Category:Internet Space

Introduction
It looks like this device is based on the Edmini drive from LaCie. Browsing it, I could see several 'edmini'-related files.

Specs
-bash-3.00# uname -a Linux axentraserver.htpc.homelibrary.fr 2.6.12.6-arm1-lacie5b #3 Fri Apr 20 11:44:12 EDT 2007 armv5tejl armv5tejl armv5tejl GNU/Linux

-bash-3.00# cat /proc/cpuinfo Processor	: ARM926EJ-Sid(wb) rev 0 (v5l) BogoMIPS	: 266.24 Features	: swp half thumb fastmult CPU implementer	: 0x41 CPU architecture: 5TEJ CPU variant	: 0x0 CPU part	: 0x926 CPU revision	: 0 Cache type	: write-back Cache clean	: cp15 c7 ops Cache lockdown	: format C Cache format	: Harvard I size		: 32768 I assoc		: 1 I line length	: 32 I sets		: 1024 D size		: 32768 D assoc		: 1 D line length	: 32 D sets		: 1024

Hardware	: MV-88fxx81 Revision	: 0000 Serial		: 0000000000000000

-bash-3.00# cat /proc/meminfo MemTotal:       61320 kB MemFree:          2120 kB Buffers:         10556 kB Cached:          24856 kB SwapCached:         24 kB Active:          42816 kB Inactive:         8360 kB HighTotal:           0 kB HighFree:            0 kB LowTotal:        61320 kB LowFree:          2120 kB SwapTotal:      530136 kB SwapFree:       530104 kB Dirty:              20 kB Writeback:           0 kB Mapped:          32932 kB Slab:             5152 kB CommitLimit:    560796 kB Committed_AS:    60888 kB PageTables:        744 kB VmallocTotal:   450560 kB VmallocUsed:       816 kB VmallocChunk:   449724 kB

-bash-3.00# cat /proc/mtd dev:   size   erasesize  name mtd0: 00080000 00010000 "phys_mapped_flash"

Boot info
-bash-3.00# file -sL /dev/sda* /dev/sda: x86 boot sector /dev/sda1: Linux rev 1.0 ext3 filesystem data (needs journal recovery) (large files) /dev/sda2: Linux/i386 swap file (new style) 1 (4K pages) size 132535 pages /dev/sda3: Linux rev 1.0 ext3 filesystem data (needs journal recovery) (large files) /dev/sda4: x86 boot sector, extended partition table /dev/sda5: data /dev/sda6: PPCBoot image /dev/sda7: Linux rev 1.0 ext3 filesystem data

/dev/sda6 contains the boot image?!

/dev/sda7 arranges the booting?!

-bash-3.00# dmesg Linux version 2.6.12.6-arm1-lacie5b (root@lacie) (gcc version 3.4.4 (release) (CodeSourcery ARM 2005q3-2)) #3 Fri Apr 20 11:44:12 EDT 2007 CPU: ARM926EJ-Sid(wb) [41069260] revision 0 (ARMv5TEJ) CPU0: D VIVT write-back cache CPU0: I cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets CPU0: D cache: 32768 bytes, associativity 1, 32 byte lines, 1024 sets Machine: MV-88fxx81 Using UBoot passing parameters structure Sys Clk = 200000000, Tclk = 166666667 Memory policy: ECC disabled, Data cache writeback On node 0 totalpages: 16384 DMA zone: 16384 pages, LIFO batch:7 Normal zone: 0 pages, LIFO batch:1 HighMem zone: 0 pages, LIFO batch:1 Built 1 zonelists Kernel command line: console=ttyS0,115200 root=/dev/sda7 ro PID hash table entries: 512 (order: 9, 8192 bytes) Console: colour dummy device 80x30 Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) Memory: 64MB 0MB 0MB 0MB = 64MB total Memory: 61184KB available (3084K code, 465K data, 104K init) Calibrating delay loop... 266.24 BogoMIPS (lpj=1331200) Mount-cache hash table entries: 512 CPU: Testing write buffer coherency: ok NET: Registered protocol family 16

CPU Interface - SDRAM_CS0 ....base 00000000, size 64MB SDRAM_CS1 ....disable SDRAM_CS2 ....disable SDRAM_CS3 ....disable PEX0_MEM ....base e0000000, size 128MB PEX0_IO ....base f2000000, size  1MB PCI0_MEM ....base e8000000, size 128MB PCI0_IO ....base f2100000, size  1MB INTER_REGS ....base f1000000, size  1MB DEVICE_CS0 ....no such DEVICE_CS1 ....base f4000000, size 16MB DEVICE_CS2 ....no such DEV_BOOCS ....base ff800000, size  8MB CRYPTO ENG ....base f0000000, size 64KB

LaCie EDmini V2 (MV LSP Version 1.10.3.patch2_DB_NAS)-- RD-88F5182-EDMV2 Soc: 88F5182 A2

