Adding Support for Verizon CR1000A

a_guy · 2023-02-21T15:35:02.754Z

Config is produced/consumed by web server running cusom Verizon code, right? Why do you think uboot capabilities are relevant?

soxrok2212 · 2023-02-21T16:14:37.481Z

They are very relevant but that’s for a completely different device

tesf23 · 2023-02-21T16:55:35.554Z

just assumption it might use the same app for doing encryption since verizon app is also a modified version of openwrt, I could be wrong.

a_guy · 2023-02-21T19:18:40.719Z

If I understand how it all works this it uboot environment, it's own mini-os with own commands. Completely separated from the root OS which just happens to be OpenWrt.

spol-eff · 2023-03-05T19:23:05.797Z

Well they're using the same image for all their devices, so if it's in the TPM it must be baked in and static. The initrd image doesn't seem to be encrypted (I think?), but it seems to be compressed with unknown algorithm.
Its filename from the upgrade FDT bin suggest it's another FDT image ("openwrt-ipq-ipq807x_64-qcom-ipq807x-hkxx-fit-uImage.itb.padded"). If we could take a peek inside maybe we'd find the LUKS unlock key or script.

tesf23 · 2023-03-09T02:51:25.101Z

Spectrum SAX1V1K (Askey RT5010W) OpenWrt Support For Developers

I published my security research for this device here; MeisterLone/Askey-RT5010W-D187-REV6: Reverse Engineering the Askey RT5010W (github.com) Here is a teardown video of the device as well as an example of how to glitch it to get a shell in U-Boot. [ - YouTube]

This device using same CPU as CR1000A, looks like there is a way to drop a uboot shell.

GitHub

GitHub - MeisterLone/Askey-RT5010W-D187-REV6: Reverse Engineering the Askey...

Reverse Engineering the Askey RT5010W. Contribute to MeisterLone/Askey-RT5010W-D187-REV6 development by creating an account on GitHub.

tesf23 · 2023-03-09T03:09:15.219Z

spol-eff:

is wired to the CPU through a some kind of IC on underneath the header, also

Looks like you need interrupt the boot process in a perfect timing.
"The CLK signal that runs between the EMMC and the CPU must be interrupted at the perfect time. (3 second window) This can be done by connecting VDDF (3v) to the CLK pin as soon as the "Hit space key to stop autoboot" message appears in the Serial Console."

GitHub

GitHub - MeisterLone/Askey-RT5010W-D187-REV6: Reverse Engineering the Askey...

Reverse Engineering the Askey RT5010W. Contribute to MeisterLone/Askey-RT5010W-D187-REV6 development by creating an account on GitHub.

meisterlone · 2023-03-09T03:42:05.627Z

I dont think this trick is going to work here, because CR1000A disables console, so even if bootipq is interrupted, there is no way to interact with uboot unfortunately. The route with most guaranteed success here would be to get ISP set up so you can read and write to the EMMC as you please. @spol-eff already posted the pin locations so half the work is done.

Once EMMC is dumped, you need to confirm the router has the "bootm" command enabled by decompiling the uboot binary. If bootm is available, its game on.

I'd do it but this router is god damned expensive

meisterlone · 2023-03-09T03:56:36.299Z

Something like this

image_67529473 (1)1920×1440 385 KB

soxrok2212 · 2023-03-09T04:04:35.169Z

It depends how it's disabled. I've seen vendors disable it via u-boot env. Getting into the bootloader in that case could be used to enable the console. Others might have it as a bootarg, etc.

