Well, this all started with bricking my O!Play. It was definitely my fault, I had two open telnet sessions, one to the Asus and the other to my NAS, and I have entered some commands in the wrong place. Never accept a phone call when you do such things, and more importantly, don't think you can continue your work with full attention.
Anyway, damage has been done, I needed to revive my device. I was almost sure that the root fs was intact, it was the the media player application /usr/local/bin/dvdplayer) that refused to start (or crashed). This made the device - or the application, didn't know which one at that time - continuously restart. I thought if I could interrupt the init process - not letting the media player application start -, I could fix the problem. Other alternative was to kill the watchdog (/usr/local/bin/RootApp), and stop the continuous start/stop/restart loop.
I tried to telnet in, but no go. Telnet wasn't working, not even for a second. So, I hat to read.
I went through again all of the wiki articles Mike wrote here, and also his posts on the netbookuser site, where he posted the capture of the serial console boot log. Examining the log, I noticed that eth0 has been brought up early, with the default address of: 192.168.0.9.
From this point, it was easy. I remembered that inetd - means telnet for me - is started during the init process. So the device should be accessible through telnet early, before the dvdplayer application starts
(as the last step of the init process). The only problem is that this option may last only for a few seconds. I changed my network settings to match the 192.168.0.* network, started telnet, and powered up the device. And ideed, telnet was available!
Only for a short time though - 2-3 secs, I was right about it -, but it was available. So I put up a little script that pings the above IP address, and once it responds, immediately starts a telnet session
and sends a few keypresses. First the "root" string certainly, then a "/usr/bin/stopall" command.
(I remembered that I was able to kill the dvdplayer & watchdog with a "# /usr/bin/stopall" command from the telnet command prompt.)
I have a windows laptop, so I needed a windows script. I used a similar script a while ago to connect to a Linksys router, so I took that script and modified it. Here is how it looked:
asusrescue.bat
echo off
echo Set objShell = WScript.CreateObject("WScript.Shell") > asusrescue.vbs
echo Set objExecObject = objShell.Exec("cmd /c ping -t -w 1 192.168.0.9") >> asusrescue.vbs
echo Wscript.Echo "Now, start your O!Play..." >> asusrescue.vbs
echo Do While Not objExecObject.StdOut.AtEndOfStream >> asusrescue.vbs
echo strText = objExecObject.StdOut.ReadLine() >> asusrescue.vbs
echo Wscript.Echo strText >> asusrescue.vbs
echo If Instr(strText, "Reply") > 0 Then >> asusrescue.vbs
echo Exit Do >> asusrescue.vbs
echo End If >> asusrescue.vbs
echo Loop >> asusrescue.vbs
echo objShell.Run("telnet 192.168.0.9") >> asusrescue.vbs
echo Do Until Success = True >> redbootSlug.vbs
echo Success = objShell.AppActivate("telnet") >> redbootSlug.vbs
echo Loop >> redbootSlug.vbs
echo Wscript.Sleep 300 >> redbootSlug.vbs
echo Success = objShell.AppActivate("telnet") >> asusrescue.vbs
echo objShell.SendKeys "root" >> asusrescue.vbs
echo objShell.SendKeys "{ENTER}" >> asusrescue.vbs
echo objShell.SendKeys "/usr/bin/stopall" >> asusrescue.vbs
echo objShell.SendKeys "{ENTER}" >> asusrescue.vbs
echo Wscript.Echo "Done... You can close this window." >> asusrescue.vbs
rem echo Wscript.Quit >> asusrescue.vbs
CALL CScript asusrescue.vbs
del asusrescue.vbsPowered down the O!Play (unplugged the power cord), started the script, then switched on the player. It worked for the very first time. The dvd player application stopped, so did the watchdog, and I had a working telnet prompt. In fact this command did some more, for example remounted the root fs in write mode, etc., so I think this command is a kind of debug command to aid developers to get access to things easily.
So I had a working telnet connection, I could fix my mistakes, and my O!Play was working again.
Note: The above script works on english versions of Windows XP and up. For making it work on localized versions, you need to change the string "Reply" in the 8th line to something that ping displays for succesfull tries, but does not displays when there is no response. It does not need to be a whole word, you can choose any character sequence which is part of the success message, but not part of the unsuccess message.
I believe that by polishing this further, we will be able to initiate a firmware reflashing procedure as well. Examining the firmware, I noticed that the "kill -6 1" command triggers busybox to execute the script /etc/reexec_init. This script creates a ramfs, copies the required files from the root fs to this ramfs. Finally, busybox executes a new init in ram. The script /etc/reexec_init/rcS (which becomes /etc/rcS in ram, so executed by the init) calls "loader_a", the flash image loader.
