Geekly articles weekly

Nous obtenons la racine sur le dongle TV

J'ai un appareil AllShare Cast (un appareil comme Chormecast, de Samsung), comme ceci:

image

Sans savoir quoi en faire, j'ai pensĂ©: «Attendez une minute, il devrait y avoir Linux ... Et s'il y a Linux - il y a SoC ... Et s'il y a il y a SoC, donc il y a une interface UART Ă  travers laquelle vous pouvez obtenir des droits shell et root sur ce Linux! ”

Clause de non-responsabilité
.

, , , .

Nous avons d'abord besoin:

  • L'appareil lui-mĂȘme, oĂč serait-il sans lui.
  • Tournevis
  • Adaptateur USB-> UART (3,3 volts, en aucun cas RS-232, il brĂ»lera simplement l'appareil!)
  • Le test conduit Ă  s'accrocher aux contacts de la carte.

Commençons par le démontage de l'appareil, vous devez d'abord retirer la "semelle" en caoutchouc du fond du boßtier, il y a trois vis en dessous (marquées en rouge):

Vis
image

Une fois les vis dĂ©vissĂ©es, le couvercle supĂ©rieur peut ĂȘtre percĂ© avec un tournevis plat (il se trouve sur les loquets).

Sous la couverture, vous verrez ceci:

Carte dongle
image

Vous pouvez maintenant retirer avec précaution la carte et y connecter l'adaptateur. Le cùblage est illustré ci-dessous, les noms des signaux par rapport aux broches de l'adaptateur.

CĂąblage UART sur la carte
image

Remarque: l'adaptateur et le dongle doivent ĂȘtre connectĂ©s au mĂȘme ordinateur ou connecter le boĂźtier de l'un des connecteurs de la carte d'appareil Ă  la broche GND de l'adaptateur.

UPD: La vitesse du port est de 115200 bauds.

Ouvrez le terminal de l'ordinateur et connectez l'alimentation au dongle, tout en maintenant la touche EntrĂ©e enfoncĂ©e dans la fenĂȘtre du terminal. Le chargeur devrait nous rencontrer avec joie si cela ne se produisait pas:

DĂ©pannage
:

  2. UART
  3. TX RX


U-Boot 2011.06-svn10711 (12 juin 2012-21: 21: 34)

I2C: prĂȘt
DRAM: 256 Mio
SF: fabricant non pris en charge c8
Vitesse SPI Ă  [R: 23 MHz / W: 47 MHz] Taille du flash: 64 Ko
NAND: 256 Mio
MMC:   
initialisation d'un environnement sécurisé
Table de blocs incorrects trouvée à la page 131008, version 0x01
Table de blocs incorrects trouvée à la page 130944, version 0x01
Dans: série
Sortie: série
Err: série
MAC: 00: 1a: cc: 00: 00: 01
Appuyez sur n'importe quelle touche pour arrĂȘter le dĂ©marrage automatique: 0 
CNCl800L>


Eh bien, maintenant notre tùche est de charger le noyau et d'obtenir le shell. Il ne pourra tout simplement pas le faire, car le noyau et initrd sont cryptés et signés.

Pour obtenir le shell racine, vous devez conduire les commandes suivantes dans le chargeur de dĂ©marrage (les commentaires ne doivent pas ĂȘtre saisis):

nand read 06020000 2400000 2000000 #    -,    5  10 .
cryptotest 06020000 08080000 2000000 #  
nand read 8000000 5801000 20000 #  initrd
cryptotest 8000000 bfff000 20000 #  
setenv bootargs ${bootargs} rdinit=/bin/sh #  /bin/sh  init 
bootm 08080000 #

Un chargement supplémentaire sera effectué, aprÚs cela, nous verrons ce qui suit:

CNCl800L> nand read 06020000 2400000 2000000 && cryptotest 06020000 08080000 2000000 && nand read 8000000 5801000 20000 && cryptotest 8000000 bfff000 20000 && setenv bootargs ${bootargs} rdinit=/bin/sh && bootm 08080000

NAND read: device 0 offset 0x2400000, size 0x2000000
 33554432 bytes read: OK
length 33554432: 511 whole chunks with 65536 remainder
done!

