tama exploit extensions work in progress
it could boot twrp one time
This commit is contained in:
j4nn
parent
49e94e7218
commit
6c2a2484e5
2 changed files with 95 additions and 10 deletions
70
README.rst
70
README.rst
|
|
@ -575,6 +575,76 @@ and bootloader had been re-locked:
|
|||
product:H8266
|
||||
|
||||
|
||||
Trying to boot twrp with locked xz2 fails most of the time so far as exploited
|
||||
fastboot state seems not to be stable enough or there may be a bug or something
|
||||
still missing that needs to be implemented, so this is still work in progress.
|
||||
But there has been eventually one case in which twrp booted successfully.
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<details>
|
||||
<summary><a>two kernels exploit variant</a></summary>
|
||||
|
||||
.. code-block::
|
||||
|
||||
$ ./xperable -v -v -V -V -B -U -x -x -x -5 -I boot_X-FLASH-ALL-B6B5.img -c twrp-akari.img -8
|
||||
{00000019->00000019:OK} 67 65 74 76 61 72 3a 76 65 72 73 69 6f 6e 2d 62 "getvar:version-bootloader"
|
||||
{00000040<-00000027:OK} 4f 4b 41 59 31 33 31 30 2d 37 30 37 39 5f 58 5f "OKAY1310-7079_X_Boot_SDM845_LA2.0_P_118"
|
||||
version-bootloader: 1310-7079_X_Boot_SDM845_LA2.0_P_118
|
||||
[.] Using p118 xperable target (offset = 0x2a7000, size = 0x400f90)
|
||||
{0000000e->0000000e:OK} 67 65 74 76 61 72 3a 75 6e 6b 6e 6f 77 6e "getvar:unknown"
|
||||
{00000040<-0000001d:OK} 46 41 49 4c 47 65 74 56 61 72 20 56 61 72 69 61 "FAILGetVar Variable Not found"
|
||||
[.] Code boundary of LinuxLoader-p118.pe is 0x000fb000
|
||||
[+] Starting test5 size = 0x400f90, offset = 0x2a7000, payloadsize = 0xfb000
|
||||
{00400f90->00400f90:OK} 64 6f 77 6e 6c 6f 61 64 3a 30 30 30 66 62 30 31 "download:000fb010..............................................."
|
||||
{00000040<-0000000d:OK} 44 41 54 41 78 e2 8e 98 00 00 00 00 00 "DATAx........"
|
||||
[+] Got LinuxLoader base addr 0x988bc000 (0x988ee278)
|
||||
{000fb000->000fb000:OK} 4d 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 "MZ..........................................................X..."
|
||||
{00000040<-00000004:OK} 4f 4b 41 59 "OKAY"
|
||||
{00000008->00000008:OK} 66 6c 61 73 68 3a 66 62 "flash:fb"
|
||||
{00000040<-00000017:OK} 46 41 49 4c 39 38 38 42 43 30 30 30 2f 39 38 34 "FAIL988BC000/984C5000.."
|
||||
[+] LinuxLoader @ 0x988bc000 patched successfully (usb buff @ 0x984c5000, distance = 0x003f7000)
|
||||
[+] Starting test8
|
||||
[.] Code boundary of LinuxLoader-p118.pe is 0x000fb000
|
||||
[+] LinuxLoader @ 0x988bc000 already patched for test8
|
||||
{00000011->00000011:OK} 64 6f 77 6e 6c 6f 61 64 3a 30 36 62 35 61 30 31 "download:06b5a010"
|
||||
{00000040<-0000000d:OK} 44 41 54 41 30 36 62 35 61 30 31 30 00 "DATA06b5a010."
|
||||
{01000000->01000000:OK} 41 4e 44 52 4f 49 44 21 47 ef e5 00 00 80 00 00 "ANDROID!G...................................G..................."
|
||||
{01000000->01000000:OK} 4d ae 7d 7f 8f 38 b9 18 72 7c 6e f9 3f 99 d8 3b "M.}..8..r|n.?..;yh-....`...:jm......C..W.......m......o.n......."
