From 6c2a2484e5b9a549793308ea0eebd4fe2d2f0b9d Mon Sep 17 00:00:00 2001 From: j4nn <531585+j4nn@users.noreply.github.com> Date: Sat, 13 Dec 2025 22:04:29 +0100 Subject: [PATCH] tama exploit extensions work in progress it could boot twrp one time --- README.rst | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++ target-p118.c | 35 ++++++++++++++++++-------- 2 files changed, 95 insertions(+), 10 deletions(-) diff --git a/README.rst b/README.rst index d0d576a..7c56e2a 100644 --- a/README.rst +++ b/README.rst @@ -575,6 +575,76 @@ and bootloader had been re-locked: product:H8266 +Trying to boot twrp with locked xz2 fails most of the time so far as exploited +fastboot state seems not to be stable enough or there may be a bug or something +still missing that needs to be implemented, so this is still work in progress. +But there has been eventually one case in which twrp booted successfully. + +.. raw:: html + +
+ two kernels exploit variant + +.. code-block:: + + $ ./xperable -v -v -V -V -B -U -x -x -x -5 -I boot_X-FLASH-ALL-B6B5.img -c twrp-akari.img -8 + {00000019->00000019:OK} 67 65 74 76 61 72 3a 76 65 72 73 69 6f 6e 2d 62 "getvar:version-bootloader" + {00000040<-00000027:OK} 4f 4b 41 59 31 33 31 30 2d 37 30 37 39 5f 58 5f "OKAY1310-7079_X_Boot_SDM845_LA2.0_P_118" + version-bootloader: 1310-7079_X_Boot_SDM845_LA2.0_P_118 + [.] Using p118 xperable target (offset = 0x2a7000, size = 0x400f90) + {0000000e->0000000e:OK} 67 65 74 76 61 72 3a 75 6e 6b 6e 6f 77 6e "getvar:unknown" + {00000040<-0000001d:OK} 46 41 49 4c 47 65 74 56 61 72 20 56 61 72 69 61 "FAILGetVar Variable Not found" + [.] Code boundary of LinuxLoader-p118.pe is 0x000fb000 + [+] Starting test5 size = 0x400f90, offset = 0x2a7000, payloadsize = 0xfb000 + {00400f90->00400f90:OK} 64 6f 77 6e 6c 6f 61 64 3a 30 30 30 66 62 30 31 "download:000fb010..............................................." + {00000040<-0000000d:OK} 44 41 54 41 78 e2 8e 98 00 00 00 00 00 "DATAx........" + [+] Got LinuxLoader base addr 0x988bc000 (0x988ee278) + {000fb000->000fb000:OK} 4d 5a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 "MZ..........................................................X..." + {00000040<-00000004:OK} 4f 4b 41 59 "OKAY" + {00000008->00000008:OK} 66 6c 61 73 68 3a 66 62 "flash:fb" + {00000040<-00000017:OK} 46 41 49 4c 39 38 38 42 43 30 30 30 2f 39 38 34 "FAIL988BC000/984C5000.." + [+] LinuxLoader @ 0x988bc000 patched successfully (usb buff @ 0x984c5000, distance = 0x003f7000) + [+] Starting test8 + [.] Code boundary of LinuxLoader-p118.pe is 0x000fb000 + [+] LinuxLoader @ 0x988bc000 already patched for test8 + {00000011->00000011:OK} 64 6f 77 6e 6c 6f 61 64 3a 30 36 62 35 61 30 31 "download:06b5a010" + {00000040<-0000000d:OK} 44 41 54 41 30 36 62 35 61 30 31 30 00 "DATA06b5a010." + {01000000->01000000:OK} 41 4e 44 52 4f 49 44 21 47 ef e5 00 00 80 00 00 "ANDROID!G...................................G..................." + {01000000->01000000:OK} 4d ae 7d 7f 8f 38 b9 18 72 7c 6e f9 3f 99 d8 3b "M.}..8..r|n.?..;yh-....`...:jm......C..W.......m......o.n......." + {01000000->01000000:OK} 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 "................................................................" + {01000000->01000000:OK} 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 "................................................................" + {01000000->01000000:OK} 00 a0 b5 02 00 00 00 00 41 4e 44 52 4f 49 44 21 "........ANDROID!C.......8...........................