sfasf

Hocam modemi yakmamı engelleyen tek şey elimdeki tek DSL modem olması. SCP bağlanmıyor WGET bağlanmıyor. Arayüzde yetki yüksek terminalde düşük. Fiber gelene kadar idare edeyim gelince UART'tan bağlanıp istediğimiz şeyi çekeriz.
Modemi yakmamaya direnmeye çalışmanız harika. 😂 Bu bize aslında bu rootlama işine ne kadar destek verdiğinizi gösteriyor. Şu an geçerken terminalden hiç özel şeyler alamıyor muyuz?
 
Son düzenleyen: Moderatör:
Modemi yakmamaya direnmeye çalışmanız harika. 😂 Bu bize aslında bu rootlama işine ne kadar destek verdiğinizi gösteriyor. Şu an geçerken terminalden hiç özel şeyler alamıyor muyuz?
Çoğunlukta yetki hatası veriyor birkaçında sansürlü veri getiriyor daha output.txt'lere bakamadım bile. Kodu gözden geçirmem lazım,bi yerde hata yapmışım. Arayüzün yetkisi yüksek iken terminalde yetkim düşük bir üst kullanıcıya geçmem gerek.
 
Çoğunlukta yetki hatası veriyor birkaçında sansürlü veri getiriyor daha output.txt'lere bakamadım bile. Kodu gözden geçirmem lazım,bi yerde hata yapmışım. Arayüzün yetkisi yüksek iken terminalde yetkim düşük bir üst kullanıcıya geçmem gerek.
Her tuşa basıyoruz. Bakalım GitHub kullanıcıları ne derecede ilgi gösterecek? Bir dönüş olur mu dersiniz?

Screenshot_20260706-010735.webp
 
Son düzenleyen: Moderatör:
Huawei'den hallice bunlarda da her şey kapalı kutu. Hocam aciliyet durumu varsa modemi bilgisayar olan yere götürüp Root atsan olmadı Android bir cihaza USB ethernet takıp denesen.
Hocam, şu komutları sırayla dener misiniz? Hangisi çalışırsa çıktısını atın:
Bash:
od -c /lib/libhardcode.so

od -x /lib/libhardcode.so

cat /lib/libhardcode.so | od -c

xxd /lib/libhardcode.so

hexdump /lib/libhardcode.so

cat /lib/libhardcode.so
Permission denied yemeyiz umarım, ya ufak 5 komut
 
Son düzenleyen: Moderatör:
Hocam, şu komutları sırayla dener misiniz? Hangisi çalışırsa çıktısını atın:
Bash:
od -c /lib/libhardcode.so

od -x /lib/libhardcode.so

cat /lib/libhardcode.so | od -c

xxd /lib/libhardcode.so

hexdump /lib/libhardcode.so

cat /lib/libhardcode.so
Permission denied yemeyiz umarım, ya ufak 5 komut
$ od -c /lib/libhardcode.so
/bin/sh: od: not found
$
$ od -x /lib/libhardcode.so
/bin/sh: od: not found
$
$ cat /lib/libhardcode.so | od -c
/bin/sh: od: not found
cat: write error: Broken pipe
$
$ xxd /lib/libhardcode.so
/bin/sh: xxd: not found
$
$ hexdump /lib/libhardcode.so
/bin/sh: hexdump: not found
$
$ cat /lib/libhardcode.so
EL�4�p4 (p�����


