Onnxruntime C++ API 简介

发表于 2023-11-30 更新于 2023-12-01

使用Onnxruntime C++/Python API也有两年时间了，对常用的API做一个简单的介绍。
OnnxRuntime的运行流程如下：

创建运行环境，可以设置日志级别，Log ID等

1	Ort::Env env(OrtLoggingLevel::ORT_LOGGING_LEVEL_WARNING,"APP NAME");

创建Session, model_path为ONNX模型存储的地址。另外可以通过SessionOptions设置优化级别、推理运行的Provider，如CPU， CUDA， TensorRT等。

Ort::SessionOptions session_options;
// session_options.SetGraphOptimizationLevel(Ort::ORT_ENABLE_BASIC);
// session_options.AppendExecutionProvider_CUDA(providerOptions);
Ort::Session ort_session = Ort::Session(env_, model_path_.c_str(), session_options);

获取模型输入输出信息

size_t numInputNodes = ort_session->GetInputCount();
size_t numOutputNodes = ort_session->GetOutputCount();
AllocatorWithDefaultOptions allocator;
for (int i = 0; i < numInputNodes; i++)
{
    input_names.push_back(ort_session->GetInputName(i, allocator));
    Ort::TypeInfo input_type_info = ort_session->GetInputTypeInfo(i);
    auto input_tensor_info = input_type_info.GetTensorTypeAndShapeInfo();
    auto input_dims = input_tensor_info.GetShape();
    input_node_dims.push_back(input_dims);
}
for (int i = 0; i < numOutputNodes; i++)
{
    output_names.push_back(ort_session->GetOutputName(i, allocator));
    Ort::TypeInfo output_type_info = ort_session->GetOutputTypeInfo(i);
    auto output_tensor_info = output_type_info.GetTensorTypeAndShapeInfo();
    auto output_dims = output_tensor_info.GetShape();
    output_node_dims.push_back(output_dims);
}

图像预处理，如调整大小转换通道，MAT->Tensor等

Mat img;
Mat srcimg = imread(imgpath);
resize(srcimg, img, Size(tgtWidth, tgtHeight));
vector<float> tensor(tgtWidth * tgtHeight * img.channels());
for(int i = 0; i < img.rows * img.cols * 3; i++)
{
    if(i % 3 == 0)
    {
        tensor[i + 2] = img.data[i];
    }
    else if(i % 3 == 1)
    {
        tensor[i] = img.data[i];
    }
    else if(i % 3 ==2)
    {
        tensor[i - 2] = img.data[i];
    }
}

分配内存

1
2
3

array<int64_t, 4> input_shape{ 1, 3, tgtWidth, tgtHeight};
auto allocator_info = MemoryInfo::CreateCpu(OrtDeviceAllocator, OrtMemTypeCPU);
Value input_tensor = Value::CreateTensor<float>(allocator_info, tensor.data(), tensor.size(), input_shape.data(), input_shape.size());

执行推理

1	vector<Value> ort_outputs = ort_session->Run(RunOptions{ nullptr }, &input_names[0], &input_tensor, 1, output_names.data(), output_names.size());

获取输出

1	float* preds = ort_outputs[0].GetTensorMutableData<float>();

谷歌(包括微软Edge)浏览器保存的Cookie及网站用户名密码都是以sqlite数据库文件存储在本地的，Linux系统下的目录为～/.config/microsoft-edge/Default，Windows系统下目录为C:\Users{user}\AppData\Local\Google\Chrome\User Data\Default，其中的Login Data和Cookies文件就是存储密码的数据库文件。

注： Windows、Linux和Mac获取password_value的逻辑稍有不同，Windows的密钥是存储在文件中的，Linux和Mac可以通过DBUS接口获取。

安装依赖库

1	pip install cryptography SecretStorage

主体代码如下：

#! /usr/bin/env python3

from cryptography.hazmat.primitives.ciphers import Cipher
from cryptography.hazmat.primitives.ciphers.algorithms import AES
from cryptography.hazmat.primitives.ciphers.modes import CBC
from cryptography.hazmat.primitives.hashes import SHA1
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC

import secretstorage

# Function to get rid of padding
def clean(decrypted: bytes) -> str:
    last = decrypted[-1]
    if isinstance(last, int):
            return decrypted[:-last].decode("utf8")
    return decrypted[: -ord(last)].decode("utf8")

# 获取Chrome密钥
def find_pass():
    bus = secretstorage.dbus_init()
    collection = secretstorage.get_default_collection(bus)
    for item in collection.get_all_items():
        print(item.get_label(), " :", item.get_secret())
        if item.get_label() == 'Chromium Safe Storage':
            return item.get_secret()
    else:
        raise Exception('Chrome password not found!')