The loader expects the firmware URL as parameter. Since, at this point there are no USB devices yet, we cannot just give it a /tmp/usbmounts/..../install.img path. Either we need to
•Put the flash image on a web site and let "loader_a" download it from there.
•Mount the usb device manually, and specify the path of the flash image on the mounted usb drive.
I haven't tried this, so I don't know if any of the two ways work. But I think it should. I'll try it soon, I just feel I need to dig some more info out about how things work before I make an attempt to reflash a working device.
So, more about this later.
Notes
1. I tried the /usr/bin/stopall application from a telnet login.
Here is the list of threads running before, the output of stopall, and the list of threads running afterward:
/usr/bin # ls /proc
1 139 29 8 cmdline irq partitions
10 14 3 80 cpuinfo kallsyms self
100 140 32 83 crypto kcore slabinfo
101 141 35 84 devices kmsg stat
102 142 4 9 diskstats loadavg swaps
103 143 5 92 dma locks sys
104 144 55 93 driver meminfo sysvipc
11 15 6 94 execdomains misc tty
112 154 65 96 filesystems modules uptime
113 155 7 98 fs mounts version
12 196 70 99 interrupts mtd vmstat
13 2 77 buddyinfo iomem nandinfo yaffs
134 28 79 bus ioports net
/usr/bin # ./stopall
[Found RootApp] pid = 79 ...
[Found dvdplayer] pid = 83 ...
killing DvdPlayer...
killing RootApp...
RootApp AVHDD version...
pli initialization...
remount RO: ...
chip id: 1283: Mars...
>>>>>> Got NAND Flash device!
fw_desc_table_v1->signature=VERONA__
fw_desc_table_v1->part_list_len=0xc0
data_buf = 0x10006878
fw_desc_table_v1 = 0x10006878
sizeof(fw_desc_table_v1_t) = 0x20
part_entry = 0x10006898
part_count= 0x4
fw_entry = 0x10006958
FW type, 0x2!
Audio FW found!
Video FW found!
audio_fw_entry->offset = 0x1420000
audio_fw_entry->length = 0x1cd6b0
audio_fw_entry->target_addr = 0x81b00000
read len = 0x1cd6b0
video_fw_entry->offset = 0x1600000
video_fw_entry->length = 0x1b2478
video_fw_entry->target_addr = 0x81e00000
read len = 0x1b2478
remount RW: ...
/usr/bin # ls /proc
1 206 65 crypto ioports mounts sysvipc
10 28 7 devices irq mtd tty
11 29 70 diskstats kallsyms nandinfo uptime
12 3 77 dma kcore net version
13 32 8 driver kmsg partitions vmstat
14 35 9 execdomains loadavg self yaffs
15 4 buddyinfo filesystems locks slabinfo
154 5 bus fs meminfo stat
155 55 cmdline interrupts misc swaps
2 6 cpuinfo iomem modules sys
/usr/bin #
For those not familiar with the contents of /proc under Linux -
Those numbers are the thread (process) id numbers and are each a directory of information about the process.
That information includes the process (application) name.
It would take a bit of scripting to print a pretty list of what is still running (this Busybox does not have 'top' included).
It has 'ps -a', here is the result:
/usr/bin # ps -A
PID Uid VmSize Stat Command
1 root 368 S init
2 root SWN [ksoftirqd/0]
3 root SW< [events/0]
4 root SW< [khelper]
5 root SW< [kthread]
6 root SW< [kblockd/0]
7 root SW [khubd]
8 root SW [pdflush]
9 root SW [pdflush]
12 root SW< [aio/0]
10 root SW [kswapd0]
11 root SW [watchdog]
13 root SW< [cifsoplockd]
14 root SW< [cifsdnotifyd]
15 root SW [eth0]
16 root SW [mtdblockd]
28 root 376 S init
29 root 376 S init
32 root 376 S init
34 root 376 S init
64 root 380 S inetd
67 root SW< [sata_eh/0]
72 root SW [scsi_eh_0]
83 root SW [scsi_eh_1]
170 root 364 S /sbin/udhcpc -p /var/lock/udhcpc_eth0.pid -t 15 -b -s
183 root 312 R telnetd
184 root 492 S -sh
221 root 360 R ps -A
:fill(white):strip_exif()/i/1257327395.jpeg?f=thumbmini)
:fill(white):strip_exif()/i/1246986915.jpeg?f=thumbmini)
!
appreciate it!
:strip_icc():strip_exif()/u/2189/baby.jpg?f=community)
:strip_icc():strip_exif()/u/87065/Untitled-2.jpg?f=community)
. Je zou haast denken dat het support team van de Oplay uit slechts één persoon bestaat..