Up to date instructions for brick recovery / serial cable

Sam McKoy

unread,

Oct 29, 2016, 11:29:01 PM10/29/16

to Alt-F

I believe I bricked by DNS-323 (REV C1) when upgrading from RC3 to RC5, on startup it never gets past the fast flashing main LED phase of boot.

All the forum threads i've seen that talk about recovering from this point refer to http://dns323.kood.org/howto:serial_level_adapter which doesn't seem to be online anymore. I can get the text from wayback machine but no images/diagrams of where to connect the serial cable.

Also wondering if this is suitable for the cable - https://www.aliexpress.com/item/1pcs-CP2102-module-USB-to-TTL-serial-UART-STC-download-cable-PL2303-Super-Brush-line-upgrade/32694152202.html

I have a second DNS-323 (unsure of rev) running RC5 if that's of any help.

João Cardoso

unread,

Oct 30, 2016, 12:07:56 PM10/30/16

to Alt-F

On Sunday, 30 October 2016 03:29:01 UTC, Sam McKoy wrote:

I believe I bricked by DNS-323 (REV C1) when upgrading from RC3 to RC5, on startup it never gets past the fast flashing main LED phase of boot.

All the forum threads i've seen that talk about recovering from this point refer to http://dns323.kood.org/howto:serial_level_adapter which doesn't seem to be online anymore. I can get the text from wayback machine but no images/diagrams of where to connect the serial cable.

Try http://forum.dsmg600.info/viewtopic.php?id=4656 and http://dsmg600.info/howto:kernel_upload

and for your rev-C board http://forum.dsmg600.info/viewtopic.php?id=5460 and http://forum.dsmg600.info/viewtopic.php?id=5088

These might also be usefull https://www.cyrius.com/debian/orion/d-link/dns-323/recovery/

Could you made your own contribution to the wiki or FAQ? :-)

Also wondering if this is suitable for the cable - https://www.aliexpress.com/item/1pcs-CP2102-module-USB-to-TTL-serial-UART-STC-download-cable-PL2303-Super-Brush-line-upgrade/32694152202.html

Any ***3.3 Volts*** RS-232C to USB adapter will be OK. The link above talks about TTL, which is 5 Volts, not suitable.

I have a second DNS-323 (unsure of rev)

See the box bottom attached label

Sam McKoy

unread,

Oct 31, 2016, 8:57:03 PM10/31/16

to Alt-F

Thanks, those dsmg600 threads look great.

For now I've moved my drives to my other NAS and it works. I've ordered a few pieces I need to make the serial cable. Will document this thread once things arrive.

Sam McKoy

unread,

Dec 13, 2016, 4:50:30 AM12/13/16

to Alt-F

Bought https://www.aliexpress.com/item/Free-Shipping-FT232RL-FT232-USB-TO-TTL-5V-3-3V-Download-Cable-To-Serial-Adapter-Module/32591300362.html

The 4 holes on the board were the serial adapter (as per http://forum.dsmg600.info/viewtopic.php?id=5088)

closest to the power switch/leds at the front seems to be the 3.3v, then data, data, then ground.

Connected the usb adapter, plugged in into the machine with the unit turned off, lights came on.

I could use RealTerm (or Putty) to connect to the COM port (I'm on windows).

Turned on the dns 323 when connected, waited for a while and a command prompt appeared in the terminal - success!

Sam McKoy

unread,

Dec 13, 2016, 5:02:01 AM12/13/16

to Alt-F

Now trying to follow instructions on https://www.cyrius.com/debian/orion/d-link/dns-323/recovery/ but modifying since i'm in windows instead of linux.

Used Windows Subsystem for Linux (windows 10 feature) to

sudo apt-get install ruby

sudo apt-get install ruby-dev

sudo gem install ffi

downloaded latest version of https://github.com/mpalmer/dns323-firmware-tools

extracted it using WSL (in case windows screwed with newlines)

ran

splitdns323fw -k uKernel -i uRamdisk netboot.img

with my downloaded firmware.

Found a 1.5MB uKernel file in the current directory.