#密文，前三个字符一般为v10或v11
password_value = b'v11******'

kdf = PBKDF2HMAC(
        algorithm=SHA1(),
        iterations=1,
        length=16,
        salt=b'saltysalt',
    )
enc_key = kdf.derive(find_pass())

cipher = Cipher(algorithm=AES(enc_key),mode=CBC(b'                '))

encrypted_value = password_value[3:]
decryptor = cipher.decryptor()
decrypted = decryptor.update(encrypted_value) + decryptor.finalize()
print(clean(decrypted))

参考链接：

https://www.cnblogs.com/CourserLi/p/16941184.html

https://www.jianshu.com/p/9ad6e8087c58

https://github.com/n8henrie/pycookiecheat

http://www.meilongkui.com/archives/1904

https://stackoverflow.com/questions/23153159/decrypting-chromium-cookies/23727331#23727331

破解某东路由宝之构造官方固件并刷机

发表于 2023-10-30 更新于 2023-11-21

破解某东路由宝之官方固件解包

发表于 2023-10-30 更新于 2023-11-30

将上次解析出来的固件包使用binwalk进行分析，显示如下：

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x879D8349, created: 2022-02-15 02:10:52, image size: 1741422 bytes, Data Address: 0x82001000, Entry Point: 0x82001000, data CRC: 0xA2E8A9E0, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "OpenWrt Linux-3.10.108"
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 5126400 bytes
1741486       0x1A92AE        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 12958032 bytes, 2918 inodes, blocksize: 1644891052 bytes, created: 1970-01-04 00:49:04

于是尝试使用binwalk解包，显示如下：

binwalk -Me dec.bin                                                       

Scan Time:     2023-11-28 12:20:59
Target File:   ./_full.bin-0.extracted/squashfs-root/test/dec.bin
MD5 Checksum:  507cab500d74c85f2ab4f84dfa0774fe
Signatures:    411

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
0             0x0             uImage header, header size: 64 bytes, header CRC: 0x879D8349, created: 2022-02-15 02:10:52, image size: 1741422 bytes, Data Address: 0x82001000, Entry Point: 0x82001000, data CRC: 0xA2E8A9E0, OS: Linux, CPU: MIPS, image type: OS Kernel Image, compression type: lzma, image name: "OpenWrt Linux-3.10.108"
64            0x40            LZMA compressed data, properties: 0x6D, dictionary size: 8388608 bytes, uncompressed size: 5126400 bytes
1741486       0x1A92AE        Squashfs filesystem, little endian, version 4.0, compression:xz, size: 12958032 bytes, 2918 inodes, blocksize: 1644891052 bytes, created: 1970-01-04 00:49:04


Scan Time:     2023-11-28 12:20:59
Target File:   ./_full.bin-0.extracted/squashfs-root/test/_dec.bin-1.extracted/40
MD5 Checksum:  8a45c216a579a11540105e688ad8b602
Signatures:    411

