Skip to content

Commit 900bf09

Browse files
asutoshpalaiasutoshpalai
committed
Added old notes
0 parents  commit 900bf09

File tree

4 files changed

+354
-0
lines changed

4 files changed

+354
-0
lines changed

‎AC3633_v2.md

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
- Wifi disk access at
2+
[http://192.168.1.1/sdindex.asp](http://192.168.1.1/sdindex.asp) is vulneable
3+
for arbitrary read/write on any directory.
4+
- After logging in, visit [Wifi disk access](http://192.168.1.1/sdindex.asp).
5+
- Set BP on folder click.
6+
- run `sd_current_path = "/";initSDList(0);` in the console.

‎EC315.md

+254
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
## Exractring UPDATA.APP from update setup
2+
- Downloaded the update setup
3+
- Loaded it with PE explorer
4+
- Extracted an _executable_ named UPDATEWIZARD\_130.exe from the Resource folder
5+
- Loaded that with PE explorer
6+
- Extracted a file named BIN\_250 from the Resource folder
7+
- Renamed BIN\_250 to UPDATA.APP
8+
9+
## Extracting UPDATA.APP
10+
11+
- Used [split\_update.pl](https://github.com/JoeyJiao/split_updata.pl) to extract files from UPDATA.APP
12+
13+
```
14+
Unknown sequence: 00000100
15+
Extracted unknown_file.0 - CRC Okay
16+
Unknown sequence: 00001100
17+
Extracted unknown_file.1 - CRC Okay
18+
Unknown sequence: 00001300
19+
Extracted unknown_file.2 - CRC Okay
20+
Unknown sequence: 00000800
21+
Extracted unknown_file.3 - CRC Okay
22+
Unknown sequence: 00000900
23+
Extracted unknown_file.4 - CRC Okay
24+
```
25+
26+
## Analysis of extracted files:
27+
28+
### unknown\_file.0
29+
30+
**Sequence:** 00000100
31+
**Size:** 464 bytes
32+
**Desc:** ATAGs msm partition table
33+
**Suggested Name:** partition.mbn
34+
35+
Analysed using the tool described below in the links. The output is as follows:
36+
37+
```
38+
Partition header:
39+
MAGIC1: aa7d1b9a
40+
MAGIC2: 1f7d48bc
41+
Version: 3
42+
Number of partitions: 8
43+
Partition table:
44+
00: 0:MIBIB offset=6 size=4 flags=feffffff
45+
01: 0:OSBL offset=768 size=256 flags=ffffffff
46+
02: 0:OEMINFO offset=4096 size=512 flags=ffffffff
47+
03: 0:AMSS offset=32256 size=2560 flags=ffffffff
48+
04: 0:EFS2 offset=5760 size=640 flags=ffffffff
49+
05: 0:DWNLOAD offset=43520 size=2560 flags=ffffffff
50+
06: 0:MMC offset=8960 size=1280 flags=ffffffff
51+
07: 0:FTL offset=23040 size=2560 flags=ffff01ff
52+
```
53+
54+
Links:
55+
- [`roman-yepishev/acer-tools/msmptbl`](https://github.com/roman-yepishev/acer-tools/tree/master/msmptbl)
56+
57+
### unknown\_file.1
58+
59+
**Sequence:** 00001100
60+
**Size:** 38752 bytes (38K)
61+
**Desc:** Qualcomm SBL1 image / Device Boot Loader
62+
**Suggested Name:** dbl.mbn
63+
64+
Analysed with binwalk as per an online ref[Notes about Qualcomm Secure Boot and
65+
Motorola High Assurance Boot
66+
(hab)](http://vm1.duckdns.org/Public/Qualcomm-Secure-Boot/Qualcomm-Secure-Boot.htm).
67+
68+
It had 2 skip headers. The actual image was at offset 0x2000.
69+
70+
Loaded with IDA Pro using loader plugin from
71+
[ralekdev/mbn\_ida\_loader](https://github.com/ralekdev/mbn_ida_loader/blob/master/mbn_ida_loader.py).
72+
The plugin didn't work directly because as noted in the ref mentioned above,
73+
with image type as `0x7D0B435A` it assumes that the image is at address
74+
`0x2800`. But actually, it is just a forward pointer. There were 3 headers.
75+
First 2 at 0, 0x800 respectively with image type as `0x7D0B435A`. The actual one
76+
was at 0x2000. The last one's type field had `0xFFFFFFFF`.
77+
78+
Applied the following patch to make it work for this file:
79+
```patch
80+
diff --git a/mbn_ida_loader.py b/mbn_ida_loader.py
81+
index 095a7f0..c35dbe3 100644
82+
--- a/mbn_ida_loader.py
83+
+++ b/mbn_ida_loader.py
84+