Tried to send the file using RealTerm via the COM port after using "loadb k" command, had to cancel the transfer very quickly to see the error

Un-Protect Flash Bank # 1

Erase Kernel from 0xff820000 to 0xff99ffff Can't erase unknown flash type - aborted

time for more research

João Cardoso

unread,

Dec 13, 2016, 10:07:42 AM12/13/16

to al...@googlegroups.com

for your rev-C board see http://forum.dsmg600.info/viewtopic.php?id=5460

Sam McKoy

unread,

Dec 17, 2016, 10:44:47 PM12/17/16

to Alt-F

Thanks that looks useful. Still think the program i was trying (realterm) doesn't send files correctly as loadb claims 0 bytes file transferred successfully and bails.

## Ready for binary (kermit) download to 0x00100000 at 115200 bps...

## Total Size = 0x00000000 = 0 Bytes

## Start Addr = 0x00100000

Un-Protect Flash Bank # 1

Kernel Size = 0

Copy to Flash... done

Protect Flash Bank # 1

Marvell>> ì× ÐÓ ŒÓ

Tried using a Hyper-V virtual machine with linux on it but it appears hyper-v doesn't do proper pass through of usb devices.

Guessing i'll have to fall back to a proper linux distro installed on a portable drive.

Norbert Horváth

unread,

Jan 3, 2017, 4:29:07 PM1/3/17

to Alt-F

You can copy uImage and uInitrd to an ext2 or fat usb drive, plug it into the NAS and load them from there: http://jamie.lentin.co.uk/devices/dlink-dns325/keeping-original-firmware/ Booting via USB section.
One small hint: in uboot prompt, after you do an "usb reset" and it finds your drive, do not replace the usb drive or do an other "usb reset", it won't find the drive again, you have to power off and on again the NAS. At least in my case (DNS-320) only the first usb reset finds the drive.

Sam McKoy

unread,

Jan 3, 2017, 7:36:25 PM1/3/17

to Alt-F

Thanks Norbert, unfortunately usb is an unrecognized command so I'm guessing that method doesn't work on the dns-323 or the rev-c version at least.

However your post did lead me back to http://dns323.kood.org/howto:reflash_from_windows which appears to be working now.

Big clue for windows users is to use Tera Term (not RealTerm) as it supports Kermit file transfers. Currently waiting on the kernel to upload will report back after that.

Sam McKoy

unread,

Jan 4, 2017, 3:13:03 AM1/4/17

to Alt-F

So i've tried booting both Alt-F and DLink 1.10.

Alt-F kernel panics

squashfs: SQUASHFS error: unable to read id index table
mount: mounting /rootmnt/dev/loop0 on /rootmnt/ro failed: Invalid argument
mount: mounting /rootmnt on /newroot/rootmnt failed: No such file or directory
pivot_root: No such file or directory
/init: line 134: can't open dev/console: no such file
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000200

---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000200

DLink boots but doesn't seem to get an IP so I can't do much with it. It is detecting the network cable being plugged in an out, curiously there's no activity/connection lights at all. Also doesn't respond to keyboard (no terminal available via serial?) except for ctrl-c which kills a process and it auto restarts.

Then when I reboot it's back into uboot, assuming the loadb, cp, bootm method just copies things to temporary memory and I need to use the booted linux to flash the device afterwards.

Can people normally use a terminal by connecting via serial?

João Cardoso

unread,

Jan 4, 2017, 2:53:24 PM1/4/17

to Alt-F

On Wednesday, 4 January 2017 08:13:03 UTC, Sam McKoy wrote:

So i've tried booting both Alt-F and DLink 1.10.

Alt-F kernel panics

squashfs: SQUASHFS error: unable to read id index table
mount: mounting /rootmnt/dev/loop0 on /rootmnt/ro failed: Invalid argument
mount: mounting /rootmnt on /newroot/rootmnt failed: No such file or directory
pivot_root: No such file or directory
/init: line 134: can't open dev/console: no such file
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000200
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000200

Can you post your loadb and cp commands and all the u-boot output to them?

