Based on work by nix, frontalot and noName.
Originally by frontalot.
First some background. 'mtd' stands for memory technology device. Traditionally Unix (and Linux) just has two device types
- Block special files
- Character special files
The interfaces of these special files is and was primarily geared at communicating with devices like hard disks, tapes, or terminals. Flash memory, or other 'memory technology' doesn't match too well to the classic device interfaces. For example, writing to a flash device should usually be more controlled to avoid excessive wear and tear of the memory (flash memory allows just a limited number of re-writes). So a particular mtd interface was created in the kernel to support these devices better. In addition, for backward-compatibility with non-mtd-aware software and tools (most are not mtd-aware) the mtd interface was mapped back to the classic block and character special device interfaces. The LinkStation firmware contains the necessary mtd device driver and matching file entries under /dev.
Flash ROM analysis
|/dev/mtd0||90||0||0xbfc00000||0x040000||Boot loader (custom version of idt/sim)|
|/dev/mtd1||90||2||0xbfc40000||0x350000||Stores firmimg.bin (encrypted bzip2 compressed (vmlinux with embedded initrd.gz)).|
|/dev/mtd2||90||4||0xbffc0000||0x040000||Stores configuration files as conf_save.tar.gz (written by ls_flash).|
|/dev/mtd3||90||6||0xbfc00000||0x400000||The whole flash.|
|/dev/mtdblock0||31||0||Block special file version of mtd0.|
|/dev/mtdblock1||31||1||Block special file version of mtd1.|
|/dev/mtdblock2||31||2||Block special file version of mtd2.|
|/dev/mtdblock3||31||3||Block special file version of mtd3.|
Note: If the flash devices do not already exist, they can easily be created by mknod:
mknod /dev/mtd0 c 90 0 mknod /dev/mtd1 c 90 2 mknod /dev/mtd2 c 90 4 mknod /dev/mtd3 c 90 6 mknod /dev/mtdblock0 b 31 0 mknod /dev/mtdblock1 b 31 1 mknod /dev/mtdblock2 b 31 2 mknod /dev/mtdblock3 b 31 3
The kernel is compiled with embedded gzip-ed ram disk. The resulting ELF image is then compressed using bzip2 and then encrypted. An encrypted header is prepended and the result is firmimg.bin.
Contents of conf_save.tar.gz:
etc/network/interfaces etc/samba/ etc/samba/smb.conf etc/samba/lmhosts etc/samba/smbpasswd etc/samba/smbusers etc/samba/recycle.conf etc/samba/secrets.tdb etc/samba/smb.conf.bak etc/atalk/ etc/atalk/atalkd.conf etc/atalk/AppleVolumes.default etc/atalk/AppleVolumes.system etc/atalk/afpd.conf etc/atalk/config etc/atalk/config.papd etc/atalk/papd.conf etc/melco/ etc/melco/info etc/melco/shareinfo etc/melco/userinfo etc/melco/groupinfo etc/melco/ntp etc/melco/ntp_result etc/melco/timer_backup.cron etc/melco/timer_status etc/melco/pcast_mp2000 etc/melco/printer etc/melco/ftpstatus etc/melco/pdcuserinfo etc/melco/backup_error_status etc/melco/timer_backup_folder etc/melco/groupinfo.bak etc/passwd etc/group etc/hosts www/.htpasswd www/cgi-bin/.htpasswd www/script/.htpasswd etc/ls_servd.log etc/shadow etc/printcap etc/pcast/pcastd.conf
You can read and write conf_save.tar.gz to and from /dev/mtdblock2 (using the block device here is slightliy more efficient) by using /usr/bin/ls_flash - However, at least in the 2.05 firmware that file in the flash partition is not used. The init.d script load_config is not referenced in any init.d run-level.
ls_flash [device] [add|del|get|init] [options] add -n <filename> add file image to end of flash del [-n <filename>|-i <block number>] delete Entered file name or block number of block data from flash get [-n <filename>|-i <block number>] [--output <filename>] read Entered file name or block number of block data from flash, and store output filename init clear device by zero
ls_flash /dev/mtdblock2 get -n /tmp/conf_save.tar.gz --output /tmp/conf_save.tar.gz
There is a "hidden" feature to list the contents of the flash bank:
ls_flash /dev/mtdblock2 list
Some of this information courtesy of http://www.yamasita.jp/linkstation.en/index.html.