<&]........." + {01000000->01000000:OK} 8a 11 cf 16 ea 12 c1 d9 85 f2 ba f1 7a 65 51 7c "............zeQ|Z%*M7^.,.....hX....1j..0.W..'y;....Xu...A!N.T.^." + {00b5a010->00b5a010:OK} 59 1f 61 6c 59 6f 33 62 20 57 62 8d 08 83 3e af "Y.alYo3b Wb...>.N...........zL..Zlsod..1.~..l..m..O....i..7.k.vk" + {00000040<-00000004:OK} 4f 4b 41 59 "OKAY" + {00000004->00000004:OK} 62 6f 6f 74 "boot" + {00000040<-00000004:OK} 4f 4b 41 59 "OKAY" + [+] test8 succeeded + +.. raw:: html + +
+ +Although decryption did not work in this case, adb shell could be used. + +.. raw:: html + +
+ adb shell + +.. code-block:: + + akari:/ # uname -a + Linux localhost 4.9.186-perf+ #1 SMP PREEMPT Thu Oct 2 22:00:09 2025 aarch64 + + akari:/ # cat /proc/cmdline + rcupdate.rcu_expedited=1 androidboot.selinux=permissive androidboot.console=ttyMSM0 androidboot.hardware=qcom androidboot.usbcontroller=a600000.dwc3 lpm_levels.sleep_disabled=1 msm_rtb.filter=0x237 service_locator.enable=1 swiotlb=2048 ehci-hcd.park=3 androidboot.configfs=true loop.max_part=7 panic_on_err=1 msm_drm.dsi_display0=dsi_panel_cmd_display:config0 zram.backend=z3fold video=vfb:640x400,bpp=32,memsize=3072000 twrpfastboot=1 buildvariant=userdebug androidboot.verifiedbootstate=green androidboot.keymaster=1 dm="1 vroot none ro 1,0 8127088 verity 1 PARTUUID=c351ca12-1a0f-43aa-911e-99daf8ba5dcd PARTUUID=c351ca12-1a0f-43aa-911e-99daf8ba5dcd 4096 4096 1015886 1015886 sha1 a16d90654215feadb5413403b2f72f007bdea3c1 aee087a5be3b982978c923f566a94613496b417f2af592639bc80d141e34dfe7 10 restart_on_corruption ignore_zero_blocks use_fec_from_device PARTUUID=c351ca12-1a0f-43aa-911e-99daf8ba5dcd fec_roots 2 fec_blocks 1023887 fec_start 1023887" root=/dev/dm-0 androidboot.vbmeta.device=PARTUUID=6995d1b0-2855-4d80-9e2b-9a386e09bd5e androidboot.vbmeta.avb_version=1.0 androidboot.vbmeta.device_state=locked androidboot.vbmeta.hash_alg=sha256 androidboot.vbmeta.size=3456 androidboot.vbmeta.digest=1504743017b278b3371f673ed3653b5766a47d152a13475c8ac3794b91f67861 androidboot.vbmeta.invalidate_on_error=yes androidboot.veritymode=enforcing androidboot.bootdevice=1d84000.ufshc androidboot.baseband=sdm lcdid_adc=1310806 androidboot.slot_suffix=_b skip_initramfs rootwait ro init=/init oemandroidboot.imei=xxxxxxxxxxxxxx oemandroidboot.security=1 oemandroidboot.securityflags=0x00000002 + +.. raw:: html + +
+ + Linux Host Setup ---------------- diff --git a/target-p118.c b/target-p118.c index 72f18fe..2ac06e9 100644 --- a/target-p118.c +++ b/target-p118.c @@ -269,9 +269,10 @@ static void p118_setup_test5_hitcode(unsigned char *buff, int pos, int jmpto) static void p118_setup_test5(unsigned char *buff, int size, int offset, int payloadsize) { int i, j, idx; - //int bs = 0x1000; - int bs = 0x400; - int shift = 0x3f8; + int bs = 0x1000; + int shift = 0x0000; + //int bs = 0x0400; + //int shift = 0x03f8; memset(buff, 0, size); // for (i = 0x1000; i < size; i += 4) { @@ -292,9 +293,11 @@ static void p118_setup_test5(unsigned char *buff, int size, int offset, int payl idx += 0x20; \ } while (0) - HITENTRY(0x032274, 0x6152FF97, 0x0000, 0); - HITENTRY(0x032330, 0x003FFF97, 0x0000, -0xbc); - HITENTRY(0x006CFC, 0xD5FBFF97, 0x0040, 0x2b578); + HITENTRY(0x0050B0, 0x8FFCFF97, 0x0050, 0x2d1c4); // 0x03235C [0x0050B0] -> 0x50C0 + HITENTRY(0x032274, 0x6152FF97, 0x0000, 0); // 0x032274 -> 0x6BF8 + HITENTRY(0x006CFC, 