Some u-boot versions (even on recent boxes such as the DNS-320L/325/327) don't work with big files, and Alt-F uses almost every byte it can.

Even some latter D-Link fw for the 323 couldn't be flashed using u-boot, 1.03 or previous is one of the smaller.

DLink boots but doesn't seem to get an IP so I can't do much with it. It is detecting the network cable being plugged in an out, curiously there's no activity/connection lights at all. Also doesn't respond to keyboard (no terminal available via serial?) except for ctrl-c which kills a process and it auto restarts.

Try typing '5784468' at the prompt to be able to type commands

Then when I reboot it's back into uboot, assuming the loadb, cp, bootm method just copies things to temporary memory and I need to use the booted linux to flash the device afterwards.

Can people normally use a terminal by connecting via serial?

Yes, type the magic '5784468' without quotes, of course

Sam McKoy

unread,

Jan 4, 2017, 10:11:53 PM1/4/17

to Alt-F

wow what a mission.

Entered the magic code, got a prompt. (almost thought you were kidding when you mentioned the magic code)

setup network using

ifconfig egiga0 10.1.1.45

pinged device succesfully

tried to access web interface - didn't work

tried to start web interface /web/webs - seg fault

tried to use dd / netcat etc, nothing appeared to be on the box

randomly tried to telnet in, succesfully connected, both dd and nc were present.

sent uKernel and uRamdisk to device using

nc -l -p 10000 > uKernel

nc 10.1.1.45 10000 < uKernel

dd if=uKernel of=/dev/mtdblock2

dd if=uRamdisk of=/dev/mtdblock3

(this took a while and provided no feedback during the process)

reboot

2 minutes later I appear can boot something from power off - gets a kernel panic but at least it's a start.

Sam McKoy

unread,

Jan 5, 2017, 2:34:00 AM1/5/17

to Alt-F

OK

## Loading Ramdisk Image at ff9a0000 ...

Image Name: Ramdisk

Image Type: ARM Linux RAMDisk Image (gzip compressed)

Data Size: 5507627 Bytes = 5.3 MB

Load Address: 00800000

Entry Point: 00800000

Verifying Checksum ... Bad Data CRC

OK

Starting kernel ...

Uncompressing Linux................................................................................................... done, booting the kernel.

Linux version 2.6.12.6-arm1 (tim@SWTEST2) (gcc version 3.3.3) #47 Mon Nov 30 12:06:02 CST 2009

CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ)

CPU0: D VIVT write-back cache

CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets

CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets

Machine: MV-88fxx81

Using UBoot passing parameters structure

Sys Clk = 166000000, Tclk = 166000000

Memory policy: ECC disabled, Data cache writeback

Built 1 zonelists

Kernel command line: root=/dev/ram console=ttyS0,115200 :::DB88FXX81:egiga0:none

PID hash table entries: 512 (order: 9, 8192 bytes)

Console: colour dummy device 80x30

Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)

Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)

Memory: 64MB 0MB 0MB 0MB = 64MB total

Memory: 56192KB available (2599K code, 462K data, 112K init)

Mount-cache hash table entries: 512

CPU: Testing write buffer coherency: ok

checking if image is initramfs...it isn't (no cpio magic); looks like an initrd

Freeing initrd memory: 5378K

NET: Registered protocol family 16

Marvell Development Board (LSP Version 1.7.6_NAS)-- RD-88F5182-NAS-2

Detected Tclk 166000000 and SysClk 166000000

Marvell USB EHCI Host controller #0: c0d43b00

Marvell USB EHCI Host controller #1: c0d43a40

pexBarOverlapDetect: winNum 2 overlap current 0

mvPexInit:Warning :Bar 2 size is illigal

it will be disabled

please check Pex and CPU windows configuration

PCI: bus0: Fast back to back transfers enabled

PCI: bus1: Fast back to back transfers enabled

SCSI subsystem initialized

usbcore: registered new driver usbfs

usbcore: registered new driver hub

cesadev_init(c0012468)

