New Release: eyefi-config-013

[Dave Hansen]

This adds support for outputting the card upload key and information
about the direct mode SSID/password.

Thanks to Makesh for the tips on where to find these commands!

https://github.com/hansendc/eyefi-config/tree/eyefi-config-013

[曹世军]

WoW，Good Job!

$ ./eyefi-config --direct-mode-info

located EyeFi card at: '/media/test/AA52-6922'

Direct mode SSID:  'Eye-Fi Card 43aXXX'

Direct mode password:  '7NJXXXXXX'

$ ./eyefi-config -u

located EyeFi card at: '/media/caojun/AA52-6922'

card upload key (len: 32): 'XXXXXXXXXXXXXXXXXXXXXXXXXXXX'

Dave Hansen,Thanks very much!

在 2017年10月9日星期一 UTC+8上午7:23:14，Dave Hansen写道：

[Feng Liu]

I tried my card, which firmware is 5.0.  Card upload key is empty. Is there any way to fix this?

card upload key (len: 0): ''

在 2017年10月9日星期一 UTC+8上午7:23:14，Dave Hansen写道：

This adds support for outputting the card upload key and information

[Maxim A Piskunov]

Hi guys!

One of member has wrote to me today about the same issue with Eye-Fi and I have to say something to all of you.

My original upload key was lost from PC and some time eyefi-config does not help me.

But after few years I have news.

Part 1 – the upload key

[newbie notice] EyeFi-Config will does not see your card until card is not mount! (Please check that your card is inserted and mounted)

If EyeFi card is detected, just check that it's really working for us:

./eyefi-config -m

located EyeFi card at: '/mnt/eyefi'

card mac address: 00:18:56:50:e3:62

[OK]

Checking log's of Wi-Fi router:

19:23:30 wireless,info 00:18:56:50:E3:62@wl1.ffamax: connected, signal strength -66 

19:23:36 dhcp,info eth3 assigned 10.0.142.237 to 00:18:56:50:E3:62 

00:18:56:50:e3:62 - Yes, it's really the same — we on the right way, exactly!

And here I show you, that only one Wi-Fi network is configured:

./eyefi-config -c

located EyeFi card at: '/mnt/eyefi'

configured wireless networks:

'FFAMax'

Also, card firmware (len: 27): '5.2010 Aug 27 2013 18:12:44' (just for history of my case)

And magic moment (may work or may not work for you):

 ./eyefi-config -u

located EyeFi card at: '/mnt/eyefi'

card upload key (len: 32): '98f54547b5d7255acdebca4390fa1aab'

Yay! It's the same!

    <Card MacAddress="00-18-56-50-e3-62">

      <UploadKey>98f54547b5d7255acdebca4390fa1aab</UploadKey>

In some cases in Settings.xml may be old key or empty string. Now it work for me, but before - no.

If `./eyefi-config -u` does not show upload key, try to use Eye-Fi X2 Utility.

I have old red card of first generation (4Gb) but X2 Utility working well for me (Version 1.1.1.0).

When I trying to install X2 Utility at first time to my PC, X2 Utility wants to see Wi-Fi network card (My PC has only Ethernet card and X2 Utility was not work for me until I have not plug in USB Wi-Fi dongle).

If X2 Utility see wireless adapter, X2 Utility will able to configure card.

As I understand, exactly at this moment, X2 Utility doing something like `./eyefi-config -u` to obtain the key. But if at different firmware version command for obtaining upload key is another, try to use X2 Utility as last chance to obtain the upload key.

If you have no linux, you may just take X2 Utility and install to your laptop, configure it and look to Settings.xml.

My full path is: `C:\Users\FFAMax\AppData\Roaming\Eye-FiX2\Settings.xml`

Part 2 - working at L3 network level without server

After card was paired to X2 Utility card is somehow remembered IP-address of PC with X2 Utility. (I think what possible to store public IP (domain?) of PC with X2 Utility and it will work well "from the box" without server)

At my case I show you that one card may work with X2 Utility not only at the same broadcast domain (L2) but even working on routed network (L3 of OSI model).

My network is:

Time to take some photo and look to wireshark:

POST /api/soap/eyefilm/v1 HTTP/1.1

Host: api.eye.fi

User-Agent: Eye-Fi Card/5.2010

Accept: text/xml, application/soap

Connection: Keep-Alive

SOAPAction: "urn:StartSession"

Content-Length: 409

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="EyeFi/SOAP/EyeFilm"><SOAP-ENV:Body><ns1:StartSession><macaddress>00185650e362</macaddress><cnonce>00150275b0914f539d213e4d2c5ec606</cnonce><transfermode>34</transfermode><transfermodetimestamp>1484336928</transfermodetimestamp></ns1:StartSession></SOAP-ENV:Body></SOAP-ENV:Envelope>HTTP/1.1 200 OK

Server: Eye-Fi Agent/ (Microsoft Windows NT 6.1.7601 Service Pack 1, 32-bit)

Connection: Keep-Alive

Keep-Alive: timeout=500, max=10

Date: Fri, 07 Dec 2018 16:23:38 GMT

Content-Type: text/xml; charset="utf-8"

