Persistence
Ofcourse, I could make this into a full hack, but needing to use JTAG to poke it in RAM every time the hard disk boots would make it pretty useless. I needed to make it persistant, that is, I needed to store my modifications somewhere where it would be picked up again every time the hard disk powers on.
My location of choice was the flash rom. I could probably also have put
it somewhere in the reserved sectors on the disk itself, but if I messed
something up, I would have no way to recover my disk. The flash chip
is just an eight-pin standard part, so I could easily take it out, flash
it and put it in again. For that purpose, I desoldered it and put it
on a bit of veroboard, so I could easily switch it between a programmer
and the hard disk:
Now, what to put in the flash? Luckily, the format of what's stored in the chip already has been figured out: it consists of multiple blocks of data, with a table describing them at the very start. That table describes the location of the block in flash, how it's compressed (if it is compressed), the location where the block should be put in RAM and, for the final address, an execution point where the loader would jump to to start executing the program.
Unfortunately, I couldn't modify the code that was in the flash; the bits that contained the parts where I wanted to put my hooks was compressed with an unknown compression algorithm, so I couldn't modify that. What I however could do was add an extra block, and modify the execution address so that block would get executed before the rest. That made things a bit easier: when 'my' block got executed, I could just code it to insert the hooks in the now decompressed bits of code.
Ofcourse, I had to dis- and re-assemble the flash binary for this. I created a
tool for that, unimaginatively called 'fwtool'. This tool can dump out the
various blocks in the flash, plus translate the header into a text file for easy
modification. You can then modify, delete or add a block and re-assemble
everything into a single firmware file, ready to be re-flashed. I used that to
add my custom bit of code to the image, flashed everything back to the chip,
put the chip back into the HD, booted everything back up and this was the
result:
The result isn't that shocking: it's exactly the same as I had before. The trick is that I didn't need the JTAG-rig to get it.