Cyberloginit

Utelnetd Interface Parameter Stack Buffer Overflow

2020-07-26T00:00:00+00:00

Utelnetd Interface Parameter Stack Buffer Overflow

Utelnetd

utelnetd is a small and efficient stand alone Telnet server daemon.

The source code can be downloaded from Pengutronix, and the latest version is 0.1.11.

2008-08-11 Marc Kleine-Budde mkl@pengutronix.de

	- Revision 0.1.11 released
	- added CFLAGS to linking stage
	 (thanks to Remy Bohmer <linux@bohmer.net>)

There is also a SourceForge project, but the latest version is 0.1.9.

At present, the only major Linux distro still has Utelnetd in its packages repository is Gentoo.

Buffer Overflow

The stack buffer overflow vulnerability affects Utelnetd version from 0.1.7 to the latest 0.1.11.

2003-08-06 Robert Schwebel r.schwebel@pengutronix.de

	- Revision 0.1.7 released
	- changed Makefile and utelnetd.c to work with BSD
	  (thanks to Sepherosa Ziehau <sepherosa@myrealbox.com>)

When the compatibility with BSD was introduced in Revision 0.1.7,

if (interface_name) {
    strncpy(interface.ifr_ifrn.ifrn_name, interface_name, IFNAMSIZ);
    (void)setsockopt(master_fd, SOL_SOCKET,
            SO_BINDTODEVICE, &interface, sizeof(interface));
}

was changed to

if (interface_name) {

    strcpy(interface.ifr_name, interface_name);

    /* use ioctl() here as BSD does not have setsockopt() */
    if (ioctl(master_fd, SIOCGIFADDR, &interface) < 0) {
        printf("Please check the NIC you specified with -i option\n");
        perror("ioctl SIOCGFADDR");
        return 1;
    }

    sa.sin_addr = ((struct sockaddr_in *)(&interface.ifr_addr))->sin_addr;
} else 
    sa.sin_addr.s_addr = htonl(INADDR_ANY);

Especially, strncpy(interface.ifr_ifrn.ifrn_name, interface_name, IFNAMSIZ); was changed to strcpy(interface.ifr_name, interface_name);.

The user-controlled interface parameter(interface_name local string variable) is copied to the interface.ifr_name element from the struct ifreq interface local variable without having its length checked.

The interface.ifr_name has a fix length of 16 bytes on Linux systems like Ubuntu 18.04 64 bit.

valgrind --leak-check=full ./utelnetd -p 8000 -l /bin/sh -i "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

Exploit

On a multi-user system with root and non-root users, if the utelnetd executable file has the setuid attribute, malicious user could overflow the interface.ifr_name buffer and overwrite the EIP/RIP register to achieve privilege escalation and effectively take control of the whole system as root.

Reference

D-Link SharePort Web Access Authentication Bypass

2019-09-10T00:00:00+00:00

D-Link SharePort Web Access Authentication Bypass

Vulnerability Description

SharePort Web Access is a feature available to most D-Link wireless home routers with a USB port.

It is enabled by default.

Tutorial from its website shows that just insert your USB Flash Drive into your router, then you will be able to access it from the Internet by visit a URL like http://[ip]:8181.

Theoretically you have to be authorized by entering your router’s administrator username and password.

However, D-Link screws it up pretty badly.

First: If you have not changed them from the defaults, the username should be Admin, and the password field should be left blank.

Second: The authentication can be bypassed directly. Just visit folder_view.php or category_view.php or any valid page in this path and authentication is not required, including even logininfo.xml.

In some cases, visit http://[ip]:[port]/webaccess/folder_view.php instead http://[ip]:[port]/folder_view.php.

Vulnerability Scope

At least these wireless router models below are affected, each with its latest firmware installed.

Model	Revision	Firmware	Note
DIR-868L	REVB	2.03	Latest
DIR-885L	REVA	1.20	Latest
DIR-895L	REVA	1.21	Latest

Vulnerability Analysis

So, how the authentication fails ？

Take http://[ip]:[port]/folder_view.php for example.

Authentication Functions

folder_view.php is actually a HTML with JavaScript, nothing PHP here.

On line 719

<body onLoad="load_value();get_login_info()">

get_login_info() is supposed to do the authentication .

get_login_info()

function get_login_info(){
    var xml_request = new XMLRequest(get_login_info_result);
    var para = "request=get_login_info";

    xml_request.exec_webfile_cgi(para);
}

XMLRequest()

/**
 * XMLRequest( ) - Constructor for building XMLRequest Object 
 
 *	Parameter(s) :
 * 	onReqComp : the function that you want to perform after receive response from the web server
 *
 * Variable(s) :
 * 	http_req   :  user custom function for performing post response.
 * 	onReqComp  :  user custom function for performing post response.
 *
 **/
function XMLRequest(onReqComp){
	this.http_req = create_http_request();	
	this.onReqComp = onReqComp;	
}

/**
 * XMLRequest.prototype - Prototype of XMLRequest Object 
 *
 * Data members:
 * 	READY_STATE_***:  ready state constants
 *
 * Methods:
 * 	loading_xml()		:  get remote xml document
 * 	exec_cgi()			:  requesting server performing CGI command
 *  	get_login_level() :  get user's login level
 * 	onReadyState()		:  callback function while readystate changing
 **/
XMLRequest.prototype = {

READY_STATE_UNINITIALIZED 	: 0,
READY_STATE_LOADING 			: 1,
READY_STATE_LOADED 			: 2,
READY_STATE_INTERACTIVE 	: 3,
READY_STATE_COMPLETE 		: 4,


loading_xml: function(which_url){	
	//...
},

exec_cgi: function(para){
	//...			
},

exec_webfile_cgi: function(para){
	var req_url = "logininfo.xml?" + para;
	var obj = this;
		
	if (this.http_req){	
		this.http_req.onreadystatechange = function() {obj.onReadyState.call(obj)};				
		this.http_req.open('GET', req_url, true);
		this.http_req.setRequestHeader('Content-length', para.length);	
		this.http_req.setRequestHeader("Connection", "close");
		this.http_req.send(null);		
		
		return true;
	}			
	
	return false;			
},

exec_auth_cgi: function(para){
	//...	
},

json_cgi: function(para){
	//...		
},

get_login_level: function(){	
	//...
},

onReadyState: function(){
	//...
}
}

get_login_info_result()

function get_login_info_result(http_req){
	//...
	var my_xml = http_req.responseXML;

	if (check_user_info(my_xml.getElementsByTagName("redirect_page")[0])){

		storage_user.put("id", get_node_value(my_xml, "user_name"));
		storage_user.put("tok", get_node_value(my_xml, "user_pwd"));

		load_webfile_settings();
	}
}

check_user_info()

/**
 *	check_user_info() : to check if the user has login yet
 *
 *	Parameter(s) :
 *		redirect_page : a XML's element object which contains a redirect page
 *
 * Return :	True or False
 * 	
 **/
function check_user_info(redirect_page){
	var which_page;
	
	if (redirect_page != null){	
		which_page = redirect_page.firstChild.nodeValue;
		location.href = html_obj.get_value(which_page);				
		return 0;
	}
	
	return 1;
}

How It Failed

When get_login_info() GET

http://[ip]:[port]/logininfo.xml?request=get_login_info

We get

<?xml version="1.0"?>
<root>
	<user_name>admin</user_name>
	<user_pwd>t</user_pwd>
	<volid>1</volid>
</root>

In get_login_info_result()

var my_xml = http_req.responseXML;

my_xml is actually the XML content above.

my_xml.getElementsByTagName("redirect_page") should return

HTMLCollection []
length: 0
__proto__: HTMLCollection

And if we should try to take its first element, undefined is returned.

