lördag 17 februari 2018

Deep dive into an old router to extract its password

The objectives:
I had an old ISP provided ADSL wifi router to spare. I was hoping to increase its value slightly by checking if I would be able to use one of the LAN ports as WAN port and ignore the ADSL part, but we were never given the credentials for logging in to the web UI. Challenge accepted! :)

The router:
Provided by Swedish ISP Boxer (later sold their ADSL service to AllTele)
Branded name: Inteno X5669A

Original name: Xavi X5669A-WP2 (closely related to WP2U, same model with USB ports - they share firmware)

Specification: ADSL 2+, 4x10/100 Mbit LAN, 802.11b/g wifi, 2xVoIP ports
Internal hardware:
- ADSL/router SoC: Broadcom BCM6358VKFBG
- Ethernet switch: Broadcom BCM5325EKQMG
- Wifi: Broadcom BCM4318KFBG
- VoIP: Legerity LE88221DLC
- 32mb RAM
- 8 mb Flash
Router was running CFE version 1.0.37-12.5
Firmware version was X5669A-WP2U_3.12UVNT10.08

Looking for the obvious...
(Unsuccessful stuff is greyed out, including it since it might have worked for other routers)

- Lots of googling, tried every default credential I could find and think of (admin/admin, admin/serialnumber, etc), or trying to find a firmware update of this or a similar router that might contain the default credentials. No luck.- Tried Telnet, SSH, etc - but these also required credentials.
- Contacted Boxer and AllTele asking for the default credentials - no luck.
- Using Firefox dev tools I was able to see in the HTTP headers which HTTP server it used, trying to find exploits of it but no luck
- Resetting to factory settings by holding reset for 10+ seconds - no luck, but curiously it changed the Wifi name from the previous Boxer_XX to Inteno_YYXX (XX amd YYXX being the last digits of the MAC address). This might have affected the password as well!

No luck... Time to open it up
- Opened it up, looking for serial port and JTAGs - yes to both!
- Bought a CP210x (USB to Serial adapter with 3.3 and 5V support) for like 15 SEK on ebay. Initially I didn't get it to work - first Windows 10 just spammed me with "the device has malfunctioned", until I tried a different USB port (maybe it had problems with USB 3). Then I needed drivers.
- Checked the settings of the device in device manager, I found that the COM port became called "COM6".
- Used multimeter to find ground pin of the serial (black on a grounded point on the PCB, red on each of the four pins. All but one shows 0 while the others shows 3.3V - that one is the ground. Then just took a semi-wild guess and actually picked the right pinout on the first go: "GROUND - NC - VCC (3.3V) - RX - TX" - the TX goes to the RX on the adapter and vice versa. Note: Never connect VCC pin.
- Tried to access the device with PuTTY. With cables connected as such, I just got a lot of garble. Changed the bit rate from the default to 115200, both in device settings in Windows and in PuTTy. Success - the CFE boot loader gave me a boot menu! :)

Using CFE
- Sadly, all of the obvious commands in CFE (such as "save") was not enabled in this version. There were plenty of commands to erase or write to Flash but that is not what I need.
- However, the CFE allowed download an image from TFTP to RAM, and run it from there... but what image to use?

OpenWRT to the rescue!
- OpenWRT supports at least the BCM63xx, so I created an Ubuntu VM, downloaded and installed the prerequisites and the code repository, selected the proper hardware (generic BCM63xx), "ramdisk" as target, and compression disabled.
- I then used Solarwinds free SFTP server on Windows box and hosted the OpenWRT image I built. I hooked the PC and the router with Ethernet cables.
- I configured CFE ("c" command) to a manually selected IP address of the PC, specified that it should boot from host ("h") instead of flash ("f").
- Got error code "-18".  Solarwinds log was empty. Removed a switch that sat between the router and the PC, and disabled the Windows firewall.
- Succes! OpenWRT was booting!

Getting the Flash content
- With OpenWRT running, I could use dd to copy the raw flash data from /dev/mtdX (X = 0-4) to files in the /tmp folder:
dd if=/dev/mtd0 of=/tmp/mtd0backup
- I could then use WinSCP to transfer the content to my PC.
- I then used a hex editor (HxD) to simply search for "user" and "password" in the flash image files. - In mtd1 I found quite a few interesting passwords, but the most interesting was [sysusername value="admin"] and [syspassword value="cGliNk9FWXZ5Qg=="]. (XML angle brackets replaced with square brackets because Blogger...
- The "==" at the end of the password makes it look like it is base64 encoded. Decoding it gave me the password "pib6OEYvyB".