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
1407126       0x157896        PGP RSA encrypted session key - keyid: 80102B 10820050 RSA (Encrypt or Sign) 1024b
3997812       0x3D0074        Linux kernel version 3.10.1
3998076       0x3D017C        CRC32 polynomial table, little endian
4023656       0x3D6568        gzip compressed data, maximum compression, from Unix, last modified: 1970-01-01 00:00:00 (null date)
4116354       0x3ECF82        Certificate in DER format (x509 v3), header length: 4, sequence length: 30947
4116358       0x3ECF86        Certificate in DER format (x509 v3), header length: 4, sequence length: 22755
4116362       0x3ECF8A        Certificate in DER format (x509 v3), header length: 4, sequence length: 10467
4116374       0x3ECF96        Certificate in DER format (x509 v3), header length: 4, sequence length: 18659
4116378       0x3ECF9A        Certificate in DER format (x509 v3), header length: 4, sequence length: 14563
4116402       0x3ECFB2        Certificate in DER format (x509 v3), header length: 4, sequence length: 28898
4116438       0x3ECFD6        Certificate in DER format (x509 v3), header length: 4, sequence length: 29921
4116478       0x3ECFFE        Certificate in DER format (x509 v3), header length: 4, sequence length: 29919
4116482       0x3ED002        Certificate in DER format (x509 v3), header length: 4, sequence length: 3297
4116514       0x3ED022        Certificate in DER format (x509 v3), header length: 4, sequence length: 6369
4116550       0x3ED046        Certificate in DER format (x509 v3), header length: 4, sequence length: 1248
4116766       0x3ED11E        Certificate in DER format (x509 v3), header length: 4, sequence length: 25836
4116786       0x3ED132        Certificate in DER format (x509 v3), header length: 4, sequence length: 21742
4116790       0x3ED136        Certificate in DER format (x509 v3), header length: 4, sequence length: 9454
4116806       0x3ED146        Certificate in DER format (x509 v3), header length: 4, sequence length: 3310
4116810       0x3ED14A        Certificate in DER format (x509 v3), header length: 4, sequence length: 15598
4116818       0x3ED152        Certificate in DER format (x509 v3), header length: 4, sequence length: 27886
4116830       0x3ED15E        Certificate in DER format (x509 v3), header length: 4, sequence length: 17648
4116890       0x3ED19A        Certificate in DER format (x509 v3), header length: 4, sequence length: 19695
4116906       0x3ED1AA        Certificate in DER format (x509 v3), header length: 4, sequence length: 23792
4116910       0x3ED1AE        Certificate in DER format (x509 v3), header length: 4, sequence length: 23792
4116914       0x3ED1B2        Certificate in DER format (x509 v3), header length: 4, sequence length: 23792
4116918       0x3ED1B6        Certificate in DER format (x509 v3), header length: 4, sequence length: 23792
4116954       0x3ED1DA        Certificate in DER format (x509 v3), header length: 4, sequence length: 26866
4185014       0x3FDBB6        Certificate in DER format (x509 v3), header length: 4, sequence length: 10240
4185018       0x3FDBBA        Certificate in DER format (x509 v3), header length: 4, sequence length: 20480
4185022       0x3FDBBE        Certificate in DER format (x509 v3), header length: 4, sequence length: 22528
4185026       0x3FDBC2        Certificate in DER format (x509 v3), header length: 4, sequence length: 24576
4185030       0x3FDBC6        Certificate in DER format (x509 v3), header length: 4, sequence length: 26624
4185038       0x3FDBCE        Certificate in DER format (x509 v3), header length: 4, sequence length: 3074
4185046       0x3FDBD6        Certificate in DER format (x509 v3), header length: 4, sequence length: 28675
4185058       0x3FDBE2        Certificate in DER format (x509 v3), header length: 4, sequence length: 23558
4185066       0x3FDBEA        Certificate in DER format (x509 v3), header length: 4, sequence length: 15369
4185070       0x3FDBEE        Certificate in DER format (x509 v3), header length: 4, sequence length: 27657
4185078       0x3FDBF6        Certificate in DER format (x509 v3), header length: 4, sequence length: 2058
4185086       0x3FDBFE        Certificate in DER format (x509 v3), header length: 4, sequence length: 17419
4185090       0x3FDC02        Certificate in DER format (x509 v3), header length: 4, sequence length: 22539
4185114       0x3FDC1A        Certificate in DER format (x509 v3), header length: 4, sequence length: 17428
4185122       0x3FDC22        Certificate in DER format (x509 v3), header length: 4, sequence length: 21525
4185130       0x3FDC2A        Certificate in DER format (x509 v3), header length: 4, sequence length: 12312
4185142       0x3FDC36        Certificate in DER format (x509 v3), header length: 4, sequence length: 27673
4185146       0x3FDC3A        Certificate in DER format (x509 v3), header length: 4, sequence length: 12316
4185150       0x3FDC3E        Certificate in DER format (x509 v3), header length: 4, sequence length: 19493
4185162       0x3FDC4A        Certificate in DER format (x509 v3), header length: 4, sequence length: 29735
4185170       0x3FDC52        Certificate in DER format (x509 v3), header length: 4, sequence length: 30760
4185174       0x3FDC56        Certificate in DER format (x509 v3), header length: 4, sequence length: 13356
4185182       0x3FDC5E        Certificate in DER format (x509 v3), header length: 4, sequence length: 13357
4185186       0x3FDC62        Certificate in DER format (x509 v3), header length: 4, sequence length: 18481
4185190       0x3FDC66        Certificate in DER format (x509 v3), header length: 4, sequence length: 20529
4185194       0x3FDC6A        Certificate in DER format (x509 v3), header length: 4, sequence length: 22588
4185206       0x3FDC76        Certificate in DER format (x509 v3), header length: 4, sequence length: 8256
4185210       0x3FDC7A        Certificate in DER format (x509 v3), header length: 4, sequence length: 27714
4185214       0x3FDC7E        Certificate in DER format (x509 v3), header length: 4, sequence length: 19524
