{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"Ukryta pow\u0142oka w syntezatorze Yamaha, kt\u00f3ra umo\u017cliwia wykonywanie kodu przez MIDI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anna Antonenko, zajmuj\u0105ca si\u0119 rozwojem system\u00f3w wbudowanych oraz rozwijaj\u0105ca w wolnym czasie system operacyjny BOSS (BEAM-based Operating System with Security), opublikowa\u0142a wyniki in\u017cynierii odwrotnej syntezatora muzycznego Yamaha PSR-E433. W trakcie przeprowadzonej pracy w syntezatorze zidentyfikowano obfuskowany interfejs shellowy, kt\u00f3ry umo\u017cliwi\u0142 wykonanie w\u0142asnego kodu na poziomie oprogramowania uk\u0142adowego. Dost\u0119p do interfejsu shellowego realizowany jest poprzez wysy\u0142anie pakiet\u00f3w MIDI z komunikatami SysEx, kt\u00f3re mo\u017cna przesy\u0142a\u0107 podczas pod\u0142\u0105czenia syntezatora przez port USB. Uzyskane w trakcie in\u017cynierii odwrotnej informacje o chipie i wersjach oprogramowania, a tak\u017ce przyk\u0142ady kodu i zrzuty debugowania, zosta\u0142y umieszczone na GitHubie. <\/p>\n

Zainteresowanie in\u017cynieri\u0105 odwrotn\u0105 pojawi\u0142o si\u0119 kilka lat temu, po tym jak Anna postanowi\u0142a oczy\u015bci\u0107 wn\u0119trze syntezatora z kurzu i jednocze\u015bnie zaspokoi\u0107 swoj\u0105 ciekawo\u015b\u0107 zwi\u0105zan\u0105 z ch\u0119ci\u0105 zobaczenia wn\u0119trza urz\u0105dzenia. Na p\u0142ycie znajdowa\u0142 si\u0119 chip YAMAHA SWL01U, dla kt\u00f3rego w internecie nie uda\u0142o si\u0119 znale\u017a\u0107 szczeg\u00f3\u0142owych informacji. Kilka miesi\u0119cy temu Anna natkn\u0119\u0142a si\u0119 na instrukcj\u0119 dotycz\u0105c\u0105 podobnego modelu syntezatora, w kt\u00f3rej podano wyprowadzenia tego chipa. Ponownie rozebra\u0142a urz\u0105dzenie i rozpocz\u0119\u0142a eksperymenty, wykorzystuj\u0105c znajduj\u0105ce si\u0119 na p\u0142ycie wyprowadzenia dla interfejsu debugowania JTAG oraz portu UART.

\"Ukryta<\/center> <\/p>\n

Dzi\u0119ki debuggerowi OpenOCD, pod\u0142\u0105czeniu do JTAG i eksperymentom ustalono, \u017ce na p\u0142ycie znajduje si\u0119 chip z rdzeniem procesora ARM7TDMI. Po zbadaniu uk\u0142adu pami\u0119ci w debuggerze uda\u0142o si\u0119 zgra\u0107 zawarto\u015b\u0107 oprogramowania umieszczonego w pami\u0119ci ROM i Flash. Nast\u0119pnie obrazy oprogramowania zosta\u0142y przeanalizowane w pakiecie do in\u017cynierii odwrotnej Ghidra. <\/p>\n

Podczas przegl\u0105dania wyodr\u0119bnionych z oprogramowania danych tekstowych zauwa\u017cono zestaw fraz («help, «info», «ver», «logout» itd.), przypominaj\u0105cych polecenia interfejsu pow\u0142oki. Analiza wska\u017anik\u00f3w do tych fraz pozwoli\u0142a na odnalezienie kodu, kt\u00f3ry wywo\u0142uje funkcje do obs\u0142ugi polece\u0144, przypominaj\u0105cych interfejs logowania i pow\u0142ok\u0119 komend. Ustalono r\u00f3wnie\u017c, \u017ce do aktywacji pow\u0142oki przewidziano polecenie «login», do kt\u00f3rego nale\u017cy przekaza\u0107 has\u0142o «#0000». void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, «login») == 0) { shell_ask_passwd(); \\\/\\\/ prints «passwd? » shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, «#0000») == 0) { shell_login_ok(); \\\/\\\/ prints «login OK» shell_login_state = 2; } else { shell_print(«Passwd Error\r»); shell_login_state = 0; } } else { \\\/\\\/ actually run the command } } <\/p>\n

