diff --git a/source/dwc3_test/Makefile b/source/dwc3_test/Makefile new file mode 100644 index 0000000..28d2fe1 --- /dev/null +++ b/source/dwc3_test/Makefile @@ -0,0 +1,17 @@ +ifeq ($(ANDROID_NDK_ROOT),) +$(error Error : Set the env variable 'ANDROID_NDK_ROOT' with the path of the Android NDK (version 20)) +endif + +CC := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android27-clang +AR := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-ar +OBJCOPY := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-objcopy +LD := $(ANDROID_NDK_ROOT)/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android-ld.bfd + +#==================Target Samsung S7 (8890)================== +CFLAGS_SAMSUNGS7 = -Os + +dwc3: + $(CC) entry.S -c -o entry.o $(CFLAGS_SAMSUNGS7) + $(CC) $(CFLAGS_SAMSUNGS7) -c test_dwc3.c -o dwc3.o + $(LD) -T test_dwc3.ld entry.o dwc3.o -o dwc3.elf --just-symbols=symbols.txt + $(OBJCOPY) -O binary dwc3.elf dwc3.bin diff --git a/source/dwc3_test/Readme.md b/source/dwc3_test/Readme.md new file mode 100644 index 0000000..b4ac60d --- /dev/null +++ b/source/dwc3_test/Readme.md @@ -0,0 +1,14 @@ +# Test DWC3 +Code used to interact with the DWC3 implemenatation in the Exynos 8890 bootrom. Left here as reference. + +## Size limitations +This code can be compiled and pushed as first stage after running the exploit, but due to size limitations it is probably better to create a dedicated stage1 and do full send/recv in a second stage. + +## Building +```bash +export ANDROID_NDK_ROOT=$TOOLCHAINENV/android-ndk-r21_Linux +make +``` + +This will result in a dwc3.bin file which can be pushed. + diff --git a/source/dwc3_test/dwc3.elf b/source/dwc3_test/dwc3.elf new file mode 100755 index 0000000..1531389 Binary files /dev/null and b/source/dwc3_test/dwc3.elf differ diff --git a/source/dwc3_test/dwc3.o b/source/dwc3_test/dwc3.o new file mode 100644 index 0000000..bf81e16 Binary files /dev/null and b/source/dwc3_test/dwc3.o differ diff --git a/source/dwc3_test/entry.S b/source/dwc3_test/entry.S new file mode 100644 index 0000000..3d4c757 --- /dev/null +++ b/source/dwc3_test/entry.S @@ -0,0 +1,47 @@ +start: + b main + +;.text +;.global rom_send +;rom_send: +; mov w1, #0x20000 // size +; mov w0, #0x0 // address +; bl usb_send +; ret +; +;.text +;.global usb_send +;usb_send: +; stp x29, x30, [sp,#-48]! +; mov w3, #0x0 +; bfxil w3, w1, #0, #24 +; mov w1, #0xc12 +; mov x29, sp +; stp x19, x20, [sp,#16] +; mov x5, #0xc834 +; mov w20, #0x1 +; movk x5, #0x1540, lsl #16 +; ldr x2, [x29,#40] +; mov x4, #0xc838 +; orr w6, w1, w20 +; movk x4, #0x1540, lsl #16 +; mov x19, #0xc83c +; movk x19, #0x1540, lsl #16 +; stp w3, w1, [x2,#8] +; mov w3, #0x406 +; stp w0, wzr, [x2] +; mov w0, w20 +; ldr x1, [x29,#40] +; strb w6, [x2,#12] +; ; mov x2, #0x27c8 +; str w1, [x5] +; mov w1, #0x1388 +; str wzr, [x4] +; str w3, [x19] +; ; blr x2 +; mov w0, w20 +; ldr w1, [x19] +; ldp x19, x20, [sp,#16] +; ldp x29, x30, [sp],#48 +; ret +; \ No newline at end of file diff --git a/source/dwc3_test/entry.o b/source/dwc3_test/entry.o new file mode 100644 index 0000000..cfc037f Binary files /dev/null and b/source/dwc3_test/entry.o differ diff --git a/source/dwc3_test/memory_map.drawio.svg b/source/dwc3_test/memory_map.drawio.svg new file mode 100644 index 0000000..470727a --- /dev/null +++ b/source/dwc3_test/memory_map.drawio.svg @@ -0,0 +1 @@ +
