GonnaHetzMe/palera1n
1
0 Fork 0
mirror of https://github.com/palera1n/palera1n.git synced 2026-10-24 02:59:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'openra1n' of https://github.com/palera1n/palera1n into openra1n

Browse Source
This commit is contained in:
Mineek committed 2023-07-17 17:53:46 +02:00
2 parents 5c41f37b39 045d11d956
commit 238c96befe
1 file changed
+22 -29
Download Patch File Download Diff File Expand all files Collapse all files
src/checkm8.c
+22 -29
View File
@@ -29,12 +29,6 @@
#include <IOKit/usb/IOUSBLib.h> #include <IOKit/usb/IOUSBLib.h>
#endif #endif
#ifdef DEBUG
#define log_debug(...) fprintf(stderr, __VA_ARGS__); fputc('\n', stderr)
#else
#define log_debug(...) do {} while (0)
#endif
#define DFU_DNLOAD (1) #define DFU_DNLOAD (1)
#define APPLE_VID (0x5AC) #define APPLE_VID (0x5AC)
#define DFU_STATUS_OK (0) #define DFU_STATUS_OK (0)
@@ -872,69 +866,69 @@ checkm8_stage_patch(const usb_handle_t *handle) {
p[5] = insecure_memory_base; p[5] = insecure_memory_base;
switch (cpid) { switch (cpid) {
case 0x8000: case 0x8000:
log_debug("setting up stage 2 for s8000"); LOG(LOG_VERBOSE, "Setting up stage 2 for s8000");
data = calloc(1, payloads_yolo_s8000_bin_len); data = calloc(1, payloads_yolo_s8000_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_s8000_bin, payloads_yolo_s8000_bin_len); memcpy(data, payloads_yolo_s8000_bin, payloads_yolo_s8000_bin_len);
data_sz += payloads_yolo_s8000_bin_len; data_sz += payloads_yolo_s8000_bin_len;
break; break;
case 0x8001: case 0x8001:
log_debug("setting up stage 2 for s8001"); LOG(LOG_VERBOSE, "Setting up stage 2 for s8001");
data = calloc(1, payloads_yolo_s8001_bin_len); data = calloc(1, payloads_yolo_s8001_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_s8001_bin, payloads_yolo_s8001_bin_len); memcpy(data, payloads_yolo_s8001_bin, payloads_yolo_s8001_bin_len);
data_sz += payloads_yolo_s8001_bin_len; data_sz += payloads_yolo_s8001_bin_len;
break; break;
case 0x8003: case 0x8003:
log_debug("setting up stage 2 for s8003"); LOG(LOG_VERBOSE, "Setting up stage 2 for s8003");
data = calloc(1, payloads_yolo_s8003_bin_len); data = calloc(1, payloads_yolo_s8003_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_s8003_bin, payloads_yolo_s8003_bin_len); memcpy(data, payloads_yolo_s8003_bin, payloads_yolo_s8003_bin_len);
data_sz += payloads_yolo_s8003_bin_len; data_sz += payloads_yolo_s8003_bin_len;
break; break;
case 0x7000: case 0x7000:
log_debug("setting up stage 2 for t7000"); LOG(LOG_VERBOSE, "Setting up stage 2 for t7000");
data = calloc(1, payloads_yolo_t7000_bin_len); data = calloc(1, payloads_yolo_t7000_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_t7000_bin, payloads_yolo_t7000_bin_len); memcpy(data, payloads_yolo_t7000_bin, payloads_yolo_t7000_bin_len);
data_sz += payloads_yolo_t7000_bin_len; data_sz += payloads_yolo_t7000_bin_len;
break; break;
case 0x7001: case 0x7001:
log_debug("setting up stage 2 for t7001"); LOG(LOG_VERBOSE, "Setting up stage 2 for t7001");
data = calloc(1, payloads_yolo_t7001_bin_len); data = calloc(1, payloads_yolo_t7001_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_t7001_bin, payloads_yolo_t7001_bin_len); memcpy(data, payloads_yolo_t7001_bin, payloads_yolo_t7001_bin_len);
data_sz += payloads_yolo_t7001_bin_len; data_sz += payloads_yolo_t7001_bin_len;
break; break;
case 0x8010: case 0x8010:
log_debug("setting up stage 2 for t8010"); LOG(LOG_VERBOSE, "Setting up stage 2 for t8010");
data = calloc(1, payloads_yolo_t8010_bin_len); data = calloc(1, payloads_yolo_t8010_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_t8010_bin, payloads_yolo_t8010_bin_len); memcpy(data, payloads_yolo_t8010_bin, payloads_yolo_t8010_bin_len);
data_sz += payloads_yolo_t8010_bin_len; data_sz += payloads_yolo_t8010_bin_len;
break; break;
case 0x8011: case 0x8011:
log_debug("setting up stage 2 for t8011"); LOG(LOG_VERBOSE, "Setting up stage 2 for t8011");
data = calloc(1, payloads_yolo_t8011_bin_len); data = calloc(1, payloads_yolo_t8011_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_t8011_bin, payloads_yolo_t8011_bin_len); memcpy(data, payloads_yolo_t8011_bin, payloads_yolo_t8011_bin_len);
data_sz += payloads_yolo_t8011_bin_len; data_sz += payloads_yolo_t8011_bin_len;
break; break;
case 0x8015: case 0x8015:
log_debug("setting up stage 2 for t8015"); LOG(LOG_VERBOSE, "Setting up stage 2 for t8015");
data = calloc(1, payloads_yolo_t8015_bin_len); data = calloc(1, payloads_yolo_t8015_bin_len);
