Или System on a Chip. Впервые прочитал у Алекса и не смог сдержаться. PQI AirCard выглядит как SD карточка, в которую вставляется microSD (16G версия стоила 60 баксов). Вставленная в устройство начинает раздавать содержимое по WiFi - после чего можете забыть про датакабели. Стартует и поднимает WiFi меньше чем за пол минуты. После чего всё что внутри становится доступным на 192.168.1.1. Главная проблема - выключение самого девайса по неиспользованию, которое рекомендуется сильно увеличить либо вообще убрать. Управлять с фотоаппарата можно удаляя 3 специальных фотографии: включить хотспот, подключиться к первому доступному хотспоту из списка, сбросить устройство. Для безопасности можно задать пароль на WPA2 (на работе спокойно подключился, но дома начались какие-то гоны и пришлось сбросить устройство). В маркете или сторе можно скачать приложение с функциональностью аналогичной веб-интерфейсу.Дальше идет лог того, что удалось выковырять из устройства:
Открытые порты
➜ ~ nmap 192.168.1.1 Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-07 07:57 NOVT Nmap scan report for air.card (192.168.1.1) Host is up (0.050s latency). Not shown: 997 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.94 seconds
Синхрониться можно по FTP, скорость скачивания в два потока достигала 1.5 Мб/c ➜ ~ ftp 192.168.1.1 Connected to 192.168.1.1. 220 Operation successful Name (192.168.1.1:constantine): anonymous 230 Operation successful Remote system type is UNIX. Using binary mode to transfer files. ftp> cd sd/DCIM/199_WIFI/ 250 Operation successful ftp> get SDC10108.JPG local: SDC10108.JPG remote: SDC10108.JPG 200 Operation successful 150 Opening BINARY connection for SDC10108.JPG (5029763 bytes) 226 Operation successful 5029763 bytes received in 5.14 secs (955.4 kB/s)
В папке mtd лежат всяческие конфиги ftp> cd /mtd 250 Operation successful ftp> ls 200 Operation successful 150 Directory listing drwxrwxrwx 2 0 0 0 Jan 1 00:00 config -rwxrwxrwx 1 0 0 0 Dec 31 1979 wifilist.txt 226 Operation successful ftp> cd config 250 Operation successful ftp> ls 200 Operation successful 150 Directory listing -rwxr--r-- 1 0 0 102 Jan 1 00:00 cimgconf -rwxr--r-- 1 0 0 21 Jan 1 00:00 dnsd.conf -rwxr--r-- 1 0 0 328 Jan 1 00:00 udhcpd.conf -rwxr--r-- 1 0 0 414 Jan 1 00:00 wsd.conf -rwxr--r-- 1 0 0 414 Jan 1 00:00 wsd_backup.conf ftp> bye 221 Operation successful Телнет без пароля ➜ ~ telnet 192.168.1.1 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'.
Файловая система, многие бинарники фейковые
# ls /
bin etc lib mnt sbin usr
config_value home linuxrc proc sys var
dev init lost+found root tmp www
# ls /bin/
ash cp hello_ka iptunnel mknod rev uaputl
athtestcmd date hostname iwconfig mount rm umount
base64 df ifrename iwevent mpstat rmdir usleep
bash dmesg ionice iwlist mv sh vi
boa dnsdomainname iostat iwpriv netstat sleep wmiconfig
boa_indexer echo ip kill ping sta wpa_supplicant
busybox egrep ipaddr ln powertop stat
cat fgrep iplink ls printenv sync
chmod fsync iproute macaddr ps tcmd
chown grep iprule mkdir pwd touch
# ls /sbin
acpid blockdev devmem insmod modinfo route udhcpc
arp bootchartd ifconfig logread modprobe sysctl vconfig
blkid depmod init lsmod rmmod syslogd
# ls /usr/bin/
a0 md5sum tftpd
a1 mesg thumbNail
a1_ap microcom thumbNail_android
a1a mount_sd thumbnail_video
a2 mptest.sh timeout
a3 mrgtmp0 top
a3a mtdf tr
arping mtdm uap
beep nc udpsvd
