Building a Mesh Network in Rural Somaliland

Re:Building a Mesh Network in Rural Somaliland by cinquemb on Thursday January 02, 2014 @10:31PM (#7003981)

Thanks for the response. I have to be honest and say I'm probably not going to dig through a bunch of the makefiles listed in the third repo in feeds.conf (at least right now).

But at least from you even mentioning deterministic builds, must mean that the thought has crossed your minds? I know the Tor project has to deal with concerns like that, and I figure firmware providers for mesh-networks will increasingly have to deal with the same.

These sorts of things have piqued my interest lately and right now I'm in the middle of digging through the linksys e1000 firmware[0][1] (from yesterdays hubbub, too bad the script didn't work for me :/) and my cousin telling me about open ports (10080,1780,51000) on 192.168.1.1 on his network with some interesting traffic (his words). So, if I hear any stories relating to traffic on ports from postings online relating to this firmware, I'll probably take a look for fun (though there are probably many other people better at these things like yourself).

[0] http://support.linksys.com/en-us/support/routers/E1000 [1] http://i.imgur.com/jWebamh.png

[ Parent | on HN ]

Re:Building a Mesh Network in Rural Somaliland by voltagex_ on Friday January 03, 2014 @12:11AM (#7004273)

From your screenshot, I don't think that squashfs detection is right, you may have to play around with dd and unsquashfs.

Also try a newer version of binwalk [-1] and/or the 2.0 branch [0]

-1: https://github.com/devttys0/binwalk/

0: https://github.com/devttys0/binwalk/tree/binwalk-2.0

[ Parent | on HN ]

Re:Building a Mesh Network in Rural Somaliland by hawkinsw on Friday January 03, 2014 @02:13PM (#7007402)

Here are some of the steps that I use to unsquash the binary Commotion images to make changes:

1. Find the PARTs

2. Extract them

3. unsquash: unsquashfs -d image/ squashfs.bin

4. Make the changes.

5. squash: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mksquashfs4 image/ squashfs-made.bin -nopad -noappend -root-owned -comp xz -Xpreset 9 -Xe -Xlc 0 -Xlp 2 -Xpb 2 -b 256k

6. pad: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/padjffs2 squashfs-made.bin 64

7. mkfwimage: ~/code/commotion-openwrt/commotion-openwrt/openwrt/staging_dir/host/bin/mkfwimage -B XM -k kernel.img -r squashfs-made.bin -v XM.ar7240.v6.0.0-OpenWrt-r36682 -o openwrt-ar71xx-generic-ubnt-nano-m-squashfs-factory-DR2-tn.bin

If you are modifying a sysugrade image: Extract 0-1048576 (bytes): that's the kernel Extract the rest: that's the squashfs

Put them back together with ( dd if=vmlinux bs=1048576 conv=sync; dd if=squashfs-made.bin ) > openwrt-ar71xx-generic-ubnt-bullet-m-squashfs-sysupgrade-DR2-custom.bin

These are just my notes. Feel free to contact me if you want more information.

[ Parent | on HN ]

Re:Building a Mesh Network in Rural Somaliland by cinquemb on Friday January 03, 2014 @12:36AM (#7004329)

I saw your comment yesterday, which made me want to take a stab at it. Thanks alot!

I used dd to get squashfs filesystem by itself[i], and unsquashfs [unsquashfs -v unsquashfs version 4.2 (2011/02/28)][i^2] but that gave that error, then I tried compiling with lzma,xz, lzo by their selfs and neither worked. But your right about the old version of binwalk, I was using v1.2.1.

[i] http://i.imgur.com/Vk35XL0.png

[i^2] http://i.imgur.com/HxTE0rR.png

[ Parent | on HN ]

Re:Building a Mesh Network in Rural Somaliland by voltagex_ on Friday January 03, 2014 @01:43AM (#7004462)

You're at the point where I normally get stuck. From the slides yesterday, see if you can find the version of squashfs that was used when the firmware was built.

[ Parent | on HN ]

Re:Building a Mesh Network in Rural Somaliland by cinquemb on Friday January 03, 2014 @02:25AM (#7004527)

That makes sense, cant access linksys website now to check (glad I got this binary in time :P) binwalk says "Squashfs filesystem, little endian, version 3.0" so I'm going to dl that and try again. Who knows, if I can get this to work, I can make a new wifi cracking script[0] that wont take hours with the vulns found so far by going through the backdoor, for security research purposes of course ;)

[0] https://github.com/cinquemb/WifiBruteCrack/blob/master/wifi_...

[ Parent | on HN ]

Re:Building a Mesh Network in Rural Somaliland by voltagex_ on Friday January 03, 2014 @02:33AM (#7004548)

You may also want to send a request for GPL'd sources to Linksys for this device.

[ Parent | on HN ]

Re:Building a Mesh Network in Rural Somaliland by voltagex_ on Friday January 03, 2014 @02:51AM (#7004577)

I have another way to extract this for you - can you please contact me?

[ Parent | on HN ]