From 6492aadd7cde566c15f363a7799f917590f8a661 Mon Sep 17 00:00:00 2001
From: Eljakim Herrewijnen <eljakim.herrewijnen@gmail.com>
Date: Sat, 7 Dec 2024 20:59:02 +0100
Subject: [PATCH] seperated exynos device from exploit

---
 .../__pycache__/exynos.cpython-310.pyc        | Bin 0 -> 2850 bytes
 source/exploit/exploit.py                     |  96 ++----------------
 source/exploit/exynos.py                      |  87 ++++++++++++++++
 3 files changed, 96 insertions(+), 87 deletions(-)
 create mode 100644 source/exploit/__pycache__/exynos.cpython-310.pyc
 create mode 100644 source/exploit/exynos.py

diff --git a/source/exploit/__pycache__/exynos.cpython-310.pyc b/source/exploit/__pycache__/exynos.cpython-310.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..bafbaefc0b113c967e35334aadeefee83af298fd
GIT binary patch
literal 2850
zcma)8S#KOS5^l1O=^3>~htG|@yB%)=>;%S4e8kZrr*$Nr*cm61yhi4QXf-LRrJn9F
zn`29ZaS%j)-CqzaAiXT$zpy_dKY*`!SwAOF0TQH&J-VDt5H`B1NLE)@u|5`=Pfpe>
zXg~aCbt9-+)_2%B*=*>12ygLUAl%|4wYnuIU1IvQOAWWXw&70KG2HFChI?HPI87_7
z_#I9CF|Uq!&2T%N=mp(?ppKJH_Uhfbkx4q$oicW&yVHixbZ5BBy=PW;mRGnB{0y)1
z8t}7xf(O9QeQfbbUVmos`X23`=VZldOuYdAtxkhz@&=HZk8iU`_HNx|T&xW?HiU%1
z%IEjk?d63#F+tsNL)n3M0p9NeAj;Y&oQ$jk3TA0%NZ)Ngr`ju&9K=dH{V3jk4u9Es
zZpjHy|8cIhnfF9Xq+8K;(rc~c0~w3fO4KU`*#=vAyH%7UVyB<xiE4?R-7GJf{atPM
zZ(PUhd{2P{L{0+xP2Z#ov!y@t(gRsSI!hOf9}<1nv_FSdWF5&AkUwJY&TreZ``2zw
z9~ngHj~M*?_YB^;dFIIA3>t*@R6By?br=>F!Vn-x0DhC);qEg60Q7hTfZ%eUSAl!H
z#wUPRcmO%8>tM;O@uGN~#A0~27D8J{qoN2^9**-6Mq#NHa-$aheQxd_Z?=HE)d&Yg
zl5K=)Q-lvz=EFik&YQ-{i~j*uUfi4ox6#eRhB78`0p8*-Kt=!{W{oIN111L2zI|W;
z<`Gu*@Nzp#RQM!Oo8e=T@m#k0GUtG>u)SDl2Yu-@9PKCkpJrND6aHDLp*<DJ4WV>B
z&a+I!3NVg=Hf-$_B3+l~!2x*z2?F#4I()_w_$_0XV7%~wc+?{v3CQr=$t7zZ>YYk9
z28eJqL4FGY?vw)yLZnroTXf3?>cH!A%I$wak9pAZxU)^=#Yb+{8dkBtUpcV$eO!!(
zR(92~RCTvQtfz!n!*E2lYRcN0*b263F?ZCP1Pk-3&fPuGQd9fW+&cg%qa*S)d1!qB
zMdc~^l4NelpO7c$k+(m?E2sxw`f3(NoIUc5#j8dJTi;m!h7m}L14*e3-&qlA&<`OK
zeIdi~>Lz)1HH<PIimVt&VNh{A6(&U(rO9Kl`Vp*uwag_;xUP-!iSlHzo%C6rF(G9x
zJHs0#GDDseV@raEtuV{g;ZFr`hRb3+i6H#o1r{oaWH`G}<{dsNGyiJ%BMBR4v@<By
zuIU=6gN712N>{*y5nh3iviaQ-Ozp+n*&&+Ri^q7;-X;W^3S9+wl|Jez5LbjuqO>#U
ztqG~COFOaXD_9ooK916X(3Lb<Gk-pNuRRYxXG_b=_m|mf`_rZS4_5WmsnPa*?e=Ao
zDQy?KfON5wAd=H4>9xUCxgNzr+nZviLFFqDttR3n7|TDw@D+HAt3Ya$0)`!UDDi))
zxfD31v!qTg6CaT6(BNnPEBaI5zea|aPN96fyyNY23hTJexTy`+UjqTKW6lLclaVRn
z7bJV%IkBzJEgq%R0Hw^2Nn5Ak%Gbe?o|YmNQ6Y}Qb>lQIg!~)K$`+6YF`>T{x2_%I
z<vq|U@DvDW4MH7WI2G8jUW}Xeu;DR>hlUC2eGtkG{FExXZ?^81tGp3Wl@Zw^Fz1ix
z0aUL8@2NeqIe`uN=TD%1?ZK8C*`|tJd?*toLLR9IODh)46A=&px{wc2Zg347YCV^|
zaBYxohe}3Su?}Z)ReQ18?TbRYF_b1H-vF=l*%D6-b=jeAxpo&B;HyOD9RpRy#*m#^
z>MVYCzuj47^AGObWe7Yw6@byTT`ATZP6;LlUDXpuMg`Zl6vfLc?LNV{%sOF}^yw8c
z4G0^~o?2$3)B&8D1MMs*Hhc{=Hj8?KF<oP<2PHj4IbiJ3AWFwG6~=fTGbXVP8#v3i
zQ2G$bam_Xo9_td$8w;y?fj!@HNX_vp{-wY(GmQ(ff?7=^uOh)^l(&Fr8#bo);k@Wa
zvJl$e7Q2PYGmzq_UrLuZHWMx*2Ipe}M_s0x1C^vjNp<+ES=ctQ6iSTujeh%A8s+zg
zH?QWQ05`IDvuJL>ukdOnZFDerl%#OjHo+=fu@It~=1>>ZBi_?Kq)VuzC(PZ*Txg`Z
oj^M??#Qy)5OZ)GZ3;#ZD;{vP5oaI9`z$bv`BJrtj<1=gj0?+8eOaK4?

