2

I'm currently researching my home router (D-Link 2760-U) which has a (kind-of) proprietary ISP firmware. What I'm trying to achieve is understanding how the router is persisting it's configuration settings across reboots.

mount output:

/dev/mtdblock0 on / type squashfs (ro,relatime)
/proc on /proc type proc (rw,relatime)
tmpfs on /var type tmpfs (rw,relatime,size=420k)
tmpfs on /mnt type tmpfs (rw,relatime,size=16k)
sysfs on /sys type sysfs (rw,relatime)

I did nvram show and it does contain some wireless configuration such as the encryption in use, wireless modes, pre-shared key but that's about it. Obviously the router has other configurations (such as DNS, PPP, Port forwards etc) that must be stored elsewhere. As it can be observed, all mounted filesystems are volatile and thus configuration cannot be stored in them.

Where can the information be saved besides filesystem and NVRAM? How do I go about finding this out?

  • Is the output of nvram show some kind of ascii, or binary stuff that needs a command like strings to read? If it's binary, the other configuration might be right there but unreadable. – Guntram Blohm Jun 6 '14 at 11:23
  • Nope, it shows readable ASCII variables and value strings. – Kinetic Jun 6 '14 at 11:27
  • What is the output of cat /proc/mtd? – 6EQUJ5 Jun 6 '14 at 12:49
  • dev: size erasesize name mtd0: 00608000 00608000 "Physically mapped flash". /dev/ has mtd[0-1] and mtdblock[0-7]. – Kinetic Jun 7 '14 at 18:37
  • It could be helpful if you posted the entire output in the question... – 6EQUJ5 Jun 8 '14 at 0:00
1

I have played with at least one (not a D-Link) Linux-based router that stored its configuration in a bare mtd partition and accessed it using a proprietary binary. It compressed the data using LZMA or something but within that, you could see passwords in clear-text (not good!)

D-Link actually have a very good GPL source code system, go to http://tsd.dlink.com.tw/downloads2008list.asp?SourceType=download&OS=GPL and type in 2760 and you can download the entire buildroot and source for that router.

Even if they happen to use some non-standard proprietary mechanism for saving configuration, you should be able to get some idea of where it is hidden from examining the GPL sources...

  • Thanks a lot for the infos, I will totally stay some nights up on this =] – Kinetic Jun 8 '14 at 22:17
  • Found it! It's in userspace/private/libs/cms_core/libcmscore.so_DSL-2760-U_save in a function called cmsMgm_saveConfigToFlash. Basically loads the configuration file into memory and sends an IOCTL message with the pointer. Still need to crack this case completely (kernel stuff, yay) but this is a huge breakthrough, thank you so much! – Kinetic Jun 9 '14 at 0:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.