#1  
Old June 2nd, 2008, 11:57 PM
jmjoebar jmjoebar is offline
Junior Member
NETGEAR Newbie
 
Join Date: Jun 2008
Posts: 3
jmjoebar is on a distinguished road
Default Please help me read/edit/write a backup ".cfg" file

Hi all,

I have a CBVG834G wifi cable modem router, and my ISP in France that provided this cable box has configured the modem in a way that prevents some ports forwarding like 22 (ssh).

I figured out that the configured port-forwarding are saved in the backup.cfg file during backup, so I tried to look at this file to force my modification as wanted.
However, this file is a binary file and is not easily readable.

As I'm a little stubborn, I've started some crude reverse engineering on this file, and easily discovered that every byte in the file has been bitwise rotated on the left (that is if you read a byte as abcdefgh it should be read as bcdefgha). [ In C, one could write it as x = ((x << 1) | (x >> 7)) if that's more explicit for the reader ]

Doing so, I spotted in the backup file the ports-forwarding locations, but also other things like the non official login/passwd: MSO/135naBle, and also my wifi access key.

However, I still have a serious problem and that's where i need your help.
The file begins with a 16 bytes (128bits) checksum. It's probably something like a MD5 sum. If this header is not correctly set, then the box refuses to read in my newly edited file. And precisely, up to now and despite many efforts, I did not manage to find out what kind of algorithm is used to create this key.

Does anybody know how Netgear signs or checksums their backup.cfg files?

Please help.
Thanks
JM
Reply With Quote
  #2  
Old June 3rd, 2008, 10:15 AM
GLaDOS's Avatar
GLaDOS GLaDOS is offline
Senior Member
NETGEAR Addict
 
Join Date: Apr 2008
Location: Aperture Science Enrichment Center
Posts: 1,428
GLaDOS is on a distinguished road
Default Re: Please help me read/edit/write a backup ".cfg" file

ok, first I wanted to respond so you don't think you won't ever get a response. I think you're going in the right direction for reverse engineering the cfg file. But I'm sorry to say that I don't think you'll see anyone here that has that much information, as this is a community forum, I doubt you'll get any good information about the cfg files.

Good luck.
__________________
-GLaDOS
"The Enrichment Center is committed to the well being of all participants. Cake and grief counseling will be available at the conclusion of the test. Thank you for helping us help you help us all."
"All right, keep doing whatever it is you think you're doing. Killing you and giving you good advice aren't mutually exclusive. The rocket really is the way to go."

"Stop squirming and die like an adult, or I'm going to delete your backup. STOP! Okay, enough, I deleted it. No matter what happens now, you're dead. You're still shuffling around a little, but believe me, you're dead. The part of you that could have survived indefinitely is gone. I just struck you from the permanent record."
Reply With Quote
  #3  
Old June 4th, 2008, 12:58 AM
jmjoebar jmjoebar is offline
Junior Member
NETGEAR Newbie
 
Join Date: Jun 2008
Posts: 3
jmjoebar is on a distinguished road
Default Re: Please help me read/edit/write a backup ".cfg" file

So thanks at least for sending this answer.
I'll try to continue on my own then.
Thanks.
Reply With Quote
  #4  
Old June 4th, 2008, 05:44 AM
jmizoguchi's Avatar
jmizoguchi jmizoguchi is offline
Junior Member
 
Join Date: Feb 2007
Location: Kentucky, USA
Posts: 0
jmizoguchi is an unknown quantity at this point
Default Re: Please help me read/edit/write a backup ".cfg" file

Quote:
Originally Posted by jmjoebar View Post
So thanks at least for sending this answer.
I'll try to continue on my own then.
Thanks.
interesting to see your outcome of project though... not too many have posted or tried it..
Reply With Quote
  #5  
Old June 10th, 2008, 11:01 AM
jmjoebar jmjoebar is offline
Junior Member
NETGEAR Newbie
 
Join Date: Jun 2008
Posts: 3
jmjoebar is on a distinguished road
Default Re: Please help me read/edit/write a backup ".cfg" file

Sure,

the problem is that I'm still stuck.

I had a look to the opensource packages here: http://kbserver.netgear.com/kb_web_files/n101238.asp
and more specifically into the Firm1.x of the DG834. I don't expect netgear to have created diferent read/save routines for its different routers... :-)

I found the location where the .cfg files are read/saved.
Unluckily, it is in a cgi file (executable) and the source does not appear to be available.

the cgi file is namely /usr/sbin/restore_config.cgi which is located in tarball target.tar.bz2, but since I don't know of any good MIPS decompiler, I cannot go any further.

So that's just the end of my quest... till now
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



All times are GMT -8. The time now is 09:33 PM.