{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"Interfa\u021ba shell ascuns\u0103 \u00een sintetizatorul Yamaha, care a permis executarea codului prin MIDI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anna Antonenko, specializat\u0103 \u00een dezvoltarea sistemelor \u00eencorporate \u0219i care \u00ee\u0219i dezvolt\u0103 opera\u021biunea de sistem BOSS (BEAM-based Operating System with Security) \u00een timpul liber, a publicat rezultatele procesului de inginerie invers\u0103 a sintetizatorului muzical Yamaha PSR-E433. \u00cen urma lucr\u0103rii realizate, a fost identificat un interfa\u021b\u0103 shell obfuscat\u0103 \u00een sintetizator, care a permis executarea propriului cod la nivelul firmware-ului. Accesul la interfa\u021ba shell se face prin trimiterea de pachete MIDI cu mesaje SysEx, care pot fi transmise prin conectarea sintetizatorului prin portul USB. Informa\u021biile ob\u021binute \u00een timpul ingineriei inverse despre cip \u0219i firmware-uri, precum \u0219i exemple de cod \u0219i dumpuri de depanare au fost publicate pe GitHub. <\/p>\n

Interesul pentru ingineria invers\u0103 a ap\u0103rut cu c\u00e2\u021biva ani \u00een urm\u0103, dup\u0103 ce Anna a decis s\u0103 cure\u021be interiorul sintetizatorului de praf \u0219i \u00een acela\u0219i timp s\u0103 \u00ee\u0219i satisfac\u0103 curiozitatea legat\u0103 de dorin\u021ba de a vedea componentele dispozitivului. Pe plac\u0103 se afla cipul YAMAHA SWL01U, despre care nu a reu\u0219it s\u0103 g\u0103seasc\u0103 informa\u021bii detaliate pe internet. Cu c\u00e2teva luni \u00een urm\u0103, Anna a dat peste un manual pentru un model similar de sintetizator, \u00een care se oferea pinout-ul acestui cip. Anna a demontat din nou dispozitivul \u0219i a \u00eenceput experimentele, folosing ie\u0219irile disponibile pe plac\u0103 pentru interfa\u021ba de depanare JTAG \u0219i portul UART.

\"Interfa\u021ba<\/center> <\/p>\n

Folosind debugger-ul OpenOCD, conectarea la JTAG \u0219i experimentele, s-a descoperit c\u0103 pe plac\u0103 este utilizat un cip cu nucleu procesor ARM7TDMI. Studiind aranjamentul memoriei \u00een debugger, s-a reu\u0219it s\u0103 se extrag\u0103 con\u021binutul firmware-urilor stocate \u00een ROM \u0219i memoria Flash. Dup\u0103 aceea, imaginile firmware-urilor au fost analizate \u00een pachetul pentru inginerie invers\u0103 Ghidra. <\/p>\n

\u00cen timpul analiz\u0103rii liniilor de date extrase din firm\u0103, a fost observat un set de comenzi (\"help\", \"info\", \"ver\", \"logout\" etc.), asem\u0103n\u0103toare cu comenzile dintr-o interfa\u021b\u0103 de programare. Studiul referin\u021belor c\u0103tre aceste comenzi a permis identificarea codului care apeleaz\u0103 func\u021bii pentru gestionarea comenzilor, asem\u0103n\u0103toare unei interfe\u021be de autentificare \u0219i a unei linii de comand\u0103. De asemenea, s-a descoperit c\u0103 pentru activarea interfe\u021bei se folose\u0219te comanda \"login\", la care trebuie s\u0103 se transmit\u0103 parola \"#0000\". void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, \"login\") == 0) { shell_ask_passwd(); \/\/ imprim\u0103 \"passwd? \" shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, \"#0000\") == 0) { shell_login_ok(); \/\/ imprim\u0103 \"login OK\" shell_login_state = 2; } else { shell_print(\"Passwd Error\\r\"); shell_login_state = 0; } } else { \/\/ execut\u0103 efectiv comanda } } <\/p>\n

