May 072020
 
Picture of a Raspberry Pi 4 UART connected to a console port on a Synology Disktation 1813+

As a result of my Synology DS1813+ crashing yet again due to the Synology Memory issues and Crashing that I’ve been regularly experiencing, I finally decided to try hacking the Synology NAS to run another operating system. Let it also be noted that numerous of my readers are also experiencing these issues as I receive chats and e-mails about this almost on a daily basis.

Under the hood, the DS1813+ is just another x86 computer system. There’s no reason why we shouldn’t be able to hack this to run another Linux distribution or possibly even a BSD variant like FreeNAS.

Ultimately all I want from this is a reliable NAS to perform software RAID and provide an iSCSI target, it would also be kinda cool to see what we can install on it!

I’ve already started preliminary work on this, so keep visiting back as the blog post get’s updated with more and more information on a regular basis. If you feel you can contribute, please don’t hesitate to leave a comment or reach out.

Current Status

In this section, I’ll be updating it regularly with the current status of my efforts.

Completed:

  • Serial console access
  • UEFI Shell Access
  • GRUB Bootloader Access

See the below sections for information.

Accessing the DS1813+ system

There’s numerous different approachs we can take to try to gain access to repurpose the Synology Disk Station and install another operating system.

These include:

  • Accessing the serial console
  • Accessing the BIOS/UEFI and/or bootloader
  • Booting from a USB stick or modified HD
  • Modifying the USB DOM

The ultimate result we are looking for is to boot our own linux kernel, kick off a Linux or BSD OS installer, or boot from a modified drive that already has Linux installed on it.

Accessing the serial console

Serial console access to the Synology Diskstation is easily acheived.

I originally found this post which provided me information on the pinouts and the voltage: http://www.netbsd.org/ports/sandpoint/instSynology.html

While the above post is for older units utilizing architectures other than x86, the pinout information along wiht the voltage is still relevant.

With the Synology unit using 3.3v, you cannot use a normal computer RS-232 interface to connect to it as it runs at 5V. You’ll need to step-down the voltage using a converter or use a RS-232 interface that runs at 3.3v.

In my case, I used a Raspberry Pi 4 and one of the UART ports along with Minicom to access it. The Pi 4 uses 3.3v for UART so it works perfect. You’ll need Rx, Tx, and GRND for the connection to work.

Picture of a Raspberry Pi 4 with UART connection to ttyS0
Raspberry Pi 4 UART Connection ttyS0

In my case, I used the ttyS0 UART interface to avoid issues with the Mhz and timing (that’s experienced with using ttyAMA0). To use ttyS0, you’ll need to enable the UART on your Pi boot configs, as well as disable the Raspberry Pi console.

Picture of a Raspberry Pi 4 UART connected to a Synology DS1813+ serial console connection
Raspberry Pi 4 UART connected to Synology Diskstation DS1813+ console port

I used the following command to initialize minicom:

minicom -b 115200 -o -D /dev/ttyS0

After connecting, I was able to view and interact with the serial console.

Accessing the BIOS/UEFI and/or bootloader

After gaining serial console access, powering on the Synology DS1813+ results in the following:

Intel (R) Granite Well Platform
Copyright (C) 1999-2011 Intel Corporation. All rights reserved.
Product Name : GRANITE WELL
Processor : Intel(R) Atom(TM) CPU D2701 @ 2.13GHz
Current Speed : 2.12 GHz
Total Memory : 4096 MB
Intel BLDK Version : Tiano-GraniteWell (Allegro 0.3.7)

Miscellaneous Info

Memory Ref Code Version :
CDV Ref Code Version : 0.9.0-1
P-Unit Firmware Version :
P-Unit Location in Flash : 0xFFFB0000
P-Unit Location in RAM : 0xDF6F0000
No of SATA ports available : 6
No of SATA ports enabled : 6

Press F10 in 3 seconds to list all boot options
Any other key to active boot…

Unfortunately, I’m unable to press F10 due to terminal emulation issues (it’s also possible they’ve removed this feature to stop someone from doing what I’m doing).

