发现华为U8110的功能不少,WIFI,蓝牙,GPS,FM收音机外加GSM四频与WCDMA900/2100,一激动弄了个玩玩。由于是android系统,到手就破解了root权限,运行sshd服务,用wifi连接到局域网里面之后可以用电脑ssh登录到手机。
CPU据说是msm7202,528mhz,看了下bogomips,貌似性能不怎么好啊,NND真悲剧。
# cat /proc/cpuinfo
Processor : ARMv6-compatible processor rev 2 (v6l)
BogoMIPS : 245.55
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 6TEJ
CPU variant : 0x1
CPU part : 0xb36
CPU revision : 2
Hardware : HUAWEI U8110 BOARD
Revision : 0000
Serial : 0000000000000000
系统自带的命令不多,free居然也没有,无法看内存状态只好作罢,幸好还是可以使用管道命令输出dmesg信息的,有空的话研究下移植busybox到上面去。
拿nmap扫下这个蛋疼的机机,不知道开了20000端口做什么用的,难道是后门?有时间偶得研究下是怎么回事。
root@ubuntu-gnome
:~# nmap -v -A 192.168.2.101
Starting Nmap 5.00 ( http://nmap.org
) at 2010-09-18 22:58 CST
NSE: Loaded 30 scripts for scanning.
Initiating ARP Ping Scan at 22:58
Scanning 192.168.2.101 [1 port]
Completed ARP Ping Scan at 22:58, 0.13s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:58
Completed Parallel DNS resolution of 1 host. at 22:58, 0.00s elapsed
Initiating SYN Stealth Scan at 22:58
Scanning 192.168.2.101 [1000 ports]
Discovered open port 22/tcp on 192.168.2.101
Discovered open port 20000/tcp on 192.168.2.101
Completed SYN Stealth Scan at 22:58, 0.83s elapsed (1000 total ports)
Initiating Service scan at 22:58
Scanning 2 services on 192.168.2.101
Completed Service scan at 22:59, 69.13s elapsed (2 services on 1 host)
Initiating OS detection (try #1) against 192.168.2.101
Retrying OS detection (try #2) against 192.168.2.101
NSE: Script scanning 192.168.2.101.
NSE: Starting runlevel 1 scan
Initiating NSE at 23:00
Completed NSE at 23:00, 30.24s elapsed
NSE: Script Scanning completed.
Host 192.168.2.101 is up (0.010s latency).
Interesting ports on 192.168.2.101:
Not shown: 998 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh Dropbear sshd 0.52 (protocol 2.0)
| ssh-hostkey: 1024 66:28:97:b5:77:3a:53:c6:9b:8f:e4:84:ca:a8:24:09 (DSA)
|_ 1040 43:b8:f8:0d:3e:ee:29:76:88:ba:12:50:40:af:87:dc (RSA)
20000/tcp open unknown
MAC Address: 4C:54:99:4D:98:73 (Unknown)
Aggressive OS guesses: Alvarion BreezeACCESS II broadband wireless access system 4.5.17 (89%), Linux 2.6.18 (Debian, x86) (88%), Linux 2.6.23 (Gentoo) (87%), AX IS 207 Network Camera (Linux 2.6.16) or 241Q Video Server (87%), DD-WRT v24 (Lin ux 2.6.22) (87%), Linux 2.6.13 – 2.6.27 (87%), Linux 2.6.20 (87%), Linux 2.6.22 (87%), Linux 2.6.22 – 2.6.23 (87%), Linux 2.6.9 – 2.6.18 (87%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http: //nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 113.73 seconds
Raw packets sent: 1149 (56.570KB) | Rcvd: 1006 (40.270KB)
root@ubuntu-gnome
:~# nmap 192.168.2.101 -p22
Starting Nmap 5.00 ( http://nmap.org
) at 2010-09-18 23:11 CST
Interesting ports on 192.168.2.101:
PORT STATE SERVICE
