Merge branch 'main' of ssh://git.herreweb.nl:3022/EljakimHerrewijnen/Samsung_S7

README.md

@@ -1,3 +1,12 @@
 # Samsung_S7
+Code to exploit and research the Exynos Bootrom.
 
-Code to exploit and research the Exynos Bootrom
+## Setting up
+Create a venv, and intall ghidra_assistant.
+```bash
+python3 -m venv venv
+. venv/bin/activate
+pip install -r requirements.txts
+```
+
+To get to work, run `source/exploit/exploit.py`

documentation/source/BootROM_8890/index.rst

@@ -21,7 +21,7 @@ To extract the sboot.bin file from a samsung firmware file:
 
 Memory Layout
 -------------
-TODO make memory layout of ROM, IMEM and some devices
+TODO make memory layout of ROM, IMEM and some devices @JONHE
 
 .. figure:: images/memory_layout.drawio.svg
 
@@ -49,10 +49,44 @@ dldata
 
     This protocol remains *mostly* the same for newer Exynos SoCs. 
 
+USB Stack
+=========
+This information is largely based on the blogpost of Frederic on reversing the `USB stack of the Exynos BootROM <https://fredericb.info/2020/06/reverse-engineer-usb-stack-of-exynos-bootrom.html#reverse-engineer-usb-stack-of-exynos-bootrom>`_. We're looking at the proprietary USB protocol used by the Exynos BootROM.
+
+The base address of the usb controller (dwusb3) is mapped at 0x1540000, with a size of 0x10000: (can be found at: `Exynos8890 dtsi <https://github.com/LineageOS/android_kernel_samsung_universal8890/tree/lineage-18.1/arch/arm64/boot/dts>`_). 
+
+.. code-block:: dts
+
+	udc: usb@15400000 {
+		compatible = "samsung,exynos8890-dwusb3";
+		clocks = <&clock 700>, <&clock 703>, <&clock 708>, <&clock 709>;
+		clock-names = "aclk", "sclk", "phyclock", "pipe_pclk";
+		reg = <0x0 0x15400000 0x10000>;
+		#address-cells = <2>;
+		#size-cells = <1>;
+		ranges;
+		usb-pm-qos-int = <255000>;
+		status = "disabled";
+
+		usbdrd_dwc3: dwc3 {
+			compatible = "synopsys,dwc3";
+			reg = <0x0 0x15400000 0x10000>;
+			interrupts = <0 213 0>;
+			phys = <&usbdrd_phy0 0>, <&usbdrd_phy0 1>;
+			phy-names = "usb2-phy", "usb3-phy";
+		};
+	};c
+
+
+This is a basic USB controller, but some functions, that are also present in the linux kernel, should be visible in the bootROM as well. Available functions could be: `linux-kernel-dwc3 <https://android.googlesource.com/kernel/msm/+/android-msm-dory-3.10-kitkat-wear/drivers/usb/dwc3/core.h>`_.
 
 Bug 1(Integer underflow)
 ------------------------
-@TODO better explain frederick's bug. @JOHER
+
+https://github.com/LineageOS/android_kernel_samsung_universal8890/blob/lineage-18.1/arch/arm64/boot/dts/exynos8890.dtsi
+
+@TODO better explain frederick's bug. @JONHE
+
 
 Bug 2
 -----

requirements.txt

@@ -0,0 +1,3 @@
+sphinx-rtd-theme
+sphinxcontrib.confluencebuilder
+sphinxcontrib.drawio