plewin / tp-link-modem-router

Goodies for TP-Link modem routers
GNU General Public License v3.0
83 stars 17 forks source link

sequence not present in encryption params response #26

Open rOY369 opened 1 year ago

rOY369 commented 1 year ago

Hi @plewin

First of all, thank you for this tool. I have a use case to send SMS and was testing the script sms-send.js.

Router Model: Archer MR200

Issue : The response of fetchEncryptionParams does not have seq which is leading to the error below.

config file config.json could not be read, skipping
args {
  routerUiUrl: 'http://192.168.1.1',
  routerUiLogin: 'admin',
  routerUiPassword: '<password>',
  to: '<destination>',
  textContent: 'my text message'
}
var ee="010001";
var nn="F60E0796536CDE9E0DB1EA4FE69DA34FF2C495165954D0026D080C4A912AAFA6F410D663AFE4F5115B22C65A143E27B129A66C95F4272397BF73FDA3DD6F3C97F4CF80C485D3AE19C79A88C1A1D2CE5B5DD05A219303A9522481B2235E87D00200E38BBBAEEE7BFF0332BAA350F83067C112C04554C410D51D669CF6C0B4C5A1";
var userSetting=1;
$.ret=0;

TypeError: Cannot read properties of null (reading '1')
    at RouterClient.parseEncryptionParams (file:///home/pi/tp-link-modem-router/src/routerClient.mjs:89:25)
    at file:///home/pi/tp-link-modem-router/src/routerClient.mjs:37:30
    at processTicksAndRejections (node:internal/process/task_queues:96:5)

Does this mean that the router's encryption is configured in a different way? Can this happen due to a different router's firmware version? What method can you suggest to debug and resolve the authentication problem?

plewin commented 1 year ago

Hey @rOY369, That's the first time I read about this issue. It does not look really good. I think your guess about a firmware version difference might be right.

Sorry, I am not able to make improvements on this project and I have no hardware to test on.

This parameter sequence is only used during authentication.

In the project's README, there's a code to debug the encryption of the protocol while using your browser on the web ui

$.Iencryptor.AESDecrypt_backup = $.Iencryptor.AESDecrypt;
$.Iencryptor.AESEncrypt_backup = $.Iencryptor.AESEncrypt;
$.Iencryptor.AESDecrypt = function(data) {
    let decrypted = $.Iencryptor.AESDecrypt_backup(data);
    console.log("RECV:\n" + decrypted);
    return decrypted;
}
$.Iencryptor.AESEncrypt = function(data) {
    console.log("SEND:\n" + data);
    return $.Iencryptor.AESEncrypt_backup(data);
}

This code won't help you because it only works to log the protocol after the authentication is etablished. The authentication uses RSA. There should be in "$.Iencryptor" some RSA fonctions, even maybe getSignature. If you could log getSignature and all rsa functions like AESEncrypt/Decrypt, and see if the parameter sequence is dropped that would be a good hint to fix it. If that's the only change. I have no idea how difficult it is to log what getSignature does.

If you manage to read what getSignature produces, you might be able to fix this function https://github.com/plewin/tp-link-modem-router/blob/master/src/routerEncryption.mjs#L168

Best regards,