In get_login_info_result()

if (check_user_info(my_xml.getElementsByTagName("redirect_page")[0])){

	storage_user.put("id", get_node_value(my_xml, "user_name"));
	storage_user.put("tok", get_node_value(my_xml, "user_pwd"));

	load_webfile_settings();
}

If check_user_info(my_xml.getElementsByTagName("redirect_page")[0]) is True, load_webfile_settings() will be executed, which means user is authorized to visit this page folder_view.php.

However, in check_user_info()

function check_user_info(redirect_page){
	var which_page;
	
	if (redirect_page != null){	
		which_page = redirect_page.firstChild.nodeValue;
		location.href = html_obj.get_value(which_page);				
		return 0;
	}
	
	return 1;
}

If element redirect_page = my_xml.getElementsByTagName("redirect_page")[0] does not exist, 1 is returned, and user is authorized to proceed !

Summary

The authentication procedure for D-Link SharePort Web Access basically fails at every aspects.

Frontend authentication is not very reliable;
Name your variable wisely, or you will most likely pay for it.

Reference

https://eu.dlink.com/uk/en/support/faq/routers/mydlink-routers/dir-880l/how-do-i-configure-shareport-web-access-on-my-router

使用Fiddler嗅探Android App网络流量并还原大象公会RESTful API

2018-05-21T00:00:00+00:00

使用Fiddler嗅探Android App网络流量并还原大象公会RESTful API

缘由

很喜欢大象公会的文章，很讨厌微信公众号这种封闭平台。

但其首要的文章发布平台是微信，还好官网也提供Android App下载。

吐槽：官网没有HTTPS保护；Android App没有上架Google Play Store，还好提供直接下载链接，而不是像Vice中国那样放在第三方“应用商店”，然而下载链接也未做HTTPS保护。

手机启用未知安装来源(Unknown sources)，安装大象公会Apk，发现

This app can collect data that may be used to track you.

由于Apk的下载链接是HTTP，有被篡改或替换的风险。首先排除安装包被替换的可能(毕竟得到的还是大象公会，不是应用宝。。。)；其次，运营商暂时没有对安装包注入恶意代码的需求；所以，应该是因为大象公会Android App接入了国内某些统计SDK，这种情况比较常见。

因此，有必要看一下大象公会的Android App究竟如何与服务器交互，为后面第三方客户端的开发做基础。

嗅探

嗅探Android App HTTP数据包主要有两种方法：

在Android本地嗅探，工具如Packet Capture；
在网络传输过程中嗅探，如PC代理，经典工具有Fiddler, Charles, Burp suite；

Fiddler, Charles, Burp suite等工具嗅探Android App流量的原理都一样，即联网的PC安装上述客户端，在局域网内提供HTTP代理，设置Android手机Wi-Fi流量走该代理。

之前一直用Burp suite，但其更着重捕获，而非监听，所以要设置放行规则，本次需求中体验较差，故使用Fiddler。

Fiddler需要先Allow remote computers to connect

端口即Android设置Wi-Fi HTTP Proxy时填的端口。

然后，PC本机的流量及使用Fiddler HTTP代理的流量都会显示。

RESTful API

打开大象公会App，刷新或者点击单篇文章，Fiddler中出现对应的RESTFul请求，否定了之前的猜测：文章存储在微信公众号，客户端只是套壳浏览器。

看来大象公会网站已经实现了完整的RESTful API，提供Web网页很容易，不清楚为什么没有提供，毕竟Web是这个时代最开放的平台。

获取文章列表API：

http://app.idaxiang.org/api/v1_0/art/list?pageSize=20

pageSize指定返回的文章条目数量：

{
    "body": {
        "ad": {
            "welcome_ad": "0",
            "article_ad": "0",
            "css_version_code": "1"
        },
        "article": [
            {
                "id": "1071",
                "title": "唐朝真的「对外开放」吗？",
                "headpic": "http://static.idaxiang.org/fb875f7f0d51225ff62afb3492845c22_thumb.jpeg",
                "raw_headpic": "http://static.idaxiang.org/fb875f7f0d51225ff62afb3492845c22.jpeg",
                "author": "石禄珊",
                "brief": "唐朝的「对外开放」，是一种「外面的能进来，里面的难出去，进来了休想走」的开放。",
                "read_num": "2457",
                "wechat_url": "https://mp.weixin.qq.com/s?__biz=MjM5NzQwNjcyMQ==&mid=2651015947&idx=1&sn=8c0fd661ffb13ba8641d956a3279985b&chksm=bd2d9a658a5a13735e19a78664f28bf554eed56e1f26fd6a13b8684dba7673ca543e79039c64#rd",
                "url": "",
                "create_time": "1526486400",
                "update_time": "1526567239"
            },
            {
                "id": "1070",
                "title": "南怀瑾的江湖",
                "headpic": "http://static.idaxiang.org/bacf201ecbaf03e61fadf6027dad7e4d_thumb.jpeg",
                "raw_headpic": "http://static.idaxiang.org/bacf201ecbaf03e61fadf6027dad7e4d.jpeg",
                "author": "李青岚",
                "brief": "他以绝大机缘和自身禀赋，在特殊的历史行程里占据了一个独一无二的生态位。南怀瑾可以成为「国学大师」，但国学大师绝不可能成为南怀瑾。",
                "read_num": "1815",
                "wechat_url": "https://mp.weixin.qq.com/s?__biz=MjM5NzQwNjcyMQ==&mid=2651015925&idx=1&sn=a64dab30eff2ec6f9e9f9c0ef735acc1&chksm=bd2d9b9b8a5a128d0310124939d393b605c6de66b621e63998ad625161a0c0d8c339718107e6#rd",
                "url": "",
                "create_time": "1526400000",
                "update_time": "1526567348"
            }
        ]
    },
    "head": {
        "code": 0,
        "message": "",
        "has_more": true
    }
}

