如何从 android.car.cluster 读取数据

逆向工程 安卓 联网 安全 未知数据
2021-06-17 19:15:02

在对 Android 汽车信息娱乐系统的开放端口执行漏洞扫描时，我发现该端口5151是开放的。netcat在开放端口上执行 a操作，会显示连续的不可读数据流。

kali:~$ nc 192.168.x.x 5151       //IP of infotainment system
7ò”°R YJøOæݽ9^çÆC€E†éúaI™íÐåY—
...
...

这是包含从端口读取的数据的文件的链接：android-port-5151

由于我拥有Android系统的root访问权限，我可以发现这些数据与android.car.cluster.

console:/ # netstat -ltpu                                                  
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program Name
tcp6       0      0 :::pcrd                 :::*                    LISTEN      4473/android.car.cluster

现在我的问题是，是否有办法读取推送到端口的数据5151。例如。一些客户端应用程序，我可以安装在我的 Kali 机器上以读取端口上的数据。我相信这些数据可能包括一些关于集群的关键信息，如速度读数、指标等。

使用的安卓版本：android-10.0.0_r20。

Kali Machine 和信息娱乐系统在同一个本地网络上。

1个回答

我猜这是某种方式的MPEG Streaming。

以下file是在文件的前 10k 字节中以各种字节偏移量运行的内容：

598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 or more streams
838 /dev/stdin: MPEG-4 LOAS
1232 /dev/stdin: MPEG-4 LOAS
1696 /dev/stdin: MPEG sequence, H.264 video, baseline @ L 31
3204 /dev/stdin: MPEG ADTS, AAC, v4 Main, 96 kHz, surround + LFE
3220 /dev/stdin: MPEG ADTS, layer II, v2, 144 kbps, 16 kHz, Monaural
3433 /dev/stdin: MPEG ADTS, layer II, v1, 44.1 kHz, JntStereo
4889 /dev/stdin: MPEG ADTS, AAC, v4 Main, 88.2 kHz, surround + LFE
5465 /dev/stdin: MPEG ADTS, layer III, v2,   8 kbps, 22.05 kHz, 2x Monaural
5700 /dev/stdin: MPEG ADTS, AAC, v4 SSR, 88.2 kHz, stereo
5722 /dev/stdin: MPEG ADTS, layer II, v1,  32 kbps, 48 kHz, 2x Monaural
6035 /dev/stdin: MPEG ADTS, AAC, v4 Main, 44.1 kHz, stereo+center+LFE
6207 /dev/stdin: MPEG ADTS, AAC, v2 Main, 64 kHz, surround
6543 /dev/stdin: MPEG ADTS, AAC, v2, 22.05 kHz, stereo+center+LFE
6790 /dev/stdin: MPEG ADTS, AAC, v4 SSR, stereo + center
8039 /dev/stdin: MPEG ADTS, layer II, v1, 48 kHz, 2x Monaural
8683 /dev/stdin: MPEG ADTS, layer III, v1, 112 kbps, 32 kHz, Stereo
9296 /dev/stdin: MPEG-4 LOAS

外壳脚本：

#!/bin/bash
FILE=$1
for I in {1..10000}
do
    RES=`tail -c "+$I" "$FILE" | file -`
    echo "$I $RES"
done