Fast Floating Point Emulator V0.9 (c) Peter Teichmann.

inotify device minor=63

VFS: Disk quotas dquot_6.5.1

Dquot-cache hash table entries: 1024 (order 0, 4096 bytes)

squashfs: version 3.3 (2007/10/31) Phillip Lougher

squashfs: LZMA suppport for slax.org by jro

Initializing Cryptographic API

Serial: 8250/16550 driver $Revision: 1.1.1.1 $ 4 ports, IRQ sharing disabled

ttyS0 at MMIO 0x0 (irq = 3) is a 16550A

io scheduler noop registered

io scheduler deadline registered

RAMDISK driver initialized: 16 RAM disks of 10240K size 1024 blocksize

loop: loaded (max 8 devices)

Marvell Gigabit Ethernet Driver 'egiga':

o Ethernet descriptors in DRAM

o DRAM SW cache-coherency

o Checksum offload enabled

o Loading network interface 'egiga0'

Intergrated Sata device found

scsi0 : Marvell SCSI to SATA adapter

scsi1 : Marvell SCSI to SATA adapter

Vendor: Seagate Model: ST31000340AS Rev: SD15

Type: Direct-Access ANSI SCSI revision: 03

Vendor: Seagate Model: ST31000340AS Rev: SD15

Type: Direct-Access ANSI SCSI revision: 03

Attached scsi generic sg0 at scsi0, channel 0, id 0, lun 0, type 0

Attached scsi generic sg1 at scsi1, channel 0, id 0, lun 0, type 0

physmap flash device: 800000 at ff800000

phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank

Amd/Fujitsu Extended Query Table at 0x0040

number of CFI chips: 1

cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.

cmdlinepart partition parsing not available

RedBoot partition parsing not available

Using physmap partition definition

Creating 5 MTD partitions on "phys_mapped_flash":

0x00000000-0x00010000 : "MTD1"

0x00010000-0x00020000 : "MTD2"

0x00020000-0x001a0000 : "Linux Kernel"

0x001a0000-0x007d0000 : "File System"

0x007d0000-0x00800000 : "u-boot"

ehci_platform ehci_platform.20865: EHCI Host Controller

ehci_platform ehci_platform.20865: new USB bus registered, assigned bus number 1

ehci_platform ehci_platform.20865: irq 17, io mem 0x00000000

ehci_platform ehci_platform.20865: park 0

ehci_platform ehci_platform.20865: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004

hub 1-0:1.0: USB hub found

hub 1-0:1.0: 1 port detected

ehci_platform ehci_platform.86401: EHCI Host Controller

ehci_platform ehci_platform.86401: new USB bus registered, assigned bus number 2

ehci_platform ehci_platform.86401: irq 12, io mem 0x00000000

ehci_platform ehci_platform.86401: park 0

ehci_platform ehci_platform.86401: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004

hub 2-0:1.0: USB hub found

hub 2-0:1.0: 1 port detected

mice: PS/2 mouse device common for all mice

md: linear personality registered as nr 1

md: raid0 personality registered as nr 2

md: raid1 personality registered as nr 3

md: md driver 0.90.1 MAX_MD_DEVS=256, MD_SB_DISKS=27

device-mapper: 4.4.0-ioctl (2005-01-12) initialised: dm-d...@redhat.com

NET: Registered protocol family 2

IP: routing cache hash table of 512 buckets, 4Kbytes

TCP established hash table entries: 4096 (order: 3, 32768 bytes)

TCP bind hash table entries: 4096 (order: 2, 16384 bytes)

TCP: Hash tables configured (established 4096 bind 4096)

NET: Registered protocol family 1

NET: Registered protocol family 17

md: Autodetecting RAID arrays.

md: autorun ...

md: ... autorun DONE.

RAMDISK: Compressed image found at block 0

invalid compressed format (err=1)

EXT2-fs warning: mounting unchecked fs, running e2fsck is recommended

VFS: Mounted root (ext2 filesystem).

Freeing init memory: 112K

Kernel panic - not syncing: No init found. Try passing init= option to kernel.

looks like my ram disk might not have written successfully. will try again.