获取指定文章API：

http://app.idaxiang.org/api/v1_0/art/info?id=400

id即文章ID，返回指定文章内容：

{
    "body": {
        "article": {
            "id": "400",
            "title": "上海为什么缺少创业家",
            "headpic": "http://static.idaxiang.org/d6973a16ee62198c80127569b6e03e43_thumb.jpg",
            "raw_headpic": "http://static.idaxiang.org/d6973a16ee62198c80127569b6e03e43.jpg",
            "author": "高利民",
            "brief": "上海是中国政府管理能力、效率和服务意识最好的城市，而且也是人才引进奖励制度最完善、规范的城市，但这些优点，有事恰恰妨碍出现创业者。",
            "content": "<h5><span>上海是中国政府管理能力、效率和服务意识最好的城市，而且也是人才引进奖励制度最完善、规范的城市，但这些优点，有事恰恰妨碍出现创业者。</span></h5><p>你能想起几个最近十年在上海崛起的民营企业品牌？</p><p>几乎没有。如果换做北京、广东、福建、浙江，许多人都能至少说出一些。</p><p style=\"text-align: center;\"><img src=\"http://static.idaxiang.org/266f989922b96aaaf57c16a4ad4f35b6.jpeg\"/></p><h6><span>2014中国民营企业500强各省区市企业数量</span></h6><p>这是令上海倍感尴尬的一点：作为一直以来中国内地的经济中心，上海聚集了大量跨国企业、著名国企、民营企业的中国区总部，几乎能找到所有世界知名企业。但却极少有本土的创业企业，也很少生长著名的品牌、专利。</p><p>上海规模民营企业，大都集中在传统制造业和商业领域，极少有高科技型企业。以专利数量论，北京专利数仅次于广东，但每万人拥有的有效专利数则高居全国第一，接近上海的2倍。即使刨去其中国家科研院所的成分，其绝对领先也不容置疑。</p><p>那么，水面下的冰山呢？截止2013年末，中国各地注册商标数排名是：广东（112.7 万）、浙江（86.4 万）、北京（46.7 万）、江苏（45.9 万）、福建（40 万）、上海（36.4万）。人口多于北京的上海却被北京拉开了相当大的距离。</p><p style=\"text-align: center;\"><span><img src=\"http://static.idaxiang.org/396800832765969b23937e4ed40f5bd9.jpeg\"/></span></p><h6><span>截止2011年部分省市有效发明专利量及万人发明专利拥有量情况</span></h6><p>然而，在中国城市中，上海却是公认政府管理最精细、效率最高、服务意识最好的城市，为吸引人才、鼓励创新不遗余力。或许，正是这种强烈反差，才会有2008年时任上海市委书记的俞正声著名的俞氏一问：上海为什么不出马云？</p><h2>缺乏空间的土壤</h2><p>其实，早期的上海也曾是创业家的乐园。</p><p>19世纪中期后，上海先后设立了英、法、美等国租界，逐渐形成了脱离于清政府权力，又享有国际交往的独立空间，最早接触到了近代化的经济组织形式。</p><p>此后，上海逐步成为远东的经济、贸易中心之一，无数冒险者来到这片十里洋场，虽然当时的人们并不将此称为“创业”，但许多工厂、商行都在此产生。</p><p style=\"text-align: center;\"><span><img src=\"http://static.idaxiang.org/daa06d095bc36d3907a41e12b3306a00.jpeg\"/></span></p><h6><span>1928年的上海公共租界外滩一景</span></h6><p>真正的变化产生于1949年以后。由于上海出色的经济基础，被作为公私合营、货币改制等新政的重点地区。上海和工业基础同样雄厚的东北一样，建立了远比其他地区更完备的公有制体系。</p><p>这时的上海经济到底比其他地区高出多少？</p><p>即使经历了“三线建设”等为中西部输血的过程，上海仍在改革开放前占全国工业总产值的三分之一左右。它在计划经济中的地位，使之今日依然保有强大的国有经济体系。</p><p>熟悉上海的外地人应该注意到一个现象：上海今天的国营商业企业依然无处不在。以超市为例，上海的社区型超市主要是联华与华联（现已合并为一家），两者均为商业局下属，比它们更小且遍布街巷的国字号超市还有可的、好德等。</p><p>中国几乎不会有第二个城市，国营超市占据如此重要的地位。与超市毗邻的，还有很多国营饭馆甚至理发馆——有些饭馆严格坚持每天8小时劳动，午后有两小时午休。不可思议的是，有些民营餐馆会让你觉得是国营的，里面的服务人员不是外地小姑娘，而是一群本地阿姨。</p><p>这当然是50年代后公有制改造的后果，但其格局延续至今，还有赖于上海在经济体制转型中对就业问题的出色解决——它几乎没有经历过其他相似城市那种剧烈的下岗社会镇痛。其他地方转轨过程中常出现的国有资产流失问题，在上海引起的争议也非常小。</p><p style=\"text-align: center;\"><span><img src=\"http://static.idaxiang.org/5c2537b16fe5896ed754d691c98cf4a3.jpeg\"/></span></p><h6><span>1956年，毛泽东在荣毅仁陪同下参观上海中新纺织厂</span></h6><p>与其鲜明相对的是重工业盛极一时的东北。这很大程度上得益于上海市政府官员卓越的管理能力。</p><p>不过，这却日渐显示出了另一面的效应——给新企业、新经济势力留出的空间太小了。</p><p>中国民营企业具有强大创新能力和社会活力的地区，无一例外都是国营企业不成气候，计划经济体制薄弱的地方。中国国企比重较大的地区，国企多仰赖银行低息贷款及国家特许政策等优惠维系，而上海则仰赖高昂的地价，这使它们相对更理直气壮，拥有无处不在的话事权。</p><p>为谋求稳定的市场地位，它们很容易通过政府制定各种细密的管治措施，构建维护垄断地位的堤坝。而创业行为，本质上打破行业格局的洗牌行为，它当然为地位稳固者所不容。像“滴滴专车”最近被上海市交管局叫停这种事发生在上海，其实并不意外。</p><h2>五道口与张江科技园</h2><p>上海并不是没有意识到这一点。</p><p>1980年以后，上海经济增长速度放缓，其经济中心的地位受到浙江、广东、福建的挑战。直到九零年决定开发浦东新区，上海才在接下来的十多年保持了10%以上的增长，重新确立了自己在全国经济中的地位。</p><p>这也给上海市应对创业问题提供了思路——典型的例子就是精心规划设计的张江高科技园区。</p><p>为了形成像北京海淀区那样的人才集聚效应，科技园区与新大学园区被安排得很近。这里的马路极为宽阔，马路两旁是整齐、漂亮的园区建筑，但几乎没有生活气息，看上去很像一块北京的飞地。</p><p style=\"text-align: center;\"><img src=\"http://static.idaxiang.org/78bfc9381eb8daa0efd382792e8145ba.jpeg\"/></p><h6>上海张江高科技园区</h6><p>问题是，这块精心设计的园区，只适合已成规模的企业入驻，而不是在这里创业。一般的创业者很难在此找到合适的低成本住房、餐饮等条件。</p><p>如果类比北京海淀的五道口，这种精心的规划其实是不利于创业的。</p><p>五道口之所以成为怀抱IT创业梦者心中的“宇宙中心”，除了周边高校和IT企业云集外，附近多为小而老旧的小区，少有大规模的高档社区，一到晚上满街摊贩。