Compare commits

...

2 Commits

Author SHA1 Message Date
Jonathan Herrewijnen
5aa1331a52 small docs update 2024-08-03 15:38:10 +02:00
Jonathan Herrewijnen
33d3d38d5c add incomplete readme and requirements.txt 2024-08-03 15:37:57 +02:00
4 changed files with 5044 additions and 3 deletions

View File

@ -1,3 +1,12 @@
# Samsung_S7
Code to exploit and research the Exynos Bootrom.
Code to exploit and research the Exynos Bootrom
## Setting up
Create a venv, and intall ghidra_assistant.
```bash
python3 -m venv venv
. venv/bin/activate
pip install -r requirements.txts
```
To get to work, run `source/exploit/exploit.py`

View File

@ -21,7 +21,7 @@ To extract the sboot.bin file from a samsung firmware file:
Memory Layout
-------------
TODO make memory layout of ROM, IMEM and some devices
TODO make memory layout of ROM, IMEM and some devices @JONHE
.. figure:: images/memory_layout.drawio.svg
@ -49,10 +49,44 @@ dldata
This protocol remains *mostly* the same for newer Exynos SoCs.
USB Stack
=========
This information is largely based on the blogpost of Frederic on reversing the `USB stack of the Exynos BootROM <https://fredericb.info/2020/06/reverse-engineer-usb-stack-of-exynos-bootrom.html#reverse-engineer-usb-stack-of-exynos-bootrom>`_. We're looking at the proprietary USB protocol used by the Exynos BootROM.
The base address of the usb controller (dwusb3) is mapped at 0x1540000, with a size of 0x10000: (can be found at: `Exynos8890 dtsi <https://github.com/LineageOS/android_kernel_samsung_universal8890/tree/lineage-18.1/arch/arm64/boot/dts>`_).
.. code-block:: dts
udc: usb@15400000 {
compatible = "samsung,exynos8890-dwusb3";
clocks = <&clock 700>, <&clock 703>, <&clock 708>, <&clock 709>;
clock-names = "aclk", "sclk", "phyclock", "pipe_pclk";
reg = <0x0 0x15400000 0x10000>;
#address-cells = <2>;
#size-cells = <1>;
ranges;
usb-pm-qos-int = <255000>;
status = "disabled";
usbdrd_dwc3: dwc3 {
compatible = "synopsys,dwc3";
reg = <0x0 0x15400000 0x10000>;
interrupts = <0 213 0>;
phys = <&usbdrd_phy0 0>, <&usbdrd_phy0 1>;
phy-names = "usb2-phy", "usb3-phy";
};
};c
This is a basic USB controller, but some functions, that are also present in the linux kernel, should be visible in the bootROM as well. Available functions could be: `linux-kernel-dwc3 <https://android.googlesource.com/kernel/msm/+/android-msm-dory-3.10-kitkat-wear/drivers/usb/dwc3/core.h>`_.
Bug 1(Integer underflow)
------------------------
@TODO better explain frederick's bug. @JOHER
https://github.com/LineageOS/android_kernel_samsung_universal8890/blob/lineage-18.1/arch/arm64/boot/dts/exynos8890.dtsi
@TODO better explain frederick's bug. @JONHE
Bug 2
-----

3
requirements.txt Normal file
View File

@ -0,0 +1,3 @@
sphinx-rtd-theme
sphinxcontrib.confluencebuilder
sphinxcontrib.drawio

File diff suppressed because it is too large Load Diff