{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"Hidden shell in the Yamaha synthesizer that allowed code execution via MIDI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anna Antonenko, who specializes in embedded system development and, in her spare time, is developing the BOSS (BEAM-based Operating System with Security) operating system, published the results of reverse engineering the Yamaha PSR-E433 synthesizer. During the work, an obfuscated shell interface was discovered in the synthesizer, allowing the execution of custom code at the firmware level. Access to the shell interface is achieved by sending MIDI packets with SysEx messages, which can be transmitted when connecting the synthesizer via USB. The information obtained during reverse engineering about the chip and firmware, along with code examples and debugging dumps, is available on GitHub. <\/p>\n

Interest in reverse engineering arose a few years ago when Anna decided to clean the dust from the synthesizer's insides and satisfy her curiosity about the device's internal components. The board featured a YAMAHA SWL01U chip, about which she couldn't find detailed information online. A couple of months ago, Anna came across a guide for a similar synthesizer model that included the pinout for this chip. She disassembled the device again and started experiments, utilizing the available pins for the JTAG debugging interface and the UART port.

\"Hidden<\/center> <\/p>\n

Using the OpenOCD debugger, connections to JTAG, and experimentation, it was found that the board uses a chip with an ARM7TDMI processor core. By studying the memory layout in the debugger, she managed to dump the contents of the firmware located in the ROM and Flash memory. After that, the firmware images were analyzed in the reverse engineering package Ghidra. <\/p>\n

A kiv\u00e1lasztott firmware soradatok megtekint\u00e9se sor\u00e1n \u00e9szleltem egy sor utas\u00edt\u00e1st («help, «info», «ver», «logout» stb.), amelyek hasonl\u00edtanak a parancssori utas\u00edt\u00e1sokra. Ezen utas\u00edt\u00e1sok mutat\u00f3inak tanulm\u00e1nyoz\u00e1sa lehet\u0151v\u00e9 tette a parancsok feldolgoz\u00e1s\u00e1\u00e9rt felel\u0151s k\u00f3d felfedez\u00e9s\u00e9t, amely hasonl\u00edt a bejelentkez\u00e9si fel\u00fclethez \u00e9s a parancs\u00e9rtelmez\u0151h\u00f6z. Tov\u00e1bb\u00e1 meg\u00e1llap\u00edt\u00e1st nyert, hogy a shell aktiv\u00e1l\u00e1s\u00e1hoz sz\u00fcks\u00e9ges parancs a «login», amelyhez a «#0000» jelsz\u00f3t kell megadni. void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, «login») == 0) { shell_ask_passwd(); \/\/ prints «passwd? » shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, «#0000») == 0) { shell_login_ok(); \/\/ prints «login OK» shell_login_state = 2; } else { shell_print(«Passwd Error\r»); shell_login_state = 0; } } else { \/\/ actually run the command } } <\/p>\n

A firmware tov\u00e1bbi vizsg\u00e1lata megmutatta, hogy a parancsokat csomagokban dolgozz\u00e1k fel, amelyek mindig azonos 8 b\u00e1jt adatokkal kezd\u0151dnek \u00e9s a 0xf7 k\u00f3ddal z\u00e1rulnak. Mivel a hangszerrel val\u00f3 k\u00fcls\u0151 kommunik\u00e1ci\u00f3 csak MIDI-n kereszt\u00fcl t\u00f6rt\u00e9nik, \u00e9s a MIDI specifik\u00e1ci\u00f3ja szerint l\u00e9tezik egy SysEx nev\u0171 k\u00fcl\u00f6nleges \u00fczenett\u00edpus, felt\u00e9telezt\u00fck, hogy ez haszn\u00e1lhat\u00f3 a parancsok tov\u00e1bb\u00edt\u00e1s\u00e1ra. Az elgondol\u00e1st az is al\u00e1t\u00e1masztotta, hogy a SysEx \u00fczenetek \u00e9s a parancssor \u00e1ltal feldolgozott csomagok 0xf0 k\u00f3ddal kezd\u0151dtek, ezt k\u00f6vet\u0151en pedig a gy\u00e1rt\u00f3i azonos\u00edt\u00f3 0x43 (Yamaha) tal\u00e1lhat\u00f3. <\/p>\n