��dt�Q�������
␦�� $

pppp
'0pp%0␦)
(% !-,*
/
"#$$�
���������C �@�p��8�`�\PE���d���!
�d�����d���
���␦@�␦0n␦� 4���␦ (␦3␦[�} �'�t�p���h���Up$a`P-@�0� :v<�_GLOBAL_OFFSET_TABLE__gp_dispmemsetfopenfgetsfclosesnprintfCspHardCodeVerGetfseekftellmallocstrncpyfreadAES_set_decrypt_keyAES_decryptstrlenfwritefreeCspHardCodeDecryCspHardCodeParamGetgetpidsyscallstrstrstrsepstrcmpunlinkCspHardCodeDecryDefaultKeyAES_set_encrypt_keyAES_encryptCspHardCodeEncryCspHardCodeEncryDefaultKey__start_init_fini__uClibc_main__data_startlibc.so.0_ftext_fdata_gp_edata__bss_start_fbss_end/home/workspace/chip_en7513/opensource/uclibc_release/lib<'�����!'��௼������'� <'��p��!'�����l��h��d����\����!�=��!���'� !(!$� $@�����������d$�␦� � $�␦ȏ�@,@�!���� !$@ � @0!�����T@ � ! � !�� !!$
$@�!�BGF$c$c���!�@e���!�������@ !(!$�␦� � '�����l��h��d����\'�p<'��0��!'��௿������ !'P � �(!����!'� <'�����!'�����l��h��d����\��X��T��P��L��H�����'���!��!��!@ !(! � $!�� !�!�$��������d � $�␦̏� !@�!������d � $�␦Џ�����<@�(!���|$ � � !�����X � � !��$���� � ��8��$���� � @�!��@�!��4����0@�� !���(! � $��� !(!���$ � $��(!@ !���t$ � �!��� !(!���| � 0!'�<����DI��@b*@w�#���l� !$0! � �8!��P@�![$���!��!��!@ �!$ � 0�#����D��@���� � $����@ !���0@(! � p�!��P�!�����@(!$� ��*"���4 � � !����<� !���<$@0! � @�!��@�!� !���(! � &���0��!��##$����!��8�*@���!���T��< � �!�����T � � !�����, � � !�����,#� !��<@"$��$����4��0���T��< � ������T � � !����4`���, � !����0@@ !���, � ����l!��h��d����\��X��T��P��L��H'�p��$��$����4�կ�0<'�����!'��௿�������$�����'9 � � ��@
@�!�������@(! � $�␦ԏ�$����!��'� <'��P��!'��P��
���
���
���
���
���
���
���
���
���
�����!��!��!����!��$�����'�d !(! � $��'�d@ !���(! � $��'�$ !���(! � $@�����4 � !��@�$����� !'P � $@��$@ !�������������$B␦�$�␦��� � �������� � ��$~���� � @�!�� !$����������$�
� � ����� !@0!���8 � (!��@'�d�������@(!r$����@ !(! � $�� !������d � $�␦ȏ�@A@�!^ (! � ���0!@8!���� !$ � �� � $�x � �� ��� !���@@0�(! � ��@ !���L � (!��@%�(!������ �0! � � !�����4 � � !� !��$B��$
����f$B��e����$���A�����'�t'� $T␦����$W����@ !$ � 0!�� !(!���`@��$���T � !�����p � '�d��!�������$����p � !��$����
���
���
���
���
���
���
���
���
���
�'�
�<'�����!'�����t��p��l��h��d�����'���!��! !(! � $��'� $@��� ! � (!�� !���'P � $@���� !�������������$B�$�␦�$�␦� � $��@ !(!���8 � 0!��t����p��l��h��d'�x<'�����!'�����l��h��d����\��X��T��P��L��H����!����!��������d � $��� !@�!������d � $�␦Џ���@�!@�$�����|(!$ � � !�����X � � !��$���� � ��<��$���� � @�!��@�!��8����4@�(!���'� ! � $!�� (! !���t$ � �!��� !(!���|0! � $'�<����DH��@b*@u�#���� !(! � $��� !(!��� � $��� !$���l 0! � �8!��Q��0K$����!�! �! � &�����D��@���� � $����@` !���P � @(!��0�#&R&s�����@(!��$􏙀<� !$ 0! � �8!��"#$����0��!��<�*@��5!���T� ! � �!�����T � � !�����, � � !�����,!� !@"$��$����8��4���T � � !������T � � !����8@���, � @ !����4 !���, � ����l!��h��d����\��X��T��P��L��H'�p��$��$���!��8�ԯ�4<'�����!'��௿�������������$�� � $����'9( � ��@@�!�������@(! � $�����!��'� <'��,��!'�����t��p��l��h��d�����'���!��! !(! � $��'� $@��� ! � (!�� !���'P � $@���� !�������������$B�$�␦�$�␦� � $��@ !(!���H � 0!��t����p��l��h��d'�x�!<'��$��!�!���\��'�$����$'���������D���������h � ������x! � $/����x! � $.����x! � $-����x! � $,����x! � $+����x! � $*����x! � $)����x! � $(����x! � $&����x! � $%����x! � $$����x! � $#����x! � $"����x! � $!����x! � $ ����x! � $����x! � $����x! � $����x! � $���x! � $␦����x! � $����x! � $����x! � $����x! � $����x! � $<'��0��!'��௼������'� /etc/hardcoderrbwb+
Csp HardCode Decry (%d).
%s%s%s0x02720x0105%s%d%lu/var/tmp/hardcodefile-decry
Csp HardCode Decry fail (%d).
=
Fail to open the file %s .
rb+
Input parameter is NULL.

Csp HardCode encry (%d).
����� p�������������$`P@0 P�����p ������ �������p
�8�����x(������p������ ������x$����� ␦������ GCC: (Buildroot 2012.05) 4.3.6GCC: (GNU) 3.3.2Agnu.symtab.strtab.shstrtab.reginfo.dynamic.hash.dynsym.dynstr.init.text.MIPS.stubs.fini.rodata.data.got.pdr.comment.gnu.attributes.mdebug.abi32��$

