Zsun SD111 Wi-Fi Flash Drive Hacking Tentative

Two days ago, I reviewed Zsun SD111 a 8GB Wi-Fi flash drive based on Atheros AR9331, and I discovered the telnet port was open, but I could not access it because none of the standard username and password combinations (root/root, admin/admin, root/admin, etc…) would work, which is actually a good thing. However, as I opened the stick, the serial pins were clearly marked, so today I’ve soldered some Dupont wires to access the serial console.

In order to open the stick, you need a rigid sharp object to push the top cover via the neck strap hole, as shown below, and another tool (mine looks similar to a scalpel) to help popping the cover up.

Then I connected the three wires to a USB to TLL debug board, connected it to my PC, started minicom (115200 8N1), and pressed the power button. I could see U-Boot 1.1.4 message, so it seems to be successful, but unfortunately, the boot ended with:

(none) mips #56 Thu Jun 19 15:45:22 HKT 2014 (none)                            
(none) login:

1 2	(none) mips #56 Thu Jun 19 15:45:22 HKT 2014 (none) (none) login:

So I was unable to login…

I’ve included the full boot log for reference below:

U-Boot 1.1.4 (Apr 4 2014 – 18:04:53)

AP121 (ar9331) U-boot

DRAM: 32 0
32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 139k for U-Boot at: 81fdc000
Reserving 192k for malloc() at: 81fac000
Reserving 44 Bytes for Board Info at: 81fabfd4
Reserving 36 Bytes for Global Data at: 81fabfb0
Reserving 128k for boot params() at: 81f8bfb0
Stack Pointer at: 81f8bf98
Now running in RAM – U-Boot at: 81fdc000
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8388608, sector count = 128
Flash: 8 0
8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize…
Fetching MAC Address from 0x81ff4128
Fetching MAC Address from 0x81ff4128
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:11:56:48
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:11:56:49
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot: 0
## Booting image at 9f6b0000 …
Image Name:   Linux Kernel Image
Created:      2014-06-20   1:24:58 UTC
Image Type:   MIPS Linux Kernel Image (lzma compressed)
Data Size:    1057231 Bytes = 1 0
1 MB
Load Address: 80002000
Entry Point: 802306f0
Verifying Checksum at 0x9f6b0040 …OK
Uncompressing Kernel Image … OK
No initrd
## Transferring control to Linux (at address 802306f0) …
## Giving linux memsize in bytes, 33554432

Starting kernel …

Shenzhen Zsun Cloud Technology Co.,Ltd.
Shenzhen Zhishang Yidong Keji Youxian Gongsi
www.zsuncloud.com
Linux version 2.6.31–LSDK-9.2.0_U11.14 (ivansi@zsuncloud) (gcc version 4.3.3 (4
flash_size passed from bootloader = 8
arg 1: console=ttyS0,115200
arg 2: root=31:02
arg 3: rootfstype=jffs2
arg 4: rw
arg 5: init=/sbin/init
arg 6: mtdparts=ar7240-nor0:64k(u-boot),64k(u-boot-env),6720k(rootfs),1216k(uIm)
arg 7: mem=32M
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:
Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00002000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=jffs2 rw init=/
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 29364k/32768k available (2248k kernel code, 3404k reserved, 644k data, )
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop… 266.24 BogoMIPS (lpj=532480)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
===== ar7240_platform_init: 0
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
NET: Registered protocol family 1
AR7240 GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NTFS driver 2.1.29 [Flags: R/W DEBUG].
JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
fuse init (API version 7.12)
msgmni has been set to 57
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered (default)
gpio: ath-gpio module inited!
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
brd: module loaded
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
PPPoL2TP kernel driver, V1.0 6 cmdlinepart partitions found on MTD device ar7240-nor0
Creating 6 MTD partitions on “ar7240-nor0”:
0x000000000000-0x000000010000 : “u-boot”
0x000000010000-0x000000020000 : “u-boot-env”
0x000000020000-0x0000006b0000 : “rootfs”
0x0000006b0000-0x0000007e0000 : “uImage”
0x0000007e0000-0x0000007f0000 : “NVRAM”
0x0000007f0000-0x000000800000 : “ART”
usbmon: debugfs is not available
usbcore: registered new interface driver usbserial
USB Serial support registered for generic
usbcore: registered new interface driver usbserial_generic
usbserial: USB Serial Driver core
USB Serial support registered for GSM modem (1-port)
usbcore: registered new interface driver option
option: v0.7.2:USB Driver for GSM modems
nf_conntrack version 0.5.0 (512 buckets, 2048 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
ClusterIP Version 0.8 loaded successfully
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 17
Bridge firewalling registered
802.1Q VLAN Support v1.8 Ben Greear <[email protected]>
All bugs added by David S. Miller <[email protected]>
arch/mips/ar7240/gpio.c (ar7240_simple_config_init) AP_RESET_GPIO: 12
arch/mips/ar7240/gpio.c (ar7240_simple_config_init) JUMPSTART_GPIO: 11
ar7240wdt_init: Registering WDT success
VFS: Mounted root (jffs2 filesystem) on device 31:2.
Freeing unused kernel memory: 128k freed
init started: BusyBox v1.01 (2014.06.20-01:25+0000) multi-call binary
init started: BusyBox v1.01 (2014.06.20-01:25+0000) multi-call binary
Starting pid 152, console /dev/ttyS0: ‘/etc/rc.d/rcS’
Welcome to
——-      |            /    /–/        ___      |
/           |           /|     \/        _____   –|–|
/_____\      |—       –|–   //–/      /        / |
__|__       |           /|\    / \/      /___\    /   |
___|___   ___|____      / | \     /               /   \|

