github-mirrors/Linkplay
1
0
Fork 0
mirror of https://github.com/Jan21493/Linkplay.git synced 2024-11-20 19:33:58 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

updated content

Browse source
This commit is contained in:
Jan Wachsmuth 2024-01-05 22:29:31 +01:00 committed by GitHub
parent cf9057f84d
commit f5e73e8cc4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 158 additions and 83 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
Downgrade.md
View file

@ -40,14 +40,11 @@ The XML file contains a list of products with their ID and more, including an UR
<productList> <productList>
... ...
<product> <product>
<productid>RP0011_WB60</productid> <productid>RP0011_WB60</productid>
<hardwareversion>WiiMu-A31</hardwareversion> <hardwareversion>WiiMu-A31</hardwareversion>
<UUID>FF31F09E</UUID> <UUID>FF31F09E</UUID>
<major-url> <major-url>http://ota.rakoit.com/release/RP0011_WB60/product.xml</major-url>
http://ota.rakoit.com/release/RP0011_WB60/product.xml
</major-url>
</product> </product>
<product>
... ...
</productList> </productList>
``` ```
@ -85,22 +82,22 @@ The example was downloaded in Oct 2020:
<mcu-ver>24</mcu-ver> <mcu-ver>24</mcu-ver>
<mcu-size>672498</mcu-size> <mcu-size>672498</mcu-size>
<mcu-image>http://ota.rakoit.com/release/RP0011_WB60/RP0011_WB60-0024-99617ee3-08182020.mcu.bin</mcu-image> <mcu-image>http://ota.rakoit.com/release/RP0011_WB60/RP0011_WB60-0024-99617ee3-08182020.mcu.bin</mcu-image>
</project> </project>
</product> </product>
``` ```
The URLs include a "random" ID that might be mapped to the product ID and a subdirectory with the version (date) for some files. The MCU files follow a different structure with the product ID used as a subdirectory and a version number that is included in the name of the image. The URLs include a "random" ID that might be mapped to the product ID and a subdirectory with the version (date) for some files. The MCU files follow a different structure with the product ID used as a subdirectory and a version number that is included in the name of the image.
| XML ID | Subdirectory | Description | | XML ID | Subdirectory | Description |
| --------------- | ------------- | ------------- | | --------------- | ------------- | ------------- |
| md5-url | major-version | plain text file with MD5 checksums for image files (uBoot, backup, user2, kernel) | | \<md5-url\> | major-version | plain text file with MD5 checksums for image files (uBoot, backup, user2, kernel) |
| ver-url | major-version | plain text file with version information and release date | | \<ver-url\> | major-version | plain text file with version information and release date |
| layout-url | major-version | plain text file with layout (e.g. offset, size, version, fstype, name, size) of file system in flash (user2, user, kernel) | | \<layout-url\> | major-version | plain text file with layout (e.g. offset, size, version, fstype, name, size) of file system in flash (user2, user, kernel) |
| image-kernel | major-version | main binary image for kernel | | \<image-kernel\> | major-version | main binary image for kernel |
| image-user | major-version | image for user file system (persistent) | | \<image-user\> | major-version | image for user file system (persistent) - not available for download |
| image-user2 | major-version | image for user file system (persistent) | | \<image-user2\> | major-version | image for user file system (persistent) - not available for download |
| image-uboot | - | boot loader uBoot | | \<image-uboot\> | - | boot loader uBoot |
| image-backup | - | backup image | | \<image-backup\> | - | backup image |
I'm not sure if the **<sign>** tag is used. I've modified the URLs (different FQDN and path) and got no error. Only the following files are downloaded during an upgrade and in that order (verified with Up2Stream Amp v2.0 and Wireshark): I'm not sure if the **\<sign\>** tag is used at all and what is covered with that 'signature'. I've modified the URLs (different FQDN and path) and got no error. Only the following files are downloaded during an upgrade and in that order (verified with Up2Stream Amp v2.0 and Wireshark):
| URL | Description | | URL | Description |
| --------------- | ------------- | | --------------- | ------------- |
| http://silenceota.linkplay.com/wifi_audio_image/products.xml | List of all Linkplay products in XML format with infos and URL | | http://silenceota.linkplay.com/wifi_audio_image/products.xml | List of all Linkplay products in XML format with infos and URL |
@ -420,7 +417,7 @@ curl -s 'http://10.1.1.58/httpapi.asp?command=getMvRemoteUpdateStartCheck'
# retrieve the status about the update/downgrade # retrieve the status about the update/downgrade
curl -s 'http://10.1.1.58/httpapi.asp?command=getMvRemoteUpdateStatus' curl -s 'http://10.1.1.58/httpapi.asp?command=getMvRemoteUpdateStatus'
``` ```
To verify that the downgrade was sucessful, you may request the extended status from the device. To verify that the downgrade was sucessful, you may retrieve the extended status from the device.
``` ```
curl -s 'http://10.1.1.58/httpapi.asp?command=getStatusEx' | jq curl -s 'http://10.1.1.58/httpapi.asp?command=getStatusEx' | jq
{ {

