6 ms·

Remote code execution via MIDI messages

deleted 2y ago
[deleted]
purplesyringa 2y ago
This is such a ludicrous premise, I'm amazed you pulled it off. You mention "another packing optimization". I'm wondering, how are you transferring frames? The dot matrix is eight 7x5 characters, i.e. 280 bits in total, which amounts to 40 7-bit groups per frame. You seem to be using twice that space in transmission, is it wasted on some control data or is the transmission just slightly suboptimal?
- portasynthinca3 2y ago
  Thanks! The dot matrix is actually eight 5x8 characters, or 320 bits in total. I'm packing those 320 bits into the the 4 bits per byte that are available to us in this shell protocol. Plus, another 9 bytes for the packet header and footer. Looks like I wrote 92 in the article, I must have miscalculated that. I'm not using the full 7 bits because figuring out a way to do so turned out to be way too hard for me, so I opted for a solution that is negligibly worse than the optimal one, in comparison to the original one. If you're wondering about the exact algorithm, consider checking these files out, but please keep in mind that I haven't cleaned the code up yet: https://github.com/portasynthinca3/swl01u/blob/master/fun/big_brain.s https://github.com/portasynthinca3/swl01u/blob/master/fun/bi..., https://github.com/portasynthinca3/swl01u/blob/master/fun/bad_apple.py https://github.com/portasynthinca3/swl01u/blob/master/fun/ba...
  - phkahler 2y ago
    Another option might be to modify the baud rate of the MIDI interface. MIDI is terribly slow at 1M/32 bps, and most UARTs can go at least 115200. That would also mean changing the baud rate on your PC software at that point in transmission, and would not allow a standard MIDI file to be used.
    - lambda 2y ago
      This was being done over USB midi, which is already faster than standard DIN midi AFAIK. Trying to change the baud rate of DIN midi on both ends of the communication seems like a lot of work.
beardyw 2y ago
Thanks, a great read.
Terr_ 2y ago
While I suggest reading the whole thing, the money-quotes: > So yeah, these [keyboard manufacturer] madlads made a shell that runs on top of MIDI SysEx messages on top of USB. > [T]he most interesting commands that we have are arbitrary memory read/write commands. So, if we really wanted to, we could just peek and poke the memory of the synth via MIDI. > If we wanted to, we could write these messages to a MIDI file and play it on the synth like any other MIDI file. Hey, that gives me an idea..... > From the countless sleepless nights of digging around in the firmware I’ve discovered a function that sends arbitrary data to the LCD controller.
- dylan604 2y ago
  > If we wanted to, we could write these messages to a MIDI file and play it on the synth like any other MIDI file. Hey, that gives me an idea..... I'm imagining dubstep would be the result
- Terr_ 2y ago
  P.S.: Now the real question is whether you can change the running-code on the keyboard so that it tries to infect other keyboards (of the same model) that might receive MIDI data originating from-it. In a way, this is a peek at the nightmare of Internet of Things (IoT, where the S stands for Security.) Almost any device might have a backdoor in it, and it might even be a stupid backdoor, like #0000.
- odiroot 2y ago
  > > [T]he most interesting commands that we have are arbitrary memory read/write commands. So, if we really wanted to, we could just peek and poke the memory of the synth via MIDI. This sounds easy but with SysEx having no delivery guarantees, and no sense of connection/session it can be frustrating. Totally normal to get "packet loss".
liotier 2y ago
Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !
- fer 2y ago
  Yeah, same thinking here. No standard, manufacturer-defined, everything-goes kind of messages.
- 1oooqooq 2y ago
  can't wait to see what sysEx hacks google will cram on chrome midi support they are building for the last couple years.
  - jeroenhd 2y ago
    WebMIDI already has SysEx support: https://developer.mozilla.org/en-US/docs/Web/API/Web_MIDI_API https://developer.mozilla.org/en-US/docs/Web/API/Web_MIDI_AP...
    - 1oooqooq 2y ago
      did you read the article? of course webmidi must support sysEx, it's essential to work with midi2 at all. but mostly because you must parse the weird sized packet to properly ignore it. what might show up are chrome specific sysEx messages which then leads to exploits as the article.