4185226       0x3FDC8A        Certificate in DER format (x509 v3), header length: 4, sequence length: 1095
4185230       0x3FDC8E        Certificate in DER format (x509 v3), header length: 4, sequence length: 4167
4185234       0x3FDC92        Certificate in DER format (x509 v3), header length: 4, sequence length: 13383
4185246       0x3FDC9E        Certificate in DER format (x509 v3), header length: 4, sequence length: 6216
4185254       0x3FDCA6        Certificate in DER format (x509 v3), header length: 4, sequence length: 30794
4185262       0x3FDCAE        Certificate in DER format (x509 v3), header length: 4, sequence length: 16460
4185270       0x3FDCB6        Certificate in DER format (x509 v3), header length: 4, sequence length: 30803
4185274       0x3FDCBA        Certificate in DER format (x509 v3), header length: 4, sequence length: 84
4185282       0x3FDCC2        Certificate in DER format (x509 v3), header length: 4, sequence length: 29781
4185286       0x3FDCC6        Certificate in DER format (x509 v3), header length: 4, sequence length: 26710
4185290       0x3FDCCA        Certificate in DER format (x509 v3), header length: 4, sequence length: 24663
4185294       0x3FDCCE        Certificate in DER format (x509 v3), header length: 4, sequence length: 28762
4185298       0x3FDCD2        Certificate in DER format (x509 v3), header length: 4, sequence length: 19551
4185306       0x3FDCDA        Certificate in DER format (x509 v3), header length: 4, sequence length: 24673
4185314       0x3FDCE2        Certificate in DER format (x509 v3), header length: 4, sequence length: 12391
4185318       0x3FDCE6        Certificate in DER format (x509 v3), header length: 4, sequence length: 17511
4185346       0x3FDD02        Certificate in DER format (x509 v3), header length: 4, sequence length: 124
4185358       0x3FDD0E        Certificate in DER format (x509 v3), header length: 4, sequence length: 20606
4185366       0x3FDD16        Certificate in DER format (x509 v3), header length: 4, sequence length: 133
4185370       0x3FDD1A        Certificate in DER format (x509 v3), header length: 4, sequence length: 24716
4185378       0x3FDD22        Certificate in DER format (x509 v3), header length: 4, sequence length: 1165
4185386       0x3FDD2A        Certificate in DER format (x509 v3), header length: 4, sequence length: 26770
4185418       0x3FDD4A        Certificate in DER format (x509 v3), header length: 4, sequence length: 18589
4185442       0x3FDD62        Certificate in DER format (x509 v3), header length: 4, sequence length: 10420
4185458       0x3FDD72        Certificate in DER format (x509 v3), header length: 4, sequence length: 31937
4185462       0x3FDD76        Certificate in DER format (x509 v3), header length: 4, sequence length: 4290
4185466       0x3FDD7A        Certificate in DER format (x509 v3), header length: 4, sequence length: 24770
4185494       0x3FDD96        Certificate in DER format (x509 v3), header length: 4, sequence length: 23767
4185498       0x3FDD9A        Certificate in DER format (x509 v3), header length: 4, sequence length: 6360
4185502       0x3FDD9E        Certificate in DER format (x509 v3), header length: 4, sequence length: 24792
4185506       0x3FDDA2        Certificate in DER format (x509 v3), header length: 4, sequence length: 27864
4185518       0x3FDDAE        Certificate in DER format (x509 v3), header length: 4, sequence length: 7390
4185534       0x3FDDBE        Certificate in DER format (x509 v3), header length: 4, sequence length: 21736
4185538       0x3FDDC2        Certificate in DER format (x509 v3), header length: 4, sequence length: 31978
4185542       0x3FDDC6        Certificate in DER format (x509 v3), header length: 4, sequence length: 2296
4185554       0x3FDDD2        Certificate in DER format (x509 v3), header length: 4, sequence length: 6395
4185562       0x3FDDDA        Certificate in DER format (x509 v3), header length: 4, sequence length: 255
4185566       0x3FDDDE        Certificate in DER format (x509 v3), header length: 4, sequence length: 12543
4454928       0x43FA10        xz compressed data
4473168       0x444150        Unix path: /lib/firmware/updates/3.10.108
4495888       0x449A10        Unix path: /var/run/udhcpc.pid
4549848       0x456CD8        Neighborly text, "NeighborSolicitsp6InMsgs"
4549868       0x456CEC        Neighborly text, "NeighborAdvertisementsrs"
4553530       0x457B3A        Neighborly text, "neighbor %.2x%.2x.%pM lost rename link %s to %s"
4725184       0x4819C0        CRC32 polynomial table, little endian
4886602       0x4A904A        Certificate in DER format (x509 v3), header length: 4, sequence length: 15369
4887374       0x4A934E        Certificate in DER format (x509 v3), header length: 4, sequence length: 12312
4887378       0x4A9352        Certificate in DER format (x509 v3), header length: 4, sequence length: 10240
4887382       0x4A9356        Certificate in DER format (x509 v3), header length: 4, sequence length: 24576
4887406       0x4A936E        Certificate in DER format (x509 v3), header length: 4, sequence length: 22528
4887574       0x4A9416        Certificate in DER format (x509 v3), header length: 4, sequence length: 28675
4887598       0x4A942E        Certificate in DER format (x509 v3), header length: 4, sequence length: 17428
4887602       0x4A9432        Certificate in DER format (x509 v3), header length: 4, sequence length: 31937
5112308       0x4E01F4        ASCII cpio archive (SVR4 with no CRC), file name: "dev", file name length: "0x00000004", file size: "0x00000000"
5112424       0x4E0268        ASCII cpio archive (SVR4 with no CRC), file name: "dev/console", file name length: "0x0000000C", file size: "0x00000000"
5112548       0x4E02E4        ASCII cpio archive (SVR4 with no CRC), file name: "root", file name length: "0x00000005", file size: "0x00000000"
5112664       0x4E0358        ASCII cpio archive (SVR4 with no CRC), file name: "TRAILER!!!", file name length: "0x0000000B", file size: "0x00000000"


