Meraki MS220-8P - Revision history

Leo: /* Rooting the Switch */

2023-12-03T02:45:24Z

Rooting the Switch

← Older revision		Revision as of 02:45, 3 December 2023
Line 395:		Line 395:

	Customization that I found useful and have been using is given below. I also recommend checking out an improved version by Lukas linked below.		Customization that I found useful and have been using is given below. I also recommend checking out an improved version by Lukas linked below.
	{{highlight\|lang=bash\|code=		{{highlight
	<nowiki>		\| lang = bash
			\| code = <nowiki>
	#!/bin/sh		#!/bin/sh
	# Kill everything except for a few critical services		# Kill everything except for a few critical services
Line 419:		Line 420:
	# Cleanup		# Cleanup
	killall sync_log		killall sync_log

			# Do not ping 8.8.8.8
			echo false > /click/wan0_pinger/active
	}}		}}

Leo: Added hardware category

2021-12-30T02:16:39Z

Added hardware category

← Older revision		Revision as of 02:16, 30 December 2021
Line 626:		Line 626:
	{{Navbox Tinkering}}		{{Navbox Tinkering}}
	[[Category:Tinkering]]		[[Category:Tinkering]]
			{{Navbox Hardware}}
			[[Category:Hardware]]

Crackerhk: /* Rooting the Switch */

2021-12-19T01:21:17Z

Rooting the Switch

← Older revision		Revision as of 01:21, 19 December 2021
Line 363:		Line 363:
	#Connect the MX25L to a flasher, such as a Raspberry Pi running {{code\|flashrom}}		#Connect the MX25L to a flasher, such as a Raspberry Pi running {{code\|flashrom}}
	#Connect the J4 header to your UART		#Connect the J4 header to your UART
			#Check the chipset model for flashing parameter -c
			{{Highlight
			\| code = flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=600
			\| lang = terminal
			}}
	#Flash [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage1/dump-patched.dat this modified stage 1 image] using {{code\|flashrom}}: {{highlight\|lang=terminal\|code=		#Flash [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage1/dump-patched.dat this modified stage 1 image] using {{code\|flashrom}}: {{highlight\|lang=terminal\|code=
	rpi# flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=600 -c "MX25L12835F/MX25L12845E/MX25L12865E" -w dump-patched.dat		rpi# flashrom -p linux_spi:dev=/dev/spidev0.0,spispeed=600 -c "MX25L12835F/MX25L12845E/MX25L12865E" -w dump-patched.dat
	}}		}}
	#Boot the switch. You should now have a root shell on stage1 with a working version of busybox in the path and {{code\|/dev/ubi1_4}} mounted as {{code\|/storage}}.		#Boot the switch. You should now have a root shell on stage1 with a working version of busybox in the path and {{code\|/dev/ubi1_4}} mounted as {{code\|/storage}}.
			#By default stage1 image mount as read-only partition, execute the follow code to turn to read write mode:
			{{Highlight
			\| code = busybox umount /dev/ubi1_4
			busybox mount -t ubifs -o rw /dev/ubi1_4 /storage
			\| lang = terminal
			}}<br />
	#Transfer a copy of {{code\|kexec}} to {{code\|/storage}} (via serial only because there's no networking, [https://git.steamr.com/leo/meraki-220-8p/tree/master/utils using these ghetto transfer scripts]). A copy of <code>kexec</code> can be obtained by running the extract.sh script at https://git.steamr.com/leo/meraki-220-8p/-/tree/master/stage1.		#Transfer a copy of {{code\|kexec}} to {{code\|/storage}} (via serial only because there's no networking, [https://git.steamr.com/leo/meraki-220-8p/tree/master/utils using these ghetto transfer scripts]). A copy of <code>kexec</code> can be obtained by running the extract.sh script at https://git.steamr.com/leo/meraki-220-8p/-/tree/master/stage1.
	#Copy [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage2/firmware.bin this modified stage 2 image] to {{code\|/firmware.bin}} via serial		#Copy [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage2/firmware.bin this modified stage 2 image] to {{code\|/firmware.bin}} via serial, if your {{code\|/storage}} size don't have enough space consider to copy the stage 2 image to {{code\|/dev}}
	#Flash the modified firmware.bin image to the NAND flash by running {{highlight\|lang=terminal\|code=		#Flash the modified firmware.bin image to the NAND flash by running {{highlight\|lang=terminal\|code=
	# /busybox flash_eraseall /dev/mtd12		# /busybox flash_eraseall /dev/mtd12

Leo: /* Rooting the Switch */ clarified on where kexec comes from

2021-12-14T05:07:10Z

Rooting the Switch: clarified on where kexec comes from

Show changes

Leo at 00:46, 15 June 2020

2020-06-15T00:46:03Z

← Older revision		Revision as of 00:46, 15 June 2020
Line 607:		Line 607:
	* https://openwrt.org/docs/guide-developer/crosscompile		* https://openwrt.org/docs/guide-developer/crosscompile

	[[Category:Tinkering]]~~{{Navbox Tinkering}}~~		{{Navbox Tinkering}}[[Category:Tinkering]]

Leo: /* Rooting the Switch */

2020-01-27T01:34:42Z

Rooting the Switch

← Older revision		Revision as of 01:34, 27 January 2020
Line 381:		Line 381:
	A custom startup script in {{code\|/etc/init.d/S90custom}} will run {{code\|/storage/init.sh}} to allow persistent customizations on this switch.		A custom startup script in {{code\|/etc/init.d/S90custom}} will run {{code\|/storage/init.sh}} to allow persistent customizations on this switch.

