Hacking the SmartStor NS4600 – Part 2

Here we go, my plan worked. I have been able to get some FW to boot from USB successfully.

I aim for this blog post to be more of a guide, than a “this is what I did” post.

So it turns out that the NAS I have is actually an NS4600P (the difference between the non-p variant and this one, is this one has a PowerPC processor) and there is another NAS which is just a rebranded NS4600P, the Patriot Javelin S4 which I noticed has a lot more… community support (in terms of repairs, hacking etc) so I used a lot of information gathered about that device and applied it to this one without many changes needed.

First off I grabbed myself a 2GB memory stick (formatted as FAT/16 not FAT32) and whacked on the firmware files for the Javelin S4 that had been extracted by a user that goes by the name of Senomoto on the Patriot forums on to the root of the stick. I then attached my serial cable, and booted up the system (completely spamming CTRL+C to get to the u-boot menu) and seeing what variables uboot was applying. This gave me all of the addresses I need to load the kernel/rootfs from elsewhere.

With the USB stick in the NAS, I ran the following commands to set up USB booting:
setenv load_ext_usb “run ramargs addtty mtdargs;usb start;fatload usb 0:1 1200000 kernel;fatload usb 0:1 1b00000 rootfs;fatload usb 0:1 1a00000 dtb; bootm 1200000 1b00000 1a00000”

setenv real_bootcmd “run load_ext_usb”


(Credits to Senomoto for these)

Once the variables had been saved I just went ahead and booted the system, watching closely to the serial output and noting any errors. To my surprise the FW had booted completely fine, meaning that the S4 firmware, is again just a rebranded NS4600 firmware, making my life hell of a lot easier.

Thanks to the USB boot, I am again able to access the web configuration pages for the NAS, so I went ahead and threw in a small hard drive and created a brand new array with it (just a single drive in RAID-0) but I noticed I was still getting “File System Errors” and I currently can’t tell if that’s because there was no drive in any of the bays or it’s checking the internal NAND. So my plan is to let the array rebuild and see if I get FS errors. If I do, it’s likely the system is completely screwed (as it won’t even let me flash a new FW with filesystem errors). But we will go from there.

Leave a Reply

Your email address will not be published. Required fields are marked *