[XVortex] pulled off a pretty incredible firmware hack. He managed to get a firmware upgrade for Synology running on a QNAP machine. These are both Network Attached Storage devices, but apparently the Synology firmware is better than what QNAP supplies with their offerings.

The nice thing is that this is not a one-off hack. You can download the raw image and give it a spin for yourself. A few words of warning though. It will only work on models which use the Atom and ICH9R chipset, you’re out of luck if you have one sporting an ARM processor. You will also need to format the drives once the new firmware is flashed so do this before you fill them up.

This harkens back to the days when DD-WRT was first being run on Linksys routers. We don’t remember if that started with upgrade image hacks like this one uses, or if the source code was available (Linksys was compelled to release it once it was proven they were in violation of the GPL).

See a proof video of this hack after the break.

[Thanks ZeroQI]

Here’s a nifty programmer for a cheap Bluetooth module. So just how cheap is this part? Does $6.60 sound like an extreme deal?

The information on this hack is spread throughout a series of posts. The link above goes to the completed programmer (kind of a look back on the hack). But you might start with this post about module firmware options. Just because you can get the part inexpensively doesn’t mean that it’s going to work as you expected. [Byron] sourced similar devices from different suppliers and found they were not running the same firmware; the footprints were the same but he features were not. With his help you can tailor the code to your needs and reflash the device.

The programmer that he build has a nice slot for the module which interfaces with the programming lines using pogo pins (spring-loaded contacts). It connects to the CSR BC417 chip’s SPI pins in order to flash the firmware. If you’ve had any experience working with these cheap parts we’d love to hear your tale in the comment section.

[Thanks MS3FGX]

[Chris'] family made the mistake of giving him a hackable Christmas gift. We’d bet they didn’t see much of him for the rest of the day as he set about rooting this Android wristwatch.

This thing has some pretty powerful hardware under the hood. It’s sporting an OMAP3 processor running at 600 MHz along with 256 MB of RAM. [Chris] needed to get his hands on a firmware image in order to look for security holes. He found a way to spoof the update application in order to intercept an upgrade image from the Internet.

He dumped the firmware locations and got to work searching for a way to exploit the device. Details are a bit scarce about want exactly he did, but you can download his modified image, letting you root your own Motorola Actv using the Android Debug Bridge.

We’ve embedded a demo video after the break. The OS is pretty snappy on the tiny device. We’re not sure what will come of this functionality, but we assume [Chris] was really only interested in the challenge of rooting process itself.

The news was abuzz yesterday with coverage of a study released by Columbia University researchers warning consumers that HP laser printers are wide open to remote tampering and hacking. The researchers claim that the vast majority of printers from HP’s LaserJet line accept firmware updates without checking for any sort of digital authentication, allowing malicious users to abuse the machines remotely. The researchers go so far as to claim that modified firmware can be used to overheat the printer’s fuser, causing fires, to send sensitive documents to criminals, and even force the printers to become part of a botnet.

Officials at HP were quick to counter the claims, stating that all models built in 2009 and beyond require firmware to be digitally signed. Additionally, they say that all of the brand’s laser printers are armed with a thermal cutoff switch which would mitigate the fuser attack vector before any real fire risk would present itself. Despite HP’s statements, the researchers stand by their claims, asserting that vulnerable printers are still available for purchase at major office supply stores.

While most external attacks can easily be prevented with the use of a firewall, the fact that these printers accept unsigned firmware is undoubtedly an interesting one. We are curious to see if these revelations inspire anyone to create their own homebrew LaserJet firmware with advanced capabilities (and low toner warning overrides), or if this all simply fizzles out after a few weeks.

[Craig] is always keeping busy by deconstructing and poking around in various firmware images. This time around he has taken on the task of modifying the DD-WRT package, a popular replacement firmware for SOHO routers.

While the firmware is released under the GPL, [Craig] cites that it’s pretty difficult to build from source. Instead, he says that the typical course of action is to extract files from the firmware image, alter them, then reconstruct the image. This works for most things, but the DD-WRT GUI files are protected in order to prevent modification.

