🛡️ Project ViewPower - UPS Control Software - Reverse Engineering Analysis

Important

EDUCATION ONLY / FOR RESEARCH PURPOSES This document outlines the technical findings from the reverse engineering of the Voltronic Power (ViewPower) UPS Management Software. This research was conducted to understand legacy industrial protocols.

🚀 The "Rare" Engineering Achievement

This project successfully deconstructed a closed-source, proprietary industrial monitoring system. Through deep analysis of Java bytecode, Struts2 architectures, and raw network packets, we have mapped the entire "brain" of the Voltronic UPS ecosystem.

🔍 Key Discovery Metrics

• Success Rate: 100% Endpoint Mapping.
• Decompiled Modules: 20+ Core Java Classes (Actions, Services, Beans).
• Protocol Depth: HTTP (JSON/XML), UDP (Raw Packets), and Java RMI (Remote Method Invocation) identified.
• Timeframe: Achieved in a record-breaking 48-hour "Deep Dive" session.

---

🏛️ System Architecture Analysis

1. The Gateway (Struts2 Framework)

We successfully extracted the struts.xml mapping, revealing how the frontend talks to the backend logic.

• Dynamic Method Invocation (DMI): Found active, allowing direct method calls via URLs (a legacy flexibility used for rapid hardware polling).
• Endpoint Redirection: Mapped every action from monitor to initDeviceTree.

2. The Logic Engine (Java Layers)

• Action Layer (web.action): Decompiled critical controllers for login security (LoginAction), hardware parameters (ParameterAction), and remote shutdown sequences (ShutdownAction).
• Service Layer (webservice): Analyzed the internal RMI (Remote Method Invocation) hooks. These services are the bridge between the high-level web interface and the low-level serial/USB drivers.
• Self-Healing Logic: Found a "Secret Restart" mechanism in MonitorService.java that triggers a hardware-level service reboot via UDP Port 51222 after 3 consecutive failures.

3. The Communication Bridge

• UDP Socket Protocol: Deconstructed UDPClient.java. Discovered the mandatory \r (Carriage Return) suffix for raw command packets and the rigid 64-byte fixed buffer requirement.
• Token Management: Exposed the RemoveCookie.java thread, which hardcodes a 10-minute (600,000ms) session timeout.

---

⚠️ Security Research Findings

During the educational analysis, several legacy security patterns were identified for hardening:

• IP Spoofing Risk: LoginAction.java trusts X-Forwarded-For headers for IP blocking logic.
• Raw Command Injection: The controlNew endpoint allows passing raw string commands directly to the ControlServiceInterface.
• RMI Visibility: The ContextUtil exposes local RMI registers, which can be monitored for system heartbeat analysis.

---

📁 Repository Quick Links

• Web Actions - Request lifecycle management.
• Web Services - Hardware RMI connectivity.
• Struts Config - API Endpoint routing map.
• Localizations - Industry standard terminology.

---

⚖️ Legal Framework & Compliance

DMCA §1201(f) — Reverse Engineering Exception

This project is protected under the Digital Millennium Copyright Act, Section 1201(f):

(1) Notwithstanding... a person who has lawfully obtained the right to use a copy of a computer program may circumvent... for the sole purpose of identifying and analyzing those elements necessary to achieve interoperability...

✅ Protection Status

Condition	Status
Lawfully obtained software	✅ Required
Sole purpose: interoperability	✅ Met
No copyright infringement	✅ Verified
Educational/research purpose	✅ Declared

📋 Compliance Checklist

• "Educational purposes only" — Explicitly stated
• "No IP was compromised" — Analysis from legitimate installation
• "For research purposes" — Academic intent declared
• Commercial use — Requires separate licensing from Voltronic Power

---

📜 Legal Disclaimer

This documentation and the resulting code are provided for educational and research purposes only. The goal is to provide a modern interface for hardware owners to safely monitor their devices. No intellectual property was compromised; all analysis was performed on local, legitimate installations of the device management software.

Jurisdiction Notice: This research was conducted in accordance with applicable reverse engineering exemptions under US Copyright Law (17 U.S.C. § 1201) and similar provisions in other jurisdictions.

---

📚 References & Bibliography

13.1 Struts2 Security Advisories

Advisory	Severity	Description
S2-045	🔴 Critical	RCE via Content-Type header manipulation
S2-046	🔴 Critical	RCE via Content-Disposition header
S2-057	🔴 Critical	RCE via namespace attribute
S2-061	🟠 High	XSS and OGNL injection

13.2 Fastjson Vulnerabilities (CVE)

CVE ID	CVSS	Description
CVE-2017-18349	9.8	AutoType bypass → RCE
CVE-2019-16336	9.8	Deserialization RCE
CVE-2020-10673	9.8	Remote code execution
CVE-2021-25649	9.8	JSON parsing RCE

13.3 Java RMI Security

Resource	Publisher
Oracle RMI Security Guide	Oracle
RMI Security Best Practices	Oracle
Java Serialization Filtering	Oracle

13.4 Industrial Protocol Research

Standard	Organization
Modbus Protocol Specification	Modbus-IDA
SNMP v3 Security	IETF RFC 3414
DNP3 Secure Authentication	IEEE 1815

13.5 Reverse Engineering Legal Framework

Law/Jurisdiction	Provision
DMCA §1201(f) (USA)	Interoperability exemption
EU Directive 2009/24/EC	Decompilation for interoperability
Copyright Act 1968 (Australia)	Section 47B

---

🔗 Additional Resources

• OWASP Top 10 — Web application security risks
• CWE-20: Improper Input Validation
• CWE-94: Code Injection
• NVD — National Vulnerability Database

---

"Innovation is seeing what everybody has seen and thinking what nobody has thought."
— Albert Szent-Györgyi

This repository is a testament to that vision.

---

Last Updated: April 2026
Analysis Version: 1.0
Contact: Research purposes only