  - p0w3n3d 2y ago
    2030, browsers are TPMd DRMd and JAILed, one cannot simply access web with Firefox anymore: so we have jailbroken the Chrome using MIDI protocol to install extension that blocks ads
  - prashnts 2y ago
    I tried to make a bidirectional channel from a webpage to a python script over MIDI. I'd just found that with sysex you can pack any arbitrary data that you want, that python can create virtual MIDI devices, and that Chrome can then connect to such devices. I'm sure I'd more code than what's in my 8yo repo, but the premise is simply https://github.com/prashnts/midipacks/blob/master/midipacks/pack.py https://github.com/prashnts/midipacks/blob/master/midipacks/...
cluckindan 2y ago
Any mirrors not in Russia? My ISP blocks access.
- jeroenhd 2y ago
  https://archive.is/N5t7a https://archive.is/N5t7a
- codetrotter 2y ago
  Snapshot: https://archive.is/FVUHe https://archive.is/FVUHe There's an embedded YouTube video in the article as well, that appears twice. First at the top and then again further down. https://www.youtube.com/watch?v=u6sukVMijBg https://www.youtube.com/watch?v=u6sukVMijBg There are also several videos in the article that are hosted on the same site as the original article (so on the .ru site). Those are not included in the snapshot unfortunatelly. You'll see placeholders and the associated text that describes them but you can't view those via the snapshot. It also contains a link to a GitHub repo at the end. https://github.com/portasynthinca3/swl01u https://github.com/portasynthinca3/swl01u
- perching_aix 2y ago
  Do you not have DNS-over-HTTPS/TLS configured, or are you on some weird browser that doesn't support ECH [0]? I wonder how they blocked it if those are in place (unless you use the ISP's DNS), since the site itself is served by Cloudflare from wherever close to you, not from Russia (and so the actual SNI isn't leaked via the ClientHelloOuter field either). [0] you can test these by using https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
- skissane 2y ago
  Out of interest, which country are you in? Is this something your country's government made your ISP do?
  - friend_Fernando 2y ago
    It's starting to look like an increasingly sensible policy IMO.
perching_aix 2y ago
> Now, we have to get a little philosophical here. In my eyes, RE is like a game of minesweeper. You start with an empty field not knowing the state of any of the cells, i.e. not knowing whether each individual cell contains a landmine or not. When you discover the state of a cell, you have the context to deduce the state of its neighbor cells. In minesweeper, you don’t have a particular direction in which you progress. You never say “In this game of minesweeper, I want to go up no matter what”, you just let the numbers nudge you in the direction that is the easiest to go in at the moment. I assert that this is also true for RE. Once you find out what a function or a variable does, you suddenly understand a little more about functions and variables that depend on the ones whose meaning you’ve just inferred. It may be beneficial not to set any particular goal with an RE project, and instead letting the complex network of intertwined functions and variables guide you towards understanding the system as a whole. That's such a nice way to think about it. Maybe I should try giving RE a go again.
- Waterluvian 2y ago
  I don’t know RE but I love this sentiment. I think it’s quite generalizable too. So many things are like that. Just start somewhere. It really doesn’t matter where. And what you find will guide your next steps. Eventually you’ll have enough context to see a much bigger picture well before it’s fully revealed.
  - friend_Fernando 2y ago
    Gradient Descent?
    - deleted 2y ago
      [deleted]
- bluGill 2y ago
  The one difference is in re you sometimes go up no matter what because there isn't enough information. (in minesweeper I typically pick a few squares early because without them the game probably won't be solveable anyway. Typically in thegame once you have enough solved you have it all - once in a while a couple squares are unknowable. In re you hit points where you know all the clues can get you more often and so have to try something at random. Otoh it is much rarer in re for a wrong try to be catestropic [not unheard of but rare]
moosedev 2y ago
Great project, write-up, and sense of humor in the videos! > Using that part number I wasn’t able to find any information about the chip online apart from an article that claimed it was based around a “SuperH” CPU core – an ISA that I’ve encountered for the first time ever in that article. Also found in Sega 32x, Sega Saturn, and Sega Dreamcast! And some early Pocket PCs (turn-of-the-century handhelds running Windows CE) like the HP Jornada series, although most Pocket PCs were ARM-based.
- brian-armstrong 2y ago
  Many industrial applications as well. Mitsubishi used it in the ECU of some of its cars, including the Lancer Evolution.
  - publicmail 2y ago
    Early (2003 for sure) 350z had it as well.
trelbutate 2y ago
So, the repo's README claims the repo contains the image dumps, but they're not actually there. Is this correct?
- perching_aix 2y ago
  Seems to be. Probably a good shout considering those dumps would be protected by Yamaha's copyright.
- portasynthinca3 2y ago
  My bad! I added *.bin to .gitignore last minute to exclude assembled code snippets, but looks like the dumps were excluded as well. I'm going to upload them in the next few hours
brokenmachine 2y ago
Awesome writeup, thanks for that.
exabrial 2y ago
holy crap, nothing is safe.
lqstuart 2y ago
> I’m very unexperienced when it comes to reverse engineering Lol… where does that leave the rest of us in comparison
- pottspotts 2y ago
  Yeah this is oft-repeated by particularly good "lay" engineers.
- Cthulhu_ 2y ago
  Knowing a lot but being aware you know nothing is like level 4 of experience, where level 1 is being new and eager but knowing you know nothing yet, level 2 is the "I am a god" stage, and level 3 is "I'm an idiot".
sharkbot 2y ago
Now for the most important question: can you run DOOM on it? :)
deleted 2y ago
[deleted]
ejacky001 2y ago
interesting.
the_plus_one 2y ago
As someone who's reversed some basic MIDI stuff in an old video game and has always wanted to get into hardware hacking, I really enjoyed reading this article. Great work!
pottspotts 2y ago
How does a man even get to this point? I will tell you how: derangement, a failure to engage with society and the degeneration/depravity of being one step away from making MIDI component improvised explosives and emailing your remaining friends a manifesto. Ah just kidding, this is pretty sweet.
saagarjha 2y ago
Curious if you can intersperse the Bad Apple commands with MIDI music so it plays the audio itself ;)
lucasluitjes 2y ago
That is amazing research! Reminds me a bit of the 2017 research of RCE on a DNA sequencing machine by synthesizing shellcode in actual DNA/RNA molecules [0]. I was gonna say "next up: OSC" but I guess MIDI is still dominant. [0] https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ney https://www.usenix.org/conference/usenixsecurity17/technical...
serverlessmania 2y ago
Awesome, I'm trying to do this with Elektron machines, the Digitakt.
JimmyWilliams1 2y ago
[dead]
notpushkin 2y ago
On the off chance any of the HN crowd is in Armenia: Porta will be giving a talk about this on January 10th at the Hacker Embassy. You should definitely come: https://t.me/hackerembassy/17 https://t.me/hackerembassy/17
helpfulContrib 2y ago
[dead]
SideQuark 2y ago
> World’s First MIDI Shellcode There's been MIDI shell code for well over 20 years on pretty much all major platforms: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=midi https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=midi
- LegionMammal978 2y ago
  Plenty of buffer overflows. But has anyone actually written a shellcode for those?
  - SideQuark 2y ago
    Metasploit added automated shellcode generators into midi files at least a dozen years ago, likely earlier. https://www.exploit-db.com/exploits/18426 https://www.exploit-db.com/exploits/18426 So to test this, surely they tried it once, and presumably Metasploit users generated tons of them . And from having worked in this space a long time ago, such CVEs would trigger a host of malicious midi files looking for holes, especially since people embedded them in webpages around early 2000s. Around that time I'd routinely take a MS update, diff the DLLs, reverse interesting location changes, and craft shellcode attacks during training to show people how it's not very hard. And there were tons of people across the spectrum able to do similarly. CVE disclosures made them much easier to develop.