O studiere ulterioar\u0103 a firmware-ului a ar\u0103tat c\u0103 comenzile sunt procesate \u00een pachete, care \u00eencep \u00eentotdeauna cu acelea\u0219i 8 octe\u021bi de date \u0219i se termin\u0103 cu codul 0xf7. Deoarece interac\u021biunea extern\u0103 cu sintetizatorul se realizeaz\u0103 exclusiv prin MIDI, iar \u00een specifica\u021bia MIDI este prev\u0103zut un tip special de mesaje de serviciu SysEx, s-a presupus c\u0103 acesta ar putea fi folosit pentru transmiterea comenzilor. Presupunerea a fost \u00eent\u0103rit\u0103 \u0219i de faptul c\u0103 mesajele SysEx \u0219i pachetele procesate de shell \u00eencepeau cu un cod 0xf0, urmat de identificatorul produc\u0103torului 0x43 (Yamaha). <\/p>\n

Pentru a verifica ipoteza, a fost scris un script Python care transpune datele introduse \u00een pachete de protocol MIDI. \u0218i metoda a func\u021bionat: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\/s xxxxx m ADDRESS DATA m\/b ADDRESS DATA m\/w ADDRESS DATA m\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\/E Select English > <\/p>\n

\u00cen sugestia ar\u0103tat\u0103 la trimiterea comenzii \"help\", printre altele, au fost incluse comenzi pentru modificarea con\u021binutului memoriei. Cu ajutorul acestor comenzi era posibil s\u0103 se \u00eencarce un cod arbitrar \u00een memorie \u0219i s\u0103 se preia controlul prin \u00eenlocuirea referin\u021bei din stiv\u0103 utilizat\u0103 pentru a reveni dup\u0103 finalizarea proces\u0103rii comenzii. Ca experiment, \u00eentr-o zon\u0103 neutilizat\u0103 a memoriei, a fost plasat\u0103 o aplica\u021bie simpl\u0103 scris\u0103 \u00een assembler, care afi\u0219a \u0219irul \"HeloWrld\" pe un indicator LCD de 8 caractere. Programul a fost realizat sub form\u0103 de fi\u0219ier MIDI obi\u0219nuit, suficient fiind s\u0103 fie transmis pe dispozitiv.

\"Interfa\u021ba<\/center> <\/p>\n

Dup\u0103 aceasta, au \u00eenceput lucr\u0103rile de studiu a caracteristicilor de afi\u0219are a graficii pe un ecran LCD, culmin\u00e2nd cu preg\u0103tirea codului care afi\u0219a con\u021binut pixelat arbitrar \u00een zona de caractere, sincronizat cu redarea videoclipului Bad Apple pe un dispozitiv extern (videoclip demonstrativ).

\"Interfa\u021ba<\/center>
\r\n \"Reda\u021bi\r\n
<\/div>\r\n <\/div><\/center>
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u043c\u0443\u0437\u044b\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0430 Yamaha PSR-E433. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u0414\u043e\u0441\u0442\u0443\u043f \u043a shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 MIDI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 SysEx, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Shell-ul ascuns \u00een sintetizatorul Yamaha, care a permis executarea codului prin MIDI | ProHoster","description":"Anna Antonenko, care se ocup\u0103 de dezvoltarea sistemelor \u00eencorporate \u0219i care, \u00een timpul liber, dezvolt\u0103 sistemul de operare BOSS (BEAM-based Operating System with Security), a publicat rezultatele ingineriei inverse.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0430\u044f \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 Yamaha, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 MIDI | ProHoster","og:description":"\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-06T13:46:04+00:00","article:modified_time":"2025-01-06T13:46:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:26:19","updated":"2026-01-23 09:26:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/121246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=121246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/121246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/121247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=121246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=121246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=121246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}