k3dt

Will be fixed in next Trantor's build. I forgot patch that. You can replace synobios.ko with this file: http://k3dt.eu/synobios-patched3.ko

Of course Need to test /add some SCSI drivers (from drivers request topic) first and I will post new repack.

everything works here..

Here it is: http://k3dt.eu/synobios-patched2.ko can you upload 3810 pat + boot img? THX

Dead? no. I'm running 4.3 files I provided with smallupdates applied. 20 users, 10TB of data, 5 IP cameras, Plex server, all works fine. It CAN be usable. But still waiting for VeNoM's release.

viewtopic.php?p=7033#p7033 ><'

http://xpenology.trantor.be/unstable_4.3.7z http://k3dt.eu/devices-append mount with: mount -t ext2 -o loop,offset=32256 synoboot-4.3-test.img /mnt/ replace zImage with http://xpenology.trantor.be/zImage-4.3b unmount boot.

Its easy. Install Trantor's 4.3 test build (with newer bzImage), then login into ssh and copy /proc/bus/pci into for example /root/pci and append content of my file /root/pci/devices-append to your /root/pci/devices. Then edit /etc/rc and insert mount --rbind /root/pci/ /proc/bus/pci/ after "export HOME PATH". Reboot and it should work.

Here is my working 4.3 virtual with 'mount --rbind' pci-devices fix. Only for testing, but seems everything is working. For production please wait for neXus's /VeNoM's version. Based on Trantor's 4.3 build. Files are updated to 3776-3, boot device isn't. VirtualBox required. Default login is admin/admin. https://mega.co.nz/#!ZtRTGR7K!anlF3ED9L ... gr1mn8I9zw (624.3 MB)

Any idea how apply patch manually? tried dpkg -i *.deb but without success. edit: got it, nevermind.)

Agree. But I'll use 4.3 in production New features are important for me. I will not have problem check updated packages if they are safe before upgrading.

Yep.. it works too! No kernel module required. No modifications. Just mount edited directory(file). https://www.dropbox.com/s/iiln8gdp7gr6h ... .41.23.png

Did someone test mount --rbind command? ( mount --rbind /tmp/pci/ /proc/bus/pci/ ) should do the same.

Congratulations guys! IMO hooking was the best possible (and clean!) solution. Please give required files to Trantor so he can make test build. Can't wait

Do not see any differences. Patching synobios in DSM<4.3 is same piracy as this.

neXus: that was LITTLE tricky part (you need "freeze" the process then kill it with some of coredump-making signals... strace says it fopens synoinfo.conf so...) mv /etc/synoinfo.conf /etc/synoinfo.conf.bak ; mkfifo /etc/synoinfo.conf ; (this is tricky part. you need ipkg and install... coreutils maybe? dont remember) ./storagehandler.cgi (second ssh) ulimit -c unlimited ; kill -SIGABRT DiskStation> ./storagehandler.cgi Aborted (core dumped) find / -name \*core\* And you are done. IDA PRO can open coredump files. Then remove /etc/synoinfo.conf and mv /etc/synoinfo.conf.bak /etc/synoinfo.conf EDIT: here is coredump http://www.k3dt.eu/storagehandler..core.gz

Interesting.. good find neXus. I found this script for IDA: http://hooked-on-mnemonics.blogspot.cz/ ... n-ida.html

Post your results too pls edit; I have only this.. DSM 3.2 CubeStation CS-406 0060 10953512 14 bffff9 bffff5 bfffe9 bfffe5 bfffd1 bffffe00 0 8 4 8 4 10 200 80000 sata_sil 0068 10953512 10 bfffc9 bfffc5 bfffb9 bfffb5 bfffa1 bffffc00 0 8 4 8 4 10 200 80000 sata_sil 0070 10330035 11 bfffe000 0 0 0 0 0 0 1000 0 0 0 0 0 0 ohci_hcd 0071 10330035 11 bfffd000 0 0 0 0 0 0 1000 0 0 0 0 0 0 ohci_hcd 0072 103300e0 11 bfffcf00 0 0 0 0 0 0 100 0 0 0 0 0 0 ehci_hcd 0078 11ab4320 12 bfff8000 bffe01 0 0 0 0 0 4000 100 0 0 0 0 20000 sk98lin

thats should be ok

Another check is in dsmnotify.cgi an its packed/encrypted/protected too..

