View Single Post
Posts: 1,298 | Thanked: 4,322 times | Joined on Oct 2014
#28
Originally Posted by ginggs View Post
I disassembled /usr/sbin/icd2 and found:

Code:
.text:000220C4                 CMP     R7, R9
.text:000220C8                 BGT     loc_22138
.text:000220CC                 CMP     R7, #300
.text:000220D0                 BGT     loc_22164
.text:000220D4                 CMP     R7, #200
.text:000220D8                 BEQ     loc_22164
.text:000220DC                 CMP     R7, #204
.text:000220E0                 BNE     loc_22144
.text:000220E4                 MOV     LR, #1
.text:000220E8                 STR     LR, [R10,#0xA4]
.text:000220EC                 LDR     R12, [R4,#0x40]
.text:000220F0                 CMP     R12, #0
.text:000220F4                 BEQ     loc_222C0
I had been thinking about the '200 OK' response code, so when I saw 300, 200 and 204 together, I looked up what 204 meant.


How will you detect a wifi hotspot landing page without a www host?
That! Is a good find.
Should be fixable by patching out those cmp instructions directly in the binary.

I think replacing

Code:
 CMP     R7, #204
BNE     loc_22144
With

Code:
MOV r0, r0  (0xe1a00000)
which is NOP should work, and no need for the service then.

Last edited by nieldk; 2015-12-27 at 07:56.
 

The Following 3 Users Say Thank You to nieldk For This Useful Post: