7 ms·

the project is open source so you can also take a look through the source code: https://github.com/opentechinstitute/commotion-router https://github.com/opentec

by sOuqq 13y ago

the project is open source so you can also take a look through the source code: https://github.com/opentechinstitute/commotion-router https://github.com/opentechinstitute/commotion-router

cinquemb 13y ago
This looks like shell scrips for patches and config files. Is there another place with the source that actually used to compile the binaries like this: http://downloads.commotionwireless.net/router/1.0/ar71xx/generic/openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin http://downloads.commotionwireless.net/router/1.0/ar71xx/gen...
- sOuqq 13y ago
  It uses the OpenWRT build system to produce those binaries. Try pulling the source code and building it yourself :) https://github.com/opentechinstitute/commotion-router#installation https://github.com/opentechinstitute/commotion-router#instal...
  - cinquemb 13y ago
    I would be more interested in the decompiled binaires at this point, you know the stuff being released directly into the wild from the site :) Unless you could point me in the direction of a repo that looks like this[0] (posted in this thread, and project I've been following along with others), that corresponds to the binary I posted above. [0] https://github.com/cjdelisle/cjdns https://github.com/cjdelisle/cjdns
    - elation 13y ago
      Hey, I am one of the developers of the Commotion project. OpenWRT can be a confusing system. Let me help you find what you are looking for. The Commotion-router repo above is contains our setup scripts that make it easier for new users like you to build our software from source. If you look at the feeds.conf file you will find the exact sources we are pulling in to the openWRT build system for compilation. The most important line, for your concerns about backdoors would be the third line of that file. That line pulls in the master branch of the repo commotion-feed. This repository is full of makefiles. These makefiles specify how to build the source code into the compiled binary your pointed to before. If you follow the follow the install instructions that were poster earlier and then explore the curses (command line GUI) menu for make menuconfig you can explore the exactly what packages are going to be built for the specific architecture. (If you are curious about tampering we sadly have not had the time or funding to do deterministic builds, so I suggest you build it from source yourself so that you can examine the code.) Now, each item in the menuconfig references a "feed." You can look at the feeds.conf file in the current directory, and the various makefiles in the feeds folder to explore where exactly things are being pulled from. Our source code will use the git repo's specified in the makefiles in commotion-feed on the master branch. You can find all of those in our github, because we are an open-source project. If you have any concerns about specific lines of code that have been implemented I beg of you to submit a bug to the repo you find a problem with. We want every possible opportunity better our code. While we have done internal testing, I hope that with eyes like yours looking over the code we will find more bugs that we can address in the future. If you have any questions I will try to follow this thread the best I can, and am elationfoundation on github. You can also find most of the developers and our field experts on freenode at #commotion. I have built, and debugged, far too many openWRT images. So, If you do need assistance jump on #commotion during Americas East Coast working hours and I will be glad to help you. I hope this helped. OpenWRT's build system is a beautiful, but complex being.
      - cinquemb 13y ago
        Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at least right now). But at least from you even mentioning deterministic builds, must mean that the thought has crossed your minds? I know the Tor project has to deal with concerns like that, and I figure firmware providers for mesh-networks will increasingly have to deal with the same. These sorts of things have piqued my interest lately and right now I'm in the middle of digging through the linksys e1000 firmware[0][1] (from yesterdays hubbub, too bad the script didn't work for me :/) and my cousin telling me about open ports (10080,1780,51000) on 192.168.1.1 on his network with some interesting traffic (his words). So, if I hear any stories relating to traffic on ports from postings online relating to this firmware, I'll probably take a look for fun (though there are probably many other people better at these things like yourself). [0] http://support.linksys.com/en-us/support/routers/E1000 http://support.linksys.com/en-us/support/routers/E1000 [1] http://i.imgur.com/jWebamh.png http://i.imgur.com/jWebamh.png
        voltagex_ 13y ago
        From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs. Also try a newer version of binwalk [-1] and/or the 2.0 branch [0] -1: https://github.com/devttys0/binwalk/ https://github.com/devttys0/binwalk/ 0: https://github.com/devttys0/binwalk/tree/binwalk-2.0 https://github.com/devttys0/binwalk/tree/binwalk-2.0
        cinquemb 13y ago
        I saw your comment yesterday, which made me want to take a stab at it. Thanks alot! I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1. [i] http://i.imgur.com/Vk35XL0.png http://i.imgur.com/Vk35XL0.png [i^2] http://i.imgur.com/HxTE0rR.png http://i.imgur.com/HxTE0rR.png
    - deleted 13y ago
      [deleted]

by sOuqq 13y ago

the project is open source so you can also take a look through the source code: https://github.com/opentechinstitute/commotion-router https://github.com/opentechinstitute/commotion-router

cinquemb 13y ago

This looks like shell scrips for patches and config files. Is there another place with the source that actually used to compile the binaries like this: http://downloads.commotionwireless.net/router/1.0/ar71xx/generic/openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-factory.bin http://downloads.commotionwireless.net/router/1.0/ar71xx/gen...