-��\3
; $(P�O���[␦�␦�(a2␦�␦��io�td�y0�0�o����d$$�!�` &D�
� P␦� ␦�


d�P@! �'(�-��-��8
��A�H
O����Xlu }�����0�@�P�`� �@$�p��8���\�pP�
��'�/�6�<�J�Pd��\�ch�n␦u␦�␦ ����!
�␦� �␦0�␦@���␦P���d���
�d��␦`␦pcsp_hardcode_api.c_HCGetVerValdecryencryinitfini.c_DYNAMICprintf_fdata_gp_dispAES_set_decrypt_keysnprintfsyscall_gpgetpidfgetsAES_set_encrypt_keymallocCspHardCodeVerGet_initCspHardCodeParamGetCspHardCodeDecryDefaultKey__startfseek_ftextstrstrCspHardCodeEncryDefaultKeystrncpyunlinkfread__uClibc_mainfopen__bss_startmemsetmainftellfcloseAES_encryptstrcmpCspHardCodeEncrydata_start_finistrsepfwrite_edata_GLOBAL_OFFSET_TABLE__endCspHardCodeDecrystrlen__data_start_fbssAES_decryptfree$ f
 
$ od -c /lib/libhardcode.so
/bin/sh: od: not found
$
$ od -x /lib/libhardcode.so
/bin/sh: od: not found
$
$ cat /lib/libhardcode.so | od -c
/bin/sh: od: not found
cat: write error: Broken pipe
$
$ xxd /lib/libhardcode.so
/bin/sh: xxd: not found
$
$ hexdump /lib/libhardcode.so
/bin/sh: hexdump: not found
$
$ cat /lib/libhardcode.so
EL�4�p4 (p�����


��dt�Q�������
␦�� $

pppp
'0pp%0␦)
(% !-,*
/
"#$$�
���������C �@�p��8�`�\PE���d���!
�d�����d���
���␦@�␦0n␦� 4���␦ (␦3␦[�} �'�t�p���h���Up$a`P-@�0� :v<�_GLOBAL_OFFSET_TABLE__gp_dispmemsetfopenfgetsfclosesnprintfCspHardCodeVerGetfseekftellmallocstrncpyfreadAES_set_decrypt_keyAES_decryptstrlenfwritefreeCspHardCodeDecryCspHardCodeParamGetgetpidsyscallstrstrstrsepstrcmpunlinkCspHardCodeDecryDefaultKeyAES_set_encrypt_keyAES_encryptCspHardCodeEncryCspHardCodeEncryDefaultKey__start_init_fini__uClibc_main__data_startlibc.so.0_ftext_fdata_gp_edata__bss_start_fbss_end/home/workspace/chip_en7513/opensource/uclibc_release/lib<'�����!'��௼������'� <'��p��!'�����l��h��d����\����!�=��!���'� !(!$� $@�����������d$�␦� � $�␦ȏ�@,@�!���� !$@ � @0!�����T@ � ! � !�� !!$
$@�!�BGF$c$c���!�@e���!�������@ !(!$�␦� � '�����l��h��d����\'�p<'��0��!'��௿������ !'P � �(!����!'� <'�����!'�����l��h��d����\��X��T��P��L��H�����'���!��!��!@ !(! � $!�� !�!�$��������d � $�␦̏� !@�!������d � $�␦Џ�����<@�(!���|$ � � !�����X � � !��$���� � ��8��$���� � @�!��@�!��4����0@�� !���(! � $��� !(!���$ � $��(!@ !���t$ � �!��� !(!���| � 0!'�<����DI��@b*@w�#���l� !$0! � �8!��P@�![$���!��!��!@ �!$ � 0�#����D��@���� � $����@ !���0@(! � p�!��P�!�����@(!$� ��*"���4 � � !����<� !���<$@0! � @�!��@�!� !���(! � &���0��!��##$����!��8�*@���!���T��< � �!�����T � � !�����, � � !�����,#� !��<@"$��$����4��0���T��< � ������T � � !����4`���, � !����0@@ !���, � ����l!��h��d����\��X��T��P��L��H'�p��$��$����4�կ�0<'�����!'��௿�������$�����'9 � � ��@
@�!�������@(! � $�␦ԏ�$����!��'� <'��P��!'��P��
���
���
���
���
���
���
���
���
���
�����!��!��!����!��$�����'�d !(! � $��'�d@ !���(! � $��'�$ !���(! � $@�����4 � !��@�$����� !'P � $@��$@ !�������������$B␦�$�␦��� � �������� � ��$~���� � @�!�� !$����������$�
� � ����� !@0!���8 � (!��@'�d�������@(!r$����@ !(! � $�� !������d � $�␦ȏ�@A@�!^ (! � ���0!@8!���� !$ � �� � $�x � �� ��� !���@@0�(! � ��@ !���L � (!��@%�(!������ �0! � � !�����4 � � !� !��$B��$
����f$B��e����$���A�����'�t'� $T␦����$W����@ !$ � 0!�� !(!���`@��$���T � !�����p � '�d��!�������$����p � !��$����
���
���
���
���
���
���
���
���
���
�'�
�<'�����!'�����t��p��l��h��d�����'���!��! !(! � $��'� $@��� ! � (!�� !���'P � $@���� !�������������$B�$�␦�$�␦� � $��@ !(!���8 � 0!��t����p��l��h��d'�x<'�����!'�����l��h��d����\��X��T��P��L��H����!����!��������d � $��� !@�!������d � $�␦Џ���@�!@�$�����|(!$ � � !�����X � � !��$���� � ��<��$���� � @�!��@�!��8����4@�(!���'� ! � $!�� (! !���t$ � �!��� !(!���|0! � $'�<����DH��@b*@u�#���� !(! � $��� !(!��� � $��� !$���l 0! � �8!��Q��0K$����!�! �! � &�����D��@���� � $����@` !���P � @(!��0�#&R&s�����@(!��$􏙀<� !$ 0! � �8!��"#$����0��!��<�*@��5!���T� ! � �!�����T � � !�����, � � !�����,!� !@"$��$����8��4���T � � !������T � � !����8@���, � @ !����4 !���, � ����l!��h��d����\��X��T��P��L��H'�p��$��$���!��8�ԯ�4<'�����!'��௿�������������$�� � $����'9( � ��@@�!�������@(! � $�����!��'� <'��,��!'�����t��p��l��h��d�����'���!��! !(! � $��'� $@��� ! � (!�� !���'P � $@���� !�������������$B�$�␦�$�␦� � $��@ !(!���H � 0!��t����p��l��h��d'�x�!<'��$��!�!���\��'�$����$'���������D���������h � ������x! � $/����x! � $.����x! � $-����x! � $,����x! � $+����x! � $*����x! � $)����x! � $(����x! � $&����x! � $%����x! � $$����x! � $#����x! � $"����x! � $!����x! � $ ����x! � $����x! � $����x! � $����x! � $���x! � $␦����x! � $����x! � $����x! � $����x! � $����x! � $<'��0��!'��௼������'� /etc/hardcoderrbwb+
Csp HardCode Decry (%d).
%s%s%s0x02720x0105%s%d%lu/var/tmp/hardcodefile-decry
Csp HardCode Decry fail (%d).
=
Fail to open the file %s .
rb+
Input parameter is NULL.

