Replacing a flash chip on the firewall - Page 1
Forum section: electronics / repair

author: OldFox
author_rank: Contributor
timestamp: February 08, 2021, 11:08:04 am
content: Hi all!I've two Zyxel USG110 firewalls. One of them has recently died after the firmware upgrade - it doesn't boot anymore, so I attached the console cable to see what's going on. From the logs I can see that it has problems with mounting the partition and it reboots after the "kernel panic" error. Reloading the firmware didn't help. My prediction was that the flash chip was bad, so I took the thing apart.I've located the flash chip, which is soldered to a seperate PCB module together with the flash controller. The module can be easily removed so I tried to replace it with the one from my other firewall device, which still works and it worked without problems!I've easily removed old flash chip from the PCB module using the hot air gun and ordered a replacement flash chip Samsung K9F4G08U0D-SCB0.I don't have much experiences with Flash chips, so my question here is:will it work if I just simply replace old flash chip with the new one (assuming that flash controller is ok)? Will the flash controller self-initialize the new flash chip or do I have to program it before I solder it on the flash PCB board?If I need to program it, then I probably need a NAND Flash programmer and read the content of the flash from the working module and write it to the new flash chip. Would that work?p.s. The device is out of warranty, so I have nothing to lose. I've tried my luck with Zyxel support and they don't offer a spare flash PCB or repair.TODO LISTCurrent status:-DONE: waiting for new flash chip to arrive-DONE: desolder bad flash chip from PCB module-IN PROGRESS: solder a new flash chip to PCB module (out of solder wire, waiting for new one to arrive)-DONE: try to attach an USB-Connector from the PC-ATX mainboard to the firewall and use an usb flash drive instead of PCB flash module: boot is stuck at "Recovering partition" (tried ext2, ext3 partition type)-DONE: prepare a USB A to duPont pin adaptor cable-DONE: try to read image from the working PCB module using USB A to duPont cable (determine partition type, ...):Successfully cloned image from working eUSB flash module-IN PROGRESS: try to boot from an usb flash drive with cloned image. Try to fake(clone) the Vendor ID (VID) and Product ID (PID) of the USB stick-TBD: try to add power switch to the PCB module, then boot firewall with the good module and hot-swap module with the bad one-TBD: if fixing old module fails, try to use a replacement eUSB module (e.g.https://www.swissbit.com/de/usb-produkte/).

author: Ian.M
author_rank: Super Contributor
timestamp: February 08, 2021, 11:54:51 am
content: The Phison PS2251-50-F appears to be a USB interface flash controller., usually used in USB thumb drives. There's a little bit of data here:http://www.rflashdata.com/uploadfile/2011/1117/UP19-PS2251%20datasheet.pdfwhich should be sufficient for you to trace the pinout to the female header so you can butcher a USB cable to make a USB A to duPont pin adaptor cable.It may be sufficient to image the good drive with a raw disk imaging utility, but you may need a Phison OEM utility to initialise and defect map the new FLASH chip. There's a page of Phison utilites here:http://usb-fix.blogspot.com/p/phison.htmlI haven't used any oif them so YMMV.

author: OldFox
author_rank: Contributor
timestamp: February 08, 2021, 05:14:47 pm
content: Quote from: Ian.M on February 08, 2021, 11:54:51 amGreat, thanks for the info! So basically I could connect that PCB module to USB and use it like a USB Flash drive?I'll definitely try my luck with a USB A to duPont pin adaptor cable.Does that also mean that I could simply connect the USB flash drive to that firewall flash connector (with the USB to duPont cable) and use it instead of the original flash PCB?Flash is probably only used for storing firewall logs and firmware.

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 08, 2021, 05:28:43 pm
content: Aren't the USB 2.0 connectors of a normal PC ATX mainbaoard using a 2x5pin 2mm pitch connector? Maybe you don't even need a adapter.Edit: But you should first check if the pinout match!

author: aqibi2000
author_rank: Regular Contributor
timestamp: February 08, 2021, 05:33:56 pm
content: Use a programmer

author: Ian.M
author_rank: Super Contributor
timestamp: February 08, 2021, 05:53:28 pm
content: Quote from: OldFox on February 08, 2021, 05:14:47 pmOnce you've got the replacement FLASH chip, there's little risk in hooking up the rebuilt module to a PC. Once you are satisfied it works as a mass storage device, you can risk imaging the good module, preferably under Linux to avoid Windows' unpleasant tendency to write stuff to filesystems it doesn't really understand.Re: Thumbdrive substitution in the router: Maybe, maybe not. It very much depends on if the host firmware is looking for a specific mass storage device, or if those extra pins on the connector are anything except power, ground and n/c.

author: OldFox
author_rank: Contributor
timestamp: February 08, 2021, 07:21:14 pm
content: Quote from: Twoflower on February 08, 2021, 05:28:43 pmNo idea. I'll check the pinout.Quote from: aqibi2000 on February 08, 2021, 05:33:56 pmI'll try with the USB to duPont cable first. If that fails, which programmer do you suggest?Quote from: Ian.M on February 08, 2021, 05:53:28 pmNew flash chips (I bought more than 1, just in case something goes wrong) are on the way - will probably get them tomorrow.I'll be back to you once I prepare everything I need (solder new flash chip on the PCB, prepare USB to duPont cable, study that pinout). Thanks a lot for your help guys

