Snom 370 VoIP Phone Password Recovery - Page 1
Forum section: electronics / projects

author: gnif
author_rank: Unknown
timestamp: September 25, 2014, 10:17:06 am
content: Hey All,Just thought I would post a little bit of info here on a little hack I performed last night, not exactly electronics, more software then anything, but someone else might want this at some point, so posting it all here for the world to see.Five years ago I was issued this phone and promptly set it all up, and then discarded my voip password. Now like all good systems, it does not allow password recovery, even if you dump the MTD using its debug interface, it discards the JFFS2 block that contains the information. Now I could just wait for my superiour to return from his break and give me the password, or I could try to 'recover' it myself.Upon tearing it apart, I found 3 very clearly marked pads under the main PCB, GND/RX/TX. My DSO was quickly attached and noted that there was 115200 baud serial data at 3.3v levels. So I broke out my USB RS232 adaptor and wired it up to the pads, only to find I was getting nothing from the port now. After much messing around I discovered the issue, the 3.3V from the TX of my USB adaptor was keeping the SoC partially powered while resetting the device, and serial output would not work. The solution, power the device, and then quickly connect the adaptor. That solved I was greeted with a custom built version of u-boot, with a 'Press enter' to abort boot, and then after doing so, the following promptCode:INCA-IP-ROM #Going forward with u-boot... first thing is first, printenv:Code:INCA-IP-ROM # printenvbootcmd=run flash_allbaudrate=115200nfsargs=setenv bootargs root=/dev/nfs rw nfsroot=$(serverip):$(rootpath)ramargs=setenv bootargs root=/dev/ram rwaddip=setenv bootargs $(bootargs) ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):offflash_nfs=run nfsargs addip addmisc;bootm $(kernel_addr)flash_self=run ramargs addip addmisc;bootm $(kernel_addr) $(ramdisk_addr)net_nfs=tftp 80500000 $(bootfile);run nfsargs addip addmisc;bootmrootpath=/opt/eldk/mips_4KCbootfile=uImagekernel_addr=B0040000ramdisk_addr=B0100000u-boot=u-boot.binloadloader=tftp 80500000 $(u-boot)updloader=protect off 1:0-2;era 1:0-2;cp.b 80500000 B0000000 $(filesize)loadkernel=tftp 80400000 $(bootfile)updkernel=era b0040000 b00fffff;cp.b 80400000 B0040000 $(filesize)jffs2args=setenv bootargs root=/dev/mtdblock2 rw rootfstype=jffs2flash_all=run jffs2args addip addmisc;fsload 80400000 /boot/uImage;bootm 80400000factoryargs=setenv bootargs root=/dev/mtdblock3 rw rootfstype=jffs2factory_system=run factoryargs addip addmisc;bootm $(kernel_addr)failsave=setenv bootcmd run factory_system;saveenv;run factory_systemreset_env=protect off b0030000 b003ffff;erase b0030000 b003ffffdhcp=offconsole_on=setenv addmisc 'setenv bootargs $(bootargs) console=ttyS0,$(baudrate) ethaddr=$(ethaddr) panic=1'console_off=setenv addmisc 'setenv bootargs $(bootargs) console=NULL ethaddr=$(ethaddr) panic=1'ethact=INCA-IP Switchethaddr=<REMOVED>ipaddr=192.168.0.105netmask=255.255.0.0serverip=192.168.0.38gatewayip=192.168.0.1addmisc=setenv bootargs $(bootargs) console=NULL ethaddr=$(ethaddr) panic=1bootdelay=1phone_signature=<REMOVED>phone_info=Mac:<REMOVED>;Version:Standard;Hardware:snom370 (H: R2A);Date:09/04/10;Copyright(C) snom technology AGstdin=serialstdout=serialstderr=serialFollowing this through, we can see that the bootcmd is 'run flash_all', which compiles the bootargs, loads the kernel at 0x80400000 from the jffs2 filesystem, and then boots the kernel. More interesting in here is the 'reset_env' parameter, which blanks out 0xb30000-0xb003ffff of the flash, this is the block missing from the firmware dump from the debug interface.So, before trying to dump this out I decided to try a trick I commonly use to reset passwords on servers for clients who loose their root password, init=/bin/sh.Code:setenv bootargs root=/dev/mtdblock2 rw rootfstype=jffs2 ip=$(ipaddr):$(serverip):$(gatewayip):$(netmask):$(hostname):$(netdev):off console=ttyS0,115200 ethaddr=$(ethaddr) panic=1 mem=32M init=/bin/shfsload 80400000 /boot/uImagebootm 80400000And here is the money shotCode:Checking for Inca-IP