logon84 / Hacking_Huawei_HG8012H_ONT

Steps to hack a HG8012H, access it and mod the firmware
274 stars 67 forks source link

dump is different #20

Closed lmbss closed 2 years ago

lmbss commented 2 years ago

Hi, I'm trying to follow your steps but I'm having some differences. For example, I don't have the Cfg_file Backup folder and I can only access all the files if I extract the entire AFile_system, without dividing it into parts.

but with access to the files I can't decrypt the necessary files

Can you help me?

M25P128(ST25P28V6G)@SOP16.zip

logon84 commented 2 years ago

I compared you A partition with mine and both have the exactly same starting 12 bytes: 85 19 03 20 0C 00 00 00 B1 B0 1E E4. I don't know why you cannot extract if you trim A partition first, byt anyway, I suppose that you can do this: -Extract A partition without trimming -Modify as you wish and pack again -Once your A partition is packed with the correct size and with the data at the correct offset, edit again the first 12 bytes to look like it was (85 19 03 20 0C 00 00 00 B1 B0 1E E4) -Done

I think it should work

lmbss commented 2 years ago

Thanks for the reply, I extracted the entire partition A the file list is this:

image

I think I have all the important files here, but I can't decrypt the xml

logon84 commented 2 years ago

When I wrote this, I hadn't a single problem with aescrypt2, but if you do, I have found this: https://devilinside.me/blogs/decrypt-configuration-files-exactly-how-huawei-ont-does

I wish it helps to you. Bye

lmbss commented 2 years ago

it doesn't work either, I think it's because the file is not well because I have header errors

Can you share these three files?

if you can get me my file i can also make a donation

logon84 commented 2 years ago

Post your xml files and let me try

lmbss commented 2 years ago

tks you for your support

i have this error:

version header of file wrong!

If its possible sendme a .bin customized its perfect :)

hw_ctree.zip

logon84 commented 2 years ago

Yep, the format is different. Possible solution: extract aescript2 from bin folder in the dump and copy to your computer. Then use qemu-arm on a computer against the encrypted xml's and see if this aescrypt2 tool is able to decrypt the files. For sharing my xml's I first have to look inside them for sensible data, but I don't think my xml (encrypted or decrypted) will work for you since the aescrypt2 tool present in your dump is totally different to mine (i compared sizes and mine is 50kb while yours is about 10kb)

lmbss commented 2 years ago

You think the dump or the partions its ok? Its not possible load a oem firmware?

No dia 14/05/2022, às 00:01, logon84 @.***> escreveu:

 Yep, the format is different. Possible solution: extract aescript2 from bin folder in the dump and copy to your computer. Then use qemu-arm on a computer against the encrypted xml's and see if this aescrypt2 tool is able to decrypt the files. For sharing my xml's I first have to look inside them for sensible data, but I don't think my xml (encrypted or decrypted) will work for you since the aescrypt2 tool present in your dump is totally different to mine (i compared sizes and mine is 50kb while yours is about 10kb)

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.

logon84 commented 2 years ago

You think the dump or the partions its ok? Its not possible load a oem firmware? No dia 14/05/2022, às 00:01, logon84 @.***> escreveu:  Yep, the format is different. Possible solution: extract aescript2 from bin folder in the dump and copy to your computer. Then use qemu-arm on a computer against the encrypted xml's and see if this aescrypt2 tool is able to decrypt the files. For sharing my xml's I first have to look inside them for sensible data, but I don't think my xml (encrypted or decrypted) will work for you since the aescrypt2 tool present in your dump is totally different to mine (i compared sizes and mine is 50kb while yours is about 10kb) — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.

I think partitions and dump are ok, but something in the way the xml are encrypted/decrypted is different. Sorry to say this, but the encryption/decryption process is totally out of my scope because, as I said in the writing, I just made use of a tool previously written to decrypt my files.....no idea here of how it works.

logon84 commented 2 years ago

I think this guy knows more about the matter than me: https://blog.fayaru.me/posts/huawei_router_config/

lmbss commented 2 years ago

I view this blog bur i think thos for passwords encryptation in files and dont for file. Iam beginner in binary and encryption world 😂

Its possible this ISP change de encrypt mechanism? Or its not possible?

So thank you for your support i search a solution but if you give same. Share with me

No dia 14/05/2022, às 01:00, logon84 @.***> escreveu:

 I think this guy knows more about the matter than me: https://blog.fayaru.me/posts/huawei_router_config/

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.

lmbss commented 2 years ago

Hello, is it possible for you to give me the correct command so that you can unpack the complete rootfs from the original bin file? i tried binwalk -e file.bin but i don't get searchable rootfs

lmbss commented 2 years ago

The NOR of my hardware is different, I don't know if that has an impact. I can make the hardware available and send it to your address if you want to evaluate it, unfortunately my knowledge doesn't allow me to go much further than I went