hacker

turmio

hacker

otter

Hacking Bus Displays

Background

City of Oulu / Oulun Energia is dumping old bus displays and we got two of those. We promised to do our best to build something from them.

Devices

Mass media and modem (they used to communicate through 3G) were removed before we got them. Modem was apparently attached to the main card through ethernet. Device shows the IP on display upon boot.

Plans

displays.jpg

Generic technical info

Linux (none) 2.4.17_mvl21-rpxlite #8 Fri Jan 16 16:59:00 EET 2004 ppc unknown

Posting content

It seems that you can POST information to WEB-server and it will be show at display. E.g.

Network

display2.jpg

nmap -results

Host is up (0.00088s latency).
Not shown: 65532 closed ports
PORT     STATE SERVICE
21/tcp   open  ftp
23/tcp   open  telnet
8080/tcp open  http-proxy

PORT     STATE SERVICE     VERSION
21/tcp   open  ftp         Topfield TF7100HDPVRt DVR ftpd 6.4/OpenBSD/Linux-ftpd-0.17
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-------    1 root     root          330 Oct 15  2013 .bash_history
| -rw-r--r--    1 root     root         6011 Oct 12  2006 .xftcache
| -rw-r-----    1 root     root        24450 Oct 12  2006 ArialBold-14.bdf_longbus
| drwxr-xr-x    1 root     root            0 May 28  2002 bin
| drwxr-xr-x    1 root     root            0 May 28  2002 dev
| drwxr-xr-x    1 root     root            0 May 28  2002 etc
| drwxr-xr-x    1 root     root            0 May 28  2002 lib
| drwxr-xr-x    1 root     root            0 May 28  2002 lost+found
| drwxr-xr-x    1 root     root            0 May 28  2002 mnt
| drwxr-xr-x    1 root     root            0 May 28  2002 opt
| dr-xr-xr-x   28 root     root            0 Jul 10 23:55 proc
| drwxr-xr-x    1 root     root            0 May 28  2002 root
| drwxr-xr-x    1 root     root            0 May 28  2002 sbin
| drwxr-xr-x    1 root     root            0 May 28  2002 tmp
| drwxr-xr-x    1 root     root            0 May 28  2002 usr
|_drwxr-xr-x    1 root     root            0 May 28  2002 var
23/tcp   open  telnet      Linux telnetd
8080/tcp open  http-proxy?
|_http-open-proxy: ERROR: Script execution failed (use -d to debug)

WEB-page

webpage.png

telnet

Accounts:

root::0:0:root:/:/bin/sh
ftp::0:0:ftp:/:/bin/sh
nobody::99:99:nobody:/:/bin/sh

ps auxw

[/usr/bin]# ps auxwww
  PID  Uid     Stat Command
    1 root     S    init 
    2 root     S    [keventd]
    3 root     S    [ksoftirqd_CPU0]
    4 root     S    [kswapd]
    5 root     S    [bdflush]
    6 root     S    [kupdated]
    7 root     S    [mtdblockd]
   14 root     S    /bin/sh --login 
   18 root     S    /bin/sh /usr/bin/reset_eth.sh 
   19 root     S    /usr/bin/paras 
   28 root     S    [jffs2_gcd_mtd3]
   31 root     S    /usr/sbin/xinetd 
   35 root     S    /usr/bin/paras 
   36 root     S    /usr/bin/paras 
   37 root     S    /usr/bin/paras 
  282 root     S    in.ftpd: 10.2.0.137: anonymous/NcFTP@: RETR /usr/bin/boot_s
  307 root     S    in.telnetd: 10.2.0.137            
  308 root     S    -sh 
  403 root     S    /bin/ping -c 3 10.0.0.226 
  404 root     R    ps auxwww 

/Dmesg

Display menu

Creates configuration files 

                    MAIN MENU 
                    ========= 

   Select: 
         1   - Change display type
         2   - Change ip-address, netmask and gateway
         3   - Select protocol to use
         4   - Check values
         5   - Save changes and exit
         6   - Save changes and reboot
         0   - Exit, no changes made to the files

         DISPLAY TYPE SELECTION: 
         =======================

        Current type : 2M2466

    Select:
          1   - M14118       display with four MO03 glasses
          2   - M24B99       display with three GV74 glasses
          3   - M24BM12132DL display with four GV74 and GV76 glasses
          4   - M24B330      display with ten GV74 glasses
          5   - twoGV74      display with two GV74 glasses
          6   - 2M2466       display with two GV74 glasses in two rows
          0   - Back to main menu

       PROTOCOL SELECTION 
        ==================

    Select:
          1   - Krone
          2   - DisplayML
          3   - DisplayML in Vilnius
          0   - Back to main menu