Csp HardCode encry (%d).
����� p�������������$`P@0 P�����p ������ �������p
�8�����x(������p������ ������x$����� ␦������ GCC: (Buildroot 2012.05) 4.3.6GCC: (GNU) 3.3.2Agnu.symtab.strtab.shstrtab.reginfo.dynamic.hash.dynsym.dynstr.init.text.MIPS.stubs.fini.rodata.data.got.pdr.comment.gnu.attributes.mdebug.abi32��$

-��\3
; $(P�O���[␦�␦�(a2␦�␦��io�td�y0�0�o����d$$�!�` &D�
� P␦� ␦�


d�P@! �'(�-��-��8
��A�H
O����Xlu }�����0�@�P�`� �@$�p��8���\�pP�
��'�/�6�<�J�Pd��\�ch�n␦u␦�␦ ����!
�␦� �␦0�␦@���␦P���d���
�d��␦`␦pcsp_hardcode_api.c_HCGetVerValdecryencryinitfini.c_DYNAMICprintf_fdata_gp_dispAES_set_decrypt_keysnprintfsyscall_gpgetpidfgetsAES_set_encrypt_keymallocCspHardCodeVerGet_initCspHardCodeParamGetCspHardCodeDecryDefaultKey__startfseek_ftextstrstrCspHardCodeEncryDefaultKeystrncpyunlinkfread__uClibc_mainfopen__bss_startmemsetmainftellfcloseAES_encryptstrcmpCspHardCodeEncrydata_start_finistrsepfwrite_edata_GLOBAL_OFFSET_TABLE__endCspHardCodeDecrystrlen__data_start_fbssAES_decryptfree$ f
Hocam güncelleme vereyim, nereye kadar geldik:
✅ Key string bulundu: H168AV2.0_TTN (cat /etc/hardcode ile)
✅ libhardcode.so içinde %s%s%s ve 0x02720x0105 prefix'i gördük
✅ Config.bin yapısı tam anlaşıldı, offset bulundu
❌ Tek eksik: Key'in tam olarak nasıl türetildiği
cat /lib/libhardcode.so çıktısında her şey vardı, çok işe yaradı!
Bir / birkaç adım kaldı:
cat /var/tmp/hardcodefile-decry
Bu dosya varsa içinde decode edilmiş değerler düz metin olarak yazar — key türetme mantığını anlayabiliriz.
Şu an config.bin'i açmaya çalışırken 64 byte'ın 33'ü okunabilir çıkıyor — yani %51. Açılmış olsaydı %90+ olması gerekirdi.