It really depends on the implementation.

soxrok2212 · 2023-03-09T04:05:46.298Z

Please be aware that this is also highly implementation specific. U-boot can be patched to simply reset if emmc/storage can't be accessed. It doesn't have to drop into a shell. It's highly vendor dependent. Timing can also play a pretty big factor here.

a_guy · 2023-03-09T04:18:13.366Z

It could be had for 150 open box on ebay. I could chip in if needed. I don't have enough understanding here... but cr1000a uses encrypted partitions it seems, so dumping emmc would not be useful?

spol-eff · 2023-03-09T17:11:02.818Z

Well the firmware upgrade script disables the console in this way, but I'm not sure it applies to boot as well:
if test "x$verbose" = "x"; then

meisterlone · 2023-03-09T17:17:07.907Z

Doesnt seem encrypted if it can be read witha logic analyzer

spol-eff · 2023-03-09T17:17:14.492Z

I have the u-boot binary reconstructed from a logic analyzer dump, but it's mangled in a way I cannot understand:

ehgtdvb_aesl_tlcekalct_attoobo_indmtlaor_m_n_ntftfxpmmr_ak_ftasaeadesbadiim_edw_e_la_ces)q0xehiiofsiqiq0xehhlp87_daalcrnsiq0xem_ofgr_igp8ÀÆb"
Þîg ©#,ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ7_dah_ntbadehiip_d_iu_oifpcnn_edosscbo_nbes_eiywt_eobov_dr_s_eiypitpr_fe_`tto_noei3tdfutev_cceivlrnegtpriincuteieviprn_xoti_p_ailo_edgtetisi_t_aidc_eedc_rnfrdtdc_edcmadftfn_radsboeshistcokatbo_omndc_ntiqmi_atbsd_dF6-eaUHV=<'R}>ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿctbadstpdvc_eoedvc_rb_hle_e_aetpadte_e_caspadte_e_rvdvgtuls_rviqpi_as_tiq0xem_lo_xbfep87_dar_opeeiq0xem_eu_igrsucs(( AAABBB boag=osl=iÙôÞÉê¤¶÷ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿtMM,evrp12181.ems=5.5.5. 02468ACEaodbm02468ace	Õ68@óûã/DÞË{2Â=LúN.fÙ²[I%ødh¤ÌepPíÚWØ¼ä³,?¯kAgêòÎ´s¬"ùèunñq)·eVKÒ ÛþÍôÝ3a1Y_Q©µ
åÉïàM*°ë<Sa+~w&ic!}PGKÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿôªÍÊôe[qÇ|°mÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0+ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0`He ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¼ÑÝ.ù()b@·ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0`He Z 6|{kÅ+×v}YðÔ¯¤Àý&?Ì¥ñØÇÃâ'un ;³ãÑíü[Ë9LÏïûMù<¨£õ¶!ÿÒì{&^¤ÛytS±¶þ[Íÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ§=]sÜ*î^Û2
\ÓbyÈmÕ©Vêzx.¦ÆÝ½>f5¹ÁøÙéUß¡
æhT»ëRO:%  tr drs sntaind-0%8
ERR s-so drs sntaind-0%8
0HOls_ye	0%
ls_ne:	xxfahci_eet	xxfahboksz:0%
ls_est:	xxpriintbeofe	xxls_ye	00%
atto al fst0%
Atiueo-s -6 1s%6 1sieSatPriinifrainntaalbe3:%1s0%8 #6l #6l
se:ra ls yefie
se:ra ls ne aldmm edfahci eetfie
se:ra ls lc  iefie
se:ra ls est alds%
se:Fie ofthtebadmci.mme oif  p yefie
se:Gtscno-vrinfie
se a tbefud e:% e:%
MH%:;addldFM/N #O
+Yymÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ2xlx%)mmnopitSE LS nomtotmrgn_aegn_nc_ogn_nc_igtfe_ztmrla_aro xr rsntspotda' otkre:%
Jmigt(AC6 enlvamntrupn oARH4TTvamntra' otTT dfk u o rcn)mcisn  ahd0%xfo niomn