@@ -58,11 +58,22 @@ def load_file(li, neflags, format):
85+
86+
return 0
87+
88+
-def load_file_sbl(li):
89+
+def load_file_sbl(li, start = 0):
90+
+
91+
+ if dwordAt(li, start + 8) == 0x7D0B435A:
92+
+ # The actual header is ahead
93+
+ li.seek(start + 4)
94+
+ s = li.read(4)
95+
+ while len(s) > 0 and struct.unpack('<I', s)[0] != 0x844BDCD1:
96+
+ s = li.read(4)
97+
+ if len(s) > 0:
98+
+ return load_file_sbl(li, li.tell() - 4)
99+
+ return 0
100+
101+
- start = 0
102+
- if dwordAt(li, 8) == 0x7D0B435A:
103+
- start = 0x2800
104+
+ if dwordAt(li, start) != 0x844BDCD1:
105+
+ print "dword at {}: {}".format(hex(start), hex(dwordAt(li, start)))
106+
+ print "Signature mismatch at expected start {}".format(hex(start))
107+
+ return 0
108+
109+
image_source = dwordAt(li, start + 0x14)
110+
image_dest = dwordAt(li, start + 0x18)
111+
```
112+
113+
### unknown\_file.2
114+
115+
**Sequence:** 00001300
116+
**Size:** 672072 bytes (657K)
117+
**Desc:** OS Boot Loader
118+
**Suggested Name:** osbl.mbn
119+
120+
From the online ref about Secure Bootloader and HBA, one could guess that this
121+
file was High Assurance Boot (hab) file. The file structure matched the one
122+
given online, but the type `0x0000000b` as no where to be found. All the online
123+
refs pointed it to be `0x00000005`.
124+
125+
It could be loaded into IDA Pro with the same loader file mentioned above.
126+
127+
But later I found that I was mistaken in assuming it to be aboot.mdn (not that I
128+
know what aboot is ;) ). As I learned from an [online form](For http://forum.gsmhosting.com/vbb/f804/huawei-modem-universal-flasher-1495518/index23.html#post9851968) it is actually osbl.mbm
129+
130+
```
131+
$ strings unknown_file.2 | grep target
132+
E:\baiyunting\11.102.99.60.00\core\boot\amssboot\target\qsc6695\src\boot_shared_progressive_boot_block.c
133+
E:\baiyunting\11.102.99.60.00\core\boot\secboot2\osbl\target\qsc6695\src\osbl_stubs.c
134+
```
135+
136+
### unknown\_file.3
137+
138+
**Sequence:** 00000800
139+
**Size:** 19005440 bytes (19M)
140+
**Desc:** Qualcomm's operating system
141+
**Suggested Name:** amss.mbn
142+
143+
Upon further research it turned out to be `amss.mbn`. (Searched strings on
144+
google and found https://pastebin.com/NcGy8Fr7)
145+
146+
```
147+
$ strings unknown_file.2 | grep target
148+
E:\baiyunting\11.102.99.60.00\core\boot\amssboot\target\qsc6695\src\boot_shared_progressive_boot_block.c
149+
E:\baiyunting\11.102.99.60.00\core\boot\secboot2\osbl\target\qsc6695\src\osbl_stubs.c
150+
```
151+
152+
AMSS stands for Advanced Mobile Subscriber Software (Qualcomm's operating
153+
system). Ref: [Mobile Devices: Tools and
154+
Technologies](https://books.google.co.in/books?id=lky3BgAAQBAJ&pg=PA47&lpg=PA47&dq=full+form+amss+firmware&source=bl&ots=LOj8slD2l1&sig=FwadyTImv2zKOSRFUA9yI6DkmSg&hl=en&sa=X&ved=0ahUKEwje7-mP_e3VAhUKso8KHVrrDTgQ6AEIVjAI#v=onepage&q=full%20form%20amss%20firmware&f=false)
155+
156+
### unknown\_file.4
157+
158+
**Sequence:** 00000900
159+
**Size:** 284672 bytes (278K)
160+
**Desc:** EFS2 File system
161+
**Suggested Name:** efs2.mbn
162+
163+
Upon analysis of amss.mbn as ARM ELF file, the magic bytes for this, `87 67 85
164+
34 59 77 34 92` (0x34856787, 0x92347759) was found in a function which was being
165+
called (after a series of intermediate functions) from a function which referred
166+
to the string "EFS2". So, I guess this is our best bet.
167+
168+
## USB connection attempt:
169+
170+
- Pluging in, `lsusb` read:
171+
172+
`Bus 003 Device 014: ID 12d1:1f01 Huawei Technologies Co., Ltd. E353/E3131 (Mass storage mode)`
173+
174+
- Installed `usb_modeswitch`. It added the necessary udev rules.
175+
176+
The switched interface looked to be:
177+
