May 072020
Picture of a Raspberry Pi 4 UART connected to a console port on a Synology Disktation 1813+

As a result of my Synology DS1813+ crashing yet again due to the Synology Memory issues and Crashing that I’ve been regularly experiencing, I finally decided to try hacking the Synology NAS to run another operating system. Let it also be noted that numerous of my readers are also experiencing these issues as I receive chats and e-mails about this almost on a daily basis.

Under the hood, the DS1813+ is just another x86 computer system. There’s no reason why we shouldn’t be able to hack this to run another Linux distribution or possibly even a BSD variant like FreeNAS.

Ultimately all I want from this is a reliable NAS to perform software RAID and provide an iSCSI target, it would also be kinda cool to see what we can install on it!

I’ve already started preliminary work on this, so keep visiting back as the blog post get’s updated with more and more information on a regular basis. If you feel you can contribute, please don’t hesitate to leave a comment or reach out.

Current Status

In this section, I’ll be updating it regularly with the current status of my efforts.


  • Serial console access
  • UEFI Shell Access
  • GRUB Bootloader Access

See the below sections for information.

Accessing the DS1813+ system

There’s numerous different approachs we can take to try to gain access to repurpose the Synology Disk Station and install another operating system.

These include:

  • Accessing the serial console
  • Accessing the BIOS/UEFI and/or bootloader
  • Booting from a USB stick or modified HD
  • Modifying the USB DOM

The ultimate result we are looking for is to boot our own linux kernel, kick off a Linux or BSD OS installer, or boot from a modified drive that already has Linux installed on it.

Accessing the serial console

Serial console access to the Synology Diskstation is easily acheived.

I originally found this post which provided me information on the pinouts and the voltage:

While the above post is for older units utilizing architectures other than x86, the pinout information along wiht the voltage is still relevant.

With the Synology unit using 3.3v, you cannot use a normal computer RS-232 interface to connect to it as it runs at 5V. You’ll need to step-down the voltage using a converter or use a RS-232 interface that runs at 3.3v.

In my case, I used a Raspberry Pi 4 and one of the UART ports along with Minicom to access it. The Pi 4 uses 3.3v for UART so it works perfect. You’ll need Rx, Tx, and GRND for the connection to work.

Picture of a Raspberry Pi 4 with UART connection to ttyS0
Raspberry Pi 4 UART Connection ttyS0

In my case, I used the ttyS0 UART interface to avoid issues with the Mhz and timing (that’s experienced with using ttyAMA0). To use ttyS0, you’ll need to enable the UART on your Pi boot configs, as well as disable the Raspberry Pi console.

Picture of a Raspberry Pi 4 UART connected to a Synology DS1813+ serial console connection
Raspberry Pi 4 UART connected to Synology Diskstation DS1813+ console port

I used the following command to initialize minicom:

minicom -b 115200 -o -D /dev/ttyS0

After connecting, I was able to view and interact with the serial console.

Accessing the BIOS/UEFI and/or bootloader

After gaining serial console access, powering on the Synology DS1813+ results in the following:

Intel (R) Granite Well Platform
Copyright (C) 1999-2011 Intel Corporation. All rights reserved.
Product Name : GRANITE WELL
Processor : Intel(R) Atom(TM) CPU D2701 @ 2.13GHz
Current Speed : 2.12 GHz
Total Memory : 4096 MB
Intel BLDK Version : Tiano-GraniteWell (Allegro 0.3.7)

Miscellaneous Info

Memory Ref Code Version :
CDV Ref Code Version : 0.9.0-1
P-Unit Firmware Version :
P-Unit Location in Flash : 0xFFFB0000
P-Unit Location in RAM : 0xDF6F0000
No of SATA ports available : 6
No of SATA ports enabled : 6

Press F10 in 3 seconds to list all boot options
Any other key to active boot…

Unfortunately, I’m unable to press F10 due to terminal emulation issues (it’s also possible they’ve removed this feature to stop someone from doing what I’m doing).

After 10 seconds, the Synology will UEFI boot the GRUB bootloader.

You can browse through the list, edit the entries, as well as run the GRUB command line.

Booting from a USB stick or modified HD

I attempted to boot numerous different USB sticks containing either OS installers (Linux variants and FreeNAS) with no success. I also tried to boot off an HD connected to one of the SATA ports in the NAS, this was also unsuccesful.

I noticed that out of the 8 SATA connections, ports 1-6 are treated differently (possibly being on a SATA expander) and 7-8 may be accessed by the UEFI, BIOS, or bootloader.

I attempted to chainload a CD image written to a USB stick, however GRUB is not able to see any USB or HDs other than the SATA DOM it’s residing on.

Removing the SATA DOM presents you with a UEFI shell, however you are unable to see, view, or execute any efi files as the shell is unable to read any USB or HD devices other than the SATA DOM.

It appears both the UEFI/BIOS and GRUB have been modified to either not allow access to other bootable devices, or drivers are required which haven’t been incorporated.

In order to execute our own kernel or OS, we may need to modify the SATA DOM.

Modifying the USB DOM

The onboard USB DOM appears to be the only bootable device that is presented to the UEFI/BIOS.

On a booted system, the DOM appears as the device “/dev/synoboot”.

While logged in to the Synology via SSH, you are unable to mount this device to a mount point. You can however image the device, copy it, and write it to another device on another system.

