Hacking COMPLETED Fusee-LEDE Dongle (6$ payload injector)

[Huntereb]

have you tried just sda without a number?

Yes, and again no dice.

Is it a usb 3 flash drive? Theoretically it's supposed to be backwards compatible with usb 2, but if the port on the router is a cheapo one, there might be some issues.
I can't think of anything else, really. Have you tried booting it with the drive inserted and then mounting?

I have tried multiple USB flashdrives, all of which have a similar behavior. I have attempted to boot with the device inserted, and as soon as the device successfully boots, the light on it turns off.

Just as an FYI, I am using the device with a built in battery.

 

[OkazakiTheOtaku]

Yes, and again no dice.
I have tried multiple USB flashdrives, all of which have a similar behavior. I have attempted to boot with the device inserted, and as soon as the device successfully boots, the light on it turns off.

Weird...I don't know then.

Just as an FYI, I am using the device with a built in battery.

Ah, ok. I'm just using the one linked in the OP so maybe there's some weird difference with yours? I don't know, sorry
I use unix-like operating systems a lot but never on small dedicated devices like this so it's a little out of my area of expertise. Maybe someone else can chime in and see why the drives aren't getting detected

 

[Wierd_w]

Stupid question, but does /mnt exist?

Do:

cd /
ls

and see if /mnt even exists. If it does not, make it yourself then try again.

mkdir /mnt
mount -t fat32 /dev/sda1 /mnt


--Oh, also-- if /mnt exists, but is not empty, you can have problems. You should only ever mount on an empty directory. you might try making a folder inside /mnt and mounting there, then adjusting accordingly.

 

[Huntereb]

Stupid question, but does /mnt exist?

It does, and it is empty.

 

[Wierd_w]

It does, and it is empty.

Ok, insert and remove the device, then immediately afterward, get the last bit of dmesg. I want to see it. You mention blinking lights that turn off. I want to be sure that the dongle is properly loading the mass storage driver.

If we determine that it is in fact properly loading the driver, then we can try passing the filesystem type to the mount command with -t. eg

mount -t fat32 /dev/sda1 /mnt

 

[Huntereb]

Ok, insert and remove the device, then immediately afterward, get the last bit of dmesg.

There is no dmesg within /var/logs. Remember that this is the default factory "qualcomm" firmware.

 

[Wierd_w]

There is no dmesg within /var/logs. Remember that this is the default factory "qualcomm" firmware.

I just checked on my actual bonafide linux, and there is no /var/log/dmesg there either.

Instead, just run

dmesg

and collect the last bit of the output.

 

[Huntereb]

Instead, just run

dmesg

and collect the last bit of the output.

# dmesg
-sh: dmesg: not found

Thank you for the help by the way. If this cannot be done through USB, is there perhaps another way of loading the firmware? Here's a dump of the binaries within /bin:

tip               iptables          ated              umodem-down
mii_mgr           sleep             syslogc           g++-uc
iwpriv            mkdir             mount             reg
pppd              iwlist            cp                gpio
ntfs-3g           sh                date              echo
ls                nvram_set         mount.ntfs-3g     mknod
wifi_client       usb_modeswitch    rt2860apd         rmdir
ralink_init       iwspy             ntpclient         busybox
nvram_get         iwscan            cat               goahead
chmod             umount            brctl             switch
sync              ping              kill              umodem
touch             grep              stty              rm
sed               mv                rtinicapd         login
umodem-up         samba.sh          dnsmasq           ez-ipupdate
hostname          mtd_write         ethtool
ps                chat              lld2d
samba_add_dir.sh  ash               nvram_daemon

 

[Wierd_w]

# dmesg
-sh: dmesg: not found

Thank you for the help by the way. If this cannot be done through USB, is there perhaps another way of loading the firmware? Here's a dump of the binaries within /bin:

tip               iptables          ated              umodem-down
mii_mgr           sleep             syslogc           g++-uc
iwpriv            mkdir             mount             reg
pppd              iwlist            cp                gpio
ntfs-3g           sh                date              echo
ls                nvram_set         mount.ntfs-3g     mknod
wifi_client       usb_modeswitch    rt2860apd         rmdir
ralink_init       iwspy             ntpclient         busybox
nvram_get         iwscan            cat               goahead
chmod             umount            brctl             switch
sync              ping              kill              umodem
touch             grep              stty              rm
sed               mv                rtinicapd         login
umodem-up         samba.sh          dnsmasq           ez-ipupdate
hostname          mtd_write         ethtool
ps                chat              lld2d
samba_add_dir.sh  ash               nvram_daemon

Give me listings on these locations as well:

/usr/bin
/usr/sbin
/sbin

 

[Huntereb]

Give me listings on these locations as well:

/usr/bin
/usr/sbin
/sbin

# ls /usr/bin
logger      awk         eject       tail        [
[[          uptime      test        free        dumpleases
top         expr        wc          killall
# ls /usr/sbin
chpasswd   udhcpd     telnetd    brctl      dhcprelay
# ls /sbin
chpasswd.sh          config-l2tp.sh       ppp-on
lan.sh               nmbd                 klogd
poweroff             vconfig              modprobe
vpn-passthru.sh      firewall.sh          ntp-init.sh
global.sh            ppp-off              udhcpc
config-igmpproxy.sh  config-pptp.sh       config.sh
upnp-reset.sh        insmod               config-vlan.sh
nat.sh               init                 udhcpc.sh
wifi_unload.sh       ppp-udhcpc.sh        smbd
automount.sh         rmmod                logread
config-dns.sh        ntp.sh               dhcpd-reset.sh
smbpasswd            lsmod                mdev
ifconfig             reboot               internet.sh
route                greenap.sh           pppoe.sh
halt                 mkdosfs              ddns.sh
storage.sh           igmpproxy-reset.sh   wan.sh
syslogd              config-udhcpd.sh
udhcpc1.sh           config-pppoe.sh

 

[Wierd_w]

Looks like we have only 2 possible means of getting it onto the device while it is running.

Copy it onto a samba share (backed by tmpfs?)
Copy it onto a tmpfs backed folder with sftp (using something like winscp, or "connect to server" on linux with type of ssh.)


OH WAIT- there's busybox! See what applets are baked in!

busybox

with no arguments.

 

[Huntereb]

Copy it onto a samba share (backed by tmpfs?)
Copy it onto a tmpfs backed folder with sftp (using something like winscp, or "connect to server" on linux with type of ssh.)

Can I connect to this device with sftp? Mounting a tempfs and copying to that seems like a good plan.

 

[Wierd_w]

Can I connect to this device with sftp? Mounting a tempfs and copying to that seems like a good plan.

See if busybox has wget baked in. You might just be able to directly download it over the console into a tmpfs backed folder.

 

[Huntereb]

See if busybox has wget baked in. You might just be able to directly download it over the console into a tmpfs backed folder.

It does not. Could I possibly pipe the entire file over telnet with "echo ... > file"? I'd probably hit a character limit for telnet or something.

 

[Wierd_w]

It does not. Could I possibly pipe the entire file over telnet with "echo ... > file"? I'd probably hit a character limit for telnet or something.

I would pipe it with rsh'd tar if I were to try that. Netcat is the proper tool, but does not exist. (I dont see tar either, but I dont know what applets are baked into busybox.)

 

[Huntereb]

I would pipe it with rsh'd tar if I were to try that. Netcat is the proper tool, but does not exist. (I dont see tar either, but I dont know what applets are baked into busybox.)

Yep, no tar. This is a total bummer. I'm able to plug in a USB hub into the thing and plug my flashdrive into that and it stays on, so it's certainly not a power issue. This is the software purposely cutting the USB off.

 

[Wierd_w]

Yep, no tar. This is a total bummer. I'm able to plug in a USB hub into the thing and plug my flashdrive into that and it stays on, so it's certainly not a power issue. This is the software purposely cutting the USB off.

I really want to know what lives inside busybox. Just run it without any arguments, it will spit out a list of baked in applets.

If it contains mount, try using busybox's mount command instead of the native one. Sometimes the native mount command is dodgy on embedded systems.


If push comes to shove, we can *DEFINATELY* push it over SMB. smbd and smpasswd exist. That means we can create a tmpfs backed location, and manually edit smbd.conf with a public share at that location, then restart smbd. We could then push it over the network that way. pain in the ass, but it is definately an available option from what I see.

 

[Huntereb]

If it contains mount, try using busybox's mount command instead of the native one. Sometimes the native mount command is dodgy on embedded systems.

Same outcome, pretty certain it's already using busybox's mount.

Here are the commands busybox is packaged with:

        [, [[, ash, awk, brctl, cat, chmod, chpasswd, cp, date, dhcprelay,
        dumpleases, echo, eject, expr, free, grep, halt, hostname, ifconfig,
        init, init, insmod, kill, killall, klogd, logger, login, logread,
        ls, lsmod, mdev, mkdir, mknod, modprobe, mount, mv, ping, poweroff,
        ps, reboot, rm, rmdir, rmmod, route, sed, sh, sleep, stty, sync,
        syslogd, tail, telnetd, test, top, touch, udhcpc, udhcpd, umount,
        uptime, vconfig, wc

 

[Wierd_w]

wow. They really dont want you having any tools to work with do they?

Fully serious about trying to use busybox's mount instead of the native mount.

busybox mount -t fat32 /dev/sda1 /mnt

See if you get love from that.

 

[Huntereb]

See if you get love from that.

I had already ran busybox's mount with the type flag as you suggested, it has the same output as before.