Sam McKoy

unread,

Jan 5, 2017, 3:41:39 AM1/5/17

to Alt-F

interesting the 3.3v line doesn't seem to be mandatory to connect to the serial/usb device.

issue atm is that I can't seem to connect to the serial session fast enough to prevent uboot from starting the default option.

currently unplugging nas, replugging in and racing to connect and hit space. might need a way to reboot without physically unplugging the device.

Sam McKoy

unread,

Jan 5, 2017, 3:59:09 AM1/5/17

to Alt-F

3.3 volt connected appears to power the device enough to keep serial connection open, without this i need to reconnect on power up.

still not fast enough to hit the space key apparently thought

Sam McKoy

unread,

Jan 5, 2017, 4:26:36 AM1/5/17

to Alt-F

so on a whim, i rigged up my unsuitable serial adapter 5v (https://www.aliexpress.com/item/1pcs-CP2102-module-USB-to-TTL-serial-UART-STC-download-cable-PL2303-Super-Brush-line-upgrade/32694152202.html) mentioned earlier to the tx/rx but with the voltage going back to the old serial adapter.

booted, hit space/1 a lot and got it first go. tried again and got it second time too.

guessing there's something wrong with my 3.3 serial adapter on initalisation (noticed that the data send light won't flash for the first 2-3 seconds of turning on the device).

currently uploading kernel/ramdisk into memory again for another bootm, suspect i could probably skip the kernel as I have a working kernel already. also might try writing directly to "loadb r" again see if that give something different.

João Cardoso

unread,

Jan 5, 2017, 3:42:20 PM1/5/17

to Alt-F

On Thursday, 5 January 2017 03:11:53 UTC, Sam McKoy wrote:

wow what a mission.

Entered the magic code, got a prompt. (almost thought you were kidding when you mentioned the magic code)

Yes, ridiculous "obfuscation". plus the space+1 key during boot.

On the other side they had (until recently) the "fun_plug" boot script, in fact opening the box.

setup network using

ifconfig egiga0 10.1.1.45

pinged device succesfully

tried to access web interface - didn't work

tried to start web interface /web/webs - seg fault

tried to use dd / netcat etc, nothing appeared to be on the box

You should have a path problem. Read their rc init script, don't remember the name, the location might also not be obvious.

You might also want to clear default settings in flash to their initial state, don't know if their firmware needs it to initialize the system.

This is what I get with Alt-F 'dns323-fw' on fw dns323_109:

jcard@silver:~/Alt-F/alt-f-sf> dns323-fw -s /home/jcard/Hardware/DNS-323/Firmware/dns323_109.bin

product_id=7;

custom_id=1;

model_id=1;

sub_id=1;

NewVersion=4;

signature="FrodoII";

sig_num=0 header=64 Next_offset=0

ko=64 kl=1490268 kr=0 kc=3407378563 next=1490332

io=1490332 il=5240664 ir=0 ic=4150494728 next=6730996

do=6730996 dl=7848 dr=0 dc=2187115512 next=6738844

filesz=6738844 compsz=6738844

signature is "FrodoII"

kernel saved, checksum is OK.

initramfs saved, checksum is OK.

defaults saved, checksum is OK.