8
README.md
View file

@ -28,13 +28,13 @@ More information about the hardware and Firmware, file systems, including inform
Information about the boot process, file systems including environment (NVRAM). [Reverse Engineering](/boot-process.md) Information about the boot process, file systems including environment (NVRAM). [Reverse Engineering](/boot-process.md)
## Downgrade Firmware ## Downgrade Firmware
The first version on my devices was 4.2.8020 from 2020/02/20 (20th of Feb 2020). That version still has some vulnerabilites to be able to get onto the CLI with telnet by pushing a single command to these devices. Although it is good when the vendor is providing upgrades with additional feature and security fixes, I'd still like to be able to "hack" into the CLI. Therefore I had to downgrade the firmware. [Downgrade Firmware](/Downgrade.md) The first version on my devices was 4.2.8020 from 2020/02/20 (20th of Feb 2020). That version still has some vulnerabilites to be able to get onto the CLI with telnet by pushing a single command to these devices. Although it is good when the vendor is providing upgrades with additional feature and security fixes, I'd still like to be able to "hack" into the CLI. Therefore I had to downgrade the firmware. See [Downgrade Firmware](/Downgrade.md) and next section for more information.
## Download and Prepare Firmware on your own web server
If you have some Linkplay devices I have compiled a list / script with useful commands (mainly 'curl')' to download XML files, images and more for version 4.2.80 mentioned above and latest version. There is a lot of information, especially for devices with Linkplay A31 module, but may also be a starting point for other Linkplay modules. The script may help you to download and prepare the firmware on your own web server. [Download and prepare Firmware](/download-firmware.md)
## Install Persistant Hook ## Install Persistant Hook
When the device reboots, any changes in ramfs are lost, however there is a way to install a script or command so that it survives a reboot. [Install Persistant Hook](/persistant-hook.md) When the device reboots, any changes in ramfs are lost, however there is a way to install a script or command so that it survives a reboot. [Install Persistant Hook](/persistant-hook.md)
## Download and Prepare Firmware on your own web server
If you have some Linkplay devices I have compiled a list / script with useful commands (mainly curl) to download XML files, images and more for two different versions. It contains a lot of devices with Linkplay A31 module, but may also be a starting point for other Linkplay modules. The script may help you to download and prepare the firmware on your own web server. [Download and prepare Firmware](/download-firmware.md)
## Allow own shell scripts in cgi-bin ## Allow own shell scripts in cgi-bin
By default the cgi-bin directory is read-only, but there is a way to make it writable to be able to install own shell scripts on the device. See [Allow own shell scripts in cgi-bin](/cgi-bin.md) By default the cgi-bin directory is read-only, but there is a way to make it writable to be able to install own shell scripts on the device. See [Allow own shell scripts in cgi-bin](/cgi-bin.md)

2
TELNETD.md
View file

@ -24,4 +24,4 @@ The tool **_"busybox"_** is like a swiss army knife and combines a lot of CLI co
A version of busybox is provided here (see binary directory). That binary is compatible with the SoC that is running on the Linkplay A31 module, see [Hardware and Firmware](/Hardware.md) for details about the hardware. A version of busybox is provided here (see binary directory). That binary is compatible with the SoC that is running on the Linkplay A31 module, see [Hardware and Firmware](/Hardware.md) for details about the hardware.
There is an OpenWRT archive available where you can get precompiled binaries for almost all utilities you may need. See section [Hardware and Firmware](/Hardware.md) for details. There is an OpenWRT archive available where you can get precompiled binaries for almost all utilities you may need. See section [Firmware](/Hardware.md#firmware) for details.

7
boot-process.md
View file

@ -451,10 +451,11 @@ nvram_get 2860 lan_netmask
# displays password admin and sets a new one # displays password admin and sets a new one
nvram_get 2860 Password nvram_get 2860 Password
nvram_set Password newpassword nvram_set 2860 Password newpassword
``` ```
The option '2860' is optional and may be skipped.
The commands are located here: The commands to read and manipulate the NVRAM are located here:
``` ```
cd /bin cd /bin
ls l ls l
@ -466,7 +467,7 @@ lrwxrwxrwx 1 1000 1000 11 nvram_get -> ralink_init
... ...
``` ```
I found a documentation for these commands: I found a documentation for these commands (not matching 100%):
``` ```
Usage: Usage:
a. get: nvram_get [<2860/rtdev>] <field> a. get: nvram_get [<2860/rtdev>] <field>