`Bus 003 Device 011: ID 12d1:14db Huawei Technologies Co., Ltd. E353/E3131`
178+
179+
- This is usb ethernet mode.
180+
181+
- Seems like not switching to serial mode and switching to ethernet mode is a
182+
known issue.
183+
184+
- Was able to switch to serial mode, thanks to discussion an online discussion
185+
for [Huawei E353](http://www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?p=8651#p8651)
186+
187+
- Disabled udev rule for `12d1` (Generic Huawei device).
188+
189+
- Executed command
190+
191+
sudo usb_modeswitch -v 0x12d1 -p 0x1f01 -M "55534243123456780000000000000011060000000000000000000000000000"
192+
193+
- Now it detects two `ttyUSB` devices:
194+
195+
```
196+
--- Available ports:
197+
--- 1: /dev/ttyUSB0 HUAWEI Mobile
198+
--- 2: /dev/ttyUSB1 HUAWEI Mobile
199+
```
200+
- Was able to send AT commands using `/dev/ttyUSB0`: `sudo socat -
201+
/dev/ttyUSB0`. Tried some ref commands from
202+
[https://routerunlock.com/useful-at-commands-for-huawei-modem/](https://routerunlock.com/useful-at-commands-for-huawei-modem/)
203+
and [Hacking the Huawei
204+
E589](https://forum.xda-developers.com/showpost.php?p=44389917&postcount=2)
205+
206+
- Found an offical doc, [HUAWEI ME906s LTE Module AT Command Interface Specification-%28V100R001_01%2C English%29.pdf](http://download-c.huawei.com/download/downloadCenter?downloadId=51047&version=120450&siteCode)
207+
208+
- Switched `/dev/ttyUSB0` to QCDM with `AT$QCDMG` AT command. Later found that
209+
/dev/ttyUSB1 was in
210+
211+
- Tested QCDM with qcdm.pl obtained from [huawei.git by Dobrica Pavlinusic](http://git.rot13.org/?p=huawei.git;a=summary)
212+
213+
- Sending diag commands for peek returns packets starting with 0x13
214+
(`DIAG_BAD_CMD_F`).
215+
Found a call to `diagpkt_err_rsp` with 0x13 at `0x08176846`, `0x0812ED20`, `0812EC8E`, `0812EBFE`, `0812EB42`, `0812E91A`, `0809E166`, `0809E14C`, `0809DE94`, `0809DE76`
216+
217+
218+
## Analysis of amss.mbn
219+
220+
- Loaded into IDA as an ARM ELF file.
221+
- Tried Snowman for decompling, didn't work as it doesn't support THUMB
222+
instruction set.
223+
- Looked for AT command strings and tried to reverse the functions.
224+
- Searched for the magic string for the 5th unknown file,
225+
`87 67 85 34 59 77 34 92`. Got two hits at
226+
227+
- 0x0055C054 DCD 0x34856787
228+
- 0x00733AF4 DCD 0x34856787
229+
230+
Both the locations had the second half of the magic bits.
231+
232+
At the hit at 0x0055C054 the magic bits were being assigned to something. The
233+
trail of `xrefs from` went down a dead end.
234+
235+
The hit at 0x00733AF4 was being referred by function (present just above),
236+
beginning at 0x00733A5C. It was verifying the magic bytes from a buffer.
237+
Following the trail of `xref from` lead me to a function at 0x00364420 which
238+
had the reference to the string "EFS2". Interesting. So, I guess that the last
239+
unknown file is a EFS2 file system.
240+
241+
- [SMD (Shared Memory Device)](https://osmocom.org/projects/quectel-modems/wiki/Qualcomm_Linux_SMD)
242+
243+
- OSA is a cooperative multitasking real-time operating system (RTOS) for Microchip PIC-controllers.
244+
245+
- searching for `websdk` gave interesting results
246+
- same goes for `ipwebs`
247+
A lot of functions can be identified using the log messages.
248+
- A memory map was found resembling the found at page 66 of [Mobile Data modem user guide](https://electronix.ru/forum/index.php?act=Attach&type=post&id=102723)
249+
- Got peek into qualcomm source code files for the first time at [huawei.git by Dobrica Pavlinusic](http://git.rot13.org/?p=huawei.git;a=summary) inside the AMSS folder.
250+
251+
# Known issues
252+
253+
- webserver\_get\_time() does not closes the xml file in case of get\_childnode
254+
failes

