Håvard Sørbø

Flash / SIlverlight video-download in Safari

2010-03-02T10:20:00.003+01:00

I have a very poor internet connection at home, and as a result i prefer to download movies from the web. One common problem is that the videos are run from flash or silverlight, and the url is not available. There is a neat trick one can do in Safari to get the url for these movies (provided the video uses http).
Steps:
- You first need to enable the developer menu in Safari.
- Go to the page showing the video.
- Go to the developer menu, press "Show web inspector"
- In the web inspector select resource tracking. (enable for this session)
(This will show all resources the webpage is using, if you sort them by size, the video will soon become the largest element)
- Sort by size
- Wait a few seconds of video playback
- Select the topmost resource.
- Copy the url and paste it the address field of Safari.
- Hit alt+enter (This tells safari to download the url instead of opening it)
- Enjoy!

Here is a demo:

Reverse engineering the Airport Express Part 3

2010-02-26T05:22:00.005+01:00

Part 1, Part 2
A small update.
Memory alignment took a few hours. I did this by dumping a lot of the string offsets in the firmware using standard unix console tools:
strings -n 10 -o | grep "Audio" | awk '{print $2}'
I then wrote a IDA script that dumped all load operation offsets, made a second script that brute-forced matching the offsets. The best match was 0x80010000 and not to anybody's surprise this made IDA pro very happy and she started auto analyzing the firmware.
Here is a screen shot of the memory-offsets:

Here is a in-action screen shot of IDA:

I've done a good amount of reversing and everything is going well, still have no ETA on anything though. Subscribe to the blog or check back after the weekend if you are curious.

Reverse engineering the Airport Express Part 2

2010-02-23T17:53:00.007+01:00

Part 1, Part 3

Yesterday I was analyzing my firmware-dump and I couldn't make sense of very much. One thing that got my attention was that scattered around the firmware-dump were a lot of 0xFF. I Found a pattern, and I tried to convince myself that this was some sort of container or padding between important chunks of data. Then as the night approached BOOM, it hit me. The pattern was like this: 512 bytes of data, 16 bytes of 0xFF, 512 bytes of data and 16 bytes of 0xFF. This was significant and here is the problem/solution.

The flash chip on AT45DB321B is like a book with 8192 pages and 528 letters on each page. When I dumped it my program just read through the book carefully noting every letter. Now the airport express doesn't do it this way, the airport just turns to the page it wants and reads what is needed (random access). Now there is one other limitation, the Airport Express doesn't read more than 512 letters from each page. This means that he doesn't care about the last 16 letters I have been carefully putting into my dump/analysis. I Fixed this and my brute-force decopression-program (15 line python script) found both the bootloader and the main firmware. Their md5-sums are: ff4c561a6dcce8686749594d84ff4e7d and 7db70daf035f085eb455d8de3c2099fb. A guy name James seems to have done the deployment of this firmware :)
I think all that remains now is spending time with IDA Pro. I need to get a memory alignment as the start address of memory seems to be 0x8000000 + some offset.

A screenshot of the strings-window in IDA Pro (strings used in the Airtunes authentication):

I really think this discovery makes for part 2 as I now am pretty sure the rest is doable, albeit time consuming.

PS. I had to replace every occurence of dump with firmware-dump as the text became very questionable

Reverse engineering the Airport Express Part 1

2010-02-22T20:18:00.011+01:00

For quite some time I've wanted to reverse engineer the airport express base station. There are two reasons for this. The first is that within this firmware are the private Airtunes keys. The second and more important part, at least for me, is that it is almost identical to a wrt54g plus it adds usb and sound-card. Getting linux/openwrt running on this would be wicked cool. The main issue with reversing apples firmwares for these access points is that they are encrypted and the airport express decrypts the firmware when flashing so you can't really do anything fun with the firmware-update files.

A time back I posted on twitter that I needed a broken airport expresss! I go really lucky, a friend of mine saw the tweet and gave me his broken airport. I disassembled it and found out that the flash was AT45DB321B, which is nice because Atmel keeps their datasheet public, the not so good news was that it was BGA-mounted and my old soldering station wasn't up for this. Everybody knows I'm a real ebay-whore, so I went to ebay and ordered this excellent hakko rework-station clone (YIHUA 852D+). This had the hot-air-gun that I needed. Here is a short video when I'm detaching the IC:

After desoldering I glued it to a breadboard and hooked up some wires, this was a bit tricky as this is quite small.

After everything was hooked up, I attached it to my Bus Pirate and after a lot of trial and error managed to communicate with the chip.

Finally i wrote this small python-script that dumped the content of the chip.

I'm now in the possession of the unencrypted firmware for airport express, but still there are a lot of stuff remaing. The firmware is compressed, and I have had no success brute-force inflating it, so I may have to start reverse-engineering the bootloader just to get to the uncompressed firmware. Another option could be running it under qemu, the decompression-part that is, should be fairly generic arm-code. A third option would be to flash it on my wrt54g and do jtag-debugging, if I'm really lucky I'd get serial-port and bootloader on the linksys.

There are a lot for options going forward, I'll post a new blog-entry when I make further progress.
Please excuse the bad language in this post, I don't want to spend time on grammar now that I have this very sexy binary blob right in front of me.

Happy hacking!

I want union of types in c#

2010-02-04T17:27:00.006+01:00

I would really like something that defines a field or argument as a union of types in c#. I'm not sure about the best syntax but something like this would be nice:

BindCollection(<ICollection<T> , INotifyCollectionChanged> collection);

Currently I'm achieving some of this functionality using naked type constraints. Like this:

BindCollection<U>(U collection) where U : ICollection<T> , INotifyCollectionChanged

This has some limitations, like you cant use it in a constructor. The sweet thing about this is you don't have to do casting, you get some checking from your compiler and you'll get code-completion for the union of types

Flah on iPad

2010-02-02T13:24:00.006+01:00

I love the fact that the iPad doesn't have support for flash! I believe removing flash support is a big win for an open standard-based web and a rather small loss for consumers. Personally I've never missed flash on my iphone, although browsing the web is kept at a minimum. Flash is closed source and proprietary and adobe should not be able to dictate which platforms are suitable for browsing the web and not (linux-x86-64, linux-ppc, mac-ppc has no recent releases). Apple, by having a substantial deployment, can change the consensus around RIA to focus on standard-based solutions.

For the user its mostly a loss except for battery-time which would probably be greatly reduced if flash was available. Flash is such a battery hog that even firefox in maemo has disabled it.

If the loss is to big for you, you should look to another system that fits your needs or sse if there is an application that allows you to circumvent this.

Apple has gone to some extent to fix the lack of flash by having an iphone-app for youtube, the no1 flash site. (if you don't support youtube, you are fucked). Youtube also enabled html5-support at youtube.com/html5. Limitations of html5 on youtube is lack of fullscreen and only H.264 and not theora (which is license-free) video codec.

Being in the same shoes as Apple I would have done the same. Imagine you have source-code for the entire stack of iPhone, iPad, iPod, except one known trouble-maker and doing support for 40.000.000 customers. Imagine if there is an exploit and you can't fix it yourselves, you'll be owned by Adobe.

Comments are welcome!

Moved blog

2010-02-01T04:34:00.001+01:00

I ended up upgrading my blog-engines more frequently than posting blogs. I'm lazy so I switched to blogger.com. Lets se how this works out :)