Completely recovering from a “bricked” Buffalo LinkStation LS200-series NAS (and opening the firmware too!)

I recently bought a Buffalo LinkStation LS220 NAS (network-attached storage) device. The device itself is a good quality piece of hardware, but the software leaves a lot to be desired. I bought this NAS purely as a redundant (i.e. RAID1) backup solution and intended to use it as an SSH server for my rsync backup scripts.

Much to my disappointment, however, the firmware came far more locked-down than I had hoped, and provided no means to (easily) enable SSH. In my struggles to find an elegant solution to this, I ended up “bricking” the device, meaning it would no longer boot. To make matters worse, I later found out that the LS220’s recovery features are stored on the disks’ /boot partition, which I had wiped while cleaning down the disks.

The information available online for unbricking and/or opening the firmware of the LS200-series is… sparse. I ended up having to contact Buffalo support in order to rectify everything. Thinking they’d tell me I’d voided my warranty and couldn’t help me as such, I was pleasantly surprised at how helpful they were in providing me TFTP Boot instructions, including all the relevant software and images required.

This post should act as a definitive guide to unbricking your LS200-series. I’ve even provided instructions on how to open up the firmware, enabling SSH, Telnet and more. Note that you will lose all data on your NAS, so perform any backups where possible.

This guide assumes you are running Linux and that your NAS is a LinkStation LS220.

Part 1: Wiping the drives

  1. Open up the front plate on your LS220 and remove both hard drives.
  2. Take a Phillips-head screwdriver and remove the screws on both hard drive mounting plates, so that the drives come away.
  3. Attach the hard drives to your computer. You can do this using a USB-SATA hard drive (3.5″) dock (I bought this one)
    …or, if you have spare SATA and power cables, just connect it directly to your computer’s motherboard.
  4. Open up a terminal and run GNU Parted on the block device representing the connected hard drive. Be careful during this part, as you don’t want to wipe your computer’s primary drive.
    In my case, the NAS drive shows up as /dev/sdb so I run Parted as follows:

    $> sudo parted /dev/sdb
  5. Using the parted print command, we can see that there are six partitions on the NAS drive by default:
    (parted) print
    Number  Start   End     Size ...
    1      17.4kB  1024MB  1024MB ...
    2      1024MB  6144MB  5119MB ...
    3      6144MB  6144MB  394kB ...
    4      6144MB  6144MB  512B ...
    5      6144MB  7168MB  1024MB ...
    6      7168MB  2992GB  2985GB ...
  6. Let’s go ahead and remove all of them:
    (parted) rm 1
    (parted) rm 2
    (parted) rm 3
    (parted) rm 4
    (parted) rm 5
    (parted) rm 6
  7. Great! You can now unplug this hard drive and repeat the above process for the other drive.
  8. Once both drives are done, screw the mounting plates back on to the hard drives and install them back into the NAS.

Part 2: TFTP Boot

This step involves flashing a minimal image to the drives, allowing it to boot into EM Mode. EM Mode allows us to get our final, fully-working firmware image on to the NAS.

Unfortunately, you’ll need a Windows PC for this part. I just ran a Windows 7 VM with a network interface bridged to my host’s eth0 interface.

  1. Connect your PC directly to your NAS with an Ethernet cable.
  2. Plug in and power on your NAS. After a few seconds, the LED on the front will flash red to let you know it failed to boot anything.
  3. The NAS will assign itself an IP address of 192.168.11.150/24. You will need to set Windows to a static IP of 192.168.11.1/24 in order to serve up the TFTP Boot image.
    To do this, open up Control Panel > Network and Sharing Center and click Change adapter settings.
    Right-click your network adapter and click Properties.
    Double-click Internet Protocol Version 4 (TCP/IPv4).
    Choose Use the following IP address and set the below values:

    IP address: 192.168.11.1
    Subnet mask: 255.255.255.0
    Default gateway: (leave blank)

    Then click OK and OK again to leave the Properties screen.