Detected Tclk 166666667 and SysClk 200000000 Marvell USB EHCI Host controller #0: c045fb00 Marvell USB EHCI Gadget controller #1: c045fa40 pexBarOverlapDetect: winNum 2 overlap current 0 mvPexInit:Warning :Bar 2 size is illigal it will be disabled please check Pex and CPU windows configuration PCI: bus0: Fast back to back transfers enabled PCI: bus1: Fast back to back transfers enabled SCSI subsystem initialized usbcore: registered new driver usbfs usbcore: registered new driver hub Use the XOR engines (offloading) for enhancing the following functions: o RAID 5 Xor calculation o kernel memcpy o kenrel memzero o copy user to/from kernel buffers Number of XOR engines to use: 2 Fast Floating Point Emulator V0.9 (c) Peter Teichmann. inotify device minor=63 Registering unionfs 1.1.5 Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled ttyS0 at MMIO 0x0 (irq = 3) is a 16550A io scheduler noop registered io scheduler anticipatory registered io scheduler deadline registered io scheduler cfq registered loop: loaded (max 8 devices) Marvell Gigabit Ethernet Driver 'egiga': o Ethernet descriptors in DRAM o DRAM SW cache-coherency o Checksum offload enabled o Loading network interface 'eth0' Intergrated Sata device found scsi0 : Marvell SCSI to SATA adapter scsi1 : Marvell SCSI to SATA adapter Vendor: SAMSUNG  Model: HD502JI           Rev: 1AA0 Type:  Direct-Access                      ANSI SCSI revision: 03 SCSI device sda: 976773168 512-byte hdwr sectors (500108 MB) SCSI device sda: drive cache: write back SCSI device sda: 976773168 512-byte hdwr sectors (500108 MB) SCSI device sda: drive cache: write back sda: sda1 sda2 sda3 sda4 Attached scsi disk sda at scsi1, channel 0, id 0, lun 0 Attached scsi generic sg0 at scsi1, channel 0, id 0, lun 0, type 0 physmap flash device: 80000 at ff800000 phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank Amd/Fujitsu Extended Query Table at 0x0040 phys_mapped_flash: CFI does not contain boot bank location. Assuming top. number of CFI chips: 1 cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. cmdlinepart partition parsing not available RedBoot partition parsing not available ehci_platform ehci_platform.4523: EHCI Host Controller ehci_platform ehci_platform.4523: new USB bus registered, assigned bus number 1 ehci_platform ehci_platform.4523: irq 17, io mem 0x00000000 ehci_platform ehci_platform.4523: park 0 ehci_platform ehci_platform.4523: USB 0.0 initialized, EHCI 1.00, driver 10 Dec 2004 hub 1-0:1.0: USB hub found hub 1-0:1.0: 1 port detected ohci_hcd: 2004 Nov 08 USB 1.1 'Open' Host Controller (OHCI) Driver (PCI) usbcore: registered new driver usblp drivers/usb/class/usblp.c: v0.13: USB Printer Device Class driver Initializing USB Mass Storage driver... usbcore: registered new driver usb-storage USB Mass Storage support registered. usbcore: registered new driver usbhid drivers/usb/input/hid-core.c: v2.01:USB HID core driver mice: PS/2 mouse device common for all mice edmini_power 1.0 initialised md: linear personality registered as nr 1 md: raid0 personality registered as nr 2 md: raid1 personality registered as nr 3 md: raid10 personality registered as nr 9 md: md driver 0.90.1 MAX_MD_DEVS=256, MD_SB_DISKS=27 device-mapper: 4.4.0-ioctl (2005-01-12) initialised: dm-devel@redhat.com NET: Registered protocol family 2 IP: routing cache hash table of 512 buckets, 4Kbytes TCP established hash table entries: 4096 (order: 3, 32768 bytes) TCP bind hash table entries: 4096 (order: 2, 16384 bytes) TCP: Hash tables configured (established 4096 bind 4096) ip_conntrack version 2.1 (512 buckets, 4096 max) - 248 bytes per conntrack ip_tables: (C) 2000-2002 Netfilter core team NET: Registered protocol family 1 NET: Registered protocol family 17 NET: Registered protocol family 5 Loading I2C based RTC driver device interface. Found TWSI adapter with id: 0 Found I2C RTC rs5c372 @ 0x32 md: Autodetecting RAID arrays. md: autorun ... md: ... autorun DONE. EXT3-fs: mounted filesystem with ordered data mode. VFS: Mounted root (ext3 filesystem) readonly. Freeing init memory: 104K kjournald starting. Commit interval 5 seconds EXT3-fs: mounted filesystem with ordered data mode. kjournald starting. Commit interval 5 seconds EXT3 FS on sda1, internal journal EXT3-fs warning: checktime reached, running e2fsck is recommended kjournald starting. Commit interval 5 seconds EXT3 FS on sda3, internal journal EXT3-fs: mounted filesystem with ordered data mode. Adding 530136k swap on /dev/sda2. Priority:-1 extents:1 eth0: link down eth0: link up<5>, full duplex<5>, speed 100 Mbps<5> fuse init (API version 7.8) fuse distribution version: 2.6.3 tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky 


 * mt-daapd runs on port 6689, visit <>:6689, log in with default user and default password 'sLPoe243'

Gaining root SSH access
Remove the casing, and connect the harddrive to a Linux pc. Make sure you browse to the partition of about 3.1GB in size. (presumably /dev/sdb1) This is the boot-partition. Somehow, only root can connect through SSH, so we should give the user root a password. This is done in the file /etc/shadow I copied the password from the user I created when first installing the LaCie Internet Space, so I knew that would work. That's it. Hook the drive up again, and now you can connect via SSH: ssh root@

guido@HTPC:~$ ssh root@192.168.2.77 Axentra HipServ version 10.0.x root@192.168.2.77's password:

Gaining root SSH access without removing the casing
Here is short overview of how to gain root access without opening the box. It exploits the fact that mt-daapd allows you to run your own shellscripts as root. It is not a step by step howto, but it works if you follow it.