And indeed, admin and pib6OEYvyB where the correct credentials for this device. Victory! :)

Further work...

And no... the current web UI doesn't allow using a LAN port as WAN port... :( Perhaps some configuration changes could be done to make it happen...
Would be nice to get OpenWRT running on this, though it seems from the wiki that it is not likely to have wifi drivers for this device (and ADSL and VoIP certainly wont work). I'll look closer into this another day...

Very thankful for OpenWRT, enabling stuff like this!

fredag 22 december 2017

Checklist for freshing up computer

I am wondering how much perfectly good computers are thrown out that could have been saved by a reinstallation of Windows (sometimes not even that).

This is what I do when someone asks me to have a look at their computer:

(Do everything behind a firewall and without any other devices in the network if there is a risk of it having a virus! If you KNOW it has a virus, deal with that first - worst case wipe hard drive using a safe, secure (but disposable) environment).

1. Is hardware OK?
Visual inspection, are fans clogged up?

Charger cable worn out? (often close to the connector at the PC end) - this can literally cause fires

Dust clogged up in fans? (Causes fans to spin faster to compensate, makes PC louder, hotter and the fan will break down sooner)

(start PC)

Does the fans sound healthy?

chkdsk X: /R (for each hard drive, C, D, etc).

Seagate SeaTools for Seagate hard drives

WD Windows Data Lifeguard (WinDLG) for all hard drives

Windows memory diagnostics (start menu -> type: mdsched)

Any serious errors - look closer into that part, make sure there is no false positive, replace any hardware determined to actually be bad

Bluescreens happening? Maybe some bad hardware, but more commonly caused by bad drivers. Enable further logs and investigate based on information in bluescreens.

If it can be done, upgrade to 4 gb ram or more and an SSD, SSHD or at least a 7200rpm drive.
Definitly make sure it has at least 80gb drive (death to absolutely useless 32gb eMMC!)

Check UEFI and firmware updates for other hardware from PC maker, hard drive firmware update from hard drive maker.

2. Is software OK?

What version of Windows is suitable?
- Windows XP - do not use! Upgrade if hardware can supports it
- Windows Vista - not as bad as people say but if you can, but pretty much zero drawbacks of upgrading at least to Windows 7
- Windows 7 - if user is happy, no problem keeping it, but can be upgraded to Windows 10 if user wants to.
- Windows 8, 8.1 - strongly recommend upgrading Windows 10

Note that if you have a legal license for Windows 7 and forward (e.g., it came with the computer), it can be upgraded to Windows 10 - you can simply download it from Microsoft's website. (DO NOT download it from any website not on "microsoft.com"). When asked for licence key, type the key on the sticker on the computer. Windows 10 installation will accept most keys for Windows 7 newer. If the Windows sticker on the computer does not have a licence key on it, the key is stored in the computer's UEFI (BIOS) and you can just click "I don't have a licence key" during the installation.

Even if Windows version is good or not, do the rest of the list first before upgrading, system needs to be healthy before upgrading


Make sure some virus software is running, at least Windows Defender. Make sure it and it's virus definitions are up to date. Run a full scan and make sure it is not finding anything.

Is Windows Update working properly? Sooner or later it tends to break in one way or another. Are recent updates installed? Is any update repeatedly being installed? Get those problems fixed.
Configure WU to "include software for all Microsoft software". Check for updates manually until it specifically says there are no more updates.

Disk clean up ("include system files")

Clean temp folders (disk clean up does usually not clear up everything)

Defrag (unless system is on SSD), check defrag is scheduled

For each web browser, disable every add-on/plugin that is useless. Make sure default home page and search engine is the one the user want to use.

Update drivers for everything (from PC maker and/or separate device manufacturers)

Make sure all partitions have at least 15% free space (except "recovery" partitions, boot system partitions etc

In Startup tab of Task Manager, disable everything useless

Check services and make sure there is nothing inappropriate running

Make sure computer is running the performance profile "Maximum performance"

Check BIOS/UEFI settings. Reconsider all settings that affect the priority between performance, noise and heat. (E.g. "best performance" vs "best acoustics". Usually make sure everything is set to best performance, then noise, then heat.
HP laptops often have option "Fan always on" - disable it. No reason to have fan running (and getting worn out) if the computer is not hot enough.

