Reverse-engineering an encrypted IoT protocol • Hacker News Board

Re: Reverse-engineering an encrypted IoT protocol

#41

Post by poyu » Thu, Feb 15, 2024, 9:23 AM UTC

kwar13 wrote: post #40

Any kind soul want to teach me how echo -e 'admin\nadmin\nspi rd 0 2097152\n' | nc 192.168.18.17 23 | tee ~/download/hk1000.spi2.img downloads the firmware?

I think `spi rd 0 2097152` is probably something in the telnet prompt that reads values from an SPI flash, the two number seems to be starting and ending range.

Re: Reverse-engineering an encrypted IoT protocol

#42

Post by npteljes » Thu, Feb 15, 2024, 9:28 AM UTC

kwar13 wrote: post #40

Any kind soul want to teach me how echo -e 'admin\nadmin\nspi rd 0 2097152\n' | nc 192.168.18.17 23 | tee ~/download/hk1000.spi2.img downloads the firmware?

The device appears to support the Serial Peripheral Interface protocol, which Scott discovered (and others before him too: https://mlug-au.org/lib/exe/fetch.php?media=20210726-goodwe....). He did this by poking around with nmap for open ports, discovering that the telnet port is open, and then trying to talk to the device with telnet.

"spi rd" are commands that can be used to dump some data from the device, as you can read in my linked presentation.

And the one-liner Scott has in the blog just automates the following process: 1. logging in with admin/admin on the device with telnet 2. issuing the telnet command "spi rd 0 2097152" 3. capturing its output into a file, while also viewing it on the standard output at the same time

Re: Reverse-engineering an encrypted IoT protocol

#43

Post by wwader » Thu, Feb 15, 2024, 9:28 AM UTC

turtledragonfly wrote: post #13

denysvitali wrote: post #4

Next time you find yourself reverse engineering a weird protocol - use ImHex. You can literally define patterns (in a C++ / Rust -like language) so that your binary file gets highlighted and processed. I can't recommend it enough - it's perfect for the job and it's free and Open Source. https://imhex.werwolv.net/

Just piggybacking here to mention a variety of other "interpret structured binary data" tools. Apparently I collect links to these (: * fq - like jq for binary data: https://github.com/wader/fq * Kaitai Struct - https://kaitai.io/ ** visualizer, for the above: https://github.com/kaitai-io/kaitai_struct_visualizer/ * HexFiend - a hex editor, but with "binary templates" feature : https://github.com/HexFiend/HexFiend **…

Hey! fq author here. I have a bunch of related tools in the readme https://github.com/wader/fq?tab=readme-ov-file#tools two suggestions: gnu poke and wireshark (can decode lots of more things then just network protocols)

Re: Reverse-engineering an encrypted IoT protocol

#44

Post by kwar13 » Fri, Feb 16, 2024, 7:53 AM UTC

npteljes wrote: post #42

kwar13 wrote: post #40

Any kind soul want to teach me how echo -e 'admin\nadmin\nspi rd 0 2097152\n' | nc 192.168.18.17 23 | tee ~/download/hk1000.spi2.img downloads the firmware?

The device appears to support the Serial Peripheral Interface protocol, which Scott discovered (and others before him too: https://mlug-au.org/lib/exe/fetch.php?media=20210726-goodwe.... ). He did this by poking around with nmap for open ports, discovering that the telnet port is open, and then trying to talk to the device with telnet. "spi rd" are commands that can be used to dump some data from the device, as you c…

thank you!