Hacking an eink tablet

Hi!, can anyone help me?, im trying to hack a Supernote A5 so i can run homebrew on it, it doesnt have a lot of features, it is manufactured in china, it is really secure for what i've done, it runs on linux 3.x to 4.x according to Nmap i've done a nessus scan, which shows only 14 vulnerabilities but just the info type Nmap just shows that the port 111 is open, all other ports are closed it let's you connect to a windows pc and transfer files, i dont know what version of samba it is running, all it says it is an Mtp device It has mail capabilities but gmail wont let me configure the imap port it has no browser it recieves updates via zip files which are encrypted, i've tried john the ripper on that and hashcat, but the password is in chinese, so it gave me a false positive Can anyone help me on this points? >How could i know what pdf reader is using so i can craft a malicious pdf >how could i check the usb comunication it uses, so i can search for vulnerabilities >How can i make a dictionary in chinese so i can bruteforce the password on the zip updates >how to get more information on this black box >how can i search on how to do a mtp registry attack? ive tried google dorking their main site, but they are protected, if anyone has more ideas on how to hack this device i would appreciate them a lot, im new to this, i have kali on a VM on windows, and have read a metasploit device

Never done it but people who work on porting openwrt usually look for hardware debugging jumpers on the board. Sometimes it's as easy as connecting a debugger to it and you get a shell connection. Sometimes you need to send an "interrupt" on booting process. Someone else here probably knows more but you can look it up. An alternative is make sure to find a generic name for the device or the software. Chinese stuff is usually branded and sold under 50 different names. Someone else might have already done the work for you for the same device under a different name.

>>9508 i havent seen the same type of device i cannot open the tablet, it is sealed with plastic and it is expensive, i cannot afford to lose it

managed to open it, what debbuging jumper do i have to search?

cont

last one

Processor SOC name + UART Probably will be some of the test pads

Some Better quality pics might help. I can't read soykaf on that board. But like ^ said, find the soc and uart into it. You'll need a raspberry pi or another way to communicate. You might be in over your head here.

can you post the sysinfo from nessus, knowimg what os were working with could help

These where a bitch to take, hope it works, the arm processor is an MCIMX6L8DVN10AB this one https://www.digikey.com.mx/product-detail/es/freescale-semiconductor-nxp/MCIMX6L8DVN10AB/MCIMX6L8DVN10AB-ND/4234716?WT.z_slp_buy=freescale_imx6

There is a chip that had the identificator removed, but there are some marks, i'll try to see what it is the name

any thoughts?, if yall want to make this faster, we could use an irc or discord.

>>9515 nessus didn't identify the os, neither did nmap, here is the nmap dump, it is an xml, so change it to xml i upload it with pdf because it wont let me upload the xml

>>9514 i have only an arduino on my hands by the moment, but i can get a raspberrypi 2, i dont know how to uart, im new

>>9519 do you have user/pass on the device? can you boot into debug mode? do you have dev tools? Am assuming it's some version of android or am I wrong?

>>9521 No No also no

>>9521 it aint android

>>9522 damn, can you connect the device to the pc, and when you do, can you navigate the linux filesystem. I.E. can you see /etc/passwd or any other info.

>>9525 no, it only shows as a mtp device, and i can only transfer files to specific folders, but i can transfer any type of file

Also it advertises as a 1 gb model, but i searched the die NT6TL256T32BA and it advertises as either 4gb or 8gb, so maybe i can unlock that in the future, or maybe they are using the ram for something else dunno, or maybe the soc cant work with 4/8gb, it is a single core arm9 processor at 1ghz

>>9527 you might get lucky with a juice jacking attack, you can see if there is a Linux pdf exploit that might work (IDK what pdf reader it has on there.) https://en.wikipedia.org/wiki/Juice_jacking but im stumped...

>>9528 thanks, im downloading a book on the subject, but it is for android, dunno if i can apply the same

>>9529 before I forget, try connecting via samba, or doing some samba enum via msf.

>>9530 uh i have a problem when i connect it to kali, it says mtp 00,1028 error, when i try to connect multiple times the tablet crashes, how could i solve this, also a thing that you have to do is confirm in the tablet if you wish to transfer files

>>9530 deadass doesnot has any smb ports open

Why can chinks made safe devices but not make any useful app the fuarrrk is wrong with them

i may have something?

Absolutely nothing

Deadass

How can i put a usb sniffer on windows? or how can i fix the issue with mtp on kali in order to connet to the tablet?

for some reason it detects it as a google pixel c

going to bed lain, last piece of advice is to enumerate more and see if you change settings on the device good luck

>>9539 have a good night

Some more ideas: 1)Did you try nmap --script=discovery 2) Try to find the earlier firmware zips on the web, maybe it's unencrypted. 3) If you have a friend who speaks mandarin they could search the Chinese wired for clues. 4) Try to get the firmware password somehow, maybe even tricking the customer support or just brute forcing.