Shenzhen Zsun Cloud Technology Co., LTD.
www.zsuncloud.com
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140
ATHR_GMAC: Mac address for unit 0:bf7f0000
ATHR_GMAC: 00:03:7f:11:56:48
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   252
ATHR_GMAC: Mac capability flags    :   4403
ATHR_GMAC: Mac address for unit 1:bf7f0006
ATHR_GMAC: 00:03:7f:11:56:49
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   96
ATHR_GMAC: Mac capability flags    :   4D83
athr_gmac_ring_alloc Allocated 640 at 0x81d5fc00
athr_gmac_ring_alloc Allocated 4032 at 0x81d36000
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY…
athr_gmac_ring_alloc Allocated 640 at 0x81d5f800
athr_gmac_ring_alloc Allocated 1536 at 0x81d4d800
ATHRS26: resetting s26
ATHRS26: s26 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY…
device eth0 entered promiscuous mode
ehci_hcd: USB 2.0 ‘Enhanced’ Host Controller (EHCI) Driver
Port Status 1c000004
ar7240-ehci ar7240-ehci.0: ATH EHCI
ar7240-ehci ar7240-ehci.0: new USB bus registered, assigned bus number 1
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: irq 3, io mem 0x1b000000
ehci_reset Intialize USB CONTROLLER in host mode: 3
ehci_reset Port Status 1c000000
ar7240-ehci ar7240-ehci.0: USB 2.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: ATH EHCI
usb usb1: Manufacturer: Linux 2.6.31–LSDK-9.2.0_U11.14 ehci_hcd
usb usb1: SerialNumber: platform
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
Initializing USB Mass Storage driver…
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
rm: cannot remove `/var/log.*’: No such file or directory
**** drop_caches_sysctl_handler: all done timer added …****
usb 1-1: new high speed USB device using ar7240-ehci and address 2
Starting pid 373, console /dev/tasf: module license ‘Proprietary’ taints kernel.
Disabling lock debugging due to kernel taint
usb 1-1: New USB device found, idVendor=0424, idProduct=2240
usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 1-1: Product: Ultra Fast Media
usb 1-1: Manufacturer: Generic
usb 1-1: SerialNumber: 000000225001
usb 1-1: configuration #1 chosen from 1 choice
scsi0 : SCSI emulation for USB Mass Storage devices
ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Righd
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reservd

(none) mips #56 Tath_ahb: 9.2.0_U11.14 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
hu Jun 19 15:45:22 HKT 2014 (none)
(none) login: Bootstrap clock 25MHz
ar9300RadioAttach: Need analog access recipe!!
Restoring Cal data from Flash
Using Cal data from Flash 0xbf7f0000
ath_get_caps[5184] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[5159] tx chainmask mismatch actual 1 sc_chainmak 0
SC Callback Registration for wifi0
wifi0: Atheros 9380: mem=0xb8100000, irq=2
wlan_vap_create : enter. devhandle=0x81ff02c0, opmode=IEEE80211_M_HOSTAP, flags1
wlan_vap_create : exit. devhandle=0x81ff02c0, opmode=IEEE80211_M_HOSTAP, flags.
device ath0 entered promiscuous mode
br0: port 2(ath0) entering forwarding state
scsi 0:0:0:0: Direct-Access Generic Ultra HS-COMBO 1.98 PQ: 0 ANSI: 0
sd 0:0:0:0: [sda] 15630336 512-byte logical blocks: (8.00 GB/7.45 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Assuming drive cache: write through
sda:
sda1
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk

(none) mips #56 Thu Jun 19 15:45:22 HKT 2014 (none)
(none) login:
(none) mips #56 Thu Jun 19 15:45:22 HKT 2014 (none)
(none) login: root
Password:
Login incorrect
(none) login:

In order to disable serial console login, we may need to edit /etc/inittab, and comment out a line with something like /bin/ash –login, and if we add an Ethernet connection, it might be possible to Enter U-boot, and boot from tftp with another AR9331 firmware, and edit the file, but since there’s no Wi-Fi in U-boot this is not an option.

But I’ve noticed there was a new firmware available via Apple Extender Android app, so I started “Shark for Root” in my phone to capture the packets with tcpdump into files called shark_dump_xxxxxxxx.pcap, which can then be opened in WireShark in a computer, and found out the link for the firmware SD111-FW-V3.6.tar.gz.

The file contains a bunch of kernel drivers, scripts, config files, and the kernel (uImage), but there isn’t any root file systems I could find. You can also download earlier version of the firmware V3.4, V3.0 etc… by changing the number in the link. The Android itself store configuration files and libraries in /data/data/com.wltx.mycloudclient directory in the phone.

That’s all I’ve done so far, and I’ve not yet been able to access the serial console.

Jean-Luc Aufranc (CNXSoft)

Jean-Luc started CNX Software in 2010 as a part-time endeavor, before quitting his job as a software engineering manager, and starting to write daily news, and reviews full time later in 2011.