Extract Stuff from O.mg Cable firmaware dumps

omg_extract.py

import re
import argparse
import esptool
from esptool import ESPLoader
from io import StringIO 
import sys


MODE_PATTERN = b'MODE ([1-2])\x00'
SSID_PATTERN = b'SSID (.*)\x00PASS'
PASS_PATTERN = b'PASS (.*)\x00MODE'



# Context Manager to capture output of an external lib to a list
class Capturing(list):
    def __enter__(self):
        self._stdout = sys.stdout
        sys.stdout = self._stringio = StringIO()
        return self
    def __exit__(self, *args):
        self.extend(self._stringio.getvalue().splitlines())
        del self._stringio
        sys.stdout = self._stdout

def dump_firmware(dev_name, output_name):
    # Connect to the programmer dump ~ 2mb of data. 
    print("[+] Connecting to {0}".format(dev_name))

    # test connection first

    # Read Device Info

    info_command = [ '--baud', '115200', '--port', dev_name, '--no-stub', 'chip_id' ]
    error = False
    with Capturing() as output:
        try:
            esptool.main(info_command)
        except Exception as err:
            error = err

    if error:
        print("[!] Something went wrong: {0}".format(error))
        sys.exit()
        
    chip_id = output[9].split("ID: ")[-1]
    mac_add = output[7].split("MAC: ")[-1]

    print("[+] Found Device")
    print("  [-] Chip ID: {0}".format(chip_id))
    print("  [-] MAC: {0}".format(mac_add))

    print("[+] Dumping firmware to {0}".format(output_name))
    print("  [-] This can take up to 2 minutes to complete")
    dump_command = [ '--baud', '115200', '--port', dev_name, 'read_flash', '0', '0x200000', output_name ]
    output = []
    with Capturing() as output:
        try:
            esptool.main(dump_command)
        except Exception as err:
            error = True

    if error:
        print("[!] Something went wrong: {0}".format(err))
        sys.exit()

    # I have not had a failure so not sure how to check for an error state. 
    print(output)
    if "100 %" in output[-4]:
        print("  [-] Success: {0}".format(output[-2]))
    else:
        print("  [!] Failed")
        sys.exit()



def parse_firmware(firmware_name):
    print("[+] Reading Firmware")
    try:
        firmware_dump = open(firmware_name, "rb").read()
    except:
        print("[!] Unable to read firmware file at {0}".format(firmware_name))
        sys.exit()

    print("[+] Extracting Config")

    cable_mode = re.search(MODE_PATTERN, firmware_dump)

    if cable_mode:
        if cable_mode.group(1) == "2":
            wifi_mode = "Access Point"
        else:
            wifi_mode = "Station Mode"

    ssid = re.search(SSID_PATTERN, firmware_dump).group(1)
    ssid_pass = re.search(PASS_PATTERN, firmware_dump).group(1)
    

    print("  [-] WiFi Mode: {0}".format(wifi_mode))
    print("  [-] SSID: {0}".format(ssid))
    print("  [-] PASS: {0}".format(ssid_pass))


    # Lets get some payloads

    payload_length = 4096
    payload_offsets = [0xa9000,0xaa000, 0xab000 ]


    print("[+] Saving Custom Payloads")

    for offset in payload_offsets:
        print("  [-] Extracting payload from offset {0}".format(offset))
        output_name = "{0}.txt".format(offset)
        with open(output_name, "wb") as out:
            payload_data = firmware_dump[offset: offset+payload_length]
            out.write(payload_data.rstrip(b'\xff'))
            print("  [-] Payload written to {0}".format(output_name))


def main():

    parser = argparse.ArgumentParser(description='Extract Stuff from O.mg Cable')
    parser.add_argument('--dev', help='USB Device to read')
    parser.add_argument('--out', help='Dump Firware here')

    args = parser.parse_args()

    dump_firmware(args.dev, args.out)
    parse_firmware(args.out)

if __name__ == "__main__":
    main()