‎EC315_research.md

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
- https://pastebin.com/NcGy8Fr7
2+
- https://androidforums.com/threads/virgin-mobile-sprint-help-qualcomm-hs-usb-qdloader-9008.869613/
3+
4+
```
5+
dbl.mbn - Device Boot Loader
6+
osbl.mbn - OS Boot Loader
7+
partition.mbn - MBR sector
8+
```
9+
10+
- For http://forum.gsmhosting.com/vbb/f804/huawei-modem-universal-flasher-1495518/index23.html#post9851968
11+
12+
```
13+
Rename extracted firmware parts as follows:
14+
01.bin -> partition.mbn;
15+
02.bin -> dbl.mbn;
16+
03.bin -> osbl.mbn;
17+
04.bin -> amss.mbn;
18+
05.bin -> dsp1.mbn;
19+
06.bin -> dsp2.mbn.
20+
```
21+
22+
- [Reverse Engineering Android's Aboot](http://www.newandroidbook.com/Articles/aboot.html)
23+
24+
```
25+
morpheus@Forge (~/S5/)% od -A d -t x4 aboot |head -5
26+
Magic Version NULL ImgBase
27+
0000000 00000005 00000003 00000000 0f800000
28+
ImgSize CodeSize ImgBase+CodeSize SigSize
29+
0000020 00107e24 000fed24 0f8fed24 00000100
30+
ImgBase+CodeSize+SigSize Certs
31+
0000040 0f8fee24 00009000 ea000006 ea005487
32+
0000048 ea00548d ea005493 ea005499 ea00549f
33+
0000064 ea00549f ea0054b6 ee110f10 e3c00a0b
34+
```
35+
36+
- http://blog.azimuthsecurity.com/2013/05/exploiting-samsung-galaxy-s4-secure-boot.html
37+
- http://blog.azimuthsecurity.com/2013/04/unlocking-motorola-bootloader.html
38+
- https://askubuntu.com/questions/634180/minicom-status-stays-offline
39+
- [Reverse engineering a Qualcomm baseband](https://events.ccc.de/congress/2011/Fahrplan/attachments/2022_11-ccc-qcombbdbg.pdf)
40+
41+
Recomends to use `AT$QCDMG` to enable diag mode
42+
- https://forum.xda-developers.com/showthread.php?t=2396752
43+
- [QC BQS Firmware Analyzer - learnt about efs2 magic stings](http://forum.modopo.com/diskussionen-rund-ums-modding/t-19197-qc-bqs-firmware-analyzer/page44.html#post189000)
44+
45+
- [Res OS] (https://en.wikipedia.org/wiki/REX_OS)
46+
- [osa files from another device](http://www.pudn.com/Download/item/id/1019687.html)
47+
- [osa homepage](http://wiki.pic24.ru/doku.php/en/osa/ref/introduction/intro#what_is_osa)
48+
- [osa\_semaphore.h](https://github.com/bushuhui/pi-slic/blob/master/Thirdparty/PIL/src/base/osa/osa_semaphore.h)
49+
- [wpscli source (probably leaked)](https://github.com/elenril/VMG1312-B/blob/master/bcmdrivers/broadcom/net/wl/impl10/wps/wpscli/linux/wpscli_wlan.c)
50+
- [CBW and USBC explanantion](https://books.google.co.in/books?id=zSv3BwAAQBAJ&pg=PA357&lpg=PA357&dq=CBW+usbc&source=bl&ots=74N3yJ4wK8&sig=vrZE6pc0CYeD_l2cp1lMuYbIrlQ&hl=en&sa=X&ved=0ahUKEwi0mcT04v_VAhWKPY8KHXRUDn0Q6AEIOjAE#v=onepage&q=CBW%20usbc&f=false)
51+
- [ Android/HTC/Vision/BootProcess – TJworld : Really detailed explanation of boot process](http://tjworld.net/wiki/Android/HTC/Vision/BootProcess)
52+
- [Mobile Data modem user guide](https://electronix.ru/forum/index.php?act=Attach&type=post&id=102723)
53+
- [](https://blogs.gnome.org/dcbw/2010/04/15/mobile-broadband-and-qualcomm-proprietary-protocols/)
54+
- [rtf file with links to some usefull codes](https://saturn.ffzg.hr/rot13/index.cgi/asterisk_gsm.rtf?action=rtf_export;page_selected=asterisk_gsm)
55+
- [some more qualcomm source
56+
codes](https://github.com/Bigcountry907/HTC_a13_vzw_Kernel/tree/master/vendor/qcom/proprietary)
57+
and [some more](https://v2.pikacode.com/jsr-d10/qcom_msm8626_adsp_proc/raw/ae282f66e175a6a585b5f9b9daade693b9f736ef/core/api/services/diagpkt.h)
58+
- [DIAG protocol description](https://books.google.co.in/books?id=lky3BgAAQBAJ&pg=PA46&lpg=PA46&dq=qualcomm+diag+mode+dump+memory&source=bl&ots=LOj9plB5jZ&sig=rkEUC-gY782oHae8g6_3DFM3kNI&hl=en&sa=X&ved=0ahUKEwjgj7CzpoLWAhVJvI8KHSyeDGwQ6AEIMzAB#v=onepage&q=qualcomm%20diag%20mode%20dump%20memory&f=false)