Scan Time:     2023-11-28 12:21:00
Target File:   ./_full.bin-0.extracted/squashfs-root/test/_dec.bin-1.extracted/_40.extracted/3D6568
MD5 Checksum:  feef2ce937a96646234e78fc025639d8
Signatures:    411

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------


Scan Time:     2023-11-28 12:21:00
Target File:   ./_full.bin-0.extracted/squashfs-root/test/_dec.bin-1.extracted/_40.extracted/console
MD5 Checksum:  d41d8cd98f00b204e9800998ecf8427e
Signatures:    411

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------

破解某东路由宝之官方固件结构

发表于 2023-10-30 更新于 2023-11-28

通过官方固件中的某二进制文件我们可以得知固件的结构如下：

0x00-0x03：固定字符HIMG
0x0c-0x0f：真实的固件大小
0x10-0x1F：固件的MD5值
0x20-0x11F：固件RSA签名
0x220-0x22F： AES-128-CBC KEY
0x230-0x23F： AES-128-CBC IV
0x240-文件末尾：加密主体

通过以上结构，我们可以很容易写出解密固件的代码逻辑：

int decrypt(char *encrypt_content, int encrypt_size, char *key, char *iv, char *dec_content)
{
    int result = -1;
    EVP_CIPHER_CTX *ctx;
    int dec_out[2];

    ctx = EVP_CIPHER_CTX_new();
    if (ctx == 0)
    {
        ERR_print_errors_fp(stderr);
    }
    else
    {
        if (EVP_DecryptInit_ex(ctx, EVP_aes_128_cbc(), 0, key, iv))
        {
            if (EVP_DecryptUpdate(ctx, dec_content, dec_out, encrypt_content, encrypt_size))
            {
                result = dec_out[0];
                if (EVP_DecryptFinal_ex(ctx, dec_content + dec_out[0], dec_out))
                {
                    result += dec_out[0];
                }
                else
                {
                    ERR_print_errors_fp(stderr);
                }
            }
            else
            {
                ERR_print_errors_fp(stderr);
            }
        }
        else
        {
            ERR_print_errors_fp(stderr);
        }
    }
    if (ctx != 0)
    {
        EVP_CIPHER_CTX_free(ctx);
    }
    return result;
}
int save_to_file(char *filename, char *decode_buffer, int size)
{
    FILE *fp = fopen(filename, "w+");
    if (NULL == fp)
    {
        return -1;
    }
    fwrite(decode_buffer, size, 1, fp);
    fclose(fp);
    fp = NULL;
    return 0;
}
int decode_img(char *buffer, char *dec_file_name)
{
    //获取文件大小
    int size = ntohl(*(uint32_t *)(buffer + 0xc));
    char *decoded_buffer = malloc(size + -0x230);
    int decoded_size = decrypt(buffer + 0x240, size + -0x230, buffer + 0x220, buffer + 0x230, decoded_buffer);
    if (decoded_size > 0)
    {
        return save_to_file(dec_file_name, decoded_buffer, decoded_size);
    }
    return -1;
}

破解某东路由宝之Qemu模拟运行固件

发表于 2023-10-30 更新于 2023-11-28

Qemu是使用最广泛的跨平台仿真软件，可以模拟运行二进制文件和系统固件。因为某东路由是mips小端格式，因此我们使用mipsel进行仿真。

QEMU主要有两种仿真方式：

用户模式仿真：允许一个（Linux）进程执行在不同架构的CPU上，该模式下，QEMU 可以作为进程级虚拟机。
系统模式仿真：允许仿真完整的系统，包括处理器和配套的外设，该模式下，QEMU 也可以作为系统虚拟机。

安装qemu

sudo apt-get install qemu 
sudo apt-get install qemu-user-static
sudo apt-get install qemu-system
sudo apt-get install uml-utilities
sudo apt-get install bridge-utils
sudo apt-get install qemu-user-static qemu-system-mips

用户模式下仿真

首先将qemu-mipsel-static拷贝到固件解包的系统目录下

1 2	cd squashfs-root cp $(which qemu-mipsel-static) ./

执行二进制程序

1	sudo chroot . ./qemu-mipsel-static sbin/ifconfig

系统模式下仿真

下载文件

首先我们需要从debian官网下载kernel和image，我使用vmlinux-2.6.32-5-4kc-malta和debian_squeeze_mipsel_standard.qcow2。当然也可以使用自己的kernel和imgage，后面模拟固件启动时会用到。

配置网络

sudo brctl addbr Virbr0
sudo ifconfig Virbr0 192.168.244.133/24 up
sudo tunctl -t tap0
sudo ifconfig tap0 192.168.244.134/24 up
sudo brctl addif Virbr0 tap0

