From Lundman Wiki
Jump to: navigation, search

Enabling telnetd

It is entirely possible that you can break your hardware, for which I can not be held responsible, nor is it likely you will get help from Syabas. This guide should not be read by anyone

Seems not to work on 200 series

The C200 has its own section, and besides, this document is historical only. It is recommended you use the CSI Tool

Installing telnetd on HARD_DISK

Download the file:

Unpack telnet-installer.zip so that you get three additional files, telnet-installer.html, telnet-installer.cgi-RENAME-ME.bin and busybox26.

Because WinZIP has a tendency to corrupt *.cgi files, please rename telnet-installer.cgi-RENAME-ME.bin to telnet-installer.cgi.

Upload the three files to your nmt, most easily to your HDD. You could also use a USB stick, if so, place the files in the root of the stick. You should upload a total of three files to your PCH.

Filezilla warning: If you use Filezilla to upload files make sure the Edit->Settings->Transfers->File Types->"treat files without extension as ASCII files" is clear or the busybox binary will be corrupted.

You must also make telnet-installer.cgi be executable.

site chmod 755 telnet-installer.cgi

In DOS FTP you use:

quote SITE CHMOD 755 telnet-installer.cgi

  1. Upload telnet-installer.html, telnet-installer.cgi and busybox26 to the root directory of your nmt.
  2. site chmod 755 telnet-installer.cgi
  3. Push "Sources" to get your to your nmt start page
  4. Select "HARD_DISK" (or USB stick if you chose that)
  5. Select "Files" (Forth icon on the right. Video, Music, Photos, Files - or push the blue button on the remote).
  6. Pick "telnet-installer.html".
  7. Select "Install to HARD_DISK" - if this fails, you did not make telnet-installer.cgi executable or copied it to the wrong place
  8. You should now be able to telnet to your nmt.

Note: The Popcorn Hour B110 and other NMT's with SATA hard disk may require you to change the installer script files path with 'HARD_DISK' to 'SATA_DISK' before launching.

Running from USB stick

Download file:

UnZIP telnet-installer.tar.gz so that you get three files, telnet-installer.html, telnet-installer.cgi-RENAME-ME.binand busybox26.

Because WinZIP has a tendency to corrupt *.cgi files, please rename telnet-installer.cgi-RENAME-ME.bin to telnet-installer.cgi.

Place them in the root of your USB stick.

You USB stick should have, in its root:


You must also make telnet-installer.cgi be executable.

  1. Push "Sources" to get your to your nmt start page
  2. Select "USB_DRIVE_A" (or USB_DRIVE_A-1, etc as appropriate)
  3. Select "Files" (Forth icon on the right. Video, Music, Photos, Files)
  4. Pick "telnet-installer.html".
  5. Select "Run from USB_DRIVE_A". If this fails, you did not make telnet-installer.cgi executable
  6. You should now be able to telnet to your nmt.

Comment for WinXP users that cannot set permissions:

I added these lines to the provided cgi script in the zip file above after the line that contains pwd=$0 (line 7); Im not sure which of the 3 chmods made the script work, but without them I failed to install telnet on my box. Good Luck :)

# start of PEU edit for windows users
chmod 755 /usr/bin/utelnetd
chmod 755 /usr/bin/busybox26
chmod 755 telnet-installer.cgi
# end of PEU edit for windows users 

Old files:


Hard disk swap

The rest of this document is kept for historical reasons.

READ THIS Taking the HDD out to add telnetd was needed the first time, to gain access to the unit. However, since then the clever chaps on the forum has found they can execute binaries through the PHP port. This new method lets you upload a html file and your binary (telnetd) then simply tell NMT to run it. It even survives firmware upgrades. Please look for the USB stick solution below for adding telnetd service.

The following steps are written in a chronological order the author used to discover and improve on his findings, the first step isn't necessarily a starting point and only one step seems necessary to enable telnet.

It all started with a theory that since the FTPD, NFSD, and SMBD all live on the HDD (since indeed, it would be pointless to run them if you had no storage to share) perhaps they could be tweaked with. I had been warned that the NMT might be using binary signatures so perhaps I would not be able to replace the binaries themselves, nor was I sure my cross-compile toolchain was correct anyway. But maybe I could wrap FTPD in a shell script or similar and see if I can not somehow glean more information.