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 08, 2021, 07:26:49 pm
content: That memory module really looks like an USB flash module (e.g.https://www.swissbit.com/de/usb-produkte/). So there's a good chance that this will be compatible to access via a normal PC.

author: OldFox
author_rank: Contributor
timestamp: February 08, 2021, 07:37:07 pm
content: Quote from: Twoflower on February 08, 2021, 07:26:49 pmWoow, great find! I tought that the PCB module with flash and controller is custom PCB from Zyxel. But that U-110 module from the link you provided looks just like the one on my photo.

author: OldFox
author_rank: Contributor
timestamp: February 10, 2021, 06:38:31 pm
content: Ok little update:I've traced the pinout. It looks like only 4 pins are connected to the controller chip.Next step is to solder a new flash chip and try to connect module to the computer USB

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 10, 2021, 07:03:30 pm
content: That only 4 pins are assigned is normal as the 10-pin header provide 2x USB 2.0: (https://doc.xdevs.com/doc/_PC_HW/Form_factors/fpio_design_guideline.pdf; Page 21).I would say: That module is compatible to the USB-Connectors you'll find on a normal PC-ATX mainboard.

author: fzabkar
author_rank: Super Contributor
timestamp: February 10, 2021, 07:36:41 pm
content: I would have thought that the next step would be to try a regular USB flash drive, with a suitable cable.

author: OldFox
author_rank: Contributor
timestamp: February 10, 2021, 07:45:29 pm
content: Quote from: Twoflower on February 10, 2021, 07:03:30 pmSo I could simply attach it to the mainboard connector. I'll check my old PC to see if I've one of those connectors available.Otherwise I already have a USB A to duPont pin adaptor cable prepared.Quote from: fzabkar on February 10, 2021, 07:36:41 pmDid you mean that I should try to attach an USB flash drive directly to that usb connector of firewall (instead of that flash module)?

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 10, 2021, 07:57:56 pm
content: Yes, I would think so. The 10-Pin or sometimes 9-Pin as one is used for preventing to plug it in the wrong way is standarized. Otherwise you can't connect the mainboard** to the front-side USB connectors most of the PC-Cases have. So if you have a reasonable modern PC you might find at least one of the USB connectors. Depending on the board often two or three connectors. And if you don't have many USB-Ports and memory card readers in your Desktop PC you might even find one unused.**Some mainboards from Dell, Lenovo, Fujitsu... might be an exception as they sometimes use non standard connectors.

author: fzabkar
author_rank: Super Contributor
timestamp: February 10, 2021, 08:48:30 pm
content: Use something like this:https://ae01.alicdn.com/kf/HTB1APEKSpXXXXbhXpXXq6xXFXXXy/6-pcs-PCI-C-bles-9pin-USB2-0-Connecteur-Carte-M-re-USB-Extension-C-ble.jpghttps://ae01.alicdn.com/kf/HTB14QP_SpXXXXakapXXq6xXFXXXR/6-pcs-PCI-C-bles-9pin-USB2-0-Connecteur-Carte-M-re-USB-Extension-C-ble.jpgThen plug a regular USB flash drive into it.

author: OldFox
author_rank: Contributor
timestamp: February 11, 2021, 08:40:22 am
content: Quote from: fzabkar on February 10, 2021, 08:48:30 pmI didn't find time to solder a new flash chip on the module yet, BUT...I've tried with the cable and USB flash drive, like you suggested, and it actually detects the USB drive - usb drive blinks and the console message on the firewall is different:But I'm not sure which partition type should I use.Startup process is stuck at "Recovering partition ...".Maybe I should remove that flash module from the working Firewall and try to attach it to the computer using USB A to duPont pin adaptor cable to check the partition type, and maybe clone the contents of that flash?I'll have probably the same situation when I try to boot using that original module with replaced flash.

author: perieanuo
author_rank: Frequent Contributor
timestamp: February 11, 2021, 10:07:45 am
content: well, you have much simplier solutionidentify your VCC for your module and add a switch (cut some track or whatever get this done) on both modulesstart the router with the good module, cut power to the module, insert the other one (the bad one), switch this one 'on' (with his new attached power switch) and start updating or play in terminal with the bad flashcosts you 2 switches or just lumpers or just some wiresit's kinda risky ...that's in case you avoid the correct way, reading the good one and reprogramming the bad one with a serious flash programmer

author: Ian.M
author_rank: Super Contributor
timestamp: February 11, 2021, 10:14:33 am
content: That's high risk compared to simply cloning the USB mass storage device the module presents as. Also it quite likely that the router only mounts USB devices at boot as its expecting it to be non-removable.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: February 11, 2021, 12:44:46 pm
content: One thought. Looking at those messages, I suspect the Kernel is checking for an EXT2/3/4 partition.As inhttps://linux.die.net/man/8/mke2fsCreate an EXT2 or 3 partition on a blank USB drive and see if the boot sequence likes that.I suspect the kernel does not need a 'sexy' NAND partition type (like UBI), as the NAND chip is hidden away on the USB bus.Do you have a copy of the boot log, as this may give clues as to what is being loaded?

