev/sda: 4294967295 sectors, 4095M
Logical sector size: 512
Disk identifier (GUID): e322dd27-e54e-4065-8de8-045fa0b3be00
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 5860533134

Number Start (sector) End (sector) Size Code Name
   1 1032192 5031935 1953M 0700 primary
   2 5031936 9031679 1953M 0700 primary
   3 30720 1032191 489M 0700 primary
   4 9428992 5860532223 2790G 0700 primary
   5 9031680 9226239 95.0M 0700 primary
   6 9226240 9422847 96.0M 0700 primary
   7 9422848 9424895 1024K 0700 primary
   8 9424896 9428991 2048K 0700 primary

Disk /dev/md127: 2047 MB, 2047803392 bytes
2 heads, 4 sectors/track, 499952 cylinders
Units = cylinders of 8 * 512 = 4096 bytes

Disk /dev/md127 doesn't contain a valid partition table

Disk /dev/md126: 2047 MB, 2047803392 bytes
2 heads, 4 sectors/track, 499952 cylinders
Units = cylinders of 8 * 512 = 4096 bytes

Disk /dev/md126 doesn't contain a valid partition table

So essentially the flash memory partitions are visible and read/writable, but not the physical 3TB disk itself on /dev/sda4.  Mounting just gives the usual “Device Busy”   EDIT: Looks like /dev/sda4 finally decided to mount after all.  Wonder why it didn’t work previously… :\

It does look like some things are manageable.  If it may, dd could possibly work for injecting img but I’m still not sure if the Device or resource busy messages would have an implication for those partitions whilst unmounted.

Launching ftpd via tcpsvd works, which makes things somewhat manageable to pass files in and out.

EDIT2: dd works.  Unbricking mycloud on BusyBox environment via Telnet successful! :smiley:

1 Like

Complete arhive with all needed software and files:

Includes:

  • Kernel with initrd (Busybox, mdadm)
  • Preconfigured Tftp and DHCP servers (For windows only. But all software available for Linux systems)
  • Howto / Readme file.

Tested, works fine.

Good that Foxexe was able to help you, I really don’t have the time for that…

So for your Edit2:

Nice to hear, so maybe it wasn’t useless to publish my findings :wink:

Ciao,

  Uli

@baerle: Certainly it wouldn’t have been possible if it weren’t for your earlier findings. :)  Community effort prevails once again.

1 Like

hi all

thanks to baerle and fox_exe for detailed procedure and support

i cannot mount /dev/sda4 i get ‘No such file or direcotry’

in the dmsg boot log i’ve got these

[    9.394868] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   14.938401] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   14.944867] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   20.488788] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   20.495250] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   26.038382] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   26.044844] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   31.588296] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   31.594755] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   37.138177] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   37.144638] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   42.688068] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   42.694530] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   48.238308] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   48.244769] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   53.788145] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   53.794605] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   59.339924] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   59.346383] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   64.886828] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   64.893294] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   70.441961] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   70.448420] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)
[   75.980575] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300)
[   75.987035] ata1.00: failed to IDENTIFY (INIT_DEV_PARAMS failed, err_mask=0x80)

so i’ve tried to open the wdmc (according to wd support i can open it to recover data)  but when i connect the disk is not recognized

diskutil info /dev/disk1

   Device Identifier:        disk1

   Device Node:              /dev/disk1

   Part of Whole:            disk1

   Device / Media Name:      WDC WD30 EFRX-68EUZN0 Media

   Volume Name:              Not applicable (no file system)

   Mounted:                  Not applicable (no file system)

   File System:              None

   Content (IOContent):      None

   OS Can Be Installed:      No

   Media Type:               Generic

   Protocol:                 USB

   SMART Status:             Not Supported

   Total Size:               0 B (0 Bytes) (exactly 0 512-Byte-Units)

   Volume Free Space:        Not applicable (no file system)

   Device Block Size:        512 Bytes

   Read-Only Media:          No

   Read-Only Volume:         Not applicable (no file system)

   Ejectable:                Yes

   Whole:                    Yes

   Internal:                 No

   OS 9 Drivers:             No

   Low Level Format:         Not supported

/dev/disk1

   #:                       TYPE NAME                    SIZE       IDENTIFIER

   0:                                                   *0 B        disk1

i’ve tried also to use diskutil diskRepair but i’ve got this

rror repairing map: POSIX reports: Invalid argument (22)

or

gpt recover /dev/disk1

gpt recover: unable to open device ‘/dev/disk1’: Operation not supported by device

do you know if i can:

  1. access to my data and recover data

  2. alternatively initialize disk from scratch 

?

any support is appreciated

thank you!!

Having a similar problem and would like to check what is wrong without opening the case.
Butt the archive with the preconfigured files ist not available anymore.
@Fox_exe: Could you please share it again?
Thanks

All here: https://drive.google.com/open?id=0B_6OlQ_H0PxVRXF4aFpYS2dzMEE

1 Like

Can we do the same Recover for WD my cloud gen2 ? Using DHCP, TFTP, nping, startup.sh & uImage.

Yeah, same method present, but im not test it.
Also in Gen2 possible to load kernel from USB flash…

Thank. Would you please share the instructions or link of boot from usb and recover boot of gen2?

Anyone knows what the magic packet for gen2 is?

The magic packet for gen2 is exactly the same. I tried it myself. However, the behavior is quite different than on gen1 devices:

  • Gen 2 starts up, eth0 link goes up and waits for the magic packet.
  • Use rawping from utessel to send magic packet.
  • DHCP is triggered, the gen2 MyCloud tries to get an IP.
  • After IP was assigned, it asks the TFTP for uImage and uRamdisk

** No startup.sh or so required, the gen2 already knows what to search!

But I dont have the right uImage nor the right uRamdisk for any recovery process (my HDD died).

I’ve mailed support. There must be a way to recover the firmware for gen2 Clouds.

Got it solved. The gen2 can be recovered via USB recovery. Its exactly as described in How I replace the HDD of mycloud gen2

hi all,

I spent hours trying to set up tftp without any success. When I get to the point executing start_ping.bat it gives this error:
pcap_open_live(eth0, 50, 1, 25) FAILED. Reported Error: Error opening adapter: The system cannot find the device specified. (20). Will wait 5 seconds then retry.

Do you guys maybe know what I’m doing wrong?

Thx for your help :slight_smile:

Use files from USB recovery.
Or original WD recovery: uImage uRamdisk

Thx for your reply!
However, I have a Gen1. Where do I get those files for the Gen1?
And am I supposed to put these files into tftproot?