buzzer nslookup unlzop
clear p2p_client unxz
client_t p2p_server uptime
cmp perl ver
copy_control_images_to_nor.sh pkill volname
dirname pmap w1
download printf w2
du pscan w2_old
dumpleases rcS1 w2_t
env rcS2 w3
f1 rcS3 w3_adhoc
factory_reset.sh rcS4 w3_wifi_auto_on
fgconsole rcS5 w3es
find rcS6 w4
flock rcS7 w5
ftpget readahead wall
ftpput refresh_sd wget
gen_hostapd_conf.pl renice which
hexdump restore_all_control_images.sh wifi_connect_router
hostapd seq wifi_download
i0 sha256sum wifi_filelist
i1 sha512sum wifi_ftp_server
id showkey wifi_ftp_upload
ifplugd smemcap wifi_get_config
kcard_app softlink wifi_quick_send
kcard_cmd t1 wifi_receiver
kcard_startup t2 wifi_sender
logger tcpsvd wifi_upload
lspci telnet xargs
lsusb test_wireless1.sh xz
lw.sh test_wireless2.sh xzcat
lzopcat tftp
# ls /usr/sbin
brctl fakeidentd flash_unlock httpd iwlist ntpd setfont
dhcprelay flash_eraseall flashcp inetd nbd-client popmaildir telnetd
dnsd flash_lock ftpd iwconfig ncftpput rdev udhcpd
Содержимое веб интерфейса
# ls /www/
cgi-bin page
frame1.html page.html
frame2.html postconfig.html
hello.html script
images sd
index.html test_uploadto.html
mtd uploadto.html
multi_download_decode.jar
# ls /www/cgi-bin/
ftpsend.conf kcard_status.pl thumbnail_video
get_config.pl kcard_upload.pl update_hostapd.pl
get_macad.pl kcard_video.cgi uploadto
kcard_client_start.pl post_config.cgi wifi_download
kcard_edit_config.pl preview_photo.cgi wifi_filelist
kcard_login.pl preview_video.cgi wifi_upload
kcard_photo.cgi thumbNail
kcard_save_config.pl thumbNail_android
Файл создать можно, но после рестарта всё сотрется
# cd /www
# touch test.html
# ls
cgi-bin page
frame1.html page.html
frame2.html postconfig.html
hello.html script
images sd
index.html test.html
mtd test_uploadto.html
multi_download_decode.jar uploadto.html
# ls /www
cgi-bin page
frame1.html page.html
frame2.html postconfig.html
hello.html script
images sd
index.html test_uploadto.html
mtd uploadto.html
multi_download_decode.jar
Внутри бизибокс
# busybox
BusyBox v1.18.5 (2012-05-03 19:53:21 CST) multi-call binary.
Copyright (C) 1998-2009 Erik Andersen, Rob Landley, Denys Vlasenko
and others. Licensed under GPLv2.
See source distribution for full notice.
Usage: busybox [function] [arguments]...
or: busybox --list[-full]
or: function [arguments]...
BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.
Currently defined functions:
arp, arping, ash, bash, boa, boa_indexer, bootchartd, buzzer, cat, chmod, cp, date, df, dhcprelay,
dmesg, dnsd, dnsdomainname, dumpleases, echo, egrep, env, fgrep, find, ftpd, ftpget, grep, hostname,
ifconfig, inetd, init, insmod, iwconfig, iwlist, iwpriv, kcard_app, kcard_cmd, kcard_startup, kill,
linuxrc, ln, ls, lsmod, macaddr, mesg, mkdir, mount, mv, nslookup, perl, ping, pkill, ps, pwd,
readahead, rm, rmdir, rmmod, route, sh, sleep, sync, tcpsvd, telnetd, thumbNail, thumbNail_android,
thumbnail_video, touch, udhcpc, udhcpd, umount, wget, which, wifi_connect_router, wifi_download,
wifi_filelist, wifi_ftp_server, wifi_ftp_upload, wifi_get_config, wifi_quick_send, wifi_upload, xargs
Перл
# perl -version
This is perl 5, version 14, subversion 1 (0x183190) built for unknown
Copyright 1987-2011, Larry Wall
Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.
Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl". If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.