这是它找到的所有内容：

3 /dev/stdin: raw G3 (Group 3) FAX, byte-padded
7 /dev/stdin: SVR2 pure executable (USS/370)
10 /dev/stdin: DOS executable (COM, 0x8C-variant)
33 /dev/stdin: QDOS object '?z_???/??M?U?/?\????|?~Ru????U?/?}[??7?*?
aC<x??'?EI?Y'
45 /dev/stdin: DOS executable (COM)
75 /dev/stdin: PGP Secret Sub-key -
103 /dev/stdin: PGP Secret Key -
110 /dev/stdin: DOS executable (COM)
111 /dev/stdin: zlib compressed data
151 /dev/stdin: PGP symmetric key encrypted data -
242 /dev/stdin: DOS executable (COM)
253 /dev/stdin: PGP Secret Sub-key -
265 /dev/stdin: amd 29k coff noprebar executable
343 /dev/stdin: DOS executable (COM, 0x8C-variant)
384 /dev/stdin: DOS executable (COM, 0x8C-variant)
396 /dev/stdin: COM executable for DOS
490 /dev/stdin: PGP key public ring (v0) created Sat Jun 11 06:16:17 1977, 4742 days valid invalid (67) 1337 bits MPI=0xb28d1ec6effb04c5...
573 /dev/stdin: PRCS packaged project
596 /dev/stdin: zlib compressed data
598 /dev/stdin: MPEG-4 LOAS, 4 or more streams, 8 or more streams
621 /dev/stdin: COM executable for DOS
638 /dev/stdin: DOS executable (COM, 0x8C-variant)
682 /dev/stdin: DOS executable (COM)
718 /dev/stdin: PGP Secret Key -
723 /dev/stdin: SysEx File - PalmTree
725 /dev/stdin: PGP Secret Key -
734 /dev/stdin: COM executable for DOS
737 /dev/stdin: PGP Secret Key -
775 /dev/stdin: COM executable for DOS
788 /dev/stdin: DOS executable (COM)
823 /dev/stdin: COM executable for DOS
838 /dev/stdin: MPEG-4 LOAS
840 /dev/stdin: COM executable for DOS
929 /dev/stdin: PGP Secret Key -
940 /dev/stdin: PPMN archive data
946 /dev/stdin: DOS executable (COM)
954 /dev/stdin: DOS executable (COM)
969 /dev/stdin: lif file
973 /dev/stdin: DOS executable (COM)
982 /dev/stdin: Encore unsupported executable
1033 /dev/stdin: mc68k COFF object
1124 /dev/stdin: COM executable for DOS
1146 /dev/stdin: PGP Secret Sub-key -
1210 /dev/stdin: PGP Secret Key -
1232 /dev/stdin: MPEG-4 LOAS
1280 /dev/stdin: PARIX executable
1291 /dev/stdin: executable (RISC System/6000 V3.1) or obj module not stripped
1331 /dev/stdin: PGP Secret Key -
1358 /dev/stdin: COM executable for DOS
1386 /dev/stdin: QDOS object '??????8C???1??a?_?^???M|????!??8??қ?a?'
1428 /dev/stdin: COM executable for DOS
1446 /dev/stdin: zlib compressed data
1465 /dev/stdin: DOS executable (COM)
1484 /dev/stdin: COM executable for DOS
1534 /dev/stdin: SysEx File -
1630 /dev/stdin: Sky archive data
1639 /dev/stdin: TTComp archive, binary, 4K dictionary
1677 /dev/stdin: DOS executable (COM)
1686 /dev/stdin: Dyalog APL component file 32-bit level 2 journaled checksummed version 248.19
1695 /dev/stdin: JVT NAL sequence, H.264 video, baseline @ L 31
1696 /dev/stdin: MPEG sequence, H.264 video, baseline @ L 31
1697 /dev/stdin: raw G3 (Group 3) FAX, byte-padded
1704 /dev/stdin: MIPSEB MIPS-III ECOFF executable not stripped - version 0.1
1707 /dev/stdin: DOS executable (COM)
1711 /dev/stdin: zlib compressed data
1726 /dev/stdin: raw G3 (Group 3) FAX, byte-padded
1729 /dev/stdin: COM executable for DOS
1833 /dev/stdin: DOS executable (COM, 0x8C-variant)
1899 /dev/stdin: MIPSEB-LE MIPS-III ECOFF executable - version 107.107
2017 /dev/stdin: MS-DOS executable
2118 /dev/stdin: DOS executable (COM)
2378 /dev/stdin: Minix filesystem, V1, 30 char names (big endian), 10256 zones
2414 /dev/stdin: Minix filesystem, V1, 30 char names, 4681 zones
2478 /dev/stdin: PGP Secret Key -
