真正的逆向工程 reverse engineerin.docVIP

真正的逆向工程 reverse engineerin 标签：无标签 真正的逆向工程(reverse engineering-破解motorola advisor寻呼机密码 一直有个愿望，当年公司为了那些寻呼机改频入网，不得不破解寻呼机的密码。记得一共买了2，3台解密器。好像2000多一台。那时也不太明白单片机，只记得很神奇。当时就想，啥时我能破这个。 时光斗转，记得07年，无意之中又想起了这件事。当时没有逻辑分析仪。手头只有个fpga的开发板，于是又尝试用altera的fpga的ram去记录数据。可惜失败了。那点ram太少了。当时的记录在此 这件事不得不搁下了。又过了3年。机会终于来了。先是买了网友的魏坤的第二版示波器，随后又买了网友的saleae的la。又刚刚用mega48做了个NRf24Z1的项目。感觉都准备好了，那就开始吧。 手上有motorola的寻呼机图纸和service manual。又搜到1片外文。那就先贴上，省的解释了。 这个u2含有256 byte的eeprom，他和mcu通过spi通信。可惜u2不仅仅是eeprom，它还有晶振和按键检测和初步解码功能。我觉得更像单片机。摩托罗拉寻呼机在写码编程时可以设置密码，如果机内有密码，寻呼机再次读写码时，寻呼机会要求输入密码，如不输入或输入密码错误，电脑显示屏会发出警告密码错误，你还有7次机会，如果连续7次将密码输错，BP机将锁死，寻呼机功能将完全丧失，这时只能更换码片。 motorola u9 How to decode Motorola pager passwords Posted by Jack Ryan-2009/04/06 07：40 _ Heres astab at trying to explain how to decode encrypted Motorola Pager Passwords.This has been verified to work with pretty much all motorola pagers on the market,including 1.5 and 2-way pagers.First.plaintext pager passwords can only contain A-Z,0-9 and(space)for characters.The plaintext passwords are always encoded as 10 characters even if there are less than 10 characters in the plaintext password.Basically there is some sort of lookup table contained in the PPS(pager programming software)which either encodes or decodes the password.The lookup table is included further down in this posting.Conveniently,when apagers programming is read using the PPS,all the passwords come out(assuming you know the pagers download password if it has one)in the encoded form.You can either sniff the passwords out of the programming read as its happening or you can save the freshly read pager configuration to afile and then import it into ahex editor as aMotorola S19 file.A favorite program of mine for hex editing,which will import Motorola S19 files,is called Hex Workshop.Finding the passwords is easy.If you are using Hex Workshop,you simply import the saved file(codeplug)and search for astring of letters and numbers.You will see them looking something like this NEJF1K54H5 or some