Unable to get firmware loader to return to debugger (yet)

This commit is contained in:
Jonathan Herrewijnen 2024-08-22 19:50:46 +02:00
parent 416521c8c7
commit 4ab063cc71
6 changed files with 308 additions and 277 deletions

Binary file not shown.

View File

@ -2,7 +2,7 @@
"cells": [ "cells": [
{ {
"cell_type": "code", "cell_type": "code",
"execution_count": 2, "execution_count": 263,
"metadata": {}, "metadata": {},
"outputs": [], "outputs": [],
"source": [ "source": [
@ -20,24 +20,12 @@
}, },
{ {
"cell_type": "code", "cell_type": "code",
"execution_count": 3, "execution_count": 264,
"metadata": {}, "metadata": {},
"outputs": [], "outputs": [],
"source": [ "source": [
"# Convert the following into an appropriate data object, which is searchable, from start, to end, to name and label\n", "import pandas as pd\n",
"# - 0x00000000 to 0x00020000: BootROM\n", "data = pd.read_csv('stack_and_functions.csv').to_dict(orient='records')"
"# - 0x000002c0: BL1 boot entry point\n",
"# - 0x00012848: bootrom authentication function\n",
"# - 0x00019310: BL1 boot function\n",
"# - 0x02069000: First debugger location\n",
"\n",
"data = [\n",
" {\"start\": 0x00000000, \"end\": 0x00020000, \"name\": \"BootROM\"},\n",
" {\"start\": 0x000002c0, \"name\": \"BL1 boot entry point\"},\n",
" {\"start\": 0x00012848, \"name\": \"bootrom authentication function\"},\n",
" {\"start\": 0x00019310, \"name\": \"BL1 boot function\"},\n",
" {\"start\": 0x02069000, \"name\": \"First debugger location\"}\n",
"]\n"
] ]
}, },
{ {
@ -49,7 +37,7 @@
}, },
{ {
"cell_type": "code", "cell_type": "code",
"execution_count": 120, "execution_count": 266,
"metadata": {}, "metadata": {},
"outputs": [ "outputs": [
{ {
@ -60,7 +48,11 @@
}, },
"data": [ "data": [
{ {
"marker": {
"color": "#768f95"
},
"mode": "text", "mode": "text",
"name": "BootROM",
"text": "BootROM", "text": "BootROM",
"textposition": "middle center", "textposition": "middle center",
"type": "scatter", "type": "scatter",
@ -68,11 +60,15 @@
0.5 0.5
], ],
"y": [ "y": [
0.5 2.1463414634146343
] ]
}, },
{ {
"marker": {
"color": "#2564cb"
},
"mode": "text", "mode": "text",
"name": "BL1 boot entry point",
"text": "BL1 boot entry point", "text": "BL1 boot entry point",
"textposition": "middle center", "textposition": "middle center",
"type": "scatter", "type": "scatter",
@ -80,11 +76,15 @@
0.5 0.5
], ],
"y": [ "y": [
1.5 4.628048780487806
] ]
}, },
{ {
"marker": {
"color": "#9e0519"
},
"mode": "text", "mode": "text",
"name": "Boot USB function",
"text": "Boot USB function", "text": "Boot USB function",
"textposition": "middle center", "textposition": "middle center",
"type": "scatter", "type": "scatter",
@ -92,11 +92,15 @@
0.5 0.5
], ],
"y": [ "y": [
2.5 5.298780487804878
] ]
}, },
{ {
"marker": {
"color": "#2f0c12"
},
"mode": "text", "mode": "text",
"name": "bootrom authentication function",
"text": "bootrom authentication function", "text": "bootrom authentication function",
"textposition": "middle center", "textposition": "middle center",
"type": "scatter", "type": "scatter",
@ -104,11 +108,15 @@
0.5 0.5
], ],
"y": [ "y": [
3.5 5.969512195121951
] ]
}, },
{ {
"marker": {
"color": "#7e4e8a"
},
"mode": "text", "mode": "text",
"name": "BL1 boot function",
"text": "BL1 boot function", "text": "BL1 boot function",
"textposition": "middle center", "textposition": "middle center",
"type": "scatter", "type": "scatter",
@ -116,71 +124,15 @@
0.5 0.5
], ],
"y": [ "y": [
4.5 6.640243902439026
]
},
{
"mode": "text",
"text": "Boot USB return address",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
5.5
]
},
{
"mode": "text",
"text": "Event buffer pointer",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
6.5
]
},
{
"mode": "text",