0xD5FBFF97, 0x0040, 0x2b578); // 0x006CFC -> 0x5C50 + HITENTRY(0x006D48, 0x27FCFF97, 0x0040, 0x2b52c); // 0x006D48 -> 0x5DE4 + HITENTRY(0x032330, 0x003FFF97, 0x0000, -0xbc); // 0x032330 -> 0x1F30 HITENTRY(0x000000, 0x00000000, 0x0000, 0); for (i = offset + shift; i < size; i += bs) { @@ -309,8 +312,11 @@ static void p118_setup_test5(unsigned char *buff, int size, int offset, int payl //p118_setup_test5_hitcode(buff, i + 0x0f30, 0x1bf8); // 0x032330 -> 0x1F30 //p118_setup_test5_hitcode(buff, i + 0x0000, 0x0000); // 0x032274 -> 0x6BF8 //p118_setup_test5_hitcode(buff, i + 0x0338, 0x0000); // 0x032330 -> 0x1F30 - //p118_setup_test5_hitcode(buff, i + ((0x0bf8 - shift) & (bs - 1)), 0x0000); // 0x032274 -> 0x6BF8 - p118_setup_test5_hitcode(buff, i + ((0x0c50 - shift) & (bs - 1)), 0x0000); // 0x006CFC -> 0x5C50 !!needs hitcode size max 0x58 to fit after 0x0bf8, partial cache of hex2uint64 with "download:0"!! + + //p118_setup_test5_hitcode(buff, i + ((0x00c0 - shift) & (bs - 1)), 0x0000); // 0x03235C [0x0050B0] -> 0x50C0 + p118_setup_test5_hitcode(buff, i + ((0x0bf8 - shift) & (bs - 1)), 0x0000); // 0x032274 -> 0x6BF8 + //p118_setup_test5_hitcode(buff, i + ((0x0c50 - shift) & (bs - 1)), 0x0000); // 0x006CFC -> 0x5C50 !!needs hitcode size max 0x58 to fit after 0x0bf8, partial cache of hex2uint64 with "download:0"!! + p118_setup_test5_hitcode(buff, i + ((0x0de4 - shift) & (bs - 1)), 0x0000); // 0x006D48 -> 0x5DE4 p118_setup_test5_hitcode(buff, i + ((0x0f30 - shift) & (bs - 1)), 0x0000); // 0x032330 -> 0x1F30 //OPCODE(buff + i + ((0x0f58 - shift) & (bs - 1)), 0xc0, 0x03, 0x5f, 0xd6); // 0x0070D0 -> 0x6F88 ret = [ c0 03 5f d6 ] @@ -379,13 +385,15 @@ static void p118_patch_abl(unsigned char *ablcode, int extended) OPCODE(ablcode + 0x2FA9C + 0x10, 0xe8, 0xff, 0xff, 0x17); // b #-0x60 = [ e8 ff ff 17 ] // patch debug logging verbosity check to always be the most verbose +//#if 0 OPCODE(ablcode + 0x07D68 + 0x00, 0x00, 0x00, 0x80, 0x12); // mov w0, #-1 = [ 00 00 80 12 ] //OPCODE(ablcode + 0x07D68 + 0x00, 0xe0, 0x03, 0x1f, 0xaa); // mov x0, xzr = [ e0 03 1f aa ] OPCODE(ablcode + 0x07D68 + 0x04, 0xc0, 0x03, 0x5f, 0xd6); // ret = [ c0 03 5f d6 ] - //*(uint8_t *)(ablcode + 0xB98EC) = 0xff; // more debug logging maybe - *(uint8_t *)(ablcode + 0xB98EC) = 0xfe; // more debug logging possibly with disabled asserts + *(uint8_t *)(ablcode + 0xB98EC) = 0xff; // more debug logging maybe + //*(uint8_t *)(ablcode + 0xB98EC) = 0xfe; // more debug logging possibly with disabled asserts //*(uint8_t *)(ablcode + 0xB98EC) = 0x2e; // just disable asserts (original value was 0x2f) //*(uint8_t *)(ablcode + 0xB98EC) = 0x00; // disable debug logging for hopefully better stability +//#endif // patch the "oem unlock" command to directly set unlock state with 'X' for 0 (locked) or with 'Y' for 1 (unlocked) @@ -603,6 +611,13 @@ static void p118_patch_abl(unsigned char *ablcode, int extended) if (extended > 2) p118_test8_patch(ablcode, 0, 0); + + OPCODE(ablcode + 0x31CA4, 0x1f, 0x20, 0x03, 0xd5); // nop = [ 1f 20 03 d5 ] + OPCODE(ablcode + 0x03764, 0xc0, 0x03, 0x5f, 0xd6); // ret = [ c0 03 5f d6 ] + + OPCODE(ablcode + 0x36AB4, 0x00, 0x00, 0xc0, 0x14); // b #0x3000000 = [ 00 00 c0 14 ] + OPCODE(ablcode + 0x58AF0 + 0x00, 0xe0, 0x03, 0x1f, 0xaa); // mov x0, xzr = [ e0 03 1f aa ] + OPCODE(ablcode + 0x58AF0 + 0x04, 0xc0, 0x03, 0x5f, 0xd6); // ret = [ c0 03 5f d6 ] } static const int p118_vb_size = 0xc000;