{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"Skryt\u00fd p\u0159\u00edkazov\u00fd termin\u00e1l v syntez\u00e1toru Yamaha, kter\u00fd umo\u017enil vykon\u00e1vat k\u00f3d p\u0159es MIDI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anna Antonenko, kter\u00e1 se zab\u00fdv\u00e1 v\u00fdvojem vestavn\u00fdch syst\u00e9m\u016f a ve voln\u00e9m \u010dase rozv\u00edj\u00ed opera\u010dn\u00ed syst\u00e9m BOSS (BEAM-based Operating System with Security), zve\u0159ejnila v\u00fdsledky reverzn\u00edho in\u017een\u00fdrstv\u00ed hudebn\u00edho syntez\u00e1toru Yamaha PSR-E433. B\u011bhem proveden\u00e9 pr\u00e1ce byl v syntez\u00e1toru odhalen obfuskovan\u00fd shell interface, kter\u00fd umo\u017enil prov\u00e1d\u011bn\u00ed vlastn\u00edho k\u00f3du na \u00farovni firmwaru. P\u0159\u00edstup k shell interface se realizuje prost\u0159ednictv\u00edm odes\u00edl\u00e1n\u00ed MIDI paket\u016f se zpr\u00e1vami SysEx, kter\u00e9 lze p\u0159edat p\u0159i p\u0159ipojen\u00ed syntez\u00e1toru p\u0159es USB port. Z\u00edskan\u00e9 informace o \u010dipu a firmwarech, stejn\u011b jako p\u0159\u00edklady k\u00f3du a lad\u00edc\u00ed v\u00fdpisy, byly zve\u0159ejn\u011bny na GitHubu. <\/p>\n

Z\u00e1jem o reverzn\u00ed in\u017een\u00fdrstv\u00ed vznikl p\u0159ed n\u011bkolika lety, pot\u00e9 co se Anna rozhodla vy\u010distit vnit\u0159nosti syntez\u00e1toru od prachu a z\u00e1rove\u0148 uspokojit svou zv\u011bdavost spojenou s p\u0159\u00e1n\u00edm pod\u00edvat se na vnit\u0159nosti za\u0159\u00edzen\u00ed. Na desce byl p\u0159\u00edtomen \u010dip YAMAHA SWL01U, o kter\u00e9m se v internetov\u00fdch zdroj\u00edch nepoda\u0159ilo naj\u00edt podrobn\u00e9 informace. P\u0159ed n\u011bkolika m\u011bs\u00edci Anna narazila na p\u0159\u00edru\u010dku k podobn\u00e9mu modelu syntez\u00e1toru, ve kter\u00e9 byla uvedena pinout tohoto \u010dipu. Anna znovu rozebrala za\u0159\u00edzen\u00ed a za\u010dala experimentovat, vyu\u017e\u00edvaj\u00edc dostupn\u00e9 v\u00fdvody na desce pro lad\u00edc\u00ed interface JTAG a port UART.

\"Skryt\u00fd<\/center> <\/p>\n

Pomoc\u00ed debuggeru OpenOCD, p\u0159ipojen\u00ed k JTAG a experiment\u016f bylo zji\u0161t\u011bno, \u017ee na desce je pou\u017eit \u010dip s procesorov\u00fdm j\u00e1drem ARM7TDMI. Po prostudov\u00e1n\u00ed rozlo\u017een\u00ed pam\u011bti v debuggeru se poda\u0159ilo extrahovat obsah firmware um\u00edst\u011bn\u00e9ho v ROM a Flash pam\u011bti. Pot\u00e9 byly obrazy firmware analyzov\u00e1ny v bal\u00edku pro reverzn\u00ed in\u017een\u00fdrstv\u00ed Ghidra. <\/p>\n

P\u0159i prohl\u00ed\u017een\u00ed vybran\u00fdch \u0159et\u011bzcov\u00fdch dat z firmwaru byl zaznamen\u00e1n soubor \u0159et\u011bzc\u016f (\"help\", \"info\", \"ver\", \"logout\" atd.), kter\u00e9 p\u0159ipom\u00ednaj\u00ed p\u0159\u00edkazy p\u0159\u00edkazov\u00e9ho rozhran\u00ed. Zkoum\u00e1n\u00ed ukazatel\u016f na tyto \u0159et\u011bzce umo\u017enilo naj\u00edt k\u00f3d, kter\u00fd vyvol\u00e1v\u00e1 funkce pro zpracov\u00e1n\u00ed p\u0159\u00edkaz\u016f, co\u017e p\u0159ipom\u00edn\u00e1 rozhran\u00ed p\u0159ihl\u00e1\u0161en\u00ed a p\u0159\u00edkazov\u00fd shell. Tak\u00e9 bylo zji\u0161t\u011bno, \u017ee pro aktivaci shellu je ur\u010dena p\u0159\u00edkaz \"login\", kdy je t\u0159eba zadat heslo \"#0000\". void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, \"login\") == 0) { shell_ask_passwd(); \/\/ prints \"passwd? \"; shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, \"#0000\") == 0) { shell_login_ok(); \/\/ prints \"login OK\"; shell_login_state = 2; } else { shell_print(\"Passwd Error\\r\"); shell_login_state = 0; } } else { \/\/ actually run the command } } <\/p>\n