EOF
printable=30/64: iv=5666de2083302cf9
printable=33/64: iv=ae9f32d07d8f03b4 > %51
printable=32/64: iv=524f065039bf67d6
printable=31/64: iv=0000000000000000
printable=32/64: iv=0e99b3c71d04c8d4

$ od -c /lib/libhardcode.so
/bin/sh: od: not found
$
$ od -x /lib/libhardcode.so
/bin/sh: od: not found
$
$ cat /lib/libhardcode.so | od -c
/bin/sh: od: not found
cat: write error: Broken pipe
$
$ xxd /lib/libhardcode.so
/bin/sh: xxd: not found
$
$ hexdump /lib/libhardcode.so
/bin/sh: hexdump: not found
$
$ cat /lib/libhardcode.so
EL�4�p4 (p�����


��dt�Q�������
␦�� $

pppp
'0pp%0␦)
(% !-,*
/
"#$$�
���������C �@�p��8�`�\PE���d���!
�d�����d���
���␦@�␦0n␦� 4���␦ (␦3␦[�} �'�t�p���h���Up$a`P-@�0� :v<�_GLOBAL_OFFSET_TABLE__gp_dispmemsetfopenfgetsfclosesnprintfCspHardCodeVerGetfseekftellmallocstrncpyfreadAES_set_decrypt_keyAES_decryptstrlenfwritefreeCspHardCodeDecryCspHardCodeParamGetgetpidsyscallstrstrstrsepstrcmpunlinkCspHardCodeDecryDefaultKeyAES_set_encrypt_keyAES_encryptCspHardCodeEncryCspHardCodeEncryDefaultKey__start_init_fini__uClibc_main__data_startlibc.so.0_ftext_fdata_gp_edata__bss_start_fbss_end/home/workspace/chip_en7513/opensource/uclibc_release/lib<'�����!'��௼������'� <'��p��!'�����l��h��d����\����!�=��!���'� !(!$� $@�����������d$�␦� � $�␦ȏ�@,@�!���� !$@ � @0!�����T@ � ! � !�� !!$
$@�!�BGF$c$c���!�@e���!�������@ !(!$�␦� � '�����l��h��d����\'�p<'��0��!'��௿������ !'P � �(!����!'� <'�����!'�����l��h��d����\��X��T��P��L��H�����'���!��!��!@ !(! � $!�� !�!�$��������d � $�␦̏� !@�!������d � $�␦Џ�����<@�(!���|$ � � !�����X � � !��$���� � ��8��$���� � @�!��@�!��4����0@�� !���(! � $��� !(!���$ � $��(!@ !���t$ � �!��� !(!���| � 0!'�<����DI��@b*@w�#���l� !$0! � �8!��P@�![$���!��!��!@ �!$ � 0�#����D��@���� � $����@ !���0@(! � p�!��P�!�����@(!$� ��*"���4 � � !����<� !���<$@0! � @�!��@�!� !���(! � &���0��!��##$����!��8�*@���!���T��< � �!�����T � � !�����, � � !�����,#� !��<@"$��$����4��0���T��< � ������T � � !����4`���, � !����0@@ !���, � ����l!��h��d����\��X��T��P��L��H'�p��$��$����4�կ�0<'�����!'��௿�������$�����'9 � � ��@
@�!�������@(! � $�␦ԏ�$����!��'� <'��P��!'��P��
���
���
���
���
���
���
���
���
���
�����!��!��!����!��$�����'�d !(! � $��'�d@ !���(! � $��'�$ !���(! � $@�����4 � !��@�$����� !'P � $@��$@ !�������������$B␦�$�␦��� � �������� � ��$~���� � @�!�� !$����������$�
� � ����� !@0!���8 � (!��@'�d�������@(!r$����@ !(! � $�� !������d � $�␦ȏ�@A@�!^ (! � ���0!@8!���� !$ � �� � $�x � �� ��� !���@@0�(! � ��@ !���L � (!��@%�(!������ �0! � � !�����4 � � !� !��$B��$
����f$B��e����$���A�����'�t'� $T␦����$W����@ !$ � 0!�� !(!���`@��$���T � !�����p � '�d��!�������$����p � !��$����
���
���
���
���
���
���
���
���
���
�'�
�<'�����!'�����t��p��l��h��d�����'���!��! !(! � $��'� $@��� ! � (!�� !���'P � $@���� !�������������$B�$�␦�$�␦� � $��@ !(!���8 � 0!��t����p��l��h��d'�x<'�����!'�����l��h��d����\��X��T��P��L��H����!����!��������d � $��� !@�!������d � $�␦Џ���@�!@�$�����|(!$ � � !�����X � � !��$���� � ��<��$���� � @�!��@�!��8����4@�(!���'� ! � $!�� (! !���t$ � �!��� !(!���|0! � $'�<����DH��@b*@u�#���� !(! � $��� !(!��� � $��� !$���l 0! � �8!��Q��0K$����!�! �! � &�����D��@���� � $����@` !���P � @(!��0�#&R&s�����@(!��$􏙀<� !$ 0! � �8!��"#$����0��!��<�*@��5!���T� ! � �!�����T � � !�����, � � !�����,!� !@"$��$����8��4���T � � !������T � � !����8@���, � @ !����4 !���, � ����l!��h��d����\��X��T��P��L��H'�p��$��$���!��8�ԯ�4<'�����!'��௿�������������$�� � $����'9( � ��@@�!�������@(! � $�����!��'� <'��,��!'�����t��p��l��h��d�����'���!��! !(! � $��'� $@��� ! � (!�� !���'P � $@���� !�������������$B�$�␦�$�␦� � $��@ !(!���H � 0!��t����p��l��h��d'�x�!<'��$��!�!���\��'�$����$'���������D���������h � ������x! � $/����x! � $.����x! � $-����x! � $,����x! � $+����x! � $*����x! � $)����x! � $(����x! � $&����x! � $%����x! � $$����x! � $#����x! � $"����x! � $!����x! � $ ����x! � $����x! � $����x! � $����x! � $���x! � $␦����x! � $����x! � $����x! � $����x! � $����x! � $<'��0��!'��௼������'� /etc/hardcoderrbwb+
Csp HardCode Decry (%d).
%s%s%s0x02720x0105%s%d%lu/var/tmp/hardcodefile-decry
Csp HardCode Decry fail (%d).
=
Fail to open the file %s .
rb+
Input parameter is NULL.

