{"id":1207,"date":"2022-06-03T11:20:00","date_gmt":"2022-06-03T03:20:00","guid":{"rendered":"https:\/\/www.zhiwanyuzhou.com\/?p=1207"},"modified":"2022-06-11T17:48:07","modified_gmt":"2022-06-11T09:48:07","slug":"mrctf2022-iot%e9%a2%98%e7%9b%ae%e4%b9%8bnand%e6%9c%89%e6%95%88%e6%95%b0%e6%8d%ae%e5%88%86%e6%9e%90%ef%bc%882%ef%bc%89","status":"publish","type":"post","link":"https:\/\/www.zhiwanyuzhou.com\/index.php\/2022\/06\/03\/mrctf2022-iot%e9%a2%98%e7%9b%ae%e4%b9%8bnand%e6%9c%89%e6%95%88%e6%95%b0%e6%8d%ae%e5%88%86%e6%9e%90%ef%bc%882%ef%bc%89\/","title":{"rendered":"MRCTF2022 IoT\u9898\u76ee\u4e4bNand\u6709\u6548\u6570\u636e\u5206\u6790\uff082\uff09"},"content":{"rendered":"\n<p>\u4e0a\u4e00\u8282\uff0c\u6211\u4eec\u8bb2\u8ff0\u4e86\u5982\u4f55\u5206\u79bbNand\u7684\u6709\u6548\u6570\u636e\uff0c\u6700\u7ec8\u4f7f\u7528binwalk\u89e3\u51fa\u6765\u6587\u4ef6\u7cfb\u7edf\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"839\" height=\"220\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-3.png\" alt=\"\" class=\"wp-image-1208\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-3.png?v=1654135294 839w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-3-300x79.png?v=1654135294 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-3-768x201.png?v=1654135294 768w\" sizes=\"(max-width: 839px) 100vw, 839px\" \/><\/figure>\n\n\n\n<p>\u4f46\u5b9e\u9645\u4e0a\u8fd8\u67091\u4e2ayaffs\u6587\u4ef6\u7cfb\u7edf\u6ca1\u80fd\u6b63\u786e\u7684\u89e3\u51fa\u6765\uff0c\u8fd9\u4e00\u8282\u6211\u4eec\u6765\u5177\u4f53\u770b\u770b\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"590\" height=\"73\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-5.png\" alt=\"\" class=\"wp-image-1211\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-5.png?v=1654137239 590w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-5-300x37.png?v=1654137239 300w\" sizes=\"(max-width: 590px) 100vw, 590px\" \/><\/figure>\n\n\n\n<p>\u4f7f\u752816\u8fdb\u5236\u547d\u4ee4<em>hexdump -C 2E01000.yaffs -n 4096<\/em>\uff0c\u67e5\u770b2E010000.yaffs\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code has-palette-color-4-color has-palette-color-8-background-color has-text-color has-background\"><code>00000000  03 00 00 00 01 00 00 00  ff ff 00 00 00 00 00 00  |................|\n00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|\n*\n00000100  00 00 00 00 00 00 00 00  00 ff ff ff ed 41 00 00  |.............A..|\n00000110  e8 03 00 00 e8 03 00 00  d2 ce e9 5e d0 ce e9 5e  |...........^...^|\n00000120  d0 ce e9 5e ff ff ff ff  ff ff ff ff ff ff ff ff  |...^............|\n00000130  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n000001c0  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 00 00  |................|\n000001d0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n00000800  03 00 00 00 01 00 00 00  ff ff 61 70 70 00 00 00  |..........app...|\n00000810  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|\n*\n00000900  00 00 00 00 00 00 00 00  00 ff ff ff ed 41 00 00  |.............A..|\n00000910  e8 03 00 00 e8 03 00 00  d2 ce e9 5e d3 ce e9 5e  |...........^...^|\n00000920  d3 ce e9 5e ff ff ff ff  ff ff ff ff ff ff ff ff  |...^............|\n00000930  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n000009c0  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 00 00  |................