cuynu/tama_unbrick
Watch
1
Fork
You've already forked tama_unbrick
 0
Code Issues Pull requests Projects Releases Wiki Activity

docs: adapt new katana & change fhcoyote* url & minor changes

Browse source 
Signed-off-by: Cuynu <cuynu@proton.me>
This commit is contained in:
Cuynu 2026-07-23 23:09:42 +07:00
commit 040dbb1624
Signed by: cuynu
GPG key ID: 1F01341D0B42B51A
1 changed files with 36 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

67
README.md
View file

@ -43,7 +43,7 @@ EDLClient : https://github.com/bkerler/edl
## Start
- You need to enter EDL mode first, if the device has corrupted `xfl` or `xbl` and the light does not show up then you can just connect USB charger then it will automatically enter EDL
- You need to enter EDL mode first, with Testpoint or EDL cable. if the device is entering EDL due to corrupted bootloader (eg: XBL is corrupted), then it will not work, you can't use that EDL mode.
- In case if the device is blinking/stuck at red light of death when connect charger, or keep blinking or just blink once with green light when you hold power button, you need to short testpoint to enter EDL mode.
Find testpoint here
@ -132,7 +132,7 @@ Then try `cd .. && pip install . --break-system-packages` to install again.
Clone and prepare BootROM exploit tool (`fhcoyote_sdm845` is used to providing pre-built binaries)
```
git clone https://git.disroot.org/cuynu/fhcoyote_sdm845.git
git clone https://codefloe.com/cuynu/fhcoyote_sdm845.git
git clone https://github.com/Daniel224455/katana.git
cd katana
pip install -r requirements.txt --break-system-packages
@ -142,43 +142,44 @@ cp ../fhcoyote_sdm845.git/*.elf .
Run the exploit
```
python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf -vid 0fce -p ade5
python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf -vid 0x0FCE -pid 0xADE5
```
Output should be like this (katana banner removed)
```
2026-07-04 16:12:23
Qualcomm BootROM Exploit - CVE-2021-30327
Version 1.0 (c) 2025 Daniel224455 <danalexgro@gmail.com> - github.com/Daniel224455/katana
Selected SoC: sdm845
Searching for Qualcomm device in Sahara state
Found device!
Connected to device
Sahara version 2
Device is in PBL Sahara
Starting exploit
Coyote payload detected
Sending payload segment, offset=0x0 size=0x40
Sending payload segment, offset=0x40 size=0x428
Sending payload segment, offset=0x1000 size=0x1000
Transferred payload, now trying to get our shellcode to execute!
Transferring nulls to satisfy PBL
Executing shellcode
Your BootROM is now pwned!
You can now run testsigned firehoses
Releasing USB after reinit by payload
Device released.
Reconnecting
Searching for Qualcomm device in Sahara state
Found device!
Connected to device
Checking if sahara was reinitialized correctly
Transfer complete, telling PBL it's done
Loader uploaded successfully
Device released.
2026-07-23 22:26:31 Selected SoC: sdm845
2026-07-23 22:26:31 Waiting for Qualcomm device in Sahara state
2026-07-23 22:26:31 Found device!
2026-07-23 22:26:31 Connected to device
2026-07-23 22:26:31 Sahara version 2
2026-07-23 22:26:31 Device is in PBL Sahara
2026-07-23 22:26:31 Starting exploit
2026-07-23 22:26:31 Coyote payload detected
2026-07-23 22:26:31 Sending payload segment, offset=0x0 size=0x40
2026-07-23 22:26:31 Sending payload segment, offset=0x40 size=0x428
2026-07-23 22:26:31 Sending payload segment, offset=0x1000 size=0x1000
2026-07-23 22:26:31 Payload transferred
2026-07-23 22:26:31 The BootROM is still requesting data, uploading nulls
2026-07-23 22:26:31 BootROM received all requested data
2026-07-23 22:26:31 Corrupting memory beyond available stack space
2026-07-23 22:26:31 Executing Payload
2026-07-23 22:26:31 Got code execution in EL3, which means your BootROM is now pwned!
2026-07-23 22:26:32 You can now run testsigned firehoses
2026-07-23 22:26:32 Releasing USB after reinitialization by payload
2026-07-23 22:26:32 Device released.
2026-07-23 22:26:32 Reconnecting
2026-07-23 22:26:32 Waiting for Qualcomm device in Sahara state
2026-07-23 22:26:32 Found device!
2026-07-23 22:26:32 Connected to device
2026-07-23 22:26:32 Checking if Sahara was reinitialized correctly
2026-07-23 22:26:32 Sahara was reinited correctly
2026-07-23 22:26:32 Transfer complete, telling PBL it's done
2026-07-23 22:26:32 Loader uploaded successfully
2026-07-23 22:26:32 Device released.
2026-07-23 22:26:32 Exploit finished!
```
If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint, or replug then connect (if xbl,xfl is corrupted) then try again.
If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint (or use EDL cable) then try again.
## Backup necessary UNIQUE partitions
> [!WARNING]