Hex Editor - Peplink .diag files changed - Can they still be opened? - hex

Good Morning, I have a somewhat obscure question that I'm hoping someone more knowledgeable than I can share some insight and help me push forward.
My end goal is to be able to open .diag files that come from Peplink cellular routers for diagnostic purpose. I spend a lot of time working with them, and have to always send the files to peplink for their opinion as there is no way provided for me to view them myself.
While researching this topic. I found this old thread..
https://serverfault.com/questions/303687/how-do-i-open-a-peplink-routers-diagnostic-report
Using this thread with OLD Peplink .diag files I was able to get them to open.
I used hexplorer to open the file All of the files I open that had
the older firmware start with 2D B9 3A (-¹:)
If I select all the text and run XOR with a hex of 32 all files now start with 1F 8B 08
From here, I simply save the file as a tar.gz and I am able to extract all of the logs from it.
Works like a dream.
Unfortunately, the .diag files made from the past several years are now completely different.
When I open all of the new files with a hex editor they begin with 50 65 31 33 33 37 5F 5F (Pe1337__)
I suspect this is now a different type of file header (maybe it's not tar.gz anymore)
I have tried using different XOR Hex operations. I have tried using an XOR calculator and removing certain bytes, but thus far I haven't found a way to save the file as a working archive I can open.
At the end of the day, I have to admit that I don't know jack when it comes to using a hex editor and I'm working on something that's above my head.
Does anyone have thoughts or suggestions on how I might get this open?
I'd be happy to provide old and new .diag files to you if you think you could figure it out by getting your hands dirty.
Any help is appreciated.

The newer diagnostic reports are encrypted using AES-256-CBC with the key 5pE8w17hJ8806874Y312naWEdf14fqFDSp143FDSnfp134njfr.
This key can be found in the /usr/local/ilink/bin/dump bash script. If you use OpenSSL for the decryption, you need to change the starting Pe1337 to Salted in order to avoid the "bad magic number" error.
I use following one-liner to decrypt the diagnostic reports on Unix:
$ cat diag.report | sed 's/Pe1337/Salted/' | openssl aes-256-cbc -d -md md5 -pass pass:5pE8w17hJ8806874Y312naWEdf14fqFDSp143FDSnfp134njfr > report.tar.gz

Related

Meaning of R command system("touch AAA")

I am watching a Machine Learning Distributed in R and this lines of code appear:
For what the teacher says, system("touch fin1") will save the document in fin1 when the process has finished.
Does anyone know where I can find documentation about such function?
Think of system as an easy way to send commands to a terminal. The touch command (at least on *unix systems) creates a file. That's all it does really.
So the individual slave sessions create a file on the system. Why would they do that? So that the master session can easily detect when the slave sessions have gotten past a certain point in their scripts. The master session is constantly looping looking to see if all of the slave sessions have successfully gotten past that first actual line in their code.
So the answer your question of "Does anyone know where I can find documentation about such function?" is to look at the documentation provided by your system. For most *unix systems you can go to a command line and enter the command man touch or man {command you're interested in} to bring up the man pages for the given command.

Old password protected Zip files can only be opened with the original 1995 addZip v0.69 library?

My company has many many thousands of old compressed files that are maintained by a small program written many years ago. The program successfully decrypts and decompresses individual files using internal addZip unzip calls (from Stephen Darlingotn's original addZip 0.69 library) but whenever I attempt to open the file manually with the password using 7Zip, WinRAR, or the modern PKZip, it tells me the password is not correct.
My initial theory was that the password I was given was incorrect, but I can clearly see it used in the DLL (The source is lost in time, but the decompilation lists and uses the password very clearly).
Is it possible that modern programs don't support older ZIP encrypted files? The file PK header corresponds to a PK ZIP 2.0 file (created by addZip library v0.69), with encryption and normal deflation (per the PKZip spec), the first 10 bytes being...
50 4B 03 04 14 00 0B 00 08 00
The call made to encrypt/decrypt it seems very straight forward...
<Module>.addUNZIP_Decrypt(<Module>.std.basic_string<char,std::char_traits<char>,std::allocator<char> >.c_str(ptr3));
<Module>.addUNZIP_Overwrite(11);
<Module>.addUNZIP_InstallCallback(<Module>.__unep#?zip_callback#?A0xb8f18585##$$FYGHFFPAD#Z);
<Module>.addUNZIP_View(0);
...with that ptr3 parameter on that first call being the pointer to the password.
Is it possible the way this is being called is somehow adding additional unprintable chars to the password? I can't seem to find the source for the addZip library to validate it. ...and even if the password did have unprintable chars, I'm not sure how I'd feed that to a modern opening program. The password isn't that long and has low entropy so I even tried brute forcing it with a few extra chars, but that didn't seem to do the trick (although I'm not sure it was even working because I'm starting to wonder if modern programs can read these zips).
I'm at a loss and the thought of manually and individually opening and saving 100000 documents is driving me to update my resume (kidding).
I had a similar situation.
I ran some tests with a version of AddZip (v0.7 if I'm not mistaken) and I saw the same behaviour.
Investigating the issue I saw some references to the library stating that it is shareware, not freeware as I thought, and that one of the limitations of the shareware version is that the password, no matter what you input, is "Unregistered".
In the version I was using it worked.
HTH,
Paulo