Can some owner of REAL synology hardware send me "cat /proc/bus/pci/devices" ?

Anybody can look at file "storagehandler.cgi"? File is packed/protected :/ We need to unpack it for analyzing with dissasambler. EDIT: I have core-dumped storagehandler.cgi then: DiskStation> cat /volume1/@storagehandler..core | grep sd libsynosdk.so.4 SLIBSpaceSsdCacheConfCheck ���������E�D�M��L$�$�sd sysdef sd%c support_ssd_cache support_generic_ssd buzzer_ssd_cache_fail update_ssd_support_list strict_ssd_policy umount_ssd /tmp/space/ssd_trimming ssd_trim isSsd ssd_%d %s:%d Fail to get ssd cache size. [0x%04X %s:%d] %s:%d Fail to get ssd cache needed memory. [0x%04X %s:%d] /usr/syno/etc.defaults/dnsdsm /dev/sd* sd_cache sd��: libsynosdk.so.4 /usr/syno/etc.defaults/dnsdsm /dev/sd* /lib/libsynosdk.so.4 libsynosdk.so.4 libsynosdk.so.4 %s --sdk-mod-ver /usr/syno/etc.defaults/dnsdsm /dev/sd* ../sysdeps/unix/sysv/linux/dl-origin.c ../sysdeps/generic/dl-sysdep.c ../sysdeps/unix/sysv/linux/getcwd.c Same interesting strings edit2 got it.. http://www.k3dt.eu/storagehandler_cgi_ida.png (same check is inside libdsm.so and libsynocgi.so) now we need bypass this check against pci/devices OR unpack storagehandler.cgi and patch all files. /usr/syno/etc.defaults/dnsdsm /dev/sd* edit3: yes.. it must check something with /proc/bus/pci/devices DiskStation> grep -rE "/proc/bus/pci/devices|/dev/sd|dnsdsm" /volume1/@storagehandler..core /usr/syno/etc.defaults/dnsdsm /proc/bus/pci/devices /dev/sd* /usr/syno/etc.defaults/dnsdsm /proc/bus/pci/devices /dev/sd* /usr/syno/etc.defaults/dnsdsm /proc/bus/pci/devices /dev/sd* DiskStation> DiskStation> grep -rE "/proc/bus/pci/devices|/dev/sd|dnsdsm" /lib/ /lib/libsynocgi.so:/usr/syno/etc.defaults/dnsdsm /lib/libsynocgi.so:/proc/bus/pci/devices /lib/libsynocgi.so:/dev/sd* /lib/libdsm.so.4:/usr/syno/etc.defaults/dnsdsm /lib/libdsm.so.4:/proc/bus/pci/devices /lib/libdsm.so.4:/dev/sd* /lib/libdsm.so:/usr/syno/etc.defaults/dnsdsm /lib/libdsm.so:/proc/bus/pci/devices /lib/libdsm.so:/dev/sd*