Step 1

I took out the HDD, and mounted it on OsX. (After installing that most excellent ext3 driver!). Lo-and-behold, there are two (well 3) partitions on the HDD:

initial    mflag    swap        size
  1         1       0        257008
  2         0       1        506047
  3         1       0      11805585

So, a 250MB partition 1, swap and then the rest of the disk for your media files. Taking a look at partition 1 we find:

# ls -l 
drwxr-xr-x    8 515      500          4096 Dec 22 07:58 syb8634

# ls -l syb8634
-rwxr-xr--    1 515      500          4811 Dec 13 15:22 CHANGELOG
-rwxr-xr-x    1 515      500            28 Dec 13 15:25 MIN_FIRMWARE_VER
-rwxr-xr--    1 515      500            24 Dec 13 15:25 VERSION
drwxr-xr-x    2 515      500          4096 Dec 22 07:58 bin
drwxr-xr-x    2 515      500          4096 Dec 31 21:19 etc
drwxr-xr-x    2 515      500          4096 Dec 22 07:57 lib
drwxr-xr-x    2 515      500          4096 Dec 22 07:58 nfsserver
drwxrwxrwx    3 515      500          4096 Dec 31 21:19 server
drwxrwxr-x    6 515      500          4096 Dec 22 07:57 web

# ls -l syb8634/etc
-rwxr-xr-x    1 515      500           575 Dec  6 18:52 btpd-env.sh
-rwxr-xr-x    1 515      500           965 Oct 24 15:16 btpd-nvram.sh
-rwxr-xr-x    1 515      500          1962 Dec  6 19:41 btpd.sh
-rwxr-xr-x    1 515      500           203 Oct 24 15:16 btpd_get_setting.sh
-rwxr-xr-x    1 515      500           523 Dec 30 21:00 ftpserver.sh
-rwxr-xr--    1 515      500          1978 Dec 13 15:19 nfsserver.sh
-rw-------    1 root     root          152 Dec 31 21:19 pureftpd.passwd
-rw-------    1 root     root         2228 Dec 31 21:19 pureftpd.pdb
-rwxr-xr-x    1 515      500           718 Nov 29 12:37 smb.sh

Nice. pure-ftpd is there, and we know it has to be run as root (to be allowed to open port 21), but also, the startup script! As well as pure-ftpd password file. Nice. My next step, as I did not want to attempt to change any binary, nor startup script unless I had to, was to change the pure-ftpd passwd file to allow a root login.

As it turns out, pure-ftpd is too picky about root users, I had to change quite a lot just to be able to create the db file, let alone allow me to login. So, I modified ftpusers account to not be chroot. (Ie, remove the '/./' end part of the home directory.

This allowed me to login as ftpuser and look around from /. First thing I noticed was:

# ls -l /usr/sbin/
-rwxr-xr-x    1 514      root        12908 Jan  1  2000 boot_auth
lrwxrwxrwx    1 514      root           17 Jan  1  2000 crond -> ../../bin/busybox
lrwxrwxrwx    1 root     root           31 Dec 31 21:19 exportfs -> /mnt/syb8634/nfsserver/exportfs
lrwxrwxrwx    1 root     root           29 Dec 31 21:19 mountd -> /mnt/syb8634/nfsserver/mountd
lrwxrwxrwx    1 root     root           27 Dec 31 21:19 nfsd -> /mnt/syb8634/nfsserver/nfsd
lrwxrwxrwx    1 root     root           30 Dec 31 21:19 portmap -> /mnt/syb8634/nfsserver/portmap
lrwxrwxrwx    1 root     root           28 Dec 31 21:19 statd -> /mnt/syb8634/nfsserver/statd
lrwxrwxrwx    1 514      root           17 Jan  1  2000 telnetd -> ../../bin/busybox

Nice, telnetd! Saves me an hour trying to compile my own. I was also allowed to fetch /etc/shadow which informed me that root has no password. Nice, saves me another hour.

Step 2

So, it is time to start telnetd. I made my changes like this:

# cat syb8634/etc/ftpserver.sh
# Pure FTP Server

start() {
        echo "Starting FTP Server..."
        /mnt/syb8634/bin/nmt_services.cgi cmd=ftp_passwd opt=ftpuser
        /mnt/syb8634/bin/pure-ftpd -j -lpuredb:/mnt/syb8634/etc/pureftpd.pdb -U 000:000 -c 10 -k 100 &
        /usr/sbin/telnetd &

Notice the & is part of the command, to put it in the background.

