hacker:: [[turmio]] hacker:: [[otter]] = Hacking Bus Displays = == Background == City of Oulu / Oulun Energia is dumping old bus displays and we got two of those. We promised to do our best to build something from them. === Devices === Both are designed for outdoor public use, so they are heavy, metal enclosed, robust boxes. * One is larger (1m x 1m) one sided, two 'modules' stacked vertically. Heavy. * Second one is smaller two sided, two 'modules' back-to-back. Surprisingly heavier. Mass media and modem (they used to communicate through 3G) were removed before we got them. Modem was apparently attached to the main card through ethernet. Device shows the IP on display upon boot. === Plans === * Figure out how they work * Use at least one (larger) as information display. (Twitter? IRC?) * Smaller ones for some project. {{attachment:displays.jpg}} == Generic technical info == * Telnet * FTP * Web-server Linux (none) 2.4.17_mvl21-rpxlite #8 Fri Jan 16 16:59:00 EET 2004 ppc unknown == Posting content == It seems that you can POST information to WEB-server and it will be show at display. E.g. * Using curl: {{{ curl -d @display_request.xml http://10.2.0.139:8080}}} * display_request.xml {{{ Tarlab FTW! }}} {{attachment:tarlab-ftw.jpg}} == Network == {{attachment:display2.jpg}} === nmap -results === {{{ Host is up (0.00088s latency). Not shown: 65532 closed ports PORT STATE SERVICE 21/tcp open ftp 23/tcp open telnet 8080/tcp open http-proxy PORT STATE SERVICE VERSION 21/tcp open ftp Topfield TF7100HDPVRt DVR ftpd 6.4/OpenBSD/Linux-ftpd-0.17 | ftp-anon: Anonymous FTP login allowed (FTP code 230) | -rw------- 1 root root 330 Oct 15 2013 .bash_history | -rw-r--r-- 1 root root 6011 Oct 12 2006 .xftcache | -rw-r----- 1 root root 24450 Oct 12 2006 ArialBold-14.bdf_longbus | drwxr-xr-x 1 root root 0 May 28 2002 bin | drwxr-xr-x 1 root root 0 May 28 2002 dev | drwxr-xr-x 1 root root 0 May 28 2002 etc | drwxr-xr-x 1 root root 0 May 28 2002 lib | drwxr-xr-x 1 root root 0 May 28 2002 lost+found | drwxr-xr-x 1 root root 0 May 28 2002 mnt | drwxr-xr-x 1 root root 0 May 28 2002 opt | dr-xr-xr-x 28 root root 0 Jul 10 23:55 proc | drwxr-xr-x 1 root root 0 May 28 2002 root | drwxr-xr-x 1 root root 0 May 28 2002 sbin | drwxr-xr-x 1 root root 0 May 28 2002 tmp | drwxr-xr-x 1 root root 0 May 28 2002 usr |_drwxr-xr-x 1 root root 0 May 28 2002 var 23/tcp open telnet Linux telnetd 8080/tcp open http-proxy? |_http-open-proxy: ERROR: Script execution failed (use -d to debug) }}} === WEB-page === {{attachment:webpage.png}} === telnet === Accounts: {{{ root::0:0:root:/:/bin/sh ftp::0:0:ftp:/:/bin/sh nobody::99:99:nobody:/:/bin/sh }}} === ps auxw === {{{ [/usr/bin]# ps auxwww PID Uid Stat Command 1 root S init 2 root S [keventd] 3 root S [ksoftirqd_CPU0] 4 root S [kswapd] 5 root S [bdflush] 6 root S [kupdated] 7 root S [mtdblockd] 14 root S /bin/sh --login 18 root S /bin/sh /usr/bin/reset_eth.sh 19 root S /usr/bin/paras 28 root S [jffs2_gcd_mtd3] 31 root S /usr/sbin/xinetd 35 root S /usr/bin/paras 36 root S /usr/bin/paras 37 root S /usr/bin/paras 282 root S in.ftpd: 10.2.0.137: anonymous/NcFTP@: RETR /usr/bin/boot_s 307 root S in.telnetd: 10.2.0.137 308 root S -sh 403 root S /bin/ping -c 3 10.0.0.226 404 root R ps auxwww }}} [[/Dmesg]] ##content goes here == Display menu == {{{ Creates configuration files MAIN MENU ========= Select: 1 - Change display type 2 - Change ip-address, netmask and gateway 3 - Select protocol to use 4 - Check