type.memsize=32flash_start=0xb0000000flash_size=8388608CPU revision is: 00018009Primary instruction cache 4kB, physically tagged, 2-way, linesize 16 bytes.Primary data cache 4kB, 2-way, linesize 16 bytes.Linux version 2.4.31-INCAIP-4.3 (anderssv@anderssv-lx-01) (gcc version 3.3.6) #1 Do 7. Jul 12:49:43 CEST 2011Can't analyze prologue code at 8001ad70Inca-IP Multiplex InitializationLEDs=0 Addr=23 Keys=0SSC1 n/aSSC2 n/aPWM1 availablePWM2 n/aDetermined physical RAM map:User-defined physical RAM map:memory: 02000000 @ 00000000 (usable)On node 0 totalpages: 8192zone(0): 8192 pages.zone(1): 0 pages.zone(2): 0 pages.Kernel command line: root=/dev/mtdblock2 rw rootfstype=jffs2 ip=192.168.0.105:192.168.0.38:192.168.0.1:255.255.0.0:::off console=ttyS0,115200 console=ttyS0,115200 ethaddr=<REMOVED> panic=1 mem=32M init=/bin/shINCA-IP CPU Ver. 1.4 150MHzUsing 75.000 MHz high precision timer.Syam before calibrate_delayCalibrating delay loop...149.50 BogoMIPSSyam after calibrate_delayMIPS CPU counter frequency is fixed at 75000000 HzMemory: 30608k/32768k available (1525k kernel code, 2160k reserved, 96k data, 80k init, 0k highmem)Dentry cache hash table entries: 4096 (order: 3, 32768 bytes)Inode cache hash table entries: 2048 (order: 2, 16384 bytes)Mount cache hash table entries: 512 (order: 0, 4096 bytes)Buffer cache hash table entries: 1024 (order: 0, 4096 bytes)Page-cache hash table entries: 8192 (order: 3, 32768 bytes)Checking for 'wait' instruction... available.POSIX conformance testing by UNIFIXLinux NET4.0 for Linux 2.4Based upon Swansea University Computer Society NET3.039Initializing RT netlink socketStarting kswapdJFFS version 1.0, (C) 1999, 2000 Axis Communications ABJFFS2 version 2.1. (C) 2001 Red Hat, Inc., designed by Axis Communications AB.pty: 256 Unix98 ptys configuredttyS0 at MEM 0xb8000400 (irq = 81) is a INCAIPASCSoftware Watchdog Timer: 0.05, timer margin: 60 seceth0: incaipsw, <REMOVED>loop: loaded (max 8 devices)Universal TUN/TAP device driver 1.5 (C)1999-2002 Maxim Krasnyanskyinit_incaip_mtd: chip probing count 0Amd/Fujitsu Extended Query Table v1.1 at 0x0040number of CFI chips: 1cfi_cmdset_0002: Disabling fast programming due to code brokenness.init_incaip_mtd: bank1, name:INCA-IP Bank 0, size:8388608bytes priv1=0xb0000000INCA-IP flash0: Using static image partition definitionCreating 5 MTD partitions on "INCA-IP Bank 0":0x00000000-0x00040000 : "U-Boot"0x00040000-0x00050000 : "Environment"0x00050000-0x00800000 : "filesystem"0x00050000-0x00800000 : "mirror_fs"0x00000000-0x00800000 : "whole flash"IPv6 v0.8 for NET4.0IPv6 over IPv4 tunneling driverNET4: Linux TCP/IP 1.0 for NET4.0IP Protocols: ICMP, UDP, TCPIP: routing cache hash table of 512 buckets, 4KbytesTCP: Hash tables configured (established 2048 bind 4096)ip_conntrack version 2.1 (256 buckets, 2048 max) - 292 bytes per conntrackip_tables: (C) 2000-2002 Netfilter core teamNET4: Unix domain sockets 1.0/SMP for Linux NET4.0.ip6_tables: (C) 2000-2002 Netfilter core team802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>All bugs added by David S. Miller <davem@redhat.com>Device availability: pwm1=1 and pwm2=0Device pwm2 not available!PWM device registered. major: 251./proc/driver/pwm1 created!INCA-IP Pulse Width Modulator initializedInca-IP Switch Access InitializationSwitch device registered. major: 248./proc/driver/inca_switch_lan created!Inca-IP Port Initializationinca-port: Registered port device with major. 247INCA-IP OAK mailbox driver, Version 0.1.1.2(c) Copyright 2003, Infineon Technologies AGVFS: Mounted root (jffs2 filesystem).Freeing unused kernel memory: 80k freedAlgorithmics/MIPS FPU Emulator v1.5Bus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activatedBus handler 1 activated#This worked a treat, logged me into a clean shell, I just had to correct the path so busybox tools could be found (PATH=/bin). Digging around the filesystem I found what I was looking for in /snomconfig, a file (which name eludes me, I did this last night and didn't note it) that contained exactly what I was looking for, all the identies on the device, and their plain text passwords, just had to cat it out and bingo!I hope this helps anyone else trying to do something similar.