After 10 seconds, the Synology will UEFI boot the GRUB bootloader.

You can browse through the list, edit the entries, as well as run the GRUB command line.

Booting from a USB stick or modified HD

I attempted to boot numerous different USB sticks containing either OS installers (Linux variants and FreeNAS) with no success. I also tried to boot off an HD connected to one of the SATA ports in the NAS, this was also unsuccesful.

I noticed that out of the 8 SATA connections, ports 1-6 are treated differently (possibly being on a SATA expander) and 7-8 may be accessed by the UEFI, BIOS, or bootloader.

I attempted to chainload a CD image written to a USB stick, however GRUB is not able to see any USB or HDs other than the SATA DOM it’s residing on.

Removing the SATA DOM presents you with a UEFI shell, however you are unable to see, view, or execute any efi files as the shell is unable to read any USB or HD devices other than the SATA DOM.

It appears both the UEFI/BIOS and GRUB have been modified to either not allow access to other bootable devices, or drivers are required which haven’t been incorporated.

In order to execute our own kernel or OS, we may need to modify the SATA DOM.

Modifying the USB DOM

The onboard USB DOM appears to be the only bootable device that is presented to the UEFI/BIOS.

On a booted system, the DOM appears as the device “/dev/synoboot”.

While logged in to the Synology via SSH, you are unable to mount this device to a mount point. You can however image the device, copy it, and write it to another device on another system.

To image the USB DOM, I ran the following command:

dd if=/dev/synoboot of=/volume1/ShareName/synoboot-image

I than downloaded the “synoboot-image” image file to another Linux system, wrote it to a USB stick and I was able to mount the partitions.

There are two vfat partitions containing some linux kernels, ramdisks, and the UEFI version of GRUB.

I believe in an effort to move forward, we will need to either modify and incorporate a version of GRUB with extra drivers, or we will need to use the existing version to boot our own kernel and initial ramdisk.

At this point, we’ll need to evaluate how to write to the SATA DOM. There are two options:

  • Modify the image we created, and write it back after copying it back to the Synology NAS.
  • Find a way to directly mount and access the partitions on the Synology NAS, at this point we are unable due to “access is denied”, however dd reading functions.
  • Connect the SATA DOM to the USB headers on another system.

Once we access this SATA DOM, it may be possible to copy the kernels and ramdisks to kick off an OS installer, or better yet install a more feature and driver filled version of GRUB.

  8 Responses to “Hacking the Synology Diskstation (Synology DS1813+)”

  1. […] unacceptable, especially in addition to all the issues over the years, or I may try an attempt at hacking the Synology Diskstation to run my own […]

  2. Maybe this (in German) may has more clues. However, its old (examples are ARMEL in DS210j/DS211+ and e500v2 PowerPC in DS213+) and likely obsolete.

    Good luck!

  3. Hi Tinker,

    Definitely interesting (and do-able), but I want to actually change the operating system and do much more than a chroot.

    With chroot, it would still be using the Synology Linux kernel, with it’s modifications blocking access to devices like the SATADOM.

    I’m hoping I can find some time soon to play with this! lol

    Cheers,
    Stephen

  4. Could the old way (netBSD via altboot) be still workable on newer models?

  5. Unfortunately not, they’ve locked these down pretty hard now 🙁

  6. Do the DSs have some kind of BIOS? Maybe it’s possible to replace or add a BIOS chip.

  7. They do/did. Originally, they used a BIOS which I heard was really easy to load your own OS on to. It had access to all the disks and USB devices, and you could simply use a serial console session to do a Linux/BSD install on.

    I don’t know the specific version, but eventually it was changed to UEFI. It’s been heavily modified to ONLY allow booting off the SATADOM.

    My next step is to try and put my own kernel/initrd on the SATADOM to kick off a Linux or BSD installer, but I just haven’t had the time yet unfortunately.

  8. If all else fails, my last resort when DSM support ends will be replacing the logic board.

    For smaller DSs, a Raspberry 4 (or better if then available) should do it, with USB hubs and USBSATA bridges. If space allows, even an internal mains adaper.

 Leave a Reply

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

(required)

(required)