0 Usuarios y 1 Visitante están viendo este tema.
; SKY DG834GT decoder v1.0; 6th May 2009;; Ref: (no url yet); Please note that the following is sloppy coding, my brain is fried. I didn't actually; achieve any result by viewing the MIPS assembler functions of the router binaries, but this is ; where I started: I have Ubuntu installed and the QEMU emulator, running MIPS (Debian); Snip (no url yet); (The Debian Etch MIPS small) - rest of the instructions are on that page.;; Once up And running I install GDB And place the SKY router binary 'RC' (usr/sbin/rc) on a webserver; where I can 'wget' it To the emulated MIPS environment. The binaries for the router can be found; here: (snip); The file you're after is: DG834GT-1SKUK (For Firmware Version 1.02.28) - within that archive; is target.tar.bz2 - unpack that and you'll find the RC binary.;; You'll also have to copy some libs over from that target archive to your /lib/ directory...; ld-uClibc-0.9.28.so; ld-uClibc.so.0; libc.so.0; libuClibc-0.9.28.so; else the RC binary will appear to not function. ; Make sure to CHMOD 777 the libs and RC binary.;; After failing badly to understand any of the code of RC using GDB,; I found another way. In the QEMU emulator I renamed my MD5SUM to MD5SUM2, then copied; my 'more' command to 'MD5SUM' (find them using the 'whereis' command). Effectively, this lets; GDB run the RC file without creating an MD5SUM. You create it yourself. It still calls MD5SUM, but; doesn't realise it's calling 'more' instead. So what it's doing it echoing your personalised MAC; file to itself and creating the password/phrase/etc into the newly created nvram file. With this ; method you can trial and error to find algorithm combinations.; ; GDB: shell echo -n 00000000000000000000000000000000 >mac; GDB: file rc; GDB: start; GDB jump EzPassword; GDB: shell more nvram; ; To get this to work correctly you have to type 'start' in GDB before every attempt. Values for; nvram include: EzPassword, EzSSID, EzChannel, EzPassphrase (all of which can be jumped to, see above);; Purebasic source requires Droopy Library for hex2dec function; Window functions derived from public domain source by 'Kale'.; DG934G v2 SKY router uses the serial on the router itself,; which is added To the tmp/mac file As: 1a1b1c2a2d2f-12345678...; (I think!) - trying this out on norm360's data brings the correct; password etc but not the correct Passphrase. Working on it.; Ref: (snip); Haven't looked at the v3 router yet.; I think this is all right, my brain is mince, as I said.; The following is to set the window/button setup; which I can't explain well, since I took and modified the code; from public domain archives#Window_0 = 0 #Window_1 = 1 #Gadget_0 = 0 #Gadget_1 = 1 #Gadget_2 = 2 #Gadget_3 = 3#Gadget_4 = 4#Gadget_5 = 5#Gadget_6 = 6#Gadget_7 = 7Procedure AddText() existingText.s = GetGadgetText(#Gadget_0) If existingText = "" SetGadgetText(#Gadget_0, GetGadgetText(#Gadget_1)) Else SetGadgetText(#Gadget_0, existingText + Chr(13) + Chr(10) + GetGadgetText(#Gadget_1)) EndIf lines = SendMessage_(GadgetID(0),#EM_GETLINECOUNT,0,0) SendMessage_(GadgetID(#Gadget_0), #EM_LINESCROLL, 0, lines) EndProcedure If OpenWindow(#Window_0, 5, 5, 690, 300, "Sky v1.0 - DG834GT", #PB_Window_MinimizeGadget | #PB_Window_MaximizeGadget | #PB_Window_SystemMenu | #PB_Window_ScreenCentered ) If CreateGadgetList(WindowID(#Window_0)) EditorGadget(#Gadget_0, 5, 5, 680, 254, #ES_MULTILINE | #ES_AUTOVSCROLL | #ES_AUTOHSCROLL | #WS_VSCROLL ) StringGadget(#Gadget_1, 5, 270, 250, 21, "") ButtonGadget(#Gadget_2, 270, 270, 65, 22, "Go") ButtonGadget(#Gadget_3, 340, 270, 65, 22, "Info") ButtonGadget(#Gadget_4, 410, 270, 65, 22, "Null1") ButtonGadget(#Gadget_5, 480, 270, 65, 22, "Null2") ButtonGadget(#Gadget_6, 550, 270, 65, 22, "Null3") ButtonGadget(#Gadget_7, 620, 270, 65, 22, "Null4") EndIf EndIf Repeat Event = WaitWindowEvent() Select Event Case #PB_Event_Gadget Select EventGadget() ; Button Go is pressed Case #Gadget_2 If GetGadgetText(#Gadget_1) <> "" mac$=GetGadgetText(#Gadget_1) Gosub pro EndIf SetGadgetText(#Gadget_0,"") SetGadgetText(#Gadget_0,all$) SetGadgetText(#Gadget_1,"") ; Button Read Me is pressed Case #Gadget_3 mystring.s = PeekS(? source) SetGadgetText(0, mystring.s) EndSelect EndSelect Until Event = #PB_Event_CloseWindow Endpro:; Main routine to grab everything from the hash; Uppercases your mac and removes the : colons if entered; No other checks on the mac are done in this versionmac$=UCase(RemoveString(mac$,":")); Purebasic inbuilt md5sum routine; If doing an MD5SUM in Linux, create your /tmp/mac file with; echo -n 1a2b3c4d5e6f >mac - Make sure to use the n flaghash$=MD5Fingerprint(@mac$, Len(mac$)); This takes 5 double-char hex characters from the MAC; starting with position 1 - example (MD5SUM for 112233445566):; eb341820cd3a3485461a61b1e97d31b1 - split this to; eb 34 18 20 cd; Then split from position 15, 10 characters again:; 85 46 1a 61 b1; I then converted the first five to decimal, then; the second five and added eb + 85, 34 + 46, etc; Converted them back to hex and then converting again to 2-digit hex; (first sum of eb + 85 = 170, so becomes 70); Place all of your 5 sums together in one line to; create the password:; 70 7a 32 81 7e -> 707a32817e; I did try adding eb341820cd + 85461a61b1 but the result; was wrong, maybe it was my math, or the routine, or maybe; it just can't be done that way, I don't know.a1=Hex2Dec(Mid(hash$,1,2))a2=Hex2Dec(Mid(hash$,3,2))a3=Hex2Dec(Mid(hash$,5,2))a4=Hex2Dec(Mid(hash$,7,2))a5=Hex2Dec(Mid(hash$,9,2))b1=Hex2Dec(Mid(hash$,15,2))b2=Hex2Dec(Mid(hash$,17,2))b3=Hex2Dec(Mid(hash$,19,2))b4=Hex2Dec(Mid(hash$,21,2))b5=Hex2Dec(Mid(hash$,23,2))sum1$=Right(Hex(a1+b1),2)sum2$=Right(Hex(a2+b2),2)sum3$=Right(Hex(a3+b3),2)sum4$=Right(Hex(a4+b4),2)sum5$=Right(Hex(a5+b5),2)password$=LCase(sum1$+sum2$+sum3$+sum4$+sum5$+sum6$); The following creates an array for easy lookup of the Passphrase.; 00 = A, 01 = B, 02 = C, etc until Z is reached, ; then we kick back to A: 19 = Z, 1a = A, 1b = B; The 8 hex values for the Passphrase can be found in the hash; at these locations:; Position 3,7,11,15,19,23,27,31 - an example using 1's and 0's,; where the 1's are the Passphrase hex values:; 00110011001100110011001100110011; So if the above MD5SUM = 00990011001100110011001100110011; Then via the array-lookup, the Passphrase is:XRRRRRRR; X=99, R=11Dim phrasearray.s(255)a=65For i = 0 To 255letter$=Chr(a)find$=LCase(RSet(Hex(i),2,"0"))+" "+letter$phrasearray(i)=find$a=a+1If a=91 : a=65 :EndIfNextp1=Hex2Dec(Mid(hash$,3,2))phrase$+Mid(phrasearray(p1),4,1)p2=Hex2Dec(Mid(hash$,7,2))phrase$+Mid(phrasearray(p2),4,1)p3=Hex2Dec(Mid(hash$,11,2))phrase$+Mid(phrasearray(p3),4,1)p4=Hex2Dec(Mid(hash$,15,2))phrase$+Mid(phrasearray(p4),4,1)p5=Hex2Dec(Mid(hash$,19,2))phrase$+Mid(phrasearray(p5),4,1)p6=Hex2Dec(Mid(hash$,23,2))phrase$+Mid(phrasearray(p6),4,1)p7=Hex2Dec(Mid(hash$,27,2))phrase$+Mid(phrasearray(p7),4,1)p8=Hex2Dec(Mid(hash$,31,2))phrase$+Mid(phrasearray(p8),4,1); The SSID array is created as above, where; a hex value of 00=0 and 09=9. When it reaches 9; the array kicks back To 0, so 0a = 0; The hex positions in the MD5SUM are found ; at 23,25,27,29,31; Example: 0102031a1b = 12367 Dim ssidarray.s(255)a=48For i = 0 To 255digit$=Chr(a)find$=LCase(RSet(Hex(i),2,"0"))+" "+digit$ssidarray(i)=find$a=a+1If a=58 : a=48 :EndIfNexts1=Hex2Dec(Mid(hash$,23,2))ssid$+Mid(ssidarray(s1),4,1)s2=Hex2Dec(Mid(hash$,25,2))ssid$+Mid(ssidarray(s2),4,1)s3=Hex2Dec(Mid(hash$,27,2))ssid$+Mid(ssidarray(s3),4,1)s4=Hex2Dec(Mid(hash$,29,2))ssid$+Mid(ssidarray(s4),4,1)s5=Hex2Dec(Mid(hash$,31,2))ssid$+Mid(ssidarray(s5),4,1); Channel array same as above, but it appears; they only use channels 1,6 and 11 - so the array; creates 00=1, 01=6, 02=11, 03 =1, 04=6, etc.; Channel hex in the MD5SUM is found at position 31 (last two; characters of the MD5SUM)Dim channelarray.s(255)a=1For i = 0 To 255find$=LCase(RSet(Hex(i),2,"0"))+" "+Str(a)channelarray(i)=find$a=a+5If a>12 : a=1 :EndIfNexts1=Hex2Dec(Mid(hash$,31,2))channel$+Mid(channelarray(s1),4,1);Dump them all into variablesx$=Chr(13)+Chr(10)a$="MD5SUM: "+hash$ b$="Username: "+mac$+"@skydsl"c$="Password: "+password$d$="Passphrase: "+phrase$e$="SSID: SKY"+ssid$f$="Channel: "+channel$; Dump all of the above into a shorter single line with breaksall$= a$+x$+b$+x$+c$+x$+d$+x$+e$+x$+f$; Reset some stuffhash$=""mac$=""password$=""phrase$=""channel$=""ssid$=""find$="" Return; Includes this source file into the Purebasic executableDataSection source : IncludeBinary "source.txt" + Chr(0) phrasearray : IncludeBinary "phrasearray.txt" + Chr(0) ssidarray : IncludeBinary "ssidarray.txt" + Chr(0) channelarray : IncludeBinary "channelarray.txt" + Chr(0)EndDataSection
If the first three digits of the serial number is 1JN the router is a KWGR624NAIf the first three digits of the serial number is 1SV the version number is V9If the first three digits of the serial number is 1MF the version number is V8 or WGR614L If the first three digits of the serial number is 1J1 the version number is V7If the first three digits of the serial number is 166 the version number is V6If the first three digits of the serial number is WR7 the version number is V5
membase = mmap( 0, ATHEROS_PCI_MEM_SIZE, PROT_READ|PROT_WRITE,MAP_SHARED|MAP_FILE, fd, base_addr ) ;
membase = (unsigned char *) mmap(0, ATHEROS_PCI_MEM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FILE, fd, base_addr);
me quedan 7 fallitos
lo que he modificado
porque sin querer he visto algo muy interesante.
no tengo ni ideia en que lenguaje fue hecho esto....
nunca he oído hablar de este lenguaje
¿Alguno de vosostros ha conseguido ejecutar el programa para saber si funciona?
He aprovechado para mejorar un poco más la interfaz hombre-maquina de la aplicación original.
Para aquellos que quieren jugar con el código fuente
Saludos y besitos para maripuri
pero alguno lo probado.
Visitantes: 75
Oculto(s): 0
Usuarios: 10
Usuarios en Línea:
Total de Usuarios: 
Cinco de Mayo
