Nand Image unpacking/extraction from NAND S34ML04G100 BGA and MK MCIMX6S5DVM10AC - Page 1
Forum section: electronics / general

author: Icherkayev
author_rank: Newbie
timestamp: May 16, 2023, 01:58:46 am
content: Hello everyone in this community!i have a coffee machine running on MCIMX6S5DVM10AC processor with nand S34ML04G100.OS: WINCE 7open telnet and ftp portsthrough the programmer, I took an image from nand:https://drive.google.com/file/d/1Q0BUCbalDwvgbLmmEWwJ-0r9wqLuYnIW/view?usp=share_link(the image is working, I restored it to a new nand memory and the coffee machine started working.)full log startup from console:https://drive.google.com/file/d/1iZT2SVfnVRIC4mLKaxn17Ev4q1z5QaVA/view?usp=share_linkboot options:https://drive.google.com/file/d/1wONSk-8-tSiN1N7sx3kPk2RwgIfZH8KT/view?usp=share_linkCan anyone share a tip for extracting a disk image? I want to know the telnet password. This password is also the FTP password.what I need it for: I have a VNC server for this machine, it will help reduce the time for their maintenance. Price changes, configuration changes, and so on.If more information is needed, I will provide it. I will be glad to any advice.Thank you all!

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 16, 2023, 03:33:28 pm
content: Use the attached tool to convert raw NAND dump to bin (the tool requires Python 3.xx and bchlib installed, theoffsetparameter for your image is 0x84000), then use any WinCE nk.bin unpacker on it (there are many of them still around from WinCE era). The NK image is at +0x220000 in the converted bin.

author: Icherkayev
author_rank: Newbie
timestamp: May 17, 2023, 04:25:00 am
content: Good afternoon Thank you very much for your reply.1.Converted the file .2. any WinCE nk.bin unpacker - (binmod.exe, compress.dll, cvrtbin.exe, dumprom.exe, viewbin.exe ) - I've only found this tool so far:https://drive.google.com/file/d/1P7_Lb7EInXc-UKYXRvCdaOHr78PxjduW/view?usp=share_linkThere is very little information on the Internet, I wanted to ask if I am going in the right direction?Thank You!

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 17, 2023, 09:38:51 pm
content: This toolhttps://github.com/nlitsme/eimgfsworked for me on your image:- cut a part of converted bin starting from 0x220000 until the end into a separate file (i.e. ce.bin)- run wine eimgfs.exe ce.bin -rd xip -extractallThere are several registry files in .hv format in extracted data. This toolhttps://github.com/nlitsme/hvtoolby the same author worked fine on them, converting to text .reg format.I can see this:Code:[HKLM\Comm\FTPD]"IsEnabled"=dword:00000001"UseAuthentication"=dword:00000001"AllowAnonymous"=dword:00000001"AllowAnonymousUpload"=dword:00000001"AllowAnonymousVroots"=dword:00000001"DefaultDir"="\\""IdleTimeout"=dword:0000012c"DebugOutputChannels"=dword:00000002"DebugOutputMask"=dword:00000017"BaseDir"="\\Windows""LogSize"=dword:00001000"UserList"="ADMIN"[HKLM\Comm\TELNETD]"UserList"="ADMIN""IsEnabled"=dword:00000001"UseAuthentication"=dword:00000000So it looks like the user name is ADMIN and there should be no password. Also FTP should allow anonymous user. If this is not what you see on a real machine then perhaps some app changes these settings

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 17, 2023, 11:10:10 pm
content: Update: VNC password is qwe123And a text from filesystem part of the dump:Code:Пароль для машины 1100S admin iZpa16ukrOaFbI91IYRa

author: Icherkayev
author_rank: Newbie
timestamp: May 18, 2023, 03:31:57 pm
content: Good evening.Thank you very much, my happiness knows no bounds!!! The password came up, and what did you manage to get it all from the image !!!Today I've been trying to compile eimgfs.exe all day, until it didn't work out (((I will try tomorrow, today I have no strength anymore)))I want to learn how to receive information from an image like you!

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 19, 2023, 12:03:06 am
content: Full story:- use attached tools to extract an FS image from nand dump (see info.txt inside). The tool uses logical block numbers and "ages" from NAND page metadata to reconstruct the FS image based on newest block versions- either mount the image on Linux or just use 7-zip to extract it (7-zip understands FAT images)- look into RhApp/_README_1100S.txt (encoding is CP1251, FAR Manager understands it) for admin password- look into RhApp/EFOVNC/passwd.txt for encrypted VNC password- use thishttps://github.com/frizb/PasswordDecryptsto decrypt itThere is no need to build eimgfs, just look at Releases:https://github.com/nlitsme/eimgfs/releases/download/v2017.12/eimgfs-binaries-20171205.zipBTW, if you plan to write your dump to new NANDs it would be better to correct all errors (there are many 1-bit correctable errors) before using it. The nand2bincorr script should give you an idea how to do that - just write corrected pages back instead of splitting them into data+spare portions.

author: Icherkayev
author_rank: Newbie
timestamp: May 19, 2023, 04:33:26 pm
content: Good evening!I've had some success.)Again, thank you very much for your help!1. if I follow the path that you described in the info.txt file, then I get an image that is available via FTP.2. if I go by extracting data through eimgfs.exe, then I get files without folders at the output. And there are no files that I received through 1 case. (I don't understand why this happens).I have attached a screenshot of the files I received:https://drive.google.com/file/d/12W7OkdZsz0idc1xVk2sFBmiCdkGMBFTK/view?usp=share_linkabout the Rh App, this is not the original, this folder was installed by a company from Russia, it is not in the original coffee machine.website of this company)))https://retailhoreca.ru/professionalnye-cofemashiny-wmfI have newer coffee machines from the same manufacturer. The password is incorrect. If the password is not in the registry, and the password can set applications at the time the application is loaded.Am I right in thinking that it is necessary to write applications to the image that will check the registry and send data through an accessible method, for example, LAN. Or maybe there is an easier wayThank You!

author: Icherkayev
author_rank: Newbie
timestamp: May 19, 2023, 04:53:25 pm
content: - if i extract the image via eimgfs.exe - then I can view the registry file. through hvtool applications- and if i extract the image vianand2bincorr.py full.nand 0 full.binnand2blkids full.nand 0 full.blkidsmap_fs.py full.bin full.blkids 0x8000000 fs.binsee atach:https://drive.google.com/file/d/1xOp_L_JtTIiPu3LWizQ2NV2ncZ5t56y1/view?usp=share_linkthen I can't read the registry file through the hvtool utility.I also don't understand why this is happening. Perhaps I made a mistake.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 19, 2023, 09:59:47 pm
content: eimgfs and map_fs extracts completely different parts:- eimgfs works on “NK.BIN” part - a static WinCE kernel + ramdisk image (similar to Linux kernel+initrd). This part is pretty generic WinCE+some platform specific drivers, it is built once and never changes, nothing really interesting there (it’s like a fresh Windows installation on a PC - just the OS). Registry files in this part works fine with hvtool, but they contain some default settings like anonymous FTP enabled, telnet authentication disabled etc. I’ve spent some time finding right eimgfs params to extract this part, but is was useless at the end, don’t waste your time there.- my tool (map_fs) operates on the “disk” part. That is a writable TFAT FS (Transacted FAT, a FAT optimized for embedded systems where sudden power loss happens) over some kind of NAND FTL (Flash Translation Layer) - a scheme for mapping logical sectors to physicals that manages wear leveling, bad sectors etc. Coffee machine apps and all interesting things like passwords are there. *.hv registry files in that part are writable, they replace defaults provided by static *.hv in NK part. hvtool fails to process these files, looks like it was developed for static *.hv from NK only.I think a new machine initialization at factory looks like this:- bootloader and NK are flashed over USB using standard i.MX tools- empty WinCE boots up, providing FTP/telnet access without passwords- some tool/script operates over FTP/telnet, formats the TFAT disk, uploads all TFAT content over FTP, sets passwords- machine restarts to “full” systemFor different versions with different password you can try simple search for “admin” text straight in the NAND dump. The password inside the .txt file was near it (try it on that dump you’ve posted to see).