|
||||
{01000000->01000000:OK} 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 "................................................................"
|
||||
{01000000->01000000:OK} 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 "................................................................"
|
||||
{01000000->01000000:OK} 00 a0 b5 02 00 00 00 00 41 4e 44 52 4f 49 44 21 "........ANDROID!C.......8...........................<&]........."
|
||||
{01000000->01000000:OK} 8a 11 cf 16 ea 12 c1 d9 85 f2 ba f1 7a 65 51 7c "............zeQ|Z%*M7^.,.....hX....1j..0.W..'y;....Xu...A!N.T.^."
|
||||
{00b5a010->00b5a010:OK} 59 1f 61 6c 59 6f 33 62 20 57 62 8d 08 83 3e af "Y.alYo3b Wb...>.N...........zL..Zlsod..1.~..l..m..O....i..7.k.vk"
|
||||
{00000040<-00000004:OK} 4f 4b 41 59 "OKAY"
|
||||
{00000004->00000004:OK} 62 6f 6f 74 "boot"
|
||||
{00000040<-00000004:OK} 4f 4b 41 59 "OKAY"
|
||||
[+] test8 succeeded
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</details>
|
||||
|
||||
Although decryption did not work in this case, adb shell could be used.
|
||||
|
||||
.. raw:: html
|
||||
|
||||
<details>
|
||||
<summary><a>adb shell</a></summary>
|
||||
|
||||
.. code-block::
|
||||
|
||||
akari:/ # uname -a
|
||||
Linux localhost 4.9.186-perf+ #1 SMP PREEMPT Thu Oct 2 22:00:09 2025 aarch64
|
||||
|
||||
akari:/ # cat /proc/cmdline
|
||||
rcupdate.rcu_expedited=1 androidboot.selinux=permissive androidboot.console=ttyMSM0 androidboot.hardware=qcom androidboot.usbcontroller=a600000.dwc3 lpm_levels.sleep_disabled=1 msm_rtb.filter=0x237 service_locator.enable=1 swiotlb=2048 ehci-hcd.park=3 androidboot.configfs=true loop.max_part=7 panic_on_err=1 msm_drm.dsi_display0=dsi_panel_cmd_display:config0 zram.backend=z3fold video=vfb:640x400,bpp=32,memsize=3072000 twrpfastboot=1 buildvariant=userdebug androidboot.verifiedbootstate=green androidboot.keymaster=1 dm="1 vroot none ro 1,0 8127088 verity 1 PARTUUID=c351ca12-1a0f-43aa-911e-99daf8ba5dcd PARTUUID=c351ca12-1a0f-43aa-911e-99daf8ba5dcd 4096 4096 1015886 1015886 sha1 a16d90654215feadb5413403b2f72f007bdea3c1 aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7 10 restart_on_corruption ignore_zero_blocks use_fec_from_device PARTUUID=c351ca12-1a0f-43aa-911e-99daf8ba5dcd fec_roots 2 fec_blocks 1023887 fec_start 1023887" root=/dev/dm-0 androidboot.vbmeta.device=PARTUUID=6995d1b0-2855-4d80-9e2b-9a386e09bd5e androidboot.vbmeta.avb_version=1.0 androidboot.vbmeta.device_state=locked androidboot.vbmeta.hash_alg=sha256 androidboot.vbmeta.size=3456 androidboot.vbmeta.digest=1504743017b278b3371f673ed3653b5766a47d152a13475c8ac3794b91f67861 androidboot.vbmeta.invalidate_on_error=yes androidboot.veritymode=enforcing androidboot.bootdevice=1d84000.ufshc androidboot.baseband=sdm lcdid_adc=1310806 androidboot.slot_suffix=_b skip_initramfs rootwait ro init=/init oemandroidboot.imei=xxxxxxxxxxxxxx oemandroidboot.security=1 oemandroidboot.securityflags=0x00000002