22/tcp open ssh
MAC Address: 4C:54:99:4D:98:73 (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 1.53 seconds
贴下dmesg信息吧。
] data[3]=0
<3>[23, msg_recv] [ 4118.422355] data[4]=0
<3>[23, msg_recv] [ 4118.422385] data[5]=0
<3>[23, msg_recv] [ 4118.422413] data[6]=0
<3>[23, msg_recv] [ 4118.422441] data[7]=0
<3>[23, msg_recv] [ 4118.422471] data[8]=18
<3>[23, msg_recv] [ 4118.422500] data[9]=42
<3>[23, msg_recv] [ 4118.422531] data[10]=132
<4>[23, msg_recv] [ 4118.422568] shmem_serial_recv: (1, c96a4300, 11)
<3>[23, msg_recv] [ 4118.422616] shmem_serial_recv: success! len=11
<4>[23, msg_recv] [ 4118.422658] virtmsm_updatemsgRD is called with 28;
<4>[23, msg_recv] [ 4118.422700] pVirtMsmMsgRx->ulRD=1788; pVirtMsmMsgRx->ulWR=1788
<4>[406, android.FMRadio] [ 4118.447340] shmem_serial_write: (1,c93e0800) writing 4 bytes
<4>[406, android.FMRadio] [ 4118.447411] Content start —————–
<4>[406, android.FMRadio] [ 4118.447451] Content:
<4>[406, android.FMRadio] [ 4118.447481] Content over —————–
<4>[406, android.FMRadio] [ 4118.447570] shmem_serial_write: (1,c93e0800) writing 6 bytes
<4>[406, android.FMRadio] [ 4118.447618] Content start —————–
<4>[406, android.FMRadio] [ 4118.447656] Content:
<4>[406, android.FMRadio] [ 4118.447686] Content over —————–
<3>[23, msg_recv] [ 4118.641763] virtmsm_sio_read_cb is called, port:1, length=4
<3>[23, msg_recv] [ 4118.641835] data[0]=11
<3>[23, msg_recv] [ 4118.641868] data[1]=0
<3>[23, msg_recv] [ 4118.641896] data[2]=0
<3>[23, msg_recv] [ 4118.641926] data[3]=0
<4>[23, msg_recv] [ 4118.641963] shmem_serial_recv: (1, c96a4300, 4)
<3>[23, msg_recv] [ 4118.642043] shmem_serial_recv: success! len=4
<4>[23, msg_recv] [ 4118.642091] virtmsm_updatemsgRD is called with 20;
<4>[23, msg_recv] [ 4118.642136] pVirtMsmMsgRx->ulRD=1808; pVirtMsmMsgRx->ulWR=1836
<3>[23, msg_recv] [ 4118.642185] virtmsm_sio_read_cb is called, port:1, length=11
<3>[23, msg_recv] [ 4118.642226] data[0]=5
<3>[23, msg_recv] [ 4118.642256] data[1]=0
<3>[23, msg_recv] [ 4118.642285] data[2]=0
<3>[23, msg_recv] [ 4118.642313] data[3]=0
<3>[23, msg_recv] [ 4118.642343] data[4]=1
<3>[23, msg_recv] [ 4118.642371] data[5]=0
<3>[23, msg_recv] [ 4118.642401] data[6]=0
<3>[23, msg_recv] [ 4118.642430] data[7]=0
<3>[23, msg_recv] [ 4118.642460] data[8]=48
<3>[23, msg_recv] [ 4118.642488] data[9]=42
<3>[23, msg_recv] [ 4118.642518] data[10]=132
<4>[23, msg_recv] [ 4118.642595] shmem_serial_recv: (1, c96a4300, 11)
<3>[23, msg_recv] [ 4118.642648] shmem_serial_recv: success! len=11
<4>[23, msg_recv] [ 4118.642691] virtmsm_updatemsgRD is called with 28;
<4>[23, msg_recv] [ 4118.642733] pVirtMsmMsgRx->ulRD=1836; pVirtMsmMsgRx->ulWR=1836
<4>[406, android.FMRadio] [ 4119.088161] shmem_serial_write: (1,c93e0800) writing 4 bytes