"text": "BL1 pointer",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
7.5
]
},
{
"mode": "text",
"text": "First debugger location",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
8.5
]
},
{
"mode": "text",
"text": "End of memory stack",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
9.5
] ]
}, },
{ {
"marker": {
"color": "#43f7e5"
},
"mode": "text", "mode": "text",
"name": "Frederic Destination pointer",
"text": "Frederic Destination pointer", "text": "Frederic Destination pointer",
"textposition": "middle center", "textposition": "middle center",
"type": "scatter", "type": "scatter",
@ -188,13 +140,101 @@
0.5 0.5
], ],
"y": [ "y": [
10.5 7.310975609756099
]
},
{
"marker": {
"color": "#d4b036"
},
"mode": "text",
"name": "Boot USB return address",
"text": "Boot USB return address",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
7.981707317073173
]
},
{
"marker": {
"color": "#574d7b"
},
"mode": "text",
"name": "Event buffer pointer",
"text": "Event buffer pointer",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
8.652439024390247
]
},
{
"marker": {
"color": "#34619d"
},
"mode": "text",
"name": "BL1 pointer",
"text": "BL1 pointer",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
9.32317073170732
]
},
{
"marker": {
"color": "#57f720"
},
"mode": "text",
"name": "First debugger location",
"text": "First debugger location",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
9.993902439024394
]
},
{
"marker": {
"color": "#dca8fd"
},
"mode": "text",
"name": "End of memory stack",
"text": "End of memory stack",
"textposition": "middle center",
"type": "scatter",
"x": [
0.5
],
"y": [
10.664634146341468
] ]
} }
], ],
"layout": { "layout": {
"autosize": true, "autosize": true,
"font": {
"size": 18
},
"height": 1200, "height": 1200,
"legend": {
"title": {
"text": "Function/Locations"
}
},
"margin": { "margin": {
"b": 20, "b": 20,
"l": 200, "l": 200,
@ -203,20 +243,20 @@
}, },
"shapes": [ "shapes": [
{ {
"fillcolor": "#12e884", "fillcolor": "#768f95",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 0, "y0": 0,
"y1": 1 "y1": 4.2926829268292686
}, },
{ {
"fillcolor": "#db08ae", "fillcolor": "#2564cb",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
@ -225,125 +265,125 @@
"type": "rect", "type": "rect",
"x0": 0, "x0": 0,
"x1": 1, "x1": 1,
"y0": 1, "y0": 4.2926829268292686,
"y1": 2 "y1": 4.963414634146342
}, },
{ {
"fillcolor": "#50034a", "fillcolor": "#9e0519",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 2, "y0": 4.963414634146342,
"y1": 3 "y1": 5.634146341463415
}, },
{ {
"fillcolor": "#547ec9", "fillcolor": "#2f0c12",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 3, "y0": 5.634146341463415,
"y1": 4 "y1": 6.3048780487804885
}, },
{ {
"fillcolor": "#daac51", "fillcolor": "#7e4e8a",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 4, "y0": 6.3048780487804885,
"y1": 5 "y1": 6.975609756097562
}, },
{ {
"fillcolor": "#8704ee", "fillcolor": "#43f7e5",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 5, "y0": 6.975609756097562,
"y1": 6 "y1": 7.646341463414636
}, },
{ {
"fillcolor": "#86785f", "fillcolor": "#d4b036",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 6, "y0": 7.646341463414636,
"y1": 7 "y1": 8.31707317073171
}, },
{ {
"fillcolor": "#e33d72", "fillcolor": "#574d7b",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 7, "y0": 8.31707317073171,
"y1": 8 "y1": 8.987804878048784
}, },
{ {
"fillcolor": "#2f63f4", "fillcolor": "#34619d",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 8, "y0": 8.987804878048784,
"y1": 9 "y1": 9.658536585365857
}, },
{ {
"fillcolor": "#1258f9", "fillcolor": "#57f720",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 9, "y0": 9.658536585365857,
