EljakimHerrewijnen/Samsung_S7
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

send with custom address works

Browse Source
This commit is contained in:
Eljakim Herrewijnen 2024-08-02 21:11:18 +02:00
parent d40e818b33
commit 0a7ffe9399
5 changed files with 12 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
source/exploit/dwc3.elf
View File

Binary file not shown.

BIN
source/exploit/dwc3.o
View File

Binary file not shown.

3
source/exploit/exploit.py
View File

@ -287,7 +287,8 @@ def usb_debug():
transferred.value = 0
buf = ctypes.c_buffer(b"", 0x200)
res = libusb1.libusb_bulk_transfer(exynos.handle._USBDeviceHandle__handle, 0x81, buf, len(buf), ctypes.byref(transferred), 100)
hexdump(buf.raw[:0x20])
assert res == 0, "Error receiving data"
hexdump(buf.raw)
pass
# Should have received some bytes

2
source/exploit/symbols.txt
View File

@ -1,5 +1,5 @@
maybe_usb_setup_read = 0x00006f88;
dwc3_ep0_start_trans = 0x0000791c;
usb_event_handler = 0x00007bac;
get_endpoint_buffer = 0x00007a7c;
get_endpoint_recv_buffer = 0x00007a7c;
sleep = 0x000027c8;

17
source/exploit/test_dwc3.c
View File

@ -4,7 +4,7 @@
extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer);
extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len);
extern int usb_event_handler(void);
extern void * get_endpoint_buffer(char endpoint);
extern uint32_t get_endpoint_recv_buffer(char endpoint);
extern void sleep(int endpoint,uint32_t timeout);
extern void usb_send(uint32_t address,uint32_t size);
extern void rom_send();
@ -17,7 +17,7 @@ void recv_data_cb(uint32_t endpoint, uint32_t len){
void *dest_buf = (void *)recv_buffer;
volatile void *dref = (void *)data_received;
rbuf = get_endpoint_buffer(endpoint);
rbuf = get_endpoint_recv_buffer(endpoint);
for(int i= 0; i < len; i++){
*(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
}
@ -32,8 +32,8 @@ void recv_data(){
*(uint8_t *)dref = 0;
maybe_usb_setup_read(2, recv_data_cb, 0x200);
void *rbuf = get_endpoint_buffer(2);
dwc3_ep0_start_trans(2, (uint32_t)rbuf, 0x200);
uint32_t rbuf = get_endpoint_recv_buffer(2);
dwc3_ep0_start_trans(2, rbuf, 0x200);
while(1){
usb_event_handler();
if(*(uint8_t *)dref == 1){
@ -57,9 +57,10 @@ void send_data_cb(uint32_t endpoint, uint32_t len){
void send_data(void *address, uint32_t size){
volatile void *dref = (void *)data_received;
*(uint8_t *)dref = 0;
uint32_t val = 0x0;
maybe_usb_setup_read(0x1, send_data_cb, 0x200);
void *rbuf = get_endpoint_buffer(1);
dwc3_ep0_start_trans(1, (uint32_t)rbuf, 0x200);
uint32_t rbuf = get_endpoint_recv_buffer(1);
dwc3_ep0_start_trans(1, (uint32_t)0x0, 0x200);
while(1){
usb_event_handler();
if(*(uint8_t *)dref == 1){
@ -71,7 +72,7 @@ void send_data(void *address, uint32_t size){
int main() {
uint32_t count = 0;
while(1){
recv_data();
// rom_send();
@ -84,4 +85,4 @@ int main() {
// sleep(1, 5000);
asm("mov x0, #0x0");
asm("br x0");
}
}