6
cgi-bin.md
View file

@ -1,7 +1,7 @@
# Allow own shell scripts in cgi-bin # Allow own shell scripts in cgi-bin
By default the cgi-bin directory is read-only, but there is a way to make it writable to be able to install own shell scripts on the device. By default the cgi-bin directory is read-only, but there is a way to make it writable to be able to install own shell scripts on the device.
Initially I was looking for a way to add a notification message during play of music. There is a binary called ***"smplayer"*** preinstalled on the device that is exactly doing what I was looking for, even with nice fading of the music. Initially I was looking for a way to add a notification message during play of music. There is a binary called ***smplayer*** preinstalled on the device that is exactly doing what I was looking for, even with nice fading of the music.
Here's a shell script called ***notice.sh*** that is calling that program: Here's a shell script called ***notice.sh*** that is calling that program:
``` ```
@ -45,8 +45,8 @@ You may add these commands to a persistant hook, see [Install Persistant Hook](/
Now you can play a notice message on the device by calling your script: Now you can play a notice message on the device by calling your script:
``` ```
curl 'http://10.1.1.52/cgi-bin/notice.sh?play=http://10.1.1.22/mp3/SaunaIstAufgeheizt.mp3' curl 'http://10.1.1.52/cgi-bin/notice.sh?play=http://10.1.1.22/mp3/SaunaIstAufgeheizt.mp3'
# if you have downloaded any messages to the Linkplay device itself, you play a message from local storage # if you have downloaded any messages to the Linkplay device itself, you may play a message from local storage
curl 'http://10.1.1.52/cgi-bin/notice.sh?play=/tmp/SaunaIstAufgeheizt.mp3' curl 'http://10.1.1.52/cgi-bin/notice.sh?play=/tmp/SaunaIstAufgeheizt.mp3'
``` ```
> **Note:** > **Note:**
> Meanwhile Arylic has added an API call to play a notification message: ***/httpapi.asp?command=playPromptUrl:<url>***, see https://developer.arylic.com/httpapi/#play-notification-sound for details, but there might be other use cases. > Meanwhile Arylic has added an API call to play a notification message: ***/httpapi.asp?command=playPromptUrl:\<url\>***, see https://developer.arylic.com/httpapi/#play-notification-sound for details, but there might be other use cases.

137
download-firmware.md
View file

@ -48,42 +48,141 @@ cd /Library/WebServer/Documents/linkplay
## 1. Download latest products.xml file ## 1. Download latest products.xml file
The XML file products.xml contains a list of all products for which downloads are available. The following list contains devices with (mainly) A31 module. The XML file products.xml contains a list of all products for which downloads are available. The following list contains devices with (mainly) A31 module.
``` ```
curl http://silenceota.linkplay.com/wifi_audio_image/products.xml -o products-original-`date '+%Y-%m-%d'`.xml curl http://silenceota.linkplay.com/wifi_audio_image/products.xml -o products-`date '+%Y-%m-%d'`.xml
``` ```
> NOTE: > NOTE:
> There is a different products list available for devices with (mainly) A28 module (not covered here) > There is a different products list available for devices with (mainly) A28 module (not covered here)
``` ```
curl http://silenceota.linkplay.com/wifi_audio_image/products_v2.xml -o products_v2-original-`date '+%Y-%m-%d'`.xml curl http://silenceota.linkplay.com/wifi_audio_image/products_v2.xml -o products_v2-`date '+%Y-%m-%d'`.xml
``` ```
## 2. Download latest specific product.xml files ## 2. Download latest specific product.xml files
You should download the product.xml files for your product (and maybe a few more), because the URLs may alway point to the latest version only. Therefore it may be hard to guess the name for older versions or it's even impossible to download them if the URL stays the same. I recommend to put them into a directory with the (assumed) release date included in the directory name. You should download the product.xml files for your product (and maybe a few more), because the URLs may alway point to the latest version only. Therefore it may be hard to guess the name for older versions or it's even impossible to download them if the URL stays the same.
It's easy to see that the download URLs are the same for products with the same ***`<UUID>`*** When you look into the products.xml file, you can find the URLs, UUIDs, product IDs for each product that can be upgraded. It's easy to see that the download URLs are the same for products with the same UUID, so I added the UUID to the name (see below). I also added the (assumed) version as a prefix. It might be a good idea to use "-original.xml" for all downloaded files for later reference and modify copies only. The names get longer, but by using such a naming scheme it's easier to find the original file, know which products are using the same binaries and to distinguish between files, e.g. if they are loaded in an editor.