<4>[406, android.FMRadio] [ 4119.088206] Content start —————–
<4>[406, android.FMRadio] [ 4119.088228] Content:
<4>[406, android.FMRadio] [ 4119.088243] Content over —————–
<4>[406, android.FMRadio] [ 4119.088301] shmem_serial_write: (1,c93e0800) writing 6 bytes
<4>[406, android.FMRadio] [ 4119.088328] Content start —————–
<4>[406, android.FMRadio] [ 4119.088348] Content:
<4>[406, android.FMRadio] [ 4119.088363] Content over —————–
<3>[23, msg_recv] [ 4119.191891] virtmsm_sio_read_cb is called, port:1, length=4
<3>[23, msg_recv] [ 4119.191960] data[0]=5
<3>[23, msg_recv] [ 4119.191978] data[1]=0
<3>[23, msg_recv] [ 4119.191991] data[2]=0
<3>[23, msg_recv] [ 4119.192006] data[3]=0
<4>[23, msg_recv] [ 4119.192086] shmem_serial_recv: (1, c96a4280, 4)
<3>[23, msg_recv] [ 4119.192165] shmem_serial_recv: success! len=4
<4>[23, msg_recv] [ 4119.192210] virtmsm_updatemsgRD is called with 20;
<4>[23, msg_recv] [ 4119.192236] pVirtMsmMsgRx->ulRD=1856; pVirtMsmMsgRx->ulWR=1880
<3>[23, msg_recv] [ 4119.192261] virtmsm_sio_read_cb is called, port:1, length=5
<3>[23, msg_recv] [ 4119.192280] data[0]=7
<3>[23, msg_recv] [ 4119.192293] data[1]=0
<3>[23, msg_recv] [ 4119.192308] data[2]=0
<3>[23, msg_recv] [ 4119.192321] data[3]=0
<3>[23, msg_recv] [ 4119.192335] data[4]=0
<4>[23, msg_recv] [ 4119.192351] shmem_serial_recv: (1, c96a4280, 5)
<3>[23, msg_recv] [ 4119.192378] shmem_serial_recv: success! len=5
<4>[23, msg_recv] [ 4119.192400] virtmsm_updatemsgRD is called with 24;
<4>[23, msg_recv] [ 4119.192420] pVirtMsmMsgRx->ulRD=1880; pVirtMsmMsgRx->ulWR=1880
<4>[406, android.FMRadio] [ 4119.356731] shmem_serial_write: (1,c93e0800) writing 4 bytes
<4>[406, android.FMRadio] [ 4119.356778] Content start —————–
<4>[406, android.FMRadio] [ 4119.356798] Content:
<4>[406, android.FMRadio] [ 4119.356813] Content over —————–
<4>[406, android.FMRadio] [ 4119.356870] shmem_serial_write: (1,c93e0800) writing 6 bytes
<4>[406, android.FMRadio] [ 4119.356896] Content start —————–
<4>[406, android.FMRadio] [ 4119.356916] Content:
<4>[406, android.FMRadio] [ 4119.356931] Content over —————–
<3>[23, msg_recv] [ 4119.411728] virtmsm_sio_read_cb is called, port:1, length=4
<3>[23, msg_recv] [ 4119.411773] data[0]=5
<3>[23, msg_recv] [ 4119.411790] data[1]=0
<3>[23, msg_recv] [ 4119.411803] data[2]=0
<3>[23, msg_recv] [ 4119.411818] data[3]=0
<4>[23, msg_recv] [ 4119.411836] shmem_serial_recv: (1, c96a42a0, 4)
<3>[23, msg_recv] [ 4119.411891] shmem_serial_recv: success! len=4
<4>[23, msg_recv] [ 4119.411918] virtmsm_updatemsgRD is called with 20;
<4>[23, msg_recv] [ 4119.411941] pVirtMsmMsgRx->ulRD=1900; pVirtMsmMsgRx->ulWR=1924
<3>[23, msg_recv] [ 4119.411965] virtmsm_sio_read_cb is called, port:1, length=5
