OpenFrame 2: Recover from 'Upgrade'

Post by **roobarb!** » Thu Aug 09, 2012 10:20 am

The Story So Far

As a quick recap for those that don't already know, BuZz very kindly sent me an OpenFrame 2 recently. I powered it up and it was wonderful. You'll notice on that video that it attempted an update, and I powered it off before it had chance.

I took backups of the internal files (it booted from USB perfectly) and noticed it was reporting itself as an 'openpeaksdk' device. So in order to grab as many apps for the native OS as possible, I decided to let it complete it's update. Where's the harm?

When it rebooted, instead of an OpenPeak logo, there was a Telio logo. I wasn't keen, but hey, I could put that right later. It landed at a Telio-branded mush-up of the OpenPeak OS. It was half Danish, half English. Telnet wasn't working. SSH wasn't working. Not very impressive. So I decided to boot back into my maintenance Ubuntu build and take a copy of the files.

It wouldn't boot from USB.

It intermittently responded to the mash-ESC-repeatedly-to-get-to-EFI. It wouldn't boot from anything (fs1, fs2, fs3, etc) except fs0.

Hell.

And that's where we are today. Telio Touch branded, and seemingly completely locked down. There's a copy of a file called 'app-telio-30005.8931-S4-f2-reimage.tgz' that it upgraded from, which I managed to copy to /media before it shut down - but of course, I can't access it. There should also be a backup of the OpenPeak EFI on there, but I'll not trust that as I took it while the update was being applied.

Also, I can't figure out how the heck you open the thing. No visible screws, nothing under the sticker... just four mysterious holes near the rubber feet. No, no screws under the feet, either.

Help!

I'm going to document, at least briefly, what I go through to try and get this thing back to the state it was in the video. If you have any words of advice, ideas, anything at all - please jump in and say. If you can't say publicly, please send me a PM - anonymity assured! I just want to get this thing back up and running properly again. And Telio... if you told OpenPeak to lock this thing down so much, shame on you. Bad company.

There are three roads I'll try. The first is to keep trying with the EFI startup and get an external OS running again. That would be ideal. Second, attempt to get into the Telio OS in some way; I'm going to go back through the old Joggler hacking documentation and see what can be done. Third and finally... open the thing up and see if the EFI chip can be swapped.

Wish me luck!

Post by **BuZz** » Thu Aug 09, 2012 1:31 pm

good luck! I have a telio branded one here btw, so I mnight be able to help (we can certainly use it to find out where it gets the update from), i can lend you another one also to help with recovery if you promise not to brick it

I'm off camping for a few days so it will have to wait until next week mind.

Post by **roobarb!** » Thu Aug 09, 2012 5:10 pm

Thanks, BuZz! Good to know I'm not on my own!

Do either of the ones you have boot with the OpenPeak logo, or are they both Telio booters? I really hope I managed to nabble the OpenPeak EFI before it was overwritten.

danfoshizzle · Post by **danfoshizzle** » Thu Aug 09, 2012 5:11 pm

Good luck dude!

Post by **roobarb!** » Fri Aug 10, 2012 10:11 am

Hmm. I've had an idea. It's still going to be tricky, but it might be more straightforward than building and spoofing an update server. Just need to get Wireshark working properly on this PC first...

jazzmista · Post by **jazzmista** » Sun Aug 12, 2012 8:57 pm

Hey roobarb,

I've got an OpenPeak branded one (from another source) if you want to use the files from that? I've only just got back off holiday so I didn't see the thread before now :S

Post by **roobarb!** » Mon Aug 13, 2012 12:06 am

jazzmista wrote:Hey roobarb,

I've got an OpenPeak branded one (from another source) if you want to use the files from that? I've only just got back off holiday so I didn't see the thread before now :S

It's OpenPeak branded immediately from startup? If so, yes please!

Are you happy reading a copy of your EFI boot chip? That's the bit I really need, as I don't know if I can trust the backup I made.

jazzmista · Post by **jazzmista** » Mon Aug 13, 2012 10:19 am

roobarb! wrote:
jazzmista wrote:Hey roobarb,

I've got an OpenPeak branded one (from another source) if you want to use the files from that? I've only just got back off holiday so I didn't see the thread before now :S
It's OpenPeak branded immediately from startup? If so, yes please!

