TheeCSDump: ADS NAS Drive Kit (NAS-806-EF)

ADS NAS Drive Kit (NAS-806-EF)

PART I: How Can I Break This?

10 October 2007 - I will leave these pages up, but I got tired of this thing and gave it away. I purchased an HPMediaVault MV2010 which is MUCH better than the ADS.

Because of some storm damage, which I describe here, I had to replace some items in my home network. I decided to rethink the entire setup. For years I have run my cable connection though an old AMD K6 system acting as a gateway system. This system ran OS/2, had 2 network cards, used Injoy FW for NAT, Apache (with php & mysql), Peer, and a ftp server. I moved to a Linksys 54G router as the gateway and purchased an ADS NAS Drive Kit to replace the other components. As far as Apache, I just moved that stuff to my external site.

The NAS runs an embedded version of Linux using a PMC-Sierra MSP (Multi Service Processor) SoC (acquired from Brecis Communications). Of course I had to disassemble the unit and found that the MSP is a MSP2006 MIPS CPU with the following specs:

Core: MIPS 4Km
Speed: 167 MHz Max
Interfaces: (2) 10/100, PCI SDRAM, local bus, UARTs, SPI/MPI 2-wire serial

The PMC site has additional CPU specs. This does not have a Memory Management Unit (MMU). Additionally, the IDE controller is an ITE 8211F. Mosel Vitelic Corp 256Mbit (32MByte) SDRAM 3.3 VOLT, TSOP II / SOC BGA / WBGA PACKAGE 16M X 16, 32M X 8, 64M X 4 means it contains 64 meg of RAM from my readings.

I also found that the ADS unit is an OEM version, maybe with a couple of updated components, of the follow units:

Allnet all6200
Flepo f6200
Longshine 8210 / 8220
Netronix NH-220 (the ADS docs were named Netronix)
Hawking Net-Stor Network Storage Center HNAS1

A couple quick checks of the firmware updates shows the headers:

ADS 1.04 Firmware Update
MAGICNUM=ADxO23spFc0Mn6li8SCq9kEr
PRODUCT_ID=NH220
CUSTOMER=ADS
VERSION=v1.04(06-13-2006)

Longshine Nobrand Frimware Update
MAGICNUM=ADxO23spFc0Mn6li8SCq9kEr
PRODUCT_ID=NH220
CUSTOMER=NONBRAND
VERSION=v1.03(06-30-2005)

Ok, so from this I think one can conclude that the Longshine 8220 and ADS NAS-806-EF are all relabeled Netronix NH-220 units. From what I have read the old Longshine 8210, Hawking, Allnet units are 32 meg RAM and the 8220 and ADS units are 64 meg RAM units. I also found other units which seemed similar, but also had USB ports.

A portscan showed port 24 and when I used telnet to connect the I received the message I had read about.

Ok, I figured at this point I did not spend money much on this thing so I altered the OpenNAS firmware header and gave it a try! I first tried the LCS8220_402-zap3a_253.bin version from 2005 which with the altered header worked.

OpenNAS -  LCS8220_402-zap3a_253.bin file from 
MAGICNUM=ADxO23spFc0Mn6li8SCq9kEr
PRODUCT_ID=NH220
CUSTOMER=LONGSHINE                                 <== Changed to ADS using Hexedit/2
VERSION=v4.02(24-02-2005)-ext3-zap3a

I flashed through the web interface and once complete I pressed the reset for factory defaults. One issue I ran into was that my linksys router is 192.168.1.1 and the NAS started as 192.168.1.1. Once this conflict was cleared up I had the NAS up and running. It looked a lot like the ADS version with web interface, however, I was able to telnet into it and look around. Just for information, the default root password is all6200.

Unfortunately, like the ADS firmware this version did not support EAs. So, I decided to go one step further. Since LCS8220_402-zap3a_253.bin was from 2005, I set about to flash the NAS to openNAS-0.9d-64MB.bin (25 Feb 2007).

If the previous flash was living on the edge then the next step was even worse. The openNAS does not have the header to edit, rather you have to flash via tftp or a special serial cable. The developer did have instructions as to how to add a header:

dd if=original_firmware.bin of=header.bin bs=512 count=1 
cat openNAS-0.9d.bin >> header.bin

The dd command strips the header of original_firmware.bin, which I used an ADS fireware update, to header.bin. Next, the the cat command combines the header and openNAS file. I assume one should be able to flash from this point. However, I found that with the old v4.02 firmware installed I could no longer flash, not to openNAS or back to ADS firmware. At this point I did think I was screwed!

I found the script that the NAS ran for flashing which I modified to just do a direct flash. It was something like this:

dd if=/mnt/openNAS-0.9d.bin of=/dev/mtdblock

I was sure the NAS would be a brick once this completed. Once the dd command had completed, I typed reboot at the prompt and did the factory reset. It seems that a bug in openNAS turns the NAS power light on and then it goes out, after that "oh shit' moment I realized the lan light was flashing so it was running. Also, openNAS does not assign a static IP to the NAS, but rather uses dhcp. Last, the http server does not start. After figuring all this out, and seeing I had not turned the NAS into a brick, I telnet'd into the box (root pw:all6200). Here is what I saw:

BusyBox v1.4.1 (2007-02-25 01:26:42 CET) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

The /var/log/messages file is HERE.

The first thing I noticed is that openNAS is not as easy to use as the original ADS firmware and that it requires more setup.

Other half complete pages:
AdsNas1
AdsNas2
AdsNas3