RStudio R File Corruption

I had a R script open in RStudio. The file was saved many times over the course of several weeks and worked perfectly fine when RStudio was opened and closed. However, today, I restarted my computer and when I opened RStudio and more specifically the script that I mentioned, all of the R code vanished, leaving a single long row of "....." with red highlighting.
When I tried to open the R file in other text processors such as Sublime Text and Notepad++, only a line of zeroes was visible. None of my other R files were affected. I'm currently running Windows 8.1 and have the latest version of R and RStudio. What can I do to recover the code in the file and prevent something like this from happening again?
It might be an old thread and it might have been covered in 'user4458796' answer in suggestion #1 ("Use the history..."), but:
My friend had the same problem and we managed to recover the code from a 'history_database' files located on Windows at:
'C:\Users\%user%\AppData\Local\RStudio-Desktop\'
I assume there is an equivalent location in Linux in general.
Hopefully I won't get downvoted, just sharing my 2cents.
Ben.
It's not clear what happened to corrupt your file (and thus how to fix it if possible) and it is kind of ominous that you're just seeing 0's in other text editors, but I'll give you my best suggestion and some tips.
Suggestions for Attempting Recovery
Since your other R files were unaffected, you should have a messy record of your code in the history. Use the history to reconstruct your code.
Access a copy of your file from any version control, cloud, or offline backup you may have used -- git, SVN, iCloud, SugarSync, Dropbox, etc (I realize you probably wouldn't have posted this question if that were an option, but I had to throw it out there).
Use a Hex or sector editor to try to recover the data.
Use a data recover program to find an old version of your file.
Inspect your trash or recycling bin to see if it has an old version. Depending on your OS and the settings of how you (insecurely or securely) delete files, then you may be able to undelete a deleted version, even if it's not immediately available.
Try different methods of recovering text data from corrupted text files like OpenOffice's and Microsoft's suggestions.
Tips for the Future
I know that hindsight is 20/20, but a few quick tips for good measure:
Use version control. Git is supported in RStudio's GUI interface.
Have more than one version of your file. Many professors and professionals recommend writing/storing code in a text editor and using your IDE only for the working copy.
Make backups. Distinct from #2, you should backup your files to a hard drive, flash drive, or cloud service like Dropbox or Spideroak.

