{"id":619,"date":"2012-09-30T06:06:45","date_gmt":"2012-09-30T06:06:45","guid":{"rendered":"https:\/\/trouble.org\/?p=619"},"modified":"2012-10-12T15:09:10","modified_gmt":"2012-10-12T15:09:10","slug":"hp-firmware-disks","status":"publish","type":"post","link":"https:\/\/trouble.org\/?p=619","title":{"rendered":"HP firmware disks"},"content":{"rendered":"

I’d been playing with them… and since I hadn’t seen this anywhere I’ll put it as a small hack o the day.<\/p>\n

The disks do what they say (e.g. … install firmware ;)) – basically you burn it to a cd, boot it up, and it has some sort of access to the system. Since I’ve been working with these sorts of things lately I was curious how they did this. I’d ripped apart the 870 version and was thinking of writing that up… but it was a bit messy… so I downloaded the 920 version and triviality stared me in the face, as it will yours as well.<\/p>\n

The very quick version; copy the ISO to a writeable spot, edit\u00a0“\/system\/isolinux.cfg” on the CD copy, change one line from:<\/p>\n

append vmlinuz initrd=initrd.img media=cdrom rw root=\/dev\/ram0 ramdisk_size=302748 init=\/bin\/init loglevel=3 ide=nodma ide=noraid nopat pnpbios=off vga=791 splash=silent showopts TYPE=AUTOMATIC<\/div><\/div>\n

to (note the inclusion of “SHELL=initrd-shell”):<\/p>\n

append vmlinuz initrd=initrd.img media=cdrom rw root=\/dev\/ram0 ramdisk_size=302748 init=\/bin\/init loglevel=3 ide=nodma ide=noraid nopat pnpbios=off vga=791 splash=silent showopts SHELL=initrd-shell TYPE=AUTOMATIC<\/div><\/div>\n

Burn it back to disc. You boot… and you get the shell; just root on the little booted CD, but it seems likely that SE’s and the like use such things.<\/p>\n

\n

So – a bit more info on how this was discerned; it’s very simple. First, download the Smart Update Firmware DVD; they’re free, and I got mine from the\u00a0HP website<\/a>.<\/p>\n

They’re zip files, so extract the ISO (and a couple of other files, md5, readme, etc.) ISO is named “FW920.2010_1021.49.iso”. I’m working on a mac, which on rare occasions actuallly work with me with what I want to do. Most linux\/*nix need to figure out the mount invocation, with a mac it’s just “open filename” and it gets mounted in \/Volumes\/[name].<\/p>\n

A quick copy cp files to writable work area… I’ll call mine zHP920. Just:<\/p>\n

cp -r \/Volumes\/HPFWUP920 zHP920<\/div><\/div>\n

The initrd image is in the systems subdir; it’s a gzip’d cpio file, of all things. I’m sure you all remember your cpio format; you just (cpio probably now has bloated enough to include gzip in it like tar, but you know, I don’t really care):<\/p>\n

gzip < initrd.img > \/tmp\/920initrd.img
\nmkdir \/tmp\/920cpio
\ncd \/tmp\/920cpio
\ncpio -i < \/tmp\/920initrd.img<\/div><\/div>\n

After the trauma of figuring out how they did things in 870 it looked… damn, there’s nothing here. One squashed file system, an init file, some odds and ends….<\/p>\n

I must confess… shell is one thing I don’t mind reading, I’ve written a lot of it in my day. So I see some lines… that… well:<\/p>\n

if [ -n "$(cat \/proc\/cmdline | grep 'initrd-shell')" ] ; then
\n    echo
\n    echo "Dropping to a shell. Good luck!"
\n    echo
\n
\nexec \/bin\/bash
\nfi<\/div><\/div>\n

Could it be that easy? Well… going back to the raw CD, edit the boot config… and edit “system\/isolinux.cfg” – change the line from:<\/p>\n

append vmlinuz initrd=initrd.img media=cdrom rw root=\/dev\/ram0 ramdisk_size=302748 init=\/bin\/init loglevel=3 ide=nodma ide=noraid nopat pnpbios=off vga=791 splash=silent showopts TYPE=AUTOMATIC<\/div><\/div>\n

to this (note the inclusion of “SHELL=initrd-shell”) I figured, what the hell, it looks like it’d work from the context.<\/p>\n

append vmlinuz initrd=initrd.img media=cdrom rw root=\/dev\/ram0 ramdisk_size=302748 init=\/bin\/init loglevel=3 ide=nodma ide=noraid nopat pnpbios=off vga=791 splash=silent showopts SHELL=initrd-shell TYPE=AUTOMATIC<\/div><\/div>\n

Remake the dvd iso (I use something like “mkisofs -o ..\/zhp.iso -N -R -J -joliet-long -b system\/isolinux.bin -c system\/boot.cat -no-emul-boot -boot-load-size 4 -boot-info-table .” in the main directory of the unpacked DVD), burn it, boot… and you get the shell.<\/p>\n

This is not root on the host computer or the BMC, just the CD booted image. However, it has some interesting tidbits for those intersted in such things (ok, yes, few are ;) But just in case there’s one more of me out there!)<\/p>\n


\n\"\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

I’d been playing with them… and since I hadn’t seen this anywhere I’ll put it as a small hack o the day. The disks do what they say (e.g. … install firmware ;)) – basically you burn it to a cd, boot it up, and it has some sort of access to the system. Since […]<\/p>\n","protected":false},"author":44,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[146,6],"tags":[161,160,334,159],"class_list":["post-619","post","type-post","status-publish","format-standard","hentry","category-hack","category-tech","tag-booting","tag-cheap-thrills","tag-hack","tag-hp"],"_links":{"self":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/619","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=619"}],"version-history":[{"count":30,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/619\/revisions"}],"predecessor-version":[{"id":661,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/619\/revisions\/661"}],"wp:attachment":[{"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=619"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=619"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=619"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}