sOuqq 13y ago
It uses the OpenWRT build system to produce those binaries. Try pulling the source code and building it yourself :) https://github.com/opentechinstitute/commotion-router#installation https://github.com/opentechinstitute/commotion-router#instal...
- cinquemb 13y ago
  I would be more interested in the decompiled binaires at this point, you know the stuff being released directly into the wild from the site :) Unless you could point me in the direction of a repo that looks like this[0] (posted in this thread, and project I've been following along with others), that corresponds to the binary I posted above. [0] https://github.com/cjdelisle/cjdns https://github.com/cjdelisle/cjdns
  - elation 13y ago
    Hey, I am one of the developers of the Commotion project. OpenWRT can be a confusing system. Let me help you find what you are looking for. The Commotion-router repo above is contains our setup scripts that make it easier for new users like you to build our software from source. If you look at the feeds.conf file you will find the exact sources we are pulling in to the openWRT build system for compilation. The most important line, for your concerns about backdoors would be the third line of that file. That line pulls in the master branch of the repo commotion-feed. This repository is full of makefiles. These makefiles specify how to build the source code into the compiled binary your pointed to before. If you follow the follow the install instructions that were poster earlier and then explore the curses (command line GUI) menu for make menuconfig you can explore the exactly what packages are going to be built for the specific architecture. (If you are curious about tampering we sadly have not had the time or funding to do deterministic builds, so I suggest you build it from source yourself so that you can examine the code.) Now, each item in the menuconfig references a "feed." You can look at the feeds.conf file in the current directory, and the various makefiles in the feeds folder to explore where exactly things are being pulled from. Our source code will use the git repo's specified in the makefiles in commotion-feed on the master branch. You can find all of those in our github, because we are an open-source project. If you have any concerns about specific lines of code that have been implemented I beg of you to submit a bug to the repo you find a problem with. We want every possible opportunity better our code. While we have done internal testing, I hope that with eyes like yours looking over the code we will find more bugs that we can address in the future. If you have any questions I will try to follow this thread the best I can, and am elationfoundation on github. You can also find most of the developers and our field experts on freenode at #commotion. I have built, and debugged, far too many openWRT images. So, If you do need assistance jump on #commotion during Americas East Coast working hours and I will be glad to help you. I hope this helped. OpenWRT's build system is a beautiful, but complex being.
    - cinquemb 13y ago
      Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at least right now). But at least from you even mentioning deterministic builds, must mean that the thought has crossed your minds? I know the Tor project has to deal with concerns like that, and I figure firmware providers for mesh-networks will increasingly have to deal with the same. These sorts of things have piqued my interest lately and right now I'm in the middle of digging through the linksys e1000 firmware[0][1] (from yesterdays hubbub, too bad the script didn't work for me :/) and my cousin telling me about open ports (10080,1780,51000) on 192.168.1.1 on his network with some interesting traffic (his words). So, if I hear any stories relating to traffic on ports from postings online relating to this firmware, I'll probably take a look for fun (though there are probably many other people better at these things like yourself). [0] http://support.linksys.com/en-us/support/routers/E1000 http://support.linksys.com/en-us/support/routers/E1000 [1] http://i.imgur.com/jWebamh.png http://i.imgur.com/jWebamh.png
      - voltagex_ 13y ago
        From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs. Also try a newer version of binwalk [-1] and/or the 2.0 branch [0] -1: https://github.com/devttys0/binwalk/ https://github.com/devttys0/binwalk/ 0: https://github.com/devttys0/binwalk/tree/binwalk-2.0 https://github.com/devttys0/binwalk/tree/binwalk-2.0
        cinquemb 13y ago
        I saw your comment yesterday, which made me want to take a stab at it. Thanks alot! I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1. [i] http://i.imgur.com/Vk35XL0.png http://i.imgur.com/Vk35XL0.png [i^2] http://i.imgur.com/HxTE0rR.png http://i.imgur.com/HxTE0rR.png
  - deleted 13y ago
    [deleted]