2013年8月6日星期二

HI WIFI smart router firmware crack

open https://cloud.turboer.com/api/latest_rom?model=HC6361

{"id":820,"model":"HC6361","level":0,"branch":"","version":"0.775.784s 130802-131633","url":"http://updaterom.ikcd.net/upgrade_file/HC6361-0.775.784s_130802-131633-96d56f0c","md5":"a7fc5f5374061942b723b600e2ba66b0","size":7667716,"changelog":"<style type=\"text/css\">.tks{color:red;}</style><br>BUGFIX<br>1. 解决了50M以上入户带宽下载性能问题(<span class=\"tks\">感谢网友:Haroldzheng,kutin,dingctai</span>)<br>2. 解决了接入网络条件不好的情况下,上网页面容易出现502的问题<br>3. 解决了无线驱动与部分网卡的兼容性问题(<span class=\"tks\">感谢网友:xxmmmy</span>)<br>4. 解决了小极无法访问11对战平台战绩中心的问题(<span class=\"tks\">感谢网友:月巴月戎</span>)<br>5. 解决了小极无法访问坦克盒子战绩中心的问题(<span class=\"tks\">感谢网友:syy2153750</span>)<br><br><br>FEATURE<br>1. 无线中继支持自动连接历史连接节点(<span class=\"tks\">感谢网友:solwolf</span>)”}

dd if=HC6361-0.684.672s_130620-161916-2b3404e2  of=header   bs=1k count=1408
dd if=HC6361-0.684.672s_130620-161916-2b3404e2  of=tail_rootfs   bs=1k count=5832704 skip=1408

unsquashfs -dest squashfs-root  tail_rootfs 
open ash
yarshure@ubuntu:~$ vi squashfs-root/etc/inittab 

::sysinit:/etc/init.d/rcS S boot
::shutdown:/etc/init.d/rcS K shutdown
ttyATH0::askfirst:/bin/ash --login

check  SQUASHFS
$unsquashfs -s tail_rootfs

Found a valid SQUASHFS 4:0 superblock on tail_rootfs.
Creation or last append time Thu Jun 20 01:19:33 2013
Filesystem size 5668.60 Kbytes (5.54 Mbytes)
Compression xz
Block size 262144
Filesystem is exportable via NFS
Inodes are compressed
Data is compressed
Fragments are compressed
Always_use_fragments option is not specified
Xattrs are not stored
Duplicates are removed
Number of fragments 43
Number of inodes 1551
Number of ids 1

$cd squashfs-root/etc/rc.d
$ln -s ../init.d/dropbear S50dropbear

yarshure@ubuntu:~$ mksquashfs squashfs-root rootfs-squashfs_enable_ash9.xz.img -b 262144 -comp xz -noappend -all-root
Parallel mksquashfs: Using 1 processor
Creating 4.0 filesystem on rootfs-squashfs_enable_ash9.xz.img, block size 262144.
[===============================================================================================================================================================-] 1173/1173 100%
Exportable Squashfs 4.0 filesystem, xz compressed, data block size 262144
        compressed data, compressed metadata, compressed fragments, compressed xattrs
        duplicates are removed
Filesystem size 5723.95 Kbytes (5.59 Mbytes)
        31.90% of uncompressed filesystem size (17943.77 Kbytes)
Inode table size 12962 bytes (12.66 Kbytes)
        25.12% of uncompressed inode table size (51606 bytes)
Directory table size 15296 bytes (14.94 Kbytes)
        47.01% of uncompressed directory table size (32538 bytes)
Number of duplicate files found 19
Number of inodes 1552
Number of files 1157
Number of fragments 43
Number of symbolic links  253
Number of device nodes 0
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 142
Number of ids (unique uids + gids) 1
Number of uids 1
        root (0)
Number of gids 1
        root (0)

cat header rootfs-squashfs_enable_ash9.xz.img >HC6361-0.684.672s_130620-161916-2b3404e2_console_ssh.1

rmbp:testkk yarshure$ ls -l HC6361-0.684.672s_130620-161916-2b3404e2
-rw-r--r--  1 yarshure  staff  7274500  7 13 14:33 HC6361-0.684.672s_130620-161916-2b3404e2

>>> (7274500-4)/65536
111
rmbp:testkk yarshure$ ls -l HC6361-0.684.672s_130620-161916-2b3404e2_console_ssh.1
-rw-r--r--  1 yarshure  staff  7303168  7 15 14:58 HC6361-0.684.672s_130620-161916-2b3404e2_console_ssh.1

>>> 7303168/65536.0
111.4375
>>> 112*65536
7340032
>>> hex(7340032)
'0x700000'

>>> 7340032-7303168
36864

add  36864 0xff  padding to tail 

echo -ne '\xde\xad\xc0\xde' >> HC6361-0.684.672s_130620-161916-2b3404e2_console_ssh.1

mv HC6361-0.684.672s_130620-161916-2b3404e2_console_ssh.1 HC6361-0.684.672s_130620-161916-2b3404e2_enable_console_ssh.bin、

####################################
刷机做假dns 欺骗即可,刷机有风险,操作需谨慎
###################################
目前已经激活console ,开启opensshserver, 上图