OpenWrt Forum Archive

Topic: Hacking a Meraki MX60 Security Device

The content of this topic has been archived on 5 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Hi Guy's,

Im just getting into this subject after my Meraki kit subscription ended and that wanted £500 to renew it. So I managed to follow this github.com/riptidewave93/Openwrt-MR24/blob/master/README.md#flashing to gain access boot but I think I have screwed up the flash some how.


=> reset
Unexpected magic number 27051956
recovery volume not found
=> UBI: attached mtd1 to ubi0
UBI: MTD device name:            "mtd=2"
UBI: MTD device size:            1021 MiB
UBI: number of good PEBs:        8174
UBI: number of bad PEBs:         0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     3
UBI: available PEBs:             3663
UBI: total number of reserved PEBs: 4511
UBI: number of PEBs reserved for bad PEB handling: 81
UBI: max/mean erase counter: 184/171
Volume kernel found at volume id 1
read 0 bytes from volume 1 to 800000(buf address)
Read [1786700] bytes
Unexpected magic number 27051956
recovery volume not found
=>

Can anyone give me some pointers where to go with this please!!

=> mtdparts

device nand0 <nand0>, # parts = 3
#: name                size            offset          mask_flags
0: firmware            0x00200000      0x00000000      0
1: panic               0x00040000      0x00200000      0
2: ubi                 0x3fdc0000      0x00240000      0

active partition: nand0,0 - (firmware) 0x00200000 @ 0x00000000

defaults:
mtdids  : none
mtdparts: none

=> ubi info layout
UBI: volume information dump:
UBI: vol_id          0
UBI: reserved_pebs   1
UBI: alignment       1
UBI: data_pad        0
UBI: vol_type        3
UBI: name_len        12
UBI: usable_leb_size 129024
UBI: used_ebs        1
UBI: used_bytes      129024
UBI: last_eb_bytes   129024
UBI: corrupted       0
UBI: upd_marker      0
UBI: name            board-config

UBI: volume information dump:
UBI: vol_id          1
UBI: reserved_pebs   263
UBI: alignment       1
UBI: data_pad        0
UBI: vol_type        4
UBI: name_len        6
UBI: usable_leb_size 129024
UBI: used_ebs        14
UBI: used_bytes      1786700
UBI: last_eb_bytes   109388
UBI: corrupted       0
UBI: upd_marker      0
UBI: name            kernel

UBI: volume information dump:
UBI: vol_id          3
UBI: reserved_pebs   4162
UBI: alignment       1
UBI: data_pad        0
UBI: vol_type        3
UBI: name_len        7
UBI: usable_leb_size 129024
UBI: used_ebs        4162
UBI: used_bytes      536997888
UBI: last_eb_bytes   129024
UBI: corrupted       0
UBI: upd_marker      0
UBI: name            storage

UBI: volume information dump:
UBI: vol_id          2147479551
UBI: reserved_pebs   2
UBI: alignment       1
UBI: data_pad        0
UBI: vol_type        3
UBI: name_len        13
UBI: usable_leb_size 129024
UBI: used_ebs        2
UBI: used_bytes      258048
UBI: last_eb_bytes   2
UBI: corrupted       0
UBI: upd_marker      0
UBI: name            layout volume

=>

The guide you linked was for the Meraki MR24 only as no one has ported the MX60 to OpenWRT/LEDE at this time. Sadly without a copy of the original firmware, at this time there is not much you can do.

Good news though is I have a MX60 enroute that I hope to get ported over to LEDE in the future, but no ETA on when that will be.

Looks like this is the dst for the MX60 board (bluestone) its obviously used for a few devices.

github.com/riptidewave93/meraki-linux/blob/093132b26f2873b4e30a8c58523339ebd90f2b07/arch/powerpc/boot/dts/bluestone.dts

So as I have this is there an idiots guide to building an image for this device? I have access to uboot and tftpboot and bootm seem to work. I can boot from the MR24 image, but I don't get any response from the console after the image is un-compressed seeing a its using the same SoC I was expecting at least this!!. Im probably missing several steps as I don't know what Im doing!

inorfolk wrote:

Looks like this is the dst for the MX60 board (bluestone) its obviously used for a few devices.

github.com/riptidewave93/meraki-linux/blob/093132b26f2873b4e30a8c58523339ebd90f2b07/arch/powerpc/boot/dts/bluestone.dts

So as I have this is there an idiots guide to building an image for this device? I have access to uboot and tftpboot and bootm seem to work. I can boot from the MR24 image, but I don't get any response from the console after the image is un-compressed seeing a its using the same SoC I was expecting at least this!!. Im probably missing several steps as I don't know what Im doing!

Bluestone is what the boards are "based" on, but it is not the correct dts for the boards. For example, the MR24 uses the ikaram.dts file with some changes for the 4.4 kernel.

You are more than welcome to try and start porting the code over into LEDE for this board, but it will require it's own dts with support for the atheros switch. For now, my 2c would be to wait as I should get mine within a week so I can start getting this ported into LEDE.

EDIT: A port has been started, and you can build the firmware and test it from the Repo at https://github.com/riptidewave93/LEDE-MX60

(Last edited by riptide_wave on 4 Nov 2016, 20:27)

Thanks Chris that all worked fine. I can't believe how good this system is. I have more or less all the functionality I had with the MX60. Awesome!

inorfolk wrote:

Thanks Chris that all worked fine. I can't believe how good this system is. I have more or less all the functionality I had with the MX60. Awesome!

Glad to hear! smile As for the device, I will post images every now and then to https://github.com/riptidewave93/LEDE-MX60/releases until this code gets merged upstream into LEDE, which should be soonish.

EDIT: Code has been merged into LEDE!

(Last edited by riptide_wave on 22 Nov 2016, 08:52)

The discussion might have continued from here.