Under The Covers
Figure 19 shows the main board of the G600. In the photo, it's a bit hard to see, but the main processor for the unit is provided by Intel's IXP420 Network Processor; the IDE controller is provided by Acard; and a VIA Vectro VT6212 provides the USB support and the Gigabit network controller. For the wireless capabilities, a mini-PCI card (shown pulled away from its socket) is used with an Atheros AR5004X chipset.
Figure 19: DSM-G600 Main Board
(click image to enlarge)
It was fairly easy to determine that the G600 was running Linux internally. A network port scan identified it as running a Linux kernel based on either version 2.4 or 2.5. A Telnet connection to the UPnP port revealed the following string:
SERVER: Linux/2.4.27-uc1, UPnP/1.0, Intel SDK for UPnP devices /1.2
Examining a firmware image revealed a "tarred" collection of Linux binaries, including a kernel and a couple of disk images. After untarring the firmware file and then unzipping the root image within, I mounted the root disk image on a Linux box and was able to rummage around.
I found a typical set of embedded ARM architecture Linux executables, including busybox and Samba. Digging a bit deeper, I found the html directory, where I noticed a number of pages, including user creation, group creation and email logging that weren't available from any of the G600 menus.
When I called up the previously hidden user creation page from my browser, I wasn't able to successfully create a user, so it didn't appear to be functional (see Figure 20). However, I was able to make use of the email-logging page and successfully set it up to periodically send me email status messages.
Figure 20: Hidden User Creation page
As I was looking at the firmware image, I noticed a cramfs disk image being used for the "/usr" partition. I didn't have a cramfs driver handy, but I wanted to see what was in it. I suppose I could have gone out looking for a driver, but I decided to take the lazy man's approach - don't try this at home, kids! I created and uploaded a new firmware that gave me a listing of the /usr directory. The approach I took was to find a suitable executable script in the root disk image where I could add my own code.
The file I settled on was the Samba startup script. When this runs, the hard drive should already be mounted, so I could add code to give me a directory listing with the output redirected to the hard drive. Then it was just a matter of adding the command "ls -lR /usr > /home/UpnpAV/log" to the script. Once this was done, I reversed the steps I had previously taken to unpack the firmware, and created my new version. (Manufacturers often add a propriety checksum algorithm to the firmware image, but D-Link had not; it was just a straight tar file.) After I recreated the tar file, it was just a matter of using the standard firmware upgrade steps to load my new image.
As I did the final upgrade reboot, I worried that I had messed something up and I would end up with a destroyed box, but the blinking of the lights looked normal and it came up! I screwed up my command the first time (and the second), putting it in the wrong place, but eventually I got it right and finally found a "log" file in my network directory containing a listing of the "/usr" directory. There was not much new of interest in the directory, however; it was mostly just a standard assortment of embedded busybox commands. I had hoped to find a telnet or ssh daemon, but no such luck.
While I was at it, I changed my approach a bit; instead of executing a single command in the Samba startup script, I added a command to execute a script from the hard drive. Once I had done this, I could easily add my own commands to see which processes were running, look at memory usage, examine the system logs, etc. Every time the box booted, my commands would be executed.
I learned a few things from this approach. The G600 runs NFS, but it is not fully configured, so it can't be used. The box has 64 MB of RAM, which is a bit more than comparable boxes I've worked with. A tftp process is run at boot-time. I didn't have time to see what it was being used for, but typically tftp is used to upload new firmware. My approach of executing a hard drive script could open up a lot of possibilities for adding functionality to the device. I also noticed that the NSLU2 developers group has taken notice of the G600 as well, so maybe it will get really opened up.
Since the device is running Linux and other GPL licensed software, D-Link should be providing source code for the GPL licensed code. A quick review of D-Link's GPL ftp download site showed source code for both the Linux kernel and Samba, but not for Busybox. Hopefully this is just an oversight that will be corrected soon.