author: OldFox
author_rank: Contributor
timestamp: February 11, 2021, 12:47:47 pm
content: Quote from: Syntax Error on February 11, 2021, 12:44:46 pmThanks, I'll try.Well I've access to the working firewall. Will try to find the boot log location, maybe it will reveal some clues.

author: perieanuo
author_rank: Frequent Contributor
timestamp: February 11, 2021, 03:04:07 pm
content: Quote from: Ian.M on February 11, 2021, 10:14:33 amyes, it's a little risk, but the router won't see device as removable if you cut power and restore it to flash controller. I tested once on some devicethe only risk is on interface comm signals, but those things are well made, I never saw one fried by taking it off with voltages applied, but I saw some with dead firmwares from toying with him, took me 1/2 day to restore oneafter looking at module (http://www.rflashdata.com/uploadfile/2011/1117/UP19-PS2251%20datasheet.pdf) , if you cut power is similar to ejecting a usb stick from computer, where power is cut first cause the power pad V+ is shorter, so there's almost zero risk. in fact, zero[edit 2]in fact, if on comm lines you add 2x100ohm resistors, my sugestion is bulletproof

author: OldFox
author_rank: Contributor
timestamp: February 11, 2021, 03:33:14 pm
content: Quote from: OldFox on February 11, 2021, 12:47:47 pmActually if I log into the firewall using SSH I don’t get the linux shell, but some kind of Zyxel console which has its own list of commands.Anyway, I checked the system log in web interface and found some traces about EXT3, example:“EXT3-fs (sda10): mounted filesystem with writeback data mode”So filesystem is probably EXT3. I’ve formatted the usb drive to EXT3, but it didn’t help. It’s stuck at “recovering partition …”.Quote from: perieanuo on February 11, 2021, 03:04:07 pmWill try this, if the “USB A to duPont pin adaptor cable” method fails.Currently I’m in process of soldering that new flash module to the controller PCB.But guess what, I ran out of solder wire. Actually I have another solder wire (left on the pic) which is a real nightmare compared to the old one (right on the pic).Any suggestions which solder wire is the best for this job (soldering flash chip) ?

author: perieanuo
author_rank: Frequent Contributor
timestamp: February 11, 2021, 03:36:03 pm
content: see my latest edit if you want you can also add on data lines 100R resistor, the risc becomes zero even if you extract the module 'live'

author: Ian.M
author_rank: Super Contributor
timestamp: February 11, 2021, 05:31:49 pm
content: Anything with 'Water Washable' flux is setting yourself up for failure unless you have the correct equipment to clean thoroughly under ICs etc. The residue is typically hygroscopic and highly corrosive, and it only takes one droplet remaining sitting over a via within the footprint to result in failure months pr even years later. At the very least you want a medium pressure jet of hot water + an appropriate surfactant, to get enough flow *UNDER* chips to remove the residue effectively.

author: Haenk
author_rank: Super Contributor
timestamp: February 11, 2021, 05:44:39 pm
content: You could check the partition structure with most Linux install discs; starting the partition manager (parted or similar) should show the the partition table; note it down (! don't write to disk !), create the same partitions on the replacement...

author: OldFox
author_rank: Contributor
timestamp: February 12, 2021, 09:20:05 am
content: I've updated my first post with the TODO listQuote from: Ian.M on February 11, 2021, 05:31:49 pmAhh, I've already ordered a new solder wire. Now I have to somehow clean that solder from the new flash chip. legs are bricked all over. Desoldering wire doesn't help... that solder just doesn't stick to itis there any other good method to clean that solder off the legs?

author: CJay
author_rank: Super Contributor
timestamp: February 12, 2021, 10:36:10 am
content: Add a bit of liquid flux to your desoldering braid

author: drussell
author_rank: Super Contributor
timestamp: February 12, 2021, 10:57:12 am
content: Quote from: OldFox on February 11, 2021, 08:40:22 amYeah, the necessity ofdding the currently working drive onto the external USB stick (or repaired module) would be my first thought.Are you even sure that the flash chip in the original is actually bad somehow and didn't just get corrupted? I would have tried zeroing out the "bad" one and reading it back, then copy the good one onto the misbehaving one if it was still physically working corrctly.QuoteIndeed.QuoteWell, the system is probably not expecting it to be blank, so it can't "fix itself" and boot.

author: OldFox
author_rank: Contributor
timestamp: February 12, 2021, 11:06:36 am
content: Quote from: drussell on February 12, 2021, 10:57:12 amTotally agree with you.Problem is, that I've already desoldered the old flash chipMy bad. However I'm currently out of soldering wire so I'll continue with flash soldering process next week, when I get new soldering wireI'll attach that working module to the comp latter today and will post results (fingers crossed).

author: OldFox
author_rank: Contributor
timestamp: February 12, 2021, 04:54:04 pm
content: Little update.I've successfully cloned the flash content from working flash module using USB A to duPont cableFor creating an image I've used command: dd if=/dev/sdb of=/home/luka/zywall_flash.imgThen I wrote the clone to the usb stick using balenaEtcher for MAC OS. But I forgot to write down the name of the flash moduleProbably the name is important, so I'll have to repeat the process.

author: drussell
author_rank: Super Contributor
timestamp: February 12, 2021, 05:04:00 pm
content: Quote from: OldFox on February 12, 2021, 04:54:04 pmI probably would have tried just dd'ing it back to the new disk so it was completely identical.It is probably mounting things by physical location like looking at partitions on device sda rather than the name of the actual volume anyway.

