Capture JF Firmware URL

[itsyourap]

There is a UPGRADE_PROGRAM in environment table in /tmp/system.db. We can modify it to capture the JF firmware updates (both the URL as well as the image).

TODO:

• Take a look at the original args of firmd
• Create a shell script in /flash2 that does the following:-
  • Logs the args provided
  • Makes copies of /tmp/tr69* files in /flash2
  • Copies the firmware file (provided as args to the script) to somewhere in /flash2
• Make the script executable with chmod
• Modify UPGRADE_PROGRAM to the script location

This will give us the firmware and also the persistent firmware link in the TR069 logs.
Also, you can prevent auto firmware upgradation using this method.

Also we have to use this in combination with #45 to make sure the UPGRADE_PROGRAM gets modified on every boot as mentioned here.

I will make and post the script soon.

EDIT: I have commented the script here

[viraniac]

Firmware seems to be downloaded by dimclient and then it calls firmd with the following parameters -f /tmp/cpe3/download.dwn -d Reliance -p /dev/mtd4 -s /dev/mtd7 -R /dev/mtd7 -S -F

Meaning of these parameters is as follows

Usage:
-f --imagepath=value    : Absolute path or URL of the firmware image Default:/tmp/firm.img
-d --device=value       : Device for which this firmware image is  created.Default: TeamF1_RGW
-p --primary=value      : Primary Partition. Default:/dev/mtd6
-s --secondary=value    : Secondary Partition. Default:/dev/mtd9
-R --rootfs=value       :  rootfs Partition. Default:/dev/mtd9
-r --rebootTime=value   : Time to wait for reboot. Default:5
-u --url=value          : URL of the image. Only HTTP & HTTPS.
-A --auth=value         : Authentication type 0=none,1=digest.i Default:0
-U --username=value     : Username.Default:teamf1
-P --password=value     : Password.Default:teamf1
-V --verifypeer         : Verify Peer Identity.Default=no
-B --cabundle=value     : CA bundle file. Default:/etc/ssl/certs/cacert.pem
-c --config=value       : config database. Default:/tmp/system.db
-F                      : foreground
-D --dry-run            : only download and verify image
-S --skip-hdr           : skip writing firmware header
-h --help               : This help message

[viraniac]

Do note above is for JCOW414 and mtd device numbers can be different for different routers

[itsyourap]

This is an example script that can be put somewhere in /flash2 and then make it executable using chmod. Then modify the value where name is UPGRADE_PROGRAM in environment table in /tmp/system.db to the path of this script.

#!/bin/sh
#
# This script acts as a proxy for firmd
#
# Created by: itsyourap
# Date: 2024-11-09
#

# Store the current time in the format YYYYMMDD_HHMMSS
current_time=$(date +"%Y%m%d_%H%M%S")

# Check if firmd.log exists; if not, create it
log_file="/flash2/firmd/firmd.log"
if [[ ! -f "$log_file" ]]; then
    mkdir -p /flash2/firmd/
    touch "$log_file"
fi

# Append the current time and all arguments to the log file
echo "$current_time - Arguments: $*" >> "$log_file"

# Add a new line at the end for readability
echo "" >> "$log_file" 

# Create a folder with the current time as the folder name
# and copy all /tmp/tr69* files into it
new_folder="/flash2/firmd/$current_time"
mkdir -p "$new_folder"
cp /tmp/tr69* "$new_folder" 2>/dev/null

# Check for "-f" argument and copy specified file to our folder if provided
for i in "$@"; do
    if [[ "$i" == "-f" ]]; then
        # Get the argument following "-f" as the file location
        file_location="$2"
        if [[ -f "$file_location" ]]; then
            cp "$file_location" "$new_folder"
        else
            echo "File not found: $file_location" >> "$log_file"
        fi
        break
    fi
done

Here is an example script to do the changes in /tmp/system.db:

#!/bin/sh
#
# This script is used to replace the `UPGRADE_PROGRAM` in `environment` table in `/tmp/system.db`
#
# Created by: itsyourap
# Date: 2024-11-09
#

# SQL command to update the value for the UPGRADE_PROGRAM entry
sqlite3 "/tmp/system.db" <<EOF
UPDATE environment
SET value = '/flash2/scripts/firmd.sh'
WHERE name = 'UPGRADE_PROGRAM';
EOF

You can use the /flash2/pfrm2.0/etc/customInit script according to #45 to run the script at router startup.

[viraniac]

I already have my own script that does bunch of customizations like starting telnet, setting root password, disabling upgrade, and some other stuff also there are some stuff that I am working on adding to my script like changing IPv6 dns server mode from dns proxy to my specified one, reducing some of the services that starts, etc. Been using my own script for couple of weeks now. But I am sure that this will help someone out.

[PotatoPC44]

Can you Please share those scripts?

[akash07k]

Can you please share your scripts? I'll be extremely thankful for the help.

I already have my own script that does bunch of customizations like starting telnet, setting root password, disabling upgrade, and some other stuff also there are some stuff that I am working on adding to my script like changing IPv6 dns server mode from dns proxy to my specified one, reducing some of the services that starts, etc. Been using my own script for couple of weeks now. But I am sure that this will help someone out.

[hAckEr-aFtaB]

How to run this new script? Please explain the full process as earlier. If possible.

[itsyourap]

#67 (comment) is self explanatory