267 Hacking Linux Powered Devices

Hacking Linux-Powered
Devices
Stefan Arentz
<stefan@soze.com>
Part I
Introduction
What is Embedded Linux?
Embedded usually means that it is a device
with limited and specialized capabilities. It is
not a ‘personal computer’ as your laptop or
PC on your desk.
Embedded Linux means that there is a Linux

kernel running on such a device.
Usually together with a combination of

proprietary software and other OSS
components running on top of that kernel.
(The “user space” parts.)
Example: an imaginary portable
DivX player
(From a Linux POV)
Hardware: CPU, RAM, Flash card, screen, bunch of buttons.
Process listing of an imaginary portable DivX player

PID Uid VmSize Stat Command
1 0 396 S init
2 0 4829 S mplayer
This could be a real world example, sometimes it really is

this simple.
Some Real Examples of
Linux-Powered Devices
TomTom GO
GPS Navigation
DreamBox
Digital TV/Radio Tuner
Linksys WRT54G
Wireless AP
Linux is a paradigm shift for hardware
vendors
• They have to trust a “community work”

• They have to publish (parts of) their own work (‘The
GNU GPL Revisited’ lecture)
– There is still the ‘object code only kernel modules’ thing
• They are moving away from proprietary embedded
operating systems
– Great because those were closed
End Result for “Us”
Access to a product’s source code: at least
the kernel source and other OSS components
used.
Easier to reverse engineer the closed parts

and easier to hack and modify the device as a
whole.
Part II
Breaking the EULA
Real World Example
First things First
Share Your Work and Research
Start a Wiki!
Example - Linksys WRT54G
Our Goal
Get access to the contents of the (read-only)

filesystem that is embedded in the firmware.
If we can do this then we have basically opened up

the device; we can modify it’s default behavior and
add our own modifications.
Understand the hardware
• Opening the box will void the warranty!

• Be careful, electricity can kill you!
• Static electricity can kill the device!
• Look at relations and connections between

parts, connectors and things like switches.
• Look at part numbers (gooooogle them)
Goooooogle for the Datasheets
• Most vendors have them online (PDF)

• You don’t have to understand it all,
electronics is a different discipline
• But it helps you to understand the
device better
• And … you might find surprises!
WIFI RAM
CPU/ETH
RADIO
FLASH
ETH SWITCH
POWER
Back to our Goal: Hacking the
Firmware Image
Header
Compressed Kernel
Compressed File System
(CRAMFS)
Firmware Image Header
% hexdump -C ~/WRT54G_1.30.1_US_code.bin
00000000 57 35 34 47 00 00 00 00 03 06 17 01 1e 01 55 32 |W54G..........U2|
00000010 4e 44 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |ND..............|
00000020 48 44 52 30 00 d0 29 00 78 53 6c d5 00 00 01 00 |HDR0.?).xSl?....|
00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
struct trx_header {
uint32_t magic; /* "HDR0" */
uint32_t len; /* Length of file including header */
uint32_t crc32; /* 32-bit CRC */
uint32_t flag_version; /* 0:15 flags, 16:31 version */
uint32_t offsets[3]; /* Offsets of sections */
};
Extract the Kernel and
CRAMFS
# Extract the file system (from the end)

% dd if=code.bin of=cramfs bs=1c skip=786464
# Extract the kernel (from the beginning, skip the header)