Step 3

Boot up and:

# telnet 
Connected to
Escape character is '^]'.

BusyBox v1.5.0 (2007-12-14 18:01:15 MYT) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

/ # uname -a
Linux nmt 2.6.15-sigma #1282 PREEMPT Tue Dec 18 22:06:01 MYT 2007 mips unknown
/ #

For those of you who like information like myself, the system looks like this when idle:

/ # df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/hda1               247.0M     58.6M    175.9M  25% /mnt
/dev/hda3               292.7G    140.9G    137.0G  51% /opt/sybhttpd/localhost.drives/HARD_DISK
/ # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,nodiratime)
devpts on /dev/pts type devpts (rw)
tmpfs on /tmp type tmpfs (rw)
none on /sys type sysfs (rw)
/dev/hda1 on /mnt type ext3 (rw,data=ordered)
/dev/hda3 on /opt/sybhttpd/localhost.drives/HARD_DISK type ext3 (rw,noatime,nodiratime,data=ordered)
/ # ps -w
 PID  Uid        VSZ Stat Command
   1 root       1940 S   init  
   2 root            SWN [ksoftirqd/0]
   3 root            SW< [events/0]
   4 root            SW< [khelper]
   5 root            SW< [kthread]
   6 root            SW< [kblockd/0]
   9 root            SW< [khubd]
  52 root            SW  [pdflush]
  53 root            SW  [pdflush]
  55 root            SW< [aio/0]
  54 root            SW  [kswapd0]
  56 root            SW  [cifsoplockd]
  57 root            SW  [cifsdnotifyd]
 640 root            SW< [kseriod]
 666 root            SW  [mtdblockd]
 704 root            SW< [scsi_eh_0]
 705 root            SW< [usb-storage]
 734 root       1128 S < udevd 
 772 root       1956 S   udhcpc -R -b -p /var/run/udhcpc.eth0.pid -i eth0 
 836 root       1384 S   lircd 
 840 root       1116 S   fipd 
 854 root       1944 S   crond 
 881 root            SW  [kjournald]
 888 root            SW  [kjournald]
 899 root       2516 S   ./sybhttpd /opt/sybhttpd 
 900 root       1092 S   mounter 
 901 root       1712 S   cdstatus 
 905 root       2784 S   /upnp/upnpapp 
 915 root       2784 S   /upnp/upnpapp 
 916 root       2784 S   /upnp/upnpapp 
 917 root       1392 S   mDNSNetMonitor 
 918 root       2784 S   /upnp/upnpapp 
 919 root       2744 S   /upnp/upnpapp 
 931 root      14276 S   ./gaya 
 932 root       1160 S   ./ipmonitor 
 952 root      14276 S   ./gaya 
 977 root       1608 S   pure-ftpd (SERVER)                                                                           
 982 root       1940 S   /usr/sbin/telnetd 
 999 daemon     1392 S   /usr/sbin/portmap 
1002 root            SW< [nfsd4]
1005 root       1472 S   /usr/sbin/mountd 
1007 root       1408 S   /usr/sbin/statd 
1003 root            SW  [nfsd]
1013 root            SW  [lockd]
1014 root            SW< [rpciod/0]
1034 nobody    39312 S   ./httpd -d /mnt/syb8634/server -f /mnt/syb8634/server/httpd.conf 
1035 root       1012 S   ./msUPnP-mips --port 8088 
1037 root        928 S   ./mDNSrespd-mips -n nmt myihome -t _difi._tcp. -p 8088 -b 
1039 root        928 S   ./mDNSrespd-mips -n nmt myihome (SMP8634 Media Server) -t _http._tcp. -p 8088 -b 
1045 root       1560 S < ./ms-mips start 
1046 nobody    39336 S   ./httpd -d /mnt/syb8634/server -f /mnt/syb8634/server/httpd.conf 
1047 nobody    39336 S   ./httpd -d /mnt/syb8634/server -f /mnt/syb8634/server/httpd.conf 
1048 nobody    39336 S   ./httpd -d /mnt/syb8634/server -f /mnt/syb8634/server/httpd.conf 
1049 nobody    39336 S   ./httpd -d /mnt/syb8634/server -f /mnt/syb8634/server/httpd.conf 
1050 nobody    39336 S   ./httpd -d /mnt/syb8634/server -f /mnt/syb8634/server/httpd.conf 
1059 root       4348 S   /mnt/syb8634/bin/nmbd -D 
1061 root       9084 S   /mnt/syb8634/bin/smbd -D 
1063 root       9084 S   /mnt/syb8634/bin/smbd -D 
1098 root       1948 S   /mnt/syb8634/bin/btpd -d /opt/sybhttpd/localhost.drives/HARD_DISK/.btpd -p 8881 --bw-in 0 --bw-out 0 --max
4243 root       1944 S   /bin/sh 
4252 root       1940 R   ps -w 
/ # cat /proc/filesystems 
nodev   sysfs
nodev   rootfs
nodev   bdev
nodev   proc
nodev   sockfs
nodev   usbfs
nodev   pipefs
nodev   tmpfs
nodev   devpts
nodev   ramfs
nodev   nfs
nodev   nfs4
nodev   nfsd
nodev   cifs
nodev   rpc_pipefs