热闹、拥挤而富于生活气息的五道口，是最不像北京的地方，倒像是老上海在北京的一块飞地，但可为梦想家们提供就近且便利廉价的栖息条件，如果实在没钱，他们甚至可以混进学校宿舍。</p><p>如果中关村和五道口像张江高科技园区一样，宽阔的马路两旁只有敞亮巨大的办公室，街道上看不见闲杂人员，一到下班时间，大家就一哄而散赶路回家，它断不会像今天这样每天诞生无数的创意和新企业。</p><p>上海浦东陆家嘴金融中心的街道规划方式，也被批评为大而无当——华尔街摩天大楼之间的街道非常狭窄，临街密布着咖啡馆之类的谈话场所，两栋写字楼里的生意人突然有想法时，可以非常便利地约谈碰撞，而陆家嘴那些写字楼里的人，要和对面大楼的人当面交流，必须横过极为宽阔的马路，是绕远路，还是打出租车，颇费思量。</p><p style=\"text-align: center;\"><img src=\"http://static.idaxiang.org/bd8d5aaa2596917ae54356831bb6e099.jpeg\"/></p><h6>从纽约曼哈顿东部的克莱斯勒大楼向下看，纽约的街道与上海浦东新区相比十分狭窄</h6><p>好在上海市政府注意到了这个批评，于是有了一个可以不用横过马路的补救措施，在几栋摩天大楼之间修了一个巨大的陆家嘴天桥。可惜辽阔的张江科技园就很难照此办理了。</p><p>创业者需要的往往是一种宽松的环境，成本低廉，又在空间上充满联系，容易沟通。这是规划者最不擅长的事情——历史上，没有几个创业中心是规划出来的。</p><p>而且，也并没有哪些人从出生起就带着创业者的标签。创业企业、创业者往往诞生于复杂的交汇之中，新增的城市移民、高校毕业生中创业比例都很高。</p><p style=\"text-align: center;\"><img src=\"http://static.idaxiang.org/95609da1b8ad9b769564fe3a5981135d.jpeg\"/></p><h6>陆家嘴天桥</h6><p>上海自然知道这些人的重要性。它们也有着全国最优秀的人才引进制度，其积分方案、居住证福利在全国绝对属于一流。</p><p>但这种优秀制度反而引起了一些负面效果。</p><h2>被“格式化”的上海梦</h2><p>1992年，上海常住人口是1280万，到2013年底，上海常住人口为2415万，11年净增了1100多万人，新移民占总人口数的47%。</p><p style=\"text-align: center;\"><span><img src=\"http://static.idaxiang.org/aa5d572a77d89962dd0085577c35b7fd.jpeg\"/></span></p><h6><span>上海市人口年龄结构与国际通用年龄结构的对比</span></h6><p>但是，深圳同样新增1000万移民，里面出现了任正非、马化腾等登上世界级舞台的创业者。而上海新移民中，却没有同等量级的创业家。</p><p>如果对上海、北京、广州、深圳新移民做一项奋斗梦想的问卷调查，或许“上海梦”最单调实际，那就是房子。北京、深圳的梦想就要五花八门得多。</p><p>上海是引领中国房价的龙头，并且是中国第一个因住房价格高涨出现全民炒房现象的城市。“炒房”重塑了上海人的观念，它不但是上海人日常交流的必谈话以甚至成为衡量成就的重要标签。</p><p>房价贵使得1980年代以前普遍有房的上海人突如其来地享受到了“存量涨停”的福利，这笔意外的财富保障使得老上海人和老北京人、老广州人一样不思进取。</p><p style=\"text-align: center;\"><img src=\"http://static.idaxiang.org/61b26b2646d4b9166cd1401058cf8951.jpeg\"/></p><h6>1999—2010，上海房价与人均月薪走势图</h6><p>对上海新移民来说，2008年前后，则是一条分界线。2008年前成功买房落沪的人，是“房产红利”的最大得利族群，他们许多人通过买房攒房完成了真正意义上的“原始积累”。2008年之后来沪的人，“落户”一夜之间变成了“为房子而活的战争”。</p><p>对新移民来说，上海住房问题的影响来得远比广州、深圳甚至北京严重。深圳、广州有大量城中村，北京虽然较少城中村，但其市政、社区和小区物业管理远不如上海精细，虽然近年开始学习上海整治群租以及在住宅区办公司的现象，但死角比上海要多得多。</p><p>这让新移民的个人发展受到极大限制——没有低价栖身的空间。当然，人们也可以认为，没有低价住房，筛掉的大多是素质不那么高的人才，上海需要的是高素质人才。</p><p style=\"text-align: center;\"><span><img src=\"http://static.idaxiang.org/bb6711ae6f2223bd4802c575a29bf4b0.jpeg\"/></span></p><h6><span>白石洲，深圳最大的城中村，多年来成为了来深打拼人员的聚集地</span></h6><p>为吸引外地高素质人才，上海推出了提供留居上海的各项激励措施，按2002年相关规则，获得居住证七年后可申请上海户籍。相比其他城市的粗放简单，上海人以其特有的精密、认真，拿出一套“国内人才申领《上海市居住证》打分表”，使规则变得更清晰、透明，能极大程度地消灭作弊空间。这使得只有上海的居住证才是被外地新移民积极认真对待的。</p><p>但是，上海金融与法律研究院在承接《户籍的成本》课题时，仔细研读这个打分机制对人才的激励作用，他们得出这样一个结论，它实际上鼓励的是外来人才安心打工，而不是创业。</p><p>譬如，受聘的薪水、岗位级别、纳税数额、社保缴纳越高，得分越高，它当然是“甄别人才”的合理衡量标准，但却会让一个积分很高的人在面临创业机会时，陷入选择困境——在离居住证、上海户籍只有一步之遥时，创业往往意味着前功尽弃，毕竟白手起家创业期间，在薪水、纳税额、社保缴纳的得分都会大幅下降。</p><p>虽然《上海市居住证》打分表中，有“人才在沪投资创业附加分”，但它的打分奖励全部是以投资额和雇佣本地人数来计算的，实际鼓励的是外地资本在上海办企业，而不是在上海白手起家创业。这与通常人们说的创业完全不是一回事。</p><p style=\"text-align: center;\"><img src=\"http://static.idaxiang.org/4cae61e5191a2627cef2023aa09ba238.png\"/></p><h6><span>某上海教育机构打出的招生广告</span></h6><p>有趣的是，《上海市居住证积分办法细则》中“职称”依然占了很大权重，除了特殊技术岗位，职称对民营机构组织来说，没有任何价值，但这套打分体系，会使得不在国营单位的新移民，为了居住证去浪费时间报考“经济师”这类毫无用处的职称。</p><p>前面提到的房子，同样是打分项目，买房加分，它起到了与房价上涨的相同作用——有钱立即买房。</p><p>所以，我们一点不难理解，新移民的“上海梦”是高度格式化的：房子。至于创业，最好还是到北京、深圳去碰碰运气吧。</p>                    ",
            "read_num": "2689",
            "wechat_url": "http://mp.weixin.qq.com/s?__biz=MjM5NzQwNjcyMQ==&mid=209551190&idx=1&sn=ce028395392990019b94830e4860da77#rd",
            "url": "",
            "create_time": "1419955200",
            "update_time": "1437653110"
        }
    },
    "head": {
        "code": 0,
        "message": ""
    }
}

