I am trying to go further into the magicjack stuff, and did not know if anyone else had some info that may help me complete my knowledge.
First the hardware, as many know its a Tigerjet 560c.[1] This is actually a pretty slick bit of hardware, and reading this explained a little bit why there was a USB HID entry.
As for the software, it appears to be made of parts from various different vendors. SJPhone[2] is one that particularly interests me. If you look at Profiles.db and CfgCache.dat you will see the "magic number" SJEN possible SJEN-zw (I do not know if its only the first 4 characters or not). This differs from their (linux at least) Profile magic number for the softphone which is SJCF, implying that its stored in a slightly different format. any documentation on this file would be helpful, and would make it easier for those wanting to get their sip credentials without the somewhat time consuming task of dumping the memory and sifting through it (which is based on a race condition because shortly after reading the file, it will parse it and purge that memory).
This file cannot be encrypted in any serious way, since you can freely copy it from the dongle onto a computer and never again have the dongle plugged in, yet it can still authenticate (see elsewhere for instructions on this process). This means that it either uses the same key for all of them and its intended only as an obfuscation method, or its a compression method. Without knowing the header size it becomes difficult to know what method of compression was used, or if it is encryption how serious that is (it could be a simple XOR against a 1 byte key, or more like a stream cipher where its a longer key and some other bit of info).
The code is there, for someone adventurous enough to go through the magicjack binary and see how its reading that file (hint look for where it reads the file, and if you have ida or something comparable look for it passing the variable that contains the name of the file as a starting point). If you figure out how it reads that file then you can write a similar tool that will just dump its contents. If someone gives me the documentation on the process I would be happy to write such a tool and give it away free, but I do not have the time right now to map out the binary to see what its doing. I believe that this data is transmitted (I havent verified though) from the provisioning server, using fiddler2 I was able to monitor the HTTPS process of signing up, and did notice that it does get something "binary" after you register.
Speaking of registration, there is a "dbkey" variable that is passed to the server, this contains at least your serial number, but also other information. Again as this is generated by the magicjack binary, I am certain that it can be derived by looking at what the program is doing, again IDA would be a good tool for that. To help assist in this regard I have written a "serial number spoofer" and plan on seeing if only part of the key changes with different serial numbers or if the whole thing appears to change more radically (basically seeing if its a spliced together string or if its a hash of some type on a longer block of data). I do know that the key appears to change even though it was the same device in a short time window.
On to serial numbers, I know that they are issued sequentially, when you buy a case of them (as I have) the serial numbers are listed on the outside of the case in a way that makes me think they are not active until they are shipped to a reseller. A valid regexp provided by magicjack for serials is ^(?:[AD]9[0-9A-F]{12}|C92103[0-9A-F]{8})$ (its in their javascript during the signup stages).
Ultimately my goal is to write a tool that will either probe the device for its serial number (libusb comes to mind as its cross platform) or take a hand entered one and do some automated registration and then output the SIP credentials. After recently doing a case of them I do not relish the next batch which I am told will be coming in the near future (part of a promotional thing we are doing). For the people with just 1 or 2 of them, this could still be handy, since it would more easily provide them with the information without requiring them to dump memory, potentially fail the race condition (which under vista you tend to fail more frequently after doing 20-30 of them until you reboot).
For people thinking they can just steal other peoples credentials with this, you cant, at most you could get their phone number (but you wouldnt know their name, location, email or anything else). Try it yourself, delete your profiles.db and cfgcache.dat files and then try to use the device, it will say its already registered and you must log in with your email and password, and it has to be the one that was entered at registration time since the serial number is transmitted as the "dbkey" data during this process. So no you wont be stealing service with this information, and I am not suggesting that anyone attempt to try to abuse this information to do that.
So if anyone can fill in the information that I am lacking I would greatly appreciate it, as I am sure so would others that would benefit from the sharing.
Thanks,
[1] http://www.tjnet.com/chips/tiger560C.htm
[2] http://www.sjlabs.com
Going further with MJ
Moderators: Bill Smith, Pilot