It is more complicated to retrieve the exact release date from the content of the xml file, so I used a fixed string (20220427 in the example below).
specific p You may convert the XML file into 'curl' commands for easy downloading by using 'search & replace' with regular expressions in your editor
for all used products (the following short list contains all products from Rakoit/Arylic only!)
mkdir product.xmls-`date '+%Y-%m-%d'`
cd product.xmls-`date '+%Y-%m-%d'`
You may convert the XML file into 'curl' commands for download by using 'search & replace' with regular expressions in your editor
- Search for: `.*<product>.*\n.*<productid>(.*)</productid>.*\n.*\n.*<UUID>(.*)</UUID>.*\n.*<major-url>(.*)</major-url>.*\n.*` - Search for: `.*<product>.*\n.*<productid>(.*)</productid>.*\n.*\n.*<UUID>(.*)</UUID>.*\n.*<major-url>(.*)</major-url>.*\n.*`
- Replace with: `curl --create-dirs '$3' -o 'product-$2-$1-20220427.xml'`. (see example 1) - Replace with: `curl --create-dirs '$3' -o 'product-$2-$1-20220427.xml'`. (see example below)
and and
- Search for: `.*<product>.*\n.*<productid>(.*)</productid>.*\n.*\n.*<major-url>(.*)</major-url>.*\n.*<UUID>(.*)</UUID>.*\n.*` - Search for: `.*<product>.*\n.*<productid>(.*)</productid>.*\n.*\n.*<major-url>(.*)</major-url>.*\n.*<UUID>(.*)</UUID>.*\n.*`
- Replace with: `curl --create-dirs '$2' -o 'product-$3-$1-20220427.xml''`. - Replace with: `curl --create-dirs '$2' -o 'product-$3-$1-20220427.xml''`.
Below there is a shortlist with products that I own, but you may either follow the instructions above or extract the files for products you need from the [download-firmware.sh](/download-firmware.sh) shell script. The example below is using the current date as a directory name, but a fixed version in the filename. After you've downloaded the files you may adjust the filename with the real version from the content of the file.
``` ```
# example 1 mkdir product.xmls-`date '+%Y-%m-%d'`
cd product.xmls-`date '+%Y-%m-%d'`
curl --create-dirs 'http://ota.rakoit.com/release/UP2STREAM_PRO_V3/product.xml' -o 'product-FF31F09E-UP2STREAM_PRO_V3-20220427.xml' curl --create-dirs 'http://ota.rakoit.com/release/UP2STREAM_PRO_V3/product.xml' -o 'product-FF31F09E-UP2STREAM_PRO_V3-20220427.xml'
curl --create-dirs 'http://ota.rakoit.com/release/UP2STREAM_AMP_V3/product.xml' -o 'product-FF31F09E-UP2STREAM_AMP_V3-20220427.xml'
curl --create-dirs 'http://ota.rakoit.com/release/UP2STREAM_AMP_V4/product.xml' -o 'product-FF31F09E-UP2STREAM_AMP_V4-20220427.xml'
curl --create-dirs 'http://ota.rakoit.com/release/RP0011_WB60/product.xml' -o 'product-FF31F09E-RP0011_WB60-20220427.xml'
curl --create-dirs 'http://ota.rakoit.com/release/RP0011_WB60_S/product.xml' -o 'product-FF31F09E-RP0011_WB60_S-20220427.xml'
```
You may also download the product.xml files into the directories where the images are stored as shown in the structure tree above. You should clean up the directory afterwards, because there might be some product.xml files having only a xml error message as a content. It's easy to identify these files, because they have a length of less than 200 byte.
## 3. Download latest files for specific products
The product.xml file includes URLs for images for kernel, MCUs, boot loader and additional files e.g. version information, layout for flash file system and md5 checksums. You may combine all product.xml file into a single file for easier modification with search & replace.
```
cat ./* > all-products.xml
```
Manually convert 'all-products.xml' file into curl downloads - regular expressions and visual studio code are your friends ;-)
My focus is on products from Arylic / Rakoit. All these products are using the Linkplay A31 module, but use different MCUs. Almost all of them are using the same UUID (not included in the product.xml files) and the same 'cryptic' ID 2ANRu7eyAEYtoo4NZPy9dL in the URLs. Only the following product IDs are different:
- AURIS_S50A - it has the same 'cryptic' ID, but an an older relase date 20211206
- AE1W, Audioengine_X20_S, X-20 - they use 'cryptic' ID 3e2BsdNiza3MAfpALWxWac and have an older relase date 20211116
All other products have also the same version (release date) which is 20220427. Therefore I've downloaded the images and additional files only once per version and used ***'a31rakoit'*** and the release dates as a subdirectories.
> Note: I'm not using on of the four exceptions, so I've skipped these.
