JF SIP Overview
#70
Replies: 2 comments 2 replies
-
|
Also, take a look at #15. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
MicroSIP compiled exclusively for JF/AF on Windows |
Beta Was this translation helpful? Give feedback.
2 replies
-
|
Does microsip require juice proxy on JF CPE or does it do everything on it's own? |
Beta Was this translation helpful? Give feedback.
-
|
Yes its need to have JUICE running on JF/AF to run |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
JF SIP Breakdown
Disclaimer: - This is Only for educational purposes, No one is responsible for any type of damage.
This is what I know so far about the SIP framework used in JF router and JJoin app to make calls.
The Story
Back in 2020, before I came to know about the JF firmware, the first thing I did was to sniff the network packets sent from the JioCall app to the router while registering and calling through the app for the first time. But when I turned on the sniffing app, JioCall was not detecting the router because the sniffing app was using VPN method and thus the local network was not accessible through it.
So I turned on my laptop, installed JioCall on an Android Emulator, turned on Wireshark, and then opened JioCall. Everything was working perfectly. But the requests which the app made to the router was encrypted by self-signed certificate, so I couldn't actually sniff the packets. But I got something useful : The ports which the SIP Server listens on, which are 8080, 8443 and 7443.
Next thing I did was to decompile the JioCall apk via jadx and I found a lot of interesting things. Looking into the code of JioCall app (which was obfuscated of course), I found that it was using Retrofit for the network requests which means that there must be an interface somewhere which contains all the HTTP links with their request methods and if POST request, then their POST data structures. So, I went through the code and found some interesting links. One of them was :
/request_account. I opened up my browser and openedhttp://192.168.29.1:8080/request_accountand voila, this is what I got as response (actually this is the current response, previously the response was a bit different but the contents were almost the same) :-{"imsi": "00000XXXXXXXXXX","msisdn": "XXXXXXXXXX","mcc": "405","mnc": "874","mode": "JFV","mac_address": "aa:bb:cc:dd:ee:ff","JTCAutoWhitelist": "true","SelfHelpONTLogs": "true","CentralizedCallBlocking": "true","CentralizedCallWaiting": "true"}Indeed, the
msisdnkey contained my JF landline number. I also tried the other URL paths but none of them worked, perhaps those need an API key to work. Atleast I know that I am heading to the right path.After an year, in October 2021, I found this repository where I found JF Firmware. I downloaded the firmware quickly and started to explore its contents. I read the lua codes and came to know how the WEB-UI works and stuff. I discovered the way to get dbglogs from JF and within November, I discovered the way to decrypt the router settings backup file using the Router keys.
Then I started looking for the VoIP server code (which is called the Juice Server) in the firmware which led me to
/pfrm2.0/etc/voipInitwhich further led me topfrm2.0/bin/hgw-voice-appwhich was, of course, a binary, that cannot be decompiled easily. So, I started dumping the strings present in the binary and I found a reference tolibims.solibrary which was present in/pfrm2.0/lib/. Dumping the strings in thelibims.sogave me exactly what I needed.Juice Server
The Juice server in JF is responsible for handling all the SIP communications. JJoin app uses its API to make calls using the JF VoIP Landline number.
Uses Ports : 8080, 7443, 8443, 5068 (maybe more)
Useful Links :
http://192.168.29.1:8080/pcap?start=1will start recording all packets sent from/to the Juice Server until stopped.http://192.168.29.1:8080/pcap?stop=1will stop recording packets.http://192.168.29.1:8080/logswill let you download the captured packets in a pcap file along with the complete Juice Log dump (VERY USEFUL).http://192.168.29.1:8080/request_accountwill give you a JSON consisting of your JF Landline Number, MCC, MNC, etc etc.http://192.168.29.1:8080/request_macwill give you a JSON with your router's MAC address in it.There are many more, but the first three are the most important links.
How JJoin Works
First, after opening JJoin for the first time, it will search for the host
jiofiber.local.htmlwith a DNS Query. If found, JJoin will assume that you are on a JF network. (This is why using custom DNS providers stops JJoin from working, to tackle this, you can definejiofiber.local.htmlwith your router's static IP in yourhostsfile)After you click on the "Generate OTP" button, your phone sends an API request to the Juice Server in the router. The request is kinda like this :-
The most important paramters here are
mac_address,nwk_intfandop_type. Others can be ignored to get the same response from the request.Let me explain the request and what it does.