"y1": 10 "y1": 10.329268292682931
}, },
{ {
"fillcolor": "#109cff", "fillcolor": "#dca8fd",
"layer": "below", "layer": "below",
"line": { "line": {
"width": 2 "width": 2
}, },
"opacity": 0.5, "opacity": 0.5,
"type": "rect", "type": "rect",
"x0": 0, "x0": 0.1,
"x1": 1, "x1": 1,
"y0": 10, "y0": 10.329268292682931,
"y1": 11 "y1": 11.000000000000005
} }
], ],
"template": { "template": {
@ -1162,45 +1202,72 @@
} }
} }
}, },
"width": 800, "width": 1000,
"xaxis": { "xaxis": {
"range": [ "range": [
0, 0,
1 1
], ],
"showticklabels": false,
"tickvals": [ "tickvals": [
0, 0,
1 1
] ]
}, },
"yaxis": { "yaxis": {
"gridcolor": "black",
"griddash": "longdashdot",
"gridwidth": 0,
"showgrid": false,
"ticktext": [ "ticktext": [
"0x0", "0x0",
"0x2c0 \n 0x12c0", "0x52c0<br>0x2c0",
"0x64e0 \n 0x74e0", "0xb4e0<br>0x64e0",
"0x12848 \n 0x13848", "0x17848<br>0x12848",
"0x19310 \n 0x1a310", "0x1e310<br>0x19310",
"0x2020f60 \n 0x2021f60", "0x211000<br>0x20c000",
"0x2021578 \n 0x2022578", "0x2025f60<br>0x2020f60",
"0x2021800 \n 0x2022800", "0x2026578<br>0x2021578",
"0x2069000 \n 0x206a000", "0x2026800<br>0x2021800",
"0x206f000 \n 0x2070000", "0x206e000<br>0x2069000",
"0x20c0000 \n 0x20c1000", "0x2070000<br>0x206b000",
"0x20c1000" [
"0x0",
"0x20000",
"0x2c0",
"0x52c0",
"0x64e0",
"0xb4e0",
"0x12848",
"0x17848",
"0x19310",
"0x1e310",
"0x20c000",
"0x211000",
"0x2020f60",
"0x2025f60",
"0x2021578",
"0x2026578",
"0x2021800",
"0x2026800",
"0x2069000",
"0x206e000",
"0x206b000",
"0x2070000"
]
], ],
"tickvals": [ "tickvals": [
0, 0,
1, 4.2926829268292686,
2, 4.963414634146342,
3, 5.634146341463415,
4, 6.3048780487804885,
5, 6.975609756097562,
6, 7.646341463414636,
7, 8.31707317073171,
8, 8.987804878048784,
9, 9.658536585365857,
10, 10.329268292682931
11
] ]
} }
} }
@ -1212,45 +1279,22 @@
], ],
"source": [ "source": [
"import plotly.graph_objects as go\n", "import plotly.graph_objects as go\n",
"\n", "import random\n",
"# Sample data structure\n",
"data = [\n",
" {'start': 0x00000000, 'end': 0x00020000, 'name': 'BootROM'},\n",
" {'start': 0x000002c0, 'name': 'BL1 boot entry point'},\n",
" {'start': 0x000064e0, 'name': 'Boot USB function'},\n",
" {'start': 0x00012848, 'name': 'bootrom authentication function'},\n",
" {'start': 0x00019310, 'name': 'BL1 boot function'},\n",
" {'start': 0x02069000, 'name': 'First debugger location'},\n",
" {'end': 0x02070000, 'name': 'End of memory stack'},\n",
" {'start': 0x02021578, 'name': 'Event buffer pointer'},\n",
" {'start': 0x02020f60, 'name': 'Boot USB return address'},\n",
" {'start': 0x02021800, 'name': 'BL1 pointer'},\n",
" {'start': 0x020c0000, 'name': 'Frederic Destination pointer'},\n",
"]\n",
"\n",
"# _evtbuf_ptr: .dword 0x02021578\n",
"# _boot_usb_ra: .dword 0x02020f60\n",
"# _bl1_ptr: .dword 0x02021800\n",
"# _original_ra: .dword 0x00007c68\n",
"# _boot_usb: .dword 0x000064e0\n",
"# _dst_ptr: .dword 0x020c0000\n",
"# _auth_bl1: .dword 0x00012848\n",
"# _jmp_bl1: .dword 0x000002c0\n",
"\n", "\n",
"# If there is no end, set it to start + 0x1000\n", "# If there is no end, set it to start + 0x1000\n",
"for d in data:\n", "for d in data:\n",
" if 'end' not in d:\n", " if 'end' not in d:\n",
" d['end'] = d['start'] + 0x1000\n", " d['end'] = d['start'] + 0x5000\n",
"\n", "\n",
"# If there is no start, set it to end - 0x1000\n", "# If there is no start, set it to end - 0x1000\n",
"for d in data:\n", "for d in data:\n",
" if 'start' not in d:\n", " if 'start' not in d:\n",
" d['start'] = d['end'] - 0x1000\n", " d['start'] = d['end'] - 0x5000\n",
"\n", "\n",
"# Sort the data by start\n", "# Sort the data by start\n",
"data = sorted(data, key=lambda x: x['start'])\n", "data = sorted(data, key=lambda x: x['start'])\n",