Csp HardCode encry (%d).
����� p�������������$`P@0 P�����p ������ �������p
�8�����x(������p������ ������x$����� ␦������ GCC: (Buildroot 2012.05) 4.3.6GCC: (GNU) 3.3.2Agnu.symtab.strtab.shstrtab.reginfo.dynamic.hash.dynsym.dynstr.init.text.MIPS.stubs.fini.rodata.data.got.pdr.comment.gnu.attributes.mdebug.abi32��$

-��\3
; $(P�O���[␦�␦�(a2␦�␦��io�td�y0�0�o����d$$�!�` &D�
� P␦� ␦�


d�P@! �'(�-��-��8
��A�H
O����Xlu }�����0�@�P�`� �@$�p��8���\�pP�
��'�/�6�<�J�Pd��\�ch�n␦u␦�␦ ����!
�␦� �␦0�␦@���␦P���d���
�d��␦`␦pcsp_hardcode_api.c_HCGetVerValdecryencryinitfini.c_DYNAMICprintf_fdata_gp_dispAES_set_decrypt_keysnprintfsyscall_gpgetpidfgetsAES_set_encrypt_keymallocCspHardCodeVerGet_initCspHardCodeParamGetCspHardCodeDecryDefaultKey__startfseek_ftextstrstrCspHardCodeEncryDefaultKeystrncpyunlinkfread__uClibc_mainfopen__bss_startmemsetmainftellfcloseAES_encryptstrcmpCspHardCodeEncrydata_start_finistrsepfwrite_edata_GLOBAL_OFFSET_TABLE__endCspHardCodeDecrystrlen__data_start_fbssAES_decryptfree$ f
Hocam şunları da dener misiniz, hangisi varsa çıktısını albilirmiyim?:


