easylinux/cam-reverse
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add node with server decoder

Browse Source
This commit is contained in:
DavidVentura
2024-02-01 12:51:46 +01:00
parent bc2856eb07
commit edd4f5d6f5
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9 -1
View File
@@ -122,11 +122,12 @@ net mask : 255.0.0.0
## Spyware ## Spyware
When connecting the camera to a network, it tries to send a HELLO (?) to 3 IP addresses: When connecting the camera to a network, it tries to send a HELLO (?) to 4 IP addresses:
``` ```
139.155.68.77 - Shenzhen Tencent Computer Systems Company Limited 139.155.68.77 - Shenzhen Tencent Computer Systems Company Limited
119.45.114.92 - Shenzhen Tencent Computer Systems Company Limited 119.45.114.92 - Shenzhen Tencent Computer Systems Company Limited
162.62.63.154 - Tencent Building, Kejizhongyi Avenue 162.62.63.154 - Tencent Building, Kejizhongyi Avenue
3.132.215.40 - ec2-3-132-215-40.us-east-2.compute.amazonaws.com
``` ```
With the payload With the payload
@@ -138,7 +139,14 @@ With the payload
which is `DevLogin` which is `DevLogin`
These addresses are decoded (script at `scripts/dec_svr.py`) from the string `SWPNPDPFLVAOLNSXPHSQPIEOPAIDENLXHXEHIFLKPGLRHUARSTLQEEEPSUIHPDLSPEAOICLOSQEMLPPALNIBIAERHZLKHXEJHYHUEIEHELEEEKEG`.
Every 8-10s Every 8-10s
There are some other strings in the APK ending in `-$$` which decode to other ips/hostnames.
## Reversing ## Reversing
The interesting implementation is in `libvdp.so`, part of the apk bundle. The interesting implementation is in `libvdp.so`, part of the apk bundle.