Upgrade to Pro — share decks privately, control downloads, hide ads and more …

武蔵野さんを真似て 中古ルーターを分解した話

武蔵野さんを真似て 中古ルーターを分解した話

Here I talk about my first steps disassembling the a second hand router that I got from Hard-Off

Daniel Sangorrin

December 15, 2018
Tweet

More Decks by Daniel Sangorrin

Other Decks in How-to & DIY

Transcript

  1. 武蔵野さんを真似て 武蔵野さんを真似て 中古ルーターを分解した話 中古ルーターを分解した話 Daniel Sangorrin ( ダニエル ) @daromart

    https://speakerdeck.com/sangorrin https://sangorrin.blogspot.com/ https://github.com/sangorrin 東海道らぐ横浜集い2018冬の巻( 2018/12/15 )
  2. 主なスペック • 値段: 480 円 • 型番: TL-WR841N (JP) •

    Flash : 4 MiB (少なくて楽しい) • RAM : 32 MiB • ファームとソースを DL できるサイト: • https://www.tp-link.com/jp/download/T L-WR841N.html • イーサネットポート数: 4 個 + WAN • コンフィギュレーション画面: • http://192.168.0.1 (admin:admin)
  3. SoC のスペック • Chip: QCA9533-BL3A • Qualcomm atheros • MIPS

    24Kc, 650 MHz – https://wikidevi.com/wiki/MIPS_24K • GPIO: 18 multiplexed pins • JTAG: GPIO 0,1,2,3 = TCK, TDI, TDO, TMS • UART 16650-equivalent (115200 bps): GPIO 10, 11 • レジスターのマニュアルは github の怪しいリポジトリで見付けた • https://github.com/Deoptim/atheros/
  4. 成功。。。 U-Boot 1.1.4 (Mar 25 2016 - 16:59:35) ap143-2.0 -

    Honey Bee 2.0 DRAM: 32 MB Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x16 flash size 4MB, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ath_gmac_enet_initialize... Starting kernel ... Booting QCA953x Linux version 2.6.31 (tomcat@buildserver) (gcc version 4.3.3 (GCC) ) #13 Fri Mar 25
  5. だが。。。 TL-WR841N login: root Password: Login incorrect TL-WR841N login: admin

    Password: Login incorrect TL-WR841N login: root Password: Login incorrect Jan 1 00:03:30 login[199]: invalid password for `root' on `ttyS0' パスワードはなんなんやろう!
  6. binwalk はすごい! $ git clone https://github.com/ReFirmLabs/binwalk.git $ cd binwalk/ $

    sudo ./deps.sh $ sudo python setup.py install $ binwalk -t wr841nv11_jp_3_16_9_up_boot\(160518\).bin DECIMAL HEXADECIMAL DESCRIPTION ------------------------------------------------------------------------------------------------------------------- 0 0x0 TP-Link firmware header, firmware version: 0.-15276.3, image version: "", product ID: 0x0, product version: 138477585, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 4063744, kernel length: 512, rootfs offset: 849290, rootfs length: 1048576, bootloader offset: 2883584, bootloader length: 0 13424 0x3470 U-Boot version string, "U-Boot 1.1.4 (Mar 25 2016 - 16:59:44)" 13472 0x34A0 CRC32 polynomial table, big endian 14784 0x39C0 uImage header, header size: 64 bytes, header CRC: 0x85572A9C, created: 2016-03-25 08:59:46, image size: 35924 bytes, Data Address: 0x80010000, Entry Point: 0x80010000, data CRC: 0xADACFD5C, OS: Linux, CPU: MIPS, image type: Firmware Image, compression type: lzma, image name: "u-boot image" 14848 0x3A00 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 93944 bytes 131584 0x20200 TP-Link firmware header, firmware version: 0.0.3, image version: "", product ID: 0x0, product version: 138477585, kernel load address: 0x0, kernel entry point: 0x80002000, kernel offset: 3932160, kernel length: 512, rootfs offset: 849290, rootfs length: 1048576, bootloader offset: 2883584, bootloader length: 0 132096 0x20400 LZMA compressed data, properties: 0x5D, dictionary size: 33554432 bytes, uncompressed size: 2495224 bytes 1180160 0x120200 Squashfs filesystem, little endian, version 4.0, compression:lzma, size: 2791548 bytes, 590 inodes, blocksize: 131072 bytes, created: 2016-05-18 09:05:32 ルーターのファーム
  7. hashcat をインストール $ sudo service lightdm stop $ ./NVIDIA-Linux-x86_64-410.78.run $

    sudo apt-get install ocl-icd-libopencl1 opencl-headers clinfo $ git clone https://github.com/hashcat/hashcat $ hashcat -I hashcat (v5.0.0-113-g774b9bb) starting... OpenCL Info: Platform ID #1 Vendor : NVIDIA Corporation Name : NVIDIA CUDA Version : OpenCL 1.2 CUDA 10.0.206 Device ID #1 Type : GPU Vendor ID : 32 Vendor : NVIDIA Corporation
  8. hashcat の使い方 $ echo -n mypass | md5sum a029d0df84eb5549c641e04a9ef389e5 $