author: OldFox
author_rank: Contributor
timestamp: February 12, 2021, 05:41:13 pm
content: Quote from: drussell on February 12, 2021, 05:04:00 pmWill try to dd directly to the usb flash drive, thanks. Does dd also format the flash drive, probably not?

author: drussell
author_rank: Super Contributor
timestamp: February 12, 2021, 05:49:13 pm
content: Quote from: OldFox on February 12, 2021, 05:41:13 pmIt is adirect copy, so it will be precisely whatever format the source disk was. As long as you are using the actual complete, raw disk device for source and destination (not copying just one partition), it will be identical, no need to "format" or partition or anything, it will all be copied from the other disk 100%.As long as your destination disk is the same size or larger, it shouldJust WorkTM.

author: fzabkar
author_rank: Super Contributor
timestamp: February 12, 2021, 07:52:39 pm
content: I suspect that replacing the flash chip on the original PCB won't work because these flash drives need to be setup using the appropriate MPTool. This tool low level formats the drive, sets up the OOB data, and locates any bad blocks. The flash also stores the Flash Translation Layer (FTL) which keeps a running record of logical to physical block assignments. This is necessary for wear levelling.This means that when you power up the flash drive, the Phison controller will look for the FTL and various firmware components, see that they are corrupt or missing, and then drop back into panic mode.

author: OldFox
author_rank: Contributor
timestamp: February 12, 2021, 07:59:31 pm
content: Quote from: fzabkar on February 12, 2021, 07:52:39 pmWell my original plan is to replace a bad flash chip and then connect it to computer, using usb cable and then "initialize" the new flash module using those Phison tools, that Ian.M mentioned in his post:QuoteBut in any case I'll probably have to clone the contents of the working flash module to the new one.

author: fzabkar
author_rank: Super Contributor
timestamp: February 12, 2021, 11:44:23 pm
content: Sorry, I missed that.

author: CJay
author_rank: Super Contributor
timestamp: February 13, 2021, 09:05:19 am
content: Most of those links are dead.I've got a pile of what were quite expensive Kingston/Phison based flash drives that have failed which I can't send away for replacement (security) and can't revive because the tools don't work or aren't available.Would definitely have just replaced the board with a USB socket and flash drive by now though.

author: drussell
author_rank: Super Contributor
timestamp: February 13, 2021, 09:17:31 am
content: Quote from: CJay on February 13, 2021, 09:05:19 amThey've just moved around on the flashboot.ru site where they were linked to from the blogspot site.The Phison software section on flashboot.ru is here:https://flashboot.ru/files/phison/

author: OldFox
author_rank: Contributor
timestamp: February 13, 2021, 10:52:26 am
content: Here are some more tests.I've cloned working flash usb directly to usb stick, using command:dd if=/dev/sdb of=/dev/sdcHere is the result:Disks:ORIGINAL flash module:CLONE (usb stick):Then I've tried to boot from working flash module, using that USB extension (just to see if the extension cable works) and it worked fine with original module, but not with USB clone.In console window you can see that it's checking file system in /dev/sda6 and dev/sda7 (log is from working module).Any idea why? is that USB name really not important? Is maybe because usb stick(16gb) is larger than original module?Any clues why this method doesnt work?

author: fzabkar
author_rank: Super Contributor
timestamp: February 13, 2021, 08:36:15 pm
content: It seems odd that the ZyXEL ZyWALL device detects as a 518MB drive when its real capacity is 1GiB. What does sector 0 look like?

author: OldFox
author_rank: Contributor
timestamp: February 13, 2021, 08:46:17 pm
content: Quote from: fzabkar on February 13, 2021, 08:36:15 pmHmm, where did you see that the real capacity is 1GiB?Specs says 512MK9F4G08U0D-SCB0:SLC NAND Flash Serial 3.3V 4G-bit512MI'll check sector 0

author: drussell
author_rank: Super Contributor
timestamp: February 13, 2021, 09:48:10 pm
content: Quote from: OldFox on February 13, 2021, 10:52:26 amUnless things are being mounted in the fstab using their volume IDs or something, it shouldn't matter.What are the contents of/etc/fstabon those units?QuoteHighly unlikely

author: fzabkar
author_rank: Super Contributor
timestamp: February 13, 2021, 10:00:22 pm
content: Quote from: OldFox on February 13, 2021, 08:46:17 pmI thought you took the PCB photo after removing one of the chips.

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 08:43:53 am
content: Quote from: fzabkar on February 13, 2021, 10:00:22 pmNo, the PCB module has one free flash slotHere is the sector 0 from usb stick(clone):Should I be worried about that "Invalid partition table..."?Quote from: drussell on February 13, 2021, 09:48:10 pmUnfortunately I don't have access to the linux shell of the firewall. I can SSH to the firewall, but I only get access to some kind of command line interface (not linux shell) where I can execute specific commands (list can be foundHERE).I'll try to find some traces of the /etc/fstab in the system logs.

author: Ian.M
author_rank: Super Contributor
timestamp: February 14, 2021, 09:09:20 am
content: No. those strings are just error messages output by the x86 MBR machine-code if it cant find a valid partition table, or if the active partition doesn't have a valid boot sector. They signify that the media was (probably) originally partitioned on a PC running an English Windows NT family OS. (i.e not DOS or Win9x)Seehttps://thestarman.pcministry.com/asm/mbr/Win2kmbr.htmAs the processor in your firewall probably cant run x86 code, and it almost certainly doesn't have a PC bios, and you aren't going to attempt to boot an x86 PC from this media they are totally irreverent.

