关于buffalo TS5000系列高端机器ROOT问题，思路已经有了

国外大神弄差不多同款机器（LS400）的思路是：解包固件，改代码，打包回去，强刷。
解包修改打包都有现成的源码，不过仅对LS400系列的有效


原文链接（需走天桥访问，走不了的看下面的截图）：https://tohenk.wordpress.com/201 ... inkstation-ls421de/




使用到的工具包下载：https://github.com/tohenk/linkstation-mod/archive/master.zip



./scripts/open-ls-rootfs.sh内容

1. #!/bin/bash
   
2. 
   
3. # Original script from http://buffalo.nas-central.org/wiki/Open_Stock_Firmware_LS-XHL
   
4. # Modified by Toha <tohenk@yahoo.com>
   
5. 
   
6. # check for parameters
   
7. if [ $# -ne 1 ]; then
   
8.   echo "You have to specify the filename of the firmware zip-file!\n"
   
9.   exit 1
   
10. fi
    
11. if [ ! -f "$1" ]; then
    
12.   echo "File not found $1.\n"
    
13.   exit 1
    
14. fi
    
15. 
    
16. MYDIR=`dirname $0`
    
17. MYDIR=`pushd $MYDIR > /dev/null && pwd -P && popd > /dev/null`
    
18. ROOT=`pwd`
    
19. OUTDIR=$ROOT/out
    
20. TMP=$ROOT/tmp
    
21. ORIGINAL=$TMP/ORIG
    
22. ROOTFS=$TMP/ROOTFS
    
23. ROOTFS_IMG_NAME=hddrootfs.img
    
24. ROOTFS_FILE_NAME=hddrootfs.buffalo.updated
    
25. FIRMWARE=$1
    
26. 
    
27. . $MYDIR/ls-functions.sh
    
28. 
    
29. do_prep_dirs() {
    
30.   show_msg "Preparing directories"
    
31.   local DIRS="$ORIGINAL $ROOTFS"
    
32.   for D in $DIRS; do
    
33.     clean_dir "$D"
    
34.   done
    
35.   mkdir -p "$OUTDIR"
    
36. }
    
37. 
    
38. do_unpack_firmware() {
    
39.   show_msg "Unpacking firmware"
    
40.   ROOTFS_IMG=`unpack_firmware "$TMP" "$FIRMWARE" "$ROOTFS_IMG_NAME"`
    
41.   if [ -n "$ROOTFS_IMG" ]; then
    
42.     show_info "Found ROOTFS image: $ROOTFS_IMG."
    
43.   else
    
44.     show_info "No ROOTFS image found! May be it not a valid LinkStation firmware.\n"
    
45.   fi
    
46. }
    
47. 
    
48. do_unpack_rootfs() {
    
49.   show_msg "Unpacking ROOTFS image"
    
50.   PASSWORD=`unpack_buffalo_image "$ORIGINAL" "$ROOTFS_IMG"`
    
51.   if [ -n "$PASSWORD" ]; then
    
52.     show_info "Using password $PASSWORD."
    
53.   else
    
54.     show_info "Can't unpack ROOTFS image, no password matched.\n"
    
55.   fi
    
56. }
    
57. 
    
58. do_extract_rootfs() {
    
59.   show_msg "Extracting ROOTFS"
    
60.   extract_rootfs "$ROOTFS" "$ORIGINAL/$ROOTFS_FILE_NAME"
    
61. }
    
62. 
    
63. do_remove_root_password() {
    
64.   show_msg "Removing root password"
    
65.   INITFILE="$ROOTFS/root/.files/initfile.tar.gz"
    
66.   INITFILE_NEW="$ROOTFS/root/.files/new.initfile.tar.gz"
    
67.   if [ -f "$INITFILE" ]; then
    
68.     show_info "Removing root password from initfile backup."
    
69.     INITFILE_TMP=$TMP/INITFILE
    
70.     extract_rootfs "$INITFILE_TMP" "$INITFILE"
    
71.     remove_root_password "$INITFILE_TMP/etc/shadow"
    
72.     package_rootfs "$INITFILE_TMP" "$INITFILE_NEW"
    
73.     mv "$INITFILE_NEW" "$INITFILE"
    
74.   fi
    
75.   show_info "Removing root password from shadow file."
    
