NAS Forum

Greetings All!

Reference: Forum thread located at how do i unbrick my verbatim soho nas

First:
I have read that thread - and other similar threads, including the French one, thoroughly. Please do not reply with "RTFM!!" as I have already spent almost a week doing just that.
Unfortunately, many of the documents are in German.

Issue:

I have the SmartDisk / Verbatim SOHO NAS referenced in the preevious thread, and I got it working with the patched 2.3.2.03b firmware that I found on the French site located at http://forum.hardware.fr/hfr/Hardware/HD…et_802962_1.htm

I then decided to update to the Tinky version posted there.

Big Mistake!

I found the Tinky version to be unstable and the SSH to be useless as teats on a Boar Hog. So I decided to back-flash to the 2.3.2.03b firmware and now the machine won't completely boot.

The normal boot process - looking at the LED's on my switch - is for it to:

• Come up and activate the Ethernet port briefly (less than a minute) flashing the connection as if it was trying to do something. (probably RedBoot)
  
• Resets the Ethernet connection (It goes dark then comes back again.)
  
• Flashes the connection for a few minutes.
  
• Resets the connection again
  
• Begins flashing the connection again

At this point I can usually ping the device and log-in using the web interface.

What it does now is to activate the Ethernet connection and flash the connection. It never resets, and I have not been able to ping it.

What I suspect happened is that the Tinky update makes changes that the original firmware flash does not undo - especially in the first partition of the HD there is a lot of crap left there. Because of these differences, the machine won't boot probably because there is a config reference somewhere in Firmware that cannot find what it expects.

What I would like to get, if possible:

1. A raw binary copy of the entire contents of the firmware chip, including bootloader.

2. A tar-zip file of the entire contents of the first partition.

If at all possible, I would appreciate it being the 2.3.2.03b firmware. However if I could get a raw copy of the same things from the Tinky release, that would also be good.

This way I can completely restore the box to its pristine condition.

Thanks in advance for any help you can give me.

Jim

UPDATE:

Additional research disclosed (using Wireshark - a definite candidate for my "Hot Smokin' Weapon!" award!) that the furthest the box got was a BOOTP request. Could not even get to RedBoot.


I suspect that - at the very lowest level - the unit has the capability of asking for a boot image via BOOTP, which would then allow a firmware image to be uploaded. I have not tried sending a boot image in response to the BOOTP request. . . . (Hmmmm. . . . I have a 2k8 server with DHCP. . . . maybe I could bootstrap the thing?)

I did find a "firmware.save" file that - apparently - is the firmware from the Tinky update. (apparently I boshed the downgrade severely enough to totally trash the firmware image.)

Since it appears that I have the set of Tinky files on the small partition, I will try to restore the Tinky Firmware. Maybe even by BOOTP bootstrapping? I'll have to snoop the boot firmware image to see if I can see if it takes parameters. . . .

Zitat von »HWguru«

Hi,
with such specific questions you will never get a RTFM here. One can see if a user did some research.

The most important thing is having a serial connection to the board.

Have you tried accessing the bootloader through telnet?
At the Wiki you find a memory map for the flash, too

Regards,
HWguru

Note: Please don't ask for help through private messages, other users may have the same question.
I will move this thread to "Software" as it is not related to "Hardware"

OK, I apologize for the private messages - it appeared (from the threads I read) that you hadn't been around for a while. . . .

Points:

1. The various WIKI pages at NAS2000 appear to be dead. In fact, the entire site appears to have gone up in smoke, so those sources of information are no longer available. Can you suggest alternate sources of this information?
2. The PCB from the SmartDisk/Verbatim SOHO NAS that I have does *NOT* match the various photographs that I see, so the instructions to connect a 100 ohm resistor from this point to that do not help me - these points don't exist on my board.
3. In a previous post, you advised the poster to thread a very tiny wire underneath the STORLINK chip (to pin 17, if I am not mistaken). For me, that will be absolutely impossible - my hands are not nearly steady enough! (It has gotten to the point where I cannot even work on laptops anymore. I shake too much and loose the screws by dropping them on the floor. . . . !!!! )
4. The JTAG port on my PCB is configured for a 20 pin header. My JTAG (an AVR clone) has a 10 pin connector. Do you know of someplace that will tell me which pins to put where?

