红米小爱Play hack - 郑羊羊咩的窝

因为没找到什么入口，于是打算拆开ttl

要无损拆开，需要准备金属撬棒，大塑料撬棒，锤子

先找一个角，用金属撬棒向外顶着锤子敲开一点缝（因为4个角缝最小）

然后塑料撬棒塞进去翘一圈即可拆开

准备一个ttl小板，三根弯排针

pcb上有小字写着线的连接顺序，tx，rx与小板的反着接

插电，开机，开机完会看到控制台输出了sn_code: ，后面的复制下来，这样拼起来

1
sn码A20EDC68-62E5-70C6-76E8-75879721B8EC

到这里算一个32位小写md5，前14位就是root的密码

开启ssh：

1
dropbearkey -t rsa -f /data/dropbear_rsa_host_key
2
dropbear -r /data/dropbear_rsa_host_key

由于/是只读的，所以没法修改开机启动打开ssh，可以使用内置一个单片机来延时执行serial

播放音频：

1
mphelper tone 文件或链接

具体可以 cat /usr/bin/mphelper来了解提供的控制api

系统信息：

1
U-Boot 2018.05 (Dec 11 2019 - 02:53:20 +0000) Allwinner Technology, Build: jenkins-Mico_l07a_ota_publish-63
2
CPU: Allwinner Family
3
Model: sun8iw18
4
I2C: ready
5
DRAM: 64 MiB
6
Relocation Offset is: 00f48000
7
secure enable bit: 1
8
CPU=1008 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz MBus=264Mhz
9
Linux version 4.9.118 (jenkins@88969dbf45be) (gcc version 6.4.1 (OpenWrt/Linaro GCC 6.4-2017.11 2017-11) ) #1 SMP Wed Mar 25 02:19:05 UTC 2020