Content-Length: 475

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><StartSessionResponse xmlns="EyeFi/SOAP/EyeFilmService"><credential>50f7947a141028a923fdfb7ee37af579</credential><snonce>38a604ecdf13447515caed3ad9bc0d29</snonce><transfermode>34</transfermode><transfermodetimestamp>1544199818</transfermodetimestamp><upsyncallowed>true</upsyncallowed></StartSessionResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /api/soap/eyefilm/v1 HTTP/1.1

Host: api.eye.fi

User-Agent: Eye-Fi Card/5.2010

Accept: text/xml, application/soap

Connection: Keep-Alive

SOAPAction: "urn:GetPhotoStatus"

Content-Length: 476

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="EyeFi/SOAP/EyeFilm"><SOAP-ENV:Body><ns1:GetPhotoStatus><credential>4aa1b29bb24aa14a44d9302b7df3da50</credential><macaddress>00185650e362</macaddress><filename>DSCF1620.JPG.tar</filename><filesize>587776</filesize><filesignature>e06be86ef60026956b3b074e2968ae41</filesignature><flags>4</flags></ns1:GetPhotoStatus></SOAP-ENV:Body></SOAP-ENV:Envelope>HTTP/1.1 200 OK

Server: Eye-Fi Agent/ (Microsoft Windows NT 6.1.7601 Service Pack 1, 32-bit)

Connection: Keep-Alive

Keep-Alive: timeout=500, max=10

Date: Fri, 07 Dec 2018 16:23:39 GMT

Content-Type: text/xml; charset="utf-8"

Content-Length: 300

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><GetPhotoStatusResponse xmlns="EyeFi/SOAP/EyeFilmService"><fileid>0</fileid><offset>0</offset><mode>0</mode></GetPhotoStatusResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /api/soap/eyefilm/v1/upload HTTP/1.1

Host: api.eye.fi

User-Agent: Eye-Fi Card/5.2010

Accept: text/xml, application/soap

Connection: Keep-Alive

Content-Type: multipart/form-data; boundary=---------------------------02468ace13579bdfcafebabef00d

Content-Length: 588738

-----------------------------02468ace13579bdfcafebabef00d

Content-Disposition: form-data; name="SOAPENVELOPE"

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="EyeFi/SOAP/EyeFilm"><SOAP-ENV:Body><ns1:UploadPhoto><fileid>0</fileid><macaddress>00185650e362</macaddress><filename>DSCF1620.JPG.tar</filename><filesize>587776</filesize><filesignature>35310000d057030000000000e8cf0200</filesignature><encryption>none</encryption><flags>4</flags></ns1:UploadPhoto></SOAP-ENV:Body></SOAP-ENV:Envelope>

-----------------------------02468ace13579bdfcafebabef00d

Content-Disposition: form-data; name="FILENAME"; filename="DSCF1620.JPG.tar"

Content-Type: application/x-tar

DSCF1620.JPG......

<truncated>

79bdfcafebabef00d--

HTTP/1.1 200 OK

Server: Eye-Fi Agent/ (Microsoft Windows NT 6.1.7601 Service Pack 1, 32-bit)

Connection: Close

Date: Fri, 07 Dec 2018 16:23:40 GMT

Content-Type: text/xml; charset="utf-8"

Content-Length: 264

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><UploadPhotoResponse xmlns="EyeFi/SOAP/EyeFilmService"><success>1</success></UploadPhotoResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /api/soap/eyefilm/v1 HTTP/1.1

Host: api.eye.fi

User-Agent: Eye-Fi Card/5.2010

Accept: text/xml, application/soap

Connection: Close

SOAPAction: "urn:MarkLastPhotoInRoll"

Content-Length: 312

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="EyeFi/SOAP/EyeFilm"><SOAP-ENV:Body><ns1:MarkLastPhotoInRoll><macaddress>00185650e362</macaddress><mergedelta>0</mergedelta></ns1:MarkLastPhotoInRoll></SOAP-ENV:Body></SOAP-ENV:Envelope>

Host: api.eye.fi  — Here the hostname is hardcoded I think.

Some investigations

What EyeFi doing when powered on?

10.0.142.237 10.0.142.1 DNS 70 Standard query 0x0000 A api.eye.fi

10.0.142.1 10.0.142.237 DNS 70 Standard query response 0x0000 No such name A api.eye.fi

10.0.142.237 199.192.198.7 TCP 62 47106 → 80 [SYN] Seq=0 Win=16384 Len=0 MSS=1408 SACK_PERM=1

199.192.198.7  -- It's hardcoded server IP i think...

199.192.198.7 10.0.142.237 ICMP 90 Destination unreachable (Port unreachable)

After that EyeFi doing something unbelievable - scanning? Hahaha :)

13 4.407177 Eyefi_50:e3:62 Broadcast ARP 42 Who has 10.0.142.238? Tell 10.0.142.237

14 4.425421 Eyefi_50:e3:62 Broadcast ARP 42 Who has 10.0.142.236? Tell 10.0.142.237

15 4.444989 Eyefi_50:e3:62 Broadcast ARP 42 Who has 10.0.142.239? Tell 10.0.142.237

and so on...