"\n", "total_used_len = sum([d['end']-d['start'] for d in data]) # Length of all blocks described\n",
"import random\n", "tickpointers = []\n",
"\n", "\n",
"def random_color():\n", "def random_color():\n",
" return f'#{random.randint(0, 0xFFFFFF):06x}'\n", " return f'#{random.randint(0, 0xFFFFFF):06x}'\n",
@ -1258,33 +1302,46 @@
"# Create a square for each index\n", "# Create a square for each index\n",
"fig = go.Figure()\n", "fig = go.Figure()\n",
"for i, d in enumerate(data):\n", "for i, d in enumerate(data):\n",
" if i == 0:\n",
" prev_y = 0\n",
" max_y = (prev_y + ((d['end'] - d['start']) / total_used_len))\n",
" fillcolor = random_color()\n",
"\n",
" if d['Order'] == \"ENTRY\":\n",
" x0 = 0\n",
" else:\n",
" x0 = 0.1\n",
"\n",
" fig.add_shape(\n", " fig.add_shape(\n",
" type=\"rect\",\n", " type=\"rect\",\n",
" x0=0,\n", " x0=x0,\n",
" y0=i,\n", " y0=prev_y * len(data),\n",
" x1=0 + 1,\n", " x1=0 + 1,\n",
" y1=i+1,\n", " y1=max_y * len(data),\n",
" line=dict(width=2),\n", " line=dict(width=2),\n",
" fillcolor=random_color(),\n", " fillcolor=fillcolor,\n",
" opacity=0.5,\n", " opacity=0.5,\n",
" layer=\"below\"\n", " layer=\"below\",\n",
" )\n", " )\n",
"\n", "\n",
" tickpoint = [(prev_y + (max_y - prev_y) / 2) * len(data)]\n",
" tickpointers.extend([prev_y * len(data)])\n",
"\n",
" fig.add_trace(go.Scatter\n", " fig.add_trace(go.Scatter\n",
" (\n", " (\n",
" x=[0.5],\n", " x=[0.5],\n",
" y=[i+ 0.5],\n", " y=tickpoint,\n",
" text=d['name'],\n", " text=d['name'],\n",
" mode=\"text\",\n", " mode=\"text\",\n",
" textposition=\"middle center\"\n", " textposition=\"middle center\",\n",
" name=d['name'],\n",
" # Set color to\n",
" marker=dict(\n",
" color=fillcolor,\n",
" ),\n",
" ))\n", " ))\n",
"\n", " \n",
"fig.update_layout(\n", " prev_y = max_y\n",
" width=800,\n",
" height=1200,\n",
" autosize=True,\n",
" margin=dict(l=200, r=20, t=20, b=20)\n",
")\n",
"\n", "\n",
"fig.update_xaxes(\n", "fig.update_xaxes(\n",
" range=[0, 1],\n", " range=[0, 1],\n",
@ -1301,59 +1358,38 @@
" elif i == len(labels) - 1:\n", " elif i == len(labels) - 1:\n",
" labelset.append(labels[i])\n", " labelset.append(labels[i])\n",
" else:\n", " else:\n",
" labelset.append(f\"{labels[i]} \\n {labels[i+1]}\")\n", " labelset.append(f\"{labels[i+1]}<br>{labels[i]}\")\n",
"labelset.append(labels[-1])\n", "labelset.append(labels)\n",
"\n", "\n",
"fig.update_yaxes(\n", "fig.update_yaxes(\n",
" tickvals=[i for i in range(len(data)+1)], \n", " # tickvals=[i for i in range(len(data)+1)], \n",
" ticktext=labelset\n", " tickvals = tickpointers,\n",
" ticktext=labelset,\n",
" griddash=\"longdashdot\",\n",
" gridwidth=0,\n",
" gridcolor=\"black\",\n",
" showgrid=False,\n",
")\n",
"\n",
"fig.update_xaxes(\n",
" # Disable ticks\n",
" showticklabels=False,\n",
")\n",
"\n",
"fig.update_layout(\n",
" width=1000,\n",
" height=1200,\n",
" autosize=True,\n",
" margin=dict(l=200, r=20, t=20, b=20),\n",
" font=dict(\n",
" size=18,\n",
" ),\n",
" # Legend being the name of the function\n",
" legend_title_text=\"Function/Locations\",\n",
")\n", ")\n",
"\n", "\n",
"fig.show()" "fig.show()"
] ]
},
{
"cell_type": "code",
"execution_count": 111,
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
"['0x0',\n",
" '0x2c0 - 0x12c0',\n",
" '0x12848 - 0x13848',\n",
" '0x19310 - 0x1a310',\n",
" '0x2069000 - 0x206a000',\n",
" '0x206f000 - 0x2070000']"
]
},
"execution_count": 111,
"metadata": {},
"output_type": "execute_result"
}
],
"source": []
},
{
"cell_type": "code",
"execution_count": 115,
"metadata": {},
"outputs": [
{
"data": {
"text/plain": [
"'0x2070000'"
]
},
"execution_count": 115,
"metadata": {},
"output_type": "execute_result"
}
],
"source": [
"labels[-1]"
]
} }
], ],
"metadata": { "metadata": {