dwc3.bin
 \ No newline at end of file diff --git a/source/dwc3_test/symbols.txt b/source/dwc3_test/symbols.txt new file mode 100644 index 0000000..7d1870a --- /dev/null +++ b/source/dwc3_test/symbols.txt @@ -0,0 +1,5 @@ +maybe_usb_setup_read = 0x00006f88; +dwc3_ep0_start_trans = 0x0000791c; +usb_event_handler = 0x00007bac; +get_endpoint_recv_buffer = 0x00007a7c; +sleep = 0x000027c8; \ No newline at end of file diff --git a/source/dwc3_test/test_dwc3.c b/source/dwc3_test/test_dwc3.c new file mode 100644 index 0000000..4fbc8b1 --- /dev/null +++ b/source/dwc3_test/test_dwc3.c @@ -0,0 +1,69 @@ +#include + +// Create external function at 0x00006f88 +extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer); +extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len); +extern int usb_event_handler(void); +extern uint32_t get_endpoint_recv_buffer(char endpoint); +extern void sleep(int endpoint,uint32_t timeout); +extern void usb_send(uint32_t address,uint32_t size); +extern void rom_send(); + +#define recv_buffer 0x02021800 + 0x3000 +#define p_recv_buffer 0x02021800 + 0x2000 +#define data_received 0x02021800 + 0x2004 + +void recv_data_cb(uint32_t endpoint, uint32_t len){ + // Copies the data into the predetermined receive buffer and tells the event handler that the data was received + volatile void *dref = (void *)data_received; + char *dest_buf = (char *)recv_buffer; + void *rbuf = get_endpoint_recv_buffer(endpoint); + for(int i= 0; i < len; i++){ + dest_buf[i] = *(char *)(void *)((int)rbuf + i); + } + *(uint8_t *)dref = 1; // Mark as ready +} + +void recv_data(uint32_t address, uint32_t size){ + volatile void *dref = (void *)data_received; + *(uint8_t *)dref = 0; + maybe_usb_setup_read(2, recv_data_cb, 0x200); + uint32_t rbuf = get_endpoint_recv_buffer(2); + dwc3_ep0_start_trans(2, rbuf, 0x200); + while(1){ + usb_event_handler(); + if(*(uint8_t *)dref == 1){ + break; + } + } +} + +void send_data_cb(uint32_t endpoint, uint32_t len){ + // Tell event handler that the data was received + volatile void *dref = (void *)data_received; + *(uint8_t *)dref = 1; // Mark as ready +} + +void send_data(uint32_t address, uint32_t size){ + volatile void *dref = (void *)data_received; + *(uint8_t *)dref = 0; + maybe_usb_setup_read(0x1, send_data_cb, 0x200); + // uint32_t rbuf = get_endpoint_recv_buffer(1); + dwc3_ep0_start_trans(1, address, 0x200); + while(1){ + usb_event_handler(); + if(*(uint8_t *)dref == 1){ + break; + } + } +} + + +int main() { + + uint32_t count = 0; + while(1){ + recv_data(recv_buffer, 0x200); + send_data(recv_buffer, 0x200); + } +} \ No newline at end of file diff --git a/source/dwc3_test/test_dwc3.ld b/source/dwc3_test/test_dwc3.ld new file mode 100644 index 0000000..d2991ee --- /dev/null +++ b/source/dwc3_test/test_dwc3.ld @@ -0,0 +1,14 @@ +MEMORY { + ROM (rwx): ORIGIN = 0x02021800, LENGTH = 0x1000 +} + +SECTIONS +{ + . = 0x02021800; + .text . : { + *(.text*) + *(.data*) + *(.rodata*) + } >ROM + +} \ No newline at end of file diff --git a/source/exploit/dump_bootrom.elf b/source/exploit/dump_bootrom.elf deleted file mode 100644 index 570320d..0000000 Binary files a/source/exploit/dump_bootrom.elf and /dev/null differ