|
||||
|
||||
.. raw:: html
|
||||
|
||||
</details>
|
||||
|
||||
|
||||
Linux Host Setup
|
||||
----------------
|
||||
|
||||
|
|
|
|||
|
|
@ -269,9 +269,10 @@ static void p118_setup_test5_hitcode(unsigned char *buff, int pos, int jmpto)
|
|||
static void p118_setup_test5(unsigned char *buff, int size, int offset, int payloadsize)
|
||||
{
|
||||
int i, j, idx;
|
||||
//int bs = 0x1000;
|
||||
int bs = 0x400;
|
||||
int shift = 0x3f8;
|
||||
int bs = 0x1000;
|
||||
int shift = 0x0000;
|
||||
//int bs = 0x0400;
|
||||
//int shift = 0x03f8;
|
||||
|
||||
memset(buff, 0, size);
|
||||
// for (i = 0x1000; i < size; i += 4) {
|
||||
|
|
@ -292,9 +293,11 @@ static void p118_setup_test5(unsigned char *buff, int size, int offset, int payl
|
|||
idx += 0x20; \
|
||||
} while (0)
|
||||
|
||||
HITENTRY(0x032274, 0x6152FF97, 0x0000, 0);
|
||||
HITENTRY(0x032330, 0x003FFF97, 0x0000, -0xbc);
|
||||
HITENTRY(0x006CFC, 0xD5FBFF97, 0x0040, 0x2b578);
|
||||
HITENTRY(0x0050B0, 0x8FFCFF97, 0x0050, 0x2d1c4); // 0x03235C [0x0050B0] -> 0x50C0
|
||||
HITENTRY(0x032274, 0x6152FF97, 0x0000, 0); // 0x032274 -> 0x6BF8
|
||||
HITENTRY(0x006CFC, 0xD5FBFF97, 0x0040, 0x2b578); // 0x006CFC -> 0x5C50
|
||||
HITENTRY(0x006D48, 0x27FCFF97, 0x0040, 0x2b52c); // 0x006D48 -> 0x5DE4
|
||||
HITENTRY(0x032330, 0x003FFF97, 0x0000, -0xbc); // 0x032330 -> 0x1F30
|
||||
HITENTRY(0x000000, 0x00000000, 0x0000, 0);
|
||||
|
||||
for (i = offset + shift; i < size; i += bs) {
|
||||
|
|
@ -309,8 +312,11 @@ static void p118_setup_test5(unsigned char *buff, int size, int offset, int payl
|
|||
//p118_setup_test5_hitcode(buff, i + 0x0f30, 0x1bf8); // 0x032330 -> 0x1F30
|
||||
//p118_setup_test5_hitcode(buff, i + 0x0000, 0x0000); // 0x032274 -> 0x6BF8
|
||||
//p118_setup_test5_hitcode(buff, i + 0x0338, 0x0000); // 0x032330 -> 0x1F30
|
||||
//p118_setup_test5_hitcode(buff, i + ((0x0bf8 - shift) & (bs - 1)), 0x0000); // 0x032274 -> 0x6BF8
|
||||
p118_setup_test5_hitcode(buff, i + ((0x0c50 - shift) & (bs - 1)), 0x0000); // 0x006CFC -> 0x5C50 !!needs hitcode size max 0x58 to fit after 0x0bf8, partial cache of hex2uint64 with "download:0"!!
|
||||
|
||||
//p118_setup_test5_hitcode(buff, i + ((0x00c0 - shift) & (bs - 1)), 0x0000); // 0x03235C [0x0050B0] -> 0x50C0
|
||||
p118_setup_test5_hitcode(buff, i + ((0x0bf8 - shift) & (bs - 1)), 0x0000); // 0x032274 -> 0x6BF8
|
||||
//p118_setup_test5_hitcode(buff, i + ((0x0c50 - shift) & (bs - 1)), 0x0000); // 0x006CFC -> 0x5C50 !!needs hitcode size max 0x58 to fit after 0x0bf8, partial cache of hex2uint64 with "download:0"!!
