{"id":121246,"date":"2025-01-06T15:46:02","date_gmt":"2025-01-06T13:46:04","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi"},"modified":"2025-01-06T15:46:02","modified_gmt":"2025-01-06T13:46:04","slug":"skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","title":{"rendered":"Den dolda kommandotolken i synthesizern Yamaha, som m\u00f6jliggjorde kodk\u00f6rning via MIDI","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Anna Antonenko, som arbetar med utveckling av inbyggda system och p\u00e5 sin fritid utvecklar operativsystemet BOSS (BEAM-baserat operativsystem med s\u00e4kerhet), har publicerat resultaten av omv\u00e4nd ingenj\u00f6rskonst av den musikaliska synthesizern Yamaha PSR-E433. Under arbetet identifierades en obfuskerad shell-gr\u00e4nssnitt i synthesizern, vilket m\u00f6jliggjorde k\u00f6rning av egen kod p\u00e5 firmware-niv\u00e5. \u00c5tkomsten till shell-gr\u00e4nssnittet sker genom att skicka MIDI-paket med SysEx-meddelanden, vilka kan \u00f6verf\u00f6ras vid anslutning av synthesizern via USB-porten. De insamlade uppgifterna fr\u00e5n den omv\u00e4nda ingenj\u00f6rskonsten, inklusive information om chipet och firmware, samt kodexempel och debugdumpningar, finns p\u00e5 GitHub. <\/p>\n

Intresset f\u00f6r omv\u00e4nd ingenj\u00f6rskonst uppstod f\u00f6r flera \u00e5r sedan, efter att Anna beslutade sig f\u00f6r att reng\u00f6ra innand\u00f6met p\u00e5 synthesizern fr\u00e5n damm och samtidigt tillfredsst\u00e4lla sin nyfikenhet kopplad till att vilja se vad enheten inneh\u00e5ller. P\u00e5 kretskortet fanns en chip YAMAHA SWL01U, om vilken det inte gick att hitta detaljerad information p\u00e5 internet. F\u00f6r ett par m\u00e5nader sedan st\u00f6tte Anna p\u00e5 en manual f\u00f6r en liknande modell av synthesizer, d\u00e4r en pinout f\u00f6r chipet angavs. Anna demonterade enheten igen och b\u00f6rjade experimentera, med hj\u00e4lp av de tillg\u00e4ngliga pinnar p\u00e5 kretskortet f\u00f6r debuggr\u00e4nssnittet JTAG och UART-porten.

\"Den<\/center> <\/p>\n

Genom att anv\u00e4nda OpenOCD-debuggern, anslutning till JTAG och experimenterande kom det fram att det p\u00e5 kretskortet anv\u00e4nds ett chip med ARM7TDMI-processork\u00e4rna. Genom att studera minneslayouten i debuggern lyckades man extrahera inneh\u00e5llet i firmware som lagras i ROM och Flash-minne. Efter detta analyserades firmwarebilderna i omv\u00e4nd ingenj\u00f6rspaketet Ghidra. <\/p>\n

Vid granskning av textstr\u00e4ngar extraherade fr\u00e5n firmware observerades en upps\u00e4ttning str\u00e4ngar (\"help\", \"info\", \"ver\", \"logout\" osv.) som liknar kommandon fr\u00e5n ett kommandogr\u00e4nssnitt. Studien av referenser till dessa str\u00e4ngar gjorde det m\u00f6jligt att hitta kod som anropade funktioner f\u00f6r att bearbeta kommandon, vilket p\u00e5minde om ett inloggningsgr\u00e4nssnitt och kommandoradsskal. Det framkom ocks\u00e5 att det finns ett kommando f\u00f6r att aktivera skalet, \"login\", d\u00e4r ett l\u00f6senord \"#0000\" m\u00e5ste anges. void shell_run_command(char* command_input) { if (shell_login_state == 0) { if (shell_compare_command(command_input, \"login\") == 0) { shell_ask_passwd(); \/\/ skriver ut \"passwd? \" shell_login_state = 1; } } else if (shell_login_state == 1) { if (shell_compare_command(command_input, \"#0000\") == 0) { shell_login_ok(); \/\/ skriver ut \"login OK\" shell_login_state = 2; } else { shell_print(\"Passwd Error\\r\"); shell_login_state = 0; } } else { \/\/ k\u00f6r faktiskt kommandot } } <\/p>\n