76.   remove_root_password "$ROOTFS/etc/shadow" "$ROOTFS/etc/shadow~~"
    
77.   chmod 0644 "$ROOTFS/etc/shadow"
    
78. }
    
79. 
    
80. do_create_emergency_script() {
    
81.   show_msg "Creating emergency script service"
    
82.   local EMERG_SCRIPT="$ROOTFS/etc/rc.d/extensions.d/S00_emergency.sh"
    
83.   emergency_script >$EMERG_SCRIPT
    
84.   chmod 0755 $EMERG_SCRIPT
    
85. }
    
86. 
    
87. do_allow_root_login() {
    
88.   show_msg "Allowing root login via telnet and ssh"
    
89.   # Open telnet
    
90.   echo "telnet        stream        tcp        nowait        root        /usr/local/sbin/telnetd        /usr/local/sbin/telnetd" >> "$ROOTFS/etc/inetd.conf"
    
91.   #sed -i -e 's/#telnet/telnet/' "$ROOTFS/etc/inetd.conf"
    
92.   #if [ ! -f "$ROOTFS/usr/sbin/telnetd" ]; then
    
93.   #  cd "$ROOTFS/usr/sbin" && ln -s ../../bin/busybox telnetd
    
94.   #fi
    
95.   # Allow root login via ssh
    
96.   sed -i -e 's/#PermitRootLogin/PermitRootLogin/' "$ROOTFS/etc/sshd_config"
    
97.   sed -i -e 's/#StrictModes yes/StrictModes yes/' "$ROOTFS/etc/sshd_config"
    
98.   sed -i -e 's/#PermitEmptyPasswords no/PermitEmptyPasswords yes/' "$ROOTFS/etc/sshd_config"
    
99.   sed -i -e 's/#UsePAM no/UsePAM no/' "$ROOTFS/etc/sshd_config"
    
100.   # Patch sshd.sh
     
101.   #sed -i -e 's/`which sshd`/\/usr\/sbin\/sshd/' "$ROOTFS/etc/init.d/sshd.sh"
     
102.   sed -i -e 's/\[ "${SUPPORT_SFTP}" = "0" \]/\[ `\/bin\/false` \]/' "$ROOTFS/etc/init.d/sshd.sh"
     
103.   # Start sshd
     
104.   SSHD=`find $ROOTFS/etc/rc.d/extensions.d -name '*sshd.sh' 2>/dev/null`
     
105.   if [ "$?" -ne 0 ] || [ -z "$SSHD" ]; then
     
106.     show_info "Enabling SSHD service."
     
107.     cd "$ROOTFS/etc/rc.d/extensions.d" && ln -s ../../init.d/sshd.sh S99_sshd.sh
     
108.   fi
     
109. }
     
110. 
     
111. do_fix_su_binary() {
     
112.   show_msg "Fixing su binary"
     
113.   mv "$ROOTFS/bin/su" "$ROOTFS/bin/su~"
     
114.   cd "$ROOTFS/bin" && ln -s busybox su
     
115. }
     
116. 
     
117. do_correct_permissions() {
     
118.   show_msg "Correcting permissions"
     
119.   chmod 6555 "$ROOTFS/bin/su"
     
120.   chmod 0644 "$ROOTFS/etc/profile"
     
121. }
     
122. 
     
123. do_correct_pam_modules() {
     
124.   show_msg "Correcting pam modules"
     
125.   cd "$ROOTFS/lib/security" && ln -s pam_unix.so pam_unix_auth.so
     
126.   cd "$ROOTFS/lib/security" && ln -s pam_unix.so pam_unix_acct.so
     
127.   cd "$ROOTFS/lib/security" && ln -s pam_unix.so pam_unix_passwd.so
     
128.   cd "$ROOTFS/lib/security" && ln -s pam_unix.so pam_unix_session.so
     
129. }
     
130. 
     