Dal\u0161\u00ed zkoum\u00e1n\u00ed firmwaru uk\u00e1zalo, \u017ee p\u0159\u00edkazy jsou zpracov\u00e1v\u00e1ny v paketech, kter\u00e9 v\u017edy za\u010d\u00ednaj\u00ed stejn\u00fdmi 8 bajty dat a kon\u010d\u00ed k\u00f3dem 0xf7. Proto\u017ee extern\u00ed interakce se syntetiz\u00e1torem prob\u00edh\u00e1 pouze p\u0159es MIDI a ve specifikaci MIDI je definov\u00e1n speci\u00e1ln\u00ed typ zpr\u00e1v SysEx, bylo p\u0159edpokl\u00e1d\u00e1no, \u017ee ten m\u016f\u017ee b\u00fdt pou\u017eit pro p\u0159enos p\u0159\u00edkaz\u016f. Tu my\u0161lenku tak\u00e9 podpo\u0159ilo to, \u017ee zpr\u00e1vy SysEx a pakety zpracov\u00e1van\u00e9 rozhran\u00edm za\u010d\u00ednaly jedn\u00edm k\u00f3dem 0xf0, za kter\u00fdm n\u00e1sledoval identifik\u00e1tor v\u00fdrobce 0x43 (Yamaha). <\/p>\n

Pro ov\u011b\u0159en\u00ed hypot\u00e9zy byl naps\u00e1n Python skript, kter\u00fd p\u0159ev\u00e1d\u011bl zadan\u00e1 data na pakety protokolu MIDI. A metoda fungovala: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\/s xxxxx m ADDRESS DATA m\/b ADDRESS DATA m\/w ADDRESS DATA m\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\/E Select English > <\/p>\n

V n\u00e1pov\u011bd\u011b zobrazen\u00e9 p\u0159i odes\u00edl\u00e1n\u00ed p\u0159\u00edkazu \"help\" byly mimo jin\u00e9 tak\u00e9 p\u0159\u00edkazy pro zm\u011bnu obsahu pam\u011bti. Pomoc\u00ed t\u011bchto p\u0159\u00edkaz\u016f bylo mo\u017en\u00e9 nahr\u00e1t libovoln\u00fd k\u00f3d do pam\u011bti a p\u0159ev\u00e9st na n\u011bj kontrolu, p\u0159eps\u00e1n\u00edm ukazatele na z\u00e1sobn\u00edku, kter\u00fd se pou\u017e\u00edv\u00e1 k n\u00e1vratu po dokon\u010den\u00ed zpracov\u00e1n\u00ed p\u0159\u00edkazu. Jako experiment byla v nepou\u017e\u00edvan\u00e9 oblasti pam\u011bti um\u00edst\u011bna jednoduch\u00e1 aplikace napsan\u00e1 v assembleru, kter\u00e1 zobrazovala \u0159et\u011bzec \"HeloWrld\" na 8-znakov\u00e9m LCD displeji. Program byl sestaven jako b\u011b\u017en\u00fd MIDI soubor, kter\u00fd sta\u010dilo poslat do za\u0159\u00edzen\u00ed.

\"Skryt\u00fd<\/center> <\/p>\n

Pot\u00e9 za\u010dla pr\u00e1ce na zkoum\u00e1n\u00ed vlastnost\u00ed v\u00fdstupu grafiky na LCD displej, jej\u00edm\u017e vrcholem byla p\u0159\u00edprava k\u00f3du, kter\u00fd zobrazoval libovoln\u00fd pixelov\u00fd obsah v textov\u00e9 oblasti synchronn\u011b s p\u0159ehr\u00e1v\u00e1n\u00edm videa Bad Apple na extern\u00edm za\u0159\u00edzen\u00ed (video s uk\u00e1zkou).

\"Skryt\u00fd<\/center>
\r\n \"P\u0159ehr\u00e1t\r\n
<\/div>\r\n <\/div><\/center>
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u043c\u0443\u0437\u044b\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0430 Yamaha PSR-E433. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u0414\u043e\u0441\u0442\u0443\u043f \u043a shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 MIDI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 SysEx, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Skryt\u00e1 p\u0159\u00edkazov\u00e1 \u0159\u00e1dka v syntez\u00e1toru Yamaha, kter\u00e1 umo\u017enila vykonat k\u00f3d p\u0159es MIDI | ProHoster","description":"Anna Anton\u011bnko, kter\u00e1 se zab\u00fdv\u00e1 v\u00fdvojem vestav\u011bn\u00fdch syst\u00e9m\u016f a ve voln\u00e9m \u010dase vyv\u00edj\u00ed opera\u010dn\u00ed syst\u00e9m BOSS (BEAM-based Operating System with Security), zve\u0159ejnila v\u00fdsledky zp\u011btn\u00e9ho in\u017een\u00fdrstv\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0430\u044f \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 Yamaha, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 MIDI | ProHoster","og:description":"\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-06T13:46:04+00:00","article:modified_time":"2025-01-06T13:46:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:26:19","updated":"2026-01-23 09:26:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/121246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=121246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/121246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/121247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=121246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=121246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=121246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}