1
root@mico:~# df
2
Filesystem 1K-blocks Used Available Use% Mounted on
3
/dev/root 23296 23296 0 100% /
4
devtmpfs 512 0 512 0% /dev
5
tmpfs 29240 204 29036 1% /tmp
6
tmpfs 512 0 512 0% /dev
7
/dev/by-name/UDISK 24981 3604 19497 16% /data
8
/dev/by-name/UDISK 24981 3604 19497 16% /etc/shadow
9
root@mico:~# free
10
total used free shared buffers cached
11
Mem: 58484 56312 2172 272 6532 16968
12
-/+ buffers/cache: 32812 25672
13
Swap: 0 0 0
14
root@mico:~# ps
15
PID USER VSZ STAT COMMAND
16
1 root 1324 S /sbin/procd
17
2 root 0 SW [kthreadd]
18
3 root 0 SW [ksoftirqd/0]
19
4 root 0 SW [kworker/0:0]
20
5 root 0 SW&lt; [kworker/0:0H]
21
6 root 0 SW [kworker/u4:0]
22
7 root 0 SW [rcu_sched]
23
8 root 0 SW [rcu_bh]
24
9 root 0 SW [migration/0]
25
10 root 0 SW&lt; [lru-add-drain]
26
11 root 0 SW [cpuhp/0]
27
12 root 0 SW [cpuhp/1]
28
13 root 0 SW [migration/1]
29
14 root 0 SW [ksoftirqd/1]
30
15 root 0 SW [kworker/1:0]
31
16 root 0 SW&lt; [kworker/1:0H]
32
17 root 0 SW [kdevtmpfs]
33
18 root 0 SW [kworker/u4:1]
34
205 root 0 SW [kworker/u4:2]
35
228 root 0 SW [oom_reaper]
36
229 root 0 SW&lt; [writeback]
37
230 root 0 SW&lt; [crypto]
38
232 root 0 SW&lt; [bioset]
39
234 root 0 SW&lt; [kblockd]
40
273 root 0 SW [kworker/1:1]
41
275 root 0 SW&lt; [cfg80211]
42
304 root 0 SW [kworker/0:1]
43
320 root 0 SW [kswapd0]
44
321 root 0 SW&lt; [vmstat]
45
452 root 0 SW&lt; [bioset]
46
453 root 0 SW [nand]
47
454 root 0 SW [nftld]
48
466 root 0 SW [nand_rcd]
49
483 root 0 SW&lt; [btfwwork]
50
484 root 0 SW [cfinteractive]
51
485 root 0 SW [autohotplug]
52
486 root 0 SW [irq/165-sunxi-m]
53
648 root 0 SW&lt; [ipv6_addrconf]
54
666 root 0 SW&lt; [kworker/0:1H]
55
667 root 0 SW&lt; [kworker/1:1H]
56
858 root 972 S /sbin/ubusd
57
866 root 1040 S -ash
58
1250 root 0 SW&lt; [krfcommd]
59
1331 root 1324 S /usr/sbin/dbus-daemon --system
60
1383 root 1412 S /sbin/netifd
61
1402 root 0 SW [jbd2/nand0p9-8]
62
1403 root 0 SW&lt; [ext4-rsv-conver]
63
1410 root 2600 S&lt; /usr/bin/quickplayer
64
1419 root 1040 S&lt; /bin/ledserver
65
1461 root 1040 S /usr/sbin/crond -f -c /etc/crontabs -l 5
66
1479 root 4296 S {syslog-ng} supervising syslog-ng
67
1480 root 4348 S /usr/sbin/syslog-ng
68
1581 root 6440 S /usr/bin/xiaomi_dns_server
69
1630 root 0 SW [ksdioirqd/mmc0]
70
1641 root 0 SW [RTW_XMIT_THREAD]
71
1642 root 0 SW [RTW_CMD_THREAD]
72
1643 root 0 SW [RTWHALXT]
73
1655 root 1700 S /usr/sbin/wpa_supplicant -Dnl80211 -iwlan0 -c/data/w
74
1678 root 1040 S udhcpc -f -S -s /bin/simple_dhcp.sh -R -t 0 -i wlan0
75
1699 root 704 S odhcp6c -s /lib/netifd/odhcp6c-script.sh -P0 -e -v w
76
1702 root 1048 S {wireless_point.} /bin/sh /usr/bin/wireless_point.sh
77
2578 root 824 S rtk_hciattach -n -s 115200 ttyS1 rtk_h4
78
2628 nobody 872 S /usr/sbin/dnsmasq -C /var/etc/dnsmasq.conf -k -x /va
79
2651 root 9936 S /usr/bin/upnp-disc
80
2667 root 1340 S /usr/bin/alarmd
81
2687 root 7820 S /usr/bin/mico_aivs_lab
82
2700 root 0 SW&lt; [kworker/u5:0]
83
2701 root 0 SW&lt; [hci0]
84
2702 root 0 SW&lt; [hci0]
85
2705 root 0 SW&lt; [kworker/u5:1]
86
2706 root 0 SW&lt; [kworker/u5:2]
87
2729 root 3420 S /usr/bin/bluetoothd -n
88
2776 root 10040 S /usr/bin/mediaplayer
89
2790 root 736 S /usr/sbin/wpa_cli -a/bin/wpa_action.sh
90
2791 root 8004 S /usr/bin/messagingagent --handler_threads 8
91
2809 root 1300 S /usr/bin/mico-helper
92
2823 root 1024 S /bin/wifitool
93
2899 root 5208 S /usr/bin/statpoints_daemon
94
2999 root 1032 S /usr/bin/miio_client -L /dev/null
95
3000 root 1092 S {miio_client_hel} /bin/sh /usr/bin/miio_client_helpe
96
3315 root 5248 S /usr/bin/bluealsa -i hci0 -p a2dp-sink
97
3316 root 5760 S /usr/bin/bluealsa-aplay 00:00:00:00:00:00 -vv -i hci
98
3317 root 5964 S /usr/bin/bluez_mibt_classical
99
3318 root 2628 S /usr/bin/bluez_mibt_ble
100
3385 root 564 S /usr/bin/miio_recv_line
101
3428 root 1236 S /usr/bin/miio_service
102
3449 mosquitt 844 S mosquitto -c /etc/mosquitto/mosquitto.conf
103
3482 root 18604 S&lt; /usr/bin/mipns-horizon -c /usr/share/mipns/ -r opus3
104
3490 root 960 S /bin/touchpad
105
3668 root 5832 S /usr/bin/mibrain_service
106
3678 root 1400 S /usr/bin/mico_ai_crontab
107
3689 root 780 S /usr/bin/nano_httpd
108
3702 root 3316 S /usr/bin/pns_ubus_helper
109
3721 root 3204 S /usr/bin/mibt_mesh_proxy
110
4028 root 1040 S sleep 10s
111
4030 root 1040 R ps
112
root@mico:/data# ls /etc/init.d/
113
adbd dnsmasq mico_ai_crontab silentboot
114
alarm done mico_aivs_lab start_sound
115
alsa dropbear mico_helper statpoints_daemon
116
bluetooth fstab miio sysctl
117
bluetoothd gpio_switch mitv-disc sysfixtime
118
boot led mosquitto syslog-ng
119
boot_check logrotate nano_httpd system
120
check_mac mediaplayer network touchpad
121
coredump messagingagent odhcp6c umount
122
cron mibrain_service pns wifitool
123
dbus mibt_mesh pns_ubus_helper wireless
124
dhcpc mibt_mesh_proxy quickplayer xiaomi_dns_server
125
root@mico:/data# cat /etc/rc.local
126
# Put your custom commands here that should be executed once
127
# the system init finished. By default this file does nothing.
128

129
#playback#
130
amixer -D hw:audiocodec cset name='External Speaker Switch' 1
131
amixer -D hw:audiocodec cset name='digital volume' 63
132
amixer -D hw:audiocodec cset name='LINEOUT volume' 23
133
amixer -D hw:audiocodec cset name='Right LINEOUT Mux' 1
134

135
#capture#
136
amixer -D hw:audiocodec cset name='Left Input Mixer MIC1 Boost Switch' 1
137
amixer -D hw:audiocodec cset name='Right Input Mixer MIC2 Boost Switch' 1
138
amixer -D hw:audiocodec cset name='Xadc Input Mixer MIC3 Boost Switch' 1
139
amixer -D hw:audiocodec cset name='MIC1 gain volume' 2
140
amixer -D hw:audiocodec cset name='MIC2 gain volume' 2
141
amixer -D hw:audiocodec cset name='MIC3 gain volume' 0
142

143
exit 0
144
root@mico:/data#