% dd if=code.bin of=kernel bs=1c skip=32 \
count=786432
Mount the CRAMFS section
% sudo mount -o loop cramfs.section /mnt
% ls -l /mnt
drwxr-xr-x 1 root root 444 1970-01-01 01:00 bin/
drwxr-xr-x 1 root root 0 1970-01-01 01:00 dev/
drwxr-xr-x 1 root root 88 1970-01-01 01:00 etc/
drwxr-xr-x 1 root root 164 1970-01-01 01:00 lib/
drwxr-xr-x 1 root root 0 1970-01-01 01:00 mnt/
drwxr-xr-x 1 root root 0 1970-01-01 01:00 proc/
drwxr-xr-x 1 root root 292 1970-01-01 01:00 sbin/
drwxr-xr-x 1 root root 0 1970-01-01 01:00 tmp/
drwxr-xr-x 1 root root 64 1970-01-01 01:00 usr/
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 var -> tmp/var
drwxr-xr-x 1 root root 1328 1970-01-01 01:00 www/
# ls -l /mnt/bin
-rwxr-xr-x 1 root root 268408 1970-01-01 01:00 busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 cat -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 chmod -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 cp -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 date -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 dd -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 df -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 echo -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 false -> busybox*
lrwxrwxrwx 1 root root 7 1970-01-01 01:00 grep -> busybox*
# file /mnt/bin/busybox
bin/busybox: ELF 32-bit LSB MIPS-I executable, MIPS,
version 1 (SYSV), for GNU/Linux 2.3.99,
dynamically linked (uses shared libs), stripped
% ls -l /mnt/lib
-rwxr-xr-x 1 root root 140264 1970-01-01 01:00 ld.so.1*
-rwxr-xr-x 1 root root 35180 1970-01-01 01:00 libcrypt.so.1*
-rwxr-xr-x 1 root root 871936 1970-01-01 01:00 libc.so.6*
-rwxr-xr-x 1 root root 15460 1970-01-01 01:00 libdl.so.2*
-rwxr-xr-x 1 root root 13564 1970-01-01 01:00 libm.so.6*
-rwxr-xr-x 1 root root 13564 1970-01-01 01:00 libnsl.so.1*
drwxr-xr-x 1 root root 20 1970-01-01 01:00 modules/
% strings /mnt/lib/libc.so.6 | grep GLIBC

GLIBC_2.2.3
Building a Toolchain (Optional)
Now that we know …
•The processor architecture (MIPS-I/LSB)

•The C Library used (glibc2 2.2.4)
… we can build a compatible toolchain. Building cross

compilers is complex, but “crosstool” will handle all details
for you. It even comes with an example script for the
WRT54G!
% cd crosstool-0.28
% ./demo-mipsel.sh
Crosstool supports many other configurations too.

Modify and Regenerate the
CRAMFS image
# Make a copy of the file system
% cp --archive /mnt ~/newrootfs
# Add a new server, make changes …

% cp myserver ~/newrootfs/usr/sbin/
% chmod 755 usr/sbin/myserver
# Change our copy back into a cramfs image

% cd ~/newrootfs
% mkcramfs . ~/newcramfs
Regenerate the Firmware Image
A scripting language is your friend for quick hacks like this.
% ./make-firmware-image.rb kernel newcramfs > code.bin
Header
The script simply takes the kernel and the
CRAMFS sections and creates a new
Compressed Kernel
firmware image with a header with the right
CRC32 checksum. Compressed File System
(CRAMFS)
You can then upload this new firmware image to the

WRT54G and use it. Hack done!
Conclusion
• Hacking Linux-Powered devices is
definitely possible. Be creative and
persistent!
• Don’t underestimate the power of a

collective effort. Sharing is key.
References
• http://www.openwrt.org
• http://www.opentom.org
• Google for ‘embedded

linux’
Q&A

267 Hacking Linux Powered Devices

Uploaded by

Copyright:

Available Formats

267 Hacking Linux Powered Devices

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

267 Hacking Linux Powered Devices

Uploaded by

Copyright:

Available Formats

Hacking Linux-Powered

Embedded Linux means that there is a Linux

Usually together with a combination of

Hardware: CPU, RAM, Flash card, screen, bunch of buttons.

Process listing of an imaginary portable DivX player

This could be a real world example, sometimes it really is

• They have to trust a “community work”

Easier to reverse engineer the closed parts

Share Your Work and Research

Get access to the contents of the (read-only)

If we can do this then we have basically opened up

• Opening the box will void the warranty!

• Look at relations and connections between

• Most vendors have them online (PDF)

# Extract the file system (from the end)

# Extract the kernel (from the beginning, skip the header)

% strings /mnt/lib/libc.so.6 | grep GLIBC

•The processor architecture (MIPS-I/LSB)

… we can build a compatible toolchain. Building cross

Crosstool supports many other configurations too.

# Add a new server, make changes …

# Change our copy back into a cramfs image

A scripting language is your friend for quick hacks like this.

% ./make-firmware-image.rb kernel newcramfs > code.bin

You can then upload this new firmware image to the

• Don’t underestimate the power of a

• Google for ‘embedded

You might also like