启动虚拟环境

1
2

sudo qemu-system-mipsel -M malta -kernel vmlinux-2.6.32-5-4kc-malta -hda debian_squeeze_mipsel_standard.qcow2 \
-append "root=/dev/sda1 console=tty0" -net nic -net tap,ifname=tap0,script=no,downscript=no -nographic -s

系统启动后输入root/root登录至文件系统。

配置虚拟机IP

1	ifconfig eth0 192.168.244.132/24

上传固件文件系统

1	scp -r ./squashfs-root root@192.168.244.132:/root/

运行固件服务

1	chroot squashfs-root /bin/sh

但是由于某些原因我运行一直出错，后来索性不再尝试，改为使用另外一个工具firmware-analysis-toolkit。

FAT

FAT可以直接提取固件的image然后模拟固件运行。

下载安装工具

1
2
3

git clone https://github.com/attify/firmware-analysis-toolkit.git
cd firmware-analysis-toolkit
./setup.sh

由于国内网络的原因，建议搭梯子。

启动固件

首先修改fat.config文件，将自己用户的密码添加进去，因为fat最终也是通过qemu模拟固件运行的，需要使用sudo权限。

运行FAT

1	./fat.py xxx.bin

实际运行中FAT会由于环境或者参数的原因生成的img有问题,导致系统无法启动，所以我手动运行的解包命令

1 2	cd firmadyne/sources/extractor/ ./extract.sh xxx.bin ../../images

并对fat.py做了一定的修改。最终生成的启动命令如下：

sudo qemu-system-mipsel -m 256 -M malta -kernel firmadyne/binaries//vmlinux.mipsel \
-drive if=ide,format=raw,file=firmadyne/scratch//1//image.raw \
-append "root=/dev/sda1 console=ttyS0 nandsim.parts=64,64,64,64,64,64,64,64,64,64 rdinit=/firmadyne/preInit.sh \
rw debug ignore_loglevel print-fatal-signals=1 user_debug=31 firmadyne.syscall=0" -nographic \
-netdev socket,id=net1,listen=:2001 -device e1000,netdev=net1 -netdev socket,id=net2,listen=:2002 \
-device e1000,netdev=net2 -netdev socket,id=net3,listen=:2003 -device e1000,netdev=net3

可以从上面启动命令中看到使用的image是FAT通过提取固件生成的。系统启动信息如下：

Nov  2 04:23:31 (none) kern.info kernel: [    0.120000] NET: Registered protocol family 2
Nov  2 04:23:31 (none) kern.info kernel: [    0.120000] IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
Nov  2 04:23:31 (none) kern.info kernel: [    0.120000] TCP established hash table entries: 8192 (order: 4, 65536 bytes)
Nov  2 04:23:31 (none) kern.info kernel: [    0.124000] TCP bind hash table entries: 8192 (order: 3, 32768 bytes)
Nov  2 04:23:31 (none) kern.info kernel: [    0.124000] TCP: Hash tables configured (established 8192 bind 8192)
Nov  2 04:23:31 (none) kern.info kernel: [    0.124000] TCP reno registered
Nov  2 04:23:31 (none) kern.info kernel: [    0.124000] UDP hash table entries: 256 (order: 0, 4096 bytes)
Nov  2 04:23:31 (none) kern.info kernel: [    0.124000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
Nov  2 04:23:31 (none) kern.info kernel: [    0.124000] NET: Registered protocol family 1
Nov  2 04:23:31 (none) kern.debug kernel: [    0.124000] PCI: CLS 0 bytes, default 64
Nov  2 04:23:31 (none) kern.info kernel: [    0.184000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
Nov  2 04:23:31 (none) kern.info kernel: [    0.184000] Registering unionfs 2.6 (for 2.6.39.4)
Nov  2 04:23:31 (none) kern.info kernel: [    0.184000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
Nov  2 04:23:31 (none) kern.info kernel: [    0.184000] ROMFS MTD (C) 2007 Red Hat, Inc.
Nov  2 04:23:31 (none) kern.info kernel: [    0.188000] msgmni has been set to 492
Nov  2 04:23:31 (none) kern.info kernel: [    0.192000] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
Nov  2 04:23:31 (none) kern.info kernel: [    0.192000] io scheduler noop registered
Nov  2 04:23:31 (none) kern.info kernel: [    0.192000] io scheduler cfq registered (default)
Nov  2 04:23:31 (none) daemon.notice procd: /etc/rc.d/S10boot: /etc/rc.common: line 37: vconfig: not found
Nov  2 04:23:31 (none) kern.info kernel: [    0.192000] firmadyne: devfs: 1, execute: 1, procfs: 1, syscall: 0
Nov  2 04:23:31 (none) kern.warn kernel: [    0.192000] firmadyne: Cannot register character device: watchdog, 0xa, 0x82!
Nov  2 04:23:31 (none) kern.warn kernel: [    0.192000] firmadyne: Cannot register character device: wdt, 0xfd, 0x0!
Nov  2 04:23:31 (none) kern.warn kernel: [    0.228000] PCI: Enabling device 0000:00:12.0 (0000 -> 0002)
Nov  2 04:23:31 (none) kern.info kernel: [    0.228000] cirrusfb 0000:00:12.0: Cirrus Logic chipset on PCI bus, RAM (4096 kB) at 0x10000000
Nov  2 04:23:31 (none) kern.info kernel: [    0.448000] Console: switching to colour frame buffer device 80x30
Nov  2 04:23:31 (none) kern.info kernel: [    0.460000] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
Nov  2 04:23:31 (none) kern.info kernel: [    0.484000] serial8250.0: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
Nov  2 04:23:31 (none) kern.info kernel: [    0.488000] console [ttyS0] enabled, bootconsole disabled
Nov  2 04:23:31 (none) kern.info kernel: [    0.508000] serial8250.0: ttyS1 at I/O 0x2f8 (irq = 3) is a 16550A
Nov  2 04:23:31 (none) kern.info kernel: [    0.532000] serial8250.0: ttyS2 at MMIO 0x1f000900 (irq = 18) is a 16550A
Nov  2 04:23:31 (none) kern.info kernel: [    0.536000] brd: module loaded
Nov  2 04:23:31 (none) kern.info kernel: [    0.536000] loop: module loaded
Nov  2 04:23:31 (none) kern.debug kernel: [    0.536000] ata_piix 0000:00:0a.1: version 2.13
power off the port 0
[   14.960000] e1000: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
[   14.996000] 8021q: adding VLAN 0 to HW filter on device eth1
[   15.840000] e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
[   15.848000] ADDRCONF(NETDEV_UP): eth0: link is not ready
[   15.848000] 8021q: adding VLAN 0 to HW filter on device eth0
[   15.852000] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
btnd start_service
start v6 bridge ###########
####start SFE####
####enable SFE####
en:1
en:0
en:0
en:0
en:1
BusyBox v1.29.2 () built-in shell (ash)