A hipot\u00e9zis ellen\u0151rz\u00e9s\u00e9re egy Python-skriptet \u00edrtam, amely az input adatokat MIDI protokoll csomagokk\u00e1 alak\u00edtotta. \u00c9s a m\u00f3dszer m\u0171k\u00f6d\u00f6tt: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\/s xxxxx m ADDRESS DATA m\/b ADDRESS DATA m\/w ADDRESS DATA m\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\/E Select English > <\/p>\n

A «help» parancs elk\u00fcld\u00e9sekor megjelen\u00edtett s\u00fag\u00f3ban t\u00f6bbek k\u00f6z\u00f6tt a mem\u00f3riatartalom m\u00f3dos\u00edt\u00e1s\u00e1ra vonatkoz\u00f3 parancsok voltak jelen. Ezen parancsok seg\u00edts\u00e9g\u00e9vel tetsz\u0151leges k\u00f3d t\u00f6lthet\u0151 be a mem\u00f3ri\u00e1ba, \u00e9s \u00e1tadhat\u00f3 neki a vez\u00e9rl\u00e9s, a parancs feldolgoz\u00e1sa ut\u00e1ni visszat\u00e9r\u00e9si mutat\u00f3 manipul\u00e1l\u00e1s\u00e1val a veremben. K\u00eds\u00e9rletk\u00e9ppen az \u00fcres mem\u00f3ria ter\u00fclet\u00e9n elhelyeztem egy egyszer\u0171, assembler nyelven \u00edrt alkalmaz\u00e1st, amely a «HeloWrld» sz\u00f6veget jelen\u00edti meg egy 8 karakteres LCD kijelz\u0151n. A program egy hagyom\u00e1nyos MIDI f\u00e1jl form\u00e1j\u00e1ban k\u00e9sz\u00fclt, amelyet elegend\u0151 volt tov\u00e1bb\u00edtani az eszk\u00f6zre.

\"Hidden<\/center> <\/p>\n

Ezt k\u00f6vet\u0151en elindult a grafika kimenet\u00e9nek tanulm\u00e1nyoz\u00e1sa az LCD kijelz\u0151n, amelynek cs\u00facspontja egy olyan k\u00f3d elk\u00e9sz\u00edt\u00e9se volt, amely v\u00e9letlenszer\u0171 pixeltartalmat mutatott a karakter ter\u00fcleten, szinkronban a Bad Apple vide\u00f3 lej\u00e1tsz\u00e1s\u00e1val egy k\u00fcls\u0151 eszk\u00f6z\u00f6n (demonstr\u00e1ci\u00f3s vide\u00f3val).

\"Hidden<\/center>
\r\n \"Vide\u00f3\r\n
<\/div>\r\n <\/div><\/center>
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u043c\u0443\u0437\u044b\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0430 Yamaha PSR-E433. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u0414\u043e\u0441\u0442\u0443\u043f \u043a shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 MIDI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 SysEx, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rejtett parancssor a Yamaha szintetiz\u00e1torban, amely lehet\u0151v\u00e9 tette a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t MIDI-n | ProHoster","description":"Anna Antonenko, aki be\u00e1gyazott rendszerek fejleszt\u00e9s\u00e9vel foglalkozik, \u00e9s szabadidej\u00e9ben a BOSS (BEAM-alap\u00fa Biztons\u00e1gos Oper\u00e1ci\u00f3s Rendszer) oper\u00e1ci\u00f3s rendszer fejleszt\u00e9s\u00e9t v\u00e9gzi, k\u00f6zz\u00e9tette a ford\u00edtott m\u00e9rn\u00f6ki munka eredm\u00e9nyeit.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0430\u044f \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 Yamaha, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 MIDI | ProHoster","og:description":"\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-06T13:46:04+00:00","article:modified_time":"2025-01-06T13:46:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:26:19","updated":"2026-01-23 09:26:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/121246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=121246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/121246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/121247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=121246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=121246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=121246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}