Serial
The MD87050 has a RS323 connection on the processor board close to the hard disk USB B socket. The labelling of the pins seems to be switched, at least in my version.
Telnet
The MD87050 has a telnet server running which is accessible from its own WLAN and the WLAN it is connected to if any.
Credentials
The root credentials are as follows:
- User name:
root
- Password:
20080826
Boot message
MTD layout
cat /proc/mtd
dev: size erasesize name
mtd0: 00800000 00010000 "ALL"
mtd1: 00030000 00010000 "Bootloader"
mtd2: 00010000 00010000 "Config"
mtd3: 00010000 00010000 "Factory"
mtd4: 00180000 00010000 "Kernel_RootFS"
mtd5: 00010000 00010000 "params"
mtd6: 00010000 00010000 "user_backup"
mtd7: 00010000 00010000 "user"
mtd8: 00600000 00010000 "Rootfs"
To back up all the devices insert a fat formatted SD card in the slot and run the following commands.
# dd if=/dev/mtd0 of=/data/UsbDisk1/Volume1/mtd0.img
16384+0 records in
16384+0 records out
# dd if=/dev/mtd1 of=/data/UsbDisk1/Volume1/mtd1.img
384+0 records in
384+0 records out
# dd if=/dev/mtd2 of=/data/UsbDisk1/Volume1/mtd2.img
128+0 records in
128+0 records out
# dd if=/dev/mtd3 of=/data/UsbDisk1/Volume1/mtd3.img
128+0 records in
128+0 records out
# dd if=/dev/mtd4 of=/data/UsbDisk1/Volume1/mtd4.img
3072+0 records in
3072+0 records out
# dd if=/dev/mtd5 of=/data/UsbDisk1/Volume1/mtd5.img
128+0 records in
128+0 records out
# dd if=/dev/mtd6 of=/data/UsbDisk1/Volume1/mtd6.img
128+0 records in
128+0 records out
# dd if=/dev/mtd7 of=/data/UsbDisk1/Volume1/mtd7.img
128+0 records in
128+0 records out
# dd if=/dev/mtd8 of=/data/UsbDisk1/Volume1/mtd8.img
12288+0 records in
12288+0 records out
As seen in the list of MTD devices above mtd0 contains all data. Analysing mtd0.img with binwalk confirms this:
binwalk mtd0.img
DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------
0 0x0 uImage header, header size: 64 bytes, header CRC: 0x72E03075, created: 2013-10-22 01:51:02, image size: 127844 bytes, Data Address: 0x80200000, Entry Point: 0x80200000, data CRC: 0xEEE7DEAB, OS: Linux, CPU: MIPS, image type: Standalone Program, compression type: none, image name: "SPI Flash Image"
104496 0x19830 U-Boot version string, "U-Boot 1.1.3 (Oct 22 2013 - 09:50:58)"
104976 0x19A10 CRC32 polynomial table, little endian
327680 0x50000 uImage header, header size: 64 bytes, header CRC: 0x65E07CA2, created: 2013-11-01 05:36:56, image size: 1442332 bytes, Data Address: 0x80000000, Entry Point: 0x80441000, data CRC: 0x8EFB6500, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "Linux Kernel Image"
327744 0x50040 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 4608121 bytes
2031632 0x1F0010 gzip compressed data, maximum compression, from Unix, last modified: 2017-06-06 09:44:49
2097152 0x200000 Squashfs filesystem, little endian, non-standard signature, version 3.0, size: 4736074 bytes, 1168 inodes, blocksize: 65536 bytes, created: 2013-12-10 09:54:46
A dump of the MTD devices and an extraction of recognisable data using binwalk is available in md87050-mtd-dump.tar.bz2
Sources:
Generated on 2018-05-03 01:14:21.923024