  4. Download the TFTP Boot server and images from the link below. I received these from Buffalo support and am hosting them here for convenience:
    TFTP Boot Recovery LS200
  5. Unzip the downloaded file and launch the TFTP Boot.exe program. The program should tell you its “listening On: 192.168.11.1:69”. If not, you have not configured your network adapter correctly.
    The bottom line should read “accepting requests” with a flashing cursor.
  6. Press the physical Function button on the back of your NAS until the LEDs start flashing white.
    The TFTP Boot window should now output two messages like below:

    Client 192.168.11.150 ... Blocks Served
    Client 192.168.11.150 ... Blocks Served
  7. Great! At this point, your NAS will be booting a minimal image and will boot itself into EM Mode. You can close the TFTP Boot program, as we are done with it now.

Part 3: Opening up the stock firmware image (SSH, Telnet, …)

  1. Download the NAS Navigator program from the link below. This should work in Linux under Wine/Crossover:
    NAS Navigator
  2. Unzip and install the program by running NasNaviInst.exe. Now run the NAS Navigator program.
  3. After a few seconds, your NAS should show up. Note that it is in Emergency mode and has an IP address in the range 169.254.0.0/16.
  4. Repeat the instructions from Part 2, Step 3 above, but this time set an IP address of 169.254.11.1 and a subnet mask of 255.255.0.0

    Very important
    :
    Note the subnet mask’s third number is a 0 (zero) and not 255.
  5. Download and unzip the latest firmware for your device from the Buffalo website below:
    http://www.buffalotech.com/support_and_downloads/downloads
  6. Download and unzip the linkstation-mod tools from GitHub below:
    linkstation-mod 

    You can also clone the repo if you’re comfortable using Git.

  7. Open up a terminal and browse to the linkstation-mod directory. Run the open-ls-rootfs.sh script on the hddrootfs.img file as below.

    Bonus – root login to NAS:
    Add your SSH public key to the “data” directory and rename it id_rsa.key. This will automatically install the key and grant you root access to the NAS.


    Very important: If you are not the root user, you must use sudo to execute the script due to some permissions requirements making /dev files. I spent hours trying to figure out why my LinkStation wouldn’t boot as a result of running this as a regular user.

    $> chmod +x ./scripts/open-ls-rootfs.sh
    $> sudo ./scripts/open-ls-rootfs.sh /path/to/firmware-directory/hddrootfs.img
  8. After the script has completed, you will see a new directory: “out“. Inside this directory is the (hacked/opened) hddrootfs.img file.
    You will need to change the permissions on this back to your regular user. For example, if your username is “aaron”:

    $> sudo chown aaron:aaron ./out/hddrootfs.img

    Copy this new hddrootfs.img file to the firmware directory, overwriting the old version.

  9. Back in Windows (sorry), open up the firmware directory and open up the configuration file LSUpdater.ini. Add the following lines to the bottom to enable Debug Mode:
    [SpecialFlags]
    Debug = 1
  10. Run the LSUpdater.exe program. It should find your NAS. Click the window decoration in the top-left corner and click Debug(D)…Tick and untick the appropriate options until your configuration looks as below:debug_mode
  11. Click OK, then Update. You should now get a pop-up window saying “Formatting”, followed by “Transferring firmware”.

And that’s it! Your LinkStation LS200-series is now fully recovered and is now running an open firmware.

 

This entry was posted in Buffalo LinkStation LS220, Linux and tagged , , , , , , , , , , , , , , , , , , , , , , , . Bookmark the permalink.

36 Responses to Completely recovering from a “bricked” Buffalo LinkStation LS200-series NAS (and opening the firmware too!)

  1. John R says:

    Do you know if this boot image can also be used for the LS400? I cannot find that boot image anywhere.

    • Aaron Hastings says:

      Hi John. It’s unlikely and I wouldn’t chance it. I had bad luck trying to boot other images. If you contact Buffalo support, they should provide you a download link and the rest of these instructions should apply. Hope this helps.

      • John R says:

        Unfortunately, I have contacted them and they were not helpful in the least. As you did, I wiped the drives in an attempt to make repairs and apparently cleaned the images off. They suggested I try the TFTP route, but did not supply any links to LS400 boot images.

        Any ideas?

        • Aaron Hastings says:

          Hmmm… that’s frustrating. Did they give a reason for not providing you with TFTP Boot images? Did you explicitly ask for them? If not, I’d definitely open another case requesting them. I doubted they’d link me to them either, but was pleasantly surprised.

          • John R says:

            Thanks, I was able to find an image for the LS420 through a German Buffalo support site.

