mirror of
https://github.com/palera1n/palera1n.git
synced 2026-10-23 18:49:48 +02:00
refactor: cleanup
chore: ora1n cleanup
This commit is contained in:
6 files changed
+1321
-843
No files matched your search
@@ -0,0 +1,38 @@
|
||||
#include "payload.h"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <stddef.h>
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
int dfu_serial_number_get_cpid(char *serial) {
|
||||
char *cpid = strstr(serial, "CPID:");
|
||||
if (cpid == NULL) { return -1; }
|
||||
return strtol(cpid + 5, NULL, 16);
|
||||
}
|
||||
|
||||
int dfu_serial_number_get_bdid(char *serial) {
|
||||
char *bdid = strstr(serial, "BDID:");
|
||||
if (bdid == NULL) { return -1; }
|
||||
return strtol(bdid + 5, NULL, 16);
|
||||
}
|
||||
|
||||
bool dfu_serial_number_is_in_dfu_mode(char *serial) {
|
||||
char *DFU = strstr(serial, "SRTG");
|
||||
return DFU != NULL;
|
||||
}
|
||||
|
||||
bool dfu_serial_number_is_pwned(char *serial) {
|
||||
char *pwnd = strstr(serial, "PWND:");
|
||||
return pwnd != NULL;
|
||||
}
|
||||
|
||||
bool dfu_serial_number_is_in_yolo_dfu(char *serial) {
|
||||
char *yolo = strstr(serial, "YOLO");
|
||||
return yolo != NULL;
|
||||
}
|
||||
|
||||
bool device_serial_number_is_in_pongo_os(char *serial) {
|
||||
char *pongo = strstr(serial, "SRTG:[PongoOS");
|
||||
return pongo != NULL;
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
#ifndef DFU_H
|
||||
#define DFU_H
|
||||
|
||||
#include <stdint.h>
|
||||
|
||||
#define DFU_DNLOAD 1
|
||||
#define DFU_UPLOAD 2
|
||||
#define DFU_GET_STATUS 3
|
||||
#define DFU_CLR_STATUS 4
|
||||
#define DFU_GETSTATE 5
|
||||
#define DFU_ABORT 6
|
||||
|
||||
#define DFU_FILE_SUFFIX_LEN 16
|
||||
#define EP0_MAX_PACKET_SIZE 0x40
|
||||
#define DFU_MAX_TRANSFER_SZ 0x800
|
||||
#define DFU_STATUS_OK 0
|
||||
#define DFU_STATE_MANIFEST_SYNC 6
|
||||
#define DFU_STATE_MANIFEST 7
|
||||
#define DFU_STATE_MANIFEST_WAIT_RESET 8
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
int dfu_serial_number_get_cpid(char *serial);
|
||||
bool dfu_serial_number_is_in_dfu_mode(char *serial);
|
||||
bool dfu_serial_number_is_pwned(char *serial);
|
||||
bool dfu_serial_number_is_in_yolo_dfu(char *serial);
|
||||
bool device_serial_number_is_in_pongo_os(char *serial);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // DFU_H
|
||||
@@ -0,0 +1,294 @@
|
||||
#include "payload.h"
|
||||
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#include "../utils/log.h"
|
||||
|
||||
extern uint8_t payloads_yolo_s8000_bin[], payloads_yolo_s8001_bin[], payloads_yolo_s8003_bin[], payloads_yolo_t7000_bin[], payloads_yolo_t7001_bin[], payloads_yolo_t8010_bin[], payloads_yolo_t8011_bin[], payloads_yolo_t8015_bin[];
|
||||
extern unsigned payloads_yolo_s8000_bin_len, payloads_yolo_s8001_bin_len, payloads_yolo_s8003_bin_len, payloads_yolo_t7000_bin_len, payloads_yolo_t7001_bin_len, payloads_yolo_t8010_bin_len, payloads_yolo_t8011_bin_len, payloads_yolo_t8015_bin_len;
|
||||
|
||||