Recording Video using Qt5.4

I am building a cross-platform application to record multimedia files for ongoing processing. This is based on an inherited application and I am not able to re-write using alternative libraries.
My current issue is that the QMediaRecorder does not apparently save the video file onto the local drive - I have temporarily hard-coded the file to be saved as banana.mov into the users root folder.
When executed, the output file is not being saved.
I have tried forcing the resolution as suggested here and have seen that others have had issues recording from windows but OSX was fine
Development environment OSX 10.10 with Qt5.4 (the same issue is also happening on a Windows 8.1 machine using Qt5.3)
This code on Github is based on the camera example, with additional debug code added when trying to identify and reproduce the issue.
While investigating, the QMediaRecorder::​supportedAudioCodecs and
QMediaRecorder::supportedVideoCodecs both return empty lists. This happens on both the OSX build and the Windows environments.
The debug output is as follows:
Status change SIGNAL 'The recorder is initializing.'
Output location file:~/banana.mov
2015 01 05 14:59:58.111 Number of supported AUDIO Codecs 0
2015 01 05 14:59:58.111 Number of Audio sample rates 0
2015 01 05 14:59:58.111 Number of Video Codecs 0
2015 01 05 14:59:58.111 Number of Video Frame Rates 0
2015 01 05 14:59:58.111 Number of Containers 0
Location Changed SIGNAL 'file:~/banana.mov'
State change SIGNAL 'The recording is requested.'
Recording should have started
2015 01 05 14:59:58.111 Number of supported AUDIO Codecs 0
2015 01 05 14:59:58.111 Number of Audio sample rates 0
2015 01 05 14:59:58.111 Number of Video Codecs 0
2015 01 05 14:59:58.111 Number of Video Frame Rates 0
2015 01 05 14:59:58.111 Number of Containers 0
Status change SIGNAL 'Recording is requested but not active yet.'
I have a feeling that I'm missing something really obvious, I just haven't spotted it quite yet!
edit 1 The obvious this is that the status is Recording is requested but not active yet and not Recording is active. I'm currently trying to work out why the recording has not started.
edit 2 The audio recorder example does record and save an audio file. It looks like QMediaRecorder does not return a list of available audio codecs, but QAudioRecorder does return a list of audio codecs. I am getting the same results on both Windows 8.1 using Qt5.3 and OSX using Qt 5.4
It's highly likely your looking at an OS specific artifact rather than a core problem with QT.
I've seen this issue so many times in so many tool kits and frameworks that it scares me that no one has yet figured out an elegant solution.
The Basis of the Problem
Most operating systems implement some kind of protection for critical system files.
Under *nix, this is in the form of the user/group permissions system, under windows it's similar but with the UAC (User Access Control) sub system.
What this boils down to is that you often can't just pick an arbitrary location to write files to, not without first seeking permission from the various security API's and mechanisms in the OS to do so.
The second half of the problem then, comes from variable expansion.
In *nix particularly the tilde char '~' is expanded by the shell to mean the users home directory.
When we say shell, we mean bash, tch, csh or what ever environment your running the app in.
Within this mix, we'll also put the desktop environment too, as most things like Kde, Gnome, Unity or what ever else is being used, have some kind of operating system call that when a '~' is passed to it, knows to convert it to '/home/neil/' or what ever it needs to be expanded too.
Windows also has a similar thing, whereby you can make an OS call and say 'Hey mr operating system, where are my user folders stored', which it will happily reply to with something like 'c:\users\'
Why The Problem Manifests The Way It Does
Simply because when your in charge of creating the path strings yourself, in your own application, things are often not passed to these various OS calls for expansion and security clearance, you pretty much have to make sure your the one that calls them.
The exception to this rule, is if your using the *nix philosophy of small tools combined to do one job. In this case, you would often pass a result to a shell based program, which because it's running via the shell then knows that if it sees '~' it has to expand it.
Beacuse your using direct file access, managing your own file paths when you thought you where writing to '\home\neil\file.mov' you where in actual fact trying to write a file called 'file.mov' in the current folder where your app is running from, in a folder called '~' which I'm willing to be doesn't exist.
Add to this the fact that a lot of these frameworks (QT is no exception) are designed to hide and abstract away all the ugly details, there's a good chance it consumed the OS exception that was generated when you actually tried to write the file, if it had not then your app would most likely have crashed with some kind of exception dialog.
How to Solve The Problem
There are 3 approaches you can take to mitigating this.
1) You can hard code the paths, that is you can explicitly say to the application always store your file at '/home/neil/videos/blah.mov', this has a disadvantage however that every user of the app will need a custom build, as it's unlikely 'person2' will have write permissions on 'neil's home directory.
2) You can build in functionality that gives the user a dialog box and asks them where they would like to save the file. Since your using something like QT this should be very easy, most of these UI tool kits have built in functionality to easily present the user with such an experience.
3) You can find out if your framework or the underlying OS has any calls for you to ask who the current user is, and where their home directory is, you can then use the returned information to dynamically build a static patch similar to that in option 1. Doing things this way ensures that the application adapts automatically to it's environment irrespective of the user.
Myself personally, I generally adopt option 1 during development, then when development is complete I switch to number 2, very rarely do I use number 3 in desktop based software.
Option 3 for me is often used when the application in question is designed to do a single job, such as converting a file for another process to work with, or generating some output for a server to display in a web page etc.
For you, right now as a solution to this question however, Option 1 is your best bet.
To add to Shawty's great answer, I found that Qt does not support Recording on Windows http://doc.qt.io/qt-5/qtmultimedia-windows.html
This might be helpful https://github.com/kibsoft/QtMEL

writing hex files for linux (without a compiler/interpreter)

I would like to learn how to write(by this I mean, handcraft a program(as opposed to using a compiler), not how to edit a hex/binary file) binary files for debian.
I've tried googling, but that hasn't been very helpful. Could someone point me in the direction of the proper reading materials. I would like to learn how to write headers and such. I'm hoping to write something for a unix-y OS (right now, my setup has debian running on a MIPS32 architecture, but learning stuff to execute on bare metal would be ok for now too.)
Try hexdump for reading and hexedit for writing.
One should probably read this then.
http://www.skyfree.org/linux/references/ELF_Format.pdf

Resources