Hack a Snap Sever 1000?

[scottz]

When you do try a larger drive on your 4100, you might see a warning listed in "info log -T" about 48bit LBA's not being supported. If so, then the counter is always 0 and your stuck.

After going through the Flash code in the .sup files and every IC and connector on the board, my only WAG at this point is that by switching the model number to fake out the OS will there be a chance that 48bit LBA would be supported.

The 4100's can boot with no drives attached and get into the debug screen.
You can go to the regular admin page if you don't require language packs.

The earlier models do have the OS on the drive and switching model numbers makes the boot look for it there.

You can still get in to the debug screen, just the error "psuedo flash not found" will be in the log and it won't see any drives.

Why I hope to get the first 64Meg (32 is probably all you need) of another model that has the OS on the drive to prove it.

[re3dyb0y]

I can't get digital dolly to preform a raw clone on the drive. Has anyone else any ideas?

For the cracked raid, try unmounting all drives.

[re3dyb0y]

Command: wdir /0/os_private/Java

Directory /0/os_private/Java
:hash.qdl

Command: wdir /2/os_private/Java

Directory /2/os_private/Java
Jeode/ snapex.jar :hash.qdl

The md works, but it wont install onto it with just that drive on it. The mv function comes back code 56 (and so does the md if used again) remove files with rd. mv /2/os_private/Java /0/os_private/Java used after rd comes up with error 76. I then tried stopping the java, it still comes up with error 76 when mv /2/os_private/Java /0/os_private/Java is used.

Any ideas? I will try putting on my image when i manage to make one.!!

[scottz]

Try making the directory through debug and then the usual install through the web update or assist.

Mine is torn apart right now, but when I installed a fresh drive, the OS set it up and the Java directory existed with nothing in it. I hadn't installed it yet.

I will try later this week (I'm heading out of town for a few days) to delete the Java directory and try the install to see if I'm getting the same error.

I was using a freebsd mini-inst (minimal install) on another box to clone the drive using dd.
I then ftp'd it over to another box for safe keeping.

I used freebsd in the hopes of being able to mount the filesystems, but ran into compatibility issues with with the 4100 drive not being a standard setup.
I hex/ascii dumped the drive though to go through it, but that's another story.

Have you tried the ghost setup for cloning the drive?

[meister_sd]

OK, I now have my "Cracked Mirror" error fixed. I did what poogle_uk told me, but there were a few more steps I needed to take.

1) Remove the second HD - Just work with the single primary drive.
2) In debug, type: 'config devices info' - write down the "Logical Device" that shows the "Cracked" error. Mine was 50000
3) In debug, type: 'config devices unmount all'
4) THEN I had to type: 'config devices config individual 50000 force' (Where 50000 was mine, your's might be different)
5) Last, I rebooted from debug typing: 'reboot'

After that it took not too much longer than normal to boot, but a few extra seconds. But in the main home page, I still have the "lost" shares, but my disks aren't mirrored or showing errors.

Next, I'm going to try Digital Dolly or Ghost and mirror the main drive to another and see if that works.....

[meister_sd]

Alright. I got it! I've fixed my 2200. I'll document it out so others can follow it,
but the basics are what I wrote in my last post. Then I used Digital Dolly (The .ISO, not Dolly that is booted from a floppy) and copied the boot section, then the data section. I stopped after receiving errors (about 20 min) because that was the part of my main HD going bad. I put the new HD (200 gig Seagate) that had the imaging on it, and it worked. I had to reformat it, but then after that - no errors! I had to repartition the data area, documented in a previous post. Then I mirrored it to the other 200 gig I have. I'll get the details on here in a day or two. But I couldn't do it without the help of this forum! Especially Poogles_UK and his documented efforts in his last few posts.

Thanks to all of you!

PS. The next task - getting a proper image made that can be put on CD/DVD.

[dvscreen]

Has anyone noticed that the .sup files provided by Snap are text files of some kind of Intel Hex dump (starting with colon ?

Can they be used to rebuilt an image without assist?

I have a Snap 1000 that is drive-less and I would like to use it some day and I can't find an image for it.

[dvscreen]

Ok, got a bit further.

The .SUP file (support files) are some kind of uncompressed archives. Assist uses them to upload to the Snap Server. I have looked at .SUP files for SnapOS V3 and V4.