131. do_add_executables() {
     
132.   show_msg "Adding executables"
     
133.   for ARCHIVE in `ls -1 $ROOT/data/*.tar.gz 2>/dev/null`;
     
134.   do
     
135.     show_info "Adding from $ARCHIVE."
     
136.     tar --numeric-owner -p -xzf "$ARCHIVE" -C "$ROOTFS"
     
137.   done
     
138. }
     
139. 
     
140. do_add_ssh_keys() {
     
141.   show_msg "Adding ssh key"
     
142.   SSH_DIR="$ROOTFS/root/.ssh"
     
143.   AUTHORIZED_KEYS="$SSH_DIR/authorized_keys"
     
144.   for KEY in `ls -1 $ROOT/data/*.key 2>/dev/null`; do
     
145.     show_info "Adding key $KEY."
     
146.     mkdir -p "$SSH_DIR"
     
147.     if [ -f "$AUTHORIZED_KEYS" ]; then
     
148.       echo "" >> "$AUTHORIZED_KEYS"
     
149.     fi
     
150.     cat $KEY >> "$AUTHORIZED_KEYS"
     
151.   done
     
152. }
     
153. 
     
154. do_package_rootfs() {
     
155.   show_msg "Package ROOTFS"
     
156.   package_rootfs "$ROOTFS" "$OUTDIR/$ROOTFS_FILE_NAME"
     
157.   pack_firmware "$OUTDIR" "$ROOTFS_IMG_NAME" "$ROOTFS_FILE_NAME" "$PASSWORD"
     
158.   if [ -f "$OUTDIR/$ROOTFS_IMG_NAME" ]; then
     
159.     show_info "Opened ROOTFS image saved in $OUTDIR/$ROOTFS_IMG_NAME."
     
160.   fi
     
161. }
     
162. 
     
163. main() {
     
164.   echo "Opening stock firmware ROOTFS of $FIRMWARE."
     
165. 
     
166.   FNAME=`basename $FIRMWARE`
     
167.   FEXT="${FNAME##*.}"
     
168. 
     
169.   do_prep_dirs
     
170.   if [ "$FEXT" = "img" ]; then
     
171.     ROOTFS_IMG=$FIRMWARE
     
172.     ROOTFS_IMG_NAME=$FNAME
     
173.   else
     
174.     do_unpack_firmware
     
175.   fi
     
176.   if [ ! -f "$ROOTFS_IMG" ]; then
     
177.     exit 1;
     
178.   fi
     
179.   do_unpack_rootfs
     
180.   if [ -z "$PASSWORD" ]; then
     
181.     exit 1;
     
182.   fi
     
183.   do_extract_rootfs
     
184.   do_remove_root_password
     
185.   do_allow_root_login
     
186.   do_add_ssh_keys
     
187.   do_create_emergency_script
     
188.   #do_fix_su_binary
     
189.   #do_correct_permissions
     
190.   #do_correct_pam_modules
     
191.   #do_add_executables
     
192.   do_package_rootfs
     
193. 
     
194.   echo "\nDone.\n"
     
195. }
     
196. 
     
197. main
     
198. exit 0
     

复制代码

上述LS系列使用到的固件：点击下载TS5000系列（需要ROOT）的固件下载：点击下载

初步判断，稍微小改代码即可对TS5000系列生效，欢迎讨论。

我的LS421DE早卖了 不然还可以折腾下

我用的就是LS421DE啊，不是早就可以ROOT了吗？都一个迅雷了。。。。

faninx 发表于 2015-9-6 13:36
我的LS421DE早卖了 不然还可以折腾下

421DE我这边有现成的ROOT固件，隔壁的网友可以联系我发送

swh485 发表于 2015-9-6 14:54
我用的就是LS421DE啊，不是早就可以ROOT了吗？都一个迅雷了。。。。

这次是TS5400D啦，慢慢占领BUFFALO的高端品牌。

马克一记

学习下，最近对BUFFALO感兴趣了

有时间折腾下，谢谢楼主

需要ts5000root方法或root固件，谢谢

易璞 发表于 2015-9-7 11:50
这次是TS5400D啦，慢慢占领BUFFALO的高端品牌。

发个TS5000系列固件给我