# Sniff TLS communication between 4Stream app an player
To find undocumented commands an better understand the communication between the 4Stream app an the player, it is possible to log all commands. The player is using a separate program called ***stunnel*** to enable TLS communication. This tool is a TLS wrapper that is simply added to the existing http service / daemon.
The configuration for ***stunnel*** can be found in the ***tmp*** directory:
```
cat /tmp/st7374756E6E656C.conf
[web_https]
accept = 443
connect = 127.0.0.1:80
requireCert = yes
verify = 2
checkHost = www.linkplay.com
checkEmail = mail@linkplay.com
cert = /tmp/st7374756E6E656C.pem
CAfile = /tmp/st7374756E6E656C_ca.pem
```
In the default configuration the service is using ***st7374756E6E656C.pem*** as its own certificate with a private key that is stored in the same file. The service is also requesting a certificate from the client side that needs to be signed from the CA listed in ***st7374756E6E656C_ca.pem***.
I tried to decrypt a TLS session between the app and the player by importing the RSA keys from the server certificate, but TLS is negotiating the cipher that is used and by default a cipher with Diffie Hellman (DH) is choosen. Sessions negotiated with Diffie-Hellman don’t use the RSA key directly; instead each side generate a one-time key that stored only in RAM. The actual key is calculated from the own random key and the other half that is exchanged with the other side.
By modifiing the configuration file it is possible to select a cipher that is included in the 4stream app, but not using DH. In Wireshark you have to add the RSA key and then you are able to see the decrypted communication.
The answer to the requests can be seen in Wireshark by following the TLS stream, but it's also possible to try the discovered command directly with curl:
The ***PSK*** looks to be hex encoded, but I haven't figured out how to convert it to clear text.
## Socat
If Wireshark looks to be too complicated to you, you may add ***socat*** as an additional 'layer' between ***stunnel*** and the http daemon ***rootApp***. Socat is not available in the OpenWRT archive for v15.05 / Chaos Calmer, but in a newer version. In newer versions OpenWRT has switched the program interpreter from ***/lib/ld-uClibc.so.0**** to ***/lib/ld-musl-mipsel-sf.so.1***.
At first you have to get the program interpreter from somewhere. I have compiled binwalk with squashfs-tools and sasquatch on my Mac mini, but it may work with the following command (and binwalk from e.g. MacPorts).
# copy the socat binary from /usr/bin to e.g. /Library/WebServer/Documents/linkplay/a31/bin
```
The path to the program interpreter is /lib, but that directory is read only. So I have patched the socat binary with hex editor 0xED on my Mac. Just search for ***lib/ld-musl-mipsel-sf.so.1*** and modify the path to ***/tmp***. You may also look for a utility called ***patchelf*** to do the job.
With ***readelf*** you are able to see which interpreter is used by a binary program and verify the patch from above.
Then modify the configuration file for stunnel ***/tmp/st7374756E6E656C.conf *** as shown above, but use ```connect = 127.0.0.1:8800``` instead. Start ***socat*** as a daemon and restart ***stunnel***. All commands are shown in ***/tmp/socat.log***. They may be interleaved, so it's a bit complicated to find the answers for specific requests.