The files contains 3 areas:

1. Hex dump of binary files .HEX
2. Resource files .RES
3. HTML files (.HTML, .CSS, and .GIF)

The hex section contains one binary file for each model of Snap Server:
MOAI110.HEX
MOAI200.HEX
MOAI300.HEX
MOAI20X.HEX
MOAI400.HEX

Those are Intel HEX records and the clue is that they begin with a colon. There are four types of records, but only 3 are used here. Here's how each row is decoded:

:nnaaaattdddddddddddddddddddddddddddddd ... cc

Where:
- nn is the record-length field that represents the number of data bytes (dd) in the record.

- aaaa is the address field that represents the starting address for subsequent data in the record.

- tt is the field that represents the HEX record type, which may be one of the following:
00 - data record
01 - end-of-file record
02 - extended segment address record
04 - extended linear address record

- dd is a data field that represents one byte of data. A record may have multiple data bytes. The number of data bytes in the record must match the number specified by the ll field.

- cc is the checksum field that represents the checksum of the record. The checksum is calculated by summing the values of all hexadecimal digit pairs in the record modulo 256 and taking the two's complement.

Example: in the SnapOS v3 file, the first two lines are:

:02 0000 04 0004 F6
:nn aaaa tt dddd cc

0x02 + 0x00 + 0x00 + 0x04 + 0x00 + 0x04 = 0x0A
0x100 - 0x0A = F6 (ok)

:20 0000 00 2600B0C1870070912D00FF0770892D001800FFFFFFFF300010 00236B10006092 84
:nn aaaa tt dddddddddddddddddddddddddddddddddddddddddddddddddd dddddddddddddd cc

0x20 + 0x00 + 0x00 + 0x00 + 0x26 + 0x00 + 0xB0 + 0xC1 + 0x87 + 0x00 + 0x70 + 0x91 + 0x2D + 0x00 + 0xFF + 0x07 + 0x70 + 0x89 + 0x2D + 0x00 + 0x18 + 0x00 + 0xFF + 0xFF + 0xFF + 0xFF + 0x30 + 0x00 + 0x10 + 0x00 + 0x23 + 0x6B + 0x10 + 0x00 + 0x60 + 0x92 = 0xB7C

0x100 - 0x7C = 0x84 (ok)

Note: you can cut and paste the equation (before the =) in Google if you don't have a Hex calculator.

The records used are:
- 1 Type 04 record (address).
- 2048 Type 00 records (data).
(this sequence of two is repeated repeated 25 to 30 times)
- 1 Type 01 record (EOF) with data.

This file is quite small, around 1.7 MB once converted to binary.

I can not read any ASCII text after converting the dump to a binary. However, I don't believe these are from compressed files because they are padded with hundreds zeroes. The last character, after the zeroes, is 0xEB.

Then the resource files are:
UK\Snap_00_UK.Res
Fr\Snap_00_Fr.Res
Ge\Snap_00_Ge.Res
Sp\Snap_00_Sp.Res

There is no US file, so the resource must be contained in the .RES files. I can read ASCII text in these files, but some binary data is also present. It must be possible to compare the .RES to the .HEX to find if any binary shit has been used to hide the OS in the .HEX file.

Finally, the html files follow:
US\AccessGuideFolderSend.html
US\AccessGuideDriveSend.html
US\AccessGuideMenu.html
etc.

Some .GIFs are present and a single .CSS file.

Conclusions:
1. Most of the OS must be in the .HEX files and that's where we need to investigate.
2. The .CSS could be easily modified and uploaded to customize the look of the server.
3. Same is true with the .HTML files to change the layout and the functions.
4. There must be a reason why the .HEX files are not in plain binary. Possible clues are: the need to hide the OS, the need to upload the data to the Snap Server in a special way.
5. My findings supports other poster's observations that one .SUP file contains all server models and all supported languages.

Requests:
1. I would need an ISO file from a Snap 1000 or 1100 to go any further. Mine is toasted, and that is why I am doing this work. I would love to run the SnapOS on a regular PC.
2. Has anyone found information about hardware? I know it revolves around an embedded x86 compatible "PC on a chip" and that has a built-in video card. It would be great to put Linux on it and to attach monitor.

[re3dyb0y]

One request for newbies. Please do not email me regarding images, as as i have said, i have not got one.

Try making the directory through debug and then the usual install through the web update or assist.

Thats what i did, i will try removing the drive, reformatting it (not on the snap) and start fresh. I have tried reformatting it while its in with no luck. i will try running it after removal of files by itself in the snap server.

meister_sd i cant even get the image to be made, it takes 10 secs, and there is no image. Some detailed instructions would help please.

Thanks to dvscreen for all this info.. Could you do the same for the java one please?