	Customization that I found useful and have been using is given below. Lukas ~~Schauer added improvements to the script~~ below ~~and can be found at https://gist~~.~~github.com/lukas2511/0f4199b56f248775119eba3378c857bf~~		Customization that I found useful and have been using is given below. I also recommend checking out an improved version by Lukas linked below.

	{{highlight\|lang=bash\|code=		{{highlight\|lang=bash\|code=
	<nowiki>		<nowiki>
Line 408:		Line 407:
	killall sync_log		killall sync_log
	}}		}}

			Lukas Schauer improved my script above by adding IPv6, VLAN and LLDP support and more and can be found at https://gist.github.com/lukas2511/0f4199b56f248775119eba3378c857bf

Leo: /* Rooting the Switch */

2020-01-27T01:32:02Z

Rooting the Switch

← Older revision		Revision as of 01:32, 27 January 2020
Line 381:		Line 381:
	A custom startup script in {{code\|/etc/init.d/S90custom}} will run {{code\|/storage/init.sh}} to allow persistent customizations on this switch.		A custom startup script in {{code\|/etc/init.d/S90custom}} will run {{code\|/storage/init.sh}} to allow persistent customizations on this switch.

	Customization that I found useful and have been using is given below.		Customization that I found useful and have been using is given below. Lukas Schauer added improvements to the script below and can be found at https://gist.github.com/lukas2511/0f4199b56f248775119eba3378c857bf

	{{highlight\|lang=bash\|code=		{{highlight\|lang=bash\|code=
	<nowiki>		<nowiki>

Leo: Recategorize

2019-09-01T02:05:59Z

Recategorize

← Older revision		Revision as of 02:05, 1 September 2019
Line 604:		Line 604:
	=== OpenWRT ===		=== OpenWRT ===
	* https://openwrt.org/docs/guide-developer/crosscompile		* https://openwrt.org/docs/guide-developer/crosscompile

			[[Category:Tinkering]]{{Navbox Tinkering}}

Leo: /* Dumping Flash Data */ formatting

2019-09-01T00:45:46Z

Dumping Flash Data: formatting

← Older revision		Revision as of 00:45, 1 September 2019
Line 424:		Line 424:
	=== NOR Flash ===		=== NOR Flash ===
	The 16-Pin SOP for the MX25L12845E chip is as follows:		The 16-Pin SOP for the MX25L12845E chip is as follows:
	{\| class="wikitable"		{\| class="wikitable fixed"
	\|-		\|-
	\|		\|
Line 526:		Line 526:

	Each partition in brief detail:		Each partition in brief detail:
	{\|		{\| class="wikitable"
	! Partition		! Partition
	! Description		! Description

136.159.160.123: /* Rooting the Switch */

2019-08-22T17:14:38Z

Rooting the Switch

← Older revision		Revision as of 17:14, 22 August 2019
Line 366:		Line 366:
	# Boot the switch. You should now have a root shell on stage1 with a working version of busybox in the path and {{code\|/dev/ubi1_4}} mounted as {{code\|/storage}}.		# Boot the switch. You should now have a root shell on stage1 with a working version of busybox in the path and {{code\|/dev/ubi1_4}} mounted as {{code\|/storage}}.
	# Transfer a copy of {{code\|kexec}} to {{code\|/storage}} (via serial only because there's no networking, [https://git.steamr.com/leo/meraki-220-8p/tree/master/utils using these ghetto transfer scripts])		# Transfer a copy of {{code\|kexec}} to {{code\|/storage}} (via serial only because there's no networking, [https://git.steamr.com/leo/meraki-220-8p/tree/master/utils using these ghetto transfer scripts])
	# Copy [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage2/firmware.~~dat~~ this modified stage 2 image] to {{code\|/firmware.bin}}, again via serial		# Copy [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage2/firmware.bin this modified stage 2 image] to {{code\|/firmware.bin}}, again via serial
	# Flash the copied image to the NAND flash by running {{highlight\|lang=terminal\|code=		# Flash the copied image to the NAND flash by running {{highlight\|lang=terminal\|code=
	# /busybox flash_eraseall /dev/mtd12		# /busybox flash_eraseall /dev/mtd12

← Older revision		Revision as of 17:14, 22 August 2019
Line 366:		Line 366:
	# Boot the switch. You should now have a root shell on stage1 with a working version of busybox in the path and {{code\|/dev/ubi1_4}} mounted as {{code\|/storage}}.		# Boot the switch. You should now have a root shell on stage1 with a working version of busybox in the path and {{code\|/dev/ubi1_4}} mounted as {{code\|/storage}}.
	# Transfer a copy of {{code\|kexec}} to {{code\|/storage}} (via serial only because there's no networking, [https://git.steamr.com/leo/meraki-220-8p/tree/master/utils using these ghetto transfer scripts])		# Transfer a copy of {{code\|kexec}} to {{code\|/storage}} (via serial only because there's no networking, [https://git.steamr.com/leo/meraki-220-8p/tree/master/utils using these ghetto transfer scripts])
	# Copy [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage2/firmware.~~dat~~ this modified stage 2 image] to {{code\|/firmware.bin}}, again via serial		# Copy [https://git.steamr.com/leo/meraki-220-8p/blob/master/stage2/firmware.bin this modified stage 2 image] to {{code\|/firmware.bin}}, again via serial
	# Flash the copied image to the NAND flash by running {{highlight\|lang=terminal\|code=		# Flash the copied image to the NAND flash by running {{highlight\|lang=terminal\|code=
	# /busybox flash_eraseall /dev/mtd12		# /busybox flash_eraseall /dev/mtd12