cat /var/tmp/hardcodefile-decry
cat /var/tmp/hardcodefile-encry
ls /var/tmp/
cat /var/tmp/db_encrycopy.bin
cat /var/tmp/dbAesEncry
```"
 
Son düzenleme:
Hocam güncelleme vereyim, nereye kadar geldik:
✅ Key string bulundu: H168AV2.0_TTN (cat /etc/hardcode ile)
✅ libhardcode.so içinde %s%s%s ve 0x02720x0105 prefix'i gördük
✅ Config.bin yapısı tam anlaşıldı, offset bulundu
❌ Tek eksik: Key'in tam olarak nasıl türetildiği
cat /lib/libhardcode.so çıktısında her şey vardı, çok işe yaradı!
Bir / birkaç adım kaldı:
cat /var/tmp/hardcodefile-decry
Bu dosya varsa içinde decode edilmiş değerler düz metin olarak yazar — key türetme mantığını anlayabiliriz.
Şu an config.bin'i açmaya çalışırken 64 byte'ın 33'ü okunabilir çıkıyor — yani %51. Açılmış olsaydı %90+ olması gerekirdi.



EOF
printable=30/64: iv=5666de2083302cf9
printable=33/64: iv=ae9f32d07d8f03b4 > %51
printable=32/64: iv=524f065039bf67d6
printable=31/64: iv=0000000000000000
printable=32/64: iv=0e99b3c71d04c8d4


Hocam şunları da dener misiniz, hangisi varsa çıktısını albilirmiyim?:


cat /var/tmp/hardcodefile-decry
cat /var/tmp/hardcodefile-encry
ls /var/tmp/
cat /var/tmp/db_encrycopy.bin
cat /var/tmp/dbAesEncry
```"
$ cat /var/tmp/hardcodefile-decry
cat: can't open '/var/tmp/hardcodefile-decry': No such file or directory
$ cat /var/tmp/hardcodefile-encry
cat: can't open '/var/tmp/hardcodefile-encry': No such file or directory
$ ls /var/tmp/
rycopy.bin
cat /var/tmp/dbAesEncryAGENT.agent_asy dbdns.conf
AGENT.agent_snd deceive.conf
AGENT_oam default_resolv.conf
CLI.CLI01_asy default_resolv_proxy.conf
CLI.CLI01_snd dms.conf
CLI.CLI02_asy dmsd0._snd
CLI.CLI02_snd dns_policy.conf
CLI.CLI03_asy dnscache
CLI.CLI03_snd dnscomm.conf
CLI_oam edns0_custom.conf
HTTPD.tr069_task_asy firmware24g
HTTPD.tr069_task_snd firmware5g
HTTPD.webd_task_asy ftp_password.log
HTTPD.webd_task_snd hostnames
HTTPD_oam hosts
IGD.SNTP.PARMS igmp_proxy.igmpproxy_asy
MT7612E.dat igmp_proxy.igmpproxy_snd
PROCESSSSHD.dropbear_asy igmp_proxy_oam
PROCESSSSHD.dropbear_snd linux-igd
PROCESSSSHD_oam logcat_ctrl
PROCESSTELNETD.telnetd_asy logf_mgt0X0000005E
PROCESSTELNETD.telnetd_snd mqtt.01_asy
PROCESSTELNETD_oam mqtt.01_snd
RIP mqtt.02_asy
RT2860AP.dat mqtt.02_snd
chaninfo mqtt.03_asy
cspd.adev_task_asy mqtt.03_snd
cspd.adev_task_snd mqtt_oam
cspd.comm_task_asy multiapd.acd_asy
cspd.comm_task_snd multiapd.acd_snd
cspd.cspconfig_asy multiapd.base_asy
cspd.cspconfig_snd multiapd.base_snd
cspd.cspd_asy multiapd.map_asy
cspd.cspd_snd multiapd.map_snd
cspd.dbd_task_asy multiapd.topo_asy
cspd.dbd_task_snd multiapd.topo_snd
cspd.detect_task_asy multiapd_oam
cspd.detect_task_snd pc
cspd.dhcp4c_task_asy ppp
cspd.dhcp4c_task_snd pppd1._snd
cspd.dhcp6s_task_asy proxyserver.conf
cspd.dhcp6s_task_snd quantwifiagent_data
cspd.dhcps_task_asy ra_sendlog
cspd.dhcps_task_snd resolv.conf
cspd.dnsurl_asy rpcAgent
cspd.dnsurl_snd special_resolv.conf
cspd.easy_diag_asy syslog_data
cspd.easy_diag_snd syslog_mgt0X0000005E
cspd.log_task_asy unix_logf_data
cspd.log_task_snd upnp.dmsmgrtask_asy
cspd.srm_task_asy upnp.dmsmgrtask_snd
cspd.srm_task_snd upnp.dmsmsgtask_asy
cspd.syslog_task_asy upnp.dmsmsgtask_snd
cspd.syslog_task_snd upnp.upnptask_asy
cspd.wlan_manage_asy upnp.upnptask_snd
cspd.wlan_manage_snd upnp_oam
cspd.wwan_asy vsftp_fifo
cspd.wwan_snd wancid_realname_map.conf
cspd_oam
$ cat /var/tmp/db_encrycopy.bin
cat: can't open '/var/tmp/db_encrycopy.bin': No such file or directory
$ cat /var/tmp/dbAesEncry
cat: can't open '/var/tmp/dbAesEncry': No such file or directory
$ cat /var/tmp/hardcodefile-decry
cat: can't open '/var/tmp/hardcodefile-decry': No such file or directory
$
$ ls -l /var/tmp
srwxrwxrwx 1 Root root 0 Jan 1 1970 AGENT.agent_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 AGENT.agent_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 AGENT_oam
srwxrwxrwx 1 Root root 0 Jul 8 20:34 CLI.CLI01_asy
srwxrwxrwx 1 Root root 0 Jul 8 20:34 CLI.CLI01_snd
srwxrwxrwx 1 Root root 0 Jul 8 20:34 CLI.CLI02_asy
srwxrwxrwx 1 Root root 0 Jul 8 20:34 CLI.CLI02_snd
srwxrwxrwx 1 Root root 0 Jul 8 20:34 CLI.CLI03_asy
srwxrwxrwx 1 Root root 0 Jul 8 20:34 CLI.CLI03_snd
srwxrwxrwx 1 Root root 0 Jul 8 20:34 CLI_oam
srwxrwxrwx 1 Root root 0 Jan 1 1970 HTTPD.tr069_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 HTTPD.tr069_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 HTTPD.webd_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 HTTPD.webd_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 HTTPD_oam
-rw-r--r-- 1 Root root 201 Jul 8 19:16 IGD.SNTP.PARMS
-rwxr-xr-x 1 Root root 2326 Jan 1 1970 MT7612E.dat
srwxrwxrwx 1 Root root 0 Jan 1 1970 PROCESSSSHD.dropbear_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 PROCESSSSHD.dropbear_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 PROCESSSSHD_oam
srwxrwxrwx 1 Root root 0 Jan 1 1970 PROCESSTELNETD.telnetd_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 PROCESSTELNETD.telnetd_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 PROCESSTELNETD_oam
drwxr-xr-x 2 Root root 40 Jan 1 1970 RIP
-rwxr-xr-x 1 Root root 2159 Jan 1 1970 RT2860AP.dat
---------- 1 Root root 1541 Jul 8 20:37 chaninfo