View File

@ -0,0 +1,12 @@
start,end,name,Order,Comment
0,131072,BootROM,,
704,21184,BL1 boot entry point,ENTRY,
25824,46304,Boot USB function,,
75848,96328,bootrom authentication function,,
103184,123664,BL1 boot function,,
2146304,2166784,Frederic Destination pointer,,
33689440,33709920,Boot USB return address,,
33691000,33711480,Event buffer pointer,,
33691648,33712128,BL1 pointer,,
33984512,34004992,First debugger location,,
33992704,34013184,End of memory stack,,
1 start end name Order Comment
2 0 131072 BootROM
3 704 21184 BL1 boot entry point ENTRY
4 25824 46304 Boot USB function
5 75848 96328 bootrom authentication function
6 103184 123664 BL1 boot function
7 2146304 2166784 Frederic Destination pointer
8 33689440 33709920 Boot USB return address
9 33691000 33711480 Event buffer pointer
10 33691648 33712128 BL1 pointer
11 33984512 34004992 First debugger location
12 33992704 34013184 End of memory stack

View File

@ -14,5 +14,7 @@ sphinxcontrib.drawio
sphinx_wagtail_theme sphinx_wagtail_theme
plotly plotly
numpy numpy
nbformat>4.2.0 nbformat==5.10.4
pandas
xvfbwrapper #Required for sphinx drawio
source/ghidra_assistant/ghidra_assistant-0.0.1-py3-none-any.whl source/ghidra_assistant/ghidra_assistant-0.0.1-py3-none-any.whl

