EljakimHerrewijnen/Samsung_S7
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fixed images bug

Browse Source
This commit is contained in:
Eljakim Herrewijnen 2024-07-31 21:12:10 +02:00
parent 26be3cf77f
commit a0cdbd2310
35 changed files with 127 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@ -1 +1,3 @@
dump/ dump/
*.bin
*.a

1
documentation/.gitignore vendored Normal file
View File

@ -0,0 +1 @@
build/

0
documentation/images/underflow_bug.png → documentation/source/images/underflow_bug.png
View File

Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 73 KiB

After

Width:  |  Height:  |  Size: 73 KiB

BIN
dwc3.bin
View File

Binary file not shown.

BIN
dwc3.o
View File

Binary file not shown.

0
reven/SamsungS7.gpr Normal file
View File

9
reven/SamsungS7.lock Normal file
View File

@ -0,0 +1,9 @@
#Ghidra Lock File
#Wed Jul 31 20:30:18 CEST 2024
OS\ Name=Linux
OS\ Version=6.5.0-41-generic
Username=eljakim
Hostname=levith
<META>\ Supports\ File\ Channel\ Locking=Channel Lock
OS\ Architecture=amd64
Timestamp=7/31/24, 8\:30 PM

0
reven/SamsungS7.lock~ Normal file
View File

15
reven/SamsungS7.rep/idata/00/00000000.prp Normal file
View File

@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="EXCLUSIVE" TYPE="boolean" VALUE="false" />
<STATE NAME="CHECKOUT_VERSION" TYPE="int" VALUE="1" />
<STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
<STATE NAME="PARENT" TYPE="string" VALUE="/mib3" />
<STATE NAME="FILE_ID" TYPE="string" VALUE="7f0118059140616855428589" />
<STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
<STATE NAME="LOCAL_CHECKOUT_VERSION" TYPE="int" VALUE="3" />
<STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
<STATE NAME="CHECKOUT_ID" TYPE="long" VALUE="2" />
<STATE NAME="NAME" TYPE="string" VALUE="full_boot" />
</BASIC_INFO>
</FILE_INFO>

15
reven/SamsungS7.rep/idata/00/00000002.prp Normal file
View File

@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="EXCLUSIVE" TYPE="boolean" VALUE="false" />
<STATE NAME="CHECKOUT_VERSION" TYPE="int" VALUE="1" />
<STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
<STATE NAME="PARENT" TYPE="string" VALUE="/" />
<STATE NAME="FILE_ID" TYPE="string" VALUE="7f0119bc3142241939494339" />
<STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
<STATE NAME="LOCAL_CHECKOUT_VERSION" TYPE="int" VALUE="1" />
<STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
<STATE NAME="CHECKOUT_ID" TYPE="long" VALUE="2" />
<STATE NAME="NAME" TYPE="string" VALUE="8890_bootrom.bin" />
</BASIC_INFO>
</FILE_INFO>

BIN
reven/SamsungS7.rep/idata/00/~00000000.db/db.3.gbf Normal file
View File

Binary file not shown.

BIN
reven/SamsungS7.rep/idata/00/~00000002.db/db.1.gbf Normal file
View File

Binary file not shown.

4
reven/SamsungS7.rep/idata/~index.bak Normal file
View File

@ -0,0 +1,4 @@
VERSION=1
/
NEXT-ID:0
MD5:d41d8cd98f00b204e9800998ecf8427e

7
reven/SamsungS7.rep/idata/~index.dat Normal file
View File

@ -0,0 +1,7 @@
VERSION=1
/
00000002:8890_bootrom.bin:7f0119bc3142241939494339
/mib3
00000000:full_boot:7f0118059140616855428589
NEXT-ID:3
MD5:d41d8cd98f00b204e9800998ecf8427e

10
reven/SamsungS7.rep/idata/~journal.bak Normal file
View File

@ -0,0 +1,10 @@
FADD:/NewFolder
FMV:/NewFolder:/mib3
IADD:00000000:/mib3/fwbl1_a.bin
IDSET:/mib3/fwbl1_a.bin:7f0118059140616855428589
IMV:/mib3/fwbl1_a.bin:/mib3/full_boot
IADD:00000001:/mib3/8890_bootrom.bin
IDSET:/mib3/8890_bootrom.bin:7f011974d142238523757581
IADD:00000002:/8890_bootrom.bin
IDSET:/8890_bootrom.bin:7f0119bc3142241939494339
IDEL:/mib3/8890_bootrom.bin

9
reven/SamsungS7.rep/project.prp Normal file
View File

@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="OWNER" TYPE="string" VALUE="eljakim" />
<STATE NAME="SERVER" TYPE="string" VALUE="192.168.0.160" />
<STATE NAME="REPOSITORY_NAME" TYPE="string" VALUE="Samsung" />
<STATE NAME="PORT_NUMBER" TYPE="int" VALUE="13100" />
</BASIC_INFO>
</FILE_INFO>