deleted 2y ago

[deleted]

This is such a ludicrous premise, I'm amazed you pulled it off. You mention "another packing optimization". I'm wondering, how are you transferring frames? The dot matrix is eight 7x5 characters, i.e. 280 bits in total, which amounts to 40 7-bit groups per frame. You seem to be using twice that space in transmission, is it wasted on some control data or is the transmission just slightly suboptimal?

portasynthinca3 2y ago
Thanks! The dot matrix is actually eight 5x8 characters, or 320 bits in total. I'm packing those 320 bits into the the 4 bits per byte that are available to us in this shell protocol. Plus, another 9 bytes for the packet header and footer. Looks like I wrote 92 in the article, I must have miscalculated that. I'm not using the full 7 bits because figuring out a way to do so turned out to be way too hard for me, so I opted for a solution that is negligibly worse than the optimal one, in comparison to the original one. If you're wondering about the exact algorithm, consider checking these files out, but please keep in mind that I haven't cleaned the code up yet: https://github.com/portasynthinca3/swl01u/blob/master/fun/big_brain.s https://github.com/portasynthinca3/swl01u/blob/master/fun/bi..., https://github.com/portasynthinca3/swl01u/blob/master/fun/bad_apple.py https://github.com/portasynthinca3/swl01u/blob/master/fun/ba...
- phkahler 2y ago
  Another option might be to modify the baud rate of the MIDI interface. MIDI is terribly slow at 1M/32 bps, and most UARTs can go at least 115200. That would also mean changing the baud rate on your PC software at that point in transmission, and would not allow a standard MIDI file to be used.
  - lambda 2y ago
    This was being done over USB midi, which is already faster than standard DIN midi AFAIK. Trying to change the baud rate of DIN midi on both ends of the communication seems like a lot of work.

beardyw 2y ago

Thanks, a great read.

Terr_ 2y ago

While I suggest reading the whole thing, the money-quotes: > So yeah, these [keyboard manufacturer] madlads made a shell that runs on top of MIDI SysEx messages on top of USB. > [T]he most interesting commands that we have are arbitrary memory read/write commands. So, if we really wanted to, we could just peek and poke the memory of the synth via MIDI. > If we wanted to, we could write these messages to a MIDI file and play it on the synth like any other MIDI file. Hey, that gives me an idea..... > From the countless sleepless nights of digging around in the firmware I’ve discovered a function that sends arbitrary data to the LCD controller.

dylan604 2y ago
> If we wanted to, we could write these messages to a MIDI file and play it on the synth like any other MIDI file. Hey, that gives me an idea..... I'm imagining dubstep would be the result
Terr_ 2y ago
P.S.: Now the real question is whether you can change the running-code on the keyboard so that it tries to infect other keyboards (of the same model) that might receive MIDI data originating from-it. In a way, this is a peek at the nightmare of Internet of Things (IoT, where the S stands for Security.) Almost any device might have a backdoor in it, and it might even be a stupid backdoor, like #0000.
odiroot 2y ago
> > [T]he most interesting commands that we have are arbitrary memory read/write commands. So, if we really wanted to, we could just peek and poke the memory of the synth via MIDI. This sounds easy but with SysEx having no delivery guarantees, and no sense of connection/session it can be frustrating. Totally normal to get "packet loss".

liotier 2y ago

Of course it is SysEx. SysEx is to standard MIDI what inline assembler is to Python. A world of undocumented proprietary stuff lurks within just about every MIDI device !