Vid ytterligare unders\u00f6kning av firmware visade det sig att kommandon behandlas i paket som alltid b\u00f6rjar med samma 8 byte data och avslutas med koden 0xf7. Eftersom extern interaktion med syntetizern endast sker via MIDI, och i MIDI-specifikationen finns en speciell typ av SysEx-meddelanden, misst\u00e4nktes det att just dessa kunde anv\u00e4ndas f\u00f6r att skicka kommandon. Teorin st\u00f6ddes ocks\u00e5 av att SysEx-meddelanden och de paket som tolkades av gr\u00e4nssnittet inleddes med koden 0xf0, f\u00f6ljt av tillverkarens identifierare 0x43 (Yamaha). <\/p>\n

F\u00f6r att verifiera hypotesen skrevs ett Python-skript som \u00f6versatte inmatningarna till MIDI-protokollpaket. Metoden fungerade: login passwd? #0000 login OK > help logout help ? info ver stack perf-on perf-off perf-disp d dp d xxxxx d\/s xxxxx m ADDRESS DATA m\/b ADDRESS DATA m\/w ADDRESS DATA m\/l ADDRESS DATA > info DevelopName PSR-E433 DevelopNumber #3341 Main DevelopNumber #3341 Make data & time MAY 16 2012 19:00:57 J\/E Select English > <\/p>\n

I hj\u00e4lpen som visades vid skickande av kommandot \"help\" fanns bland annat kommandon f\u00f6r att \u00e4ndra minnesinneh\u00e5llet. Med hj\u00e4lp av dessa kommandon var det m\u00f6jligt att ladda valfri kod i minnet och \u00f6verf\u00f6ra kontrollen till den genom att \u00e4ndra pekaren p\u00e5 stacken som anv\u00e4ndes f\u00f6r att \u00e5terv\u00e4nda efter kommandobearbetningen. Som ett experiment placerades en enkel applikation, skriven i assembler, i ett oanv\u00e4nt minnesomr\u00e5de som visar str\u00e4ngen \"HeloWrld\" p\u00e5 en 8-teckens LCD-display. Programmet formaterades som en vanlig MIDI-fil som enkelt kunde \u00f6verf\u00f6ras till enheten.

\"Den<\/center> <\/p>\n

D\u00e4refter b\u00f6rjade arbetet med att studera egenskaperna hos grafikutsignalering p\u00e5 LCD-displayen, vilket kulminerade i beredningen av kod som visar godtyckligt pixelinneh\u00e5ll i teckenomr\u00e5det, synkront med uppspelning av videon Bad Apple p\u00e5 en extern enhet (video med demonstration).

\"Den<\/center>
\r\n \"Spela\r\n
<\/div>\r\n <\/div><\/center>
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430 \u043c\u0443\u0437\u044b\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0430 Yamaha PSR-E433. \u0412 \u0445\u043e\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0434\u0451\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u044b \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 \u0431\u044b\u043b \u0432\u044b\u044f\u0432\u043b\u0435\u043d \u043e\u0431\u0444\u0443\u0441\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0438\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438. \u0414\u043e\u0441\u0442\u0443\u043f \u043a shell-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 MIDI-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0441 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c\u0438 SysEx, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":121247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121246","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dold kommandoradsgr\u00e4nssnitt i synthesizern Yamaha, som m\u00f6jliggjorde kodk\u00f6rning via MIDI | ProHoster","description":"Anna Antonenko, som arbetar med utveckling av inbyggda system och p\u00e5 sin fritid vidareutvecklar operativsystemet BOSS (BEAM-baserat operativsystem med s\u00e4kerhet), publicerade resultaten av omv\u00e4nd ingenj\u00f6rskonst.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0440\u044b\u0442\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u0430\u044f \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0430 \u0432 \u0441\u0438\u043d\u0442\u0435\u0437\u0430\u0442\u043e\u0440\u0435 Yamaha, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0447\u0435\u0440\u0435\u0437 MIDI | ProHoster","og:description":"\u0410\u043d\u043d\u0430 \u0410\u043d\u0442\u043e\u043d\u0435\u043d\u043a\u043e, \u0437\u0430\u043d\u0438\u043c\u0430\u044e\u0449\u0430\u044f\u0441\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0435 \u0432\u0440\u0435\u043c\u044f \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 BOSS (BEAM-based Operating System with Security), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0438\u043d\u0436\u0438\u043d\u0438\u0440\u0438\u043d\u0433\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/skrytaya-komandnaya-obolochka-v-sintezatore-yamaha-pozvolivshaya-vypolnit-kod-cherez-midi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-01-06T13:46:04+00:00","article:modified_time":"2025-01-06T13:46:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121246","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 09:26:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 09:26:19","updated":"2026-01-23 09:26:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=121246"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/121246\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/121247"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=121246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=121246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=121246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}