PDA

View Full Version : i-option keygen


Custom Search


itjobs
11-15-2008, 08:14 AM
hi,

im looking for the i-option keygenerator plz

Deas
11-24-2008, 08:14 AM
Are you sure there even exist one? Dosn't I-option need server-auth before use?

oxident
01-20-2013, 03:26 PM
It should be possible to write some kind of keygen. I mean, since it is possible to enter the license code on the display (without having internet access), it's "simply" some kind of calculation...
Anyone took a look into the printer's firmware already?

emujo
01-21-2013, 01:57 PM
You need to have access to the KM License Management Server...The I-option token (white card stock in envelope) and a request code from the MFP are used together to generate the activation code. I belive you will need a KM tech or dealer to accomplish this, but if the Token offers a website to go to, give it a try. All I-options also require the additional memory chip, activating the option w/o the additional memory will induce an error code. Emujo

oxident
01-21-2013, 02:21 PM
Ahh, okay. Thanks for explaining. The process of getting the request code and entering the response was already clear to me. But somehow I thought, someone already managed to reverse engineer the calculation routine.
But when you say, those options also require additional hardware than the entire process is quite useless ;-)

jotunn
01-21-2013, 06:08 PM
@oxident
Hardware for iOption is quite cheap in comparison to iOption prices - it's just SODIMM memory module.

oxident
01-21-2013, 06:42 PM
Ahh, so it's only a matter of memory (and of the right activation code, of course)?
This leads me again to the conclusion that those machines must be running some kind of well known OS. I mean, the webbrowser is webkit based and as far as I know, this engine is purely for linux/unix and Windows...
Maybe we could gain root access to take a closer look ;-)

jotunn
01-21-2013, 08:29 PM
@oxident
> Ahh, so it's only a matter of memory (and of the right activation code, of course)?
Yes.

> This leads me again to the conclusion that those machines must be running some kind of well known OS. I mean, the webbrowser is webkit based and as far as I know, this engine is purely for linux/unix and Windows...
Not so easy, OS for iOption compatible machines is VxWorks (C203-C652, BH223-BH652), but... new machines (C224-) got Linux onboard :) So there is a chance, but no time for fun in a week or two :/

> Maybe we could gain root access to take a closer look ;-)

Not so easy again - VxWorks has no root, everything works in kernel space (that's good) - accessing target console gives you administrative privileges, so you can move around all options compiled into kernel for example debugging, spawning new tasks, listing devices and accessing them and so on. But... this is completely different philosophy of OS than Linux...

EarthKmTech
01-21-2013, 09:50 PM
If someone does create a key generator that works I'd be more than happy to get a copy of it :cool:

I work for the company, and only want them for self educational purposes and the answer is a big fat NO.

I'm guessing the fact that the token code comes in a sealed envelope and costs a shitload of money means not one of them has ever gotten into the wrong hands before to calculate exactly whats required to make an activation code.

Also, the license management server keeps track of all the token keys and will not allow another activation code generation from that key, until a deactivation code is supplied from the machine it was installed on previously.

oxident
01-21-2013, 10:56 PM
Yeah, we can forget about VxWorks. I'm done with Windriver ;-)

But the main point is not to copy any official license token or even try to reverse the calculation based on what's inside this envelope. It's rather a way of understand how the printer checks if the entered code is correct. This might be accomplished if one gets access to the executable on the machine which is responsible of this validation.

Of course, this would be illegal in almost any country I know but there would be huge security problem if soneone might be able to modify "things" on those Linux based copiers. That's my main motivation and why I'm trying to see if there's an easy way to get root/ssh access.

jotunn
01-22-2013, 04:34 PM
Lookin' for something like this?

