view miscprog/rfcap-grep.c @ 160:db3b300da465

malware version of the C118 bootloader reversed
author Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
date Thu, 15 May 2014 08:38:42 +0000
parents 597143ba1c37
children
line wrap: on
line source

/*
 * This utility performs a memmem() binary "grep", checking to see if a given
 * binary file (mokoN firmware image) contains a particular binary "string"
 * of 16 bytes: namely, the 16 bytes found in the "standard" /gsm/com/rfcap
 * file on GTA0x modems.
 */

#define	_GNU_SOURCE
#include <sys/types.h>
#include <sys/file.h>
#include <sys/stat.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>

u_char needle[16] = {0x00, 0x1F, 0x41, 0x14, 0x00, 0x00, 0x00, 0x00,
		     0x50, 0x00, 0x00, 0xA5, 0x05, 0x00, 0xC0, 0x00};
u_char *haystack;
size_t haystack_size;

read_file(filename)
	char *filename;
{
	int fd;
	struct stat st;

	fd = open(filename, O_RDONLY);
	if (fd < 0) {
		perror(filename);
		exit(1);
	}
	fstat(fd, &st);
	if (!S_ISREG(st.st_mode)) {
		fprintf(stderr, "error: %s is not a regular file\n", filename);
		exit(1);
	}
	haystack_size = st.st_size;
	haystack = malloc(haystack_size);
	if (!haystack) {
		fprintf(stderr, "unable to malloc buffer for %s\n", filename);
		exit(1);
	}
	read(fd, haystack, haystack_size);
	close(fd);
}

main(argc, argv)
	char **argv;
{
	u_char *result;

	if (argc != 2) {
		fprintf(stderr, "usage: %s mokoN.bin\n", argv[0]);
		exit(1);
	}
	read_file(argv[1]);
	result = memmem(haystack, haystack_size, needle, sizeof needle);
	if (result)
		printf("Found the rfcap bytes at offset 0x%x\n",
			result - haystack);
	else
		printf("rfcap bytes not found in this image\n");
	exit(0);
}