> Important Conclusion: If all these products are using the same binaries for the latest release 20220427, this should be the same for older versions. The older versions however follow a different URL path scheme where each product had its own 'cryptic' ID as path/subdirectory. This assumption is the key to be able to downgrade to an older version even if the exact product was not available for that version. You may use a different product (from the same vendor) that has the same UUID or the same URL as the product you own. If you downgrade your product, the MCU part can be constructed and be the same as the current version. I was able to verify this assumption for product ID RP0011_WB60_S.
It turned out that the two files with '.jffs2' ending were not available from the update server. Actually you get an xml error message as a content that the file was not available for download. Therefore I've commented them out. I'm not sure if this is the case for all products, but at least for all products from Arylic this is the case.
I've downloaded uBoot and backup images in main directory ***'a31rakoit'*** for all products with 'cryptic' ID 2ANRu7eyAEYtoo4NZPy9dL and all other files (kernel image, md5 checksum, loader information for flashfs, version information) into a subdirectory that are named with the release date of the version to which the file belongs to.
As before, the list below is a shortlist with commands for the products that I own. You may either follow the instructions above or extract the files for products you need from the [download-firmware.sh](/download-firmware.sh).
```
cd /Library/WebServer/Documents/linkplay
mkdir a31
cd a31
# subdirectory 2ANRu7eyAEYtoo4NZPy9dL is mapped to a31rakoit
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/uboot_v632.img -o a31rakoit/uboot_v632.img
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/backup_new_v1141.img -o a31rakoit/backup_new_v1141.img
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/20220427/md5.txt -o a31rakoit/20220427/md5.txt
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/20220427/MVver_20220427 -o a31rakoit/20220427/MVver_20220427
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/20220427/layout -o a31rakoit/20220427/layout
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/20220427/a31rakoit/_new_uImage_20220427 -o a31rakoit/20220427/a31rakoit_new_uImage_20220427
#curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/20220427/user.jffs2 -o a31rakoit/20220427/user.jffs2
#curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/2ANRu7eyAEYtoo4NZPy9dL/20220427/user2.jffs2 -o a31rakoit/20220427/user2.jffs2
#
# MCUs are stored in subdirectories (they have the version included in their file names)
curl --create-dirs http://ota.rakoit.com/release/RP0011_WB60/RP0011_WB60-0024-99617ee3-08182020.mcu.bin -o RP0011_WB60/RP0011_WB60-0024-99617ee3-08182020.mcu.bin
curl --create-dirs http://ota.rakoit.com/release/RP0011_WB60_S/RP0011_WB60_S-0024-99617ee3-08182020.mcu.bin -o RP0011_WB60_S/RP0011_WB60_S-0024-99617ee3-08182020.mcu.bin
curl --create-dirs http://ota.rakoit.com/release/UP2STREAM_AMP_V3/UP2STREAM_AMP_V3-0035-99e42697-20220509.mcu.bin -o UP2STREAM_AMP_V3/UP2STREAM_AMP_V3-0035-99e42697-20220509.mcu.bin
curl --create-dirs http://ota.rakoit.com/release/UP2STREAM_AMP_V4/UP2STREAM_AMP_V4-0036-30cb0ae0-20220702.mcu.bin -o UP2STREAM_AMP_V4/UP2STREAM_AMP_V4-0036-30cb0ae0-20220702.mcu.bin
curl --create-dirs http://ota.rakoit.com/release/UP2STREAM_PRO_V3/UP2STREAM_PRO_V3-0044-44b0e3c1-20230808.mcu.bin -o UP2STREAM_PRO_V3/UP2STREAM_PRO_V3-0044-44b0e3c1-20230808.mcu.bin
#
# The same product.xml files that were downloaded above into a common directory are also copied into the product ID directory.
# They were also renamed to "-20220427-original.xml" to makes it easier to create an xml file that is pointing to your own local web server.
curl --create-dirs http://ota.rakoit.com/release/UP2STREAM_PRO_V3/product.xml -o UP2STREAM_PRO_V3/product-UP2STREAM_PRO_V3-20220427-original.xml
curl --create-dirs http://ota.rakoit.com/release/UP2STREAM_AMP_V3/product.xml -o UP2STREAM_AMP_V3/product-UP2STREAM_AMP_V3-20220427-original.xml
curl --create-dirs http://ota.rakoit.com/release/RP0011_WB60/product.xml -o RP0011_WB60/product-RP0011_WB60-20220427-original.xml
curl --create-dirs http://ota.rakoit.com/release/RP0011_WB60_S/product.xml -o RP0011_WB60_S/product-RP0011_WB60_S-20220427-original.xml
curl --create-dirs http://ota.rakoit.com/release/UP2STREAM_AMP_V4/product.xml -o UP2STREAM_AMP_V4/product-UP2STREAM_AMP_V4-20220427-original.xml
```
## 4. Download product.xml files for all used products for version 20200220
Now it gets interesting, because you can't find these files on the Internet directly, but they are still available for download if you know the URLs.
> NOTE:
> The naming convention was different at that time - the cryptic product ID is related to a specific product and version. It's stored in the same directory as the files for that release.
As before, the list below is a shortlist with commands for the products that I own. Extract the files for products you need from the [download-firmware.sh](/download-firmware.sh).
```
cd /Library/WebServer/Documents/linkplay
mkdir product.xmls-20200220
cd product.xmls-20200220
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/product.xml -o product-RP0011_WB60-20200220-original.xml
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/drPb6dKCSrFvPiYD8tJiqe/product.xml -o product-RP0011_WB60_S-20200220-original.xml
#
cd ../a31
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/product.xml -o RP0011_WB60/product-RP0011_WB60-20200220-original.xml
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/drPb6dKCSrFvPiYD8tJiqe/product.xml -o RP0011_WB60_S/product-RP0011_WB60_S-20200220-original.xml
```
> NOTE:
> There are no product.xml files for new products like UP2STREAM_PRO_V3, UP2STREAM_AMP_V3, or UP2STREAM_AMP_V4, but that's no problem, because of the conclusion from above and the fact that there IS a product in the list that has the same UUID / 'cryptic' ID (in the latest version).
It may not be important to have the MCU files for an older version. You can just copy the part from the latest version. Even if the device will not work with that MCU, the main reason to do a downgrade is to install a persistent hook in flashfs that survives a reboot and even an upgrade, see [Install Persistant Hook](/persistant-hook.md) After the hook is installed, you may upgrade again to the version that was used before.
If there is no product with the same UUID available, but your product is based on the Linkplay A31 module, then it might be possible (although more risky) to install the files for a different product from the same or even another vendor by manipulating the product ID. At the end it's your risk - don't blame me if it is not working and you've bricked your device!
## 5. Download images and additional files for version 20200220 for a downgrade
Again, you may either modify the product.xml files and convert them into 'curl' commands or extract them from the shell script.
I followed the directory structure from above and have downloaded the files in a subdirectory below the common ***a31rakoit*** subdirectory.
> Note: uBoot and backup images are the same as for the latest version (same filename and same content). They differ slightly in binary compare via 'diff', but only in build date so I believe that they don't differ in functionality and were just compiled at a different date. For this reason and the fact that the device was never asking for these files during a downgrade, I've skipped the download.
```
cd /Library/WebServer/Documents/linkplay/a31
#curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/uboot_v632.img -o a31rakoit/uboot_v632.img
#curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/backup_new_v1141.img -o a31rakoit/backup_new_v1141.img
# subdirectory for version 20200220
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/20200220/md5.txt -o a31rakoit/20200220/md5.txt
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/20200220/MVver_20200220 -o a31rakoit/20200220/MVver_20200220
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/20200220/layout -o a31rakoit/20200220/layout
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/20200220/a31rakoit_new_uImage_20200220 -o a31rakoit/20200220/a31rakoit_new_uImage_20200220
#curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/20200220/user.jffs2 -o a31rakoit/20200220/user.jffs2
#curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image/NTeDAvvJzTUtBekHVnqJrB/20200220/user2.jffs2 -o a31rakoit/20200220/user2.jffs2
#
# MCUs are stored in subdirectories - the first few products are for Arylic/Rakoit
curl --create-dirs http://ota.rakoit.com/release/RP0011_WB60/RP0011_WB60-0024-99617ee3-08182020.mcu.bin -o RP0011_WB60/RP0011_WB60-0024-99617ee3-08182020.mcu.bin
curl --create-dirs http://ota.rakoit.com/release/UP2STREAM_PRO_V3/UP2STREAM_PRO_V3-0021-37e5f282-20201212.mcu.bin -o UP2STREAM_PRO_V3/UP2STREAM_PRO_V3-0021-37e5f282-20201212.mcu.bin
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image_mcu/RP0011_WB60/RP0011_WB600022.mcu.bin -o RP0011_WB60/RP0011_WB600022.mcu.bin
curl --create-dirs http://silenceota.linkplay.com/wifi_audio_image_mcu/RP0011_WB60_S/RP0011_WB60_S0022.mcu.bin -o RP0011_WB60_S/RP0011_WB60_S0022.mcu.bin
``` ```
It might be better to to put all ***product.xml*** files into a single directory to be able to combine them or extract the products you need. You may replace the "/" with "-" to > NOTE: Don't forget to add read and execute (enter directory) rights for the whole linkplay directory structure on your web server at the final end!!
```
curl --create-dirs $3 -o $2/$1/product-$1-original.xml
> NOTE: Don't forget to add read and execute (enter directory) rights for the whole linkplay subdirectories and files at the final end!!
``` ```
chmod -v -R u=rwx,g=rx,o=rx * chmod -v -R u=rwx,g=rx,o=rx *
``` ```

