4 ms·
> The most interesting thing about violations of open source licenses is the reverse engineering perspective. When you're able to identify the misused open sour
by iuguy 14y ago
> The most interesting thing about violations of open source licenses is the reverse engineering perspective. When you're able to identify the misused open source code within an executable binary, you can then use fingerprinting of the open source to better understand the closed source binaries. If you're curious about this kind of identification and program understanding in reverse engineering, you should look into the FLIRT and FLARE features of the IDA Pro disassembler.
For Linux-based devices more often than not they use a uImage loader with one of 3 filesystems (JFFS2, Squashfs, CramFS), so once you've got around whatever encryption or encapsulation's in the image (I typically generate a picture graphing bytes to spot entropy, a technique I shamelessly stole from Don A. Bailey) you can normally run something like binwalk[1] to identify the filesystems and dd them out using a small shell script. I typically mount each resulting image and extract the contents then unmount. You can usually spot the open source bits by looking at binary names, strings and the way they're linked.
Most Linux-based devices use common distros based on SBCs with uClibc and are either ARM or MIPS based. I'm slightly biased towards ARM because of the hotspot work but there's a lot of broadcom SBCs out there running *wrt variants.
If anyone's interested, I'll be at #44Café[2] this tuesday talking about breaking into onboard BMCs used for IPMI-based management. Again, GPL violations ahoy.
[1] - https://code.google.com/p/binwalk/ https://code.google.com/p/binwalk/
[2] - http://44con.com/44cafe http://44con.com/44cafe
- jcr 14y agoThanks for the 44con invite. It looks like fun, but I'm nowhere near there. Also, your BlackHat presentation was excellent, and surprisingly, I'm actually planing on watching it again to lift the details. I'm curious if you've touched any of the Verizon "MiFi" devices? I've started mildly poking at a MiFi4620LE (4G LTE "jetpack") recently, but not very seriously --It's not mine personally and its on a corporate account so I've been promised (read: threatened) to not mess with it too much. ;-) It's extremely fast but the double (p)NAT'ing is annoying i.e. it provides access to client devices via NAT to priv address space, but it's upstream interface is also NAT'ed by the carrier and in priv address space. So far I've figured out how to talk to it over USB, but I want to get it into "stupid" mode and talk directly to its internal modem. I want it to just be a dumb modem with a public address(es). I'm fairly sure there's a way to do it, but I just need to figure out how to do it. If I can get at the serial port, then it's game over.
- iuguy 14y agoThe MiFi4620LE is actually from the Novatel 4620L family and looks similar from what I can discern to the Novatel 3352 that I have. Novatel are horrible to deal with. They close their platform, don't release any firmware updates whatsoever and ship broken kit based almost entirely on open source software while never releasing the source they're legally obliged to provide. You need to avoid these guys if possible. The double NATing might be the 4G network. It's not uncommon to go from RFC1918 (you to device) to P2P device - mobile infrastructure to RFC1918 to boundary and onto the Internet. If you take the case apart you should find a set of 5 blobs or holes usually in a row that might indicate a JTAG interface, and with a bit of kit you should be able to get your serial port. I've not looked at my 3352 yet because the case doesn't come apart easily and I've mainly been playing with a much more hackable TP-Link device (the WR-703N). If it's like the 3352 it'll run a custom 'MifiOS' that has a ton of useless little api calls to feed javascript widgets on the web interface for things like geolocation and other pointless things.