U-Boot 2009.08-svn (10ćśˆ 13 2011 - 10:08:06)

CPU: 8536, Version: 1.2, (0x80370092)
Core: E500, Version: 3.0, (0x80210030)
Clock Configuration:
CPU0:798 MHz,
CCB:399 MHz,
DDR:199.500 MHz (399 MT/s data rate) (Synchronous), LBC:49.875 MHz
L1: D-cache 32 kB enabled
I-cache 32 kB enabled
I2C: ready
SPI: ready
DRAM: Initializing.... DDR: 2 GB (DDR2, 64-bit, CL=3, ECC off)
DDR Chip-Select Interleaving Mode: CS0+CS1
L2: 512 KB enabled
*** Warning - bad CRC, using default environment

EEPROM:
PCIE1 connected to Slot1 as Root Complex (base address ffe0a000)
Scanning PCI bus 11
11 00 196c 000a 0880 ff
PCIE1 on bus 10 - 11

PCIE2 connected to Slot 2 as Root Complex (base address ffe09000)
@ PCIe link wait ... 50[ms]
PCIE2 on bus 20 - 20

PCIE3 connected to Slot3 as Root Complex (base address ffe0b000)
@ PCIe link wait ... 51[ms]
PCIE3 on bus 30 - 30


PCI: 32 bit, 66 MHz, sync, host, arbiter (base address ffe08000)
Scanning PCI bus 00
00 15 196c 0016 0880 00
PCIE1 on bus 00 - 00

Video: No radeon video card found!
In: serial
Out: serial
Err: serial
SATA0 (1.5 Gbps)

SATA1 (1.5 Gbps)

USB: Register 10011 NbrPorts 1
USB EHCI 1.00
scanning bus for devices... 2 USB Device(s) found
scanning bus for storage devices... 0 Storage Device(s) found
Net: eTSEC1
<<<<< 3.75GB BootROM >>>>>
[ura] check_autoboot g_action[0]
[ura] km_readWarpBootSettingInfo:[1]
[ura] km_readWarpBootSettingInfo:ƒƒ‚ƒŠƒTƒCƒY now[2147483648] save[2147483648]
[ura] tmp_pci_info size[108]
[ura] main_loop(autoboot):[4]
[main_loop] warp_drvload()ƒR[ƒ‹
[main_loop] warp_boot()ƒR[ƒ‹

