Adding Support for Verizon CR1000A

soxrok2212 · 2023-02-19T20:30:17.601Z

If there’s a LUKS key then FW is probably encrypted on eMMC. Might be better to find a command injection or something to get a shell then dd off the partitions.

a_guy · 2023-02-19T22:30:59.615Z

Where would it store the key? TPM? Separate partition? Can we identify TPM? That script on the top of firmware bin just writes everything as is (as far as I could tell). That probably means you are right.

soxrok2212 · 2023-02-20T05:28:30.105Z

Probably TPM or RPMB if I had to guess.

tesf23 · 2023-02-21T14:18:39.067Z

I saw someone posted a IPQ807X uboot menu, there is a AES 256 enc and dec, I feel like the CR1000A config might using same way.

IPQ807x# help
?       - alias for 'help'
aes_256 - AES 256 CBC/ECB encryption/decryption
aq_load_fw- LOAD aq-fw-binary
aq_phy_restart- Restart Aquantia phy
base    - print or set address offset
bdinfo  - print Board Info structure
bootipq - bootipq from flash device
bootm   - boot application image from memory

soxrok2212 · 2023-02-21T14:42:46.172Z

Where was this?

tesf23 · 2023-02-21T15:32:41.608Z

Spectrum SAX1V1K (Askey RT5010W) OpenWrt Support For Developers

Some options now: IPQ807x# help ? - alias for 'help' aes_256 - AES 256 CBC/ECB encryption/decryption aq_load_fw- LOAD aq-fw-binary aq_phy_restart- Restart Aquantia phy base - print or set address offset bdinfo - print Board Info structure bootipq - bootipq from flash device bootm - boot application image from memory bypass_verify- bypass_verify canary - test stack canary chpart - change active partition cmp - memory compare cp - memory copy crc32 - checksum calculation …

a_guy · 2023-02-21T15:35:02.754Z

Config is produced/consumed by web server running cusom Verizon code, right? Why do you think uboot capabilities are relevant?

soxrok2212 · 2023-02-21T16:14:37.481Z

They are very relevant but that’s for a completely different device

tesf23 · 2023-02-21T16:55:35.554Z

just assumption it might use the same app for doing encryption since verizon app is also a modified version of openwrt, I could be wrong.

a_guy · 2023-02-21T19:18:40.719Z

If I understand how it all works this it uboot environment, it's own mini-os with own commands. Completely separated from the root OS which just happens to be OpenWrt.

spol-eff · 2023-03-05T19:23:05.797Z

Well they're using the same image for all their devices, so if it's in the TPM it must be baked in and static. The initrd image doesn't seem to be encrypted (I think?), but it seems to be compressed with unknown algorithm.
Its filename from the upgrade FDT bin suggest it's another FDT image ("openwrt-ipq-ipq807x_64-qcom-ipq807x-hkxx-fit-uImage.itb.padded"). If we could take a peek inside maybe we'd find the LUKS unlock key or script.

tesf23 · 2023-03-09T02:51:25.101Z

Spectrum SAX1V1K (Askey RT5010W) OpenWrt Support For Developers

I published my security research for this device here; MeisterLone/Askey-RT5010W-D187-REV6: Reverse Engineering the Askey RT5010W (github.com) Here is a teardown video of the device as well as an example of how to glitch it to get a shell in U-Boot. [ - YouTube]

This device using same CPU as CR1000A, looks like there is a way to drop a uboot shell.

GitHub

GitHub - MeisterLone/Askey-RT5010W-D187-REV6: Reverse Engineering the Askey...

Reverse Engineering the Askey RT5010W. Contribute to MeisterLone/Askey-RT5010W-D187-REV6 development by creating an account on GitHub.

tesf23 · 2023-03-09T03:09:15.219Z

spol-eff:

is wired to the CPU through a some kind of IC on underneath the header, also

Looks like you need interrupt the boot process in a perfect timing.
"The CLK signal that runs between the EMMC and the CPU must be interrupted at the perfect time. (3 second window) This can be done by connecting VDDF (3v) to the CLK pin as soon as the "Hit space key to stop autoboot" message appears in the Serial Console."

GitHub

GitHub - MeisterLone/Askey-RT5010W-D187-REV6: Reverse Engineering the Askey...

Reverse Engineering the Askey RT5010W. Contribute to MeisterLone/Askey-RT5010W-D187-REV6 development by creating an account on GitHub.

meisterlone · 2023-03-09T03:42:05.627Z

I dont think this trick is going to work here, because CR1000A disables console, so even if bootipq is interrupted, there is no way to interact with uboot unfortunately. The route with most guaranteed success here would be to get ISP set up so you can read and write to the EMMC as you please. @spol-eff already posted the pin locations so half the work is done.

Once EMMC is dumped, you need to confirm the router has the "bootm" command enabled by decompiling the uboot binary. If bootm is available, its game on.

I'd do it but this router is god damned expensive

meisterlone · 2023-03-09T03:56:36.299Z

Something like this

image_67529473 (1)1920×1440 385 KB

soxrok2212 · 2023-03-09T04:04:35.169Z

It depends how it's disabled. I've seen vendors disable it via u-boot env. Getting into the bootloader in that case could be used to enable the console. Others might have it as a bootarg, etc.

It really depends on the implementation.

soxrok2212 · 2023-03-09T04:05:46.298Z

Please be aware that this is also highly implementation specific. U-boot can be patched to simply reset if emmc/storage can't be accessed. It doesn't have to drop into a shell. It's highly vendor dependent. Timing can also play a pretty big factor here.

a_guy · 2023-03-09T04:18:13.366Z

It could be had for 150 open box on ebay. I could chip in if needed. I don't have enough understanding here... but cr1000a uses encrypted partitions it seems, so dumping emmc would not be useful?

spol-eff · 2023-03-09T17:11:02.818Z

Well the firmware upgrade script disables the console in this way, but I'm not sure it applies to boot as well:
if test "x$verbose" = "x"; then

meisterlone · 2023-03-09T17:17:07.907Z

Doesnt seem encrypted if it can be read witha logic analyzer