trigkre .%
D rainfie!hnig.D n TG upr o opldi  ag #8x-%0L"j@_`lmVZPWtÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿd
/eoy#ANN:fxpmmr ald
RstigCU..eo c:[%8x]  r:[%8x]p:%8x p:%8x p:%8x1:%8x 9:%8x 8:%8x7:%8x 6:%8x 5:%8x 4:%8x3:%8x 2:%8x 1:%8x 0:%8xlg:%%%% Rs% FQ s oe%%
udfndisrcinotaeitrutrfthaotaaaoto sdatitrutrqetSR2I_6IQ2V_6U42K_6U62K_6U82K_6U1_6U1_
X[	8(<@x|yyeJÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ6U1_6U1_6U1_6U1_6UE_2FQ3R_2SC3K_2U53K_2AT3K_2U93Y_2UD3K23K33K43Y_2rstig..ANN:Cce o nbe
Dcytn..al
&5aO6h34Dn.otsaerof  po_adaalbenn%=addnn%=p00fboagb.t=otsro=t:b_otsroftpOIÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿg}$fboag}rowitc-rtco:Ubo tc scrutd
cni_aeMna eiete ofgslce!ofgntaalbl
bom0%#saldt e ofgnm
pitn otrsBoigfols
Uignn eie0bdofe fhoeevmdd ad=ad &stn tprsmdat=ad:xlx0%l(s,{sprs &uipr s&  b ed0% enl& nn eie% &stn tisnn%=add& eevmdat tprsnn%:xlx0%l(s,{sprs &nQ-\EI
_3F"ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿuipr s&  b ed0% enl& s rb &fra xx0% xx& UigMCdvc
0HO_m ed0% xx0%nupre OTfahtp
Vrfig. m_eashsi h nai enltisTi steuecytdkre
Uignn eie%
nn eie% &stntisnn%=add&  eevmdat tprsnn%:xlx0%l(s,{sprs &uipr s& krefpoe&enliaeatetctoald
badqaauC7z>~$8Tpgÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿmcmo/m_otc.U:fiuea s%/s)
BGb ed0% b_ots&m ed0% x

and second dump from the same addres:

ehgtdvb_aesl_tlcekalct_attoobo_indmtlaor_m_n_ntftfxpmmr_ak_ftasaeadesbadiim_edw_e_la_cesiq0xehiiofsiqiq0xehhlp87_daalcrnsiq0xem_ofgr_igp8ÀÆb"
Þîg ©#,ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ7_dah_ntbadehiip_d_iu_oifpcnn_edobqawtetatcahupdtodmqamnmldtsscbo_nbes_eiywt_eobov_dr_s_eiypitpr_fe_atto_noeistdfutevv_cceivlrnegtpriincuteieviprn_xoti_p_ailo_edgtetisi_t_aidc_eedc_rnfrdtdc_edcmadftfn_radsboeshistcokatbo_omndc_ntiqmi_atbsd_ctbadstpdvc_eoedvc_rb_hle_e_aetpadte_e_caspadte_e_rvdvgtuls_rviqpi_as_tiq0xem_lo_xbfep87_dar_opeeiq0xem_eu_igrsucs(( AAABBB boag=osl=iÙôÞÉê¤¶÷ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿtMM,1208bocdboiqbodly2burt=120iad=9.6.01evrp12181.ems=5.5.5. 02468ACEaodbm02468ace	Õ68ÿóûã/DÞË{2Â=LúN.fÙ²[I%ødh¤ÌepPíÚWØ¼ä³,?¯kAgêòÎ´s¬"ùèunñq)·eVKÒ ÛþÍôÝ3a1Y_Qïµ
åÉïàM*°ë<Sa+~w&ic!}PGKÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ00+ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ00`He ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ¼ÑÝ.ù()b@·<ö©Ðÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ00`He Z 6|{kÅ+×v}YðÔ¯¤Àý&?Ì¥ñØÇÃâ'un§=]sÜ*î^Û2
\ÓbyÈmÕ©Vêzx.¦ÆÝ½>f5¹ÁøÙéUß¡
æhT»ëRO:%  tr drs sntaind-0%8
ERR s-so drs sntaind-0%8
0HOls_ye	0%
ls_ne:	xxfahci_eet	xxfahboksz:0%
ls_est:	xxpriintbeofe	xxls_ye	0%
ls_ne:	xxfahci_eet	xxfahboksz:4Ët¾ìe`"ªVËÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ0%
atto al fst0%
Atiueo-s -6 1s%6 1sieSatPriinifrainntaalbe3:%1s0%8 #6l #6l
se:ra ls yefie
se:ra ls ne aldmm edfahci eetfie
se:ra ls lc  iefie
se:ra ls est alds%
se:Fie ofthtebadmci.mme oif  p yefie
se:Gtscno-vrinf@%:;addldFM/N #O
+Yymÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿsxlx%)mmnopitSE LS nomtotmrgn_aegn_nc_ogn_nc_igtfe_ztmrla_aro xr rsntspotda' otkre:%
Jmigt(AC6 enlvamntrupn oARH4TTvamntra' otTT dfk u o rcn)mcisn  ahd0%xfo niomn