Lineo Warp!! 3.0.0 (MFP_bizhub 1.1.0) Wed Apr 27 16:55:56 JST 2011

ATA0 479MB UDMA mode 6 LBA48
--- Read Snapshot ---
[...]
pixcir_i2c_suspend
sd 1:0:0:0: [kmsdb] Synchronizing SCSI cache
sd 0:0:0:0: [kmsda] Synchronizing SCSI cache
dram save 54190 pages
maxarea 0x02f0d000(0x16109000) lowmem_maxarea 0x02f0d000(0x16109000)
zonetbl 2 exttbl 0 dramtbl 1273
Warp!! boot time 2106(msec)
PORPLLSR core freq 798MHz
sata_fsl_suspend selective suspend warning!!
sata_fsl_suspend selective suspend warning!!
sd 0:0:0:0: [kmsda] Starting disk
sd 0:0:0:0: [kmsda] 983040 512-byte hardware sectors (503 MB)
sd 0:0:0:0: [kmsda] Write Protect is off
sd 0:0:0:0: [kmsda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
sd 1:0:0:0: [kmsdb] Starting disk
sd 1:0:0:0: [kmsdb] 625142448 512-byte hardware sectors (320073 MB)
sd 1:0:0:0: [kmsdb] Write Protect is off
sd 1:0:0:0: [kmsdb] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
cap1166_resume. 1.
pixcir_i2c_resume
Restarting tasks ... done.
Warp!! resume time 636(msec)
err[0] stat[1]
Warp!!‹N“®‚ľ‚Á‚˝B
[getSnapShot] 8 close(fd)
[getSnapShot] 9
pixcir_init_device
[4294916232] IntegrityCommand Chek start.
checkIntegrityCommand = mpc8536-linux-u4e "12345678"
[4294916252] IntegrityCommand Chek end.
Start load_Module()
uc_BootType = boottyp=0
Execute insmod for USB.
km_usb_power_change_interrupt()---------------------------------------- level:[32]
PMU_interrupt_USB() irq[32] level:[4]
km_usb_device_suspend()
km_usb: controller 'fsl-usb2-udc' not recognized
Process1 initOSWrapper return: 0
[InitBufferMemory] ul_DimmAllSize: 0x00000800 (MB)
[InitBufferMemory] <Extra> size: 330c7000 vaddr: 0x37420000 paddr: 4cdbc000
[InitBufferMemory] <Straight> size: 00542000 vaddr: 0x6A4E7000 paddr: 0202b000
[InitBufferMemory] <Heap> size: 07e78000 vaddr: 0x6AA29008 paddr: 00000000
MemPartCfgTableSize(): 48 e_memoryPartitionConfig:0
[InitBufferMemory] <Shm> size: 007be000 vaddr: 0x728A2000 paddr: 00000000
MIOArea1 00000001 00000000 2 10485760
MIOArea2 00000002 00000000 2 3145728
WSDArea 00000003 00000000 2 2097152
ArrayTableSize 00000001 6a4e7018 1 1048576
HDDBufferArea 00000002 6a5e7418 1 4459008
THUMBNAIL1 00000003 00000000 0 245760
THUMBNAIL2 00000004 00000000 0 245760
DocListTbl 00000005 00000000 2 1150000
ImageFormatterBuffer 00000006 00000000 0 82837504
PrinterArea 00000007 00000000 0 164294656
PREVIEW 00000008 00000000 0 1966080
BufImage 00000009 46228418 0 85509120
EPNetWorkArea 0000000a 6ab42050 2 1253376
LOGING 0000000b 6ac74450 2 102400
EncPdfBox 0000000c 00000000 2 524288
PCM 0000000d 00000000 2 12582912
AuthVeinDevice 0000000e 00000000 2 1024000
AuthModule 0000000f 00000000 2 557056
AuthIccDevice 00000010 00000000 2 512000
ClickInfoBuffer 00000011 00000000 2 10485760
AccountMap 00000012 00000000 2 3612896
BMLinkS 00000013 00000000 2 2097152
OpenAPIArea 00000014 00000000 2 15192064
PanelLang 00000015 00000000 2 4456448
Font3 00000016 6dd3e130 2 36643840
PDFLIB_LOCAL 00000017 00000000 2 4194304
FaxTxRxBandBuffer11 00000018 00000000 0 245760
FaxTxRxBandBuffer12 00000019 00000000 0 245760
FaxTxRxBandBuffer21 0000001a 00000000 0 245760
FaxTxRxBandBuffer22 0000001b 00000000 0 245760
BootupScreen 0000001c 70430d30 2 1310720
FileMemoryPool 0000001d 4b4a5c18 0 516947968
FaxTtiRegionPageCtrl1 0000001e 6a1a6018 0 233472
FaxTtiRegionPageCtrl2 0000001f 6a1df418 0 233472
IPCShmArea 00000020 00000000 3 262144
DataSpooler 00000021 00000000 3 7852032
netsDataBuf 00000022 6a218818 0 1049600
JLGEntryList 00000023 70571130 2 5448704
USBDirectPrint 00000024 00000000 0 524288
PkiDecode 00000025 00000000 0 1363149
PSPManager 00000026 00000000 2 512000
MovieArea 00000027 00000000 2 26214400
ExtJobSettingArea 00000028 72421130 2 2726298
PanelPngBuf 00000029 00000000 2 1980008
[LIBF_InitLogArea] TempArea Size 1048576 byte
[LIBF_InitLogArea] CurrentRec Size 2802 byte
[LIBF_InitLogArea] WriteCnt Size 2802 byte
[LIBF_InitLogArea] LogLibAccess Size 240000 byte
[LIBF_InitLogArea] WkbSystemLog Size 144384 byte
[LIBF_InitLogArea] NonPacketMode Size 30500190 byte
[LIBF_InitLogArea] ExcPacketMode Size 1410024 byte
[LIBF_InitLogArea] CreatOK
Nic fum module link started...
[LIBF_AttachMemory] CreatOK
fsck 1st /dev/kmsda8 0 [ OK ]
FILC_FsControlColor::initClass SSD512MB /ram0
DocIns Create
ˇ IGLC_ImageLogControll::initClass. ImageLog Setting None.
ˇTHRC_ThreadJob::newInstance
ˇTHRC_ThreadJob::registerInstance
initClass() : SemaphoreID=[-291195999]
initClass() : msg_Q_ID = [0x2dabc2b8]
add exceptionHandler
ALSA lib pcm_hw.c:1399:(_snd_pcm_hw_open) Invalid value for card
snd_pcm_open : Error ( No such file or directory )
PCM has not been opened ( (nil) )
[AWS-DOUGA] Allocation was success. puc_imgBuffer(70b20d30) : requested size : 200x125000=25000000
/sdir/BootUpScreen.bin ‚Ş‚ ‚č‚Ü‚ą‚ń
[Panel]BootUpScreen“ÇŤž‚ÝŠ®—ą’Ę’m status=0 gazou=0x0(0x0)
[Panel]BootUpScreen‰ć‘ś‚Ş‚Č‚˘‚©A“ÇŤž‚ÝŽ¸”s
ˇ[Power]PS process during flag set.First[1]ˇ
ˇ[Power]Sub power switch ON boot.ˇ
echo on > /sys/bus/usb/devices/usb1/power/level
echo on > /sys/bus/usb/devices/1-1/power/level
echo on > /sys/bus/usb/devices/usb2/power/level
echo on > /sys/bus/usb/devices/2-1/power/level
echo on > "/sys/bus/platform/devices/PMU.0/devices/IR_SERIES_UART"
echo on > "/sys/bus/platform/devices/PMU.0/devices/ENG_UART"
SIOCSIFNETMASK: Cannot assign requested address
connect: Invalid argument
SIOCSIFNETMASK: Cannot assign requested address
connect: Invalid argument
btusb driver(major 235) installed
# SPS_RSHA_PATH ='/boot'.
THRF_getLinuxVer() uc_BootMode = 1
THRF_getLinuxVer() LinuxVer = Linux-2.6.26.8-rt16
THRF_getKernelChecksum() uc_BootMode = 1
THRF_getKernelChecksum() checksum_h = 133e737
THRF_getKernelChecksum() checksum_d = 727aa819
@@ Linux Version = Linux-2.6.26.8-rt16 Checksum = 0xe737
@@ Kernel Version = A2XK0Y0-1C00-G00-09 Checksum = 0xa819
IrcIf LogClear 3200
Imp LogClear 6000
CP_HDDTrans::connection()ul_HDDBufStartAdr=0x6a627 600
HDD LockPassword=False
open test04 csrc_gfd = ffffffff