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 09:31:31 am
content: Thanks for the info.I still can't understand why using usb stick clone doesn't work 🙁I hope that it will work with original PCB module after I replace that flash chip (and initialize it,...).

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 14, 2021, 10:42:46 am
content: I wonder that the model of the original module contain the Manufacturer of the Firewall. So it is possible that the Firewall indeed is locked to a OEM module. Which make some sense to prevent the BadGuys(TM) modify the firewall.Not sure if that will help much but you can get more information about the USB devices usinglsusb -v. If you do first alsusbit shows a shorter list including the ID. This ID can used to get only the needed device info:lsusb -v -d xxxx:xxxx. I'm not sure if some of these values can modified without specific tools specific to configure the USB-FLASH controller itself.

author: Syntax Error
author_rank: Frequent Contributor
timestamp: February 14, 2021, 10:47:14 am
content: Another thought... is the firewall looking for a specific vendor and product id? Does your working module reveal a valid VID/PID? As just previously mentioned.Also... is there a serial Tx-Rx on the firewall main pcb where you could hook an ascii terminal to? That might reveal a bootlog or even, let you probe the ENVironment variables?+++ Try changing the volume serial number - if that's possible. The 5DD91D... might be important.

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 11:45:28 am
content: Quote from: Twoflower on February 14, 2021, 10:42:46 amQuote from: Syntax Error on February 14, 2021, 10:47:14 amIt could be. But in the other hand, if BadGuys(TM) have access to the PCB module, they could simply attach it to the usb cable and read the content, like I didBut I don't see any other explanation, because the content is cloned.I'll try to fake the VID/PID on some USB drive.Quote from: Syntax Error on February 14, 2021, 10:47:14 amYes, there is COM port for accessing the debug console, that I was doing all the time to see what's going on on the boot process.But it doesn't reveal much information,just this:- on the working module:Code:U-Boot 2011.03 (Development build, svnversion: u-boot:422M, exec:exported) (Build time: Feb 21 2013 - 13:27:33)BootModule Version: V1.10 | 02/21/2013 10:45:46DRAM: Size = 1024 MbytesPress any key to enter debug mode within 3 seconds..............................................................Start to check file system.../dev/sda6: 504/20480 files (0.6% non-contiguous), 74536/81920 blocks/dev/sda7: 274/23040 files (12.8% non-contiguous), 30110/92160 blocksDoneKernel Version: V3.10.87 | 2020-12-01 05:01:44ZLD Version: V4.60(AAAA.1) | 2020-12-01 06:10:59INIT: version 2.86 booting- on the cloned usb stick:Code:U-Boot 2011.03 (Development build, svnversion: u-boot:422M, exec:exported) (Build time: Feb 21 2013 - 13:27:33)BootModule Version: V1.10 | 02/21/2013 10:45:46DRAM: Size = 1024 MbytesPress any key to enter debug mode within 3 seconds..............................................................Error trying to mount db partition 5 timesmke2fs: No such device or address while trying to determine filesystem sizemke2fs: No such device or address while trying to determine filesystem sizeCheck partition table error: 1Recovering Partition ...And if you enter the "Debug mode", you can only execute some specific commands (list can be foundHERE).

author: drussell
author_rank: Super Contributor
timestamp: February 14, 2021, 12:39:17 pm
content: Quote from: OldFox on February 14, 2021, 08:43:53 amNo, no...You don't need into the firewall itself to do that, I meant mount the partition on another computer and justcat(or less or more or whatever other way you prefer to otherwise read) the/etc/fstabfile. You obviously had it connected to a real computer to copy the drive contents over, I was meaning why didn't you just mount it and read it there.It is unlikely that they have whatever volume contains/etc/encrypted or something.

author: drussell
author_rank: Super Contributor
timestamp: February 14, 2021, 12:41:32 pm
content: Quote from: OldFox on February 14, 2021, 11:45:28 amThe general rule of thumb is that if someone has physical access to your machine, it's already hacked.

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 12:46:41 pm
content: Quote from: drussell on February 14, 2021, 12:39:17 pmHmm, I'll check but actually I don't think that I'll find the fstab on the flash module? That firewall has probably another partition, stored somewhere on the mainboard of the firewall. I think that it's using that flash module only for storing firmware, logs, config, etc...Edit:Ah, I've misunderstood you. So you want me to check the fstab on the ubuntu machine, where I've mounted that image 🙂What info can I get from that?

author: drussell
author_rank: Super Contributor
timestamp: February 14, 2021, 12:59:39 pm
content: Quote from: OldFox on February 14, 2021, 12:46:41 pmAh, yeah, I hadn't thought of that thing probably havingmoreflash in it where some stuff might be stored.QuoteYou will be able to tell if it is mounting the partitions by raw physical location or by volume ID, media name, etc.