extern uint8_t payloads_Pongo_bin[], payloads_shellcode_bin[];
|
||||
extern unsigned payloads_Pongo_bin_len, payloads_shellcode_bin_len;
|
||||
|
||||
#include "../gen/payloads/yolo_s8000.h"
|
||||
#include "../gen/payloads/yolo_s8001.h"
|
||||
#include "../gen/payloads/yolo_s8003.h"
|
||||
#include "../gen/payloads/yolo_t7000.h"
|
||||
#include "../gen/payloads/yolo_t7001.h"
|
||||
#include "../gen/payloads/yolo_t8010.h"
|
||||
#include "../gen/payloads/yolo_t8011.h"
|
||||
#include "../gen/payloads/yolo_t8015.h"
|
||||
|
||||
bool checkm8_find_device_configuration_for_cpid(
|
||||
int cpid,
|
||||
struct DeviceConfiguration *config)
|
||||
{
|
||||
bool foundMatchingConfiguration = true;
|
||||
switch (cpid) {
|
||||
case 0x8015:
|
||||
case 0x8012:
|
||||
case 0x8011:
|
||||
config->cpid = cpid;
|
||||
config->config_large_leak = 0;
|
||||
config->config_overwrite_pad = 0x540;
|
||||
config->config_hole = 6;
|
||||
break;
|
||||
case 0x8010:
|
||||
config->cpid = cpid;
|
||||
config->config_large_leak = 0;
|
||||
config->config_overwrite_pad = 0x5C0;
|
||||
config->config_hole = 5;
|
||||
break;
|
||||
case 0x8001:
|
||||
config->cpid = cpid;
|
||||
config->config_large_leak = 0;
|
||||
config->config_overwrite_pad = 0x5C0;
|
||||
config->config_hole = 6;
|
||||
break;
|
||||
case 0x8003:
|
||||
case 0x8000:
|
||||
case 0x7001:
|
||||
case 0x7000:
|
||||
config->cpid = cpid;
|
||||
config->config_large_leak = 0;
|
||||
config->config_overwrite_pad = 0x500;
|
||||
config->config_hole = 0;
|
||||
break;
|
||||
default:
|
||||
LOG("CPID 0x%x is not supported!", cpid);
|
||||
if (cpid > 0x8015) {
|
||||
LOG("arm64e devices (A12 and newer) will never be supported.");
|
||||
}
|
||||
|
||||
foundMatchingConfiguration = false;
|
||||
break;
|
||||
}
|
||||
return foundMatchingConfiguration;
|
||||
}
|
||||
|
||||
bool checkm8_find_payload_configuration_for_cpid(
|
||||
int cpid,
|
||||
struct PayloadConfiguration *config)
|
||||
{
|
||||
bool foundMatchingConfiguration = true;
|
||||
switch (cpid) {
|
||||
case 0x8015:
|
||||
config->tlbi = 0x1000004AC;
|
||||
config->nop_gadget = 0x10000A9C4;
|
||||
config->ret_gadget = 0x100000148;
|
||||
config->patch_addr = 0x10000624C;
|
||||
config->ttbr0_addr = 0x18000C000;
|
||||
config->func_gadget = 0x10000A9AC;
|
||||
config->write_ttbr0 = 0x10000045C;
|
||||
config->memcpy_addr = 0x10000E9D0;
|
||||
config->aes_crypto_cmd = 0x100009E9C;
|
||||
config->boot_tramp_end = 0x18001C000;
|
||||
config->ttbr0_vrom_off = 0x400;
|
||||
config->ttbr0_sram_off = 0x600;
|
||||
config->gUSBSerialNumber = 0x180003A78;
|
||||
config->dfu_handle_request = 0x180008638;
|
||||
config->usb_core_do_transfer = 0x10000B9A8;
|
||||
config->dfu_handle_bus_reset = 0x180008668;
|
||||
config->insecure_memory_base = 0x18001C000;
|
||||
config->handle_interface_request = 0x10000BCCC;
|
||||
config->usb_create_string_descriptor = 0x10000AE80;
|
||||
config->usb_serial_number_string_descriptor = 0x1800008FA;
|
||||
break;
|
||||
case 0x8012:
|
||||
