Moog One - SSH Access

The short version, extract this k.zip to the root of a usb drive. Boot the Moog One with the drive in, ethernet connected and you now you can login with SSH as root, no password.

On my initial teardown I found exactly what I was hoping for, serial access to the system which would likely be tied to the console. After a quick check on the scope for activity and voltage levels I soldered a couple wires to the pads and was pleasntly greeted with boot messages and finally a login prompt!

U-Boot SPL 2013.10 (Jul 30 2018 - 09:36:38)
DDR configuration
Ram size 512
Boot Device : MMC
mmc_id...1
Setting bit width...4
Load image from RAW...
Encoder not pressed boot straight to OS
Setting bit width...4
Boot OS Args read...256
loaded kernel...0
Entering kernel arg pointer: 0x18000000
Uncompressing Linux... done, booting the kernel.
...snip...

Here is the full boot log from serial console, serial-boot.txt, and dmesg output from a recent boot, dmesg-boot.txt.

Login with root, no password and we’re in! First order of business was to get SSH up since I didn’t want to leave some wires hanging out for console access. Since the Moog One has an ethernet port I figured it would already be in here. After some poking around in the system I found an init script for dropbear (SSH) in /etc/init.d/S50dropbear.

# Excerpt from /etc/init.d/S50dropbear
if [ -e /media/thumbdrive/k ]; then
	keyval=`hexdump /media/thumbdrive/k | awk '{print $3 $2}'`
	if [ $keyval = 23051934 ]; then
		echo "`date` : DROPBEAR : You have a key! Aren't you special!" >> /var/log/messages
		start-stop-daemon -S -q -p /var/run/dropbear.pid \
			--exec /usr/sbin/dropbear -- $DROPBEAR_ARGS
		[ $? = 0 ] && echo "OK" || echo "FAIL"
		exit;
	fi;
fi;

So, it looks like we want to have a special k file on a thumbdrive while booting. I don’t know the origin of the k file, if this is just the start of a larger file but for the purpose of starting SSH all we need is a file with those initial bytes.

echo -ne "\x34\x19\x05\x23" > k

The filename must be just a lower case k with no extension, in the root of the usb drive. Here is a zip with the file that can be extracted on your drive. k.zip

ryan@laptop:~$ ssh root@192.168.0.204
# bash
las-production:/var/local/root$ uname -a
Linux las-production 4.1.15-rt18 #1 SMP PREEMPT RT Tue Mar 31 17:15:09 EDT 2020 armv7l GNU/Linux
las-production:/var/local/root$

And we’re in! Now the real exploration can begin.