The main player appears to be something called mono, but I expect it actually uses a few depending on format. The internal GUI appears to live:

/ # ls -l /opt/sybhttpd/default/
-rw-r--r--    1 root     root         9857 Dec 31 21:19 display.html
-rw-r--r--    1 root     root         8427 Dec 31 21:19 dvd.html
-rw-r--r--    1 root     root         6278 Dec 31 21:19 dvd_password.html
-rw-r--r--    1 root     root         6947 Dec 31 21:19 dvdpwd.html
-rwxr-xr-x    1 514      500         36712 Dec 18 23:05 filemanager.cgi
-rw-r--r--    1 root     root         7244 Dec 31 21:19 maintenance.html
-rw-r--r--    1 root     root         8416 Dec 31 21:19 media_server.html
-rw-r--r--    1 root     root         9837 Dec 31 21:19 network.html
-rw-r--r--    1 root     root         7303 Dec 31 21:19 network_manual.html
-rw-r--r--    1 root     root         6853 Dec 31 21:19 network_share.html
-rw-r--r--    1 root     root         8251 Dec 31 21:19 network_wireless_manual.html
-rwxr-xr-x    1 514      500         82920 Dec 18 23:05 nmtwizard.cgi
-rw-r--r--    1 root     root         9786 Dec 31 21:19 preferences.htm
-rw-r--r--    1 root     root          185 Dec 31 21:19 restore_factory.html
-rw-r--r--    1 root     root          258 Dec 31 21:19 server_update.html
-rwxr-xr-x    1 514      500        498564 Dec 18 23:05 setups.cgi
-rwxr-xr-x    1 514      500       1663388 Dec 18 23:03 smbclient.cgi
-rwxr-xr-x    1 514      500         37352 Dec 18 23:05 start.cgi
-rw-r--r--    1 root     root         7180 Dec 31 21:19 sys_change_password.html
drwxr-xr-x    3 514      500             0 Dec 18 23:05 torrent
-rw-r--r--    1 root     root         7432 Dec 31 21:19 torrent_setting.html
-rw-r--r--    1 root     root          248 Dec 31 21:19 update.html
drwxr-xr-x    2 514      500             0 Dec 18 23:05 upnp
-rwxr-xr-x    1 514      500         30116 Dec 18 23:05 upnpnat
-rwxr-xr-x    1 514      500         98436 Dec 18 23:05 webservices.cgi
-rw-r--r--    1 root     root         9417 Dec 31 21:19 webservices_edit.html
-rw-r--r--    1 root     root         7761 Dec 31 21:19 webservices_list.html

But personally, I am not so interested in any of that.

Step 4 - Enabling Telnet in a new installation

The latest version of the installation appears to have trimmed a lot of fat in the install.

I found this page and was able to install telnet, but here's how I did it:

1. I removed the drive from my PCH, and hooked it up via USB enclosure to my PC

             Windows users: Download and install EXT2IFS (Warning! This might not work correctly, I haven't tested it)

2. Mounted the first partition

3. Downloaded busybox26 binary and installed it to /syb8634/bin/busybox26

             chmod 755 busybox26

4. Opened /syb8634/etc/ftpserver.sh in text editor

5. Added the following line to the end of the Start() directive

             /mnt/syb8634/bin/busybox26 telnetd -l /bin/sh -p 23 &

6. Added the following line to the end of the Stop() directive

             killall busybox26

7. Reinstalled the drive into the PCH and turned it on, Telnet was running.

Enabling telnetd and change subtitle font via PHP

An alternative method to enable telnet and changing the subtitle font has been provided by the user gshock on NMT's forum:

Using Lundman's guide to starting telnet on NMT, you can replace the fonts used for subtitles. Swapping \bin\arial.ttf with any truetype font will change their appearance. I'm using Bookman Antiquita, it looks so much better then Arial.

You can also run your own custom PHP scripts by browsing to them with the stream command:

http://popcorn:8088/stream/file=/share/Scripts/filetest.php?cmd=echo Hello world

The PHP script is sending a shell command "echo Hello world" to the OS.