            I have successfully completed Parts 1 and 2, but the NAS Navigator cannot find it thereafter in Part 3. (I assume I should still be directly connected to the device with the Ethernet cable when attempting this part.) No matter what I’ve tried, the NAS Navigator never finds the device.

            • Aaron Hastings says:

              Yep, that’s correct. Did you change your IP address to something in the 169.254.0.0/16 range? I usually just go with 169.254.11.1, but it really shouldn’t matter. Also make sure your subnet mask is 255.255.0.0 (note that that’s two zeroes for the last two digits in the IP address).

              • John R says:

                Yes, I’ve made it 169.254.11.1 and also tried 169.254.0.1…subnet mask def right too…..firewall is turned off.

                • Aaron Hastings says:

                  Okay, from my personal experience of trying “the wrong TFTP Boot image”, this usually means the NAS failed to boot into EM Mode as expected. In this case, I’d definitely go back to Buffalo support and explain where you’ve gotten so far. Make sure you persist with this, because they should definitely be able to provide you with the right images.

            • Fly says:

              Hello can you pout link for downloading the TFTP image for the LS420?
              Thanks

              • Aaron Hastings says:

                Woops, apologies, I responded to this originally thinking you said LS220. Hopefully you’ll be able to get a response from the other commenter.

      • Michail says:

        A good NAS -server should just work, at least 2 years, as long guaranty is valid.
        One shouldn’t need to tweak and trick with different solutions if manufacturer support his products properly.
        Unfortunately BUFFALO isn’t that kind od manufacturer who’s covering all products equally and as such is best to avoid it. BUFFALO = trouble !!!

  2. ilkka says:

    can anyone please say what exactly is mount directory for shared directories in 220 model? it is something like /mnt/something/shared-directory-name?

    I need this because I am trying to install utelnetd by copying it to shared directory. I meshed up the ssh (it doesnot run for some reason), so I need telnet access.

    • Aaron Hastings says:

      Hi. It should be /mnt/array1/[whatever]. You can verify this by running the lsblk command.

  3. John R says:

    Thanks for your time…..here is their response when I asked for a link to the right boot image:

    Dear John,

    Thank you for contacting Buffalo Support.

    Unfortunately, we do not support TFTP imaging. You may find suggestions from user contributions in the forum.

    If you have any questions, you may also contact us 24/7 at (866)752-6210.

    Buffalo Support Email is intended for non-critical support for customers in the United States and Canada. Any replies to this response will be handled in the order it was received. If you have an urgent issue that requires immediate attention, please contact our 24×7 support center at (866)752-6210.

    Thanks,

    Ronald Parrish
    Technical Support Associate
    Buffalo Americas
    (866) 752-6210

    • Aaron Hastings says:

      Urk… seems like one of those situations where it depends on who you talk to. In my case I contacted their European (UK?) support. It’s a ticketing system where you open a case with them. Maybe you’ll have better luck with them? Can’t hurt to try anyway! Sorry I can’t be of more help.

      • John R says:

        No worries, I do appreciate your time.

        • Daniel V says:

          Were you able to get your LinkStation to work again? I own a LS420D. Upgraded both hard drives and formatted the old ones. It seems I’m able to through the device away now…

          • Aaron Hastings says:

            I’m very hopeful that there’s a way. Daniel, have you attempted contacting Buffalo support as I did for my issue? Once you have the TFTP Boot images, there should be little stopping you!

  4. cb22 says:

    did you ever get rsync to work?

    • Aaron Hastings says:

      Hey Chris. Once SSH is enabled, it’s possible to use rsync-over-SSH. This is what I was using.

  5. Rick says:

    Hi, Very interesting read.
    I was wondering if you knew if gaining Root access/Enabling SSH was only possible from EM mode?
    I was hoping to to enable SSH/Root access, but I have a fully functional LS220. If I followed the above from step 3 could I expect the same end result???
    Thanks

    • Aaron Hastings says:

      Hi Rick – thanks for the comment – glad you found it interesting. Hmmm… from my many attempts at trying to get SSH/root on the LS220, I don’t recall finding a reliable way of doing so. There’s tutorials for getting SSH/root on other Buffalo NAS systems, but I wasn’t able to get any of them working with the LS220.

