Meraki MX84 Teardown and Hardware info

Teardown:

Popping the lid off this thing follows the same pattern as a lot of rack mount gear, just four screws on the back, and the cover can slide a small amount back, then taken off completely. This unveils really cleanly laid out internals with nearly everything screwed to the bottom of the case on standoffs.

Hacking:

Naturally start with the easiest thing first, the 1tb HDD. Aaaand—nothing, it's a LUKS encrypted partition which is useless to us until we can get the (hopefully random) key off the system firmware.

Next step, four pins! This usually means UART, the board has two headers kindly installed for us. We'll confirm with a cheap logic analyzer and pulseview for sigrok. Sure enough it's a 115200 baud UART connection, here's the output from my USB to TTL cable that I captured while the system booted.

mx84w.txt

In summary, it's a pretty standard coreboot setup with lzma/squashfs running an old version of busybox. I assume Cisco has kept stuff up to date, I just have no way to update the firmware without an admin panel. Other than that there's some hardware info, we know it's running Snort and a custom kernel, but nothing too out of the ordinary.

The other 4-pin header I suspect is for UART on the other chip which I'm not too concerned about right now. I think I tested it and got no output, but I'm writing this a while after I actually did all this and don't remember.

Info:

I'll go over each component on the main board one by one.

CPU

Intel Atom C2358 - seems like an appropriate choice for this, low power embedded
More info:
https://ark.intel.com/content/www/us/en/ark/products/77978/intel-atom-processor-c2358-1m-cache-1-70-ghz.html

RAM

32gb of SKHynix ECC DDR3-1600
9 chips tells us it's ECC, chip number is H5TC4G83CFR, "PBA" variant
More info:
https://www.skhynix.com/products.view.do?vseq=1340&cseq=74

Ethernet controller

Probably the most specialized component on this board, basically a managed switch in chip form, communicates with the CPU over some form of API. I'll leave any further investigation until the rest of the system is pwned.
More info:
https://www.microsemi.com/product-directory/ethernet-switches/3969-vsc7425

Flash

The 48 pin TFSOP is a flash chip, and likely what the system boots from, I want whatever is on it. https://www.digikey.com/product-detail/en/toshiba-memory-america-inc/TH58NVG3S0HTA00/TH58NVG3S0HTA00-ND/5226335

USB Flash controller

Following the traces from the NAND flash chip leads to the other side of the board which houses a Phison ps2303q USB flash controller. This is basically the chip you would find on usb drives that manages a single raw NAND flash chip. This is how the Intel CPU communicates with the flash chip and is probably the easiest way to approach getting a firmware dump from it. Actual info about this chip is pretty limited, when I was first working on this project I ran into this pinout info which luckily I saved locally since the source has disappeared.

Conclusion

Theoretically all it should take to get a ROM off this is to hook up VBUS on pin 17, GND on pin 62, and pins 50/51 to D+ and D- on a usb 2 cable. Unfortunately this chip is painfully small which is why I've procrastinated on this project. Hopefully I get bored enough to try it soon and get a firmware dump to poke at in a kali instance. Until then, good luck to anyone who pursues this, and update me on any findings!