Are you happy reading a copy of your EFI boot chip? That's the bit I really need, as I don't know if I can trust the backup I made.

I'm really sorry, I completely forgot - it's Cisco branded (and displays a Cisco logo at boot). Still boots from USB though and I haven't updated the original software (in fact, I don't think it's been booted into the original software yet as I'm trying to get the wireless drivers working on Android!)

Post by **roobarb!** » Mon Aug 13, 2012 12:21 pm

jazzmista wrote:
roobarb! wrote:
jazzmista wrote:Hey roobarb,

I've got an OpenPeak branded one (from another source) if you want to use the files from that? I've only just got back off holiday so I didn't see the thread before now :S
It's OpenPeak branded immediately from startup? If so, yes please!

Are you happy reading a copy of your EFI boot chip? That's the bit I really need, as I don't know if I can trust the backup I made.
I'm really sorry, I completely forgot - it's Cisco branded (and displays a Cisco logo at boot). Still boots from USB though and I haven't updated the original software (in fact, I don't think it's been booted into the original software yet as I'm trying to get the wireless drivers working on Android!)

Cisco branded would be fine - anything that boots from USB would be fine!

I don't suppose you know how you open the case, by any chance? I'm looking at it, but there are no screws and only four mysterious holes in the bottom.

jazzmista · Post by **jazzmista** » Mon Aug 13, 2012 12:25 pm

I'm afraid not

Seen as this is my only unit I've decided not to try and play around with the internals - apparently they are notoriously hard to put back togther again!

Post by **roobarb!** » Mon Aug 13, 2012 12:32 pm

Heck - bit different to the standard Joggler, then.

I've not managed to find any way in to this unit through software so far. I was hoping to use the App Shop as a vehicle for installing an app that would fire up telnet, but it seems to be fetching the app list over HTTPS and only the icons are downloaded over HTTP. I'm not sure I could get an icon to run any code that would start telnet.

I'm guessing that the EFI route is a no-go if they've locked it down to only load from fs0? Can anyone think of a way of making a USB device appear as fs0? Without opening the case, of course... if I can open the case, hopefully I can just swap the EFI chip.

jazzmista · Post by **jazzmista** » Mon Aug 13, 2012 12:43 pm

roobarb! wrote:Heck - bit different to the standard Joggler, then.

I've not managed to find any way in to this unit through software so far. I was hoping to use the App Shop as a vehicle for installing an app that would fire up telnet, but it seems to be fetching the app list over HTTPS and only the icons are downloaded over HTTP. I'm not sure I could get an icon to run any code that would start telnet.

I'm guessing that the EFI route is a no-go if they've locked it down to only load from fs0? Can anyone think of a way of making a USB device appear as fs0? Without opening the case, of course... if I can open the case, hopefully I can just swap the EFI chip.

Sorry, I'm not really up to speed with stock OS development - what are the icons downloaded as? If you can get it to download an icon as a .swf then it should be possible, shouldn't it?

Post by **roobarb!** » Mon Aug 13, 2012 12:53 pm

jazzmista wrote:
roobarb! wrote:Heck - bit different to the standard Joggler, then.

I've not managed to find any way in to this unit through software so far. I was hoping to use the App Shop as a vehicle for installing an app that would fire up telnet, but it seems to be fetching the app list over HTTPS and only the icons are downloaded over HTTP. I'm not sure I could get an icon to run any code that would start telnet.

I'm guessing that the EFI route is a no-go if they've locked it down to only load from fs0? Can anyone think of a way of making a USB device appear as fs0? Without opening the case, of course... if I can open the case, hopefully I can just swap the EFI chip.
Sorry, I'm not really up to speed with stock OS development - what are the icons downloaded as? If you can get it to download an icon as a .swf then it should be possible, shouldn't it?

The icons are downloaded as .swf files... maybe you're right, it might work after all. I just need to make myself a .swf that runs the telnet binary. This may be a problem for me - I've always stayed well away from Flash!

