GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → frederic → exynos-usbdl

frederic / exynos-usbdl

Licence: GPL-3.0 license
Unsigned code loader for Exynos BootROM

Programming Languages

c
50402 projects - #5 most used programming language
assembly
5116 projects
shell
77523 projects
Makefile
30231 projects

Labels

armusbexploitvulnerabilitysamsungsecure-bootexynosbootrom

Projects that are alternatives of or similar to exynos-usbdl

qemu-exynos-bootrom
Emulating Exynos 4210 BootROM in QEMU
Stars: ✭ 49 (-14.04%)
Mutual labels:  samsung, secure-boot, exynos, bootrom
Mtpwn
PoC exploit for arbitrary file read/write in locked Samsung Android device via MTP (SVE-2017-10086)
Stars: ✭ 143 (+150.88%)
Mutual labels:  usb, exploit, samsung
Ehal
Embedded Hardware Abstraction Library
Stars: ✭ 84 (+47.37%)
Mutual labels:  arm, usb
Nailgun
Nailgun attack on ARM devices.
Stars: ✭ 114 (+100%)
Mutual labels:  arm, exploit
dheater
D(HE)ater is a proof of concept implementation of the D(HE)at attack (CVE-2002-20001) through which denial-of-service can be performed by enforcing the Diffie-Hellman key exchange.
Stars: ✭ 142 (+149.12%)
Mutual labels:  exploit, vulnerability
ws-ldn-12
ARM / STM32F7 DIY synth workshop
Stars: ✭ 62 (+8.77%)
Mutual labels:  arm, usb
Rop Tool
A tool to help you write binary exploits
Stars: ✭ 590 (+935.09%)
Mutual labels:  arm, exploit
cve-2016-1764
Extraction of iMessage Data via XSS
Stars: ✭ 52 (-8.77%)
Mutual labels:  exploit, vulnerability
fusee-nano
A minimalist re-implementation of the Fusée Gelée exploit (http://memecpy.com), designed to run on embedded Linux devices. (Zero dependencies)
Stars: ✭ 49 (-14.04%)
Mutual labels:  usb, exploit
vmware guest auth bypass
Proof of concept of VMSA-2017-0012
Stars: ✭ 42 (-26.32%)
Mutual labels:  exploit, vulnerability
rsGen
rsGen is a Reverse Shell Payload Generator for hacking.
Stars: ✭ 71 (+24.56%)
Mutual labels:  exploit, vulnerability
SAP vulnerabilities
DoS PoC's for SAP products
Stars: ✭ 47 (-17.54%)
Mutual labels:  exploit, vulnerability
Ventoy
A new bootable USB solution.
Stars: ✭ 29,413 (+51501.75%)
Mutual labels:  usb, secure-boot
Toboot
Bootloader for the EFM32HG Tomu Board
Stars: ✭ 65 (+14.04%)
Mutual labels:  arm, usb
Nxloader
My first Android app: Launch Fusée Gelée payloads from stock Android (CVE-2018-6242)
Stars: ✭ 417 (+631.58%)
Mutual labels:  usb, exploit
Dirtyjtag
JTAG probe firmware for STM32F1
Stars: ✭ 183 (+221.05%)
Mutual labels:  arm, usb
exploits
Some of my public exploits
Stars: ✭ 50 (-12.28%)
Mutual labels:  exploit, vulnerability
Exphub
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340
Stars: ✭ 3,056 (+5261.4%)
Mutual labels:  exploit, vulnerability
Killshot
A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner
Stars: ✭ 237 (+315.79%)
Mutual labels:  exploit, vulnerability
armroper
ARM rop chain gadget searcher
Stars: ✭ 36 (-36.84%)
Mutual labels:  arm, exploit
View All Similar Projects ➔

exynos-usbdl : unsigned code loader for Exynos bootrom

Disclaimer

You will be solely responsible for any damage caused to your hardware/software/warranty/data/cat/etc...

Description

Exynos bootrom supports booting from USB. This method of boot requires an USB host to send a signed bootloader to the bootrom via USB port.

This tool exploits a vulnerability in the USB download mode to load and run unsigned code in Secure World.

Supported targets

  • Exynos 8890
  • Exynos 8895

Access to USB download mode

Among all the booting methods supported by this chipset, two are configured in fuses to be attempted on cold boot. If the first boot method fails (including failed authentication), then second boot method is attempted.

On retail smartphones, the usual boot configuration is internal storage (UFS chip) first, then USB download mode as fallback. This means USB download mode is only accessible if first boot method has failed.

First boot method sabotage can be achieved either through software or hardware modification. The approach used for this project was to dig a hole in UFS chip with dental scraper.

For Exynos 8890, @astarasikov shared a better approach to corrupt bootloader without opening the device : from Download mode, flash cm.bin (from a firmware image) onto BOOTLOADER partition using Heimdall tool. Please keep in mind that it will brick your device until you restore the BOOTLOADER partition.

Once the first boot method fails, USB download mode can be accessed by pressing and holding power button.

Usage

./exynos-usbdl <mode> <input_file> [<output_file>]
	mode: mode of operation
		n: normal
		e: exploit
	input_file: payload binary to load and execute
	output_file: file to write data returned by payload (exploit mode only)

Payloads

Payloads are raw binary AArch64 executables. Some are provided in directory payloads/.

License

Please see LICENSE.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].