NAND read: device 0 offset 0x5801000, size 0x20000
 131072 bytes read: OK
length 131072: 1 whole chunks with 65536 remainder
done!
## Booting kernel from Legacy Image at 08080000 ...
   Image Name:   12448_samsung_H
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    30727842 Bytes = 29.3 MiB
   Load Address: 08080040
   Entry Point:  08080040
   XIP Kernel Image ... OK
OK

Starting kernel ...

Uncompressing Linux............................................................................................................................................... done, booting the kernel.
Linux version 2.6.32.45-SDK-0.7 (builder@qabuild2) (gcc version 4.4.1 (Sourcery G++ Lite 2010q1-202) ) #1 PREEMPT Sun Nov 25 10:56:43 PST 2012
CPU: ARMv6-compatible processor [410fb767] revision 7 (ARMv7), cr=00c5387f
CPU: VIPT aliasing data cache, VIPT aliasing instruction cache
Machine: Celestial CNC1800L
Ignoring unrecognised tag 0x00000000
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 28448
Kernel command line: console=ttyS0,115200 rdinit=/bin/sh ethaddr=00:1A:CC:00:00:01
CSM ETH Readed MAC:00:1a:cc:00:00:01
PID hash table entries: 512 (order: -1, 2048 bytes)
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 112MB = 112MB total
Memory: 80980KB available (4160K code, 382K data, 120K init, 0K highmem)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:73
Clock event Set mode Periodic
Console: colour dummy device 80x30
Calibrating delay loop... 539.03 BogoMIPS (lpj=2695168)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
devtmpfs: initialized
NET: Registered protocol family 16
CNC GPIO at 0xf8260000, 64 lines
disp_base 0xfc900000, tve0_base 0xf8168000, tve1_base 0xf8160000
CNC1800L Display System Version : 0.1
cnc1800l_df: CNC Display feeder driver was initialized, at address@[phyical addr = b1800000, size = 1000] 
cnc1800l_df: CNC TVE0 driver was initialized, at address@[phyical addr = 80168000, size = 1000] 
cnc1800l_df: CNC TVE1 driver was initialized, at address@[phyical addr = 80160000, size = 1000] 
There is 112M for user!
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
HERE cnc18xx_i2c_probe 
Bluetooth: Core ver 2.15
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Switching to clocksource cs_clocksource
Slow work thread pool: Starting up
Slow work thread pool: Ready
FS-Cache: Loaded
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 3, 32768 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
NET: Registered protocol family 1
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
RPC: Registered tcp NFSv4.1 backchannel transport module.
Trying to unpack rootfs image as initramfs...
Clock event Set mode oneshot
Freeing initrd memory: 27860K
CNC18XX PINMUX at 0xb2110000, 16 lines
CNC1800L_CLOCK init at b2100000
NTFS driver 2.1.29 [Flags: R/O].
JFFS2 version 2.2. (NAND) (SUMMARY)  © 2001-2006 Red Hat, Inc.
fuse init (API version 7.13)
msgmni has been set to 212
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
fb0: CNC frame buffer @[0xc000000, 0xc8000000] size 0x4000000
fb1: CNC frame buffer @[0xc000000, 0xc8000000] size 0x4000000
fb2: CNC frame buffer @[0xc800000, 0xcd000000] size 0x3800000
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x801f1000 (irq = 12) is a 16550A
console [ttyS0] enabled
serial8250.1: ttyS1 at MMIO 0x801f2000 (irq = 13) is a 16550A
brd: module loaded
loop: module loaded
Creating 3 MTD partitions on "s25f":
0x000000000000-0x00000000c000 : "spi_cavm_miniloader"
0x00000000c000-0x00000000e000 : "spi_cavm_bootloader_env1"
0x00000000e000-0x000000010000 : "spi_cavm_bootloader_env2"
Enable HW ECC for CNC18xx!
NAND device: Manufacturer ID: 0xec, Chip ID: 0xda (Samsung NAND 256MiB 3,3V 8-bit)
Creating 19 MTD partitions on "cnc_nand.0":
