GFT2 hacking the Archos 605 with original firmware 2.1.04
Monday, 7. December 2009, 14:18:46
First a warning, don't get to excited, because like the old GFT hack the GFT2 also can't survive a reboot.
Second if you don't understand any of this you shouldn't try it.
GFT2 for the Archos 605 with original firmware 2.1.04
The file System.bin in the folder System on the fat32 partition stores local usersettings. Those settings are read when the device starts up from a complete shutdown. The System.bin took my attention, because the network settings are in there like the password from your fileserver.
As you all know Archos sanitize the password string in firmware >1.7.13 to disable the GFT hack. So I thought maybe I could trick it by entering some special characters, but no luck. Then I focussed on the workgroup wich are stored in the smb.conf. I thought I would have a bigger change, because they check right away for wrong input.
I was right, they didn't sanitize the string. After reading about the smb.conf I noticed they have some nice buildin root commands.
"root preexec" which executes when accessing a share and the "root postexec" which executes when disconnecting from a share.
I hexedited the system.bin starting at 0x1ac0 and put in the following:
workgroup <0x0a>
netbios name=H<0x0a>
server string=H<0x0a>
security=user<0x0a>
locking=no<0x0a>
username map=/tmp/samba/user.map<0x0a>
min protocol=LANMAN1<0x0a>
os level=1<0x0a>
interfaces=eth0<0x0a>
[media]<0x0a>
root preexec=/bin/sh -x /mnt/data/Data/arcwelder/install<0x0a>
path=/mnt/data<0x0a>
<0x00>
As you see I put after each line the hexnumber "0x0a" which is a line ending. The root command I execute is to install arcwelder from the GFT hack and enable SSH. Ofcourse you can also put in another commandline.
For installing arcwelder you need to copy the arcwelder folder to the Data folder on your device.
At the end you have to put hexnumber "0x00" to let the parser know it is the end of the string.
NOTE: You can change the values from 0x1a0c to 0x1b0b in the system.bin they are reserved for the workgroup string.
See Einstein's reverse engineering of the System6.bin which is almost equal for more details.
Thanks Einstein for your work.
If you hexedit the system.bin you have to open it directly from the Archos and save it. If you want to first transfer the file to your PC or you have the file from elsewhere you have to boot into recovery mode to overwrite the file. Thanks Chebuzz for this one.
How to trigger the command:
1) Enable the wireless on your device.
2) Enable the fileserver.
3) Go to your PC and browse your network to see the Archos share.
4) Open the folder share media. At this point your command will be triggered.
5) close the fileserver.
Like the GFT hack this will also not survive a complete reboot and since the bootloader is locked for devices with firmware >1.7.13 it is at the moment not very useful.
Do we get a SDE for gen 5 now Archos
Not an option I think, but I had to try.
Maurice








