JDSU / VIAVI JD745B, JD785A, JD785B - A firmware investigation - Page 1
Forum section: electronics / testgear

author: FlexibleMammoth
author_rank: Regular Contributor
timestamp: September 11, 2023, 10:15:25 pm
content: After looking for a nice, compact spectrum analyzer / vector network analyzer for my home lab, I recently pulled the trigger on a used JDSU / VIAVI JD785A.I previously had a look at the existing JD745A threads and found that they provide easy root login by running a script as root from a USB stick. Unfortunately, the newer JD745B, JD785A, JD785B models share a firmware that no longer exhibits this behavior. Instead, there is a binary recovery OS that allows to install another, binary, firmware file.The recovery consists of the files Recovery and Recovery_lk2, which appear to be the same, and a system.dat containing the emergency OS. As for the Firmware itself, it has some version information at the beginning and the rest appears to be compressed or encrypted, but other than that, there is no indication on its composition.Has anyone been lucky in obtaining root, or information on the firmware structure?Thanks

author: zrq
author_rank: Frequent Contributor
timestamp: January 21, 2024, 11:21:49 am
content: I'm also interested in acquiring such a JDSU device as a portable VNA, so I poked into theirs firmware. Apparently the .FW firmware image is not encrypted at all, but is simply in gzip format with a modified header. The original header is replaced by a string that is checked in the update process, and the correct gzip header is at the bottom of the image file. You can load the unstripped Recovery ELF to GHIDRA and check it out yourself.So that if one want to explore what's in the image, one can load the .FW in a hex editor, move (copy and delete) the last 30 bytes to the head of the file (overwriting), and then it can be uncompressed by a tool that you prefer (like 7zip).One possible approach to gain root is modify the scripts in the firmware image and craft a new .FW file, I didn't see any signature check so I think it should be possible, just need a brave guy with hardware to try this out...

author: zrq
author_rank: Frequent Contributor
timestamp: February 11, 2024, 02:10:25 pm
content: There is a root password hash in LKII_FW_3.120.043-rd946d9a.FW\UpgradePackageTree\app.tar.gz\app.tar\app\script\run_FW_1.shCode:sed -i 's|root::0:0:root:/root:/bin/bash|root:$1$qwixm66f$W/YVCVn5OcusO4ppJnChl0:0:0:root:/root:/bin/bash|' /etc/passwdI don't know if the system have the dropbear listening by default (before my JD785A arrive), but I have started hashcating... It would be nice if someone else can join as I don't have discrete graphics cards.

author: zrq
author_rank: Frequent Contributor
timestamp: February 11, 2024, 04:23:07 pm
content: FTP password:Code:CellAdvisorMobile mu%=%3Yr@DSNca4g 0000Unfortunately if the developers used a similarly complex password for the root account, then hashcat will not be able to find it.

author: zrq
author_rank: Frequent Contributor
timestamp: February 14, 2024, 01:12:52 pm
content: Quote from: zrq on February 11, 2024, 02:10:25 pmEasier than expected:$1$qwixm66f$W/YVCVn5OcusO4ppJnChl0:SiG2018Session..........: hashcatStatus...........: Cracked

author: zrq
author_rank: Frequent Contributor
timestamp: February 17, 2024, 08:54:36 pm
content: It seems the 007 Higher power CW generator option on JD785A is purely software controlled and can be hacked rather easily. However, I was hoping for the Bias-T but no luck, apparently that one needs extra hardware.

author: giovannirat
author_rank: Regular Contributor
timestamp: February 18, 2024, 07:10:37 pm
content: I own a JD785A and appreciate your great work on the firmware.QuoteIt would be really nice if you could tell us how to hack some possible option on this device.Thank you very much!

author: zrq
author_rank: Frequent Contributor
timestamp: February 29, 2024, 11:43:50 am
content: Quote from: giovannirat on February 18, 2024, 07:10:37 pmI have no plan at the moment to share the keygen as the analyzer is still in support and I want to stay away from the potential trouble but maybe in 10 years. However, the algorithm is quite simple, no asymmetrical cryptography but just a multiplication and a table lookup. The LK2 main binary is not stripped so it should be easy for one with basic reverse engineering skills to make a keygen.However one should not expect too much from the CW generator it have, the harmonics, non-harmonics, and phase noise are all terrible. I'll attach some result later.

author: zrq
author_rank: Frequent Contributor
timestamp: March 15, 2024, 02:07:26 pm
content: Quote