很容易发现body.article.content中便是HTML编码的文章(包括图片)。

此外，本文写成时最新的文章id是1071，对应”唐朝真的「对外开放」吗？”这篇文章，如果为pageSize赋值1000，返回的文章列表基本上包括了大象公会创立以来的所有文章。

值得注意的是，文章id大部分情况下是连续的，但也存在连续几百个id没有对应文章的情况，主要集中在238以下，不清楚是API设计者有意为之(留作他用)，还是一些id对应的文章在审查的压力下被迫删除(一些高位的id)。

大象公会的RESTful API很好的体现了Web平台的开放性，在此基础上可以开发体验更佳的Android/iOS客户端，或是制作RSS订阅源。

东信和平USIM卡破解原理及Linux下智能卡渗透笔记

2018-05-14T00:00:00+00:00

东信和平USIM卡破解原理及Linux下智能卡渗透笔记

东信和平USIM卡破解原理

背景

查找东信和平USIM资料时看到这篇“利用东信和平卡可编辑的技术，改iccid用有锁iphone手机”，

14年东信和平的usim卡被暴出可以读取卡片的信息

读取出卡的数据，重新写入白卡中使用

此处“读取出卡的数据”至少能够读出IMSI, Ki, OP/OPc，而Ki在普通鉴权等级(PIN/PUK)下是无法读出的，至少需要ADM鉴权。

分析

下载附件“USIM_Explorer改iccid软件.zip”，里面有dx.exe, DesDLL.dll和USIM_Explorer.exe三个可执行文件。

根据里面某张截图的提示，修改东信和平USIM卡的ICCID需要使用USIM_Explorer.exe执行以下命令

0020000A08 + 使用`dx.exe`计算出的ADM
00A4000C02 + 3F00
00A4000C02 + 2FE2
00D600000A + ICCID(20个十六进制数字)

APDU

关于Smart Card Communication

Card Acceptance Device(CAD): supply the cards with power
half-duplexed communication model
master-slave mode: CAD is the master, Card is the slave
Application Protocol Data Unit(APDU): ISO 7816-4
Command APDU(C-APDU): from CAD to Card
Response APDU(R-APDU): from Card to CAD

根据APDU规范，每行C-APDU命令的前8个十六进制数字分别对应CLA INS P1 P2，每个字段占一字节，称为Mandatory Header即

CLA	INS	P1	P2
00	20	00	0A
00	A4	00	0C
00	D6	00	00

CLA: Class of Instruction

INS: Instruction

P1, P2: Parameter 1, 2

后面的字段称为Optional Body，根据Header中的命令需求，分别有：

LC: Length of Command Data

Command Data

LE: Length of Expected Response

例如

00A4000C02 + 3F00

00表示CLS，A4表示SELECT FILE命令，00表示select EF, DF or MF by file identifier，0C表示File Control Information(FCI) returned in response，

02是LC，表示Command Data长度为两字节，3F00即MF。

R-ADPU

SW: Status Word

例如9000时表示SELECT FILE OK

TPDU

Transmission Protocol Data Unit

APDUs are transmitted by TPDUs

Defined in ISO 7816-3

ATR

Answer To Reset

After smart card is powered up, it sends ATR message to the host

Up to 33 bytes

逆向dx.exe

dx.exe大小为614,400 bytes，简单分析后发现，该程序进行了以下操作

00A40000023F00
00A40000022F50
00B000002C
00A40000022F51
00B000000F

2F50和2F51都不是标准的USIM文件EF，猜测为东信和平私有实现。

推测dx.exe的工作流程为：点击USIM专用工具单次授权版后：

程序先检查电脑是否连接PS/SC读卡器，否则报错;
尝试与USIm卡建立通信，发送00A40000023F00等指令，读取卡上存储的私有信息(2F50/2F51处的)，如果不成功，报错；
根据读取的信息，通过计算模块(IDA中看到一处结构很像加解密模块)计算出ADM key。

简单来讲，ADM(Administrative) key是智能卡(Smart Card)文件权限控制中最高级别的key，类似还有PIN(Personal Identification Number), PUK(PIN Unblocking Key)，权限递增。

如果获得了USIM卡的ADM key，则可以读出Ki，这便是东信和平USIM卡的破解原理：使用“内部流出”的ADM计算工具获得USIM卡的ADM key，通过ADM key读取卡中的关键信息，如Ki。

由于时间有限，未完整逆向出ADM key的计算流程。“USIM_Explorer改iccid软件.zip”下载链接在此，如果你有兴趣逆向dx.exe，欢迎留言或邮件交流。

Linux下智能卡渗透笔记

Linux系统通过PC/SC Lite支持使用PC/SC(Personal Computer/Smart Card)标准。

个人主要使用基于Python的pyscard及基于此的pySim与USIM卡交互。

pySim

pySim支持串口与PC/SC两种读卡器

Option	Parameter
-d	Serial Device fo SIM Access [default: /dev/ttyUSB0]
-p	Which PS/SC number for SIM access

注意PS/SC number是执行pcsc_scan后得到的，如：

Scanning present readers...
0: Identiv SCR35xx USB Smart Card Reader [CCID Interface] (xxxxxxxxxxxxxx) 00 00

中的0。

ADM key

之前的博文Build a LTE Network with srsLTE and Program Your Own USIM Card中提到了写USIM卡的软件需要和卡配套，其实不完全是这种情况。

正如前文所讲，写卡最主要的是对ADM key的鉴权，之后写卡命令大部分情况下都是符合智能卡标准的，为pySim增加某些USIM卡写卡支持需要解决两个问题：

ADM key获取及ADM key鉴权(某些卡的鉴权方法非标准)；
某些非标准参数(通常是Ki)的读写。

此处的“非标准”指文件位置或者写卡命令非标准，然而在APDU层面都是标准的(此层以下厂商没有私有的必要，需要花费太多研发精力)。

分析pySim的pySim-prog.py可以看到，pySim支持的如sysmoUSIM-GR1, sysmoUSIM-SJS1等，其实是实现了对这些卡的ADM鉴权及参数写入。

我们在之前博文中使用的私有写卡软件SIM Personalize tools(Copyright: GreenCard Co.,Ltd Ver 3.1.0很容易逆向，通过strings的搜索，很容易得到此类卡的鉴权APDU，写参数APDU等。

该软件“支持的”卡其实是ADM key是&&&&&&&&，即3838383838383838长度为16个十六进制数字的值。

手中的另一个NB-IoT USIM卡的ADM key是22222222，即3232323232323232，ADM key的长度为8 bytes，在APDU中转换成ASCII值，也有某些USIM的ADM值直接以16个十六进制呈现，且没有对应的字符，如上面使用的东信和平USIM卡。

Reference

GitHub Pages Jekyll Minima Customize Footer

2018-05-05T00:00:00+00:00

Minima is a one-size-fits-all Jekyll theme for writers. It’s Jekyll’s default (and first) theme.

As the name implies, Minima offers minimum features by default.

To customize the footer, you have to override its default structure.

At the root of your site, first, create an _includes directory and copy footer.html from the Minima GitHub repository into it.

Then customize footer.html to your own needs.

<footer class="site-footer h-card">
  <data class="u-url" href="/"></data>

  <div class="wrapper">

    <h2 class="footer-heading">Cyberloginit</h2>

    <div class="footer-col-wrapper">
      <div class="footer-col footer-col-1">
        <ul class="contact-list">
          <li class="p-name">Cyberloginit</li><li><a class="u-email" href="mailto:cyberloginit#protonmail.com">cyberloginit#protonmail.com</a></li></ul>
      <a href="https://m.do.co/c/de1b31930850" target="_blank"><img src="/images/DO_Powered_by_Badge_black.svg" ></a>
      </div>

      <div class="footer-col footer-col-2">
        <ul style="list-style-type:none">
          <li>Friends: </li>
          <li><a href="https://blog.alalin.me/" target="_blank">alalin.me</a></li>
        </ul>
      </div>

      <div class="footer-col footer-col-3">
        <p>Cyber Log in IT.</p>
      </div>
    </div>

  </div>

</footer>

In my case, the social networks column is not needed, so I used it for link exchange.