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 01:11:52 pm
content: Quote from: drussell on February 14, 2021, 12:59:39 pmOk, I've mounted the cloned usb to the Ubuntu machine and check the fstab. Btw, I can normally browse those mounted partitions and read the content, nothing is encrypted.Well I'm not expert, but where is info about /dev/sdb ?

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 14, 2021, 01:15:49 pm
content: To get an overview of the currently mounted devices usemountin the shell (or usemount | grep sdb).

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 01:27:34 pm
content: Quote from: Twoflower on February 14, 2021, 01:15:49 pmThanks for the hint.mount command reveals this info:

author: drussell
author_rank: Super Contributor
timestamp: February 14, 2021, 01:32:04 pm
content: Quote from: OldFox on February 14, 2021, 01:11:52 pmIt would appear that you are just looking at the fstab on your ubuntu machine, not the one on the disk for the target firewall machine. You need to mount the USB stick's partitions to see if one of them contains the/etc/directory for the firewall and look atthatfilesystem table (fstab).Since your system has automount enabled, it is mounting those partitions for you off of/media/on your ubuntu machine, so go int each of those directories (like do acd /media/xxxxxxx/e110e776-31ce-4fa8-b43e-418f49061b12) then see if there is anetcdirectory in there and if it contains afstabfile you cancat.If they weren't already mounted you would have to do amount /dev/sdb3 /mnt/mydirnamebut like I said, you have automount enabled so it is mounting them for you automatically when it sees what looks like valid partitions.Hopefully that isn't what is messing you up somehow. When I'mdding things around, I wouldn't want to have the automounter trying to outsmart me or something, I only want to mount partitions (and in this case I would mount them read only with a-o rooption) whenI tell it toso the bloody system doesn't touch them inany way, nofscking them, not updating their last-mounted-date, nothing.But I run FreeBSD, not linux so I don't know how you turn that shit off.

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 14, 2021, 01:37:24 pm
content: My guesses on the partitions (seeuboot documentation):sd?1 = uboot boot-codesd?2 = NVRAMsd?3 = /boot (linux boot partition)sd?4 = /root (linux root partiton; here you'll find the etc/fstab)...

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 06:24:08 pm
content: Quote from: drussell on February 14, 2021, 01:32:04 pmThanks for the hint. I'll try to dd that working flash PCB again, this time with disabled automount.Quote from: Twoflower on February 14, 2021, 01:37:24 pmI didn't find fstab on those partitions. See the list of directory contents in attached file.I still think that the linux OS is installed somewhere on the firewall and the /etc/fstab is on that system and that PCB flash is just "extension drive", where thatZyNOS(Zyxel OS) is installed.My next goal is to try to change/fake that usb stick's VID/PID.And to solder that new flash chip on the old PCB module (still waiting for solder wire to arrive).

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 14, 2021, 07:16:39 pm
content: I'm pretty sure that the operating system is on the module. The OS-Kernel seems to be compress.img (66MByte) on sd?3. But that's not a normal linux it probably a proprietary OS that uses similar functions (e.g. the ext3 driver). So either that's an in-house OS or some commercial embedded code (QNX, VX-Works... ).I would even say that even the uboot (so to say the BIOS) is most likely on the module (sd?1). The processor automagically dumps a certain memory region (the u-boot boot code) from the USB-Module into memory and jumps to it.But all that won't help you to get the USB-Stick to boot. Sorry. The last straws I have: check the content of the .fsck_log.? files. They won't show up in the Ubuntu file manager (the leading . makes them hidden). So trycat /media/luka/11bc15ff-455d-43c2-9275-566ef55e928e/.fsck_log.*of the USB stick and the USB-Module. if they provide some insight. Also try to generate the same text file you attached from the module but from the USB stick. Try to boot once and create another text file. Now check if there are some changes. That file(s) might be an interesting one to check for additional log-messages.

author: OldFox
author_rank: Contributor
timestamp: February 14, 2021, 07:22:25 pm
content: Thanks for the info.Quote from: Twoflower on February 14, 2021, 07:16:39 pmI'll try to do that. That file list is from the cloned USB stick, not from the original module. But they should be the same, right?

author: Twoflower
author_rank: Frequent Contributor
timestamp: February 14, 2021, 07:24:26 pm
content: Yes, but the logfiles might change as they get updated with the information about the current boot.

author: fzabkar
author_rank: Super Contributor
timestamp: February 14, 2021, 11:08:11 pm
content: AFAICT, there is nothing physically wrong with the original flash chip. It is onlylogicallydamaged. If so, then the original module should still be detected with the "damaged" NAND, albeit with file system errors. This means that PID/VID or serial numbers would not be an issue. One would then only need to dd a working image from a working module, thereby preserving the ID.That said, it could still be that each FS image is uniquely tied to the VID/PID or serial number, but then it might just be a matter of locating the corresponding data in the file system and editing them, rather than low level formatting the Phison controller.It might be interesting to see how a NAND-less module is detected by lsusb and then comparing that with a populated, working module. I expect that you could take a populated module and make it NAND-less by shorting the NAND's Ready/Busy* pin to ground. This is permissible since this pin is open drain.In fact if you could dump the original NAND (via USB), we could then compare its contents against the firmware update and see where it all went wrong. It might then be a simple case of replacing missing files or a missing partition, etc.