The
mac_addressparameter contains a random mac address (it is not a real mac address of any device in your network, it is a random mac generated like as a session key which persists with the current JJoin installation. It might be the real mac address in case of Jio STB).The
nwk_intfparameter represents the Network Interface used for the request, it can either bewifi(almost everytime) oreth(in case of requests from Jio STB).The
op_typeparameter perhaps represents "option type". It can beaddorremove(maybe more which idk).The
mac_addressandop_typeare essential parameters in this request.So, whenever this request is sent to the Juice Server, the Server first checks the
op_typeparameter. If it isaddthen the server has to add the device (from where the request was initiated) to SIP whitelist (devices in this list are the only devices which are permitted to send or receive SIP requests/responses). The server differentiates between clients (I mean different JJoin apps on different devices) using themac_addressparameter which is unique for each JJoin app installation. The Juice server checks if themac_addressis already present in the whitelisted devices list. If it is present it replies with a XML data which contains all the SIP configs which is explained later. For now let us assume that our device was not previously whitelisted. An OTP is sent to your JF linked mobile number. The Juice server then responds with a200 OKstatus code but without any response data. But the server provides with some important response headers which areand
The Cookie called
WITRCSeConfigCookiewill be needed when we want to verify the OTP with the Juice Server next while thex-amnheader signifies the JF linked mobile number to which the OTP was sent.JJoin tells you that an OTP was sent to your registered mobile number
+91********XXwhich is derived from thex-amnheader from the previous step. You type the OTP and submit it. Now the request is sent to the Juice Server looks like this (assume the OTP is 696969):with a required header :
which we have received from the
Set-Cookieheader from the server response in step 2.As soon as the OTP is verified, the Juice Server whitelists the
mac_addressassociated with the request with the cookie and replies with an XML body. This XML is the SIP configuration required to make calls using JJoin. Now, as themac_addressis verified, you can use it to get the XML configuration anytime using step 2. The response in step 2 will now be the XML data without any further authentication.The XML Configuration looks like this :
We need mainly these parameters :
Under
characteristicof typeapplication.appauth:authtype- Digest Authenticationrealm- SIP Server Realm (for Jio, you cannot connect directly to it, so you need to have the Juice Server as Proxy),username- SIP Username for authentication,userpwd- SIP Password for authenticationUnder
characteristicof typeapplication.lbo_p-cscf_address:address- Refers to the SIP Proxy URL which is basically the port 5068 of JFUnder
characteristicof typeapplication.other:uuid_valuerepresents the value ofmac_addressparameter, if yourmac_addressparameter wasaa:bb:cc:dd:ee:ffthen the last section of the uuid will beAABBCCDDEEFF. The first sections are same for every device under every router as far as I know.How SIP (in JJoin and JF) Works
You can see the pcap yourself if you use the previously provided important links in the Juice Server section.
REGISTER Request
The REGISTER request sent by the SIP client (here, JJoin app) looks like this:
This is the general format of every request sent to the SIP server. This request is sent via the proxy, i.e., Juice Server (look for the parameters in the XML file mentioned previously).
Things that makes Jio's SIP protocol different from others are:
The Contact Header - The contact header must have the
+sip.instanceparameter with proper value format otherwise you will get 401 Unauthorized response from the server. The proper format of this parameter is+sip.instance="<00000000-0000-1000-8000-AABBCCDDEEFF>"where you have to put the value of uuid got from the XML previously.Let me be clear, other SIP Server/Clients have their
+sip.instanceparameter format as+sip.instance="<urn:uuid:ABCABCAB-AABB-CCDD-EEFF-AABBCCAABBCCC>"- Note the stringurn:uuid:is present which Jio's Juice Server does not support. (This is why using a third party SIP client like MicroSIP to call through JF isn't gonna work).The P-Access-Network-Info Header - Use it on every request.
So, the first time you send the REGISTER request to the SIP server via the Juice Server as proxy, you will get a 401 Unauthorized response because you haven't provided your credentials yet. The server response is important. Let me show you how it looks like :
The headers
WWW-Authenticatecontains the Digest nonce which will be used to verify your identity using your credentials. Refer to Wikipedia for more information about digest authentication.According to Wikipedia, we need to prepare a response based on the nonce and our credentials.
The format is:
where
usernamerefers to your SIP username found in the XML, here,[email protected]realmrefers to your SIP realm, here,wb.wln.ims.jio.compasswordrefers to your SIP password, here<randompassword>methodrefers to the request method, here,REGISTERdigestURIrefers to (idk what) but it is"sip:" + realm, here,sip:wb.wln.ims.jio.comMD5(x)refers to the MD5 hash ofx.After preparing our response, we need to send another REGISTER request with a fulfilled
Authorizationheader like this:Now we get a 200 OK from the server:
Thus the REGISTER request is successful.
To call someone, you need to send an INVITE request with SDP data like this:
The Juice server responds with 100 Trying which means the call is being connected.
When the recipient picks up the call, we get a 183 Session Progress from the Juice server along with some SDP data. It does place a call to the number but of course with no audio.
Also you need to send ACK and PRACK requests frequently to keep the call alive. You can read any SIP documentations available on the internet for more info.
Edit (27-01-2025)
https://github.com/JFC-Group/JFC-SIP-Configuration-Tool/blob/main/jfc_configure.py can be used to generate a SIP client configuration for MicroSIP. You can supply
-nas an argument to generate the configuration without OTP.Basically, as I previously mentioned above:
If you supply
eth, you no longer need any OTP and you can start making calls through your JF/AF without authorisation. This privilege can be exploited if someone is under a public JF/AF Wi-Fi ( No, I definitely DO NOT recommend you to do this! This is just for educational purposes ONLY ) and can be used to make calls through the Fixed Voice number associated with JF/AF connection without proper authorisation.BTW, we have managed to compile MicroSIP exclusively for JF/AF on Windows. You can use it to make calls (voice, video, conference) through JF/AF from Windows PC.
Check here: https://github.com/JFC-Group/JFC-microsip/releases/
Beta Was this translation helpful? Give feedback.
All reactions