Darwin Mach

Cisco-Linksys decided to release new routers for their home routers: the “Valet” series and the “E” series. After doing some research, they’re actually just a re-branding of the older models. The only difference is that the “E” series now have double the amount of NVRAM available. In this article, we’ll be looking at the new E2000 and E3000 routers.

The E2000 is actually the WRT320N with a working reset button and E3000 is the new WRT610N v2. But that doesn’t that mean you have to ditch your current router if you own one of these already, especially just to get the extra 32k of NVRAM. You can actually update the CFE of the older model and transform your WRT320N or WRT610N v2 into the E2000 or E3000 respectively. The CFE is basically the BIOS of the router.

I actually found out how after a lot of searching on the DD-WRT forums. Thanks to users barryware and LOM, we have a way to upgrade the CFE. The procedure for both routers are the same, but at the DD-WRT forums, they are on 2 separate threads and buried in the “Broadcom Based Routers” section. So here’s my single article on it to make it easier to find for those of you who want to follow in my footsteps & convert your routers. I did this for 2 WRT610Ns and 5 WRT320Ns and so far, everything works well.

Advantages of converting:

- You get double NVRAM

- Future proofing

DISADVANTAGES of converting:

- Flashing CFE is not like flashing firmware. You fail & your router = brick

- Advantages not worth the risk for some people

Knowledge required:

- Using a Hex editor. NOTEPAD, WORDPAD, ETC IS NOT A HEX EDITOR!

- Use SSH and SCP

- Flash and use DD-WRT firmware

- Know how to do a serial port & JTAG recovery on your router

You MUST know how to do the first 3 or YOU WILL FAIL. The last one is extremely helpful if something goes wrong, but you’re taking a big risk if you don’t know how do it.

DISCLAIMER: NOBODY will take responsibility or be liable for anything you do to your router. If you brick it trying these procedures, YOU are solely responsible for your actions. YOU HAVE BEEN WARNED.

Important notes:

- The WRT320N has a working JTAG, the WRT610N doesn’t. If you fail with the CFE flash, you may be able to recover your WRT320N, but your WRT610N will be dead.

- Both routers have a working serial console. If you fail to flash the modified firmware before rebooting, you may be able to recover by using the serial console to clear NVRAM and re-flash the firmware.

- E3000 conversion only works on a WRT610N v2. It will not work, and will brick your v1.

- Do NOT power cycle your router at any time until you have completely finished and can confirm that the router has booted up into an operational state.

- READ these instructions completely, a few times, before you proceed. Save them to a safe place. I also suggest you download the files needed in advanced.

1.) Flash you router with DD-WRT (an ordinary K26 big build), reset to defaults, set an admin password, and enable SSH.

2.) Open http://[your router's ip]/backup/cfe.bin and save your current CFE to a safe place.

3.) Download the appropriate CFE for your router below:

- WRT320N => E2000

- WRT610N v2 => E3000

4.) Using a Hex editor, modify your CFE so that it has your router’s MAC address, serial number, and 8-digit easy access PIN. All of these numbers are on the sticker under your router. The easy access PIN is the number that is in the white space next to the “synchronize” arrows and looks like XXXX-XXXX. In the CFE, it is a single string XXXXXXXX.

Here are the offsets…

E2000:

MAC @ 0x3E098

SN @ 0x3E0AD

PIN @ 0x3E0C2

E3000:

MAC @ 0x1E00

SN @ 0x3FE30

PIN @ 0x3FCDC

4.) Connect your router to a reliable power source. REMEMBER: Do NOT power cycle your router at any time until you have completely finished and can confirm that the router has booted up into an operational state.

5.) SCP the modified CFE into /tmp on the router.

6.) SSH into your router using “root”. The password is your web interface password.

7.) Run the following commands:
cd /tmp
mtd unlock cfe
mtd write -f [cfe's file name] cfe

8.) It will only take a few seconds to flash the CFE. But you are not done yet – DO NOT REBOOT. Go back to the router’s web interface and upload the modified firmware, making sure your set the “Reset to defaults” option. This modified firmware tricks your router in thinking its the proper build, but is indeed the build for the converted model so that after a reset, it can boot the proper image. The downloads are here: E2000 and E3000.

9.) The router will reset itself upon flashing this modified firmware. Be patient – it can take up to 10 minutes and a few reboot cycles to complete. If your are successful, you should be able to access the DD-WRT admin page at http://192.168.1.1.

10.) One last thing: set a password, and flash a proper DD-WRT E2000 or E3000 build, making sure you reset to defaults again. You can find them in the “Other Downloads” section on the DD-WRT website.