author: OldFox
author_rank: Contributor
timestamp: February 15, 2021, 02:04:57 pm
content: Quote from: Twoflower on February 14, 2021, 07:16:39 pmYou were right. I've mounted compress.img to check the contents (see attachment compress_img.txt) and it looks like linux structure.And there are duplicated partitions, because Zywall firewall has two firmwares - one is in "Stand by" mode and the other is in "Running" mode then you can switch between versions, if anything goes wrong during update.Quote from: Twoflower on February 14, 2021, 07:16:39 pmHere is the content of fsck_log files:Code:sdc 15,1G root disk brw-rw----├─sdc1 1M root disk brw-rw----├─sdc2 10M root disk brw-rw----├─sdc3 ext3 1.0 e110e776-31ce-4fa8-b43e-418f49061b12 920K 93% /media/luka 80M root disk brw-rw----├─sdc4 ext3 1.0 11bc15ff-455d-43c2-9275-566ef55e928e 68,1M 13% /media/luka 90M root disk brw-rw----├─sdc5 10M root disk brw-rw----├─sdc6 ext3 1.0 b5a25007-1f8b-4e50-8f1f-98c33be3305e 3,2M 90% /media/luka 80M root disk brw-rw----├─sdc7 ext3 1.0 0480693d-558d-4811-beaa-a27bcf84d13a 56,1M 27% /media/luka 90M root disk brw-rw----├─sdc8 1M root disk brw-rw----├─sdc9 ext3 1.0 91ff76af-8cae-4912-b46e-2e6b108c11d7 30M 68% /media/luka 120M root disk brw-rw----└─sdc10 ext3 1.0 a662977c-7b94-450f-ba9a-a9b6071a40a2 5,4M 1% /media/luka 7M root disk brw-rw----sr0 67,4M root cdrom brw-rw----luka@Luka-ubuntu:~$ ls -alh /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/total 2,4Mdrwxr-xr-x 5 root root 1,0K dec 18 15:27 .drwxr-x---+ 8 root root 4,0K feb 15 14:07 ..drwxr-xr-x 11 root root 1,0K jan 31 2019 etc-rw-r--r-- 1 root root 70 jan 25 16:33 .fsck_log.1-rw-r--r-- 1 root root 71 jan 25 16:25 .fsck_log.10-rw-r--r-- 1 root root 71 jan 25 16:33 .fsck_log.2-rw-r--r-- 1 root root 70 feb 12 15:51 .fsck_log.3-rw-r--r-- 1 root root 71 feb 12 15:51 .fsck_log.4-rw-r--r-- 1 root root 70 feb 13 11:03 .fsck_log.5-rw-r--r-- 1 root root 71 feb 13 11:03 .fsck_log.6-rw-r--r-- 1 root root 70 jan 6 15:26 .fsck_log.7-rw-r--r-- 1 root root 71 jan 6 15:26 .fsck_log.8-rw-r--r-- 1 root root 70 jan 25 16:25 .fsck_log.9-rw-r--r-- 1 root root 1 feb 13 11:03 .fsck_log_idx-r--r--r-- 1 root root 1,1M feb 13 11:04 ksyms-r--r--r-- 1 root root 1,1M feb 13 11:04 ksyms_lastdrwx------ 2 root root 12K jan 1 1970 lost+found-rw-r--r-- 1 root root 81 jan 25 2016 scan_manager.log-rw-r--r-- 1 root root 81 avg 30 2015 scan_manager_old.log-rw-r--r-- 1 root root 286K dec 18 15:29 .update-fw.logdrwxr-xr-x 3 root root 1,0K dec 18 15:31 wtp_imageluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.1/dev/sda6: 504/20480 files (0.6% non-contiguous), 74536/81920 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.2/dev/sda7: 265/23040 files (12.1% non-contiguous), 17822/92160 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.3/dev/sda6: 504/20480 files (0.6% non-contiguous), 74536/81920 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.4/dev/sda7: 274/23040 files (12.8% non-contiguous), 30110/92160 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.5/dev/sda6: 504/20480 files (0.6% non-contiguous), 74536/81920 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.6/dev/sda7: 274/23040 files (12.8% non-contiguous), 30110/92160 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.7/dev/sda6: 504/20480 files (0.6% non-contiguous), 74536/81920 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.8/dev/sda7: 265/23040 files (11.7% non-contiguous), 17822/92160 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.9/dev/sda6: 504/20480 files (0.6% non-contiguous), 74536/81920 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log.10/dev/sda7: 265/23040 files (10.9% non-contiguous), 17822/92160 blocksluka@Luka-ubuntu:~$ cat /media/luka/0480693d-558d-4811-beaa-a27bcf84d13a/.fsck_log_idxQuote from: Twoflower on February 14, 2021, 07:16:39 pmI've tried to create a "ls" filelist of the USB clone stick before and after I tried to boot from it and there are no differences.I also have two images of working module - 2nd one is created few days after the first one. See the diff in diff_ls_old_new.txt attachment.Quote from: fzabkar on February 14, 2021, 11:08:11 pmOk I'll re-solder the original(bad) chip to the controller and connect it to the comp, to see if I can access it.I'll get new stock of solder wire tomorrow, so stay tunedThanks a lot for your help guys!