11
reven/SamsungS7.rep/user/00/00000000.prp Normal file
View File

@ -0,0 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
<STATE NAME="PARENT" TYPE="string" VALUE="/" />
<STATE NAME="FILE_ID" TYPE="string" VALUE="7f0118d0b142268235940037" />
<STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
<STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
<STATE NAME="NAME" TYPE="string" VALUE="udf_7f0118059140616855428589" />
</BASIC_INFO>
</FILE_INFO>

11
reven/SamsungS7.rep/user/00/00000001.prp Normal file
View File

@ -0,0 +1,11 @@
<?xml version="1.0" encoding="UTF-8"?>
<FILE_INFO>
<BASIC_INFO>
<STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
<STATE NAME="PARENT" TYPE="string" VALUE="/" />
<STATE NAME="FILE_ID" TYPE="string" VALUE="7f011abb7142807435236045" />
<STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
<STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
<STATE NAME="NAME" TYPE="string" VALUE="udf_7f0119bc3142241939494339" />
</BASIC_INFO>
</FILE_INFO>

BIN
reven/SamsungS7.rep/user/00/~00000000.db/db.1.gbf Normal file
View File

Binary file not shown.

BIN
reven/SamsungS7.rep/user/00/~00000001.db/db.1.gbf Normal file
View File

Binary file not shown.

4
reven/SamsungS7.rep/user/~index.bak Normal file
View File

@ -0,0 +1,4 @@
VERSION=1
/
NEXT-ID:0
MD5:d41d8cd98f00b204e9800998ecf8427e

5
reven/SamsungS7.rep/user/~index.dat Normal file
View File

@ -0,0 +1,5 @@
VERSION=1
/
00000000:udf_7f0118059140616855428589:7f0118d0b142268235940037
NEXT-ID:1
MD5:d41d8cd98f00b204e9800998ecf8427e

2
reven/SamsungS7.rep/user/~journal.bak Normal file
View File

@ -0,0 +1,2 @@
IADD:00000000:/udf_7f0118059140616855428589
IDSET:/udf_7f0118059140616855428589:7f0118d0b142268235940037

2
reven/SamsungS7.rep/user/~journal.dat Normal file
View File

@ -0,0 +1,2 @@
IADD:00000001:/udf_7f0119bc3142241939494339
IDSET:/udf_7f0119bc3142241939494339:7f011abb7142807435236045

0
Makefile → source/Makefile
View File

BIN
source/dump_bootrom.elf Normal file
View File

Binary file not shown.

BIN
dwc3.elf → source/dwc3.elf
View File

Binary file not shown.

BIN
source/dwc3.o Normal file
View File

Binary file not shown.

0
entry.S → source/entry.S
View File

0
entry.o → source/entry.o
View File

1
exploit.py → source/exploit.py
View File

@ -163,6 +163,7 @@ class ExynosDevice():
p = b"\xaa" * 0x200 p = b"\xaa" * 0x200
transferred.value = 0 transferred.value = 0
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, p, len(p), ctypes.byref(transferred), 100) res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, ENDPOINT_BULK_OUT, p, len(p), ctypes.byref(transferred), 100)
assert res == 0, "Error sending data"
buf = ctypes.c_buffer(b"", 0x20000) buf = ctypes.c_buffer(b"", 0x20000)
res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, 0x81, buf, len(buf), ctypes.byref(transferred), 100) res = libusb1.libusb_bulk_transfer(self.handle._USBDeviceHandle__handle, 0x81, buf, len(buf), ctypes.byref(transferred), 100)

9
source/ghidra.py Normal file
View File

@ -0,0 +1,9 @@
from ghidra_assistant.ghidra_assistant import GhidraAssistant
if __name__ == "__main__":
rom = open("S7/rom.bin", 'rb').read()
ga = GhidraAssistant()
ga.ghidra.add_memory(rom, 0x0, True, "ROM")
pass

0
symbols.txt → source/symbols.txt
View File

11
test_dwc3.c → source/test_dwc3.c
View File

@ -40,6 +40,16 @@ void recv_data(){
} }
} }
void send_data(void *address, uint32_t size){
maybe_usb_setup_read(0x81, NULL, 0x200);
void *rbuf = get_endpoint_buffer(1);
for(int i= 0; i < size; i++){
*(char *)(void *)((int)rbuf + i) = *(char *)(void *)((int)address + i);
}
dwc
}
void send_data(uint32_t *address, uint32_t size) void send_data(uint32_t *address, uint32_t size)
{ {
// asm("stp x29, x30, [sp,#-48]!");; // asm("stp x29, x30, [sp,#-48]!");;
@ -79,7 +89,6 @@ void send_data(uint32_t *address, uint32_t size)
int main() { int main() {
while(1){ while(1){
recv_data(); recv_data();
send_data((uint32_t *) recv_buffer, 0x200);
} }

0
test_dwc3.ld → source/test_dwc3.ld
View File