{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"Yamaha s\u00fcnthaizeris avastatud peidetud k\u00e4surea liides, mis v\u00f5imaldas koodi t\u00e4itmist MIDI kaudu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anna Antonenko, kes tegeleb sisseehitatud s\u00fcsteemide arendamisega ja arendab vabajal BOSS-i (BEAM-p\u00f5hine ops\u00fcsteem, millel on turvalisus), avaldas tulemused Yamaha PSR-E433 muusikalis\u00fcntesaatori tagasij\u00e4lgimisest. Tehtud t\u00f6\u00f6 k\u00e4igus avastati s\u00fcnthaizerist obfuskeeritud shell-liides, mis v\u00f5imaldas k\u00e4ivitada oma koodi p\u00fcsivara tasemel. Juurdep\u00e4\u00e4s shell-liidesele toimub MIDI-pakettide saatmise kaudu SysEx s\u00f5numitega, mida saab edastada s\u00fcnthaizeri USB-porti \u00fchendamisel. Tagasij\u00e4lgimise k\u00e4igus saadud teave mikroskeemi ja p\u00fcsivara kohta, samuti koodin\u00e4idised ja silumistooted on saadaval GitHubis. <\/p>\n

Tagasit\u00f5mbamise huvi tekkis paar aastat tagasi, kui Anna otsustas s\u00fcntesaatori sisemust tolmust puhastada ja rahuldada oma uudishimu, uurides seadme sisu. Plaadil oli YAMAHA SWL01U kiip, mille kohta ei leidunud internetis p\u00f5hjalikku teavet. M\u00f5ni kuu tagasi leidis Anna sarnase s\u00fcntesaatori mudeli juhendi, milles oli selle kiibi pinout. Anna koosseisu lahti v\u00f5tnud ja katsetama asunud, kasutas ta plaadilt leiduvaid JTAG ja UART debugimise liidese v\u00e4ljundeid.

\"Yamaha<\/center> <\/p>\n

OpenOCD h\u00e4\u00e4lestaja abil, \u00fchendudes JTAG-ga ja katsetades, selgus, et plaadil on ARM7TDMI protsessorituuma kiip. Uurides m\u00e4lumooduli jaotust h\u00e4\u00e4lestajas, \u00f5nnestus laadida v\u00e4lja BIOS-i ja Flash-m\u00e4lu sisu. P\u00e4rast seda anal\u00fc\u00fcsiti BIOS-i pilte Ghidra tagasit\u00f5mbamise pakendis. <\/p>\n

Vaadates seadme p\u00fcsivara v\u00e4ljundist saadud tekstiridu, leiti rida, mis sisaldas s\u00f5nu (\"help\", \"info\", \"ver\", \"logout\" jne), mis meenutavad k\u00e4sku k\u00e4surealt. Nende ridadega seotud n\u00e4idikute uurimine aitas leida koodi, mis kutsub v\u00e4lja funktsioone, et t\u00f6\u00f6delda k\u00e4ske sarnasel viisil nagu sisselogimise ja k\u00e4surea liides. Samuti tuvastati, et liidese aktiveerimiseks on olemas k\u00e4sk \"login\", millele tuleb edastada parool \"#0000\". void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, \"login\") == 0) { shell_ask_passwd(); \/\/ prindib \"passwd? \" shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, \"#0000\") == 0) { shell_login_ok(); \/\/ prindib \"login OK\" shell_login_state = 2; } else { shell_print(\"Passwd Error\\r\"); shell_login_state = 0; } } else { \/\/ tegeleb k\u00e4su t\u00e4itmisega } } <\/p>\n

Edasi uurides tarkvara, selgus, et k\u00e4sud t\u00f6\u00f6deldakse pakettidena, mis algavad alati samade 8 baitiga andmetega ja l\u00f5pevad koodiga 0xf7. Kuna v\u00e4lised suhted s\u00fcnteesijaiga toimuvad ainult l\u00e4bi MIDI ning MIDI spetsifikatsioonis on ette n\u00e4htud spetsiaalne teenindust\u00fc\u00fcp avaldusi SysEx, siis oletati, et just seda kasutatakse k\u00e4skude edastamiseks. Eeldust toetas ka see, et SysEx s\u00f5numid ja shell'i k\u00e4ideldud paketid algasid koodiga 0xf0, millele j\u00e4rgnes tootja identifikaator 0x43 (Yamaha). <\/p>\n

H\u00fcpoteesi kontrollimiseks kirjutati Python skript, mis t\u00f5lkis sisendandmed MIDI protokolli pakettidesse. Ja meetod t\u00f6\u00f6tas: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\/s xxxxx m ADDRESS DATA m\/b ADDRESS DATA m\/w ADDRESS DATA m\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\/E Select English > <\/p>\n

K\u00e4skude \"help\" saatmisel kuvatud vihjes olid muu hulgas ka k\u00e4sud, mis v\u00f5imaldasid m\u00e4lu sisu muuta. Nende k\u00e4skude abil oli v\u00f5imalik laadida seadmesse arbitraarset koodi ja suunata selle t\u00e4itmine, asendades vahem\u00e4lu tagasi p\u00f6\u00f6rdumise n\u00e4itaja. Katse k\u00e4igus paigutati kasutamata m\u00e4lu alale lihtne assembleriga kirjutatud rakendus, mis prindib \"HeloWrld\" t\u00e4hem\u00e4rgid 8-t\u00e4helisele LCD-ekraanile. Programm oli vormindatud tavalise MIDI-failina, mille oli piisav seadmele edastada.

\"Yamaha<\/center> <\/p>\n

Seej\u00e4rel hakati uurima graafika kuvamise ise\u00e4rasusi LCD-ekraanil, mille tipphetkeks oli koodi ettevalmistamine, mis kuvab juhuslikku pikslisisu t\u00e4hestikulises piirkonnas, s\u00fcnkroonselt Bad Apple video esitamisega v\u00e4lisseadmel (demonstreeriva videoga).

\"Yamaha<\/center>
\r\n \"Vaata\r\n
<\/div>\r\n <\/div><\/center>
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u043c\u0443\u0437\u044b\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0430 Yamaha PSR-E433. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u0414\u043e\u0441\u0442\u0443\u043f \u043a shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 MIDI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 SysEx, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Peidetud k\u00e4suviip Yamaha s\u00fcntesaatoris, mis v\u00f5imaldas koodi t\u00e4itmist l\u00e4bi MIDI | ProHoster","description":"Anna Antonenko, kes on spetsialiseerunud sisseehitatud s\u00fcsteemide arendamisele ja vabal ajal arendab operatsioonis\u00fcsteemi BOSS (BEAM-based Operating System with Security), avaldas tulemused Yamaha PSR-E433 muusikas\u00fcntesaatori tagasiviimise kohta. Teostatud t\u00f6\u00f6 k\u00e4igus tuvastati s\u00fcntesaatorist obfuskeeritud shell-liides, mis v\u00f5imaldas koodi t\u00e4itmist p\u00fcsivara tasemel. Juurdep\u00e4\u00e4s shell-liidesele toimub midi-pakettide saatmise kaudu SysEx s\u00f5numitega,","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0430\u044f \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 Yamaha, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 MIDI | ProHoster","og:description":"\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u043c\u0443\u0437\u044b\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0430 Yamaha PSR-E433. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u0414\u043e\u0441\u0442\u0443\u043f \u043a shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 MIDI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 SysEx,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-06T13:46:04+00:00","article:modified_time":"2025-01-06T13:46:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:26:19","updated":"2026-01-23 09:26:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=121246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/121246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/121247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=121246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=121246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=121246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}