User Tools

Site Tools


Part 1. Pre-requisites

  1. Linux OS with x86_64 architecture (we use Ubuntu 12.10)
  2. Additional tools and libraries: git, libc6-i386, ncurses, build-essential archivemount
    sudo apt-get install git libc6-i386 build-essential libncurses5-dev
  3. DSM 4.1 tool chain. It can be downloaded from and unpacked to the /usr/local folder. For XPEnology we use “Intel x86 Linux 3.2.11 (Bromolow)” version of toolchain and its archive file name is gcc420_glibc236_x64_bromolow-GPL.tgz.
  4. Copy of XPEnology linux 3.x kernel source code from
    git clone linux-3.x

Part 2. Kernel compiling

  1. By default we have enabled a lot of different hardware in kernel, but if you need to enable or disable anything else, you can do it by using an interactive menu:
    make ARCH=x86_64 CROSS_COMPILE=/usr/local/x86_64-linux-gnu/bin/x86_64-linux-gnu- menuconfig
  2. Now we can compile our XPEnology kernel:
    make ARCH=x86_64 CROSS_COMPILE=/usr/local/x86_64-linux-gnu/bin/x86_64-linux-gnu- modules
  3. And finally, build the bzImage file:
    make ARCH=x86_64 CROSS_COMPILE=/usr/local/x86_64-linux-gnu/bin/x86_64-linux-gnu- bzImage

    Result will be placed to the “linux-3.x/arch/x86/boot/” folder. When building is done, you must rename “bzImage” to “zImage”

Part 3. Synobios modification

  1. First of all, you need to get a copy of synobios.ko file from rd.gz or hda1.tgz file, both of them are inside of the DSM pat file, which is actually a tar archive.
  2. Let SetMicropId() function return a valid NAS ID
    .text:0000000000002370                                         public SetMicropId
    .text:0000000000002370                         SetMicropId     proc near               ; DATA XREF: .data:synobios_ops_0o
    .text:0000000000002370                         var_18          = qword ptr -18h
    .text:0000000000002370 48 83 EC 18                             sub     rsp, 18h
    .text:0000000000002374 0F B6 15 1D 33 00 00                    movzx   edx, cs:syno_module+8
    .text:000000000000237B 0F B6 05 17 33 00 00                    movzx   eax, cs:syno_module+9
    .text:0000000000002382 48 C7 04 24 00 00 00 00                 mov     [rsp+18h+var_18], 0
    .text:000000000000238A C0 EA 04                                shr     dl, 4
    .text:000000000000238D 83 E0 0F                                and     eax, 0Fh
    .text:0000000000002390 48 C1 E0 04                             shl     rax, 4
    .text:0000000000002394 0F B6 D2                                movzx   edx, dl
    .text:0000000000002397 48 09 D0                                or      rax, rdx
    .text:000000000000239A 04 01                                   add     al, 1
    .text:000000000000239C 74 15                                   jz      short loc_23B3
    .text:000000000000239E 31 D2                                   xor     edx, edx
    .text:00000000000023A0 81 3D F2 32 00 00 FF 00+                cmp     cs:MpId_20729, 0FFh
    .text:00000000000023AA 74 1C                                   jz      short loc_23C8
    .text:00000000000023AC                         loc_23AC:                               ; CODE XREF: 
    .text:00000000000023AC 89 D0                                   mov     eax, edx
    .text:00000000000023AE 48 83 C4 18                             add     rsp, 18h
    .text:00000000000023B2 C3                                      retn
    .text:00000000000023B3                         loc_23B3:                               ; CODE XREF:
    .text:00000000000023B3 48 C7 C7 FE 45 00 00                    mov     rdi, offset aGetMicropFail ; "get microp fail\n"
    .text:00000000000023BA 31 C0                                   xor     eax, eax
    .text:00000000000023BC E8 9B 42 00 00                          call    printk
    .text:00000000000023C1 BA FF FF FF FF                          mov     edx, 0FFFFFFFFh
    .text:00000000000023C6 EB E4                                   jmp     short loc_23AC
    .text:00000000000023C8                         loc_23C8:                               ; CODE XREF:
    .text:00000000000023C8 48 C7 C6 13 46 00 00                    mov     rsi, offset aR  ; "R"
    .text:00000000000023CF 48 89 E2                                mov     rdx, rsp
    .text:00000000000023D2 B9 08 00 00 00                          mov     ecx, 8
    .text:00000000000023D7 48 89 F7                                mov     rdi, rsi
    .text:00000000000023DA E8 81 FE FF FF                          call    ReadUart
    .text:00000000000023DF 85 C0                                   test    eax, eax
    .text:00000000000023E1 BA FF FF FF FF                          mov     edx, 0FFFFFFFFh
    .text:00000000000023E6 75 C4                                   jnz     short loc_23AC
    .text:00000000000023E8 0F BE 04 24                             movsx   eax, byte ptr [rsp+18h+var_18]
    .text:00000000000023EC 31 D2                                   xor     edx, edx
    .text:00000000000023EE 89 05 A8 32 00 00                       mov     cs:MpId_20729, eax
    .text:00000000000023F4 EB B6                                   jmp     short loc_23AC
    .text:00000000000023F4                         SetMicropId     endp