Done! You should now have a converted E2000 or E3000! You can even flash the stock firmware for the E2000 or E3000 and use it if you’d like.

What I found was that DD-WRT actually likes the extra NVRAM better. YMMV. Cheers!

Share on Facebook

Seems like one of those really annoying things out there is deploying an installation of Adobe Acrobat Pro with all (or most) of the updates at once. Of course, this pertains to the Windows version. After doing some intense research and looking through the bits and pieces if suggestions that are out there, I found a much easier way to integrate all the updates into one package.

This one is tricky, you can’t just use the traditional method of running msiexec with the /p parameter and patch over the MSI. What makes it worse is that certain updates can’t be slip streamed or they will prevent future updates from being applied. One can only imagine the headaches that can come out of trying to deploy this without having to install the numerous patches after.

As of writing, the Adobe website only offers Acrobat Pro 9.0 as a download (trial) and it is likely the same for those that have access to the Adobe Licensing website. The problem is that the latest update brings Acrobat Pro to version 9.3.4. How? Via 10 .msp patches: 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.2.0, 9.3.0, 9.3.1, 9.3.2, 9.3.3, 9.3.4. These msp’s range from a mere 1.6MB to a whopping 126.7MB each!

Enough chatter, let’s get started. Looking at the Adobe knowledgebase article, there’s a specific order & specific patches we must apply upon “slipstreaming”. Here’s the website: http://kb2.adobe.com/cps/498/cpsid_49880.html.

In short, only “Quarterly” updates can be slipstreamed in order to allow future updates to be integrated. So to bring 9.0 up to 9.3.3 (can’t do 9.3.4 because it’s a “Security” update, we need the following patches:

9.1.0 :: AcroProStdUpd910_T1T2_incr.msp
9.1.2 :: AcrobatUpd912_all_incr.msp
9.2.0 :: AcrobatUpd920_all_incr.msp
9.3.0 :: AcrobatUpd930_all_incr.msp
9.3.2 :: AcrobatUpd932_all_incr.msp
9.3.3 :: AcrobatUpd933_all_incr.msp

You can download them from Adobe here: http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows.

You will also need a copy of the Acrobat Pro 9.0 installation. If you are a retail user, you can download the Trial version from Adobe’s public website. If you are an enterprise or volume license user, you must download from the Adobe LWS. Both user types can use the original installation media (CD/DVD) but make sure you substitute the corporate for the retail version or vice versa.

If you downloaded the installers, extract them to a folder. If you have the the CD/DVD, copy the “Acrobat Professional 9″ folder to a writable location. Inside this folder you should see setup.exe, AcroPro.msi, Data1.cab, setup.ini, a few mst’s, etc.

Now copy the .msp files (updates) you downloaded into the same folder. Open up setup.ini in an editor like notepad and underneath the “[Product]” section, append the following to the end of the section:

PATCH="AcroProStdUpd910_T1T2_incr.msp;AcrobatUpd912_all_incr.msp;AcrobatUpd920_all_incr.msp;AcrobatUpd930_all_incr.msp;AcrobatUpd932_all_incr.msp;AcrobatUpd933_all_incr.msp"

Save & close. Remember, when a future quarterly patch comes out, save it to the same folder and just add it’s file name to the end of this string inside setup.ini.

Now we have an installer that will install all the quarterly updates when we run setup.exe. Now just configure your deployment solution to copy this entire folder to the client and run setup.exe with the required parameters (no reboot, silent, etc – you can fund them by running “setup.exe /?”).

Thanks, Adobe, for making this such a nuisance.

Share on Facebook

Since I couldn’t find an all-in-one guide anywhere out there, I’m going to write up a short post on how to enable smart card logon in a Microsoft Active Directory environment.

It’s short since I’m a little bit lazy in documenting every step (these are mainly notes for myself), but if enough people request, I’ll expand this post to include more details.

Requirements:
- Active Directory (Windows 2003 and up). You cannot have smartcard login without some sort of directory service – that defeats the purpose of PKI.
- Smart card, smart card reader, and its middleware / drivers installed wherever you will be logging into the domain.

Phases:
I. Install Certificate Services on a server that is part of the domain, configure a root CA, enable the Smartcard Logon certificate template
II. Create an GPO that auto-enrolls domain machines so that all your domain machines get a certificate & can renew them automatically. Make sure computers and all domain controllers have a certificate.
III. Logon to a domain machine, open Certificates snap-in for the current user, request new certificate, select “advanced options”, pick the CSP for your smartcard and complete the request.
IV. Test logins

Share on Facebook