[硬件黑客]钉钉智能指纹考勤机M1硬件漏洞挖掘（不定期更新）

时间：2022-04-27 17:49:32

mailto:wangkai0351@gmail.com

【未经同意禁止转载】

钉钉智能指纹考勤机M1s，支持指纹、WIFI、蓝牙、GPS四种考勤方式，并且可实时查看考勤数据，自动生成考勤报表，告别人工核算，数据云端存储不易丢失。

[硬件黑客]钉钉智能指纹考勤机M1硬件漏洞挖掘（不定期更新）

[硬件黑客]钉钉智能指纹考勤机M1硬件漏洞挖掘（不定期更新）

1. 固件脆弱性分析

1.1 固件文件提取

1.1.1 固件文件提取方法

a. 直接读取spi flash芯片中的数据

b. 串口访问设备（使用boot命令upload）

c. 固件在线升级

1.2 固件文件升级

a.

 binwalk 2018_5_20.bin

 DECIMAL       HEXADECIMAL     DESCRIPTION

 --------------------------------------------------------------------------------

         0x210DC         Unix path: /usr/local/lib

         0x214FC         Unix path: /dev/uart/

         0x21650         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/esp32/./heap_alloc_caps.c

         0x21978         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/esp32/./ipc.c

         0x21C4C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/esp32/./intr_alloc.c

         0x24F7C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/newlib/./locks.c

         0x25980         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/nvs_flash/src/nvs_pagemanager.cpp

         0x25D38         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/tcpip_adapter/./tcpip_adapter_lwip.c

         0x269EC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/main/./bravo.c

         0x26B90         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/main/../embedded/dingtalk/base/dt_log.c

         0x271D4         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/driver/./rtc_module.c

         0x27ACC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/esp32/./crosscore_int.c

         0x27D8C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/esp32/./phy_init.c

         0x283E8         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/fingerprint/./fingerprint.c

         0x29060         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/fingerprint/./fingerprint_helper.c

         0x29A40         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/fingerprint/./userIdpool.c

         0x2A1A4         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/hardware/./alc5660.c

         0x2A510         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/hardware/./fd650b.c

         0x2A5EC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/hardware/./gpio_helper..c

         0x2A698         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/hardware/./pcf8563.c

         0x2A80C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/logcache/./dt_log_fireeye.c

         0x2A924         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/logcache/./dt_log_flash.c

         0x2B5DC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/root/./dt_device.c

         0x2BA3C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/root/./dt_fingerprint.c

         0x2C0D4         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/root/./dt_root.c

         0x2D114         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/root/./dt_coredump_upload.c

         0x2D3E0         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/wifi/./wifi.c

         0x2F1D8         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/main/../embedded/dingtalk/lwp/dt_lwp_response.c

         0x30C4C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/main/../embedded/dingtalk/lwp/dt_lwp_mid.c

         0x68D7C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/app_update/./esp_ota_ops.c

         0x69070         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/ble/./dt_ble.c

         0x69870         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/components/ble/./dt_npc.c

         0x69DCC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/device/controller.c

         0x6A1CC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/hci/hci_layer.c

         0x6A374         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/hci/hci_packet_factory.c

         0x6A56C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/hci/packet_fragmenter.c

         0x6A830         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/osi/fixed_queue.c

         0x6A924         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/osi/future.c

         0x727E4         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/stack/btu/btu_task.c

         0x77F30         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/stack/l2cap/l2c_api.c

         0x7ABE4         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/stack/l2cap/l2c_fcr.c

         0x82898         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/bta/dm/bta_dm_pm.c

         0x83DC0         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/bta/sys/bta_sys_main.c

         0x8410C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/btcore/bdaddr.c

         0x84210         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/gki/gki_buffer.c

         0x8787C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/stack/btm/btm_ble_bgconn.c

         0x90358         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/bt/bluedroid/device/interop.c

         0x90984         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/driver/./i2c.c

         0x90DAC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/driver/./i2s.c

         0x9187C         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/driver/./uart.c

         0x91FF4         SHA256 hash constants, little endian

         0x92894         PEM RSA private key

         0x928D4         PEM EC private key

         0x9363C         PEM certificate

         0x9D5CC         PEM RSA private key

         0x9DC78         PEM certificate

         0x9E134         PEM RSA private key

         0x9E7E0         PEM certificate

         0x9ECA0         PEM RSA private key

         0x9F398         PEM certificate

         0x9F8B4         PEM certificate

         0xA1A58         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/freertos/./heap_regions.c

         0xA1B18         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/freertos/./queue.c

         0xA1E80         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/freertos/./timers.c

         0xA1FEC         Unix path: /home/admin/.jenkins/jobs/MUPP_2440311/workspace/esp-idf/components/freertos/./ringbuf.c

        0x621170        Unix path: /dev/uart/

直接拖入IDA Pro V6.8

[硬件黑客]钉钉智能指纹考勤机M1硬件漏洞挖掘（不定期更新）

strings工具得到该固件编译过程中include 的一些c语言代码文件的路径和文件名如下

ESP32 有 3 个 UART 接口，即 UART0、UART1 和 UART2。

查阅《ESP32 技术规格书》版本2.1可知

U0RXD 40 号引脚

U0TXD 41 号引脚

U1RXD 28 号引脚

U1TXD 29 号引脚

U2RXD 25 号引脚

U2TXD 27 号引脚

到PCB上看看，这三对引脚有没有露出来，如果有任意一对引脚引到了PCB的焊盘上，那么很可能就是这个PCB的串口调试端口。

相关文章