fer 2y ago
Yeah, same thinking here. No standard, manufacturer-defined, everything-goes kind of messages.
1oooqooq 2y ago
can't wait to see what sysEx hacks google will cram on chrome midi support they are building for the last couple years.
- jeroenhd 2y ago
  WebMIDI already has SysEx support: https://developer.mozilla.org/en-US/docs/Web/API/Web_MIDI_API https://developer.mozilla.org/en-US/docs/Web/API/Web_MIDI_AP...
  - 1oooqooq 2y ago
    did you read the article? of course webmidi must support sysEx, it's essential to work with midi2 at all. but mostly because you must parse the weird sized packet to properly ignore it. what might show up are chrome specific sysEx messages which then leads to exploits as the article.
- p0w3n3d 2y ago
  2030, browsers are TPMd DRMd and JAILed, one cannot simply access web with Firefox anymore: so we have jailbroken the Chrome using MIDI protocol to install extension that blocks ads
- prashnts 2y ago
  I tried to make a bidirectional channel from a webpage to a python script over MIDI. I'd just found that with sysex you can pack any arbitrary data that you want, that python can create virtual MIDI devices, and that Chrome can then connect to such devices. I'm sure I'd more code than what's in my 8yo repo, but the premise is simply https://github.com/prashnts/midipacks/blob/master/midipacks/pack.py https://github.com/prashnts/midipacks/blob/master/midipacks/...

cluckindan 2y ago

Any mirrors not in Russia? My ISP blocks access.

jeroenhd 2y ago
https://archive.is/N5t7a https://archive.is/N5t7a
codetrotter 2y ago
Snapshot: https://archive.is/FVUHe https://archive.is/FVUHe There's an embedded YouTube video in the article as well, that appears twice. First at the top and then again further down. https://www.youtube.com/watch?v=u6sukVMijBg https://www.youtube.com/watch?v=u6sukVMijBg There are also several videos in the article that are hosted on the same site as the original article (so on the .ru site). Those are not included in the snapshot unfortunatelly. You'll see placeholders and the associated text that describes them but you can't view those via the snapshot. It also contains a link to a GitHub repo at the end. https://github.com/portasynthinca3/swl01u https://github.com/portasynthinca3/swl01u
perching_aix 2y ago
Do you not have DNS-over-HTTPS/TLS configured, or are you on some weird browser that doesn't support ECH [0]? I wonder how they blocked it if those are in place (unless you use the ISP's DNS), since the site itself is served by Cloudflare from wherever close to you, not from Russia (and so the actual SNI isn't leaked via the ClientHelloOuter field either). [0] you can test these by using https://www.cloudflare.com/ssl/encrypted-sni/ https://www.cloudflare.com/ssl/encrypted-sni/
skissane 2y ago
Out of interest, which country are you in? Is this something your country's government made your ISP do?
- friend_Fernando 2y ago
  It's starting to look like an increasingly sensible policy IMO.

perching_aix 2y ago

> Now, we have to get a little philosophical here. In my eyes, RE is like a game of minesweeper. You start with an empty field not knowing the state of any of the cells, i.e. not knowing whether each individual cell contains a landmine or not. When you discover the state of a cell, you have the context to deduce the state of its neighbor cells. In minesweeper, you don’t have a particular direction in which you progress. You never say “In this game of minesweeper, I want to go up no matter what”, you just let the numbers nudge you in the direction that is the easiest to go in at the moment. I assert that this is also true for RE. Once you find out what a function or a variable does, you suddenly understand a little more about functions and variables that depend on the ones whose meaning you’ve just inferred. It may be beneficial not to set any particular goal with an RE project, and instead letting the complex network of intertwined functions and variables guide you towards understanding the system as a whole. That's such a nice way to think about it. Maybe I should try giving RE a go again.

Waterluvian 2y ago
I don’t know RE but I love this sentiment. I think it’s quite generalizable too. So many things are like that. Just start somewhere. It really doesn’t matter where. And what you find will guide your next steps. Eventually you’ll have enough context to see a much bigger picture well before it’s fully revealed.
- friend_Fernando 2y ago
  Gradient Descent?
  - deleted 2y ago
    [deleted]
bluGill 2y ago
The one difference is in re you sometimes go up no matter what because there isn't enough information. (in minesweeper I typically pick a few squares early because without them the game probably won't be solveable anyway. Typically in thegame once you have enough solved you have it all - once in a while a couple squares are unknowable. In re you hit points where you know all the clues can get you more often and so have to try something at random. Otoh it is much rarer in re for a wrong try to be catestropic [not unheard of but rare]

moosedev 2y ago

Great project, write-up, and sense of humor in the videos! > Using that part number I wasn’t able to find any information about the chip online apart from an article that claimed it was based around a “SuperH” CPU core – an ISA that I’ve encountered for the first time ever in that article. Also found in Sega 32x, Sega Saturn, and Sega Dreamcast! And some early Pocket PCs (turn-of-the-century handhelds running Windows CE) like the HP Jornada series, although most Pocket PCs were ARM-based.

