之前網路上找不到 NSC1000 的直接相關的改機資訊。
Why? Why? Why?
2008-05-20 附近幾日調查的訊息如下:
yahoo 拍賣 CG-NSC1000 含稅不含運(有自取點) 2990 元
原廠下載頁:
http://www.corega.com.tw/products/peripherals/NSC1000.php
http://www.corega.com.tw/products/peripherals/WLNSC1000.php
0. source code
http://61.218.76.250/support/download/files/firmware/cgtw_cg-nsc1000.rar
1. [韌體更新] 最新韌體Ver 1.0.3
版本 1.0.3/ 3750k / 日期 2008-02-25
http://61.218.76.250/support/download/files/firmware/NSC1000_Ver1.0.3.zip
2. [製品型錄] corega_NSC1000_tc.pdf
版本 Rev.A/ 637 kb / 日期 2008-01-18
http://61.218.76.250/support/download/files/datasheet/corega_NSC1000_tc.pdf
3. [驅動程式] 設定軟體
版本 1.0/ 305kb / 日期 2007-09-10
http://61.218.76.250/support/download/files/driver/NSC1000_utility.zip
4. [使用手冊] 使用說明書
版本 Rev.A/ 11,383kb / 日期 2007-07-04
http://61.218.76.250/support/download/files/manual/NSC1000_manual_tc%20Rev.A.pdf
5. [使用手冊] 快速安裝指南
版本 Rev.A/ 7,415kb / 日期 2007-07-04
http://61.218.76.250/support/download/files/manual/NSC1000-QIG_tc_RevA.pdf
source code *.rar 包含:
C:\cgtw_cg-nsc1000>
Directory of C:\cgtw_cg-nsc1000
2007/08/23 上午 09:27 177,444,662 cross-i386-linux-gcc.tar.bz2
2007/03/02 上午 03:18 215,387,050 cross-i386-linux-gcc.tgz
2007/08/23 上午 09:26 1,018 ReadME_about_ToolChain.txt
2007/09/04 上午 02:40 73,861,172 WLNSC1000_GPL_V1.00.tgz
cross-*.tar.bz2 和 cross-*.tgz 是相同的內容, 浪費了 200MB 的空間。
NSC1000 和 WLNSC1000 的 source code 是通用的，不過裡面只有主程式，
缺少各個資料檔案，雖然能夠做出 upgrade.bin，不建議自行升級 firmware。
hexdump -C upgrade.img => MGB111
從 readme 可以推測，是 amit ODM 的產品，Linux 2.4.28
http://www.amit.com.tw/HomeEntertainment.html
bt 程式 Transmission, http://transmission.m0k.org/
(*) 改機重點 (發表文章時未測試)
http://mgb111.pradnik.net/
Tips and tricks
Enable telnetd on unmodified firmware (temporary)
On WebUI:
* Choose Download Assistant -> HTTP download
* Type Job Name: whatever
* Type URL: $(telnetd)
* Press SAVE button
* Wait a while and clear download job in status list
* Telnet to your box.
相關討論:
<分享> 可瑞加COREGA的NAS CG-NSC1000開箱文
http://www.mobile01.com/topicdetail.php?f=110&t=381594&last=4195209
[分享]非專業開箱-窮人超值 可瑞加 CG-WLNSC1000 VS CG-NSC1000
http://www.mobile01.com/topicdetail.php?f=110&t=379836&last=3401337
無人值守BT下載機-可瑞加CG-WLNSC1000
http://www.oc.com.tw/article/0709/readarticle.asp?id=6135
http://www.oc.com.tw/article/0709/readarticle.asp?id=6136
=> CPU AmRISC 20000
http://www.rdc.com.tw/tw/about_main.php?Main=5
下列兩個網址提供的訊息很有用，不過需要修改。
http://tintuc.no-ip.com/linux/tipps/mgb100/
NSC1000_Ver1.0.3.zip =>
20080201_Corega_CG-NSC1000_V1.0.3.bin
CRG_RUS021
$ cc -o splitamitbin splitamitbin.c
$ ./splitamitbin /tmp/20080201_Corega_CG-NSC1000_V1.0.3.bin
block:0 (CRG_RUS021) begin:0 size:4040
block:1 (CRG_RUS021) begin:4040 size:27d050
block:2 (CRG_RUS021) begin:281090 size:fc7a3
block:3 (CRG_RUS021) begin:37d833 size:3b754
The firmware file usually contains several parts:
* Linux kernel
* Ramdisk containing root file system
* Partition with HTML files
* Recovery loader
* AMIT BIOS
16368 May 20 19:12 20080201_Corega_CG-NSC1000_V1.0.3.bin-part00 <= BIOS(RDC mnBIOS V0.042 with IDE)
2609152 May 20 19:12 20080201_Corega_CG-NSC1000_V1.0.3.bin-part01 <= hsqs (mksquashfs_lzma or lzma)
1034067 May 20 19:12 20080201_Corega_CG-NSC1000_V1.0.3.bin-part02 <= Linux kernel
243460 May 20 19:12 20080201_Corega_CG-NSC1000_V1.0.3.bin-part03 <= HTML files (AMIT format)
http://www.macsat.com/macsat/component/option,com_openwiki/Itemid,66/id,dangerous_stuff/
The memorymap in the FLASH (located at 0xFFC00000):
00000010 Linux Kernel
00100010 root fs
003a0010 config
003b0010 filesystem of admin tool
003f0010 System recovery tool
003f8010 MAC-address and branding
003fa010 BIOS
The GUI filesystem
The proprietary http binary takes the pages from a seperate uncompressed filesystem
(direct access or via proprietary libraries, not mounted). Unfortunately, I didn’t have time to
investigate further in this matter. There would be a lot of necessary changes to the html and script code.
I think it can’t be too sophisticated (coming from the AMIT company). Maybe it is only some simple fs
with modified “magic” (@M!T → AMIT). It has some sort of table, followed by a directory and the data.
dir entries are 24byte, filename is 8.3, limited with 0×00. Padding/Filler byte seems to be 0xff.
wiki 上無相關資訊
http://wiki.openwrt.org/TableOfHardware
本文首發 http://www.mw.net.tw/user/fastmem/blog/