<3>[23, msg_recv] [ 4119.411985] data[0]=17
<3>[23, msg_recv] [ 4119.411998] data[1]=0
<3>[23, msg_recv] [ 4119.412011] data[2]=0
<3>[23, msg_recv] [ 4119.412025] data[3]=0
<3>[23, msg_recv] [ 4119.412038] data[4]=0
<4>[23, msg_recv] [ 4119.412056] shmem_serial_recv: (1, c96a42a0, 5)
<3>[23, msg_recv] [ 4119.412085] shmem_serial_recv: success! len=5
<4>[23, msg_recv] [ 4119.412103] virtmsm_updatemsgRD is called with 24;
<4>[23, msg_recv] [ 4119.412123] pVirtMsmMsgRx->ulRD=1924; pVirtMsmMsgRx->ulWR=1924
<4>[3633, hwvefs] [ 4121.330306] do_exit: exit code=256
<4>[3634, hwvefs] [ 4126.387033] do_exit: exit code=256
<4>[3635, hwvefs] [ 4131.441013] do_exit: exit code=256
<4>[3636, hwvefs] [ 4136.497178] do_exit: exit code=256
<4>[3637, hwvefs] [ 4141.554118] do_exit: exit code=256
<4>[3638, hwvefs] [ 4146.604781] do_exit: exit code=256
<4>[3639, hwvefs] [ 4151.660343] do_exit: exit code=256
<4>[3640, hwvefs] [ 4156.716300] do_exit: exit code=256
<4>[3641, hwvefs] [ 4161.769853] do_exit: exit code=256
<6>[154, PowerManagerSer] [ 4166.588946] request_suspend_state: sleep (0)(0->3) at 4166607345200 (2010-09-18 14:38:59.279758337 UTC)
<6>[6, suspend] [ 4166.626488] early_suspend: call handlers
<4>[6, suspend] [ 4166.626570] s: c01c0f60
<4>[6, suspend] [ 4166.626611] s: c0257574
<4>[6, suspend] [ 4166.627366] s: c025be98
<4>[6, suspend] [ 4166.641883] s: c02699dc
<4>[6, suspend] [ 4166.690100] s: c00a508c
<4>[3642, hwvefs] [ 4166.886260] do_exit: exit code=256
<6>[6, suspend] [ 4167.051761] lcdc un-config
<4>[6, suspend] [ 4167.154830] s: c01b32dc
<4>[6, suspend] [ 4167.154873] s: c01b4cf0
<6>[6, suspend] [ 4167.154890] early_suspend: sync
<4>[6, suspend] [ 4167.230563] save exit: isCheckpointed 1
<4>[6, suspend] [ 4167.286636] save exit: isCheckpointed 1
<4>[3643, hwvefs] [ 4171.952268] do_exit: exit code=256
<6>[0, swapper] [ 4172.581258] gpiomatrix: key 6c, 0-1 (35-40) changed to 1
<6>[3644, ndroid.settings] [ 4172.702768] gpiomatrix: key 6c, 0-1 (35-40) changed to 0
<6>[0, swapper] [ 4174.127763] gpiomatrix: key 6a, 1-2 (34-39) changed to 1
<6>[0, swapper] [ 4174.310438] gpiomatrix: key 6a, 1-2 (34-39) changed to 0
<6>[0, swapper] [ 4175.054353] gpiomatrix: key 3e, 0-2 (35-39) changed to 1
<6>[158, WindowManagerPo] [ 4175.059366] request_suspend_state: wakeup (3)(3->0) at 4175077783535 (2010-09-18 14:39:07.750198339 UTC)
<6>[6, suspend] [ 4175.061510] late_resume: call handlers
<3>[6, suspend] [ 4175.161901] lcd_panel:*********hw_lcd_panel == 2;***************
<6>[6, suspend] [ 4175.162426] lcdc config
<6>[133, er.ServerThread] [ 4175.195973] gpiomatrix: key 3e, 0-2 (35-39) changed to 0
<3>[6, suspend] [ 4175.591080] lcd_ili9325_disp_exit_sleep: LCD should be on, LCD_Panel = 2!