Post by **roobarb!** » Mon Aug 13, 2012 1:11 pm

Ah, but how to spoof one file on a server. It's easy enough to redirect the entire server to a new location, but one file..?

jazzmista · Post by **jazzmista** » Mon Aug 13, 2012 1:13 pm

roobarb! wrote: The icons are downloaded as .swf files... maybe you're right, it might work after all. I just need to make myself a .swf that runs the telnet binary. This may be a problem for me - I've always stayed well away from Flash!

I've looked at it once or twice for game development - and then I decided to use HTML5 instead! I presume all it needs to do is download the telnet library and run it? If so, it should be fairly easy to create. You can get a non-commercial copy of Flash Builder 4.6 (https://freeriatools.adobe.com/) if you are a student like me (have to upload verification I think - can't remember) or if you are unemployed (but it doesn't actually check). Alternatively, I've used FlashDevelop (http://www.flashdevelop.org/) in the past and it's pretty good. I'd quite like to work on this as well (with my extremely limited AS3 knowledge) so should I set up a GitHub repo?

jazzmista · Post by **jazzmista** » Mon Aug 13, 2012 1:14 pm

roobarb! wrote:Ah, but how to spoof one file on a server. It's easy enough to redirect the entire server to a new location, but one file..?

Does it pull the apps and icons from the same server?

Post by **roobarb!** » Mon Aug 13, 2012 1:22 pm

jazzmista wrote:
roobarb! wrote:Ah, but how to spoof one file on a server. It's easy enough to redirect the entire server to a new location, but one file..?
Does it pull the apps and icons from the same server?

Seems to, yes. It looks at op01.openpeak.net and does some stuff over HTTPS. Then it starts grabbing icons from http://op01.openpeak.net/telio/uploads/ ... ppshop.swf, http://op01.openpeak.net/telio/uploads/ ... ppshop.swf, http://op01.openpeak.net/telio/uploads/ ... ppshop.swf, etc...

jazzmista · Post by **jazzmista** » Mon Aug 13, 2012 1:27 pm

roobarb! wrote:
jazzmista wrote:
roobarb! wrote:Ah, but how to spoof one file on a server. It's easy enough to redirect the entire server to a new location, but one file..?
Does it pull the apps and icons from the same server?
Seems to, yes. It looks at op01.openpeak.net and does some stuff over HTTPS. Then it starts grabbing icons from http://op01.openpeak.net/telio/uploads/ ... ppshop.swf, http://op01.openpeak.net/telio/uploads/ ... ppshop.swf, http://op01.openpeak.net/telio/uploads/ ... ppshop.swf, etc...

Hmm... if we can find a way to download the contents of http://op01.openpeak.net/telio/uploads/ (and the https:// part) we can try and recreate the server on localhost to add our own swf.

Also, I've just found this... http://op01.openpeak.net/telio - going to do some digging. The swf is found at http://op01.openpeak.net/telio/main.swf

Post by **roobarb!** » Mon Aug 13, 2012 1:30 pm

jazzmista wrote:
roobarb! wrote: The icons are downloaded as .swf files... maybe you're right, it might work after all. I just need to make myself a .swf that runs the telnet binary. This may be a problem for me - I've always stayed well away from Flash!
I've looked at it once or twice for game development - and then I decided to use HTML5 instead! I presume all it needs to do is download the telnet library and run it? If so, it should be fairly easy to create. You can get a non-commercial copy of Flash Builder 4.6 (https://freeriatools.adobe.com/) if you are a student like me (have to upload verification I think - can't remember) or if you are unemployed (but it doesn't actually check). Alternatively, I've used FlashDevelop (http://www.flashdevelop.org/) in the past and it's pretty good. I'd quite like to work on this as well (with my extremely limited AS3 knowledge) so should I set up a GitHub repo?

I've submitted an application for the free Adobe tools (up to 2 weeks to wait, so it says) and I'll take a peek at FlashDevelop. I've got Adobe Flash CS3 at home, but can't grab it from here.

It may not even need to fetch the telnet binary - it's part of busybox, so literally all the app needs to do is shout 'telnetd' in an executable way.

Post by **BuZz** » Mon Aug 13, 2012 1:31 pm

there is also the http://op01.openpeak.net/openpeak/ app shop.

O2 Joggler Forum