 -----------------------------------------------------
 JDCOS 2.3.4.r1307, r7258-5eb055306f
 -----------------------------------------------------
 MAC: FFFFFFFFFFFF    Product: NULL
 ROM: HR06                
 -----------------------------------------------------
root@HaiOS:/#

破解某东路由宝之紧急升级包

发表于 2023-10-30 更新于 2023-11-28

由于前段时间一代积分下降严重，付出和收益不成比例，因此尝试刷成op作为普通路由使用，但是搜索了一圈发现系统各种漏洞都已经修复，没有办法无损刷机。正好近期一代大批断线，官方紧急上线修复工具可以刷机，于是分析一下看看是否有后门可以利用，官方修复教程地址。

首先下载官方修复工具，丢进IDA和Ghidra分析，通过分析输出可以确定两件事：

修复工具使用Golang写的，使用了github.com/lxn/walk和github.com/lxn/win两个库。
通过函数签名可以确定修复工具主要是调用路由的api进行刷机，并没有使用什么后门，通过后期的抓包也确认了我的猜想。

其中一个函数签名引起了我的注意，貌似是用来解密修复固件包的。

通过生成伪代码分析可知整个调用过程简化如下图：

另外通过抓包发现，修复时先通过刷入enc.txt过度固件，然后通过过度固件刷入bin.txt完成修复，至于为什么要通过过度固件刷入官方固件暂时无从知晓。

Build Onnx Runtime For Jetson Xavier NX

发表于 2023-07-25 更新于 2023-11-21

本文主要参考 Onnx Runtime 官方dockerfiles编译指南

查看Jetson版本

jtop

根据jtop输出确定Jetson的系统版本号

测试镜像

在Nvidia镜像仓库中搜索自己需要的基础镜像。

当前常用的镜像有：

l4t-base

从概述中可知自r34.1及以后的版本中不再集成CUDA,CuDNN和TensorRT等组件。对于高度定制化的需求，可以使用此镜像安装特定的CUDA和TensorRT版本。并且官方很贴心的提供了可参考的Dockerfile模板。

l4t-cuda

从名字可以得知此镜像集成了CUDA组件。

l4t-tensorrt

从名字可以得知此镜像集成了TensorRT组件。

l4t-jetpack

从概述中可以得知，此镜像集成了CUDA,CuDNN和TensorRT等组件，可作为通用程序开发的基础镜像。但是因为集成了CUDA等组件，此镜像磁盘空间占用较大。

l4t-ml

从概述中可知此镜像集成了非常多的常用组件，包括TensorFlow, PyTorch, JupyterLab和其他常用的机器学习库，并且包含了scikit-learn, scipy和Pandas等一些数据分析库。因此此镜像磁盘空间占用非常大，但是因为集成了很多库所以省去了很多的编译时间。

另外，对于一些常用的python库，Nvidia官方为Jetson专门提供了一个集合链接，可以从中查找需要的库进行下载安装。

我测试的系统版本是4.4 r35.1.0,可以选择l4t-ml镜像，省去了安装环境的时间。

FROM nvcr.io/nvidia/l4t-ml:r35.1.0-py3

ENV TZ=Asia/Shanghai
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone

WORKDIR ./app
 
ADD . .

