From 0a7ffe9399d7b2d0bd090a41c6121ab0e573a3fa Mon Sep 17 00:00:00 2001
From: Eljakim Herrewijnen <eljakim.herrewijnen@gmail.com>
Date: Fri, 2 Aug 2024 21:11:18 +0200
Subject: [PATCH] send with custom address works

---
 source/exploit/dwc3.elf    | Bin 7912 -> 7912 bytes
 source/exploit/dwc3.o      | Bin 1840 -> 1848 bytes
 source/exploit/exploit.py  |   3 ++-
 source/exploit/symbols.txt |   2 +-
 source/exploit/test_dwc3.c |  17 +++++++++--------
 5 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/source/exploit/dwc3.elf b/source/exploit/dwc3.elf
index 0849b7603aaea59265b031e0e651e110d64767e2..ddd1232814a19e61f8e9840899c459426efe3b26 100755
GIT binary patch
delta 218
zcmaE1`@(j^771RC8i&a*nT55uL>(+NCm)muW7L`~Az8qqz|auH<j@fGkXc@9^At$|
zCQ%^<MurCxOiT<wkN_fpz<=^ZX>rEH$qS{$C98mZkeV%$5H%uT6$}jZlNn{iB|CsT
z0fvwNWh$Y<P-^aEL!j((uq-2k2-JL-nhlc^Wnv~@l#vljPc4a0%}XiB&&(@{FG@`=
fi%%*|OPl;kX6NJ;vNITMCp*fuGajAnDJKsA6ACeE

delta 220
zcmaE1`@(j^775-L%)(lnH4c-tL>(+RCLfdtV_Y>^Lb8D8Av41&1%`$oCWnTg%~K==
zm?mG57GaE>yii))FqwgYL4e`o|25S>1`;R*vV|BJ8Ma6=F@c0dpmJ4{8D+#Jn}Ix#
zE}2TGFqE1x*$^nZ2rSFUAR+<L3sbXta-vL(aC&M<d}>}wL4IalNqkaiT3Tw+<UKO7
dlRwF9n>c}W@(S4*j24p}<=Pn!O!kzM2LL37GsOS^

diff --git a/source/exploit/dwc3.o b/source/exploit/dwc3.o
index 8d45875fa7678f7891b7bce5f5cdb26a5338c913..83c6d7fc9070bc685266d51a39f87d69c81b3111 100644
GIT binary patch
delta 189
zcmdnMw}Wqj24lrUO><t38i&a*nT55uL>(+NC+3DRX*o=`WK^H{#)C(Jp&^LLp&{rY
zv%J=32SyG?$$AC`1{Q{o|A7<=I5|0yNu2o{1H<HxY@(AVFc~n0PCm#a&X_fMB9PoV
z`6H9KWH(TU5CaojpAVF^f3hO8IOB}XmdqO%S&CAV%O<~IIl%&yTsnCpt32c7$roAg
QGe%9`$Y#&D7HGUZ03v)Z+W-In

delta 207
zcmdnNw}Eeh24lfQO>^EC%)(lnH4c-tL>(+RCgz55u5w^#2x4+*2%7A`s4(%32hT%h
zhE)nsvCR&Q9E_4x3=9k`3?KgkDHL#Iaw3!X<OC+R$#qOli~*AmGKn*$PM!!PH%$J>
zBre$oR4v571lQvOW$l`*$Slq{d9x++2FA(nSdOzU07@`VHe?c>e1VmN@!aH_toK<%
XfntmhF*XgB6+qtPi)<p31=uwJ(ho76

diff --git a/source/exploit/exploit.py b/source/exploit/exploit.py
index e2ed6c1..e37507f 100644
--- a/source/exploit/exploit.py
+++ b/source/exploit/exploit.py
@@ -287,7 +287,8 @@ def usb_debug():
         transferred.value = 0
         buf = ctypes.c_buffer(b"", 0x200)
         res = libusb1.libusb_bulk_transfer(exynos.handle._USBDeviceHandle__handle, 0x81, buf, len(buf), ctypes.byref(transferred), 100)        
-        hexdump(buf.raw[:0x20])
+        assert res == 0, "Error receiving data"
+        hexdump(buf.raw)
         pass
     
     # Should have received some bytes
diff --git a/source/exploit/symbols.txt b/source/exploit/symbols.txt
index ce55876..7d1870a 100644
--- a/source/exploit/symbols.txt
+++ b/source/exploit/symbols.txt
@@ -1,5 +1,5 @@
 maybe_usb_setup_read = 0x00006f88;
 dwc3_ep0_start_trans = 0x0000791c;
 usb_event_handler = 0x00007bac;
-get_endpoint_buffer = 0x00007a7c;
+get_endpoint_recv_buffer = 0x00007a7c;
 sleep = 0x000027c8;
\ No newline at end of file
diff --git a/source/exploit/test_dwc3.c b/source/exploit/test_dwc3.c
index 6928230..9488bb4 100644
--- a/source/exploit/test_dwc3.c
+++ b/source/exploit/test_dwc3.c
@@ -4,7 +4,7 @@
 extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer);
 extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len);
 extern int usb_event_handler(void);
-extern void * get_endpoint_buffer(char endpoint);
+extern uint32_t get_endpoint_recv_buffer(char endpoint);
 extern void sleep(int endpoint,uint32_t timeout);
 extern void usb_send(uint32_t address,uint32_t size);
 extern void rom_send();
@@ -17,7 +17,7 @@ void recv_data_cb(uint32_t endpoint, uint32_t len){
     void *dest_buf = (void *)recv_buffer;
     volatile void *dref = (void *)data_received;
     
-    rbuf = get_endpoint_buffer(endpoint);
+    rbuf = get_endpoint_recv_buffer(endpoint);
     for(int i= 0; i < len; i++){
         *(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
     }
@@ -32,8 +32,8 @@ void recv_data(){
     *(uint8_t *)dref = 0;
 
     maybe_usb_setup_read(2, recv_data_cb, 0x200);
-    void *rbuf = get_endpoint_buffer(2);
-    dwc3_ep0_start_trans(2, (uint32_t)rbuf, 0x200);
+    uint32_t rbuf = get_endpoint_recv_buffer(2);
+    dwc3_ep0_start_trans(2, rbuf, 0x200);
     while(1){
         usb_event_handler();
         if(*(uint8_t *)dref == 1){
@@ -57,9 +57,10 @@ void send_data_cb(uint32_t endpoint, uint32_t len){
 void send_data(void *address, uint32_t size){
     volatile void *dref = (void *)data_received;
     *(uint8_t *)dref = 0;
+    uint32_t val = 0x0;
     maybe_usb_setup_read(0x1, send_data_cb, 0x200);
-    void *rbuf = get_endpoint_buffer(1);
-    dwc3_ep0_start_trans(1, (uint32_t)rbuf, 0x200);
+    uint32_t rbuf = get_endpoint_recv_buffer(1);
+    dwc3_ep0_start_trans(1, (uint32_t)0x0, 0x200);
     while(1){
         usb_event_handler();
         if(*(uint8_t *)dref == 1){
@@ -71,7 +72,7 @@ void send_data(void *address, uint32_t size){
 
 int main() {
     
-    
+    uint32_t count = 0;
     while(1){
         recv_data();
         // rom_send();
@@ -84,4 +85,4 @@ int main() {
     // sleep(1, 5000);
     asm("mov x0, #0x0");
     asm("br x0");
-}
+}
\ No newline at end of file