jcard@silver:~/Alt-F/alt-f-sf> l kernel initramfs defaults

-rwx------ 1 jcard users 7848 Jan 5 19:14 defaults*

-rwx------ 1 jcard users 5240664 Jan 5 19:14 initramfs*

-rwx------ 1 jcard users 1490268 Jan 5 19:14 kernel*

jcard@silver:~/Alt-F/alt-f-sf> tar tvzf defaults

drwxr-xr-x ffna/sw1 0 2010-02-10 01:27 default/

-rwxr-xr-x ffna/sw1 36 2010-02-10 01:27 default/Certs.info

-rw-r--r-- ffna/sw1 1375 2010-02-10 01:27 default/cacert.pem

-rw-r--r-- ffna/sw1 1743 2010-02-10 01:27 default/cakey.pem

-rwxr-xr-x ffna/sw1 133 2010-02-10 01:27 default/ddns.conf

-rwxr-xr-x ffna/sw1 136 2010-02-10 01:27 default/email.conf

-rwxr-xr-x ffna/sw1 47 2010-02-10 01:27 default/group

-rwxr-xr-x ffna/sw1 72 2010-02-10 01:27 default/hosts

-rwxr-xr-x ffna/sw1 15 2010-02-10 01:27 default/language.conf

-rwxr-xr-x ffna/sw1 25 2010-02-10 01:27 default/log.conf

-rwxr-xr-x ffna/sw1 236 2010-02-10 01:27 default/mt-daapd.conf

-rwxr-xr-x ffna/sw1 249 2010-02-10 01:27 default/mt-daapd.playlist

-rwxr-xr-x ffna/sw1 15 2010-02-10 01:27 default/mtdversion

-rw-r--r-- ffna/sw1 0 2010-02-10 01:27 default/newftp

-rwxr-xr-x ffna/sw1 146 2010-02-10 01:27 default/passwd

-rwxr-xr-x ffna/sw1 172 2010-02-10 01:27 default/pf_param.conf

-rwxr-xr-x ffna/sw1 278 2010-02-10 01:27 default/pure-ftpd.conf

-rwxr-xr-x ffna/sw1 26 2010-02-10 01:27 default/quota

-rwxr-xr-x ffna/sw1 302 2010-02-10 01:27 default/rc.init.sh

-rwxr-xr-x ffna/sw1 12 2010-02-10 01:27 default/resolv.conf

-rwxr-xr-x ffna/sw1 2 2010-02-10 01:27 default/rtc.conf

-rw-r--r-- ffna/sw1 3050 2010-02-10 01:27 default/server.pem

-rwxr-xr-x ffna/sw1 71 2010-02-10 01:27 default/shadow

-rwxr-xr-x ffna/sw1 1265 2010-02-10 01:27 default/sib.conf

-rwxr-xr-x ffna/sw1 1264 2010-02-10 01:27 default/sib2.conf

-rwxr-xr-x ffna/sw1 760 2010-02-10 01:27 default/sib_ap.conf

-rwxr-xr-x ffna/sw1 1128 2010-02-10 01:27 default/smb.default

-rwxr-xr-x ffna/sw1 1 2010-02-10 01:27 default/smbpasswd

-rwxr-xr-x ffna/sw1 89 2010-02-10 01:27 default/tr069.conf

-rwxr-xr-x ffna/sw1 1320 2010-02-10 01:27 default/udhcpd.conf

-rwxr-xr-x ffna/sw1 1296 2010-02-10 01:27 default/udhcpd.conf.def

-rw-r--r-- ffna/sw1 17 2010-02-10 01:27 default/upnpav.conf

-rwxr-xr-x ffna/sw1 143 2010-02-10 01:27 default/upnpscript

-rw-r--r-- ffna/sw1 0 2010-02-10 01:27 default/v3.4

-rwxr-xr-x ffna/sw1 32 2010-02-10 01:27 default/version.txt

-rwxr-xr-x ffna/sw1 8 2010-02-10 01:27 default/version2.txt

defaults are stored in /dev/mtd0 (with a backup in mtd1). They are minix filesystems, so you can mount it and save (flash) defaults to there? Say if you need help.

I would also suspect on "their" busybox 'nc' -- is it able to transfer a 5MB files? Is there some md5/sha1sum (or even the standard unix 'sum') in the firmware so you can check the transfer? I see no reason why your flashing using dd did not succeed.

Keep us informed

PS-Ah, and by the u-boot comands I ask for I meant all of them with their output. The comm program you are using certainly has some form of capturing/logging that you can activate and use.

Sam McKoy

unread,

Jan 5, 2017, 8:16:42 PM1/5/17

to Alt-F

Got the website working by finding the init script like you suggested, updated to alt-f successfully.

Full log transcript attached.

Almost sad i didn't need to use netcat + dd + telnet, but hey I'd rather have a working box.