From 19d20965db291191a749fb2670b288adae35381c Mon Sep 17 00:00:00 2001
From: Jonathan Herrewijnen <jonathan.herrewijnen@gmail.com>
Date: Mon, 12 Aug 2024 16:57:40 +0200
Subject: [PATCH] updated docs

---
 source/dwc3_test/Makefile        |   9 +++++----
 source/dwc3_test/dwc3.elf        | Bin 7920 -> 7920 bytes
 source/dwc3_test/dwc3.o          | Bin 1832 -> 1832 bytes
 source/exploit/debugger/Makefile |  17 +++++++++++++++++
 source/exploit/modify_bin.py     |   8 ++++++++
 source/exploit/stage1/Makefile   |   1 +
 6 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 source/exploit/debugger/Makefile
 create mode 100644 source/exploit/modify_bin.py

diff --git a/source/dwc3_test/Makefile b/source/dwc3_test/Makefile
index 28d2fe1..07a1bb1 100644
--- a/source/dwc3_test/Makefile
+++ b/source/dwc3_test/Makefile
@@ -8,10 +8,11 @@ OBJCOPY := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64
 LD := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-ld.bfd
 
 #==================Target Samsung S7 (8890)==================
-CFLAGS_SAMSUNGS7 = -Os
+CFLAGS_SAMSUNGS7 = -Os # -Os for optimization for size
 
 dwc3:
-	$(CC) entry.S -c -o entry.o $(CFLAGS_SAMSUNGS7)
-	$(CC) $(CFLAGS_SAMSUNGS7) -c test_dwc3.c -o dwc3.o
-	$(LD) -T test_dwc3.ld entry.o dwc3.o -o dwc3.elf --just-symbols=symbols.txt
+	$(CC) entry.S -c -o entry.o $(CFLAGS_SAMSUNGS7) # -c compiles assembly code, and -o creates an object file (containing linking and symbol information)
+	$(CC) $(CFLAGS_SAMSUNGS7) -c test_dwc3.c -o dwc3.o # compiles test_dwc3.c to dwc3.o
+	$(LD) -T test_dwc3.ld entry.o dwc3.o -o dwc3.elf --just-symbols=symbols.txt # -T for linker script, --just-symbols for symbols file
 	$(OBJCOPY) -O binary dwc3.elf dwc3.bin
+	
\ No newline at end of file
diff --git a/source/dwc3_test/dwc3.elf b/source/dwc3_test/dwc3.elf
index 153138950c1b18fc7f5c7a8d230c93173583a341..ff987b842a1e8384bf666e38987fe7412b3ea1b3 100755
GIT binary patch
delta 143
zcmexh`@wd@O-X%o14Bzo3uA?(#NyNxh5S5)B4aaCGh@SKV@-wRoW#6zg|gJ5;!L1~
zrJjMF<z#j#E4xIaM8i~b1LI_a)RZIx<D^6*OG^`zR8u3%<m99@6H{|@6C-nD^CV3L
j4Y;vBK4HF4BkHA8CNGhi!nkF#rSx?s#;ubD<?aIjWfm*R

delta 142
zcmexh`@wd@O-VgdO9KM~Q%i-U#NyNxh5S5)B4aaCGh@SKO@-u~#JqHcvecsDOrW@>
zo`IglWDY4SJ0k=06!XNSWWz+G#H2Li)HI6}6JrBIb7Qj<vqbaMq+}x_lSCs+15E`D
ixT!uqVZKl!8l+SvFP56hxOuas^mQi2Et3W1?gIc)_AA@~

diff --git a/source/dwc3_test/dwc3.o b/source/dwc3_test/dwc3.o
index bf81e162b085c496f6395244856eb2043e0ae558..b8d7780281d0ee33518032a7b2304589dd29e417 100644
GIT binary patch
delta 143
zcmZ3%w}Nj&8>7CtfuW_Pg|R|XVsUDULVlh?k+GSnnXzHAv8F<DPGVlVLRo52aVAj0
zQqMroa`F~NE2l)GM8i~b1LI_a)RZIx<D^6*OG^`zR8u3%<m99@6H{|@6C-nD^CV3L
j4Y;vBK4HEPBZ|xNG&dVEg|jejo7~A}&S*6GAX_>B&HgE@

delta 131
zcmZ3%w}Nj&8>6JDrGbHgsii_vVsUDULVlh?k+GSnnXzH=<OPf(j24r(GFmwq8JMS-
zCnhBuCK@Fsr5UHDS)`a48yK1!o28f~nx`fu8yT4-8d(}>Drmrs@$m`sRj|}E(6cBm
c%hQ}($f~e8fXRY|aqHwxHgiV9$p_ie0k;7q!T<mO

diff --git a/source/exploit/debugger/Makefile b/source/exploit/debugger/Makefile
new file mode 100644
index 0000000..3ddaa87
--- /dev/null
+++ b/source/exploit/debugger/Makefile
@@ -0,0 +1,17 @@
+ifeq ($(ANDROID_NDK_ROOT),)
+$(error Error : Set the env variable 'ANDROID_NDK_ROOT' with the path of the Android NDK (version 20))
+endif
+
+CC := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android27-clang
+AR := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-ar
+OBJCOPY := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-objcopy
+LD := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-ld.bfd
+
+#==================Target Samsung S7 (8890)==================
+CFLAGS_SAMSUNGS7 = -Os
+
+stage1:
+	$(CC) entry.S -c -o entry.o $(CFLAGS_SAMSUNGS7)
+	$(CC) $(CFLAGS_SAMSUNGS7) -c stage1.c -o stage1.o
+	$(LD) -T linkscript.ld entry.o stage1.o -o stage1.elf --just-symbols=symbols.txt
+	$(OBJCOPY) -O binary stage1.elf stage1.bin
diff --git a/source/exploit/modify_bin.py b/source/exploit/modify_bin.py
new file mode 100644
index 0000000..b7195f5
--- /dev/null
+++ b/source/exploit/modify_bin.py
@@ -0,0 +1,8 @@
+# Open a binary file and modify it
+bl1 = open('../S7/bl1.bin', 'rb').read()
+
+# Modify the binary file at 1C10
+bl1 = bl1[:0x1C1C] + b'\x48' + bl1[0x1C1D:]
+
+# Write the modified binary file
+open('../S7/bl1_mod.bin', 'wb').write(bl1)
\ No newline at end of file
diff --git a/source/exploit/stage1/Makefile b/source/exploit/stage1/Makefile
index 3ddaa87..6c1349d 100644
--- a/source/exploit/stage1/Makefile
+++ b/source/exploit/stage1/Makefile
@@ -15,3 +15,4 @@ stage1:
 	$(CC) $(CFLAGS_SAMSUNGS7) -c stage1.c -o stage1.o
 	$(LD) -T linkscript.ld entry.o stage1.o -o stage1.elf --just-symbols=symbols.txt
 	$(OBJCOPY) -O binary stage1.elf stage1.bin
+	
\ No newline at end of file