<3>[6, suspend] [ 4175.591140] lcd_panel:*********hw_lcd_panel == 2;***************
<4>[6, suspend] [ 4175.591878] r: c01b3520
<4>[6, suspend] [ 4175.604865] r: c00a5034
<4>[6, suspend] [ 4175.621705] r: c0269968
<4>[6, suspend] [ 4175.622481] r: c025b5f4
<4>[6, suspend] [ 4175.622525] r: c0257544
<4>[6, suspend] [ 4175.623643] r: c01c0f8c
<6>[6, suspend] [ 4175.623670] late_resume: done
<4>[3649, hwvefs] [ 4176.994930] do_exit: exit code=256
<4>[406, android.FMRadio] [ 4179.746496] shmem_serial_write: (1,c93e0800) writing 4 bytes
<4>[406, android.FMRadio] [ 4179.746543] Content start —————–
<4>[406, android.FMRadio] [ 4179.746563] Content:
<4>[406, android.FMRadio] [ 4179.746578] Content over —————–
<4>[406, android.FMRadio] [ 4179.746635] shmem_serial_write: (1,c93e0800) writing 6 bytes
<4>[406, android.FMRadio] [ 4179.746660] Content start —————–
<4>[406, android.FMRadio] [ 4179.746678] Content:
<4>[406, android.FMRadio] [ 4179.746693] Content over —————–
<3>[23, msg_recv] [ 4179.911730] virtmsm_sio_read_cb is called, port:1, length=4
<3>[23, msg_recv] [ 4179.911773] data[0]=5
<3>[23, msg_recv] [ 4179.911786] data[1]=0
<3>[23, msg_recv] [ 4179.911801] data[2]=0
<3>[23, msg_recv] [ 4179.911815] data[3]=0
<4>[23, msg_recv] [ 4179.911833] shmem_serial_recv: (1, c96a4720, 4)
<3>[23, msg_recv] [ 4179.911883] shmem_serial_recv: success! len=4
<4>[23, msg_recv] [ 4179.911910] virtmsm_updatemsgRD is called with 20;
<4>[23, msg_recv] [ 4179.911931] pVirtMsmMsgRx->ulRD=1944; pVirtMsmMsgRx->ulWR=1968
<3>[23, msg_recv] [ 4179.911956] virtmsm_sio_read_cb is called, port:1, length=5
<3>[23, msg_recv] [ 4179.911976] data[0]=7
<3>[23, msg_recv] [ 4179.911990] data[1]=0
<3>[23, msg_recv] [ 4179.912003] data[2]=0
<3>[23, msg_recv] [ 4179.912016] data[3]=0
<3>[23, msg_recv] [ 4179.912030] data[4]=0
<4>[23, msg_recv] [ 4179.912046] shmem_serial_recv: (1, c96a4720, 5)
<3>[23, msg_recv] [ 4179.912071] shmem_serial_recv: success! len=5
<4>[23, msg_recv] [ 4179.912093] virtmsm_updatemsgRD is called with 24;
<4>[23, msg_recv] [ 4179.912113] pVirtMsmMsgRx->ulRD=1968; pVirtMsmMsgRx->ulWR=1968
dmesg.rar
需要的自己下载慢慢看吧,128KB的文本文件,太大了