      Hope that helps,
      Aaron

  6. Rick says:

    Sorry I am a little confused here,
    “This post should act as a definitive guide to unbricking your LS200-series. I’ve even provided instructions on how to open up the firmware, enabling SSH, Telnet and more. Note that you will lose all data on your NAS, so perform any backups where possible.

    This guide assumes you are running Linux and that your NAS is a LinkStation LS220.”

    That is the model I have. Well, mine is a Link Station LS220DE.

    I was just wondering if “opening” the firmware was possible from part 3 with a working unit. Meaning enabling SSH , TelNet. In the article you stated that yours was bricked. I was just curious if this had to be done from EM mode.
    Other wise I am very confused, as I thought that is what this article in part was about,unless I have read it wrong.
    Thanks for your time!!

    • Rick says:

      Sorry, I think I misunderstood you twice! I think you meant SSH with Root access??
      Basically I am having the “can’t delete files created with Transmission” issue. I could fix it in two seconds if I had root access. I am currently going through the painful process of re-adding the torrent files so i can delete via the Transmission interface! Ugh! Never had this issue with my woefully underpowered NAS-berry Pi setup!!
      Thanks again!

      • Aaron Hastings says:

        Hi Rick. Apologies for the misunderstanding. Yes, SSH with root access is what this guide enables you to do. From what I understand, enabling SSH with root is only possible with flashing a slightly customised firmware with this enabled. This is what I do in this guide. I know there are tools like ACP Commander which allow some root’ing, but I didn’t find them very reliable.

  7. Alex Lennon says:

    Lovely bit of work. Worked like a charm. Thanks!

  8. Nino says:

    Thanks for the post Aaron

    Did you look at bootstrapping the device and getting ipkg on there?

    http://buffalo.nas-central.org/wiki/Ipkg_on_the_Linkstation_(for_end-users)

    I have it working but the SSL libraries are way out of date and there doesn’t seem to be a suitable toolchain to compile new versions.

    • Aaron Hastings says:

      And thank you for the comment, Nino! To answer your question, I did indeed. ipkg is nice but it was missing a lot of what I would expect from, say, a standard Linux distribution’s package repos. Still, it was nice to be able to install the GNU Coreutils!

      Ah yes, another issue. I tried to install something from source once and ran into a big mess of dependency chains. Trying to compile everything I needed on the tiny little CPU of the LS220 was… unenjoyable…

  9. Christian Wikander says:

    Tried parts of this at home this weekend. My goal is to enable rsync so that I can backup my other NAS to this one.

    Downloaded the latest firmware for my LS220D0602 NAS, modified the hddrootfs.img including adding my public key (generated using PuttyGen on a Windows PC). After updating the firmware on my LS220 it boots into EM mode. I can get it back into working order by uploading the latest firmware to it, but the modified one won’t work.

    Are there limitations to what versions of the firmware the linkstation-mod scripts will work with? Will I be able to rsync even if I don’t add my SSH public key?

    • Aaron Hastings says:

      Hi Christian. It’s been so long since I did any of this that I’m not sure if those scripts still work. I don’t think I can be much use beyond the blog post, unfortunately. I just gave up on trying to hack the LS220 into working how I needed.

      • Christian Wikander says:

        I actually solved it.
        It actually had to do with which checkboxes you checked in the debug window in LSUpdater.
        According to the documentation of linkstation-mod you need to check Update rootfs if you’ve run the open-ls-rootfs script.
        So now my LS220D is running the modified firmware and I can SSH into it. It didn’t pick up my public key though, so I still need to investigate that, but I might as well use a VPN link between my networks instead.

        • Aaron Hastings says:

          Excellent, thanks for the update, Christian! Glad to know it’s working now. I don’t remember if I ever get my SSH key to work reliably.

  10. André says:

    You. I like you. Thanks for your help!

  11. Nate Nettrouer says:

    Aaron,
    I am new to this and trying to figure out how to do Part 3 step 7. I am not sure what all I am supposed to type in the terminal window. I am not running Linux, I just have windows. Feel free to email me with any questions.

    • Aaron Hastings says:

      Hey Nate. Sorry for the delay. For some reason this comment got caught in my spam filter. You should be able to download Cygwin, which is a Bash/Linux terminal and run it from that.

Leave a Reply

Your email address will not be published. Required fields are marked *