EljakimHerrewijnen/Samsung_S7
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added working dwc3

Browse Source
This commit is contained in:
Eljakim Herrewijnen 2024-08-02 22:13:27 +02:00
parent 7b2cb9b041
commit 5d7e117ea0
4 changed files with 7 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
source/exploit/dwc3.elf
View File

Binary file not shown.

BIN
source/exploit/dwc3.o
View File

Binary file not shown.

5
source/exploit/readme.md Normal file
View File

@ -0,0 +1,5 @@
# Exploit
## test_dwc3
simple dwc3 usb implementation to send/receive data.

21
source/exploit/test_dwc3.c
View File

@ -13,13 +13,11 @@ extern void rom_send();
#define data_received 0x02021800 + 0x2004 #define data_received 0x02021800 + 0x2004
void recv_data_cb(uint32_t endpoint, uint32_t len){ void recv_data_cb(uint32_t endpoint, uint32_t len){
// void *rbuf;
char *dest_buf = (char *)recv_buffer; char *dest_buf = (char *)recv_buffer;
volatile void *dref = (void *)data_received; volatile void *dref = (void *)data_received;
void *rbuf = get_endpoint_recv_buffer(endpoint); void *rbuf = get_endpoint_recv_buffer(endpoint);
for(int i= 0; i < len; i++){ for(int i= 0; i < len; i++){
// *(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
dest_buf[i] = *(char *)(void *)((int)rbuf + i); dest_buf[i] = *(char *)(void *)((int)rbuf + i);
} }
*(uint8_t *)dref = 1; // Mark as ready *(uint8_t *)dref = 1; // Mark as ready
@ -44,23 +42,16 @@ void recv_data(){
} }
void send_data_cb(uint32_t endpoint, uint32_t len){ void send_data_cb(uint32_t endpoint, uint32_t len){
// void *rbuf; // Tell event handler that the data was received
// void *dest_buf = (void *)recv_buffer;
volatile void *dref = (void *)data_received; volatile void *dref = (void *)data_received;
// rbuf = get_endpoint_buffer(endpoint);
// for(int i= 0; i < len; i++){
// *(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
// }
*(uint8_t *)dref = 1; // Mark as ready *(uint8_t *)dref = 1; // Mark as ready
} }
void send_data(uint32_t address, uint32_t size){ void send_data(uint32_t address, uint32_t size){
volatile void *dref = (void *)data_received; volatile void *dref = (void *)data_received;
*(uint8_t *)dref = 0; *(uint8_t *)dref = 0;
uint32_t val = 0x0;
maybe_usb_setup_read(0x1, send_data_cb, 0x200); maybe_usb_setup_read(0x1, send_data_cb, 0x200);
uint32_t rbuf = get_endpoint_recv_buffer(1); // uint32_t rbuf = get_endpoint_recv_buffer(1);
dwc3_ep0_start_trans(1, address, 0x200); dwc3_ep0_start_trans(1, address, 0x200);
while(1){ while(1){
usb_event_handler(); usb_event_handler();
@ -76,14 +67,6 @@ int main() {
uint32_t count = 0; uint32_t count = 0;
while(1){ while(1){
recv_data(); recv_data();
// rom_send();
send_data(recv_buffer, 0x200); send_data(recv_buffer, 0x200);
} }
// recv_data();
// sleep(1, 5000);
asm("mov x0, #0x0");
asm("br x0");
} }