trigkre .%
D rainfie!hnig.D n TG upr o opldi  agn
BdLnxAMzmg ai!enliae@%0l  #8x-%0L"jH_`lmVZPWtÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿl
#eoy# ANN:fxpmmr ald
RstigCU..eo c:[%8x]  r:[%8x]p:%8x p:%8x p:%8x1:%8x 9:%8x 8:%8x7:%8x 6:%8x 5:%8x 4:%8x3:%8x 2:%8x 1:%8x 0:%8xlg:%%%% Rs% FQ s oe%%
UdfndisrcinotaeitrutatitrutrqetSR2I_6IQ2V_6U42K_6U62K_6U82K_6U1_6U1_
X[	8(<@x|yyeJÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ6U1_6U1_6U1_6U1_6UE_2FQ3R_2SC3K_2U53K_2AT3K_2U93Y_2UD3K23K33K43Y_2rstig..ANN:Cce o nbe
Dcytn..al
&5aO6h34Dn.otsaerof po_adaalbenn%=addnn%=p00fboagb.t=otsro=t:b_otsroftp=qahsrofnm=ots1rofnm=otsn0nn0rofnm=ots1gtboiq nupre otfahtp
stn otrs$boaU$5aX(yK!I>OIÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿg}$fboag}rowitc-rtco:Ubo tc scrutd
cni_ae
na eiete ofgslce!ofgntaalbl
bom0%#saldt e ofgnm
pitn otrsBoigfo ls
Uig.n eie0bdofe fhoeevmdd auipr s& b ed0% enl& s rb &fra xx0% xx& UigMCdvc
0HO_m ed0% xx0%nupre OTfahtp
Vrfig. m_eashsi h nai enltisTi steuecytdkre
Uignn eie%
nn eie% &stn tisnn%=add& eevmdat tprsnn%:xlx0%l(s,{sprs &uipr s& krem ed0% xX0%nai mg.fpoe&enliaeatetcto ald
badqaauC7z>~$8Tpgÿÿ

Most of the packets don't pass CRC checks, but seeing how the 2 dumps match pretty well I'm suspecting this is not simply noise.

I've probably screwed something up in my reconstructing program, but I'm not sure what.

spol-eff · 2023-03-09T17:25:16.631Z

I tried ISP, but I couldn't stop CPU from booting because the router doesn't have a CPU crystal you can short, it's clocked by the PMU, and the same PMU runs eMMC DC-DC converter.
I also tried to power the flash chip externally, but that didn't work as something is holding it in reset.

meisterlone · 2023-03-09T17:51:28.585Z

You dont need to stop the cpu from booting. You just need to electrically isolate the clk signal on the EMMC from the cpu, which by the looks of it, you should be able to do here. The cpu will try init the emmc, a couple of times and fail and then go idle.

spol-eff · 2023-03-09T17:53:02.593Z

I guess cutting the trace is an option, I just wasn't ready to go that far.

meisterlone · 2023-03-09T17:56:46.065Z

Sandpaper and steady hands lol. I just dont see any other way with this router. Unfortunately. Do you have a microscope?

spol-eff · 2023-03-09T18:05:13.452Z

Yes, but I'm done with this router for now, I'm focusing on other projects. Also I had destroyed my eMMC reader by trying to "fix" it because it wasn't reading the chip before I found the RST via and realized it's being held in reset.