2943 /dev/stdin: DOS executable (COM)
2958 /dev/stdin: DOS executable (COM)
3115 /dev/stdin: DOS executable (COM)
3194 /dev/stdin: TeX font metric data (v????)
3204 /dev/stdin: MPEG ADTS, AAC, v4 Main, 96 kHz, surround + LFE
3205 /dev/stdin: SysEx File - OctavePlateau
3220 /dev/stdin: MPEG ADTS, layer II, v2, 144 kbps, 16 kHz, Monaural
3231 /dev/stdin: TeX font metric data (??>?3    f
                                                 A????P)
3289 /dev/stdin: PGP Secret Sub-key -
3355 /dev/stdin: DOS executable (COM, 0x8C-variant)
3367 /dev/stdin: PGP Secret Key -
3400 /dev/stdin: DOS executable (COM, 0x8C-variant)
3406 /dev/stdin: SysEx File -
3425 /dev/stdin: DOS executable (COM, 0x8C-variant)
3430 /dev/stdin: DOS executable (COM, 0x8C-variant)
3433 /dev/stdin: MPEG ADTS, layer II, v1, 44.1 kHz, JntStereo
3468 /dev/stdin: VAX COFF executable
3469 /dev/stdin: Tower32/600/400 68020 object
3569 /dev/stdin: SysEx File - Moog
3577 /dev/stdin: COM executable for DOS
3579 /dev/stdin: SysEx File - Sequential
3687 /dev/stdin: COM executable for DOS
3698 /dev/stdin: DOS executable (COM, 0x8C-variant)
3703 /dev/stdin: SysEx File - Sequential
3769 /dev/stdin: Atari 68xxx CPX file (version ec7f)
3814 /dev/stdin: DOS executable (COM)
3838 /dev/stdin: COM executable for DOS
3849 /dev/stdin: TTComp archive, binary, 4K dictionary
3855 /dev/stdin: PGP Secret Key -
3914 /dev/stdin: PGP Secret Sub-key -
3926 /dev/stdin: SysEx File - IDP
3970 /dev/stdin: COM executable for DOS
3995 /dev/stdin: PDP-11 UNIX/RT ldp
4010 /dev/stdin: 370 sysV pure executable
4142 /dev/stdin: SysEx File - Sequential
4143 /dev/stdin: Tower/XP rel 2 object not stripped
4197 /dev/stdin: MS Windows COFF Motorola 68000 object file
4201 /dev/stdin: COM executable for DOS
4216 /dev/stdin: DOS executable (COM, 0x8C-variant)
4218 /dev/stdin: PGP Secret Key -
4246 /dev/stdin: PDP-11 overlaid pure executable not stripped
4263 /dev/stdin: PGP Secret Sub-key -
4287 /dev/stdin: SysEx File - ADA
4294 /dev/stdin: DOS executable (COM, 0x8C-variant)
4370 /dev/stdin: PGP Secret Key -
4409 /dev/stdin: DOS executable (COM)
4410 /dev/stdin: DOS executable (COM)
4418 /dev/stdin: 0421 Alliant compact executable common library
4450 /dev/stdin: PGP Secret Key -
4482 /dev/stdin: COM executable for DOS
4511 /dev/stdin: COM executable for DOS
4572 /dev/stdin: Solitaire Image Recorder format
4578 /dev/stdin: DOS executable (COM)
4589 /dev/stdin: COM executable for DOS
4606 /dev/stdin: SysEx File - Kurzweil/Future Retro, Channel 59
4630 /dev/stdin: PGP Secret Key -
4696 /dev/stdin: DOS executable (COM, 0x8C-variant)
4700 /dev/stdin: Dyalog APL version 1.5
4702 /dev/stdin: ctab data
4780 /dev/stdin: BS image, Version 33642, Quantization 35004, (Decompresses to 36657 words)
4889 /dev/stdin: MPEG ADTS, AAC, v4 Main, 88.2 kHz, surround + LFE
4934 /dev/stdin: SysEx File - Fender
4954 /dev/stdin: DOS executable (COM)
5064 /dev/stdin: SysEx File - Gulbransen
5220 /dev/stdin: DOS executable (COM, 0x8C-variant)
5254 /dev/stdin: SVr2 curses screen image, little-endian
5267 /dev/stdin: PGP Secret Key -
5281 /dev/stdin: DOS executable (COM, 0x8C-variant)
5300 /dev/stdin: DOS executable (COM, 0x8C-variant)
5301 /dev/stdin: DOS executable (COM, 0x8C-variant)
5333 /dev/stdin: COM executable for DOS
5397 /dev/stdin: hp200 (68010) BSD
5465 /dev/stdin: MPEG ADTS, layer III, v2,   8 kbps, 22.05 kHz, 2x Monaural
