0x888e / certs

Extracts certificates from BGW210 and BGW320 routers
MIT License
41 stars 3 forks source link

clarification on mfg_dat_decode instructions #2

Closed JollyRgrs closed 2 months ago

JollyRgrs commented 2 months ago

Not sure where else to put this, but maybe in the instructions help spell it out for some of us who aren't so smart. When running mfg_dat_decode, I read the readme and it said "3. Copy mfg.dat or calibration_01.bin"

In reality, calibration_01.bin causes an error 255 when running mfg_dat_decode and further, there is no "or" as if you have only the calibration_01.bin and not the mfg.dat file, you also get the 255 error.

0x888e commented 2 months ago

calibration_01.bin is really only relevant on the BGW320. You can delete the file if you're extracting on a BGW210.

To be explicit:

If mfg_dat_decode fails, it's probably because the calibration_01.bin or mfg.dat files weren't fully downloaded / are invalid. calibration_01.bin should be 16,384 bytes (16K). mfg.dat should be 262,144 bytes (256K).

I can update the README at some point. Thanks for pointing this out.

wxyangf commented 2 months ago

heya, same issue here

Here's the bit counts of the files, tried dump 2x to make sure it wasn't invalid and it seems good asfaict

drwxr-xr-x 3 wxf users   4096 Sep 14 11:51 .
drwxr-xr-x 3 wxf users   4096 Sep 14 10:34 ..
-rw-r--r-- 1 wxf users    913 Sep 14 11:48 attroot2031.der
-rw-r--r-- 1 wxf users   1061 Sep 14 11:48 attsubca2021.der
-rw-r--r-- 1 wxf users   1015 Sep 14 11:48 attsubca2030.der
-rw-r--r-- 1 wxf users  16384 Sep 14 11:48 calibration_01.bin
-rw-r--r-- 1 wxf users   9216 Sep 14 10:34 download.py
drwxr-xr-x 8 wxf users   4096 Sep 14 10:34 .git
-rw-r--r-- 1 wxf users    551 Jun  1  2021 it_does_not_work.txt
-rw-r--r-- 1 wxf users   1063 Sep 14 10:34 LICENSE
-rw-r--r-- 1 wxf users 262144 Sep 14 11:48 mfg.dat
-rwxr-xr-x 1 wxf users 961072 Aug  6  2021 mfg_dat_decode
-rw-r--r-- 1 wxf users   8188 Sep 14 10:34 README.md
-rw-r--r-- 1 wxf users   1781 Jun  1  2021 readme.txt

Here's the logs from download.py run with Python 3.11.9 on Linux

[+] BGW-210 and BGW-320 mfg/calibration download (for bypass EAP certificates)
[+] ----------------------------------------
[+] Connect your machine directly to LAN1 on the BGW.
[+] Ensure no other interface on your machine is configured for the 192.168.1/24 subnet.
[+] Configure the IP address of the NIC on your machine to:
[+] IP: 192.168.1.11
[+] Subnet: 255.255.255.0
[+] Gateway: 192.168.1.254
[+] ----------------------------------------
[+] Press Ctrl+C to exit.
[+] ----------------------------------------
[+] Waiting for the BGW to come online...
[+] BGW is online. Determining eligibility...
[+] Firmware compatible. Configured model: BGW210
[+] ----------------------------------------
[+] *** REBOOT THE BGW210 NOW ***
[+] (This may take up to 3 minutes. After 3 minutes, keep this running and press and release the red reset button on the back of the BGW. NOTE: Do not hold this button down for more than a second as it will factory reset the BGW.)
[+] ----------------------------------------
[+] Worker 1 starting.
[+] Worker 0 starting.
[+] Worker 1 exiting.
[+] Worker 0 exiting.
[+] Download successful. File written to mfg.dat
[+] BGW210 Calibration data written to calibration_01.bin

Here's the dump from mfg_dat_decode which is the same error on both Linux and Window

802.1x Credential Extraction Tool
Copyright (c) 2018-2021 devicelocksmith.com
Version: 1.06 linux 386

Found client certificate for Serial Number: 001E46-R91NH8LW101109

Found certificates with following Subjects:
    88:96:4E:DE:30:91
                expires 2038-08-27 21:36:52 -0400 EDT
    ARRIS Group, Inc. Device Intermediate CA ATTCPE1
                expires 2038-10-24 16:22:56 -0400 EDT
    ARRIS Group, Inc. Device Root CA ATTCPE1
                expires 2043-10-24 16:17:26 -0400 EDT
Verifying certificates.. success!
panic: Error 255

goroutine 1 [running]:
main.main()
    C:/Coding/Go/src/mfg_dat_decode/mfg_dat_decode.go:223 +0x2cc2

EDIT: Move calibration_01.dat to a different folder, or delete it and just leave mfg.dat and it seems to work -- seems like just a weird bug with the extraction tool, might want to make a note in the README

0x888e commented 2 months ago

You're both getting these errors because mfg_dat_decode expects a specific format for calibration_01.bin that is relevant to the BGW-320, but not the BGW-210 (there is a minor difference between the two that appears to cause a panic with mfg_dat_decode). The calibration_01.bin file isn't really a thing on BGW-210 anyway, as the BGW-210 ONLY has /mfg/mfg.dat. It was included to serve another use case prior to the release of this script and can be deleted.

The script has been updated to remove the calibration_01.bin file write for the BGW-210 to avoid confusion. The README has been updated as well.

0x888e commented 2 months ago

closing issue; addressed/fixed