I only need some more free time :/ (too busy at work). It's like looking for a needle in a haystack. Stay tuned. I was curious about "dnsdsm" which contains CA certificate. openssl x509 -text -in /usr/syno/etc.defaults/dnsdsm returns: Certificate: Data: Version: 3 (0x2) Serial Number: 86:3d:37:01:51:85:ea:3c Signature Algorithm: sha1WithRSAEncryption Issuer: C=TW, ST=Taiwan, L=Taipei, O=Synology Inc, OU=SPG Validity Not Before: Jun 11 02:29:56 2013 GMT Not After : Jul 11 02:29:56 2013 GMT Subject: C=TW, ST=Taiwan, L=Taipei, O=Synology Inc, OU=SPG Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): 00:c4:91:4a:1b:cd:d6:6d:b1:c7:2f:12:85:33:8c: 68:56:9d:62:62:ec:29:a7:4a:4d:17:4c:bf:6e:b3: 50:b0:d1:04:ab:f6:aa:1a:0c:ce:e3:c4:43:06:6f: 75:f6:6b:d5:82:ab:73:04:f3:3f:68:f7:c9:66:fc: da:1b:56:c8:ca:1d:e4:a0:1b:4f:10:8a:eb:25:2c: 37:85:b6:0b:59:b4:dc:0f:03:fe:fc:2c:02:19:82: af:aa:ea:ac:12:8e:f8:73:9c:9d:0b:32:4c:66:77: d1:fa:75:95:06:36:d6:02:5f:0b:15:b7:c0:b9:e0: 39:f8:1b:6f:8c:6a:df:e0:d7:bb:97:56:5c:d6:82: cd:90:dc:95:c3:1d:d0:ed:60:21:c0:1a:78:b8:9f: 51:a1:60:9b:03:7f:e5:cb:ab:7d:d4:f5:eb:db:3e: ff:89:1b:f2:b3:5c:4b:90:8c:aa:f5:0d:f5:8d:fc: fc:ee:33:d3:da:fb:52:02:50:9a:d9:c7:0f:93:cf: 3f:c3:49:47:94:a2:80:fb:f8:56:c2:12:0a:d9:65: bb:93:25:73:1f:f6:99:89:8f:ee:2e:4c:f9:2b:40: b4:d2:3d:38:48:29:79:a4:1e:7d:73:63:d4:58:f6: c0:81:f5:b1:c9:c0:79:ed:0b:ec:52:83:b1:c0:fe: 02:d7 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: 0B:9E:30:4B:24:B5:B0:A8:49:BE:A6:EE:14:E4:6D:E4:ED:72:28:A9 X509v3 Authority Key Identifier: keyid:0B:9E:30:4B:24:B5:B0:A8:49:BE:A6:EE:14:E4:6D:E4:ED:72:28:A9 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha1WithRSAEncryption b5:db:dd:79:61:e7:38:28:3d:c2:c6:4a:e0:d6:29:7f:d8:62: 8d:64:83:25:75:5e:a2:6b:c5:09:90:09:ac:f9:26:f1:83:bc: 7d:3d:d2:98:ea:62:45:0e:e1:96:36:27:ea:2d:68:34:ce:0f: 4c:1a:87:81:ad:11:10:1f:05:22:b9:71:d5:d5:92:c6:ce:59: 6d:87:01:70:51:87:b1:d0:6e:9e:d3:e6:4d:78:f0:73:2f:30: 20:2e:f7:a6:24:97:37:c1:6c:2f:63:f9:2a:1d:27:72:5b:11: 14:ea:60:a5:e1:3f:b1:dd:70:be:ac:33:82:d7:89:57:30:9f: ee:83:47:46:15:05:fb:67:92:ca:d1:76:19:ed:55:12:5f:7d: 01:43:f0:c5:8e:ff:fb:88:74:20:d6:75:67:46:97:6d:79:e6: bc:7a:0c:35:3f:71:ef:5c:fb:e4:49:e2:ed:92:14:9b:48:31: 00:0d:39:55:63:d0:93:be:5a:84:44:b0:a9:4b:c6:3e:c1:7b: 43:91:5a:d2:23:da:29:4c:06:fa:15:89:7a:f5:e7:58:df:6b: e1:82:f9:a6:ed:10:eb:b9:77:d6:a5:91:0b:cd:e2:a9:a4:d3: 8c:4b:1a:42:7b:11:0c:f1:d5:04:9a:72:cb:a4:23:67:09:fb: 1c:2b:8d:cc and this is strange.. certificate valid only for 1 month? For what is this good? o_O grep -r "dnsdsm" /lib finds: /lib/libsynocgi.so:/usr/syno/etc.defaults/dnsdsm /lib/libdsm.so.4:/usr/syno/etc.defaults/dnsdsm /lib/libdsm.so:/usr/syno/etc.defaults/dnsdsm /lib/libsynocgi.so.4:/usr/syno/etc.defaults/dnsdsm grep -r "/dev/sd*" /lib finds same files. Thats VERY interesting.. Now analyzing files with IDA PRO.

Problem is in some of shared libraries, so replacing cgi's is not working. We doesnt need emulate anything. Libdsm.so Libsynocgi.so

copy their version to /lib/modules, restart, same issue