5505 /dev/stdin: COM executable for DOS
5510 /dev/stdin: MySQL table definition file Version 31, MySQL version -1402753788
5608 /dev/stdin: byte-swapped Berkeley vfont data
5638 /dev/stdin: DOS executable (COM, 0x8C-variant)
5656 /dev/stdin: DOS executable (COM)
5682 /dev/stdin: DOS executable (COM)
5695 /dev/stdin: SysEx File -
5700 /dev/stdin: MPEG ADTS, AAC, v4 SSR, 88.2 kHz, stereo
5712 /dev/stdin: DOS executable (COM, 0x8C-variant)
5722 /dev/stdin: MPEG ADTS, layer II, v1,  32 kbps, 48 kHz, 2x Monaural
5728 /dev/stdin: SysEx File - Kawai
5742 /dev/stdin: squeezed data, original name G??`g(??1`ﮉ:E??ejc?
5787 /dev/stdin: SysEx File -
5798 /dev/stdin: PARIX executable
5812 /dev/stdin: floppy image data (IBM SaveDskF, old)
5830 /dev/stdin: executable (RISC System/6000 V3.1) or obj module
5874 /dev/stdin: PGP Secret Sub-key -
5880 /dev/stdin: DOS executable (COM)
5882 /dev/stdin: SVR2 pure executable (Amdahl-UTS) not stripped - version 280614372
5913 /dev/stdin: PGP Secret Sub-key -
5942 /dev/stdin: COM executable for DOS
5982 /dev/stdin: COM executable for MS-DOS
5989 /dev/stdin: COM executable for MS-DOS
5994 /dev/stdin: COM executable for MS-DOS
5999 /dev/stdin: COM executable for DOS
6000 /dev/stdin: MIPSEB-LE ECOFF executable - version 150.146
6002 /dev/stdin: COM executable for DOS
6005 /dev/stdin: COM executable for DOS
6007 /dev/stdin: COM executable for DOS
6008 /dev/stdin: COM executable for DOS
6010 /dev/stdin: COM executable for DOS
6021 /dev/stdin: DOS executable (COM, 0x8C-variant)
6035 /dev/stdin: MPEG ADTS, AAC, v4 Main, 44.1 kHz, stereo+center+LFE
6112 /dev/stdin: PGP Secret Key -
6207 /dev/stdin: MPEG ADTS, AAC, v2 Main, 64 kHz, surround
6214 /dev/stdin: DOS executable (COM, 0x8C-variant)
6230 /dev/stdin: DOS executable (COM, 0x8C-variant)
6265 /dev/stdin: COM executable for DOS
6321 /dev/stdin: MS Windows COFF PA-RISC object file
6346 /dev/stdin: DOS executable (COM)
6347 /dev/stdin: DOS executable (COM)
6380 /dev/stdin: COM executable for DOS
6408 /dev/stdin: PGP symmetric key encrypted data - Blowfish (128 bit key, 16 rounds)
6441 /dev/stdin: SysEx File - Clavia
6470 /dev/stdin: PGP Secret Sub-key -
6543 /dev/stdin: MPEG ADTS, AAC, v2, 22.05 kHz, stereo+center+LFE
6564 /dev/stdin: DOS executable (COM)
6653 /dev/stdin: DOS executable (COM, 0x8C-variant)
6684 /dev/stdin: Tower32/800 68010 compatible object object not stripped
6724 /dev/stdin: SysEx File - Baldwin
6731 /dev/stdin: DOS executable (COM)
6790 /dev/stdin: MPEG ADTS, AAC, v4 SSR, stereo + center
6795 /dev/stdin: DOS executable (COM, 0x8C-variant)
6797 /dev/stdin: DOS executable (COM, 0x8C-variant)
6799 /dev/stdin: DOS executable (COM, 0x8C-variant)
6852 /dev/stdin: PGP Secret Sub-key -
6941 /dev/stdin: OS9/68K module: re-entrant ghost system-state
6980 /dev/stdin: DOS executable (COM)
6985 /dev/stdin: DOS executable (COM, 0x8C-variant)
7018 /dev/stdin: PGP Secret Sub-key -
7028 /dev/stdin: VISX image file
7044 /dev/stdin: DOS executable (COM)
7067 /dev/stdin: DOS executable (COM)
7192 /dev/stdin: DOS executable (COM, 0x8C-variant)
7221 /dev/stdin: PARIX object
7354 /dev/stdin: PGP Secret Sub-key -
7373 /dev/stdin: PGP Secret Sub-key -
7538 /dev/stdin: DOS executable (COM)
7539 /dev/stdin: DOS executable (COM)
7659 /dev/stdin: SYMMETRY i386 .o
7735 /dev/stdin: COM executable for DOS
7935 /dev/stdin: zlib compressed data