0x000000000000-0x000000020000 : "cavm_miniloader"
0x000000020000-0x0000000a0000 : "cavm_uboot1"
0x0000000a0000-0x000000120000 : "cavm_uboot2"
0x000000120000-0x000000140000 : "cavm_nvram_factory"
0x000000140000-0x000000160000 : "cavm_nvram1"
0x000000160000-0x000000180000 : "cavm_nvram1b"
0x000000180000-0x0000001a0000 : "cavm_nvram2"
0x0000001a0000-0x0000001c0000 : "cavm_nvram2b"
0x0000001c0000-0x0000003c0000 : "cavm_splash"
0x0000003c0000-0x0000003e0000 : "cavm_all_img1_info"
0x0000003e0000-0x000000400000 : "cavm_blob_info"
0x000000400000-0x000002400000 : "cavm_netHD_Image1"
0x000002400000-0x000004400000 : "cavm_netHD_Image2"
0x000004400000-0x000005780000 : "cavm_free1"
0x000005780000-0x0000057c0000 : "cavm_uboot2_img_info"
0x0000057c0000-0x000005800000 : "cavm_netHD_img2_info"
0x000005800000-0x000005c00000 : "cavm_blob"
0x000005c00000-0x000007c00000 : "cavm_ffs"
0x000007c00000-0x000008000000 : "customer_area"
Celestial MAC eth0: 0xb1400000 IRQ 24 MAC:00:1a:cc:00:00:01
usbcore: registered new interface driver cdc_ether
usbcore: registered new interface driver rndis_host
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
cnc18xx-ehci cnc18xx-ehci: CNC18XX EHCI
cnc18xx-ehci cnc18xx-ehci: new USB bus registered, assigned bus number 1
cnc18xx-ehci cnc18xx-ehci: irq 22, io mem 0x80200000
cnc18xx-ehci cnc18xx-ehci: USB 0.0 started, EHCI 1.00
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: CNC18XX EHCI
usb usb1: Manufacturer: Linux 2.6.32.45-SDK-0.7 ehci_hcd
usb usb1: SerialNumber: cnc18xx
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
cnc18xx-ohci cnc18xx-ohci: CNC18XX OHCI
cnc18xx-ohci cnc18xx-ohci: new USB bus registered, assigned bus number 2
cnc18xx-ohci cnc18xx-ohci: irq 27, io mem 0x80210000
usb usb2: New USB device found, idVendor=1d6b, idProduct=0001
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: CNC18XX OHCI
usb usb2: Manufacturer: Linux 2.6.32.45-SDK-0.7 ohci_hcd
usb usb2: SerialNumber: cnc18xx-ohci
usb usb2: configuration #1 chosen from 1 choice
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
usbcore: registered new interface driver cdc_wdm
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver sisusb
mice: PS/2 mouse device common for all mice
Linux video capture interface: v2.00
gspca: main v2.7.0 registered
usbcore: registered new interface driver zc3xx
zc3xx: registered
usbcore: registered new interface driver uvcvideo
USB Video Class driver (v0.1.0)
Bluetooth: Generic Bluetooth SDIO driver ver 0.1
cpuidle: using governor ladder
cpuidle: using governor menu
mshci: Mobile Storage Host Controller Interface driver
mshci: Copyright(c) Pierre Ossman
mmc0: Version ID 0x5342230a.
mmc0: FIFO WMARK FOR RX 0x20 WX 0x1.
mmc0: MSHCI controller on cavium-mshci [cnc1800l-mshci.0] using IDMA
usbcore: registered new interface driver usbhid
usbhid: v2.6:USB HID core driver
Celestial Smart Card interface initialized!
CNC18XX Watchdog Timer: timer margin 40 sec
CNC1800L Video System Version : 0.1
CNC1800 Audio System Version : 0.2
cnc1800_audio: CNC Audio driver was initialized, at address@[phyical addr = b1200000, size = 100000] 
cnc1800_audio: CNC Audio stuff at address@[phyical addr = 070f1000, size = 300000] 
CS BLIT Initialed
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 17
NET: Registered protocol family 15
VFP support v0.3: implementor 41 architecture 1 part 20 variant b rev 5
Freeing init memory: 120K
/bin/sh: can't access tty; job control turned off
# mmc0: new high speed SDIO card at address 0001


Maintenant, appuyez sur Entrée et profitez.

Littérature:
Hackitonary sur le sujet (la méthode a pris à partir de là, mais a corrigé beaucoup de choses)

Merci:
canal irc #Exploiteers sur freenode

Source: https://habr.com/ru/post/fr388049/

More articles:


All Articles