 **NOTE** Not to be used when only one protocol is in use !!!!
  
        VALUES TABLE 
          ============

          Display type :     2M2466
          IP-address :       10.2.0.139
          Subnet mask :      255.255.255.248
          Default gateway :  10.2.0.137
          Protocol :         paras

          0 - Back to main menu


         NETWORK CONFIGURATION
          =====================

    Choose: 
          1   - Change IP-address            Current: 10.2.0.139
          2   - Change Subnetmask            Current: 255.255.255.248
          3   - Change Default Gateway       Current: 10.2.0.137

          0   - Back to main menu


         VALUES TABLE 
          ============

          Display type :     2M2466
          IP-address :       10.2.0.139
          Subnet mask :      255.255.255.248
          Default gateway :  10.2.0.137
          Protocol :         paras

          0 - Back to main menu

[/proc/19]# ls -la fd       
dr-x------    2 root     root            0 Oct 14 02:59 .
dr-xr-xr-x    3 root     root            0 Oct 14 02:58 ..
lrwx------    1 root     root           64 Oct 14 02:59 0 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 1 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 10 -> socket:[64]
lr-x------    1 root     root           64 Oct 14 02:59 11 -> pipe:[65]
l-wx------    1 root     root           64 Oct 14 02:59 12 -> pipe:[65]
lrwx------    1 root     root           64 Oct 14 02:59 13 -> socket:[66]
lr-x------    1 root     root           64 Oct 14 02:59 14 -> /etc/ip.addr
lr-x------    1 root     root           64 Oct 14 02:59 15 -> /lib/ft2fonts/DefaultFont-11.bdf
lr-x------    1 root     root           64 Oct 14 02:59 16 -> /usr/bin/versions.txt
lr-x------    1 root     root           64 Oct 14 02:59 17 -> /proc/version
lr-x------    1 root     root           64 Oct 14 02:59 18 -> /proc/version
lr-x------    1 root     root           64 Oct 14 02:59 19 -> /proc/version
lrwx------    1 root     root           64 Oct 14 02:59 2 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 20 -> /dev/watchdog
lrwx------    1 root     root           64 Oct 14 02:59 3 -> /dev/ttyS0
lrwx------    1 root     root           64 Oct 14 02:59 4 -> /dev/tty0
lrwx------    1 root     root           64 Oct 14 02:59 5 -> /dev/fb0
lrwx------    1 root     root           64 Oct 14 02:59 6 -> /dev/null
lrwx------    1 root     root           64 Oct 14 02:59 7 -> /dev/spilcd
lrwx------    1 root     root           64 Oct 14 02:59 8 -> /dev/candrv0
lrwx------    1 root     root           64 Oct 14 02:59 9 -> /dev/candrv1

Display device?

Paras binary seems to be binding to /dev/fb0 This device could be "Frame buffer" -device, which is an abstraction of the display panel. It could be used to write raw bitmap data to the display. More info:

Result of dump with cat /dev/fb0 > fb0_dump.dat here: fb0_dump.dat

  • [get | view | diff] (2016-10-13 17:32:45, 732.8 KB) [[attachment:DisplayML_Specification_standard.pdf]]
  • [get | view | diff] (2016-10-13 17:32:45, 912.6 KB) [[attachment:Vedlegg_1_til_Bilag_3_Protokoll.pdf]]
  • [get | view | diff] (2014-07-10 17:12:09, 33.6 KB) [[attachment:display2.jpg]]
  • [get | view | diff] (2014-07-10 17:12:12, 27.0 KB) [[attachment:displays.jpg]]
  • [get | view | diff] (2014-11-06 19:45:23, 632.0 KB) [[attachment:fb0_dump.dat]]
  • [get | view | diff] (2014-07-10 18:57:44, 63.5 KB) [[attachment:tarlab-ftw.jpg]]
  • [get | view | diff] (2014-08-21 13:21:19, 1.3 KB) [[attachment:turmio.xml]]
  • [get | view | diff] (2016-10-13 18:28:09, 1.3 KB) [[attachment:turmionTemplate.xml]]
  • [get | view | diff] (2014-07-10 17:10:51, 49.9 KB) [[attachment:webpage.png]]
 All files | Selected Files: delete move to page
Normal Sort Sort + uniq Sort + uniq + count

RasPi

eth0      Link encap:Ethernet  HWaddr b8:27:eb:11:a8:b3  
          inet addr:10.2.0.140  Bcast:10.2.0.143  Mask:255.255.255.248
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1259 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:96068 (93.8 KiB)  TX bytes:0 (0.0 B)
description

Reverse engineering old ?BudDisplay from the year 2000 and building something new with it

started
2014-07-10


CategoryProjekti