diff mot931c/emu.c @ 157:9082f3991fe5

mot931c break-in procedure cracked
author Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
date Wed, 14 May 2014 05:34:37 +0000
parents
children
line wrap: on
line diff
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/mot931c/emu.c	Wed May 14 05:34:37 2014 +0000
@@ -0,0 +1,97 @@
+#include <sys/types.h>
+#include <sys/file.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <strings.h>
+
+static int fd;
+
+static u_char verquery[13] = {0x02, 0x14, 0x41, 0x20, 0x20, 0x00, 0x00,
+			      0x04, 0x00, 0x00, 0x00, 0x45, 0x02};
+
+static u_char verquery_resp[10] = {0x41, 0x00, 0x04, 0x00, 0x00, 0x00,
+				   '8', '.', '8', '.'};
+
+static u_char download_hdr[3] = {0x02, 0x14, 0x40};
+static u_char download_resp[2] = {0x40, 0x00};
+
+send_stx()
+{
+	static u_char stx = 0x02;
+
+	write(fd, &stx, 1);
+}
+
+send_rvtmux_byte(b)
+{
+	u_char buf[2];
+	int l, o;
+
+	buf[0] = 0x10;
+	buf[1] = b;
+	if (b == 0x02 || b == 0x10) {
+		o = 0;
+		l = 2;
+	} else {
+		o = 1;
+		l = 1;
+	}
+	write(fd, buf + o, l);
+}
+
+send_etm_resp(data, datalen)
+	u_char *data;
+{
+	u_char csum;
+	int i;
+
+	printf("Responding with:");
+	send_stx();
+	send_rvtmux_byte(0x14);
+	csum = 0;
+	for (i = 0; i < datalen; i++) {
+		printf(" %02X", data[i]);
+		send_rvtmux_byte(data[i]);
+		csum ^= data[i];
+	}
+	send_rvtmux_byte(csum);
+	send_stx();
+	putchar('\n');
+}
+
+main(argc, argv)
+	char **argv;
+{
+	u_char buf[1024];
+	int cc, i;
+
+	if (argc != 2) {
+		fprintf(stderr, "usage: %s pty\n", argv[0]);
+		exit(1);
+	}
+	fd = open(argv[1], O_RDWR);
+	if (fd < 0) {
+		perror(argv[1]);
+		exit(1);
+	}
+	for (;;) {
+		cc = read(fd, buf, sizeof buf);
+		if (cc < 0) {
+			perror("read error");
+			exit(1);
+		}
+		if (cc == 0) {
+			fprintf(stderr, "read EOF\n");
+			exit(1);
+		}
+		printf("read %d bytes:", cc);
+		for (i = 0; i < cc; i++)
+			printf(" %02X", buf[i]);
+		putchar('\n');
+		if (cc == sizeof(verquery) && !bcmp(buf, verquery, cc))
+			send_etm_resp(verquery_resp, sizeof verquery_resp);
+		if (cc > 3 && !bcmp(buf, download_hdr, 3))
+			send_etm_resp(download_resp, sizeof download_resp);
+	}
+}