<div class="footer-col footer-col-2">
  <ul style="list-style-type:none">
    <li>Friends: </li>
    <li><a href="https://blog.alalin.me/" target="_blank">alalin.me</a></li>
  </ul>
</div>

<div class="footer-col footer-col-2"><ul class="social-media-list"></ul>
</div>

I also added my DigitalOcean referral link.

<div class="footer-col-wrapper">
  <div class="footer-col footer-col-1">
        ...<li><a class="u-email" href="mailto:cyberloginit#protonmail.com">cyberloginit#protonmail.com</a></li></ul>
+ <a href="https://m.do.co/c/de1b31930850" target="_blank"><img src="/images/DO_Powered_by_Badge_black.svg" ></a>
  </div>

You can download the official DigitalOcean logo here

Last, commit and git push. There you have it.

Our customized _includes/footer.html here will overide the default footer.html used by Minima.

Besides, You can also customize the CSS style.

Reference

Build a LTE Network with srsLTE and Program Your Own USIM Card

2018-05-03T00:00:00+00:00

Build a LTE Network with srsLTE and Program Your Own USIM Card

Requirements

A Linux (preferably Ubuntu 16.04.4 desktop 64-bit) machine (i5 Dual-Core CPU will do, preferably with a USB 3.0 port)
A Software-defined radio (SDR) board with Ettus Universal Hardware Driver (UHD) or the bladeRF driver support, like USRP B210
A Windows machine to run the closed source USIM card programming software
A PC/SC compatible SIM card reader, like the MCR3512
A USIM card compatible with the programming software
A LTE handset, like the Oneplus One

Build

srsLTE is a free and open-source LTE software suite developed by SRS (www.softwareradiosystems.com).

Of the three well-known open source LTE stack(openLTE, srsLTE and OpenAirInterface), I find srsLTE have both the code elegance of openLTE and the completeness of OpenAirInterface.

With srsLTE, we are able to run a LTE network(eNodeB, MME, HSS and S/P-GW) on a single pc.

On a freshly installed 64-bit Ubuntu 16.04.4 desktop machine, install the required libraries with:

sudo apt-get install cmake libfftw3-dev libmbedtls-dev libboost-program-options-dev libconfig++-dev libsctp-dev

Then install the UHD driver for our USRP B210:

sudo apt-get install libuhd-dev libuhd003 uhd-host

Next, download and build srsLTE in the home directory with a non-root user:

cd ~
git clone https://github.com/srsLTE/srsLTE.git
cd srsLTE
mkdir build
cd build
cmake ../
make
make test
sudo make install

Configuration

Change back to the source directory.

cd ~/srsLTE

srsEPC

cp srsepc/epc.conf.example srsepc/epc.conf
cp srsepc/user_db.csv.example srsepc/user_db.csv

srsENB

cp srsenb/enb.conf.example srsenb/enb.conf
cp srsenb/rr.conf.example srsenb/rr.conf
cp srsenb/sib.conf.example srsenb/sib.conf
cp srsenb/drb.conf.example srsenb/drb.conf

Run

cd ~/srsLTE/srsepc
sudo srsepc epc.conf

Open another terminal:

cd ~/srsLTE/srsenb
sudo srsenb enb.conf

You can also tweak the epc.conf or the enb.conf file, like change the MCC and the MNC, or the DNS address.

Note: The UE database file(user_db.csv) has to be within the same directory where you would run the srsepc command.

Search ‘Available networks’ from your phone, and you should seen the custom built 4G network among local networks.

USIM Card

USIM card is a complex closed system.

Usually, you will not be able to program a blank USIM card bought online with a open source software like pySim, because different manufacturers have different implementations for the USIM standard.

If you do not have USIM cards supported by pySIM, like sysmoUSIM-SJS1, GrcardSIM, GrcardSIM2 and MagicSIM, a closed source software is needed, and most of the time, it is based on Windows.

Another way is to simply ask the seller to program the USIM cards for you. Both eBay and Taobao have plenty of them.

Just make sure the parameters: ICCID, IMSI, KI and OP/OPc are programmed accordingly.

Save 150￥

I bought a USIM card from Taobao which costs me 30￥. The USIM card reader and the programming software combined costs up to 150￥.

Note: If this link should fail, just search ‘openlte’ from Taobao.

So it seems that I will have to spend at least 180￥ for this.

Not so fast!

After digging through CSDN, a programmer website in China, I found a interesting article.

The USIM programming software used by the blogger is the same as the picture from the Taobao shop, although the later one is heavily watermarked.

Both screenshots show that the USIM programming software is called SIM Personalize tools(Copyright: GreenCard Co.,Ltd Ver 3.1.0). They are even of the same version!

The blogger has uploaded both a configuration file and a programing software to CSDN, but only gives the download link to the parameters configuration file.

I have managed to find the download link for the programing software here.

Unfortunately, like most Chinese websites, CSDN requires credits to download.

Fortunately, there are many sellers on Taobao offering CSDN downloading service which costs less than 3￥ for however many credits CSDN requires.

To save trouble, I have decided to offer it here. You’d better have it scanned by some antivirus software for safety concern:)

As for the USIM reader, any PC/SC compatible smart card reader will do.

Program the USIM Card

On Windows 10, just plug in the smart card reader and Windows will take care of installing the drivers needed.

Then, open SIM Personalize tools GRSIMWrite.exe, click Read Card, it should be able to read the parameters stored without error.

Next, write the card as you like.

For srsLTE, make sure the IMSI, KI and OP values are identical with those in the user_db.csv file.

Enbale IP Network

With the USIM card programmed above, you should be able to connect to LTE network.

To surf the Internet:

cd ~/srsLTE/srsepc
sudo su
./if_masq.sh [Interface for Internet connection]

You can get all the network interfaces of your machine with ifconfig, make sure you give if_masq.sh the name of the interface which connects to the Internet.

Note: DO NOT run if_masq.sh with sudo, it will not work on Ubuntu.

srsEPC creates a virtual network interface srs_spgw_sgi with the IP address 172.16.0.0/24. Your phone should be able to get an IP address like 172.16.0.2.

The if_masq.sh script enables IP forward for our Ubuntu system and masquerades traffic from srs_spgw_sgi by the interface which connects to the Internet.

Next, add an Access Point Names(APN) in the Cellular network settings of your phone.

Only two fields need to be filled, the first name can be anything you like; the second APN needs to be the same with settings in epc.conf, srsapn by default.

Now, you can surf the Internet by the custom built LTE network, just like Wi-Fi!

The Verizon service provider name(SPN) value is set in the USIM card.

Speed test with FAST Speed Test from Netflix.

Reference

Build a GSM Network with OpenBSC OsmoBTS OsmoTRX and USRP B210 on a Single PC

2018-04-27T00:00:00+00:00

Build a GSM Network with OpenBSC OsmoBTS OsmoTRX and USRP B210 on a Single PC

This document assumes that you have basic knowledge of the GSM network architecture(MSC, BTS, Abis, Um, etc.), Linux terminal and USRP UHD driver.

Environment

Intel Core i5-6500 CPU, 8 GB RAM, 64 GB HDD, Ethernet Connection, USB 3.0 Port
Ubuntu 16.04.4 Desktop 64-bit
USRP B210, Two GSM Antennas

Structure

GSM Network

As for our GSM network, USRP B210, OsmoTRX and OsmoBTS consist the BTS(Base Transceiver Station),

OpenBSC running as OsmoNITB (Network In The Box) implements a minimal subset of the BSC, MSC, SMSC and HLR.