RUN pip3 install --no-cache-dir onnxruntime_gpu-1.12.1-cp38-cp38-linux_aarch64.whl && rm onnxruntime_gpu-1.12.1-cp38-cp38-linux_aarch64.whl

RUN pip install -r requirements.txt -i https://pypi.tuna.tsinghua.edu.cn/simple

EXPOSE 8080
CMD ["python3", "./main.py"]

编译自定义镜像

由于官方提供的镜像要么只集成了基础组件，要么集成了太多的开源库，因此当在生产环境使用时，需要根据项目需要编译自己的镜像。通常项目组会构建自己的基础镜像，在基础镜像上根据项目的需要再加入更多的组件库。

Investigation of RPA framework

发表于 2023-07-24 更新于 2023-11-21

https://www.provincialtransport.com/rpazs/4803.html

https://zhuanlan.zhihu.com/p/551359099

PyAutoGUI
https://github.com/asweigart/pyautogui

dogtail
https://gitlab.com/dogtail/dogtail/

Selenium

OpenRPA
https://github.com/open-rpa/openrpa

taskt
https://github.com/saucepleez/taskt

UI.Vision
https://github.com/A9T9/RPA

TagUI
https://github.com/aisingapore/TagUI

Robot Framework
https://github.com/robotframework/robotframework

OPCDA errors

发表于 2022-12-05 更新于 2023-11-21

0x80070776

The following error may occur when a client (ie. Enterprise Guide, VB,
Java) attempts a connection to a remote SAS Objectserver.

Function Name:Advise CILanguageEvents
0x80070776 - The object exporter specified was not found.

Permission was not granted by the client for the server to make calls on
the server interface.

Listed below are possible reasons that could cause this error:

The IP address on the client machine is being used by another
computer at your site.
The client machine has been configured with TCP/IP as a network
transport, but TCP/IP is improperly configured. For example, the
client machines may be configured to dynamically assign an IP
address using DHCP, yet a DHCP server may not be available, so
there is no available IP address. The solution in this case is to
properly configure TCP/IP networking.
With Windows2000 COM, the marshalling packet contains the DNS
name. If the client is unable to ping the server with this
fully qualified domain name, then this error may occur. Use a
network monitoring trace facility such as netmon to take a trace
of the conversation and check to see what name is being returned
on the response packet to your OpenConnection method call.
Using DCOM across proxy servers, verify that the client computer
and proxy server can reach the DCOM server. Verify this by
using the full computer name, such as <computername.domain>.

I don’t believe that this is caused by a firewall. I have added some comments for clarification about firewall / ports below for completeness, but I don’t believe this is the issue you are running into. The 80070776 error you are getting is “The object exporter specified was not found”, which generally indicates some type of network conflict. It is most likely due to improper DNS resolution. I would suggest adding an entry in the HOST file that matches the shortname of the target OPC Server. Are you able to connect / ping the target machine properly?

To add on to the previous comments, opening up port 135 between the interface (client) and the server is not enough. DCOM communications initiate on port 135 and will then use an ephemeral port. For Windows 2008 (Vista) and later, the ephemeral port range is 49152-65535. Because OPC operations may also use callbacks (async), those ports need to be opened bidirectionally.

It is possible to reduce the port range for ephemeral ports, but you risk running into port exhaustion. See more details on how to do so here: 2973OSI8 - Configuring ports for DCOM for use with the OPC Interface. NAT and Firewall considerations Additionally, although the local Windows Firewall is turned off on the machine it does not mean that it does not have to go through a firewall on the network. I would suggest contacting your IT/Infrastructure/Network team. If you are still seeing the message after defining the ephemeral port range and insuring that all of the ephemeral ports are opened, the next step would be to look at a network trace (Wireshark or netsh) and then looking from lost packets.

知秋

Onnxruntime C++ API 简介

解密Chrome浏览器保存在本地的用户名密码

破解某东路由宝之构造官方固件并刷机

破解某东路由宝之官方固件解包

破解某东路由宝之官方固件结构

破解某东路由宝之Qemu模拟运行固件

QEMU主要有两种仿真方式：

安装qemu

用户模式下仿真

系统模式下仿真

下载文件

配置网络

启动虚拟环境

配置虚拟机IP

上传固件文件系统

运行固件服务

FAT

下载安装工具

启动固件

运行FAT

破解某东路由宝之紧急升级包

Build Onnx Runtime For Jetson Xavier NX

查看Jetson版本

测试镜像

l4t-base

l4t-cuda

l4t-tensorrt

l4t-jetpack

l4t-ml

编译自定义镜像

Investigation of RPA framework

OPCDA errors

0x80070776