data_sz = 0; data_sz = 0;
memcpy(data, payloads_yolo_t8015_bin, payloads_yolo_t8015_bin_len); memcpy(data, payloads_yolo_t8015_bin, payloads_yolo_t8015_bin_len);
data_sz += payloads_yolo_t8015_bin_len; data_sz += payloads_yolo_t8015_bin_len;
break; break;
default: default:
LOG(LOG_ERROR, "unsupported cpid 0x%" PRIX32 "", cpid); LOG(LOG_ERROR, "Unsupported cpid 0x%" PRIX32 "", cpid);
return false; return false;
} }
if(checkm8_usb_request_stall(handle) && checkm8_usb_request_leak(handle)) { if(checkm8_usb_request_stall(handle) && checkm8_usb_request_leak(handle)) {
log_debug("successfully leaked data"); LOG(LOG_VERBOSE, "Successfully leaked data");
} else { } else {
log_debug("failed to leak data"); LOG(LOG_VERBOSE, "Failed to leak data");
return false; return false;
} }
for(i = 0; i < 2; i++) { for(i = 0; i < 2; i++) {
@@ -964,14 +958,14 @@ static void compress_pongo(void *out, size_t *out_len) {
static void checkm8_boot_pongo(usb_handle_t *handle) { static void checkm8_boot_pongo(usb_handle_t *handle) {
transfer_ret_t transfer_ret; transfer_ret_t transfer_ret;
LOG(LOG_INFO, "Booting pongoOS"); LOG(LOG_INFO, "Booting pongoOS");
log_debug("Compressing pongoOS"); LOG(LOG_VERBOSE, "Compressing pongoOS");
log_debug("Appending shellcode to the top of pongoOS (512 bytes)"); LOG(LOG_VERBOSE, "Appending shellcode to the top of pongoOS (512 bytes)");
void *shellcode = malloc(512); void *shellcode = malloc(512);
memcpy(shellcode, payloads_shellcode_bin, payloads_shellcode_bin_len); memcpy(shellcode, payloads_shellcode_bin, payloads_shellcode_bin_len);
size_t out_len = payloads_Pongo_bin_len; size_t out_len = payloads_Pongo_bin_len;
void *out = malloc(out_len); void *out = malloc(out_len);
compress_pongo(out, &out_len); compress_pongo(out, &out_len);
log_debug("Compressed pongoOS from %u to %zu bytes", payloads_Pongo_bin_len, out_len); LOG(LOG_VERBOSE, "Compressed pongoOS from %u to %zu bytes", payloads_Pongo_bin_len, out_len);
void *tmp = malloc(out_len + 512); void *tmp = malloc(out_len + 512);
memcpy(tmp, shellcode, 512); memcpy(tmp, shellcode, 512);
memcpy(tmp + 512, out, out_len); memcpy(tmp + 512, out, out_len);
@@ -979,14 +973,14 @@ static void checkm8_boot_pongo(usb_handle_t *handle) {
out = tmp; out = tmp;
out_len += 512; out_len += 512;
free(shellcode); free(shellcode);
log_debug("Setting the compressed size into the shellcode"); LOG(LOG_VERBOSE, "Setting the compressed size into the shellcode");
uint32_t* size = (uint32_t*)(out + 0x1fc); uint32_t* size = (uint32_t*)(out + 0x1fc);
log_debug("size = 0x%" PRIX32 "", *size); LOG(LOG_VERBOSE, "size = 0x%" PRIX32 "", *size);
*size = out_len - 512; *size = out_len - 512;
log_debug("size = 0x%" PRIX32 "", *size); LOG(LOG_VERBOSE, "size = 0x%" PRIX32 "", *size);
log_debug("Reconnecting to device"); LOG(LOG_VERBOSE, "Reconnecting to device");
init_usb_handle(handle, APPLE_VID, DFU_MODE_PID); init_usb_handle(handle, APPLE_VID, DFU_MODE_PID);
log_debug("Waiting for device to be ready"); LOG(LOG_VERBOSE, "Waiting for device to be ready");
wait_usb_handle(handle, NULL, NULL); wait_usb_handle(handle, NULL, NULL);
{ {
size_t len = 0; size_t len = 0;
@@ -998,16 +992,15 @@ static void checkm8_boot_pongo(usb_handle_t *handle) {
send_usb_control_request(handle, 0x21, DFU_DNLOAD, 0, 0, (unsigned char*)&out[len], size, &transfer_ret); send_usb_control_request(handle, 0x21, DFU_DNLOAD, 0, 0, (unsigned char*)&out[len], size, &transfer_ret);
if(transfer_ret.sz != size || transfer_ret.ret != USB_TRANSFER_OK) if(transfer_ret.sz != size || transfer_ret.ret != USB_TRANSFER_OK)
{ {
log_debug("retrying at len = %zu", len); LOG(LOG_VERBOSE, "retrying at len = %zu", len);
sleep_ms(100); sleep_ms(100);
goto retry; goto retry;
} }
len += size; len += size;
log_debug("len = %zu", len);
} }
} }
send_usb_control_request_no_data(handle, 0x21, 4, 0, 0, 0, NULL); send_usb_control_request_no_data(handle, 0x21, 4, 0, 0, 0, NULL);
log_debug("pongoOS sent, should be booting"); LOG(LOG_VERBOSE, "pongoOS sent, should be booting");
} }
static bool static bool
@@ -1040,7 +1033,7 @@ gaster_checkm8(usb_handle_t *handle) {
stage = STAGE_RESET; stage = STAGE_RESET;
} }
if(ret) { if(ret) {
log_debug("Stage %d succeeded", stage); LOG(LOG_VERBOSE, "Stage %d succeeded", stage);
} else { } else {
LOG(LOG_ERROR, "Stage %d failed", stage); LOG(LOG_ERROR, "Stage %d failed", stage);
stage = STAGE_RESET; stage = STAGE_RESET;