OsmoTRX

OsmoTRX is a software-defined radio transceiver that implements the Layer 1 physical layer of a BTS.

It is the bridge between the RF hardware(USRP B210 in our case) and the OsmoBTS.

OsmoBTS

OsmoBTS is a software implementation of a GSM BTS.

OsmoBTS is modular and has support for multiple back-ends.

A back-end talks to a specific L1/PHY implementation of the respective BTS hardware.

In our case, OsmoBTS(osmo-bts-trx) talks to the OsmoTRX radio transceiver running on USRP B210.

OpenBSC

OpenBSC started as a BSC (Base Station Controller) side implementation of the A-bis protocol,

It can run either as OsmoBSC, exposing an A interface towards an external MSC,

or as OsmoNITB (Network In The Box), whert implements a minimal subset of the BSC, MSC, SMSC and HLR.

As our GSM network runs on a single PC, OpenBSC runs here as OsmoNITB.

It talks to OsmoBTS through Abis/IP.

USRP B210

USRP B210 is a SDR(Software Define Radio) kit from Ettus.

It transforms the digital signal on our computer into real world radio signal.

Installation

Osmocom recommands that you should use your distribution’s package management system for installing stuff.

As we will tinker with the source code later, so OpenBSC is built with make.

As for OsmoBTS and OsmoTRX, you should install them from the Osmocom repository.

Will come to that later.

Set up our working directory as non-root user

mkdir ~/Projects
cd ~/Projects

OpenBSC

First install these dependencies:

sudo apt install libdbi-dev libdbd-sqlite3 libortp-dev build-essential libtool autoconf autoconf-archive automake git-core pkg-config libtalloc-dev libpcsclite-dev libpcap-dev

Then, build these projects bellow from source, following the Build from Source guide.

libosmocore
libosmo-abis
libosmo-netif
openbsc

For each project

git clone git://git.osmocom.org/[project name]
cd [project name]
autoreconf -fi
./configure
make
make check
sudo make install
sudo ldconfig -i

In case of any missing dependency, ./configure will tell you.

Note: For openbsc, you have to run cd openbsc/openbsc instead of cd openbsc.

OsmoBTS

As I have said earlier, installing from the Osmocom repository is preferred if you have no special excuse.

sudo su
wget http://download.opensuse.org/repositories/network:/osmocom:/latest/xUbuntu_16.04/Release.key 
apt-key add Release.key
rm Release.key
echo "deb http://download.opensuse.org/repositories/network:/osmocom:/latest/xUbuntu_16.04/ ./" > /etc/apt/sources.list.d/osmocom-latest.list
exit
sudo apt-get update
sudo apt-get install osmo-bts-trx

If you should build it from source, make sure adding --enable-trx for ./configure.

The other building process are the same with the above.

OsmoTRX & UHD

I had no luck building OsmoTRX from source, neither with UHD from Ettus PPA, nor UHD built from source.

Past experiences tell me that the installation of UHD is very tricky.

At last, I just install UHD and OsmoTRX from the Ubuntu repository.

sudo apt-get install osmo-trx libuhd-dev uhd-host

Configuration

OpenBSC

Almost each Osmocom program has the configuration examples. Just look for ‘doc/examples/’.

If you have built OpenBSC from source

mkdir ~/.osmocom/
cp ~/Projects/openbsc/openbsc/doc/examples/osmo-nitb/sysmobts/openbsc.cfg  ~/.osmocom/

No need to change the openbsc.cfg file here.

OsmoBTS

If you have built OsmoBTS from source

cp ~/Projects/osmo-bts/doc/examples/calypso/osmo-bts.cfg ~/.osmocom/

Delete osmotrx legacy-setbsic from phy 0.

OsmoTRX

OsmoTRX can be configured with a variety of options on the command line. In most cases, the default settings will suffice.

Running

Open a shell and start OpenBSC

sudo osmo-nitb -c ~/.osmocom/openbsc.cfg

Open a shell and start OsmoBTS

sudo osmo-bts-trx -c ~/.osmocom/osmo-bts.cfg

Open a shell and start OsmoTRX

sudo osmo-trx

Search ‘Available networks’ from your phone, and you should seen Test PLMN 1-1 2G among local networks.

Reference

Visual Studio Code Tweaks on Windows 10

2018-04-08T00:00:00+00:00

Visual Studio Code Tweaks on Windows 10

Integrated Terminal

Set Bash on Windows as default terminal environment.

To open the terminal, Use the Ctrl+` keyboard shortcut.

open the command palate with Ctrl+Shift+P
type open user setting
search bash to locate the setting item
add "terminal.integrated.shell.windows": "C:\\Windows\\System32\\bash.exe" to WORKSPACE SETTINGS

Work on WSL

DON’T modify any file of the WSL from Windows.

However, we can work on files in our Windows file system from either within the WSL or without. To sum it up:

File Location	Edit in Windows	Edit in WSL
Windows	Yes	Yes
WSL	No	Yes

Windows file system does not include C:\Users\{username}\AppData\Local\Packages\{CanonicalGroupLimited.UbuntuonWindows}\LocalState\rootfs
WSL file system does not include /mnt/[c, d, ...]

To make your life easier, put your work directory in Windows file system (e.g. /mnt/c/Users/{username}/Documents).

This way, you can enjoy all the goodies from both Bash(Linux) and Windows, and edit your files from either environment.

Tricks

alias work='cd /mnt/c/Users/{username}/Documents/{work directory}'

code . to open current directory in Visual Studio Code

WSL Git

not supported yet:(

References

Debrick WD MyCloud 3TB without Opening Case in Linux

2017-12-31T00:00:00+00:00

About

created: 2015/05/16
edited: 2017/12/31

Requirements

A router running OpenWrt;
Recovery software from Fox_exe, download it here.

Steps

First, setup a TFTP server with OpenWrt

You need to make sure that dnsmasq has been installed on your router,

then open up /etc/config/dhcp and under the ‘dnsmasq’ section add the following lines (or if these lines already exist, adjust the values to match).

option enable_tftp '1'
option tftp_root '/var/tftp'

create a folder on your OpenWrt router where the recovery system for debricking WD MyCloud will be stored

mkdir /var/tftp

ATTENTION! /var is a link to/tmp, which will be flushed after reboot. Then it the missing folder will prevent dnsmasq form starting up.

Make sure you uncomment these options above beforing rebooting, or change the tftp_root folder to somewhere else if your router have plenty of space left.

Then, upload two files bootimage and start.sh in the downloaded root folder to /var/tftp。 Restart dnsmasq

/etc/init.d/dnsmasq restart

to apply these changes.

Second, bring your WD MyCloud back alive!

Make sure that nmap is installed.

In your computer’s terminal

sudo nping --dest-mac <Your WD MyCloud's MAC> -c 999 --icmp --icmp-type echo --icmp-code 0 --data-string WD-ICMP-BEACON 255.255.255.255

Power on your WD MyCloud(Get its IP address in /var/dhcp.leases if you have enabled dhcp of your router)
telnet <Your WD MyCloud's IP> from your computer. If everything went well, you should be able to see ``` Trying 192.168.1.2… Connected to 192.168.1.2. Escape character is ‘^]’.