values 5 - Save changes and exit 6 - Save changes and reboot 0 - Exit, no changes made to the files DISPLAY TYPE SELECTION: ======================= Current type : 2M2466 Select: 1 - M14118 display with four MO03 glasses 2 - M24B99 display with three GV74 glasses 3 - M24BM12132DL display with four GV74 and GV76 glasses 4 - M24B330 display with ten GV74 glasses 5 - twoGV74 display with two GV74 glasses 6 - 2M2466 display with two GV74 glasses in two rows 0 - Back to main menu PROTOCOL SELECTION ================== Select: 1 - Krone 2 - DisplayML 3 - DisplayML in Vilnius 0 - Back to main menu **NOTE** Not to be used when only one protocol is in use !!!! VALUES TABLE ============ Display type : 2M2466 IP-address : 10.2.0.139 Subnet mask : 255.255.255.248 Default gateway : 10.2.0.137 Protocol : paras 0 - Back to main menu NETWORK CONFIGURATION ===================== Choose: 1 - Change IP-address Current: 10.2.0.139 2 - Change Subnetmask Current: 255.255.255.248 3 - Change Default Gateway Current: 10.2.0.137 0 - Back to main menu VALUES TABLE ============ Display type : 2M2466 IP-address : 10.2.0.139 Subnet mask : 255.255.255.248 Default gateway : 10.2.0.137 Protocol : paras 0 - Back to main menu }}} {{{ [/proc/19]# ls -la fd dr-x------ 2 root root 0 Oct 14 02:59 . dr-xr-xr-x 3 root root 0 Oct 14 02:58 .. lrwx------ 1 root root 64 Oct 14 02:59 0 -> /dev/ttyS0 lrwx------ 1 root root 64 Oct 14 02:59 1 -> /dev/ttyS0 lrwx------ 1 root root 64 Oct 14 02:59 10 -> socket:[64] lr-x------ 1 root root 64 Oct 14 02:59 11 -> pipe:[65] l-wx------ 1 root root 64 Oct 14 02:59 12 -> pipe:[65] lrwx------ 1 root root 64 Oct 14 02:59 13 -> socket:[66] lr-x------ 1 root root 64 Oct 14 02:59 14 -> /etc/ip.addr lr-x------ 1 root root 64 Oct 14 02:59 15 -> /lib/ft2fonts/DefaultFont-11.bdf lr-x------ 1 root root 64 Oct 14 02:59 16 -> /usr/bin/versions.txt lr-x------ 1 root root 64 Oct 14 02:59 17 -> /proc/version lr-x------ 1 root root 64 Oct 14 02:59 18 -> /proc/version lr-x------ 1 root root 64 Oct 14 02:59 19 -> /proc/version lrwx------ 1 root root 64 Oct 14 02:59 2 -> /dev/ttyS0 lrwx------ 1 root root 64 Oct 14 02:59 20 -> /dev/watchdog lrwx------ 1 root root 64 Oct 14 02:59 3 -> /dev/ttyS0 lrwx------ 1 root root 64 Oct 14 02:59 4 -> /dev/tty0 lrwx------ 1 root root 64 Oct 14 02:59 5 -> /dev/fb0 lrwx------ 1 root root 64 Oct 14 02:59 6 -> /dev/null lrwx------ 1 root root 64 Oct 14 02:59 7 -> /dev/spilcd lrwx------ 1 root root 64 Oct 14 02:59 8 -> /dev/candrv0 lrwx------ 1 root root 64 Oct 14 02:59 9 -> /dev/candrv1 }}} === Display device? === Paras binary seems to be binding to /dev/fb0 This device could be "Frame buffer" -device, which is an abstraction of the display panel. It could be used to write raw bitmap data to the display. More info: https://www.kernel.org/doc/Documentation/fb/framebuffer.txt Result of dump with cat /dev/fb0 > fb0_dump.dat here: [[attachment:fb0_dump.dat]] === Links === * http://www.parasdisplay.com/ * http://www.parasdisplayboard.com/ * http://mitron.fi * http://displayml.org (defunct) <> = RasPi = {{{ eth0 Link encap:Ethernet HWaddr b8:27:eb:11:a8:b3 inet addr:10.2.0.140 Bcast:10.2.0.143 Mask:255.255.255.248 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:1259 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:96068 (93.8 KiB) TX bytes:0 (0.0 B) }}} description:: Reverse engineering old BudDisplay from the year 2000 and building something new with it started:: 2014-07-10 ---- CategoryProjekti