From e6b4c1ea9fb7466406d05e28756c48efce00ef99 Mon Sep 17 00:00:00 2001 From: Jan Wachsmuth Date: Fri, 12 Jan 2024 22:27:52 +0100 Subject: [PATCH] updated content --- TELNETD.md | 2 +- persistant-hook.md | 109 ++++++++++++++++++++++++++------------------- 2 files changed, 63 insertions(+), 48 deletions(-) diff --git a/TELNETD.md b/TELNETD.md index f6a6665..0330562 100644 --- a/TELNETD.md +++ b/TELNETD.md @@ -17,7 +17,7 @@ chmod 555 /tmp/bin/busybox; /tmp/bin/busybox telnetd -l/bin/ash; ``` > **Note:** -> Don't forget to add a ";" at the end inside the quotes. Replace all spaces with "+" if you want to create your own URL with curl. +> Don't forget to add a ";" at the end inside the quotes. Replace all spaces with "+" if you want to create your own URL with curl. The length of the message is limited, so don't try to add too much code. The tool **_"busybox"_** is like a swiss army knife and combines a lot of CLI commands in a single binary file. That file was stripped down in the version that was running on my Linplay device and does not include a telnetd anymore. Therefore you have to get a full version from somewhere. diff --git a/persistant-hook.md b/persistant-hook.md index bbcd7df..7c9a4f9 100644 --- a/persistant-hook.md +++ b/persistant-hook.md @@ -36,12 +36,70 @@ mtd8: 00080000 00010000 "user" mtd9: 00200000 00010000 "user2" # ``` -The mtd9 device named "user2" is not erased at a reboot, because it contains play lists. It is mounted as /vendor and a hook can be installed in ***/vendor/user*** directory as described below. On the Up2Stream Pro device that I own that directory was already present and a script called ***user.sh*** was located in that directory. +The mtd8 device named "user" is not erased at a reboot, because it may contain a preset list (file ***totalqueue.xml*** and/or ***keymap.xml***) in /mnt directory. There's also a third file in the directory called ***radio.xml***. + +The mtd9 device named "user2" is not erased at a reboot, because it may contain additional 'vendor' data. It is mounted as /vendor and a hook can be installed in ***/vendor/user*** directory as described below. On the Up2Stream Pro device that I own that directory was already present and a script called ***user.sh*** was located in that directory. + +After a reset to factory settings with release v4.6.415145, release date 2022/04/27, the device has a web interface. To run this web interface the device calls a shell script ***/vendor/user/user.sh where some code can be added to: + +``` +/usr/sbin/telnetd + +cd /system/workdir/ +. ./evn.sh + +chmod 777 /vendor/user/daemonize +chmod 777 /vendor/user/ws_server + +/vendor/user/daemonize /vendor/user/ws_server +``` +> **Note:** +> The ***telnetd*** is NOT installed, because the file is missing in the (read only) directory /usr/bin. + +Just append the code below at the end of that file. On the device where the script was not present, I've just created it. +``` +sleep 5 +# get telnetd from full version of busybox and start in background +mkdir /tmp/bin +wget -O /tmp/bin/busybox -T 5 http://10.1.1.22/linkplay/a31/bin/busybox -q +chmod 555 /tmp/bin/busybox +ln -s /tmp/bin/busybox /tmp/bin/telnetd +ln -s /tmp/bin/busybox /tmp/bin/ash +/tmp/bin/telnetd telnetd -l/tmp/bin/ash & + +echo '#!/bin/sh' >/tmp/bin/help +echo '/tmp/bin/busybox --help' >>/tmp/bin/help +chmod 755 /tmp/bin/help + +# shut down WiFi after 5 min, but only if the device is connected by LAN (eth2) and got an IP addr on that interface +sleep 300 +lanIPup=`ifconfig eth2 | grep 'inet addr:' | wc -l` +if [ $lanIPup -eq 1 ]; then + ifconfig ra0 down + ifconfig apcli0 down + ifconfig apcli0 down +fi +unset lanIPup + +# Uncomment to disable sleep after 15 minutes (I haven't used this code - just an example from Crymeiriver) +#while true; do sleep 60; echo 'AXX+MUT+000' >/dev/ttyS0; done & +``` +The shutdown of the 'apcli0' WiFi interface does not work within the script when called in the first place, however it works a bit later if executed manually. So I added the 300 seconds (5 minutes) sleep and executed the command twice. Now it looks that it works as expected. I also added some code, so that the WiFi interface is NOT shut down if the Ethernet / LAN interface (eth2) does not get an IP address. + +Compared to the the section [Enable telnetd](/TELNETD.md), the code above has a little enhancement included, because the downloaded version of busybox is used as the shell ***/tmp/bin/ash*** instead of "build-in" version. You can see the difference, because the shell prompt message is ***BusyBox v1.23.2 (2016-09-27 07:54:34 CEST) built-in shell (ash)*** instead of ***BusyBox v1.12.1 () built-in shell (ash)***. + +A list of all commands that are included is shown with ***/tmp/bin/busybox --help*** or just 'help' (see shell script below). You may create symbolic links for the commands you need (recommended, see below for an example) or start them directly, e.g. ***/tmp/bin/busybox dmesg***. + +So far, the device fetches the full version of busybook after each reboot, but stores that binary in ramfs. With ***df*** command you can verify the free space on each of the file systems. + +> **IMPORTANT:** +> The hook is NOT called, if the device got stuck during an upgrade, e.g. if you have a ***products.xml*** file with a product ID that is matching your product that triggers an upgrade, but got stuck for some reasons. Therefore I recommend to rename the ***products.xml*** file on your server to something else and block or redirect any upgrade requests on the Internet. See [Downgrade Firmware](/Downgrade.md) section at the end for details. + > **Note:** -> Neither that directory nor the **user.sh** script were installed on my Up2Stream Amp device by default. Both devices have the same software version 4.2.8020 from 2020/02/20 (20th of Feb 2020) and were downgraded from v4.6.415145, release date 2022/04/27. +> Neither the directory ***/vendor/user*** nor the **user.sh** script were installed on my Up2Stream devices when I bought them with version 4.2. That may have changed with v4.6 -Here's the file from the device where the script was already present (used to start a daemon called ***socket***): +Here's an older script that I found on the device (used to start a daemon called ***socket***): ``` # cat user.sh #!/bin/sh @@ -58,49 +116,6 @@ if [ $sn -eq 0 ]; then /vendor/user/socket & fi ``` -Just append the code below at the end of that file. On the device where the script was not present, I've just created it. - -Compared to the the section [Enable telnetd](/TELNETD.md), the code below has a little enhancement included, because the downloaded version of busybox is used as the shell ***/tmp/bin/ash*** instead of "build-in" version. You can see the difference, because the shell prompt message is ***BusyBox v1.23.2 (2016-09-27 07:54:34 CEST) built-in shell (ash)*** instead of ***BusyBox v1.12.1 () built-in shell (ash)***. - -A list of all commands that are included is shown with ***/tmp/bin/busybox --help*** or just 'help' (see shell script below). You may create symbolic links for the commands you need (recommended, see below for an example) or start them directly, e.g. ***/tmp/bin/busybox dmesg***. -``` -mkdir /vendor/user -cat <<\EOF >> /vendor/user/user.sh -#!/bin/sh - -sleep 5 -# get telnetd from full version of busybox and start in background -mkdir /tmp/bin -wget -O /tmp/bin/busybox -T 5 http://10.1.1.22/linkplay/a31/bin/busybox -q -chmod 555 /tmp/bin/busybox -ln -s /tmp/bin/busybox /tmp/bin/telnetd -ln -s /tmp/bin/busybox /tmp/bin/ash -/tmp/bin/telnetd telnetd -l/tmp/bin/ash & - -echo '#!/bin/sh' >/tmp/bin/help -echo '/tmp/bin/busybox --help' >>/tmp/bin/help -chmod 755 /tmp/bin/help - -# shut down WiFi - use only if the device is connected by LAN - eth0 -ifconfig apcli0 down -ifconfig ra0 down -sleep 600 -ifconfig apcli0 down -ifconfig apcli0 down - -# Uncomment to disable sleep after 15 minutes -#while true; do sleep 60; echo 'AXX+MUT+000' >/dev/ttyS0; done & -EOF -chmod 755 /vendor/user/user.sh -cd /vendor/user -ls -l -``` -The shutdown of the 'apcli0' WiFi interface does not work within the script when called in the first place, however it works a bit later if executed manually. So I added the 600 seconds (10 minutes) sleep and executed the command twice. Now it looks that it works as expected. - -So far, the device fetches the full version of busybook after each reboot, but stores that binary in ramfs. With ***df*** command you can verify the free space on each of the file systems. - -> **IMPORTANT:** -> The hook is NOT called, if the device got stuck during an upgrade, e.g. if you have a ***products.xml*** file with a product ID that is matching your product that triggers an upgrade, but got stuck for some reasons. Therefore I recommend to rename the ***products.xml*** file on your server to something else and block or redirect any upgrade requests on the Internet. See [Downgrade Firmware](/Downgrade.md) section at the end for details. For testing purpose, you may ***reboot*** and ***telnet*** to the device afterwards. @@ -133,5 +148,5 @@ BusyBox v1.23.2 (2016-09-27 07:54:34 CEST) built-in shell (ash) /system/workdir # exit Connection closed by foreign host. - ``` +```