|\n000009d0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n00001000\n<\/code><\/pre>\n\n\n\n<p>\u53ef\u4ee5\u770b\u51fayaffs\u6587\u4ef6\u7cfb\u7edf\u7684\u6709\u6548\u533a\u95f4\u90fd\u662f\u6b63\u5e38\u7684\uff0c\u552f\u4e00\u7f3a\u5c11\u7684\u662f\u5907\u7528\u533a\u95f4\uff08spare area\uff09\uff0c\u800c\u6b64\u533a\u95f4\u5305\u542b\u7740\u5757\u7684\u4e00\u4e9b\u4fe1\u606f\uff08\u5177\u4f53\u53ef\u4ee5\u67e5\u9605\u4e4b\u524d\u7684\u6587\u7ae0\u300a<a href=\"https:\/\/www.zhiwanyuzhou.com\/wp-admin\/post.php?post=1185&amp;action=edit\">YAFF2\u6587\u4ef6\u7cfb\u7edf<\/a>\u300b\uff09\uff0cnand\u7684OOB\u533a\u5305\u542b\u7740\u5907\u7528\u533a\u95f4\uff0c\u7531\u4e8e\u524d\u4e00\u8282\u4f7f\u7528\u811a\u672c\u624b\u52a8\u53bb\u9664\u4e86OOB\u533a\uff0c\u5bfc\u81f4yaffs\u6587\u4ef6\u7cfb\u7edf\u4e22\u5931\u4e86\u5907\u7528\u533a\u95f4\uff0c\u6240\u4ee5\u4f7f\u7528binwalk\u65e0\u6cd5\u89e3\u5f00\u6b64\u6587\u4ef6\u7cfb\u7edf\uff0c\u90a3\u4e48\u53ea\u9700\u8981\u5c06\u5907\u7528\u533a\u95f4\u6062\u590d\u5373\u53ef\u3002<\/p>\n\n\n\n<p>\u4f7f\u7528binwalk\u5206\u6790\u6700\u539f\u59cb\u7684\u7f16\u7a0b\u5668\u8bfb\u53d6\u7684\u6587\u4ef6S34ML02G200BHI00@BGA63_948.BIN\uff0c\u5f97\u5230YAFFS\u6587\u4ef6\u7cfb\u7edf\u7684\u8d77\u59cb\u5730\u57400x30E1100\uff0851253504\uff09\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"989\" height=\"90\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-6.png\" alt=\"\" class=\"wp-image-1212\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-6.png?v=1654137921 989w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-6-300x27.png?v=1654137921 300w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-6-768x70.png?v=1654137921 768w\" sizes=\"(max-width: 989px) 100vw, 989px\" \/><\/figure>\n\n\n\n<p>\u4f7f\u752816\u8fdb\u5236\u547d\u4ee4<em>hexdump -C S34ML02G200BHI00@BGA63_948.BIN -s 51253504<\/em> <em>-n 4352<\/em>\uff0c\u67e5\u770b\u90e8\u5206\u6570\u636e\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code has-palette-color-4-color has-palette-color-8-background-color has-text-color has-background\"><code>030e1100  03 00 00 00 01 00 00 00  ff ff 00 00 00 00 00 00  |................|\n030e1110  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|\n*\n030e1200  00 00 00 00 00 00 00 00  00 ff ff ff ed 41 00 00  |.............A..|\n030e1210  e8 03 00 00 e8 03 00 00  d2 ce e9 5e d0 ce e9 5e  |...........^...^|\n030e1220  d0 ce e9 5e ff ff ff ff  ff ff ff ff ff ff ff ff  |...^............|\n030e1230  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n030e12c0  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 00 00  |................|\n030e12d0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n030e1510  <s>3a f3 35 15 dd 16 c8 bf  a8 11 ab 7b 2e 9f<\/s> ff ff  |:.5........{....|\n030e1520  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n030e1910  <s>84 a8 a5 1e 40 b5 3d d7  70 04 7a 13 ca 45<\/s> 00 10  |....@.=.p.z..E..|\n030e1920  00 00 01 00 00 00 00 00  00 00 ff ff 00 00 30 00  |..............0.|\n030e1930  00 00 05 00 00 00 05 00  00 00 00 00 ff ff ff ff  |................|\n030e1940  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n<em>030e1980  03 00 00 00 01 00 00 00  ff ff 61 70 70 00 00 00<\/em>  |..........app...|\n030e1990  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|\n*\n030e1a80  00 00 00 00 00 00 00 00  00 ff ff ff ed 41 00 00  |.............A..|\n030e1a90  e8 03 00 00 e8 03 00 00  d2 ce e9 5e d3 ce e9 5e  |...........^...^|\n030e1aa0  d3 ce e9 5e ff ff ff ff  ff ff ff ff ff ff ff ff  |...^............|\n030e1ab0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n030e1b40  ff ff ff ff ff ff ff ff  ff ff ff ff 00 00 00 00  |................