literal 0
HcmV?d00001

diff --git a/source/exploit/exploit.py b/source/exploit/exploit.py
index fa8dea1..ba0ebb5 100644
--- a/source/exploit/exploit.py
+++ b/source/exploit/exploit.py
@@ -1,23 +1,4 @@
-import struct, sys, usb1, libusb1, ctypes, usb, argparse
-from keystone import *
-from capstone import *
-from ghidra_assistant.utils.utils import *
-from ghidra_assistant.concrete_device import *
-from ghidra_assistant.utils.debugger.debugger_archs.ga_arm64 import GA_arm64_debugger
-from qiling.const import QL_ARCH
-import os, tqdm, datetime
-
-def p32(x):
-    return struct.pack("<I", x)
-
-def p8(x):
-    return struct.pack("<B", x)
-
-def p16(x):
-    return struct.pack("<H", x)
-
-def p64(x):
-    return struct.pack("<Q", x)
+from exynos import *
 
 logger = setup_logger("") #Leave empty to get root logger
 logger.setLevel(logging.DEBUG)
@@ -52,57 +33,9 @@ ENDPOINT_BULK_OUT = 0x2
 ks = Ks(KS_ARCH_ARM64, KS_MODE_LITTLE_ENDIAN)
 cs = Cs(CS_ARCH_ARM64, CS_MODE_LITTLE_ENDIAN)
 
-class ExynosDevice():
-    """
-    Class to exploit a Exynos device (8890/8895) using the USB stack.
-    """
-
+class S7Exploit(ExynosDevice):
     def __init__(self, idVendor=0x04e8, idProduct=0x1234):
-        """Init with vendor/product IDs"""
-        self.idVendor = idVendor
-        self.idProduct = idProduct
-        self.target = "8890"  # TODO auto detect device
-        self.connect_device()
-
-    def connect_device(self):
-        """Setup proper connection, and ensure the connection is alive"""
-        self.context = usb1.USBContext()
-
-        while True:
-            self.handle = self.context.openByVendorIDAndProductID(
-                vendor_id=self.idVendor,
-                product_id=self.idProduct,
-                skip_on_error=False
-            )
-            if self.handle == None:
-                continue
-            break
-
-        try:
-            self.handle.getDevice().getSerialNumber()
-        except Exception as e:
-            if e.value == usb1.libusb1.LIBUSB_ERROR_TIMEOUT or e.value == usb1.libusb1.LIBUSB_ERROR_IO:
-                print("Device disconnected / not connected. Reconnect USB?")
-                sys.exit(1)
-            else:
-                raise e
-
-        # claim usb interface
-        self.handle.claimInterface(0)
-        print(f"Connected device! {hex(self.idVendor)} {hex(self.idProduct)}")
-
-    def disconnect(self):
-        """Disconnect the device"""
-        self.handle.releaseInterface(0)
-        self.handle.close()
-        self.context.exit()
-
-    def write(self, data):
-        """Write data to the device"""
-        transferred = ctypes.c_int()
-        res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, data, len(data), ctypes.byref(transferred), 0)
-        assert(res == 0), "Could not perform bulk transfer"
-        return res
+        super().__init__(idVendor, idProduct)
 
     def send_empty_transfer(self):
         """Send an empty transfer (to not actually write data)"""
@@ -242,21 +175,6 @@ class ExynosDevice():
         return
 
