From 040dbb16240ffb9874e143dd8ea7a0b16066e5b4 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Thu, 23 Jul 2026 23:09:42 +0700 Subject: [PATCH] docs: adapt new katana & change fhcoyote* url & minor changes Signed-off-by: Cuynu --- README.md | 67 ++++++++++++++++++++++++++++--------------------------- 1 file changed, 34 insertions(+), 33 deletions(-) diff --git a/README.md b/README.md index 2ebcfb2..a51a5cc 100644 --- a/README.md +++ b/README.md @@ -43,7 +43,7 @@ EDLClient : https://github.com/bkerler/edl ## Start -- You need to enter EDL mode first, if the device has corrupted `xfl` or `xbl` and the light does not show up then you can just connect USB charger then it will automatically enter EDL +- You need to enter EDL mode first, with Testpoint or EDL cable. if the device is entering EDL due to corrupted bootloader (eg: XBL is corrupted), then it will not work, you can't use that EDL mode. - In case if the device is blinking/stuck at red light of death when connect charger, or keep blinking or just blink once with green light when you hold power button, you need to short testpoint to enter EDL mode. Find testpoint here @@ -132,7 +132,7 @@ Then try `cd .. && pip install . --break-system-packages` to install again. Clone and prepare BootROM exploit tool (`fhcoyote_sdm845` is used to providing pre-built binaries) ``` -git clone https://git.disroot.org/cuynu/fhcoyote_sdm845.git +git clone https://codefloe.com/cuynu/fhcoyote_sdm845.git git clone https://github.com/Daniel224455/katana.git cd katana pip install -r requirements.txt --break-system-packages @@ -142,43 +142,44 @@ cp ../fhcoyote_sdm845.git/*.elf . Run the exploit ``` -python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf -vid 0fce -p ade5 +python katana.py -s sdm845 -e sdm845-exploit-coyote.elf -f prog_firehose_ddr.elf -vid 0x0FCE -pid 0xADE5 ``` Output should be like this (katana banner removed) ``` -2026-07-04 16:12:23 -Qualcomm BootROM Exploit - CVE-2021-30327 -Version 1.0 (c) 2025 Daniel224455 - github.com/Daniel224455/katana -Selected SoC: sdm845 -Searching for Qualcomm device in Sahara state -Found device! -Connected to device -Sahara version 2 -Device is in PBL Sahara -Starting exploit -Coyote payload detected -Sending payload segment, offset=0x0 size=0x40 -Sending payload segment, offset=0x40 size=0x428 -Sending payload segment, offset=0x1000 size=0x1000 -Transferred payload, now trying to get our shellcode to execute! -Transferring nulls to satisfy PBL -Executing shellcode -Your BootROM is now pwned! -You can now run testsigned firehoses -Releasing USB after reinit by payload -Device released. -Reconnecting -Searching for Qualcomm device in Sahara state -Found device! -Connected to device -Checking if sahara was reinitialized correctly -Transfer complete, telling PBL it's done -Loader uploaded successfully -Device released. +2026-07-23 22:26:31 Selected SoC: sdm845 +2026-07-23 22:26:31 Waiting for Qualcomm device in Sahara state +2026-07-23 22:26:31 Found device! +2026-07-23 22:26:31 Connected to device +2026-07-23 22:26:31 Sahara version 2 +2026-07-23 22:26:31 Device is in PBL Sahara +2026-07-23 22:26:31 Starting exploit +2026-07-23 22:26:31 Coyote payload detected +2026-07-23 22:26:31 Sending payload segment, offset=0x0 size=0x40 +2026-07-23 22:26:31 Sending payload segment, offset=0x40 size=0x428 +2026-07-23 22:26:31 Sending payload segment, offset=0x1000 size=0x1000 +2026-07-23 22:26:31 Payload transferred +2026-07-23 22:26:31 The BootROM is still requesting data, uploading nulls +2026-07-23 22:26:31 BootROM received all requested data +2026-07-23 22:26:31 Corrupting memory beyond available stack space +2026-07-23 22:26:31 Executing Payload +2026-07-23 22:26:31 Got code execution in EL3, which means your BootROM is now pwned! +2026-07-23 22:26:32 You can now run testsigned firehoses +2026-07-23 22:26:32 Releasing USB after reinitialization by payload +2026-07-23 22:26:32 Device released. +2026-07-23 22:26:32 Reconnecting +2026-07-23 22:26:32 Waiting for Qualcomm device in Sahara state +2026-07-23 22:26:32 Found device! +2026-07-23 22:26:32 Connected to device +2026-07-23 22:26:32 Checking if Sahara was reinitialized correctly +2026-07-23 22:26:32 Sahara was reinited correctly +2026-07-23 22:26:32 Transfer complete, telling PBL it's done +2026-07-23 22:26:32 Loader uploaded successfully +2026-07-23 22:26:32 Device released. +2026-07-23 22:26:32 Exploit finished! ``` -If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint, or replug then connect (if xbl,xfl is corrupted) then try again. +If the tool is fail to exploit, re-enter EDL mode by unplugging battery, short testpoint (or use EDL cable) then try again. ## Backup necessary UNIQUE partitions > [!WARNING]