    Code at offset 000023E6 must be changed to

    .text:00000000000023E6 48 31 C0                                xor rax, rax
    .text:00000000000023E9 B0 42                                   mov al, 042h
    .text:00000000000023EB 90                                      nop

    Full list of available NAS ID's is enumerated as SYNO_MICROP_ID and it can be obtained in “linux-3.x/include/linux/synobios.h” file.

  3. Switching off “buzzer stop button pressed” logging message:
    .text:0000000000000395 80 7C 24 17 00                          cmp     [rsp+28h+var_11], 0
    .text:000000000000039A 74 D4                                   jz      short loc_370


    .text:0000000000000395 80 7C 24 17 00                          cmp     [rsp+28h+var_11], 0
    .text:000000000000039A EB D4                                   jmp     short loc_370

Part 4. Building PAT file

For XPEnology project we use DS3612xs firmware from DSM_DS3612xs_2668.pat file, which is, actually, a TAR archive with the following files inside:

checksum.syno    // files' checksums
grub_cksum.syno  // zImage and rd.gz checksums that are used in GRUB
hda1.tgz         // system image
rd.gz            // ram disk image
updater          // WEB version of the installer (instead of Synology Assistent)
VERSION          // DSM version
zImage           // kernel image
  1. First, we need to replace synobios.ko file in RAM disk image. Unpack and mount RAM disk:
    gunzip /tmp/rd.gz
    sudo mount -t ext2 -o loop rd /mnt/ramdisk

    Now we must replace synobios.ko file in the /mnt/ramdisk/lib/modules folder with our previously patched one. Now we must unmount RAM disk and pack it back:

    sudo umount /mnt/ramdisk
    gzip /tmp/rd
  2. Secondly, we will replace synobios.ko file in system image. Mount hda1.tgz with archivemount:
    sudo archivemount /tmp/hda1.tgz /mnt/hdd
  3. Thirdly, we will replace synobios.ko file again in the /mnt/hdd/lib/modules folder with the same patched file and then unmount it:
    sudo umount /mnt/hdd

    Now we need to rename result file /tmp/hda1.tgz to /tmp/hda1 and pack it with XZ:

    xz -z9 /tmp/hda1

    and rename it back to /tmp/hda1.tgz

  4. Finally, we need to recalculate the checksums of updated files. Get a copy of checksum calculator:
    git clone synochecksum

    and compale it by running make. Now copy synochecksum-emu1 file to the folder with unpacked and modified files and recalculate checksum:

    synochecksum-emu1 hda1.tgz rd.gz updater VERSION zImage >checksum.syno

    When it's done, pack files back to TAR archive and rename its extension to pat

en/building_xpenology.txt · Last modified: 2013/02/04 16:41 by makemyday