- ANATEL WIFI MODULE V000310630 SPECS INSTALL
- ANATEL WIFI MODULE V000310630 SPECS PATCH
- ANATEL WIFI MODULE V000310630 SPECS CODE
- ANATEL WIFI MODULE V000310630 SPECS PASSWORD
Vendor-supplied extras, most need LD_LIBRARY_PATH=/system/workdir/lib to work.Ĭurl is available there, wget is available in busybox - to make copying files easier. airplaydĪirPlay receiver, has some strings pointing to the capability of communicating with an i2c MFI authentication chip.
ANATEL WIFI MODULE V000310630 SPECS PASSWORD
Start your Airplay password with " and you can make it run whatever you put after that. Pseudo-code: sprintf(buf, "echo \"%s\" > %s", airplay_password, "/tmp/airplay_password")
ANATEL WIFI MODULE V000310630 SPECS PATCH
RootApp is the ‘main app’, processes commands goahead receives on the httpapi.asp endpoint and UART commands from mv_ioguardĮnable Telnet: there’s a command for that! 507269765368656C6C:5f7769696d75645f - translates to PrivShell:_wiimud_Ĭalling system() on unsanitized input happens when processing AIRPLAY_PASSWORD nvram variable, we’ll use that to achieve persistence without having to patch initrd/go in with the SOIC8 clip. MCU seems to be firmware upgradable(AXX+MCU+UPD/AXX+MCU+RUN). Strings mv_ioguard | grep AXX/MCU for the full? list MCU+MUT+GET - request current MUTE status mv_ioguardĬommands sent from WiFI module to MCU start with AXX+Ĭommands sent from MCU to WiFI module start with MCU+ĪXX+MCU+VER - get software? revision of the MCU Not vulnerable to ShellShock because all scripts are using /bin/sh. Vulnerable to LD_PRELOAD CGI attacks and god knows what else. mnt and /vendor are writable and persistent - a good place to keep files/scripts without having to rebuild initrd. dev/mtdblock9 on /vendor type jffs2 (rw,relatime) dev/mtdblock8 on /mnt type jffs2 (rw,relatime) None on /dev/pts type devpts (rw,relatime,mode=600)ĭevpts on /dev/pts type devpts (rw,relatime,mode=600) dev/root on / type squashfs (ro,relatime) Using dd and mkimage is possible, but I never managed to extract anything useful due to mkimage format mismatch and other issues with uImage. I used a SOIC8 clip to connect to the SPI ROM IC and dump the ROM. USB is available on the WiFi module but not connected to anything.Ĭonnecting USB data lines to the rear panel USB should be possible (NOT TESTED). Soldering an RJ45 connector with transformer and a few passives should enable Ethernet (NOT TESTED YET).Įthernet connection schematics available in the module manual, section 2.5.1 USB Host Yes, there’s ONE SECURITY TORX T15 SCREW in addition to other 7 security T10 - because screw you!Įthernet is available on the WiFi module but not connected to anything, Security Torx T10 AND T15, sunk in 70mm deep holes. Volume control, display, capacitive buttons are all connected to the MCU (not the WiFi board). No documentation found some documentation for a different model by the same manufacturer here: MCU board microcontroller: JL AC1619D99111-00 Module specs: MIPS Mediatek MT7688 SoC, 64 MB RAM, 16 MB SPI flashĪudio module is connected to the microcontroller (MCU) board with UART at 57600 8n1 The speaker uses WiiMu A31 WiFi audio module by LinkPlay.
ANATEL WIFI MODULE V000310630 SPECS INSTALL
Usage: install_telnet.sh Manual install Background Hardware There’s an automatic installation script that should enable telnet on boot and disable idle timeout called install_telnet.sh. Binwalk is recommended for digging in SPI ROM contents Automatic install You need to install telnet, expect and curl for the script to work.
ANATEL WIFI MODULE V000310630 SPECS CODE
View the Project on GitHub Crymeiriver/LS150 Aboutįirmware image extracted from SPI ROM of WiiMu A31 module of iRiver LS-150 WiFi speaker,Īs well as some tools to allow custom code execution Installation Prerequisites Astell&Kern iRiver LS150 SPI firmware dump + telnet access
0 kommentar(er)