‎android_wlan.md

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Context
2+
- Checking out the wlan firmware of my device Moto G5 Plus (potter)
3+
4+
# Research
5+
- Found the vendor firmwares files at
6+
[https://github.com/boulzordev/android_vendor_motorola_potter](https://github.com/boulzordev/android_vendor_motorola_potter)
7+
- Found the wlan firmware at path
8+
[`proprietary/etc/firmware/wlan/prima`](https://github.com/boulzordev/android_vendor_motorola_potter/tree/lineage-15.1-64/proprietary/etc/firmware/wlan/prima)
9+
- Searching for "android wlabn firmware load address" I found a issue for
10+
["wlan-prima (wireless module) and
11+
wcnss-service"](https://github.com/postmarketOS/pmbootstrap/issues/373).
12+
Prima-wlan, match match!
13+
```
14+
This is how it works:
15+
16+
The wlan-prima kernel module is loaded
17+
wlan-prima tries to load the firmware (multiple files) (will be solved in issue #147)
18+
wcnss-service initializes the wireless interface
19+
```
20+
- Had the link for [wlan-prima source code](https://github.com/t2m-foxfone/android_platform_vendor_qcom-opensource_wlan_prima), but I also found it ini
21+
[andoid kernel
22+
tree](https://android.googlesource.com/kernel/msm/+/android-msm-mako-3.4-jb-mr1/drivers/staging/prima/). I used the former source. I also found similar code base for [android 8.1](://android.googlesource.com/kernel/msm/+/android-8.1.0_r0.9/drivers/staging/qcacld-2.0/), but it was a very different versoin and prelim search didn't reveal where the nv file was being loaded.
23+
- Searching for "wlan_prima firmware load address", I found error messages
24+
"wcn36xx smd:riva@6:wcnss:wifi: loading
25+
/system/vendor/firmware/wlan/prima/WCNSS_qcom_wlan_nv.bin failed with
26+
error -13" and "wlan: [1006:F :VOS] vos_open: Failed to initialize the NV
27+
module". The later was intresting because I saw VOS logging in the source
28+
code.
29+
- Searching for the string landed me at vos_open in `CORE/VOSS/src/vos_api.c`.
30+
- I called `vos_nv_open` in `vos_nvitem.c`.
31+
- It loads `WLAN_NV_FILE` which points to our firmware file.
32+
- It checks for magic number at 3rd and 4th byte `CAFEBABE` which is present in
33+
the firmware files.
34+
- The first and second bytes are called "mask", didn't find any use of that in
35+
the code.
36+
- The qcom nv files are arranged in form of streams.

0 commit comments

Comments
 (0)