Dalsze badania oprogramowania wykaza\u0142y, \u017ce polecenia s\u0105 przetwarzane w pakietach, kt\u00f3re zawsze zaczynaj\u0105 si\u0119 od tych samych 8 bajt\u00f3w danych i ko\u0144cz\u0105 kodem 0xf7. Poniewa\u017c zewn\u0119trzna interakcja z syntezatorem odbywa si\u0119 wy\u0142\u0105cznie przez MIDI, a w specyfikacji MIDI przewidziano specjalny typ wiadomo\u015bci SysEx, za\u0142o\u017cono, \u017ce to w\u0142a\u015bnie on mo\u017ce by\u0107 u\u017cywany do przesy\u0142ania polece\u0144. Hipoteza ta by\u0142a wspierana przez to, \u017ce wiadomo\u015bci SysEx i pakiety przetwarzane przez pow\u0142ok\u0119 zaczyna\u0142y si\u0119 od kodu 0xf0, po kt\u00f3rym nast\u0119powa\u0142 identyfikator producenta 0x43 (Yamaha). <\/p>\n

Aby zweryfikowa\u0107 hipotez\u0119, napisano skrypt w Pythonie, kt\u00f3ry t\u0142umaczy\u0142 wprowadzane dane na pakiety protoko\u0142u MIDI. Metoda ta zda\u0142a egzamin: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\/s xxxxx m ADDRESS DATA m\/b ADDRESS DATA m\/w ADDRESS DATA m\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\/E Select English > <\/p>\n

W podpowiedzi wy\u015bwietlanej po wys\u0142aniu polecenia «help» znajdowa\u0142y si\u0119 m.in. polecenia do zmiany zawarto\u015bci pami\u0119ci. Dzi\u0119ki tym poleceniom mo\u017cna by\u0142o za\u0142adowa\u0107 dowolny kod do pami\u0119ci i przekaza\u0107 mu kontrol\u0119, zmieniaj\u0105c wska\u017anik na stosie, u\u017cywany do powrotu po zako\u0144czeniu przetwarzania polecenia. W ramach eksperymentu w nieu\u017cywanej cz\u0119\u015bci pami\u0119ci umieszczono napisany w assemblerze uproszczony program, wy\u015bwietlaj\u0105cy ci\u0105g «HeloWrld» na 8-znakowym wska\u017aniku LCD. Program zosta\u0142 skonstruowany w formie standardowego pliku MIDI, kt\u00f3ry wystarczy\u0142o przes\u0142a\u0107 na urz\u0105dzenie.

\"Ukryta<\/center> <\/p>\n

Nast\u0119pnie rozpocz\u0119to prace nad badaniem mo\u017cliwo\u015bci wy\u015bwietlania grafiki na wy\u015bwietlaczu LCD, kulminacj\u0105 kt\u00f3rych by\u0142o przygotowanie kodu, wy\u015bwietlaj\u0105cego dowoln\u0105 zawarto\u015b\u0107 pikseli w obszarze znak\u00f3w, synchronicznie z odtwarzaniem wideo Bad Apple na zewn\u0119trznym urz\u0105dzeniu (wideo z demonstracj\u0105).

\"Ukryta<\/center>
\r\n \"Odtwarzaj\r\n
<\/div>\r\n <\/div><\/center>
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u043c\u0443\u0437\u044b\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0430 Yamaha PSR-E433. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u0414\u043e\u0441\u0442\u0443\u043f \u043a shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 MIDI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 SysEx, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ukryta pow\u0142oka w syntezatorze Yamaha, kt\u00f3ra umo\u017cliwi\u0142a wykonanie kodu przez MIDI | ProHoster","description":"Anna Antonenko, zajmuj\u0105ca si\u0119 rozwojem system\u00f3w wbudowanych i w wolnym czasie rozwijaj\u0105ca system operacyjny BOSS (BEAM-based Operating System with Security), opublikowa\u0142a wyniki in\u017cynierii odwrotnej.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0430\u044f \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 Yamaha, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 MIDI | ProHoster","og:description":"\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-06T13:46:04+00:00","article:modified_time":"2025-01-06T13:46:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:26:19","updated":"2026-01-23 09:26:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=121246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/121246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/121247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=121246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=121246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=121246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}