author: OldFox
author_rank: Contributor
timestamp: February 18, 2021, 06:55:25 am
content: I'm back with some bad news.Well, when I was cleaning the PCB pads with that shitty water cleaning solder and desoldering wire I managed to rip off 3 padsThat water cleaning solder is really strange to use or I just don't have the right tools for it.However I was lucky that those pads are NC so it should work anyway, right? Actually I'm not sure about pin #34 which is connected to 3V3 (see the left schematics - the one of the Phison datasheet).So I soldered back the old (non working) flash, connected it to the comp, using usb cable and it doesn't detect the drive. Now I'm not sure if it's because those 3 NC pins or did I fry something else.Should the computer detect the Phison USB device even if the flash chip is broken?

author: Ian.M
author_rank: Super Contributor
timestamp: February 18, 2021, 08:26:41 am
content: NC pins are just that: No Connection, so missing pads that didn't have a track or via wont affect it other than slightly weakening it mechanically. I don't know why that datasheet has NC pin 34 connected to a pullup resistor - possibly its so the same board can be used with a different FLASH chip which uses that pin.I *think* the Phison chip needs firmware to run. AFAIK Its basically a MCU with a USB SIE and an external FLASH interface. I don't know whether it has its own internal program memory, or whether it only has a bootloader. If the former, it may not get as far as initialising the USB SIE if the FLASH is bad. If the latter, the bootloader must normally load the firmware from a reserved block on the FLASH, but there must be some way of entering USB firmware download mode, for the Phison utility to interact with it to initialize the FLASH and 'burn' the firmware to it.You'd have to dig into how to use the Phison utility software, and study datasheets for related Phison controllers to figure it out.

author: OldFox
author_rank: Contributor
timestamp: February 25, 2021, 04:38:13 pm
content: Some more updates...I removed the old flash again and soldered the new one. Then I've connected the module to the computer using the USB cable and it doesn't detect itI'm not sure if the USB device should be detected even it's not "initialized" yet? How can I use those Phison tools to init the flash if the USB device isn't connected then?Hmmm, what if flash is ok and the Phison controller is bad? Any idea how can I test if the Phison controller is good?I think I'll order some PS2251-50 controller chips and connect everything to the breadboard to do some tests. This is driving me crazyI just want to figure out what's going on.I've also ordered some Chinese eUSB module to test if the cloned image will work.p.s. I found the Phison PS2251-50 datasheet (attached).

author: fzabkar
author_rank: Super Contributor
timestamp: February 25, 2021, 06:33:25 pm
content: I believe the Phison controller should still be detected in the absence of flash, albeit with a generic name.Tools such as ChipGenius should be able to identify the controller and NAND.

author: Ian.M
author_rank: Super Contributor
timestamp: February 25, 2021, 07:34:40 pm
content: Note the jumpers on the schematic of the Phison PS2251-50 reference design for a Flash drive I linked earlier:http://www.rflashdata.com/uploadfile/2011/1117/UP19-PS2251%20datasheet.pdf(page 2)Specifically TEST_EA low to bypass Flash checking and LED/PBPIO1 low for 'preformat use'I suspect that if the controller firmware (which I believe is stored in the Flash as it otherwise only has mask ROM) is corrupted or missing, you probably need to use the jumpers to get the controller into a state where it will enumerate as a USB device so the Phison utility software can access it to initialize the Flash and install firmware.If you trawl through the results of searching the sitehttps://www.usbdev.ru/forPS2251-50using Google Translate, you are likely to find enough hints about getting the drive enumerated and using the Phison utilities, to get somewhere.One thing that is important to do is dump a copy of the good drive's firmware as if the firmware's custom (as we suspect *may* be the case from the name it enumerates with), you'll otherwise be S.O.L. when it comes to getting the Zyxel USG110 firewall to recognize the (hopefully) repaired drive.

author: OldFox
author_rank: Contributor
timestamp: February 25, 2021, 07:59:22 pm
content: Quote from: Ian.M on February 25, 2021, 07:34:40 pmThanks for this! This was the missing puzzle - I didn't know how should I use those tools, if my usb module isn't detected. Now I remember that I saw a guy on YouTube, who was bricking pins on the flash to enter the "test mode". I'll try that, thanks.Edit: I should brick that test pin with the vcc pin next to it, right?

author: OldFox
author_rank: Contributor
timestamp: February 26, 2021, 07:23:46 am
content: Some more updates.I've successfully entered the "test mode" by shorting the pins before connecting the USB to the computer:36 - PI_TEST_SEL035 - VCC...So it looks like the controller detects the new flashThe next step is to use the Phison MPALL app and burn the new firmware.At this point, I'm not sure if I should just use the factory firmware or should I try to clone the firmware from the working module.

author: perieanuo
author_rank: Frequent Contributor
timestamp: February 26, 2021, 01:36:44 pm
content: clone if you can that's no better option, but 'standard' fw will work i'd guess, it's just storage, BUT who knows, serial no/checksum... or other key may be considered by firewall fw

author: OldFox
author_rank: Contributor
timestamp: February 26, 2021, 01:56:05 pm
content: Quote from: perieanuo on February 26, 2021, 01:36:44 pmMy vote also goes for "Clone FW", but first I need to figure out how to do that with all those Chinese/Russian appsDo you have any experiences with cloning maybe?