diff --git a/source/exploit/dwc3.elf b/source/exploit/dwc3.elf index 0849b76..ddd1232 100755 Binary files a/source/exploit/dwc3.elf and b/source/exploit/dwc3.elf differ diff --git a/source/exploit/dwc3.o b/source/exploit/dwc3.o index 8d45875..83c6d7f 100644 Binary files a/source/exploit/dwc3.o and b/source/exploit/dwc3.o differ diff --git a/source/exploit/exploit.py b/source/exploit/exploit.py index e2ed6c1..e37507f 100644 --- a/source/exploit/exploit.py +++ b/source/exploit/exploit.py @@ -287,7 +287,8 @@ def usb_debug(): transferred.value = 0 buf = ctypes.c_buffer(b"", 0x200) res = libusb1.libusb_bulk_transfer(exynos.handle._USBDeviceHandle__handle, 0x81, buf, len(buf), ctypes.byref(transferred), 100) - hexdump(buf.raw[:0x20]) + assert res == 0, "Error receiving data" + hexdump(buf.raw) pass # Should have received some bytes diff --git a/source/exploit/symbols.txt b/source/exploit/symbols.txt index ce55876..7d1870a 100644 --- a/source/exploit/symbols.txt +++ b/source/exploit/symbols.txt @@ -1,5 +1,5 @@ maybe_usb_setup_read = 0x00006f88; dwc3_ep0_start_trans = 0x0000791c; usb_event_handler = 0x00007bac; -get_endpoint_buffer = 0x00007a7c; +get_endpoint_recv_buffer = 0x00007a7c; sleep = 0x000027c8; \ No newline at end of file diff --git a/source/exploit/test_dwc3.c b/source/exploit/test_dwc3.c index 6928230..9488bb4 100644 --- a/source/exploit/test_dwc3.c +++ b/source/exploit/test_dwc3.c @@ -4,7 +4,7 @@ extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer); extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len); extern int usb_event_handler(void); -extern void * get_endpoint_buffer(char endpoint); +extern uint32_t get_endpoint_recv_buffer(char endpoint); extern void sleep(int endpoint,uint32_t timeout); extern void usb_send(uint32_t address,uint32_t size); extern void rom_send(); @@ -17,7 +17,7 @@ void recv_data_cb(uint32_t endpoint, uint32_t len){ void *dest_buf = (void *)recv_buffer; volatile void *dref = (void *)data_received; - rbuf = get_endpoint_buffer(endpoint); + rbuf = get_endpoint_recv_buffer(endpoint); for(int i= 0; i < len; i++){ *(char *)dest_buf = *(char *)(void *)((int)rbuf + i); } @@ -32,8 +32,8 @@ void recv_data(){ *(uint8_t *)dref = 0; maybe_usb_setup_read(2, recv_data_cb, 0x200); - void *rbuf = get_endpoint_buffer(2); - dwc3_ep0_start_trans(2, (uint32_t)rbuf, 0x200); + uint32_t rbuf = get_endpoint_recv_buffer(2); + dwc3_ep0_start_trans(2, rbuf, 0x200); while(1){ usb_event_handler(); if(*(uint8_t *)dref == 1){ @@ -57,9 +57,10 @@ void send_data_cb(uint32_t endpoint, uint32_t len){ void send_data(void *address, uint32_t size){ volatile void *dref = (void *)data_received; *(uint8_t *)dref = 0; + uint32_t val = 0x0; maybe_usb_setup_read(0x1, send_data_cb, 0x200); - void *rbuf = get_endpoint_buffer(1); - dwc3_ep0_start_trans(1, (uint32_t)rbuf, 0x200); + uint32_t rbuf = get_endpoint_recv_buffer(1); + dwc3_ep0_start_trans(1, (uint32_t)0x0, 0x200); while(1){ usb_event_handler(); if(*(uint8_t *)dref == 1){ @@ -71,7 +72,7 @@ void send_data(void *address, uint32_t size){ int main() { - + uint32_t count = 0; while(1){ recv_data(); // rom_send(); @@ -84,4 +85,4 @@ int main() { // sleep(1, 5000); asm("mov x0, #0x0"); asm("br x0"); -} +} \ No newline at end of file