Update everything, such as Flash, Acrobat, Java, web browsers, and generally everything else that says it needs to be updated

Clear CCM cache - Control Panel -> Configuration Manager -> Cache

Use Task Manager and Resource Monitor to see which the hardware bottlenecks are, and what processes are taking the most resources. Disable theses processes by appropriate measuers (e.g. uninstalling useless applications).

3. Still sluggish?

Take a backup, wipe it, install Windows from scratch...

fredag 13 januari 2017

Dear all web developers out there... Can we talk about some things?

I use the web sometimes. Here are some practices that needs to end, now!.

1. Page scrolling up and down on mobile devices.
So I go to a long web page on your mobile device, sometimes not with the fastest connection. Top of the page loads, I scroll down. Since not all of the huge images and ads has loaded yet, the content scrolls up and down for ages until the page has finished loading. Developers, please pre-define the height of the content as much as possible (especially images) in the HTML so it doesn't have to be readjusted after the content has loaded!

2. Banners that scrolls the page
So there is some cookie warning or what not as a banner on top of the page. Please, don't make it so the entire page scrolls 30 pixels down just as I am about to click a link... (I'll appreciate any irony if there is such a cookie warning on this page. :-D )

3. Popups (aka modal dialogs)
A long time ago, pages used to open popups as new browser windows. People hated them, so browsers started blocking them. Then web designers started making in-page popups instead. Granted, there are many cases where this is perfectly fine. But to show errors or alerts or especially ads, are usually NOT. Even worse, the implementations are often slow and jerky and jumps around and the "X" icon are hard to find or moves around until the popup has finished loading. Please just integrate your message into the rest of the page instead!

4. Full screen ads appearing after I already started reading the page
See title. It just makes me hate your site and the advertiser more than otherwise. Especially if the scroll position is reset after I close the ad.

5. target=_blank
I know how to use "Open in new tab". If I clicked the link without selecting "Open in new tab", I did not want it to open in new tab. Open in same tab, please.

Let's make the world a better place! :)

lördag 12 november 2016

Intel SSD Toolbox - installation fails, reboots Windows before installation is completed

The problem:
I wanted to install Intel SSD Toolbox After clicking Next a few times in the wizard and the actual installation has started, Windows reboots and the installation is interrupted. Nothing of Intel SSD Toolbox is installedor changed.
Additionally, for each interrupted installation, a number of folders called "IIxxxx.tmp" (xxxx = random characters and numbers) are left in the C:\Windows\Temp folder, each containing 300+ MiB.

The cause:
The first thing the installer does, is to run the included vc_redist.x86.exe. This is the Visual C++ Redistributable runtime installer - essentially an installation program which installs a few DLLs that the toolbox apparently requires. On my computer, the VC++ runtime installer determined my computer needed to reboot. The Intel installer should have ran this installer with the command line that instructs the installer to suppress such reboots, but it does not.

The fix:
Download the installer.Run it.
Wait while "Please wait while setup initializes".
When the installer is waiting for you to hit Next at the first step, do NOT press it.
Instead, open C:\Windows\Temp.
Find the LAST folder (order by Modified date) called "IIxxxx.tmp". Check the modified time - it should be just a minute ago.
Open the Dependencies subfolder. It should contain a file called vc_redist.x86.exe file, and a few DLL files.
Rename the vc_redist.x86.exe file something else or delete it.
Find any other exe file - I picked C:\Windows\notepad.exe.
Copy it to the Dependencies folder and rename it to vc_redist.x86.exe.
Go back to the installation wizard and hit Next to let installation proceed.
Hopefully installation should be fine.
After completion, the installer will ask you properly to reboot. Do so.
After reboot, make sure to remove all of the "IIxxxx..tmp" folder in your Temp directory to avoid wasting disk space.
Complain to Intel that the installer has a bug.

Note: If the toolbox doesn't work properly, or if installation now fails at a later stage, you might have a problem with the VC++ runtimes. One thing to try then, is to follow the instructions above, but copy the vc_redist.x86.exe file to a separate folder and run it on its own by just double clicking it. It should show you a GUI offering to install, repair or uninstall the runtimes. You could also try downloading the runtimes from Microsoft.