Since the phrase “you are not allowed to do that” doesn’t exist in his vocabulary, [Craig] set out to see if he could make his way around the protections and change the GUI code. It took quite a bit of digging around using IDA Pro and readelf, but he was eventually able to extract, tweak, then reinsert individual pages back into the firmware image.

The process is pretty time consuming, so he put together a tool called webdecomp that automates the extraction and rebuilding of DD-WRT’s web page file. If you’re interested in rocking a custom Hackaday-branded router interface like the one shown above, be sure to swing by his site and grab a copy of webdecomp.

[Arto] recently upgraded his home Internet subscription from an ADSL to VDSL, and with that change received a shiny new ZTE ZXDSL 931WII modem/wireless router. Once he had it installed, he started to go about his normal routine of changing the administrator password, setting up port forwarding, and configuring the wireless security settings…or at least he tried to.

It seems that he was completely unable to access the router’s configuration panel, and after sitting on the phone with his ISP’s “support” personnel, he was informed that there was no way for him to tweak even a single setting.

Undaunted, he cracked the router open and started poking around. He quickly identified a serial port, and after putting together a simple RS232 transceiver, was able to access the router’s telnet interface. It took quite a bit of experimentation and a good handful of help from online forums, but [Arto] was eventually able to upload an older firmware image to the device which gave him the configuration tools he was looking for.

Aside from a few Ethernet timeout issues, the router is now performing to his satisfaction. However, as a final bit of salt in his wounds, he recently read that the admin panel he was originally seeking can be accessed via the router’s WAN interface using a well-known default password – frustrating and incredibly insecure, all at the same time! He says that he learned quite a few things along the way, so not all was lost.

After about six weeks of testing [Yifanlu] has released a stable version of the Kindle 3 firmware for use with Kindle 2 hardware. Everything seems to be working just fine with the patched firmware. We immediately jumped to the conclusion that the upgrade must run pretty slow on the older hardware. [Yifanlu] addresses that assumption in his post. The Kindle 2 hardware is not as fast as the Kindle 3, but it sounds like the upgraded firmware is no slower than the stock firmware was on the older units.

Since the firmware is proprietary, the upgrade method requires that you own both Kindle 2 and Kindle 3. Three scripts will pull the firmware image from the older hardware, copy it over to the new hardware and patch it at the same time, then copy the fully patched package back to the old hardware for use.

After the break you can see a video of a Kindle DX running 3.1 firmware. There’s also a link to the Reddit post where commenters have linked to pre-compiled versions of the patched package.

[Thanks Jason via Reddit]

While not necessarily an easy thing to learn, the ability to reverse engineer embedded device firmware is an incredibly useful skill. Reverse engineering firmware allows you to analyze a device for bugs and vulnerabilities, as well as gives you the opportunity to add features if you happen to be so inclined. When it comes to things such as jailbroken iPhones, Android phones, and Nooks, you can guarantee that a close look at the firmware helped to move the process along.

[Craig] works with embedded systems quite frequently and put together a detailed walkthrough demonstrating how he reverse engineers device firmware. The subject of his hacking was a new firmware package he obtained for a Linksys WWAG120 Wireless-N router.

His tutorial walks through some of the most common reverse engineering methods and tools, which allow him to slowly unravel the firmware’s secrets. When finished, he had a working copy of the router’s boot loader, kernel, and file system – all ready to be further analyzed. His writeup includes tons of additional details, so be sure to swing by his site if reverse engineering is something you are interested in.

When we heard that Google’s open accessory development standard was forthcoming, we were pretty excited. However once we heard that the reference hardware kit was going to cost nearly $400, our thoughts changed to, “Surely you can’t be serious.”

Well, Google is dead serious (and we hear they don’t take kindly to being called Shirley either.)

With such a ridiculous asking price, it was only a matter of time before someone tried getting the ADK software running on vanilla Arduino hardware. [Inopia] wrote in letting us know that he did just that.

Using an Arduino Uno and a Sparkfun USB shield, he was able to get the ADK working without a lot of fuss. He tweaked the ADK firmware image in order to bypass a couple of hardcoded pin assignments Google made, and he was good to go. The image boots just fine, though he can’t necessarily guarantee that his setup works with an Android handset, as he doesn’t currently own one that supports accessory mode.

