{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"A hidden command shell in the Yamaha synthesizer that allowed code execution via MIDI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Anna Antonenko, who specializes in embedded systems development and in her spare time is developing the BOSS (BEAM-based Operating System with Security), published the results of reverse engineering the Yamaha PSR-E433 synthesizer. During the work, an obfuscated shell interface was discovered in the synthesizer, allowing the execution of custom code at the firmware level. Access to the shell interface is achieved by sending MIDI packets with SysEx messages, which can be transmitted when the synthesizer is connected via USB port. The findings from the reverse engineering regarding the chip and firmware, as well as code examples and debug dumps, are available on GitHub. <\/p>\n
Interest in reverse engineering arose a few years ago when Anna decided to clean the insides of the synthesizer from dust and also satisfy her curiosity about the device's internals. The board contained a chip, YAMAHA SWL01U, about which detailed information could not be found on the internet. A couple of months ago, Anna came across a manual for a similar synthesizer model that included the pinout of this chip. Anna disassembled the device again and began experiments, utilizing the available board connections for the JTAG debug interface and UART port.
<\/center> <\/p>\n
Using the OpenOCD debugger, connecting to JTAG, and conducting experiments, it was discovered that the board uses a chip with an ARM7TDMI processor core. By studying the memory layout in the debugger, it was possible to dump the contents of the firmware stored in ROM and Flash memory. After that, the firmware images were analyzed in the reverse engineering suite Ghidra. <\/p>\n
During the review of specific lines extracted from the firmware, a set of strings (\"help, \"info\", \"ver\", \"logout\", etc.) resembling commands of a command shell was noticed. Investigating the pointers to these strings allowed us to find code calling functions to process commands, similar to a login interface and command shell. It was also discovered that to activate the shell, the command \"login\" must be entered, with the password \"#0000\" required. void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, \"login\") == 0) { shell_ask_passwd(); \/\/ prints \"passwd? \" shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, \"#0000\") == 0) { shell_login_ok(); \/\/ prints \"login OK\" shell_login_state = 2; } else { shell_print(\"Passwd Error\\r\"); shell_login_state = 0; } } else { \/\/ actually run the command } } <\/p>\n
Further examination of the firmware showed that commands are processed in packets, which always start with the same 8 bytes of data and end with the code 0xf7. Since external interaction with the synthesizer is carried out only via MIDI, and the MIDI specification includes a special service message type called SysEx, it was assumed that it could be used for command transmission. This hypothesis was supported by the fact that SysEx messages and packets parsed by the shell began with the code 0xf0, followed by the manufacturer ID 0x43 (Yamaha). <\/p>\n
To test the hypothesis, a Python script was written that translated the input data into MIDI protocol packets. The method worked: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\/s xxxxx m ADDRESS DATA m\/b ADDRESS DATA m\/w ADDRESS DATA m\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\/E Select English > <\/p>\n
In the hint displayed when the command \"help\" was sent, among other things, there were commands to modify memory contents. Using these commands, arbitrary code could be loaded into memory, and control could be transferred to it by modifying the pointer in the stack used for returning after the command processing. As an experiment, a simple application written in assembly was placed in an unused memory area, displaying the string \"HeloWrld\" on an 8-character LCD display. The program was formatted as a standard MIDI file, which was simply transmitted to the device.
<\/center> <\/p>\n
After that, work began on studying the features of graphic output to the LCD display, culminating in the preparation of code that displayed arbitrary pixel content in the character area, synchronized with the playback of the video Bad Apple on an external device (a video demonstration).
![\"A](\"\/wp-content\/uploads\/2025\/01\/98533e09700241752d5b6228310c1c53.jpg\")
<\/center> <\/p>\n![\"A](\"\/wp-content\/uploads\/2025\/01\/c846c259859ceb3809af994092fcd298.jpg\")
<\/center> <\/p>\n![\"A](\"\/wp-content\/uploads\/2025\/01\/bcddc31a967d7c8e1c617c0129c92dd8.jpg\")
<\/center> ![\"Play](\"https:\/\/img.youtube.com\/vi\/u6sukVMijBg\/hqdefault.jpg\")
\r\n