As you can see from my second post, there is absolutely *nothing* happening except the BOOTP poll on the network. There is nothing happening via Telnet. I tried at least a dozen times, and got absolutely NADA! (as in nada-stinking-thing!) If I could get to that beast via telnet - I'd have had this thing back on line long ago.

I am going to try and dig out my tripod and take pictures of this beast - which I will post. Hopefully this will help you help me.

Thanks!

Jim

p.s. What does "Weizenbier" mean? Many of the German smileys are obvious - like the dude under the palm tree drinking his Margarita! But the "Weizenbier" one has me stumped. . . .

OK.

I took some pictures which I will try to upload.

I apologize for the fuzzy pictures - no, they're not out of focus, this is just my natural tremor - which is why I don't want to go sneaking around in places where microscopes fear to tread! (I could not find the tripod. . .)

Oops! The pictures are too big! (I deliberately took 10 mp pictures so you could zoom in for better detail)

All is not lost! I uploaded them to my account on MediaFire: You can find them here: http://tinyurl.com/soho-nas-pcb

Descriptions:
Pix 1: "Top Side of PCB" - this is a view of the entire top side of the PCB. It is also one of the clearer pictures. You can zoom in and read the chip numbers!
Pix 2: "Top - detail of JTAG chips" - this is a closer view of the area around the JTAG port and it's associated chips. More fuzzy than the first but still readable.
Pix 3: " Bottom of PCB" - this is a picture of the entire bottom side of the PCB - a bit fuzzier than I'd really like to admit to, but it's still readable.
Pix 4: " Bottom - detail of area around JTAG chips" - the components on the back side of the PCB, opposite of the JTAG chips on the top side. This is primarily the cluster of components to the right of the "C50" designation.
Pix 5: "Top - detail showing USB-mini-A connector" - this is a picture that is probably not related to any of this. I noticed a sub-A connector located on one edge of the board, not accessible to the outside, that has my curiosity piqued! I wonder if it's some kind of USB - to - serial setup? This one is also a bit fuzzy - hopefully you can see enough to make sense of it.

Any help would be appreciated.

Thanks!

Jim

Update:

Re: JTAG pinouts.

Some judicious web searches, (I like http://www.dogpile.com - they hit all the search engines, like Google, etc. all from one place.), found a web-site that provides a LOT of information on JTAG, the spec's, etc. Viz.: http://jtagcables.com/jtag-pinout- they have just about any piece of information about JTAG, its standards, quirks, etc.

On their pinout page, I copied the pinouts that appeared to be the most relevant to these discussions:



[edit by JH on 3/1/2011 (US) 1.3.2011 (European) ]
* The original pinout from that site showed pin 7 as "unused" On some JTAG units, most particularly the AVR clone I bought, pin 7 is tied to VSUPPLY.
There is a site that is a fountain of knowledge about the Atmel/AVR JTAG adapter located here (http://aquaticus.info/jtag ) They provide very excellent descriptions of what is going on - and even provide a schematic for a RS232 Serial version and instructions on how to build it. (I am attaching the schematic to this post).

On the "Original Atmel Schematic" - of which this is supposed to be a copy - they also show pin 7 tied to VSUPPLY, so I am assuming that this is the "official" assignment for that pin.



This should provide enough information for anyone who wants to "grow their own" adapter cable.

Note:
I do not know if all the ground-pins must be tied together at the cable end on the various boards this can connect to. You may want to look at your own device's controller board to determine how grounds are set up. If you do need grounds tied together, you may want to cut a small PCB or breadboard the connections.

Examining the SmartDisk / Verbatim SoHo NAS PCB, all the grounds are tied together on the PCB, Please check your own board before making connections to it as Your Mileage May Vary.