and so on...

oxident
01-22-2013, 07:32 PM
Well, what can I say now?! That wasn't such a big surprise :cool:
You can guess my next question, can't you?

EarthKmTech
01-22-2013, 09:49 PM
how the F did you get that ?

jotunn
01-23-2013, 05:37 PM
how the F did you get that ?

That's easy - just many things don't work as KM described to us, but talking about such things in public is a stupid idea.

oxident
01-23-2013, 06:06 PM
Agree!

emujo
01-23-2013, 08:09 PM
You two sound like the guys trying to hack the old Toshiba enablers (Print/Scan)...You do realize that your about 10 steps above the average tech including me??? We lost you around the 3rd post. Emujo

oxident
01-23-2013, 08:34 PM
No, I don't think so. At the moment, we are only talking about the operating system on which some KM machines are running on. As far as I can tell for now is that when it's Linux, many of us may have the ability to change "something under the hood". Linux isn't that kind of magic it was ten years ago :rolleyes:

jotunn
01-23-2013, 09:43 PM
emujo, thanks, it was funny :)

But I wouldn't tell that it's 10 steps above, rather beside/alongside to beeing a "mainstream" technician. I'm not a typical field service - I was IT (computer/network equipment service, server administrator, programmer) which was adopted to work with digital copiers, to help (and train) in network installations. Now I'm working stationary fixing "hard cases" - machines that cannot be repaired in the field or "factory dead" machines and as a technical support for customers and field service technicians.
So a copier from my point of view is an ordinary computer with ability to scan, copy, print and sometimes fax a document ;)

Hacking/cracking is just a hobby, and a way to show that everything is possible:
- "I got customer willing to buy 751, but I got only 601, can you do something?"
- "I will tell you tomorrow"
[next day]
- "And what? Did you find something?"
- "Yeah, now you've got 751"

EarthKmTech
01-25-2013, 06:16 AM
That's easy - just many things don't work as KM described to us, but talking about such things in public is a stupid idea.

SysLogAll, not hard.

jotunn
01-25-2013, 06:40 AM
As I said, that's easy :)
And do you know that there are two ways to get output - software (with DipSW), and hardware?

oxident
02-06-2013, 06:22 AM
Strange. If I'll extract the C754 firmware, I'll get a vxWorks kernel instead of Linux :(
Maybe KM have turned away from Linux on the new devices.

Custom Search