3
download-firmware.sh
View file

@ -14,9 +14,10 @@ curl http://silenceota.linkplay.com/wifi_audio_image/products.xml -o products-or
# FYI: There is a different products list available for devices with (mainly) A28 module (not covered here) # FYI: There is a different products list available for devices with (mainly) A28 module (not covered here)
# curl http://silenceota.linkplay.com/wifi_audio_image/products_v2.xml -o products_v2-original-`date '+%Y-%m-%d'`.xml # curl http://silenceota.linkplay.com/wifi_audio_image/products_v2.xml -o products_v2-original-`date '+%Y-%m-%d'`.xml
# #
# 2. download specific product.xml files for all used products (the following short list contains all products from Rakoit/Arylic only!) # 2. download specific product.xml files for all used products
mkdir product.xmls-`date '+%Y-%m-%d'` mkdir product.xmls-`date '+%Y-%m-%d'`
cd product.xmls-`date '+%Y-%m-%d'` cd product.xmls-`date '+%Y-%m-%d'`
# the following short list contains all products from Rakoit/Arylic only!
curl http://ota.rakoit.com/release/ARYLIC_A50N/product.xml -o product-ARYLIC_A50N.xml curl http://ota.rakoit.com/release/ARYLIC_A50N/product.xml -o product-ARYLIC_A50N.xml
curl http://ota.rakoit.com/release/Audioengine_X20_S/product.xml -o product-Audioengine_X20_S.xml curl http://ota.rakoit.com/release/Audioengine_X20_S/product.xml -o product-Audioengine_X20_S.xml
curl http://ota.rakoit.com/release/Audioengine_X20_S/product.xml -o product-AE1W.xml curl http://ota.rakoit.com/release/Audioengine_X20_S/product.xml -o product-AE1W.xml