>>9541 1i tried the -A option, i doubt the script disovery will provide something else buy let me check 2 yes, all encrypted, and the wayback time machine doesn't have all 3 i have no chinese friend 4 Yes, i have the hash for the zip file, but turns out the password is in chinese, so i need a chinese dictionary, hashcat gave me false positives , also customer support wont budge, i even tried google dorking with their site and nada

>>9541 discovery showed this Starting Nmap 7.80 ( https://nmap.org ) at 2019-12-22 00:59 Hora estándar central (México) too short too short too short too short too short too short too short Pre-scan script results: | broadcast-igmp-discovery: | 192.168.1.254 | Interface: eth6 | Version: 2 | Group: 239.255.255.250 | Description: Organization-Local Scope (rfc2365) |_ Use the newtargets script-arg to add the results as targets | ipv6-multicast-mld-list: | ::: | device: eth6 | mac: 8c:f7:10:16:e7:ee | multicast_ips: |_ ff02::fb (mDNSv6) | targets-asn: |_ targets-asn.asn is a mandatory parameter | targets-ipv6-multicast-echo: | IP: 2806:10ae:8:920b:aad3:f7ff:fe67:28e4 MAC: a8:d3:f7:67:28:e4 IFACE: eth6 | IP: 2806:10ae:8:920b:8ef7:10ff:fe16:e7ee MAC: 8c:f7:10:16:e7:ee IFACE: eth6 | IP: fe80::1 MAC: a8:d3:f7:67:28:e4 IFACE: eth6 |_ Use --script-args=newtargets to add the results as targets | targets-ipv6-multicast-invalid-dst: | IP: 2806:10ae:8:920b:8ef7:10ff:fe16:e7ee MAC: 8c:f7:10:16:e7:ee IFACE: eth6 |_ Use --script-args=newtargets to add the results as targets | targets-ipv6-multicast-mld: | IP: :: MAC: 8c:f7:10:16:e7:ee IFACE: eth6 | |_ Use --script-args=newtargets to add the results as targets Nmap scan report for 192.168.1.73 Host is up (0.012s latency). Not shown: 999 closed ports PORT STATE SERVICE 111/tcp open rpcbind | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 3,4 111/tcp6 rpcbind | 100000 3,4 111/udp6 rpcbind | 100024 1 33999/udp6 status | 100024 1 34062/tcp status | 100024 1 34094/udp status |_ 100024 1 53564/tcp6 status MAC Address: 8C:F7:10:16:E7:EE (Ampak Technology) Host script results: |_dns-brute: Can't guess domain of "192.168.1.73"; use dns-brute.domain script argument. |_fcrdns: FAIL (No PTR record) |_ipidseq: ERROR: Script execution failed (use -d to debug) |_path-mtu: ERROR: Script execution failed (use -d to debug) |_qscan: ERROR: Script execution failed (use -d to debug) |_sniffer-detect: Unknown (tests: "1______1") Nmap done: 1 IP address (1 host up) scanned in 24.88 seconds

>>9508 >people who work on porting openwrt usually look for hardware debugging jumpers on the board >>9510 At a first glance J8 (top right, above sticker, at edge of board) or J9 (lower middle, near edge of board, just above the middle screw) looks to be of interest. They are clearly designed for an external connector to attach and have a set of resistors and capacitors around them to detect when a connector is plugged in. t. basic ability in reading PCBs for reverse engineering. The wire ribbons connected to the mainboard from the other peripheral components are also another way in if you can determine the interface types (count pins, multimeter test connections, etc). Other things of note... There are also TPx (TP9 to the left of J9 for instance) that appear to be multimeter test points. RTC (rechargable) battery lower left. Shielded wifi module lower right, with black antenna wire running to an external aerial at the outer edge. It also looks like some chip package names have been milled off for secrecy (e.g. U12). Searching for 雷塔Supernote A5电子笔记本 服务手册 pdf (supernote service manual pdf) didn't find anything, but you might get lucky using a different term in Chinese. It's like deciphering a hardware puzzle.