Jim

Zitat von »HWguru«

Hi,
the Wiki should be ok again. It has been down for some maintenance.

Absolutely correct! I have finally been able to connect to it. Thanks!

Zitat von »HWguru«

I have some general information for you.

If the bootloader is still alive:
- The bootloader of a SL3316 based system should be possible being reached by telnet
- access with a 3.3V serial adapter is possible always

Like I said before - it does not even get that far. There is no IP address, no polling, nothing but the BOOTP client request on 255.255.255.255. (BOOTP is like DHCP, except it is used to auto-load an operating system to a diskless workstation.)

As far as I can tell, the bootloader is DEAD - except for BOOTP.

Zitat von »HWguru«

JTAG:
Playing around with various adapters will not lead to success.
There is no "standard" way for accessing the CPU and Flash pins through the JTAG interface.
The only way for access is documented at the forum (mainly German) and at the Wiki (English)

Now that I have access to that Wiki, I have found exactly the information I need to get this thing able to talk to a JTAG adapter. Thanks!

Since the bootloader is not responding to anything, telnet, serial, etc. etc. etc. does not work at all, so I will have to figure out a way to manually flash the firmware to bring it back to life.

Zitat von »HWguru«

GND connection:
It depends on the adapter you are using.
If it is of "LPT Wiggler" type and connected through some extension cable you will need more than on GND pin connected at the LPT side.
If the cable is short (15-20cm) one GND connection should be sufficient.

I examined my board and there are a multitude of ground connections available. I can probably tie several back to my JTAG.

Zitat von »HWguru«

is a special kind of beer --> Link to Wikipedia

Interesting! "Wheat beer" is apparently the translation according to Wikipedia. There appear to be some "less bitter" varieties that I might even find drinkable! I'll have to try some, assuming I can find some in the US that doesn't taste like dishwater. I like a Russian beer - Baltica #7 - when I am in Russia. Here in the US, Baltica #7 tastes absolutely TERRIBLE!

Zitat von »HWguru«

Regards,
HWguru

Likewise. I really do appreciate all your help.

Jim

Zitat von »HWguru«

As I know there is not any packet sent by the bootloader
But there is a small time window at boot where you can access the bootloader with telnet.

The easiest way is using Flashstart.
Of course you need to know the standard IP address being used by the bootloader which is fixed.

Note: always disconnect the disk before flashing or using JTAG.

HWguru

Sir,

I have examined this in detail, on an isolated network using Wireshark. This tool lets me see every single packet that goes across the network. My isolated network had two machines on it - the NAS and a Windows computer running Wireshark, so there was no other traffic to confuse things.

It is my humble opinion that the boot loader is trashed beyond even this method of repair - however since I have not used FlashStart, I will try that before going the JTAG route.

The only problem with this method is the "default" address to use. In my investigation, I have seen no less than three-or-four default addresses published. . . . and the Good Lord Jesus only knows which one, if any, are active on this machine at this point in time.

I guess I could go the route of looking them all up, and trying them one-at-a-time.

BTW, I have not only removed the disk, I have taken the PCB completely out of it's case so that I can work on it.

I will try flash-start. If that actually DOES work, that would be much easier than fighting with a JTAG configuration.

Thanks!

Jim

Sir,

I have tried to use ICYBOX Flash Start (v 1.0) on my Windows 7 (amd64) box, and I am having a problem.

I set my computer to an IP address within the subnet defined by the NAS default IP.


I have both devices plugged into a switch that has no other devices on it.


I try to start the Flash Start program and I get a dialog that asks for an IP address, which I fill in.

After that - nothing.

The readme instructions say to put in the IP address you want to try, and "start Flash start" I cannot see anyway to "start" the program. There is no start button on the IP dialog, and the icon in my system tray tells me that "Script Paused" which I do not appear to be able to un-pause.

I have tried running it as an Administrator, but that makes no difference at all. Running it in XP Compatibiltiy mode does not help either.

I have unpacked the flash start tool into it's own directory and am executing it from there.

Any ideas as to what I am doing wrong?

Thanks!

Jim