{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"Yamaha s\u00fcnteesaatoris peidetud k\u00e4surea liides, mis v\u00f5imaldas koodi t\u00e4ita l\u00e4bi MIDI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Anna Antonenko, who specializes in embedded systems development and also works on the BOSS (BEAM-based Operating System with Security) in her spare time, published the results of reverse engineering the Yamaha PSR-E433 synthesizer. During her work, an obfuscated shell interface was discovered in the synthesizer, allowing the execution of custom code at the firmware level. Access to the shell interface is achieved by sending MIDI packets with SysEx messages, which can be transmitted when the synthesizer is connected via USB port. The insights gained from the reverse engineering regarding the chip and firmware, as well as code samples and debugging dumps, are available on GitHub. <\/p>\n
Interest in reverse engineering arose a few years ago when Anna decided to clean the synthesizer's insides of dust and satisfy her curiosity by wanting to see the device's internals. The board contained the YAMAHA SWL01U chip, about which detailed information could not be found online. A couple of months ago, Anna came across a manual for a similar model of synthesizer that included the pinout for this chip. Anna disassembled the device once again and began experiments using the available pins on the board for the JTAG debugging interface and the UART port.
<\/center> <\/p>\n
Using the OpenOCD debugger, connecting to JTAG, and conducting experiments revealed that the board uses a chip with an ARM7TDMI core. By studying the memory layout in the debugger, it was possible to dump the contents of the firmware stored in the ROM and Flash memory. After that, the firmware images were analyzed using the Ghidra reverse engineering tool. <\/p>\n
T\u00f5lgitud arvutiteemaliste k\u00e4suviipade uurimise k\u00e4igus m\u00e4rgati jadastruktuuride kogumit (\"help, \"info\", \"ver\", \"logout\" jne), mis meenutasid k\u00e4suviibe s\u00fcsteemi k\u00e4sklusi. Kood, mis kutsub v\u00e4lja funktsioone k\u00e4skude t\u00f6\u00f6tlemiseks, meenutab sisse- ja v\u00e4ljap\u00e4\u00e4supinkade liidest. Samuti leiti, et k\u00e4suviiba aktiveerimiseks on ette n\u00e4htud k\u00e4sk \"login\", millele tuleb edastada parool \"#0000\". void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, \"login\") == 0) { shell_ask_passwd(); \\\/\\\/ prints \"passwd? \"; shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, \"#0000\") == 0) { shell_login_ok(); \\\/\\\/ prints \"login OK\"; shell_login_state = 2; } else { shell_print(\"Passwd Error\\r\"); shell_login_state = 0; } } else { \\\/\\\/ actually run the command } } <\/p>\n
P\u00fcsivara edasine uurimine n\u00e4itas, et k\u00e4ske t\u00f6\u00f6deldakse pakettidena, mis algavad alati samade 8 baitide andmetega ja l\u00f5ppevad koodiga 0xf7. Kuna v\u00e4line suhtlemine s\u00fcnteesijaga toimub ainult l\u00e4bi MIDI ja MIDI spetsifikatsioonis on ette n\u00e4htud eriline teenindust\u00fc\u00fcp SysEx s\u00f5numite jaoks, arvati, et just seda v\u00f5iks kasutada k\u00e4skude edastamiseks. Oletust kinnitas ka see, et SysEx s\u00f5numid ja liideses t\u00f5lgitavad paketid algasid \u00fche koodiga 0xf0, millele j\u00e4rgnes tootja identifikaator 0x43 (Yamaha). <\/p>\n
H\u00fcpoteesi kontrollimiseks kirjutati Python-skript, mis t\u00f5lkis sisendandmed MIDI-protokolli pakettideks. Ja meetod t\u00f6\u00f6tas: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\\\/s xxxxx m ADDRESS DATA m\\\/b ADDRESS DATA m\\\/w ADDRESS DATA m\\\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\\\/E Select English > <\/p>\n
K\u00e4skimise \"help\" saatmise k\u00e4igus kuvatud vihjes, olid muu hulgas olemas k\u00e4sud m\u00e4lu sisu muutmiseks. Nende k\u00e4skude abil oli v\u00f5imalik laadida juhuslik kood m\u00e4llu ja edastada sellele juhtimine, asendades k\u00e4su t\u00f6\u00f6tlemise l\u00f5petamisel tagasip\u00f6\u00f6rden\u00e4idiku. Katse raames paigutati kasutamata m\u00e4lupiirkonda kirjutatud assembler, mis kuvab 8-t\u00e4heline LCD ekraanile s\u00f5numi \"HeloWrld\". Programm vormistati tavalise MIDI- faili kujul, mille edastamine seadmele oli piisav.
<\/center> <\/p>\n
P\u00e4rast seda algas t\u00f6\u00f6 graafika v\u00e4ljundite uurimise kallal LCD-ekraanile, mille kulminatsiooniks oli koodi ettevalmistamine, mis kuvaks suvalist pikslisisut s\u00fcnkroonselt koos Bad Apple video esitamisega v\u00e4lisseadmest (demovideo).
![\"Yamaha](\"\/wp-content\/uploads\/2025\/01\/98533e09700241752d5b6228310c1c53.jpg\")
<\/center> <\/p>\n![\"Yamaha](\"\/wp-content\/uploads\/2025\/01\/c846c259859ceb3809af994092fcd298.jpg\")
<\/center> <\/p>\n![\"Yamaha](\"\/wp-content\/uploads\/2025\/01\/bcddc31a967d7c8e1c617c0129c92dd8.jpg\")
<\/center> ![\"M\u00e4ngi](\"https:\/\/img.youtube.com\/vi\/u6sukVMijBg\/hqdefault.jpg\")
\r\n