>>9544 i can count the pins, it is the first time i do that, i do have the tools, what can i do? or where should i search in order to test the connections, the package milled seemed to have traces left, with a magnification lense i may be able to get out a name, what resistors should i use or what equipmente should i use? i have protoboard, an arduino uno, i will get a raspberry pi 2 soon tho, i have equipment to solder, and can buy stuff, i also got the cables that you use to connect the arduino the little ones i google dorked supernote, and tried to do search with chinese charaacters, no luck aye it is a hardware puzzle

>>9545 As mentioned, I'd look at J8 and J9 first since the paired 5 pins in each suggest JTAG*. Use a multimeter to test the traces (see videos online how. Eev blog, big clive, etc) Finding any datasheets for micro controllers the traces run into might help with deciphering the logic. Look at similar tablets it was cloned from, etc. Each clue helps answer the next part of the puzzle, that can take weeks or months to solve. Good luck! *A JTAG interface is a special interface added to a chip. Depending on the version of JTAG, two, four, or five pins are added. The four and five pin interfaces are designed so that multiple chips on a board can have their JTAG lines daisy-chained together if specific conditions are met https://en.wikipedia.org/wiki/JTAG

>>9534 You are trying to log in with the USER "-N" on the WORKGROUP domain. What are you trying to accomplish here? There are tons of beginner hardware hacking videos on YT, I recommend the IoT village talks from defcon.

>>9547 I was trying commands, didn't knew what i was doing

>>9546 i don't think it has similar tablets..., i will try the multimeter thing tho

Note the similarity between the JTAG points on the board in this photo, and those I saw on your board at J8 and J9. I'm pretty certain J8 & J9 are JTAG (or UART) connection points. PHOTO SOURCE: https://discuss.96boards.org/t/how-to-use-jtag-connector-on-hikey960/1761/2

Datasheet says UART balls are B19 and D19. Try tracing them to test pad groups, I'm sure they stay close to each other, are there test pads on the other side? You can also try searching Chinese web for board layouts.

>>9552 what chinese page?, i only see tp4, tp10 tp7, tp7, on the square where the arm processor is

Here is the back of the pcb, because of my work, i haven't had the time to test the jtags, and i haven't found a video that tells me how to probe, the jtags, i have the 10k resistor, so i attach that to the positive side of the voltmeter, and do i check for voltage? or amperage?, i don't really get what i have to do, and when i have that, do i solder those jtags to a protoboard with cables, and the cables to an arduino?, is there a book about hardware hacking or testing that i can read?

Since your board has 10 JTAG pads, It's possible that they are made for serial connection with DE-9 connector which has 9 pins and 10th probably goes for ground/shielding.

>>9554 LOL! Look at all those test points on the back of the board! T85,T86,T87,T88,T97 all clustered around the likely JTAG point. >>9554 >is there a book about hardware hacking or testing that i can read? Why do you think I gave you those electronics video channels to watch?

>>9556 So i've look some videos, my to do list looks like this 1 Make a bus blaster jtag for arduino/raspberry 2 detect and identify jtag pinnout with jtagulator? or other technique 3 dump bios startup 4 dump external memory 5 dump the update sequence of the tablet 6 exploits? 7 ????? profit

>>9507 >how could i check the usb communication it uses, so i can search for vulnerabilities Wireshark has a USB capture module. Debugging (or even understanding) USB messages is extremely hard though, so good luck on that front.

>really secure meaning only creators know how to read your stuff on it without any effort?

>>9610 uh dont know, will update later

Ok, i kinda fuarrrkedup so in the J8 i tried to connect cables, but i broke one of the solder pads, it was a groud one, it has two ground pads tho, looking at the cpu sheet it says it has uart i2c and jtag?, how could i check where is the uart or i2c? those are way easier than the jtag, and i kinda dont want to fuarrrk this up

ok i managed to connect all jtag ports to cables, i will try jtag enum, does it matter if i couldnt get one? it was a gnd pin

Jtag ports are fuarrrked, i fuarrrked up, i desoldered a capacitor i believe and a resistance, i hope it will boot since it is only on the jtag port, man it is really hard to solder this tf

>>9552 there where no b19 or d19 they changed every name to T or other stuff

Its been a while, can someone help me ? m trying to get the password of a zip file with a content of 5 other files, i am not sure if the password applies to every file, i believe the password is in chinese, in the past i've tried to get the hashes with john2zip and crack them with hashcat, but it was useless, and it gave me false positives if i try to use the -o option for each file in the zip it gave me a massive hash of 300mb, can someone help me on how to use hashcat for chinese characters? here are the files, it is worth mentioning that at first it wouldn't let me use hashcat the error said something along the lines of utf-8 error, john tells me utff-16 BOM seen in input file, i do believe the password is in chinese

I made it, after a long effing time i managed to get the zip password, can someone help me? there are sh files and other stuff, i think its java the main language

>>11390 Post the code somewhere, just nothing like github that could DMCA you instantly. You might want something that supports git, it might be useful to reference code with a simple link. Last hypothesis might be a torrent and dropping here the magnet.

>>11391 how? i could link the file and password tho

>>11393 didn't you uncompress the zip? just upload the content w/password. or if you want, upload and provide the password.

>>11404 soo, i cant disclose how i managed to get in but it was possible, what should i learn to develop apps for linux? the distro is based on poky

>>11393 link it then

How is DRM protections?