[re3dyb0y]

The files being .sup is partly to do with it being an intel cpu i think.

[re3dyb0y]

dvscreen - How did you decompile the .sup files? What hex editor did you use? Hardware info. Most (or all i think) are an Intel CPU. I know my 2200 has a amd flash chip on it.

To Bill (or someone whos got it) - Can you send me the other update file for the 4x00 please?

[re3dyb0y]

Can anyone else get onto bills ftp site?

DOWN

[misterbill]

I'm sorry if anyone is having trouble with that ftp site.
I am copying everything people have sent me to another one that we can all use.
It is ftp://*********
user name: ****
password: ****

Thanks,
Bill

Site DOWN

[re3dyb0y]

Much better!!

[re3dyb0y]

Can someone put the 4x00 snap os onto the file server?

[arpsh]

Originally Posted by poogles_uk

Can someone put the 4x00 snap os onto the file server?

I've tried to upload the sup file (zipped) but the server keeps timing me out ...

[scottz]

Nice to see someone is thinking along the same line.
I went through the same manuvers last month but had to give up on it due to time.

What I found:

It looks like after the .SUP file is uploaded it is broken out by the SnapOS upgrade process.

If you look at the end of the .sup file you will find html code for minimal help screens. So there are sections to the .sup file that the upgrade process knows how to break out.

From what I found, the .HEX file seems to be either:

1) a Patch (not a full image) for the current BIOS/OS and isn't in a contigious format.

2) a compressed image.

3) Combination of both.

With the padded 0's being there, it could be a section that isn't being used, OR what I'm guessing is that these are sections that is used for saving settings when you switch off the power (i.e. you need some room in flash to store IP address, disk shares, passwords, etc) so you don't want to put code there. They could be ignored by the upgrade utility, but are there for continuity.

I started going through some of the PC BIOS and Flash utils/hacks to see if there is any related format that has a similar process and can give us a clue as to how this one maybe setup. I did find a case where a flash was upgraded with a .HEX file where the data was compressed and then decompressed on the fly during the upgrade process, so one theory is there.

The E28F016S5 Intel Chip is a 16Mbit (2MB) Flash Memory though, so I'm leaning towards it being a compressed image that decompresses on boot. Gives more room for the modified BSD OS to to fit in memory rather than disk.

Again, on the 4100 the majority of the OS lives on the Flash rather than disk.
You can boot up a 4100 with no disks installed and it will function.
Java and help/language files live on the disks, but it doesn't need them to operate.

If I could get my hands on a boot partition from a system that has it's OS on the drives, then I could do some comparisons to how the 4100 is broken out and how to modify it.

Scott

[rami]

Originally Posted by poogles_uk

Can someone put the 4x00 snap os onto the file server?

i have a server with a 100mb port, hope that makes people happier.

it will take me a while to upload (30k/s upload from home)

i'll also make an area people can upload to, i'll put a 300mb limit on the upload directory but i have 4tb of space thanks to these snap servers

i'll post login info soon

[rami]

user:XXXX
password:XXXX
site: XXXXX

Edit - Joe : Because of Adaptecs request, please contact the owner of this post if you have any questions regarding this.

if there are files you wish to share with others, please upload them to the upload directory

[re3dyb0y]

I can't get onto it.

How can i clear the files from my new hard drive and start again? So it has to be reinit again?

[rami]

Originally Posted by poogles_uk

I can't get onto it.

How can i clear the files from my new hard drive and start again? So it has to be reinit again?

if you run the reinit command again it will clear the files from the drive next time you restart the snap

[re3dyb0y]

is it reinit then the drive id?

Rami, can you write down the exact address and username and password for the files.

Tahnks


Sam

[rami]

Originally Posted by poogles_uk

I can't get onto it.

Edit - Joe : Because of Adaptecs request, please contact the owner of this post if you have any questions regarding this.


if you want to use an IE link try these,

xxxxxxxxxxx

and ftp (can upload in upload directory)

username: xxxxxxx
Password: xxxxx
Site Name: xxxxxxx

dont use your web browser to ftp, please use an ftp client

[rami]

Originally Posted by poogles_uk

is it reinit then the drive id?
Sam

config devices format 10000 /reinit

if your drive's id is 10000 (it is on 4100's)

on my 1000 and 1100's its 10000 and 10006 (for the 2 drive channels)
on my 2200's its 10006 and 10016

i only checked one of each drive, i'll look later if this applies to all my units

[re3dyb0y]

Ok Thanks

You have most of the Snap Files so far..