View File

@ -620,12 +620,9 @@ class ExynosDevice():
auth_bl1(DEBUGGER_ADDR) auth_bl1(DEBUGGER_ADDR)
self.usb_write(b"FLSH") # Flush cache self.usb_write(b"FLSH") # Flush cache
hijacked_fun = u32(self.cd.memdump_region(0x020200dc, 4)) hijacked_fun = u32(self.cd.memdump_region(0x020200dc, 4))
# INSERT YOUR BL1 PATCHES HERE
self.cd.memwrite_region(0x020200dc, p32(DEBUGGER_ADDR)) # hijack ROM_DOWNLOAD_USB for BL31 self.cd.memwrite_region(0x020200dc, p32(DEBUGGER_ADDR)) # hijack ROM_DOWNLOAD_USB for BL31
self.cd.memwrite_region(0x02021880, self.cd.arch_dbg.sc.branch_absolute(DEBUGGER_ADDR, branch_ins="br")) self.cd.memwrite_region(0x02021880, self.cd.arch_dbg.sc.branch_absolute(DEBUGGER_ADDR, branch_ins="br"))
# END
jump_bl1(DEBUGGER_ADDR) jump_bl1(DEBUGGER_ADDR)
@ -642,53 +639,45 @@ class ExynosDevice():
time.sleep(2) time.sleep(2)
self.usb_read(0x200) # GiAs self.usb_read(0x200) # GiAs
# lr = self.cd.arch_dbg.state.LR
# self.cd.memwrite_region(0x020200dc, p32(hijacked_fun)) # Resore oginal boot flow
# TODO patch verification
# self.cd.memwrite_region(0x0202010c - 52, p32(GADGET_RET0))
# self.cd.memwrite_region(0x02024774, self.cd.arch_dbg.sc.mov_0_w0_ins + self.cd.arch_dbg.sc.ret_ins) # self.cd.memwrite_region(0x02024774, self.cd.arch_dbg.sc.mov_0_w0_ins + self.cd.arch_dbg.sc.ret_ins)
# self.cd.arch_dbg.state.LR = DEBUGGER_ADDR # self.cd.arch_dbg.state.LR = DEBUGGER_ADDR
# self.cd.arch_dbg.state.X0 = 0x020347f0 # self.cd.arch_dbg.state.X0 = 0x020347f0
# self.cd.arch_dbg.state.X1 = 0 # self.cd.arch_dbg.state.X1 = 0
# self.cd.restore_stack_and_jump(0x02030464) # self.cd.restore_stack_and_jump(0x02030464)
self.cd.restore_stack_and_jump(lr) self.cd.restore_stack_and_jump(lr)
time.sleep(2) time.sleep(2)
self.usb_read(0x200) # GiAs assert self.usb_read(0x200) == b"GiAs", "Failed to jump back to debugger"
self.cd.memwrite_region(0x02031008, b"ELH")
# ====== PATCHES TO BL31 here! ====== # ====== PATCHES TO BL31 here! ======
self.cd.memwrite_region(0x02031008, b"ELH")
# Jump into BL31
# Jump entry BL31
self.cd.restore_stack_and_jump(0x02024010) self.cd.restore_stack_and_jump(0x02024010)
time.sleep(2) time.sleep(2)
self.connect_device() self.connect_device()
# WORKING
assert self.usb_read(0x200) == b"GiAs", "Failed to jump back to debugger" assert self.usb_read(0x200) == b"GiAs", "Failed to jump back to debugger"
# print(self.cd.memdump_region(0x020200dc, 4))
self.cd.memwrite_region(0x020200dc, p32(hijacked_fun)) #Sets jump/X1 address at X0 0x2048000 -> Entry point of BL2 self.cd.memwrite_region(0x020200dc, p32(hijacked_fun)) #Sets jump/X1 address at X0 0x2048000 -> Entry point of BL2
self.cd.memwrite_region(0x02020, p32(DEBUGGER_ADDR)) # Restore original boot flow # Boot mode? Not sure whether its important (related to boot type at function 02023800?)
# self.cd.memwrite_region(0x02020, p32(DEBUGGER_ADDR)) # Restore original boot flow
# Jump into BL2 # Jump into USB download function
# self.cd.arch_dbg.state.LR = DEBUGGER_ADDR
# WORKS
self.cd.restore_stack_and_jump(hijacked_fun) self.cd.restore_stack_and_jump(hijacked_fun)
# END
# self.usb_read(0x200) # GiAs # WORKING UNTIL HERE
# self.cd.restore_stack_and_jump(hijacked_fun)
# ==== Stage 3 BL2 ==== # ==== Stage 3 BL2 ====
self.send_normal_stage(open("../S7/g930f_latest/g930f_sboot.bin.3.bin", "rb").read()) BL2_FUN = 0x2048000
bl2 = open("../S7/g930f_latest/g930f_sboot.bin.3.bin", "rb").read()
# bl2 = bl2[:(0x02052bf4-0x02048000)] + b"00000000" + bl2[(0x02052bf4-0x02048000)+8:]
self.send_normal_stage(bl2)
# self.send_normal_stage(open("../S7/g930f_latest/g930f_sboot.bin.3.bin", "rb").read())
time.sleep(2) time.sleep(2)
self.connect_device() self.connect_device()

View File

@ -1,8 +0,0 @@
# Open a binary file and modify it
bl1 = open('../S7/bl1.bin', 'rb').read()
# Modify the binary file at 1C10
bl1 = bl1[:0x1C1C] + b'\x48' + bl1[0x1C1D:]
# Write the modified binary file
open('../S7/bl1_mod.bin', 'wb').write(bl1)