brian-armstrong 2y ago
Many industrial applications as well. Mitsubishi used it in the ECU of some of its cars, including the Lancer Evolution.
- publicmail 2y ago
  Early (2003 for sure) 350z had it as well.

trelbutate 2y ago

So, the repo's README claims the repo contains the image dumps, but they're not actually there. Is this correct?

perching_aix 2y ago
Seems to be. Probably a good shout considering those dumps would be protected by Yamaha's copyright.
portasynthinca3 2y ago
My bad! I added *.bin to .gitignore last minute to exclude assembled code snippets, but looks like the dumps were excluded as well. I'm going to upload them in the next few hours

brokenmachine 2y ago

Awesome writeup, thanks for that.

exabrial 2y ago

holy crap, nothing is safe.

lqstuart 2y ago

> I’m very unexperienced when it comes to reverse engineering Lol… where does that leave the rest of us in comparison

pottspotts 2y ago
Yeah this is oft-repeated by particularly good "lay" engineers.
Cthulhu_ 2y ago
Knowing a lot but being aware you know nothing is like level 4 of experience, where level 1 is being new and eager but knowing you know nothing yet, level 2 is the "I am a god" stage, and level 3 is "I'm an idiot".

sharkbot 2y ago

Now for the most important question: can you run DOOM on it? :)

deleted 2y ago

[deleted]

ejacky001 2y ago

interesting.

the_plus_one 2y ago

As someone who's reversed some basic MIDI stuff in an old video game and has always wanted to get into hardware hacking, I really enjoyed reading this article. Great work!

pottspotts 2y ago

How does a man even get to this point? I will tell you how: derangement, a failure to engage with society and the degeneration/depravity of being one step away from making MIDI component improvised explosives and emailing your remaining friends a manifesto. Ah just kidding, this is pretty sweet.

saagarjha 2y ago

Curious if you can intersperse the Bad Apple commands with MIDI music so it plays the audio itself ;)

lucasluitjes 2y ago

That is amazing research! Reminds me a bit of the 2017 research of RCE on a DNA sequencing machine by synthesizing shellcode in actual DNA/RNA molecules [0]. I was gonna say "next up: OSC" but I guess MIDI is still dominant. [0] https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/ney https://www.usenix.org/conference/usenixsecurity17/technical...

serverlessmania 2y ago

Awesome, I'm trying to do this with Elektron machines, the Digitakt.

JimmyWilliams1 2y ago

[dead]

notpushkin 2y ago

On the off chance any of the HN crowd is in Armenia: Porta will be giving a talk about this on January 10th at the Hacker Embassy. You should definitely come: https://t.me/hackerembassy/17 https://t.me/hackerembassy/17

helpfulContrib 2y ago

[dead]

SideQuark 2y ago

> World’s First MIDI Shellcode There's been MIDI shell code for well over 20 years on pretty much all major platforms: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=midi https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=midi

LegionMammal978 2y ago
Plenty of buffer overflows. But has anyone actually written a shellcode for those?
- SideQuark 2y ago
  Metasploit added automated shellcode generators into midi files at least a dozen years ago, likely earlier. https://www.exploit-db.com/exploits/18426 https://www.exploit-db.com/exploits/18426 So to test this, surely they tried it once, and presumably Metasploit users generated tons of them . And from having worked in this space a long time ago, such CVEs would trigger a host of malicious midi files looking for holes, especially since people embedded them in webpages around early 2000s. Around that time I'd routinely take a MS update, diff the DLLs, reverse interesting location changes, and craft shellcode attacks during training to show people how it's not very hard. And there were tons of people across the spectrum able to do similarly. CVE disclosures made them much easier to develop.