|
||||
p118_setup_test5_hitcode(buff, i + ((0x0de4 - shift) & (bs - 1)), 0x0000); // 0x006D48 -> 0x5DE4
|
||||
p118_setup_test5_hitcode(buff, i + ((0x0f30 - shift) & (bs - 1)), 0x0000); // 0x032330 -> 0x1F30
|
||||
//OPCODE(buff + i + ((0x0f58 - shift) & (bs - 1)), 0xc0, 0x03, 0x5f, 0xd6); // 0x0070D0 -> 0x6F88 ret = [ c0 03 5f d6 ]
|
||||
|
||||
|
|
@ -379,13 +385,15 @@ static void p118_patch_abl(unsigned char *ablcode, int extended)
|
|||
OPCODE(ablcode + 0x2FA9C + 0x10, 0xe8, 0xff, 0xff, 0x17); // b #-0x60 = [ e8 ff ff 17 ]
|
||||
|
||||
// patch debug logging verbosity check to always be the most verbose
|
||||
//#if 0
|
||||
OPCODE(ablcode + 0x07D68 + 0x00, 0x00, 0x00, 0x80, 0x12); // mov w0, #-1 = [ 00 00 80 12 ]
|
||||
//OPCODE(ablcode + 0x07D68 + 0x00, 0xe0, 0x03, 0x1f, 0xaa); // mov x0, xzr = [ e0 03 1f aa ]
|
||||
OPCODE(ablcode + 0x07D68 + 0x04, 0xc0, 0x03, 0x5f, 0xd6); // ret = [ c0 03 5f d6 ]
|
||||
//*(uint8_t *)(ablcode + 0xB98EC) = 0xff; // more debug logging maybe
|
||||
*(uint8_t *)(ablcode + 0xB98EC) = 0xfe; // more debug logging possibly with disabled asserts
|
||||
*(uint8_t *)(ablcode + 0xB98EC) = 0xff; // more debug logging maybe
|
||||
//*(uint8_t *)(ablcode + 0xB98EC) = 0xfe; // more debug logging possibly with disabled asserts
|
||||
//*(uint8_t *)(ablcode + 0xB98EC) = 0x2e; // just disable asserts (original value was 0x2f)
|
||||
//*(uint8_t *)(ablcode + 0xB98EC) = 0x00; // disable debug logging for hopefully better stability
|
||||
//#endif
|
||||
|
||||
|
||||
// patch the "oem unlock" command to directly set unlock state with 'X' for 0 (locked) or with 'Y' for 1 (unlocked)
|
||||
|
|
@ -603,6 +611,13 @@ static void p118_patch_abl(unsigned char *ablcode, int extended)
|
|||
|
||||
if (extended > 2)
|
||||
p118_test8_patch(ablcode, 0, 0);
|
||||
|
||||
OPCODE(ablcode + 0x31CA4, 0x1f, 0x20, 0x03, 0xd5); // nop = [ 1f 20 03 d5 ]
|
||||
OPCODE(ablcode + 0x03764, 0xc0, 0x03, 0x5f, 0xd6); // ret = [ c0 03 5f d6 ]
|
||||
|
||||
OPCODE(ablcode + 0x36AB4, 0x00, 0x00, 0xc0, 0x14); // b #0x3000000 = [ 00 00 c0 14 ]
|
||||
OPCODE(ablcode + 0x58AF0 + 0x00, 0xe0, 0x03, 0x1f, 0xaa); // mov x0, xzr = [ e0 03 1f aa ]
|
||||
OPCODE(ablcode + 0x58AF0 + 0x04, 0xc0, 0x03, 0x5f, 0xd6); // ret = [ c0 03 5f d6 ]
|
||||
}
|
||||
|
||||
static const int p118_vb_size = 0xc000;
|
||||
|
|
|
|||
Loading…
Reference in a new issue