Please leave me a comment if this helped you or not!

torsdag 1 september 2016

"Back to the Future: The Game" episodes 2-5 not downloading on iPad Mini

I played the first free episode of "Back to the Future: The Game" (1.6) on my iPad Mini (with iOS 9.3.5). Everything was fine and I decided to buy the bundle with episode 2-5. However, downloading the episodes (over wifi) persistently froze somewhere between 1% and 12%. After a long time, the game would then either close or give an error message about losing internet connection. I would then have to restart the download. I contacted Telltale's support, they responded quickly and with a lot of suggestions (restart the iPad, close all other apps, try another Wifi connection, keep trying, try a VPN), but neither of them made a difference.

I found this page where some people suggest using cellular data instead of wifi connection to get the episodes. That was not an option for me, as my iPad model is wifi only. However it gave me the idea to try to connect to the internet using internet sharing/tethering over Bluetooth from another device. Using Bluetooth internet sharing on my low end Lumia Windows Phone, I was able to download the episodes on the first attempt.
Note that similar Bluetooth internet sharing on an old HTC One M7 was not successful - the iPad was not able to connect to internet at all using that.

So - things to do if you suffer this issue:
- Contact Telltale support, even if you manage to solve this issue yourself using workarounds - if they do not know how many are having this issue, they wont fix it.
- Try either cellular data or Bluetooth internet sharing from another device, instead of Wifi, if you can.
- If it doesn't work over Bluetooth with your device - check if you have Internet connection at all over Bluetooth. If not, try another device, iOS is incompatible with many devices.
- Demand a refund if neither of the above helps.
- Mention this issue on App Store review etc.

Don't hesitate to leave a comment if this helped you or not!

lördag 4 januari 2014

Howto: Changing region on PS1 savegames

Maybe like me you have a bunch of PS1 games of PAL region, that you have replaced with the often much better NTSC U/C versions? Then you should know that while the PS1 memory cards are region free and can contain save games of mixed regions, the savegames themselves have regional tags set on them so that savegames made by a different regional version of a game while always show up as generic "used block" as if it was created by any other game.

Fortunatelly, for plenty of PS1 games, it is possible to change the region of savegames.

It should NOT matter if the game is a "PSOne classic" from PSN or a  physical game. It should not matter if the game is "Greatest hits"/"Platinum" or not etc.
It DOES matter if the game has any kind of in-game differences - if the game actually expect different data in the savegame, anything could happen, so keep a backup of the original savegame, as well as all other save games on the memory card. I play on PS3 so I have one virtual card for each game.
I have tried converting 4 games so far from PAL to NTSC (FF1, FF4, Medal of Honor, Breath of Fire IV), no problems so far.
I have no idea of the success rate converting to and from Japanese saves!
Also note that it is impossible to via PS1/2/3 browsers/memory card utilities see the difference between the different regionalities so try to keep them appart so you don't get them mixed up. These browsers will always concider saves of different regions as from different game, so they are always possible to have side-by-side but since their icons and names will not differ it might get confusing.

You will need a way to get savegames from and to a Windows PC - DexDrive, a PS2 that can run ULaunchElf or some Game Genie or such, the PS3 Memory Card adapter, USB stick, etc. Best option depends on your situation and available hardware.

* Download MemCardRex from: http://shendosoft.blogspot.se/ .

* Start the game of the "target" region. Create a dummy save on an empty memory card. Many games have virtual "slots", if possible you should create saves in the same "slot" as your real save game.

* Use any method to copy both the original save games as well as the dummy save games to and from a Windows PC.

* In MemCardRex, select Edit -> "Import save". Open the dummy save.

* Right click on the imported save, and click "Edit save header".

* Note all of the values. SCxS-yyyyy is the product name under which the game was sold as in the region. "x" is E for Europe (PAL), U for NTSC U/C, P for NTSC Japan. yyyyy is a five digit number, each games number is different for every region. Also note the Identifier, which is a string the game use to separate its own games. A few games contain region in this string as well (for example Breath of Fire 4 has "BOF4xxyy" where xx is the "slot" (00-14) and yy is the region (US for US, PL for PAL, unknown for Japan).