Now that just about anyone can get their hands on the ADK at a reasonable price, we look forward to seeing what you can put together!

Instead of simply watching the days pass by while the PSN network continues to be unavailable, why not do something useful with your PS3 console? [MS3FGX] wrote in to share some news regarding efforts to bring the OtherOS option back to the PS3.

The team at gitbrew.org have been diligently working to bring Linux back to the console for a little while now, and have released a dual-boot firmware they are calling OtherOS++. This firmware has two huge benefits over Sony’s original attempt at Linux support for the console. It can be run on the original “fat” PS3s as well as the newer “slim” models – something that was not possible until now. Additionally, it gives the Linux install full access to the PS3’s hardware rather than running the OS inside a virtual machine.

The project is relatively new, so the installation procedures and associated documentation are not suitable for the less experienced individuals out there, so consider yourself warned.

We love that there are people doing all they can to bring this awesome feature back to the PS3 – it’s a huge step in the right direction.

[Image via gitbrew]

We love hacks that take quality products and make them better. This enhanced firmware for the VCI-100 is a great example of that. In a similar fashion as the Behringer hack, [DaveX] reverse engineer the firmware for the device and figured out a few ways to make it better. It improves the scratch controller and slider accuracy to use 9-bit accuracy from the ADC readings, which in the stock version were being shifted down to 7-bits. There’s also a few LED tricks they call Disco Mode. They’re selling a “chip” that you need to flash the firmware but from what we can see it’s simply an RS232 converter so you might be able to figure out how to work without that part. We’ve embedded a demo of firmware version 1.4 after the break.

[Thanks Steve]

A new project called the Unofficial Behringer Control Development Kit lets you tweak or completely replace the firmware on the popular devices. The proof of concept demo shows a custom message scrolling on the 4-character 7-segment display but you can do with the device is only limited by how well you can code for the ARM processor inside. Development takes place using the GNU ARM toolchain but don’t worry, you don’t have to crack the case open to program the chip. The BCR2000 and BCF2000 models supported by the project both run bootloaders that allow firmware updates via midi commands. There’s even a recovery mode if you screw something up. Just make sure you have a direct midi connection for recovery, the USB port won’t work for that purpose. If you need a shove to get you started there’s a nice little example file in the repository.

[Thanks Bjonnh]

Whether you’re burning a new bootloader to an Arduino board, or doing away with a bootloader to flash Atmel chips directly, an in-system programmer (ISP) is an indispensable tool for working with AVR microcontrollers. If cost has held you back, it’s no longer an excuse: FabISP is a barebones USB-based AVR programmer that can be pieced together for about ten bucks.

FabISP was created by [David Mellis] as a product of MIT’s Fab Lab program, which provides schools with access to design and manufacturing tools based around a core set of fabrication capabilities, so labs around the world can share results. But the FabISP design is simple enough that you don’t need a whole fab lab. It’s a small, single-sided board with no drilling required; the parts are all surface-mounted, but not so fine-pitched as to require reflow soldering. Easy!

There’s still the bootstrap problem, of course: you need an AVR programmer to get the firmware onto the FabISP. This would be an excellent group project for a hackerspace, club or school: if one person can provide the initial programmer to flash several boards, each member could etch and assemble their own, have it programmed, then take these out into the world to help create more. We must repeat!

[Thanks Juan]

Here is one that really got some of us at the HAD offices excited (yes, we own Zunes). The introduction of the Open Zune Development Kit. Sure, there was XNA, and we even toyed around with it. But anyone will quickly realize just how limited XNA is, especially with older hardware.

OpenZDK is in its infancy, with only one application thus far (don’t worry, you can still use XNA apps too). But we wanted to give it a shout out and let the hacker community make this potential into a reality.

[Thanks Galen]

Here’s a pretty simple hack to enable playback from a USB drive on LG televisions. It only works on European hardware, the LH, LF, and some LU models. The hack consists of downgrading the firmware to version 3.15, then navigating through some service menus.

It’s not quite as hardcore as the Samsung firmware hacking, but the added functionality is really great.

[Thanks Jeton]