/ # ```

Troubleshoot the system or install a new one. I prefer clean debian. You can get it from the first reference bellow.

How it works?

Well, basically “WD-ICMP-BEACON” is a backdoor,

WD MyCloud will try to boot from a TFTP server if it receives the specific packet --data-string WD-ICMP-BEACON during startup.

Furthermore

All you needs is a TFTP server, I choose OpenWrt +dnsmasq for convenience;
You can actually use any TFTP image to do the trick, the bootimage used here has limited functions(I even have to use netcat to upload the system recover image);
As for debricking in Windows, just follow Fox_exe’s README.txt in the Recovery software folder.

Reference

一加一代使用联通4G及高通固件详解

2017-12-31T00:00:00+00:00

摘要

使用fastboot刷Oxygen OS的固件，解决一加一手机刷Cyanogen OS后无法使用联通3G、4G网络的问题。

环境

Windows/Linux/macOS
fastboot 此处下载

前言

心血来潮买了张联通卡，满怀欣喜插入一加一（Cyanogen OS cm-13.1-ZNH2KAS1KN），网络一直是2G EDGE。想到因LTE牌照问题，一加一在国内不正式支持联通3G、4G。官网说

WCDMA和 FDD-LTE两种网络制式需国际漫游状态时才能使用

但面向海外的Cyanogen OS居然也不支持，着实让人惊讶。

先用中文搜索了一下这个问题，中文互联网社区有几个帖子试图解决这个问题，本方案的灵感也部分来源于此帖。

~~但此类帖子多流于教程，而非技术。本着看教程不如学原理的原则，我们需要从这些神秘兮兮的教程步骤里提取出隐藏的信息。~~

既然Oxygen OS支持联通3G、4G，说明该ROM的固件（其实是基带）是支持的。

过程

第一次尝试（失败）

本以为简单地刷个Oxygen OS 2.1.4的modem

fastboot flash modem NON-HLOS.bin

就能成功，结果开机后无法使用任何网络。

第二次尝试（失败

同样只刷modem，这次受上述帖子影响，使用了Oxygen OS 1.0的NON-HLOS.bin文件，刷完回到了Cyanogen OS 13，看了一下基带版本，居然是一样的。。。

第三次尝试（成功）

刷cm-13.1-ZNH2KAS1KN-bacon-signed-fastboot-a03c8dbbd0.zip时需要在fastboot模式分别刷从LOGO到system的各个文件（所谓的把系统恢复成完全原生的方法），那个压缩包中有个flash-radio.sh脚本，可以“一键”刷所有固件

fastboot flash aboot emmc_appsboot.mbn
fastboot flash LOGO logo.bin
fastboot flash rpm rpm.mbn
fastboot flash modem NON-HLOS.bin
fastbootflash sbl1 sbl1.mbn
fastboot flash dbi sdi.mbn
fastboot flash oppostanvbk static_nvbk.bin
fastboot flash tz tz.mbn

不太理解其中的几个分区的功能，比如aboot，rpm，sbl1，dbi，oppostanvbk（暴露了一加的东家），但感觉这几个文件应该功能紧密相连（本文水平好像比自己鄙视的教程党高不到哪里去。。。），所以决定把这几个分区都刷了。~

还是使用Oxygen OS 2.1.4的固件。当然，有这个脚本方便多了，真是“一键”刷机。

重启后，忐忑不安的盯着开机界面，生怕刷成砖了，还好顺利进入系统，这时基带版本已经是.4.0.1.c7-00013"。

Cyanogen OS 13和Oxygen OS 1.0都是DI.3.0.c6-00241，看版本号，还是Oxygen OS 2.1.4的基带更新啊（难道CM和一加闹掰后Cyanogen OS也不给好好做了）。

如此看来，固件（Firmware）还是用Oxygen OS以及对应的氢OS的最新版比较好，即使这版Oxygen OS只是个社区版。

高通固件说明

aboot emmc_appsboot.mbn

application processor(对应baseband processor) boot loader；

emmc(embedded MMC)，Android手机常用的存储设备，当然各个固件也存储其中；

mbn(Multi Boot Image)，使用readmbn可查看文件内容

LOGO logo.bin

没什么好说的，开机动画，其实是个压缩文件，网上有大量自定义教程。

rpm rpm.mbn

Resource Power Manager，负责设备的电源管理等。

modem NON-HLOS.bin

基带系统固件

NON-HLOS(NON High Level OS)即基带处理器的系统，与HLOS(High Level OS) Android对应；

里面包含GNSS(Global Navigation Satellite System)，如GPS，子系统的控制模块；

还有mDSP(modem Digital Sigal Processor)等子系统的控制模块；

网上有泄露的高通某些型号基带源码，可以自己编译;

参考此文

NON-HLOS.bin 实际就是一个FAT16格式的磁盘映像有两种方法取得
从刷机包中解压缩
从root的手机中获取挂载镜像
su -
mkdir mountpoint
mount -o loop NON-HLOS.bin mountpoint
cp -r mountpoint modem
umount mountpoint
现在在modem目录下就有初步提取的底层驱动的文件了。

使用Revskills Pro可以把.b00格式的文件转换成elf文件。

提取过程中，如果遇到空缺的文件，会报告错误。你可以创建一个大小为0的空文件，文件名就为那个丢失的文件。然后重试。

最后你将得到一个类似于 modem.elf的文件，可以放入IDA Pro中分析。

IDA Pro不能正确解析这种架构（QDSP6）的二进制文件，可以使用这个模块，也可以参考这里

sbl1 sbl1.mbn

Secondary Boot Loader；

高通SoC(System on Chip)启动过程中有很多boot loader，一加一使用的MSM 8974AC把sbl1, sbl2, sbl3合并到了一个文件sbl1中。

dbi sdi.mbn

未知

oppostanvbk static_nvbk.bin

网络参数设定

tz tz.mbn

Trust Zone

Arm TrustZone technology is a System on Chip (SoC) and CPU system-wide approach to security.

TrustZone is hardware-based security built into SoCs by semiconductor chip designers who want to provide secure end points and a device root of trust.

吐槽

上文用到的几个文件都是在一加的英文论坛找到的，固件几十兆而已，可以直接下载，无需注册，有些链接可能打不开，请自备梯子。链接

联通4G的室内信号在我这里的确比移动好很多，前者基本全满，后者最好也只是一半。

最后一定要吐槽一下国内论坛（至此您可以关掉这个页面，去享受联通4G的畅快了）

帖子里共享文件似乎很喜欢用百度云，百度这公司的产品能信吗？？？结果是没几天后链接就失效了，然后帖子下面一帮人求文件。。。

与此形成鲜明对比的是，国外（主要是英文）的类似论坛分享的文件很多过了几年还可以下载。

文件无法正常下载的后果是，教程的可用度会打很大折扣。
好多不重要，也不大的文件，下载必须要注册，还要扣虚拟货币（说你呢，一加中文论坛，都什么年代了也不知道上HTTPS，看看你的国际版对手，全站HTTPS，对自己同胞就可以这样“不讲究”吗）。

后记

第一版成文于2016年7月10日，文中吐槽相关的文字都是这版遗留的；

第二版于2017年12月31日完成，揭开了高通SoC中诸多固件的神秘面纱，希望能为这个方向的研究者提供参考。