 
-    def usb_write(self, data):
-        assert len(data) <= 0x200, "Data too big"
-        transferred = ctypes.c_int()
-        res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, data, len(data), ctypes.byref(transferred), 300)
-        assert res == 0, f"Error sending data {res}"
-        assert transferred.value == len(data), f"Invalid transfered size {transferred.value} != {len(data)}"
-        return transferred.value
-
-
-    def usb_read(self, size):
-        transferred = ctypes.c_int()
-        buf = ctypes.c_buffer(b"", size)
-        res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_IN, buf, len(buf), ctypes.byref(transferred), 300)
-        assert res == 0, f"Error receiving data {res}"
-        return buf.raw[:transferred.value]
 
 
     def setup_concrete_device(self, concrete_device : ConcreteDevice):
@@ -851,10 +769,11 @@ if __name__ == "__main__":
     arg.add_argument("--debug", action="store_true", help="Debug USB stack", default=False)
     arg.add_argument("--unsecure-boot", action="store_true", help="Unsecure boot", default=False)
     arg.add_argument("--debugger-boot", action="store_true", help="Unsecure boot", default=False)
+    arg.add_argument("--load_ga", action="store_true", help="Load Gupje debugger", default=False)
     arg.add_argument("--MIB3", action="store_true", help="Whether boot is on a MIB3", default=False)
 
     args = arg.parse_args()
-    exynos = ExynosDevice()
+    exynos = S7Exploit()
 
     if args.debug:
         shellcode = open("../dwc3_test/dwc3.bin", "rb").read()
@@ -863,7 +782,7 @@ if __name__ == "__main__":
         # exynos.usb_debug()
         sys.exit(0)
 
-    if args.unsecure_boot:
+    elif args.unsecure_boot:
         exynos.unsecure_boot()
         sys.exit(0)
 
@@ -875,6 +794,9 @@ if __name__ == "__main__":
         sys.exit(0)
 
     exynos.setup_guppy_debugger()
+    if args.load_ga:
+        info("Loaded gupje, exiting")
+        sys.exit(0)
     exynos.dumb_interact()
 
     sys.exit(0)
\ No newline at end of file
diff --git a/source/exploit/exynos.py b/source/exploit/exynos.py
new file mode 100644
index 0000000..863466d
--- /dev/null
+++ b/source/exploit/exynos.py
@@ -0,0 +1,87 @@
+import struct, sys, usb1, libusb1, ctypes, usb, argparse
+from keystone import *
+from capstone import *
+from ghidra_assistant.utils.utils import *
+from ghidra_assistant.concrete_device import *
+from ghidra_assistant.utils.debugger.debugger_archs.ga_arm64 import GA_arm64_debugger
+from qiling.const import QL_ARCH
+import os, tqdm, datetime
+
+def p32(x):
+    return struct.pack("<I", x)
+
+def p8(x):
+    return struct.pack("<B", x)
+
+def p16(x):
+    return struct.pack("<H", x)
+
+def p64(x):
+    return struct.pack("<Q", x)
+
+class ExynosDevice():
+    """
+    Class to exploit a Exynos device (8890/8895) using the USB stack.
+    """
+
+    def __init__(self, idVendor=0x04e8, idProduct=0x1234):
+        """Init with vendor/product IDs"""
+        self.idVendor = idVendor
+        self.idProduct = idProduct
+        self.target = "8890"  # TODO auto detect device
+        self.connect_device()
+
+    def connect_device(self):
+        """Setup proper connection, and ensure the connection is alive"""
+        self.context = usb1.USBContext()
+
+        while True:
+            self.handle = self.context.openByVendorIDAndProductID(
+                vendor_id=self.idVendor,
+                product_id=self.idProduct,
+                skip_on_error=False
+            )
+            if self.handle == None:
+                continue
+            break
+
+        try:
+            self.handle.getDevice().getSerialNumber()
+        except Exception as e:
+            if e.value == usb1.libusb1.LIBUSB_ERROR_TIMEOUT or e.value == usb1.libusb1.LIBUSB_ERROR_IO:
+                print("Device disconnected / not connected. Reconnect USB?")
+                sys.exit(1)
+            else:
+                raise e
+
+        # claim usb interface
+        self.handle.claimInterface(0)
+        print(f"Connected device! {hex(self.idVendor)} {hex(self.idProduct)}")
+
+    def disconnect(self):
+        """Disconnect the device"""
+        self.handle.releaseInterface(0)
+        self.handle.close()
+        self.context.exit()
+
+    def write(self, data):
+        """Write data to the device"""
+        transferred = ctypes.c_int()
+        res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, data, len(data), ctypes.byref(transferred), 0)
+        assert(res == 0), "Could not perform bulk transfer"
+        return res
+    
+    def usb_write(self, data):
+        assert len(data) <= 0x200, "Data too big"
+        transferred = ctypes.c_int()
+        res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, data, len(data), ctypes.byref(transferred), 300)
+        assert res == 0, f"Error sending data {res}"
+        assert transferred.value == len(data), f"Invalid transfered size {transferred.value} != {len(data)}"
+        return transferred.value
+
+    def usb_read(self, size):
+        transferred = ctypes.c_int()
+        buf = ctypes.c_buffer(b"", size)
+        res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_IN, buf, len(buf), ctypes.byref(transferred), 300)
+        assert res == 0, f"Error receiving data {res}"
+        return buf.raw[:transferred.value]
\ No newline at end of file