Running native code on Hue Bridge 2.X

Once rooted, the OpenWrt-based Hue Bridge 2.X can run external binaries compiled for it.

Note if anything goes wrong, it should be possible to undo any damage with a factory reset.

Prerequisites

Root bridge using the pin2pwn method
Create an ssh key pair for dropbear on dev machine and manually copy public key onto Bridge over serial terminal, followed by a command to install it. Store private key locally in ~/.ssh/id_rsa_hue
```
echo "PUBLIC KEY CONTENTS" > /root/key
ssh-factory-key -r /root/key
```
Create links for shared libraries if they will be used
Ensure opkg is available on Bridge. Use instructions below to install if missing (later firmware removes binary)
Docker must be installed on dev machine

Building and executing custom C binary

./build

If successful, this will

download the appropriate Docker image with the OpenWrt SDK installed
copy source and cross compile into package
copy built package to working directory and across to Bridge via scp
install package onto Bridge

Then via ssh using root or new user account, the binary can be executed directly on the Bridge, it will be in the PATH.

Additional instructions

Restore Opkg removed in new firmware

It is likely necessary to set up missing library links before the copied binary will execute.

Prerequisites

squashfs (install on a Mac using brew install squashfs)
Download https://archive.openwrt.org/chaos_calmer/15.05.1/ar71xx/generic/openwrt-15.05.1-ar71xx-generic-root.squashfs

Extract filesystem

unsquashfs openwrt-15.05.1-ar71xx-generic-root.squashfs

Modify squashfs-root/etc/opkg.conf to remove check signature option.
This seems necessary since the Hue build of OpenWrt is custom and won't have matching build signatures.
```
- option check_signature 1
```

Copy binary and configuration to Bridge

scp -i ~/.ssh/id_rsa_hue squashfs-root/bin/opkg [email protected]:/bin
scp -i ~/.ssh/id_rsa_hue squashfs-root/etc/opkg.conf [email protected]:/etc/opkg.conf
scp -i ~/.ssh/id_rsa_hue squashfs-root/etc/opkg/distfeeds.conf [email protected]:/etc/opkg/distfeeds.conf

The opkg command will now be available on the Bridge

opkg update

Setup limited user account

It is always a good idea to avoid using the root account as soon as possible on a system. Sudo can also be installed to provide privileged access when needed.

On the bridge,

Install user management packages

opkg install sudo shadow-groupadd shadow-useradd

Create group and user and home directory. This will end with a prompt for a new password

USERNAME=<your own username>
groupadd --system sudo
useradd -s /bin/ash -G sudo $USERNAME
mkdir /home/$USERNAME
chown $USERNAME /home/$USERNAME
passwd $USERNAME

Configure sudo. Using vi, uncomment the sudo group line
```
visudo
```
```
- # %sudo ALL=(ALL) ALL
+ %sudo ALL=(ALL) ALL
```

It should now be possible to log in over SSH using the new username and password.

Create links for shared libraries

Some library files are not found with the same names expected by a standard OpenWrt Chaos Calmer 15.05.1 build. This prevents most packages (and in fact opkg itself) from executing. However, it appears the libraries are included with the system.

Thanks to the instructions found on blog.andreibanaru.ro for this step. It is extended here to include all shared libraries.

SSH into the Bridge and run the following commands

cd /lib
ln -s libm-1.0.14.so libm.so.0
ln -s libuClibc-1.0.14.so libc.so.0
ln -s libutil-1.0.14.so libutil.so.0
ln -s libdl-1.0.14.so libdl.so.0
ln -s libcrypt-1.0.14.so libcrypt.so.0
ln -s libpthread-1.0.14.so libpthread.so.0
ln -s librt-1.0.14.so librt.so.0
ln -s libuClibc-1.0.14.so libuClibc.so.0