Secrets of the Medtronic MyCareLink Patient Monitor

Re:Secrets of the Medtronic MyCareLink Patient Monitor by tomrod on Sunday December 04, 2016 @07:49PM (#13102642)

> Aha! So this mysteriously-named /usr/sbin/eis3920 program is responsible for the decryption. eis3920 is an ARM binary, but running strings on it came up with some items of interest:

    ...
    /sys/devices/platform/omap/omap_i2c.2/i2c-2/2-0057/eeprom
    %s%s%s%s%s
    /home/root
    .ecryptfs
    sig-cache.txt
    ecryptfs_fnek_sig=
    %s%s%s%s%s%s%s%s%s%s%s%s
    mount -t ecryptfs

I'm at a bit of a loss here. What does he mean by "running strings on it"?

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by adamryman on Sunday December 04, 2016 @07:53PM (#13102663)

Are you on linux? You might have it installed.

Try running:

  man strings

I get:

  strings - print the strings of printable characters in files.

https://linux.die.net/man/1/strings

Basically it will print out any strings of ascii charters in a file. Which in a binary usually represent string constants or "hard coded" strings that have not been obfuscated.

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by JshWright on Sunday December 04, 2016 @07:52PM (#13102660)

It's a program that spits out all the printable strings from a binary file.

https://en.wikipedia.org/wiki/Strings_(Unix)

EDIT: lol... we're all so helpful (4 replies all at '0 minutes ago' at the moment)

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by tomrod on Sunday December 04, 2016 @08:04PM (#13102706)

THIS! This is why I love hacker news. Much thanks for the pointer. I've never actually used (or, I believe, needed to directly use) strings before. Thanks so much.

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by _joel on Monday December 05, 2016 @05:53AM (#13104647)

Please be careful when running strings, if possible, don't, as it can be used as an attack surface. Just take a look at CVE-2014-8485 if you need clarification.

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by tomrod on Monday December 05, 2016 @01:42PM (#13108004)

Thank you for the heads up.

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by swatkat on Sunday December 04, 2016 @08:31PM (#13102805)

Sysinternals has a Windows equivalent[1]. Although most of the hex editors[2][3] have an in-built strings dumping functionality.

[1] https://technet.microsoft.com/en-us/sysinternals/strings.asp...

[2] https://www.safer-networking.org/products/filealyzer/

[3] http://www.catch22.net/software/hexedit

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by fencepost on Sunday December 04, 2016 @07:52PM (#13102658)

'strings' is a standard *nix command for reading a binary file and displaying only the chunks of data that appear to be ASCII character strings.

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by kens on Sunday December 04, 2016 @07:52PM (#13102657)

strings is a Unix program that prints out all the ASCII strings it finds in an arbitrary file. It is very handy for examining random programs.

https://linux.die.net/man/1/strings

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by tomrod on Sunday December 04, 2016 @08:06PM (#13102715)

Crazy, I've never heard of this before.

Could I use this on random Windows exe files if I'm running a linux box? EXE files are just compiled binary blogs, right?

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by kens on Monday December 05, 2016 @01:22AM (#13103718)

Yes, you can run strings on a Windows exe from Linux or a Mac. I just tried this and it gives everything from "!This program cannot be run in DOS mode." to DLL names to Windows function names. However, Windows text strings that get displayed are 16-bit so you need the "-e l" flag to see them; this flag works on Linux but not Mac.

TL;DR: running strings on an exe is trickier than I expected, but works.

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by jaclaz on Monday December 05, 2016 @10:41AM (#13106071)

JFYI there is a little (35 Kb) and little known free tool for Windows (by McAfee, I know, I know) that is very easy to use/convenient:

http://www.mcafee.com/it/downloads/free-tools/bintext.aspx

(a number of hex editors AFAIK want you to specify if ASCII or Unicode)

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by ajdlinux on Sunday December 04, 2016 @08:22PM (#13102769)

Yep - useful on any kind of binary. I've used strings on exes, pdfs, database files...

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by onlycommenting on Sunday December 04, 2016 @08:20PM (#13102765)

>compiled binary blogs

That, or view/edit them with a hex editor.

[ Parent | on HN ]

Re:Secrets of the Medtronic MyCareLink Patient Monitor by tomrod on Sunday December 04, 2016 @11:04PM (#13103294)

Blobs, not blogs. Darn autocorrect.

[ Parent | on HN ]