Firmware update

Update Files
The TeraStation is known to ship with firmware versions up to 1.12.

As of 2005-07-12 Buffalo US has v1.05 and Buffalo Japan has v1.13.

As of 2005-11-15 Buffalo US has v1.12.

(See Software for details on 2.x firmware. --Fred 14:40, 8 Dec 2005 (CET))

The TeraStation 㿧鿊㿼㿆 - ファームウェア情報 mentions some more versions, but they are not available any more.

The update file from the Japanese site is a selfextracting LHA archive, but the international versions might be ZIP files. Once extracted you'll get the following files (in this case from an 1.05 update):

-rw-r--r-- 1 bg bg    77824 Apr  6 16:32 HD-HTGL FWUpdate.exe -rw-r--r-- 1 bg bg  4194304 Feb 14 11:07 allimage.bin -rw-r--r-- 1 bg bg 40164851 Apr 15 17:12 image.dat -rw-r--r-- 1 bg bg       13 Apr  1 11:13 linkstation_version.txt


 * HD-HTGL FWUpdate.exe: A Windows binary that updates the TeraStation. Note that you may have to enable "Windows 2000 compatibility mode" on Windows XP for this to run!
 * allimage.bin: The content of the flash-rom.
 * image.dat: an encrypted ZIP file that contains a .tgz of the on disk firmware.
 * linkstation_version.txt: a text file that tells the FWUpdate.exe what firmware version the two images files are for.

Updating the TeraStation
To update the TeraStation, you must run FWUpdate.exe.


 * At start it checks for the image files and the linkstation_version.txt in the working directory.
 * It will first inform you that you should disable your firewall.
 * It will sent broadcast packets to find all TeraStations in your local LAN.
 * For each TeraStation found, it will query it for the installed firmware version. The TeraStation will report the firmware version from flash.
 * It will than offer you to update a TeraStation if the reported version is less than the version from linkstation_version.txt</tt>.
 * Once the update process is started, it proceeds like this:
 * First the new flash image allimage.bin</tt> is sent to the ls_servd</tt> daemon on the TeraStation.
 * The flash image is copied to /dev/mtdblock4</tt>.
 * /usr/local/bin/flash.sh</tt> is run to save the configuration to /dev/mtdblock3</tt>.
 * The kernel parameters are changed to root=/dev/ram0</tt> and the TeraStation is rebooted.
 * The new kernel and initrd are loaded and a new instance of ls_servd</tt> waits for the new hard disk image.
 * After unzipping (and decrypting) the image.dat</tt>, the included .tgz</tt> is extracted to the harddisk.
 * The kernel parameters are changed back to root=/dev/md0</tt> and the TeraStation is rebooted.
 * The new hard disk firmware restores the configuration.
 * During all this the Windows update program shows a progress bar.
 * Once the TeraStation is running, FWUpdate.exe</tt> informs you of the successful update, and displays the new version information.

Flash Firmware
The flash firmware (allimage.bin</tt>) seems to contain some kind of checksum, but there is firmimgtool from TeraStation �?��?��?��?�:

user@linuxbox ~$ gcc -o firmimgtool firmimgtool.c user@linuxbox ~$ ./firmimgtool Usage: ./firmimgtool [-icmkr] <firmimg_filename> -i : show firmimg_file information -c : cut out from firmimg_file -m : merge into firmimg_file -k : kernel image filename -r : ramdisk image filename -f : copy headers from file -h : show this help message

You could extract the kernel and the initrd from an existing firmware update, and replace either with your own. As the initrd is only used during firmware update, only the kernel seems interesting.

Disk Firmware
The on disk firmware (image.dat</tt>) is much more interesting, but it is an encrypted ZIP file. So all you need is the proper password and you can unzip/decrypt it:

user@linuxbox: ~$ unzip -p $PASSWORD image.dat Archive: image.dat inflating: tmpimage.tgz

tmpimage.tgz</tt> is the on disk firmware. It can be extracted on any unix sytem, but you should be root to preserve the device-nodes, ownerships and permissions.

root@linuxbox ~# mkdir fw1.05 root@linuxbox ~# cd fw1.05 root@linuxbox ~/fw1.05# tar -xz --numeric-owner -p -f ../tmpimage.tgz

I did that on the TeraStation, where the IDs match anyway, and could use only -xzf</tt>.

You can now add/change files as you like. e.g. install the [http:/files/dropbear.tgz dropbear] ssh server:

root@linuxbox ~/fw1.05# tar -xz --numeric-owner -p -f ../dropbear.tgz

or add the sudoers file:

root@linuxbox ~/fw1.05# cat <<EOF > etc/sudoers admin ALL=(ALL) ALL EOF root@linuxbox ~/fw1.05# chown root:root etc/sudoers root@linuxbox ~/fw1.05# chmod 440 etc/sudoers

You just have to tar/zip/encrypt it again:

root@linuxbox ~/fw1.05# tar -czf ../tmpimage-new.tgz. root@linuxbox ~/fw1.05# cd .. root@linuxbox ~# mv tmpimage.tgz tmpimage-old.tgz root@linuxbox ~# mv tmpimage-new.tgz tmpimage.tgz root@linuxbox ~# zip -e image.dat tmpimage.tgz Enter password: Verify password: adding: tmpimage.tgz

you can now use the new image.dat instead of the official one to upload your own firmware.

TeraStation Firmware Passwords
Sec spent sleepless nights figuring out these passwords, so all kudos to him.

TeraStation

 * {| class=wikitable

!| FIRMWARE !| PASSWORD !| 1.03 !| 1.04a !| 1.05 !| 1.07β !| 1.08 !| 1.09 !| 1.12 !| 1.13 !| 2.02 !| 2.03 !| 2.04b2 !| 2.05b1 !| 2.06 !| 2.07 !| 2.08 !| 2.10 !| 2.11 !| 2.12 !| 2.13 !| 2.14 !| 2.16
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * This has a new password - value not yet known
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * }

TeraStation Home Server

 * {| class=wikitable

!| FIRMWARE !| PASSWORD !| 2.03 !| 2.05b1 !| 2.09 !| 2.11
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * }

TeraStation Pro(TS-TGL)

 * {| class=wikitable

!| FIRMWARE !| PASSWORD !| 1.01-0.51 !| 1.03 !| 1.03-086B_german !| 1.04 !| 1.05 !| 1.06 !| 1.07 !| 1.09 !| 1.12
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4
 * IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * }

TeraStation Pro II

 * {| class=wikitable

!| FIRMWARE !| PASSWORD !| COMMENT !| 1.02 !| 1.04 !| 1.10 !| 1.11 !| 1.13 !| 1.20 !| 1.23
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty
 * IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty
 * aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB
 * 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l
 * For the versions here older passwords are used. Just try all passwords after the other until you find the right one.
 * YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4
 * }
 * }

TeraStation Live(HS-DHTGL)

 * {| class=wikitable

!| FIRMWARE !| PASSWORD !| 1.13
 * IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty
 * }

Password Summary

 * Gesammelte Passworte:

It appears from the tables above that only a few passwords are used by the updater, and they are recycled for different versions of the firmware. Here are the known passwords:

1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l YvSInIQopeipx66t_DCdfEvfP47qeVPhNhAuSYmA4 IeY8omJwGlGkIbJm2FH_MV4fLsXE8ieu0gNYwE6Ty aAhvlM1Yp7_2VSm6BhgkmTOrCN1JyE0C5Q6cB3oBB

Note how this list corresponds to Firmware_password

Links

 * Examine ARM9 Firmware without Updating