* Now import the original save, and select Edit save header, and change the SCxx-xxxxx, the region dropdown, and if needed, the regional code in the ID.

* Right-click and select "Export save". Select an appropriate format. Since the product code (SCxx-xxxxx) is a part of the file names, it is normal that the exported file has a different file name than the original one.

* Move the modified game to your memory card.

* In PS1/2/3 interface, save has garbled graphics and/or text - the save file is completely invalid. Check which format you exported the save from in MemCardRex, and check how you copied it to your PS1 memory card.

* Save looks fine in PS1/2/3 interface, but game only shows save as a block used by another game: Check that all the regional parameters were changed to the values corresponding with the "target" region.

* Save looks fine in PS1/2/3 interface, but game crashes or glitches when reading the memory card, when loading a savegame, or later during gameplay. Or, there are items missing in inventory, you are on the wrong level or in the wrong state - the save is probably not compatible with the new region.

Hope this was of use to anyone!

onsdag 10 juli 2013

Nvidia nForce4 / geforce 6150 LE crashing

I had an old Fujitsu-Siemens Esprimo E5615, which has a Nvidia nForce 410 or 430 chipset, with integrated GeForce 6150LE, running Windows 7 64-bit and the latest drivers supporting the GPU (version 307.83, according to Windows Update, Nvidia Update och Nvidia website)

The problem:
* When playing movies encoded with VC-1 in Windows Media Player, the video would not be displayed properly and within seconds the computer froze, the graphics driver crashed, or I got a blue screen with various messages, often with a message that the graphics drivers timed out and could not be restarted.

* When calculating the Windows Experience Index, the computer crashed in similar ways during the "Windows Media" assessment.

The cause:
This seems to be an issue with the graphics driver, which crash on hardware accelerated VC-1 decoding. Note that the WEI crash while invisibly decode a VC-1 encoded file, "Clip_1080_5sec_VC1_15mbps.wmv", in C:\Windows\Performance\WinSAT. (SAT = System AssessmentTool).

* Ignore the WEI and don't watch VC-1 files :)

* Get an older driver. For example, 285.79 (beta) seems to work while 296.10 (whql) does not, so somewhere between there, the bug was introduced. Obviously, any improvements done to the driver after will dissappear

* Disable video hardware acceleration. This can be done in Windows Media Player -> menues (press Alt to make them appear) -> Performance tab -> Tools -> Options -> uncheck "Turn on DirectX Video Acceleration for WMV files". This will fix WEI and will make VC-1 videos play without crashing, but these, and all other WMV files will no longer have hardware acceleration and thus worse performance. (Note: DirectX Video Acceleration = DXVA). If other applications use DXVA, these may have to have hardware acceleration disabled as well.

* Get another GPU if the computer has expansion ports. :) Make sure to get one that doesn't demand more than your power supply can handle. Remember to disable the 6150 (so it doesn't take up RAM and other resources) and uninstall its drivers.

If you have a better workaround, please let me know :)

Other ideas:
Some things that I tried that didn't help me in this case but might help someone else:

* Run Memtest86+. Faulty RAM is the cause of many strange problems.

* You can run WEI in console mode, just open a command prompt as administrator and run "winsat". It has various parameters to output reports and to only run particular tests. run "winsat -?" to show all parameters. Run "winsat >> c:\somelogfile.txt" to generate a log file. Also note that winsat can generate some XML report. This lets you troubleshoot various issues that happens during WEI problems.

* If the computer just restart with no explanation, maybe you got a bluescreen and the computer has been configured to restart automatically on errors. To change this, hold Win + Pause/Break button (in the upper right corner of your keyboard) -> Advanced system settings -> Startup and Recovery -> Settings -> uncheck "Automatically restart".

* Also try VMT, video memory stress test, from http://www.mikelab.kiev.ua/index.php?page=PROGRAMS/vmt . Like memtest but will run on the graphics RAM.

* Note that the drivers included in the nForce4 driver package is ancient, so answer "no" to the questions if you want to install them in the installation wizard of the nForce4 drivers.

* The nForce4 seems to have some problems with random hard drive corruption. If you have this chipset, try taking a big file and make multiple copies of it, preferably back and forth between two different (internal) hard drives, then run "comp" to ensure they are all identical.