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.adev_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.adev_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.comm_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.comm_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.cspconfig_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.cspconfig_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.cspd_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.cspd_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dbd_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dbd_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.detect_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.detect_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dhcp4c_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dhcp4c_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dhcp6s_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dhcp6s_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dhcps_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dhcps_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dnsurl_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.dnsurl_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.easy_diag_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.easy_diag_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.log_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.log_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.srm_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.srm_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.syslog_task_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.syslog_task_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.wlan_manage_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.wlan_manage_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.wwan_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd.wwan_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 cspd_oam
-r-xr-xr-x 1 Root root 0 Jan 1 1970 dbdns.conf
-r-xr-xr-x 1 Root root 47 Jan 1 1970 deceive.conf
-r-xr-xr-x 1 Root root 104 Jan 1 1970 default_resolv.conf
-r-xr-xr-x 1 Root root 116 Jan 1 1970 default_resolv_proxy.conf
-rw-r--r-- 1 Root root 452 Jan 1 1970 dms.conf
srwxr-xr-x 1 Root root 0 Jan 1 1970 dmsd0._snd
-r-xr-xr-x 1 Root root 78 Jan 1 1970 dns_policy.conf
-rw-r--r-- 1 Root root 276 Jul 8 19:16 dnscache
-r-xr-xr-x 1 Root root 32 Jan 1 1970 dnscomm.conf
-r-xr-xr-x 1 Root root 47 Jul 7 19:16 edns0_custom.conf
---------- 1 Root root 7 Jan 1 1970 firmware24g
---------- 1 Root root 7 Jan 1 1970 firmware5g
---------- 1 Root root 255 Jan 1 1970 ftp_password.log
-r-xr-xr-x 1 Root root 46 Jan 1 1970 hostnames
-r-xr-xr-x 1 Root root 116 Jan 1 1970 hosts
srwxrwxrwx 1 Root root 0 Jan 1 1970 igmp_proxy.igmpproxy_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 igmp_proxy.igmpproxy_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 igmp_proxy_oam
drwxr-xr-x 2 Root root 140 Jan 1 1970 linux-igd
srwxrwxrwx 1 Root root 0 Jan 1 1970 logcat_ctrl
srwxr-xr-x 1 Root root 0 Jan 1 1970 logf_mgt0X0000005E
srwxrwxrwx 1 Root root 0 Jan 1 1970 mqtt.01_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 mqtt.01_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 mqtt.02_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 mqtt.02_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 mqtt.03_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 mqtt.03_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 mqtt_oam
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.acd_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.acd_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.base_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.base_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.map_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.map_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.topo_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd.topo_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 multiapd_oam
srwxr-xr-x 1 Root root 0 Jan 1 1970 pc
drwxr-x--- 2 Root root 60 Jan 1 1970 ppp
srwxr-xr-x 1 Root root 0 Jan 1 1970 pppd1._snd
-r-xr-xr-x 1 Root root 242 Jan 1 1970 proxyserver.conf
srwxr-xr-x 1 Root root 0 Jan 1 1970 quantwifiagent_data
-rw-r--r-- 1 Root root 1450 Jul 8 20:34 ra_sendlog
-r-xr-xr-x 1 Root root 76 Jan 1 1970 resolv.conf
srwxr-xr-x 1 Root root 0 Jan 1 1970 rpcAgent
-r-xr-xr-x 1 Root root 0 Jan 1 1970 special_resolv.conf
srwxrwxrwx 1 Root root 0 Jan 1 1970 syslog_data
srwxr-xr-x 1 Root root 0 Jan 1 1970 syslog_mgt0X0000005E
srwxrwxrwx 1 Root root 0 Jan 1 1970 unix_logf_data
srwxrwxrwx 1 Root root 0 Jan 1 1970 upnp.dmsmgrtask_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 upnp.dmsmgrtask_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 upnp.dmsmsgtask_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 upnp.dmsmsgtask_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 upnp.upnptask_asy
srwxrwxrwx 1 Root root 0 Jan 1 1970 upnp.upnptask_snd
srwxrwxrwx 1 Root root 0 Jan 1 1970 upnp_oam
prw-r--r-- 1 Root root 0 Jan 1 1970 vsftp_fifo
-r-xr-xr-x 1 Root root 96 Jan 1 1970 wancid_realname_map.conf
$ find / -name "hardcode" 2>/dev/null
/bin/sh: can't create /dev/null: Permission denied