Thecus N3200PRO Firmware Hacking

Operating System

The M3800 firmware provides a custom Linux OS and distribution with a custom-built kernel based on 2.6.23. The kernel includes some Thecus-specific drivers for the LCD display and HDMI output (M3800 only). The distribution seems to be loosely based on Fedora 8, plus some packages specific to embedded systems (busybox provides all the core linux utilities).

The firmware package sources are available at http://gpl.nas-central.org/THECUS/.

The firmware on the N32ooPro:

uname -a

Linux N32ooPro 2.6.23 #1 Fri Nov 13 16:48:49 CST 2009 i586 unknown

/proc/version

Linux version 2.6.23 (root@dev-223.thecus.com) (gcc version 4.1.2 20070925 (Red Hat 4.1.2-33)) #1 Fri Nov 13 16:48:49 CST 2009

libc.so.6

GNU C Library stable release version 2.7, by Roland McGrath et al.
Copyright (C) 2007 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 4.1.2 20070925 (Red Hat 4.1.2-32).
Compiled on a Linux >>2.6.20-1.3001.fc6xen<< system on 2007-10-18.
Available extensions:
       The C stubs add-on version 2.1.2.
       crypt add-on version 2.1 by Michael Glad and others
       GNU Libidn by Simon Josefsson
       Native POSIX Threads Library by Ulrich Drepper et al
       BIND-8.2.3-T5B
       RT using linux kernel aio
For bug reporting instructions, please see:
<http://www.gnu.org/software/libc/bugs.html>.

Structure of the on-board flash disk

The flash disk is split into 4 partitions

Partition 1 (40 MB)

Partition 1 is the boot partition. It contains a /boot top directory with the linux kernel, ramdisk image and grub configuration file. The ramdisk is loaded by the grub initrd option, and remains mounted as the filesystem root partition after boot. It contains /bin, /lib, /lib/modules, /usr, /usr/bin, /var and a populated /dev directory.

Here is the content of the grub configuration file:

default=0
timeout=0 
hiddenmenu
title N3200Plus
    kernel /boot/bzImage ro root=/dev/ram0 max_loop=210 elevator=as acpi=noirq
    initrd /boot/ramdisk

Partition 2 (8 MB)

Partition 2 is mounted on /etc and contains all the persistent configuration files. It is mounted by the rc.local script.

Partition 3 (72 MB)

Partition 3 is an encrypted partition mounted on /rom. It is mounted during boot by the rc.sysinitscript using losetup. It has about 36M available. It contains a number of images that are mounted as read-only directories during boot.

• /rom/img.rom : mounted on /img. Web interface HTML content, php scripts.

• /rom/usrlib.rom : mounted on /usr/lib. Contains dynamic libraries, multimedia libraries.

• /rom/zoneinfo.rom : mounted on /usr/share/zoneinfo, contains timezone information for all countries.

• /rom/opt.rom : mounted on /opt. Contains third-party software packages, including apache, cups, convert, nfs-utils, pppd, samba, etc... It also contains the 2 proprietary kernel modules used to control the M3800 HDMI video card (em8xxxfb.ko and mum.ko).

Partition 4 (7 MB)

Partition 4 contains an ext2 filesystem, but it is empty and unmounted. It is checked by tune2fs during rc.sysinit, just like the other 3 partitions.