!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/usr/share/doc/sane-backends-1.0.18/teco/   drwxr-xr-x
Free 50.94 GB of 127.8 GB (39.86%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     teco3.txt (4.5 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
          BACKEND TECO3


This scanner capabilities are in the middle of the 3520 and 3575,
sharing features of both. Hence a third backend.


PIOTECH 3024 (TECO Scorpio/Taurus Infinity VM3552):
   000: 06 00 02 02 43 00 00 10 20 20 20 20 20 20 20 20    ....C...        
   016: 46 6c 61 74 2d 62 65 64 20 73 63 61 6e 6e 65 72    Flat-bed scanner
   032: 35 2e 30 38 35 2e 30 38 03 02 54 45 43 4f 20 56    5.085.08..TECO V
   048: 4d 33 35 35 32 20 00 01 01 2c 00 01 04 b0 09 f6    M3552 ...,......
   064: 10 68 01 2c 00 00 00 01                            .h.,....

RELISYS INFINiTY SCORPIO:
   000: 06 00 02 02 43 00 00 10 52 45 4c 49 53 59 53 20    ....C...RELISYS
   016: 53 63 6f 72 70 69 6f 20 20 20 20 20 20 20 20 20    Scorpio
   032: 31 2e 30 34 31 2e 30 34 03 02 54 45 43 4f 20 56    1.041.04..TECO V
   048: 4d 33 35 35 32 20 00 01 01 2c 00 01 04 b0 09 f6    M3552 ...,......
   064: 10 68 01 2c 00 00 00 00                            .h.,....

Trust Imagery 2400SP:
   000: 06 00 02 02 43 00 00 10 41 61 73 68 69 6d 61 20    ....C...Aashima
   016: 49 4d 41 47 45 52 59 20 32 34 30 30 53 50 20 20    IMAGERY 2400SP
   032: 31 2e 30 30 31 2e 30 30 03 02 54 45 43 4f 20 56    1.001.00..TECO V
   048: 4d 33 35 35 32 20 00 01 01 2c 00 01 04 b0 09 f6    M3552 ...,......
   064: 10 68 01 2c 00 00 00 01                            .h.,....

Trust Imagery 4800 SP +:
   000: 06 00 02 02 43 00 00 10 41 61 73 68 69 6d 61 20    ....C...Aashima
   016: 49 4d 41 47 45 52 59 20 34 38 30 30 53 50 20 2b    IMAGERY 4800SP +
   032: 35 2e 30 38 35 2e 30 38 03 02 54 45 43 4f 20 56    5.085.08..TECO V
   048: 4d 33 35 35 32 20 00 01 01 2c 00 01 04 b0 09 f6    M3552 ...,......
   064: 10 68 01 2c 00 00 00 00                            .h.,....

/*--------------------------------------------------------------------------*/

SCSI commands supported by the RELISYS VM3530+:

TEST UNIT READY
00 00 00 00 00 00

REQ SENSE  
03 00 00 00 12 00

VENDOR-09
09 00 00 78 00 00
  3-4 = length of data to receive. Always 30720 bytes. 
        Probably 12 lines of calibration at 300dpi. 
        8.5*300*12=30600

VENDOR-0E (?)
0E 00 00 00 00 00
  Always follows VENDOR-09 command

INQUIRY:
12 00 00 00 35 00
  standard inquiry
    52 bytes - appears to never change
    32-39: firmware version
    42-52: real scanner name

SCAN
1B 00 00 00 00 00

SET WINDOW
24 00 00 00 00 00 00 00 45 00 (3552)

Total length is 99
  07 = length (99-8 = 91)
  10-11 = X Resolution
  12-13 = Y resolution
  14-17 = X top left corner
  18-21 = Y top left corner
  22-25 = width  (size in inches * 300)
  26-29 = length (size in inches * 300)
  31 = 0x80 ?
  33 = scan mode
        0x00 = black & white
        0x02 = grayscale
		0x05 = color
  34 = bit depth? - invariants, always 8
  36 = dither pattern - only for B&W
     0x00 = line art
	 0x01 = 2 X 2
	 0x02 = 3 X 3
	 0x03 = 4 X 4 Bayer
	 0x04 = 4 X 4 Smooth
	 0x05 = 8 X 8 Bayer
	 0x06 = 8 X 8 Smooth
	 0x07 = 8 X 8 Horizontal
	 0x08 = 8 X 8 Vertical
  37 = 
     0x80 = RIF ?
  48 = color channel to use
     if scan mode is 0 or 2:
       0x00 = red
       0x01 = green
       0x02 = blue
     if scan mode is 05 -> ignored
       TWAIN leaves 0x02
  50: calibration
      00 = yes
      02 = no
  53, 57, 61, 65: 0xff

  
READ
28 00 00 00 00 00 00 00 3E 00
  6-8 = length

SEND
2A 00 03 00 00 02 00 04 00 00
  2 = data type code
       0x03 = gamma - 4*256 bytes

OBJECT POSITION
31 00 00 00 00 00 00 00 00 00
Park the CCD.

GET DATA BUFFER STATUS
34 01 00 00 00 00 00 00 12 00
  1 = bit 1 is wait
  7-8 allocation length

  returned buffer is 0x10 bytes long.
    0-2 = additional length (0x10-3 = 0x0D)
      3 = reserved(?)
    6-8 = scanner memory (with no RAM, it is 32KB on the VM3552)
   9-11 = filled data buffer
  12-13 = number of lines (constant during a scan)
  14-15 = bytes per line (constant during a scan)  
     16 = ?
     17 = in color mode, 0x07 seems to means to the colors are shifted
          and given by rasters. 0x00 seems to mean that there is no
          color shifting and that each pixel is coded by 3 consecutive
          bytes.

/*--------------------------------------------------------------------------*/

Command sequence
(simplified, since the TWAIN driver seems to be quite stupid)

Get some info:
  INQUIRY

Setup the scan:
  TUR
  SET WINDOWS
  GET BUFFER STATUS
  VENDOR-09
  VENDOR-0E
  SEND(10)
  SET WINDOWS (same as the first one)
  SCAN

loop until all data read:
  GET BUFFER STATUS
  READ(10) if any data available

park the CCD:
  OBJECT POSITION

/*--------------------------------------------------------------------------*/


:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ Read-Only ]

:: Make Dir ::
 
[ Read-Only ]
:: Make File ::
 
[ Read-Only ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0489 ]--