Всякая системная инфа
# dmesg
Linux version 2.6.32.28 (root@ubuntu-desktop) (gcc version 4.5.2 (Sourcery G++ Lite 2011.03-42) ) #244 PREEMPT Mon Jun 11 11:39:31 CST 2012
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00057177
CPU: VIVT data cache, VIVT instruction cache
Machine: KeyASIC Ka2000 EVM
Memory policy: ECC disabled, Data cache writeback
On node 0 totalpages: 8192
free_area_init_node: node 0, pgdat c049da24, node_mem_map c0000000
DMA zone: 64 pages used for memmap
DMA zone: 0 pages reserved
DMA zone: 8128 pages, LIFO batch:0
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128
Kernel command line: root=/dev/ram0 rw console=ttyS0,38400n8 mem=32M initrd=0x500000,3M
PID hash table entries: 128 (order: -3, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 32MB = 32MB total
Memory: 26632KB available (2472K code, 192K data, 76K init, 0K highmem)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:64
(192-96-1)pclk rate 96000000
time setup irq clockevent PWM T1
time setup irq 22
time32_config 0 done
time32_config 1 done
clocksource mult -1411382395 shift 22
clocksevent mult 124940 shift 32
ka2000_set_mode 1
ka2000_set_mode 2
console [ttyS0] enabled
Calibrating delay loop... 421.06 BogoMIPS (lpj=2105344)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
cfg80211: Calling CRDA to update world regulatory domain
Switching to clocksource timer0_1
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
KA2000 unpack_to_rootfs c0500008 size 277e7d
ttyS0 at MMIO 0xa0004000 (irq = 1) is a KA2000
JFFS2 version 2.2. (NAND) 2001-2006 Red Hat, Inc.
msgmni has been set to 52
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
brd: module loaded
loop: module loaded
m25p80 spi0.0: mx25l6405d (8192 Kbytes)
Creating 2 MTD partitions on "SPI NOR Flash Partition1":
0x000000080000-0x000000180000 : "SPI NOR Flash Partition1"
0x000000200000-0x000000680000 : "SPI: kernel"
TCP cubic registered
NET: Registered protocol family 17
lib80211: common routines for IEEE802.11 drivers
lib80211_crypt: registered algorithm 'NULL'
Freeing init memory: 76K
(0>0)switch_modules
init bomb irq
Bypass Flag En=0
req irq 40 (1010000)
req irq 43 (40)
req irq 41 (43)
ka_sdhc_drv_init
bw = 2
mmc0: new SDHC card at address b368
mmcblk0: mmc0:b368 CAR 14.9 GiB
mmcblk0:bootsec @ 2000
p1
FAT sec 22c sz eea #2 rtdir 2000 csz 40
umount
FAT sec 22c sz eea #2 rtdir 2000 csz 40
(0>1)pwm set 0
pwm set 33685506
dcim c 3 @4040, f:222c (off 445808)
Folder: 199_WIFIWSD00001WSD00002WSD00003 (5f393931 49464957)
Img1: WSD00001WSD00002WSD00003 (30445357 31303030)
Img2: WSD00002WSD00003 (30445357 32303030)
Img3: WSD00003 (30445357 33303030)
pwm set 0
pwm set 17432676
user_dir:(00000000 00000000)(00000000 00000000)
pwm set 17432577
pwm set 17432676
ctrlimg c 6f4e2 @1bd7800, f:3015 (off 602b84)
pwm set 17432968
pwm set 17432676
1 c 6f4e4-6f4e6 @1bd7880 f:3015(o:100)pwm set 17432577
pwm set 16842753
fat cnt 2, x0, pBuf1 c177e400, pBuf2 0(0)
2 c 6f4e6-6f4e8 @1bd7900 f:3015(o:102)
fat cnt 2, x0, pBuf1 c177e400, pBuf2 0(0)
3 c 6f4e8-6f4ea @1bd7980 f:3015(o:104)
fat cnt 2, x0, pBuf1 c177e400, pBuf2 0(0)bomb reg 222c - 3116
st 6f481, 1:100, 2:102, 3:104, 4:0, 5:0
bomb reg 222c - 3116
(1>0)sdio wakeup
mmc1: queuing CIS tuple 0x01 length 3
mmc1: queuing CIS tuple 0x1a length 5
mmc1: queuing CIS tuple 0x1b length 8
mmc1: queuing CIS tuple 0x14 length 0
set bus width 4
mmc1: queuing CIS tuple 0x80 length 1
mmc1: queuing CIS tuple 0x81 length 1
mmc1: queuing CIS tuple 0x82 length 1
mmc1: new SDIO card at address 0001
AR6000: configuration opcode 7 is only used for RTOS systems, not Linux systems
AR6K: ** HIF layer does not support scatter requests (17)
wmi_control_rx() : Unknown id 0x101e
channel hint set to 2412, freq->e 0, m 1
Add Filter 0 = 01:00:5e:00:00:01
Keep Filter 0 = 01:00:5e:00:00:01
Keep Filter 0 = 01:00:5e:00:00:01
pwm set 0
pwm set 33685506
Процессы
# ps w
PID USER VSZ STAT COMMAND
1 0 1584 S init
2 0 0 SW [kthreadd]
3 0 0 SW [ksoftirqd/0]
4 0 0 SW [events/0]
5 0 0 SW [khelper]
6 0 0 SW [async/mgr]
7 0 0 SW [sync_supers]
8 0 0 SW [bdi-default]
9 0 0 SW [kblockd/0]
10 0 0 SW [kmmcd]
11 0 0 SW [uart tx/0]
12 0 0 SW [spi_KeyAsic_ssi]
13 0 0 SW [kswapd0]
14 0 0 SW [aio/0]
15 0 0 SW [crypto/0]
30 0 0 SWN [jffs2_gcd_mtd0]
32 0 0 SW [switch/0]
34 0 0 SW [mmcqd]
46 0 1572 S kcard_app
59 0 1568 S tcpsvd 0 21 ftpd -w /mnt/
64 0 1572 S telnetd -l /bin/sh
71 0 1604 S boa
78 0 0 SW [AR6K Async]
82 0 1584 S init
83 0 0 SW [ksdioirqd/mmc1]
101 0 1580 S dnsd -c /etc/dnsd.conf -d
105 0 1572 S udhcpd /etc/udhcpd.conf
119 0 1576 S inetd
130 0 1592 S /bin/sh
141 0 1568 R ps w
Сеть
# ifconfig
mlan0 Link encap:Ethernet HWaddr B0:38:29:01:79:23
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1827 errors:0 dropped:0 overruns:0 frame:0
TX packets:2243 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:217903 (212.7 KiB) TX bytes:1706046 (1.6 MiB)
Файловые системы
# df
Filesystem 1K-blocks Used Available Use% Mounted on
/dev/mtdblock0 1024 200 824 20% /mnt/mtd
/dev/mmcblk0p1 15637504 516576 15120928 3% /mnt/sd
Конфиги
# ls /etc/
boa inittab version.txt
cimgconf mime.types wep.conf
dhcp.script mtab wpa.conf
dnsd.conf rc.conf wpa_supplicant.conf
fstab uaputl.conf wsd.conf
hostname udhcpd.conf wsd_backup.conf
init.d udhcpd_uap.conf
# cat /etc/version.txt
Product Name : PQI Air card
Firmware Version : V138 JUN132012 M
Build Date : 13 JUN 2012
Revision : 2
WiFi Model : Atheros AR6003 11n
Linux Kernel : 2.6.32.28
Busybox : 1.18.5
# cat /etc/fstab
#/dev/root / auto defaults,errors=remount-ro 0 0
#none /proc proc defaults 0 0
none /dev/pts devpts mode=0622 0 0
/dev/mmcblk0p1 /mnt/sd vfat defaults 1 1
Системная инфа
# cat /proc/cpuinfo
Processor : ARM926EJ-S rev 5 (v5l)
BogoMIPS : 421.06
Features : swp half fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 5
Hardware : KeyASIC Ka2000 EVM
Revision : 0000
Serial : 0000000000000000
# cat /proc/meminfo
MemTotal: 26708 kB
MemFree: 14680 kB
Buffers: 1948 kB
Cached: 6736 kB
SwapCached: 0 kB
Active: 4676 kB
Inactive: 4528 kB
Active(anon): 520 kB
Inactive(anon): 0 kB
Active(file): 4156 kB
Inactive(file): 4528 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 548 kB
Mapped: 368 kB
Shmem: 0 kB
Slab: 1420 kB
SReclaimable: 544 kB
SUnreclaim: 876 kB
KernelStack: 248 kB
PageTables: 88 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 13352 kB
Committed_AS: 2496 kB
VmallocTotal: 825344 kB
VmallocUsed: 324 kB
VmallocChunk: 824256 kB
Убунта десктоп, на устройстве размером с флешку? Нет пути
# cat /proc/version
Linux version 2.6.32.28 (root@ubuntu-desktop) (gcc version 4.5.2 (Sourcery G++ Lite 2011.03-42) ) #244 PREEMPT Mon Jun 11 11:39:31 CST 201
