Re: UExxC6500 series - research
Posted: Wed Sep 08, 2010 3:18 pm
Yes we couldn't find secret key of RSA signature. But when we start to infecting firmware than could find some backdoor or work around like RSA-Disable utility 

Code: Select all
//aes use from openssl
void aes_decrypt_128(const unsigned char* in, unsigned char* out, unsigned char* key){
AES_KEY akey;
AES_set_decrypt_key( key, 128, &akey );
AES_decrypt( in, out, &akey );
}
int main(int argc, char * argv[])
{
unsigned int filesize, i, n, b;
FILE *inputfp,*outputfp;
unsigned char buffer[1024];
unsigned char *inbuf,*outbuf;
unsigned char key[] = {0x84,0xAA,0x59,0x95,0x98,0x49,0xF6,0xDD,0xD4,0x82,0x3B,0x90,0xF7,0x91,0x39,0x02};
unsigned char iv_init[]= {0x1D,0xA7,0x6D,0xE2,0xA0,0xEE,0x55,0xC0,0xDB,0xCC,0xED,0xA7,0x72,0xE3,0x68,0x4D};
for (b = 1; b < argc; b++) {
unsigned char iv[16];
int paramlen = strlen(argv[b]);
memset(buffer, 0, 1024);
memcpy(buffer, argv[b], paramlen -4);
memcpy(iv, iv_init, 16);
inputfp = fopen(argv[b], "rb");
outputfp = fopen((char*)buffer, "wb");
fseek(inputfp,0,2);
filesize=ftell(inputfp);
rewind(inputfp);
inbuf =(unsigned char*) malloc(filesize);
outbuf =(unsigned char*) malloc(filesize);
fread(inbuf, sizeof(unsigned char), filesize, inputfp);
for (i = 0; i <filesize; i+=16) {
unsigned char *out = outbuf + i;
aes_decrypt_128(inbuf + i, outbuf + i, key);
for(n = 0; n < 16; n++)
out[n] ^= iv[n];
memcpy(iv, inbuf + i, 16);
}
fwrite(outbuf, 1,filesize , outputfp);
fclose(outputfp);
fclose(inputfp);
free(outbuf);
free(inbuf);
}
return 0;
}
Code: Select all
?CMK_to_membuf@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAHPAPAEAAK@Z
Code: Select all
SyncMgr.afterDownComplete = function() {
WMGlobal.FilePlugin.Unzip(WIDGET_TEMP_FULL_PATH + SyncMgr.installFileName, WIDGET_TEMP_FULL_PATH + SyncMgr.installID);
// ????? ?? apptype == 14
// CMK to SCK ?? ?? ??
TRACE( "APPTYPE " + SyncMgr.installID.substr(0,2));
if( SyncMgr.installID.substr(0,2) == "14" ){
TRACE("CMKtoSCK..........");
if (typeof WMGlobal.SecurityPlugin.CMKtoSCK == 'function'){
// CMK to SCK ?? ??
WMGlobal.SecurityPlugin.CMKtoSCK(WIDGET_TEMP_FULL_PATH + SyncMgr.installID, 0, 1);
}
else{
TRACE("[Ignore] SecurityPlugin.CMKtoSCK() is not a function.");
}
TRACE("CMKtoSCK..........DONE!! ");
}
WMGlobal.FilePlugin.Delete(WIDGET_TEMP_FULL_PATH + SyncMgr.installFileName);
WMGlobal.FilePlugin.Delete(NORMAL_WIDGET_PATH + SyncMgr.installID);
WMGlobal.FilePlugin.Move(WIDGET_TEMP_FULL_PATH + SyncMgr.installID, NORMAL_WIDGET_PATH);
var bRet = ManagerWidget.loadWidgetInfo(SyncMgr.installID);
if( bRet == false ) {
TRACE("ManagerWidget.loadWidgetInfo() returns false",TRACE_LEVEL.DEBUG);
var tRetValue = "1000?9";
SyncMgr.callbackFn(tRetValue);
return;
}
var obj = new WidgetObj(SyncMgr.installID);
if (!obj) {
TRACE("new WidgetObj returns NULL",TRACE_LEVEL.DEBUG);
return;
}
obj.loadConfig();
obj.status = WIDGET_STATUS.NORMAL;
obj.partners = SyncMgr.partners; // ??CP ??
obj.priority = SyncMgr.priority; // priority
obj.setTitle(SyncMgr.title);
var index = WidgetList.getIndex( SyncMgr.installID );
if (index == -1) {
// ?? ??? ???? ??
obj.installedDate = WidgetList.getStrDate();
WidgetList.push_back(obj);
}
else {
// ??????? installedDate ???? ??
// ?? ?? ??
var objOld = WidgetList.getWidget(index);
obj.lock = objOld.lock;
obj.favorite = objOld.favorite;
obj.executed = objOld.executed;
obj.installedDate = objOld.installedDate;
WidgetList.replaceAt(index, obj);
}
SyncMgr.putWidgetList();
}