45
persistant-hook.md
View file

@ -39,7 +39,7 @@ mtd9: 00200000 00010000 "user2"
The mtd9 device named "user2" is not erased at a reboot, because it contains play lists. It is mounted as /vendor and a hook can be installed in ***/vendor/user*** directory as described below. On the Up2Stream Pro device that I own that directory was already present and a script called ***user.sh*** was located in that directory. The mtd9 device named "user2" is not erased at a reboot, because it contains play lists. It is mounted as /vendor and a hook can be installed in ***/vendor/user*** directory as described below. On the Up2Stream Pro device that I own that directory was already present and a script called ***user.sh*** was located in that directory.
> **Note:** > **Note:**
> Neither that directory nor the **user.sh** script were installed on my Up2Stream Amp device by default. Both devices have the same software version 4.2.8020 from 2020/02/20 (20th of Feb 2020) and were downgraded from v4.6.415145, release date 2022/04/27. > Neither that directory nor the **user.sh** script were installed on my Up2Stream Amp device by default. Both devices have the same software version 4.2.8020 from 2020/02/20 (20th of Feb 2020) and were downgraded from v4.6.415145, release date 2022/04/27.
Here's the file from the device where the script was already present (used to start a daemon called ***socket***): Here's the file from the device where the script was already present (used to start a daemon called ***socket***):
``` ```
@ -57,41 +57,15 @@ echo $sn
if [ $sn -eq 0 ]; then if [ $sn -eq 0 ]; then
/vendor/user/socket & /vendor/user/socket &
fi fi
# ######### additional code to install telnetd and more #############
# get telnetd from full version of busybox and start in background
mkdir /tmp/bin
wget -O /tmp/bin/busybox -T 5 http://10.1.1.22/linkplay/a31/bin/busybox -q
chmod 555 /tmp/bin/busybox
ln -s /tmp/bin/busybox /tmp/bin/telnetd
sn=`ps | grep busybox | wc -l`
if [ $sn -eq 1 ]; then
killall busybox
fi
sn=`ps | grep telnetd | wc -l`
if [ $sn -eq 1 ]; then
killall telnetd
fi
/tmp/bin/telnetd telnetd -l/bin/ash &
# shut down WiFi
ifconfig apcli0 down
ifconfig ra0 down
sleep 60
ifconfig apcli0 down
echo "WiFi disabled!"
# Uncomment to disable sleep after 15 minutes
#while true; do sleep 60; echo 'AXX+MUT+000' >/dev/ttyS0; done &
``` ```
For testing purpose, you may ***reboot*** and ***telnet*** to the device afterwards. Just append the code below at the end of that file. On the device where the script was not present, I've just created it.
Here's the file from the device where the script was NOT present. There is a little "enhancement" included, because the downloaded version of busybox is used as the shell ***/tmp/bin/ash*** instead of "build-in" version. You can see the difference, because the shell prompt message is ***BusyBox v1.23.2 (2016-09-27 07:54:34 CEST) built-in shell (ash)*** instead of ***BusyBox v1.12.1 () built-in shell (ash)***. Compared to the the section [Enable telnetd](/TELNETD.md), the code below has a little enhancement included, because the downloaded version of busybox is used as the shell ***/tmp/bin/ash*** instead of "build-in" version. You can see the difference, because the shell prompt message is ***BusyBox v1.23.2 (2016-09-27 07:54:34 CEST) built-in shell (ash)*** instead of ***BusyBox v1.12.1 () built-in shell (ash)***.
A list of all commands that are included is shown with ***/tmp/bin/busybox --help*** or just help (see shell script below). You may create symbolic links for these commands (recommended, see below for an example) or start them directly, e.g. ***/tmp/bin/busybox dmesg***. A list of all commands that are included is shown with ***/tmp/bin/busybox --help*** or just 'help' (see shell script below). You may create symbolic links for the commands you need (recommended, see below for an example) or start them directly, e.g. ***/tmp/bin/busybox dmesg***.
``` ```
mkdir /vendor/user mkdir /vendor/user
cat <<\EOF > /vendor/user/user.sh cat <<\EOF >> /vendor/user/user.sh
#!/bin/sh #!/bin/sh
sleep 5 sleep 5
@ -107,11 +81,12 @@ echo '#!/bin/sh' >/tmp/bin/help
echo '/tmp/bin/busybox --help' >>/tmp/bin/help echo '/tmp/bin/busybox --help' >>/tmp/bin/help
chmod 755 /tmp/bin/help chmod 755 /tmp/bin/help
# shut down WiFi # shut down WiFi - use only if the device is connected by LAN - eth0
ifconfig apcli0 down ifconfig apcli0 down
ifconfig ra0 down ifconfig ra0 down
sleep 600 sleep 600
ifconfig apcli0 down ifconfig apcli0 down
ifconfig apcli0 down
# Uncomment to disable sleep after 15 minutes # Uncomment to disable sleep after 15 minutes
#while true; do sleep 60; echo 'AXX+MUT+000' >/dev/ttyS0; done & #while true; do sleep 60; echo 'AXX+MUT+000' >/dev/ttyS0; done &
@ -120,14 +95,16 @@ chmod 755 /vendor/user/user.sh
cd /vendor/user cd /vendor/user
ls -l ls -l
``` ```
The shutdown of "apcli0" does not work within the script, however it works a bit later if executed manually. The shutdown of the 'apcli0' WiFi interface does not work within the script, however it works a bit later if executed manually.
So far, the device fetches the full version of busybook after each reboot, but stores that binary in ramfs. With ***df*** command you can verify the free space on each of the file systems. So far, the device fetches the full version of busybook after each reboot, but stores that binary in ramfs. With ***df*** command you can verify the free space on each of the file systems.
> **IMPORTANT:** > **IMPORTANT:**
> The hook is NOT called, if the device got stuck during an upgrade, e.g. if you have a ***products.xml*** file with a product ID that is matching your product that triggers an upgrade, but got stuck for some reasons. Therefore I recommend to rename the ***products.xml*** file on your server to something else and block or redirect any upgrade requests on the Internet. See [Downgrade Firmware](/Downgrade.md) section at the end for details. > The hook is NOT called, if the device got stuck during an upgrade, e.g. if you have a ***products.xml*** file with a product ID that is matching your product that triggers an upgrade, but got stuck for some reasons. Therefore I recommend to rename the ***products.xml*** file on your server to something else and block or redirect any upgrade requests on the Internet. See [Downgrade Firmware](/Downgrade.md) section at the end for details.
The good thing is, that this hook even suvives an upgrade that is done afterwards (tested with v4.6.415145, release date 2022/04/27.): For testing purpose, you may ***reboot*** and ***telnet*** to the device afterwards.
> IMPORTANT: The good thing is, that this hook even suvives an upgrade that is done afterwards (tested with v4.6.415145, release date 2022/04/27.):
``` ```
Mac-mini ~ % curl -s 'http://10.1.1.52/httpapi.asp?command=getStatusEx' | jq Mac-mini ~ % curl -s 'http://10.1.1.52/httpapi.asp?command=getStatusEx' | jq
{ {