29 4.719147 Eyefi_50:e3:62 Broadcast ARP 42 Who has 10.0.142.254? Tell 10.0.142.237

30 4.963950 Eyefi_50:e3:62 Broadcast ARP 42 Who has 10.0.14.254? Tell 10.0.142.237

10.0.14.254  - Huh? Was remembered before? (it's not the same network, it's not 10.0.142.0/24, it's 10.0.14.0/24)

49 4.981181 10.0.142.237 10.0.14.254 TCP 62 44677 → 59278 [SYN] Seq=0 Win=16384 Len=0 MSS=1408 SACK_PERM=1

50 4.981711 10.0.14.254 10.0.142.237 TCP 62 59278 → 44677 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1260 SACK_PERM=1

51 4.989842 10.0.142.237 10.0.14.254 TCP 200 44677 → 59278 [ACK] Seq=1 Ack=1 Win=16384 Len=146 [TCP segment of a reassembled PDU]

52 4.991485 10.0.142.237 10.0.14.254 HTTP 518 POST /api/soap/eyefilm/v1 HTTP/1.1 

What will happens if I create static A record for api.eye.fi and point it to 10.0.14.254?

Let's try!

Continue from the resolve point:

9 4.048392 10.0.142.237 10.0.142.1 DNS 70 Standard query 0x0000 A api.eye.fi

10 4.050127 10.0.142.1 10.0.142.237 DNS 86 Standard query response 0x0000 A api.eye.fi A 10.0.14.254

11 4.051573 10.0.142.237 10.0.14.254 TCP 62 47913 → 80 [SYN] Seq=0 Win=16384 Len=0 MSS=1408 SACK_PERM=1

12 4.053024 10.0.14.254 10.0.142.237 TCP 60 80 → 47913 [RST, ACK] Seq=1 Ack=1 Win=0 Len=0

Ooops, port 80 is closed, just replace name - it's not enough.

Ooookay! Port forwarding!

C:\Windows\system32>netsh interface portproxy add v4tov4 listenport=80 listenaddress=10.0.14.254 connectport=59278 connectaddress=10.0.14.254

Continue from the resolve point:  

8 3.550266 10.0.142.1 10.0.142.237 DNS 86 Standard query response 0x0000 A api.eye.fi A 10.0.14.254

9 3.551521 10.0.142.237 10.0.14.254 TCP 62 50394 → 80 [SYN] Seq=0 Win=16384 Len=0 MSS=1408 SACK_PERM=1

10 3.552306 10.0.14.254 10.0.142.237 TCP 62 80 → 50394 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1260 SACK_PERM=1

Aha!

POST /api/soap/eyefilm/v1 HTTP/1.1

Host: api.eye.fi

User-Agent: Eye-Fi Card/5.2010

Accept: text/xml, application/soap

Connection: Keep-Alive

SOAPAction: "urn:StartSession"

Content-Length: 409

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="EyeFi/SOAP/EyeFilm"><SOAP-ENV:Body><ns1:StartSession><macaddress>00185650e362</macaddress><cnonce>5740fe01be6ad451e2fc0c56e3a2487c</cnonce><transfermode>34</transfermode><transfermodetimestamp>1484336928</transfermodetimestamp></ns1:StartSession></SOAP-ENV:Body></SOAP-ENV:Envelope>HTTP/1.1 200 OK

Server: Eye-Fi Agent/ (Microsoft Windows NT 6.1.7601 Service Pack 1, 32-bit)

Connection: Keep-Alive

Keep-Alive: timeout=500, max=10

Date: Fri, 07 Dec 2018 18:20:26 GMT

Content-Type: text/xml; charset="utf-8"

Content-Length: 475

<?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><StartSessionResponse xmlns="EyeFi/SOAP/EyeFilmService"><credential>e6b96b3429ef1db607abb882cb44d6f7</credential><snonce>f4f3e424be7040e665935fadadff3a8d</snonce><transfermode>34</transfermode><transfermodetimestamp>1544206826</transfermodetimestamp><upsyncallowed>true</upsyncallowed></StartSessionResponse></SOAP-ENV:Body></SOAP-ENV:Envelope>

But nothing more :'(

29 4.186108 10.0.142.237 10.0.14.254 TCP 54 50394 → 80 [FIN, ACK] Seq=611 Ack=729 Win=16384 Len=0

31 4.187504 10.0.14.254 10.0.142.237 TCP 60 80 → 50394 [FIN, ACK] Seq=729 Ack=612 Win=65520 Len=0

And rollback to port 59278 (why?):

38 4.495656 10.0.142.237 10.0.14.254 TCP 62 8666 → 59278 [SYN] Seq=0 Win=16384 Len=0 MSS=1408 SACK_PERM=1

Is anybody have own server with public IP?

Please add my card and key, let's check does it will work with DNS spoofing or not.