|\n030e1b50  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n030e1d90  <s>91 91 a2 ff 66 e9 80 95  a3 49 95 cf 5b d8<\/s> ff ff  |....f....I..&#91;...|\n030e1da0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n030e2190  <s>cc 79 0b ee 0c b4 ed b7  8f 1a 18 eb ad 59<\/s> 00 10  |.y...........Y..|\n030e21a0  00 00 02 01 00 00 00 00  00 00 ff ff 00 00 26 00  |..............&amp;.|\n030e21b0  00 00 00 00 00 00 ff ff  ff ff 00 00 ff ff ff ff  |................|\n030e21c0  ff ff ff ff ff ff ff ff  ff ff ff ff ff ff ff ff  |................|\n*\n030e2200<\/code><\/pre>\n\n\n\n<p>\u6839\u636e\u4e0a\u4e00\u8282\u7684\u7ecf\u9a8c\uff0c\u5254\u9664\u6709\u6548\u6570\u636e\u91cc\u9762\u7684OOB\u6570\u636e\uff0c\u4fdd\u7559spare area\uff0c\u53ef\u4ee5\u7f16\u5199\u4ee3\u7801\uff08python\u7248\u672c\uff09\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code has-palette-color-4-color has-palette-color-8-background-color has-text-color has-background\"><code>#!\/usr\/bin\/python3\n\ndata = open(\"S34ML02G200BHI00@BGA63_948.BIN\", \"rb\").read()&#91;0x30E1100:]\nprint(hex(len(data)))\nf = open(\"rootfs.yaffs\", \"wb\")\np = 0x880\nfor i in range(len(data)\/\/p):\n    f.write(data&#91;i*p:i*p+0x410] + data&#91;i*p+0x41E:i*p+0x80E] + data&#91;i*p+0x81E:i*p+0x85E])\nf.close()<\/code><\/pre>\n\n\n\n<p>\u4f7f\u7528binwalk\u6216yaffshiv\u6765\u89e3\u5f00yaffs\u6587\u4ef6\u7cfb\u7edf\uff0c\u547d\u4ee4\u5982\u4e0b\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>yaffshiv -f rootfs.yaffs -d out<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>\u89e3\u5f00yaffs\u6587\u4ef6\u7cfb\u7edf\u5982\u4e0b\uff0c\u6700\u7ec8\u89e3\u51fa\u6765120\u4e2a\u6587\u4ef6\u5939\u30011255\u6587\u4ef6\u300120\u4e2a\u94fe\u63a5\u6587\u4ef6\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" loading=\"lazy\" width=\"571\" height=\"160\" src=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-7.png\" alt=\"\" class=\"wp-image-1215\" srcset=\"https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-7.png?v=1654139449 571w, https:\/\/www.zhiwanyuzhou.com\/wp-content\/uploads\/2022\/06\/image-7-300x84.png?v=1654139449 300w\" sizes=\"(max-width: 571px) 100vw, 571px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>\u4e0a\u4e00\u8282\uff0c\u6211\u4eec\u8bb2\u8ff0\u4e86\u5982\u4f55\u5206\u79bbNand\u7684\u6709\u6548\u6570\u636e\uff0c\u6700\u7ec8\u4f7f\u7528binwalk\u89e3\u51fa\u6765\u6587\u4ef6\u7cfb\u7edf\uff1a \u4f46\u5b9e\u9645\u4e0a\u8fd8\u67091\u4e2ayaffs\u6587\u4ef6\u7cfb\u7edf\u6ca1\u80fd\u6b63\u786e\u7684\u89e3\u51fa\u6765\uff0c\u8fd9\u4e00\u8282\u6211\u4eec\u6765\u5177\u4f53\u770b\u770b\uff1a \u4f7f\u752816\u8fdb\u5236\u547d\u4ee4hexdump -C \u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[23],"tags":[],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":5}},"_links":{"self":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1207"}],"collection":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/comments?post=1207"}],"version-history":[{"count":2,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1207\/revisions"}],"predecessor-version":[{"id":1216,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/posts\/1207\/revisions\/1216"}],"wp:attachment":[{"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/media?parent=1207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/categories?post=1207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.zhiwanyuzhou.com\/index.php\/wp-json\/wp\/v2\/tags?post=1207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}