To image the USB DOM, I ran the following command:

dd if=/dev/synoboot of=/volume1/ShareName/synoboot-image

I than downloaded the “synoboot-image” image file to another Linux system, wrote it to a USB stick and I was able to mount the partitions.

There are two vfat partitions containing some linux kernels, ramdisks, and the UEFI version of GRUB.

I believe in an effort to move forward, we will need to either modify and incorporate a version of GRUB with extra drivers, or we will need to use the existing version to boot our own kernel and initial ramdisk.

At this point, we’ll need to evaluate how to write to the SATA DOM. There are two options:

  • Modify the image we created, and write it back after copying it back to the Synology NAS.
  • Find a way to directly mount and access the partitions on the Synology NAS, at this point we are unable due to “access is denied”, however dd reading functions.
  • Connect the SATA DOM to the USB headers on another system.

Once we access this SATA DOM, it may be possible to copy the kernels and ramdisks to kick off an OS installer, or better yet install a more feature and driver filled version of GRUB.

  17 Responses to “Hacking the Synology Diskstation (Synology DS1813+)”

  1. […] unacceptable, especially in addition to all the issues over the years, or I may try an attempt at hacking the Synology Diskstation to run my own […]

  2. Maybe this (in German) may has more clues. However, its old (examples are ARMEL in DS210j/DS211+ and e500v2 PowerPC in DS213+) and likely obsolete.

    Good luck!

  3. Hi Tinker,

    Definitely interesting (and do-able), but I want to actually change the operating system and do much more than a chroot.

    With chroot, it would still be using the Synology Linux kernel, with it’s modifications blocking access to devices like the SATADOM.

    I’m hoping I can find some time soon to play with this! lol


  4. Could the old way (netBSD via altboot) be still workable on newer models?

  5. Unfortunately not, they’ve locked these down pretty hard now 🙁

  6. Do the DSs have some kind of BIOS? Maybe it’s possible to replace or add a BIOS chip.

  7. They do/did. Originally, they used a BIOS which I heard was really easy to load your own OS on to. It had access to all the disks and USB devices, and you could simply use a serial console session to do a Linux/BSD install on.

    I don’t know the specific version, but eventually it was changed to UEFI. It’s been heavily modified to ONLY allow booting off the SATADOM.

    My next step is to try and put my own kernel/initrd on the SATADOM to kick off a Linux or BSD installer, but I just haven’t had the time yet unfortunately.

  8. If all else fails, my last resort when DSM support ends will be replacing the logic board.

    For smaller DSs, a Raspberry 4 (or better if then available) should do it, with USB hubs and USBSATA bridges. If space allows, even an internal mains adaper.

  9. Your crashing/sluggish system is probably due to 4GB memory, are you running single ranked ddr stick?
    Had similar issues on my 1813+, If you try removing one 2GB stick it will probably work flawless.

    From what i read there could be some issue in addressing memory above 3GB even if d2700 should work fine with 4GB as max.

  10. Awesome work, would like to see if you have made any progress on this effort. I made it to the point you did with my ds1819+. I was used 7z to extract and look at the usbdom partition content.

  11. Will having a direct attached USB keyboard to the Synology at boot allow you to press F10 if serial console input doesn’t work? Sorry, I read the notes here and cannot see whether this was attempted. I know it’s obvious, but still had to ask.

  12. Hi Trunkton,

    It could vary by model, but on my unit none of the USB ports functioned during the EFI and GRUB bootloader. Everything had to be done over serial unfortunately.


  13. you should just buy new RAM for it, $16gb of ram is like $99

  14. Hi Stephen,
    I’ve just found Your site after successfully repairing 2 RS815+ affected by the Atom C2538 issue.
    (got them yesterday evening and finished before midnight).
    My first thought was to remove the Synology bloatware and replace it with something more convenient. I’ve done something similar with Netgear ReadyNAS NVX – wrote my custom fw based on buildroot. I’ve been using my MicroNAS 😉 for about a year and I’m quiet satisfied – no issues since the first day of use.
    I’ve already copied the content of the RS815 DOM to a file and unpacked it. There could be some difficulties – modified grub calculates the checksum of initrd and kernel and compares it against the values stored in a file. Till now I could not manage how the checksum is calculated (BTW its encrypted, ugh..)
    IMHO there are 2 options:
    – replace the modded grub with a stock one
    – modify the grub.cfg (called SynoBoot.cfg) and remove that calculation.
    I’ll be trying and if any successful will inform You and everyone interested 🙂

  15. Done.
    The Flash DOM can be easily connected to USB port of a computer and then modified using a self-made adapter – no electronic parts, just a 2mm raster pinheader and a piece of wire with a USB plug.
    Another option is to use an USB pendrive connected with a similar adapter to the mainboard, but this requires changing VID/PID to the only one accepted by DS or RS.
    Than any OS can be installed, but the device must still boot from the bootflash containing the kernel and initrd.
    Both options tested – confirmed working.

  16. @Pawel, sounds great. Can you pleas explane this any further ? You wrote it is possible to install any OS ? Like Linux or something ? This would be great !
    Maybe you can give us some more information about how you did this ?

  17. Hey,

    for pressing F10 you can normally substitute ESC-0
    give it a shot 🙂

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>