The .sh scripts in /mnt/syb8634/server are writable from Apache, so you may be able to make PHP scripts that will easily enable/disable telnet without removing Popcorn's HDD or messing with the first few steps in Lundman's wiki (For those who are lazy or just don't want to remove the Popcorn HDD, but want telnet.).


The Popcorn Hour looks for arial.ttf. If it can't find it, it goes back to the main menu after showing the buffering screen.

Download Popcorn Scripts: PHP Scripts (version 2)

These are two scripts to make the process more painless.

Telnet.php enables/disables telnet without removing the hard drive. Font.php swaps (or restores) the active font.

To use Telnet.php:

  • Put Telnet.php on the Popcorn hard disk.
  • Browse to it:
  • Click Enable. It will say "Success, Telnet enabled".
  • On the NMT: go to Setup -> NMT Applications.
  • Stop myiHome server. Start it again, telnetd will start with it. . Note: You have to manually start myiHome after telnet is installed (it turns off myiHome automatically, but doesn't turn it back on again after installation finishes.).

To use Font.php:

  • First run the telnet script. It CHMODs all the fonts to 0777.
  • Put Font.php and any fonts on the Popcorn hard disk.
  • Edit Font.php and change the FONT_PATH to wherever your fonts are stored. The default is \Scripts\fonts.
  • Browse:
  • It should list the fonts in your font path. Click on any font to install it, or click the restore button to return to the default font.
Make sure popcorn is the IP address of your player, ie.

NMT Apps needs to be installed and MyiHome needs to be running for this to work (although it's always running, by default ).

  • I disclaim all responsibility in the event your NMT, PC or living space combusts as a result of using these scripts or the information included in this post. Use it at your own risk.

Note that the first release of the PHP scripts overwrites original scripts without backing them up, and recent changes in NMT firmware releases may break this solution. Second release is meant to be viewed from the web browser on the Popcorn/NMT. You can access it from a networked computer, but it will be missing images etc. It runs /bin/busybox telnetd instead of /usr/sbin/telnetd, so hopefully it will be more compatible with the new firmware.

Enabling telnetd via USB

The user Erlis has contributed with a convenient way to enable telnetd via a USB device without the need of an internal HDD.

1. Download the compiled busybox26 binary and put it in the root folder of the USB device.

2. Create the script.cgi file in the same location with the following content:


echo "Content-Length: 29"; 
echo "Content-type: text/html"; 
echo ""; 

/opt/sybhttpd/localhost.drives/USB_DRIVE_A-1/busybox26 telnetd -l /bin/sh -p 23 & 
echo "Telnetd started on port 23............"; 
exit 0; 

3. Create the telnet.html file in the same location with thte following content:

<a href="http://localhost.drives:8883/USB_DRIVE_A-1/script.cgi">Telnetd</a>

Now insert the USB device in the Popcorn Hour and navigate to it from the Media Source start page. Click on the telnet.html file and activate. If all goes well your TV screen turns white and reads "Telnetd started on port 23..........." .

Note that if you have previously inserted a USB device you might get the wrong path, e.g. USB_DRIVE_B-1. To avoid this, unplug all USB devices and reboot the Popcorn Hour previous to attempt this method. And beware of unplugging the USB device while executing.

A zipped package containing all the files needed are available here: http://erlis.se/PCH/telnetd-usb.zip

Enabling telnetd via SMB or NFS share

Cut and paste the following files to a directory on a share.


Please modify BUSYBOX and STARTPATH to reflect your environment.


echo "Content-Length: 29"; 
echo "Content-type: text/html"; 
echo ""; 

# don't change the basepath

echo "Content-Length: 30"; 
echo "Content-type: text/html"; 
echo ""; 



# enabled busybox as telnet
ln -sf /tmp/$BUSYBOX /usr/bin/telnetd

# maybe you want an editor as well?
#ln -sf /tmp/$BUSYBOX /usr/bin/vi

# and netstat?
#ln -sf /tmp/$BUSYBOX /usr/bin/netstat

echo "Telnetd starting on port 23......... ";
telnetd -l /bin/sh -p 23 &
exit 0; 

Don't forget make the cgi file executable via chmod +x telnet.cgi (look at other solutions above for how to do this in windows).


And save this file in the same directory, don't forget to change the path!

<a href="http://localhost.drives:8883/NETWORK_SHARE/the_serv_name/the_path/telnet.cgi">Enable Telnetd</a>


I'm using the binary from the above USB example: busybox26. Save it in the same directory as the above files.

You can also find telnet.cgi and telnet.html at the above server.

To enabled the above hack, navigate to your server (in file mode) and select the telnet.html file and press "Enable Telnetd"