8011 /dev/stdin: Atari MSA archive data, 63152 sectors per track, starting track: 46999, ending track: 5759
8018 /dev/stdin: PGP Secret Sub-key -
8033 /dev/stdin: AIX core file fulldump
8039 /dev/stdin: MPEG ADTS, layer II, v1, 48 kHz, 2x Monaural
8050 /dev/stdin: PGP Secret Sub-key -
8077 /dev/stdin: COM executable for DOS
8098 /dev/stdin: zlib compressed data
8110 /dev/stdin: PGP Secret Sub-key -
8338 /dev/stdin: COM executable for DOS
8347 /dev/stdin: PGP Secret Key -
8352 /dev/stdin: PGP Secret Sub-key -
8382 /dev/stdin: PGP Secret Key -
8429 /dev/stdin: PGP Secret Sub-key -
8442 /dev/stdin: COM executable for DOS
8550 /dev/stdin: PGP Secret Sub-key -
8561 /dev/stdin: DOS executable (COM)
8683 /dev/stdin: MPEG ADTS, layer III, v1, 112 kbps, 32 kHz, Stereo
8727 /dev/stdin: SysEx File - Clarity
8729 /dev/stdin: DOS executable (COM, 0x8C-variant)
8734 /dev/stdin: Intel ia64 COFF object file, not stripped, 23296 sections, symbol offset=0x911b1400, 1284708587 symbols, optional header size 57568
8738 /dev/stdin: SysEx File -
8742 /dev/stdin: raw G3 (Group 3) FAX
8746 /dev/stdin: DOS executable (COM)
8754 /dev/stdin: PDP-11 UNIX/RT ldp
8755 /dev/stdin: MIPSEB Ucode
8764 /dev/stdin: MIPSEL-BE Ucode
8766 /dev/stdin: Intel ia64 COFF object file, stripped, 57560 sections, symbol offset=0x813b142f, -1778167612 symbols, optional header size 32856
8767 /dev/stdin: GeoSwath RDF
8769 /dev/stdin: Targa image data - Color 22678 x 14464 x 1 +50305 +848 - 4-bit alpha - top - right - reserved "B??3@|?q`"
8780 /dev/stdin: little endian ispell hash file (?), and 312 string characters
8831 /dev/stdin: QDOS object 'y)??r????D??-E#<??M?xs??G?'
8868 /dev/stdin: PGP Secret Sub-key -
8895 /dev/stdin: SysEx File -
8900 /dev/stdin: COM executable for DOS
8916 /dev/stdin: PGP Secret Sub-key -
8918 /dev/stdin: DOS executable (COM, 0x8C-variant)
8931 /dev/stdin: PGP Secret Sub-key -
8932 /dev/stdin: iAPX 286 executable large model (COFF) not stripped
8988 /dev/stdin: basic-16 executable not stripped
8999 /dev/stdin: PGP symmetric key encrypted data -
9109 /dev/stdin: DOS executable (COM, 0x8C-variant)
9186 /dev/stdin: PGP Secret Key -
9215 /dev/stdin: DOS executable (COM, 0x8C-variant)
9245 /dev/stdin: SysEx File - Eventide
9248 /dev/stdin: lif file
9275 /dev/stdin: PGP Secret Sub-key -
9292 /dev/stdin: PGP Secret Sub-key -
9296 /dev/stdin: MPEG-4 LOAS
9356 /dev/stdin: DOS executable (COM)
9366 /dev/stdin: DOS executable (COM, 0x8C-variant)
9373 /dev/stdin: SysEx File -
9480 /dev/stdin: DOS executable (COM, 0x8C-variant)
9496 /dev/stdin: DOS executable (COM, 0x8C-variant)
9547 /dev/stdin: DOS executable (COM)
9552 /dev/stdin: DOS executable (COM, 0x8C-variant)
9555 /dev/stdin: PGP Secret Key -
9589 /dev/stdin: PGP Secret Key -
9607 /dev/stdin: COM executable for DOS
9696 /dev/stdin: PGP Secret Key -
9742 /dev/stdin: ID tags data version 3710
9763 /dev/stdin: Dyalog APL component file 64-bit level 1 journaled checksummed version 204.112
9787 /dev/stdin: Targa image data 24628 x 8654 x 15 +49152 +15116 - 3-bit alpha - top - interleave "??ƀ6?????).??
                                                                                                                 ,?7?=??}&ɍ??O?
                                                                                                                               ?&??''''?)@?P?A??'??^??l??(??gxm??K?j?&x?M??$?@Lt ??D"
其它你可能感兴趣的问题
上一篇如何在可执行文件中找到加密的字符串？ 下一篇如何停止 Hex Rays 优化？