    hashcat -w 2 -m 0 -a 3 -1 ?l a029d0df84eb5549c641e04a9ef389e5 ?1?1?1?1?1?1 -> a029d0df84eb5549c641e04a9ef389e5:mypass • hashcat syntax -m hash-type (md5:0) -a attack-mode (brute-force:3) -1 custom charset number 1 l:lowercase, u:uppercase, d:digits, h:hex, H:hexupper, s:symbols a:luds -w performance (1:minimal, 2:noticeable 3:unresponsive 4:headless) ?1?1?1?1?1?1: this means a word with 6 letters, where each letter can be in charset 1 (-1 ?l <-- a lower case letter)
  9. がんばれ! $ hashcat -w 2 -m 500 -a 3 -1

    ?l shadow ?1?1?1?1?1?1?1 [s]tatus [p]ause [b]ypass [c]heckpoint [q]uit => s Session..........: hashcat Status...........: Running Hash.Type........: md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5) Hash.Target......: $1$GTN.gpri$DlSyKvZKMR9A9Uj9e9wR3/ Time.Started.....: Sun Dec 2 10:58:58 2018 (20 secs) Time.Estimated...: Tue Dec 4 12:34:57 2018 (2 days, 1 hour) パスワードは 9 文字を 推測の場合
  10. 近道 $ hashcat --potfile-disable -i --increment-min=6 -w 3 -m 500

    -a 3 -1 ?l -O shadow \ ?1?1?1?1admin パスワードは 6 ~ 9 文字で admin で終わることを 推測の場合 $1$GTN.gpri$DlSyKvZKMR9 A9Uj9e9wR3/:sohoadmin
  11. ソースのビルド [Note] Host: ubuntu 12, gcc 4.6.3, make 3.81 $

    tar xvf TL-WR841NV11_eu.tar.gz $ cd TL-WR841NV11_eu/build $ make 意外と簡単! make mk_squashfs_build fs_size=0x2C0000 make fill_model_conf cp: cannot stat ‘/home/dsl/Desktop/tl-wr841n/rootfs/source/TL- WR841NV11_eu/build/../build/products_config/wr841nv11_eu//version.conf’: No such file or directory make[2]: [fill_model_conf] Error 1 (ignored) ENCRYPT len:1496 fakeroot: preload library `libfakeroot.so' not found, aborting. make: *** [wr841nv11_eu] Error 2 エラー!
  12. どんなものが入るの? • /bin/busybox • /sbin/80211stats • /sbin/apstats • /sbin/athstats •

    /sbin/athstatsclr • /sbin/iptables-multi • /sbin/pktlogconf • /sbin/pktlogdump • /sbin/tc • /sbin/wifitool • /sbin/wlanconfig • /usr/arp • /usr/net_ioctl • /usr/bin/lld2d • /usr/sbin/bpalogin • /usr/sbin/dropbearmulti • /usr/sbin/pppd • /usr/sbin/xl2tpd
  13. GPIO 操作したい - kernel.conf CONFIG_GPIOLIB=y CONFIG_GPIO_SYSFS=y $ vi drivers/gpio/Kconfig -

    remove dependency on arch_want_gpiolib - fstab $ find . -iname fstab $ vi ./filesystem/ap93fus/etc/fstab sysfs /sys sysfs nosuid,noexec,nodev 0
  14. ビルドして、アップグレードすると 0x000000000000-0x000000020000 : "u-boot" 0x000000020000-0x000000120000 : "kernel" 0x000000120000-0x0000003e0000 : "rootfs"

    0x0000003e0000-0x0000003f0000 : "config" 0x0000003f0000-0x000000400000 : "art" ->Oops: flash id 0xc84016 . Ooops, why the devices couldn't been initialed? TCP cubic registered NET: Registered protocol family 10 NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <[email protected]> All bugs added by David S. Miller <[email protected]> athwdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 120k freed Please be patient, while OpenWrt loads .. ... BRICK しちゃった!
  15. オリジナルの復元 $ sudo ifconfig eth0:1 192.168.0.66 netmask 255.255.255.0 $ sudo

    cp wr841nv11_jp_3_16_9_up_boot\(160518\).bin /var/lib/tftpboot/wr841nv11_tp_recovery.bin 後は ボタンは2つを押しながら 再起動
  16. UNBRICK できた! TFTP from server 192.168.0.66; our IP address is

    192.168.0.86 Filename 'wr841nv11_tp_recovery.bin'. Load address: 0x80800000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############## done Bytes transferred = 4063744 (3e0200 hex) Firmware recovery: product id verify sucess! Firmware recovery: filesize = 0x3e0200. Erasing flash... First 0x2 last 0x3d sector size 0x10000 61 Erased 60 sectors Copy to Flash... write addr: 9f020000 done UNBRICK 成功!
  17. やりたいこと • GPIO は使えるようにして、サーボやリモコン を操作できるように • WiFi のサーバーにアプリを作って、携帯から API を使えるように

    • 例:携帯からリモコンを操作して、エアコン やライトを動作する • JTAG のピンを探して、 JTAG の勉強もしたい