Posts Tagged Open Stock Firmware

Opening Stock Firmware of LinkStation LS421DE

The purpose for opening a stock firmware is to gain root access to LinkStation. With root access, several additional softwares can be added to the firmware, e.g: using optware package. Furthermore, a custom operating system can be used to replace the Buffalo stock firmware such as Debian.

This process based on existing method on, tested on LS421DE:

  1. Download the tools from
    $ mkdir ~/lsmod
    $ cd ~/lsmod
    $ wget
    $ unzip
    $ cd linkstation-mod-master
  2. Get the Buffalo stock firmware from, the latest firmware as of this writing is 1.33.
    $ mkdir firmware
    $ cd firmware
    $ wget
    $ unzip

    After unzip process, the firmware can be found on the ~/lsmod/linkstation-mod-master/firmware/ls400-133en/ folder.

  3. Prepare SSH public key for login authentication.
    If you’re already using a linux box, simply copy or to data folder.

    $ cd ~/lsmod/linkstation-mod-master
    $ cp ~/.ssh/ data/id_dsa.key

    On windows box, use puTTYgen to generate SSH private/public key pair. Refer to for an example. After the key generation is complete, do not close the puTTYgen window, rather select all the text in the generated public key, press Ctrl+C to copy the content and paste it as text file in notepad and save the file with .key extension. You then can copy the file to linux box using WinSCP for example and put in the data folder.

  4. Execute the script to open the stock firmware.
    $ sudo ./scripts/ firmware/ls400-133en/hddrootfs.img
    Opening stock firmware ROOTFS of firmware/ls400-133en/hddrootfs.img.
    > Preparing directories...
    > Unpacking ROOTFS image...
      Using password 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l.
    > Extracting ROOTFS...
    > Removing root password...
      Removing root password from initfile backup.
      Removing root password from shadow file.
    > Allowing root login via telnet and ssh...
      Enabling SSHD service.
    > Adding ssh key...
    > Creating emergency script service...
    > Package ROOTFS...
      Opened ROOTFS image saved in /home/toha/lsmod/linkstation-mod-master/out/hddrootfs.img.

    Additionally, you can add features by editing data/nas_features and issue the following command:

    $ sudo ./scripts/ firmware/ls400-133en/initrd.img
    Opening stock firmware INITRD of firmware/ls400-133en/initrd.img.
    > Preparing directories...
    > Unpacking INITRD image...
      Using password 1NIf_2yUOlRDpYZUVNqboRpMBoZwT4PzoUvOPUp6l.
    > Extracting INITRD using cpio...
    > Enable SFTP in nas_features...
    > Patching nas_features...
      Applying patch from /home/toha/lsmod/linkstation-mod-master/data/nas_features.
    > Removing root password...
    > Create and package INITRD...
      Opened INITRD image saved in /home/toha/lsmod/linkstation-mod-master/out/initrd.img.

    The opened firmware image can be found on ~/lsmod/linkstation-mod-master/out/ folder named as hddrootfs.img and initrd.img.

  5. Re-flash the modified firmware.
    You need a windows box (or Machintosh) to flash Buffalo firmware. Copy and replace original firmware with the opened firmware from previous step.
    Append the following lines to LSUpdater.ini

    Debug = 1

    Execute LSUpdater.exe, activate debug mode by clicking in the upper left corner (see figure below).
    In the Debug Mode dialog, tick the following options:

    • Config: Do not check version
    • Config: Force update
    • Update: Update rootfs
    • Update: Update initrd (only if you add features to initrd image)

    Next, perform update process by clicking the Update button. After update process is done you can SSH-ing to the box using root.


, ,