config->tlbi = 0x100000494;
|
||||
config->nop_gadget = 0x100008DB8;
|
||||
config->ret_gadget = 0x10000012C;
|
||||
config->patch_addr = 0x100004854;
|
||||
config->ttbr0_addr = 0x18000C000;
|
||||
config->func_gadget = 0x100008DA0;
|
||||
config->write_ttbr0 = 0x100000444;
|
||||
config->memcpy_addr = 0x10000EA30;
|
||||
config->aes_crypto_cmd = 0x1000082AC;
|
||||
config->boot_tramp_end = 0x18001C000;
|
||||
config->ttbr0_vrom_off = 0x400;
|
||||
config->ttbr0_sram_off = 0x600;
|
||||
config->gUSBSerialNumber = 0x180003AF8;
|
||||
config->dfu_handle_request = 0x180008B08;
|
||||
config->usb_core_do_transfer = 0x10000BD20;
|
||||
config->dfu_handle_bus_reset = 0x180008B38;
|
||||
config->insecure_memory_base = 0x18001C000;
|
||||
config->handle_interface_request = 0x10000BFFC;
|
||||
config->usb_create_string_descriptor = 0x10000B1CC;
|
||||
config->usb_serial_number_string_descriptor = 0x18000082A;
|
||||
break;
|
||||
case 0x8011:
|
||||
config->tlbi = 0x100000444;
|
||||
config->nop_gadget = 0x10000CD0C;
|
||||
config->ret_gadget = 0x100000148;
|
||||
config->patch_addr = 0x100007630;
|
||||
config->ttbr0_addr = 0x1800A0000;
|
||||
config->func_gadget = 0x10000CCEC;
|
||||
config->write_ttbr0 = 0x1000003F4;
|
||||
config->memcpy_addr = 0x100010950;
|
||||
config->aes_crypto_cmd = 0x10000C994;
|
||||
config->boot_tramp_end = 0x1800B0000;
|
||||
config->ttbr0_vrom_off = 0x400;
|
||||
config->ttbr0_sram_off = 0x600;
|
||||
config->gUSBSerialNumber = 0x180083D28;
|
||||
config->dfu_handle_request = 0x180088A58;
|
||||
config->usb_core_do_transfer = 0x10000DD64;
|
||||
config->dfu_handle_bus_reset = 0x180088A88;
|
||||
config->insecure_memory_base = 0x1800B0000;
|
||||
config->handle_interface_request = 0x10000E08C;
|
||||
config->usb_create_string_descriptor = 0x10000D234;
|
||||
config->usb_serial_number_string_descriptor = 0x18008062A;
|
||||
break;
|
||||
case 0x8010:
|
||||
config->tlbi = 0x100000434;
|
||||
config->nop_gadget = 0x10000CC6C;
|
||||
config->ret_gadget = 0x10000015C;
|
||||
config->patch_addr = 0x1000074AC;
|
||||
config->ttbr0_addr = 0x1800A0000;
|
||||
config->func_gadget = 0x10000CC4C;
|
||||
config->write_ttbr0 = 0x1000003E4;
|
||||
config->memcpy_addr = 0x100010730;
|
||||
config->aes_crypto_cmd = 0x10000C8F4;
|
||||
config->boot_tramp_end = 0x1800B0000;
|
||||
config->ttbr0_vrom_off = 0x400;
|
||||
config->ttbr0_sram_off = 0x600;
|
||||
config->gUSBSerialNumber = 0x180083CF8;
|
||||
config->dfu_handle_request = 0x180088B48;
|
||||
config->usb_core_do_transfer = 0x10000DC98;
|
||||
config->dfu_handle_bus_reset = 0x180088B78;
|
||||
config->insecure_memory_base = 0x1800B0000;
|
||||
config->handle_interface_request = 0x10000DFB8;
|
||||
config->usb_create_string_descriptor = 0x10000D150;
|
||||
config->usb_serial_number_string_descriptor = 0x1800805DA;
|
||||
break;
|
||||
case 0x8001:
|
||||
config->tlbi = 0x100000404;
|
||||
config->nop_gadget = 0x10000CD60;
|
||||
config->ret_gadget = 0x100000118;
|
||||
config->patch_addr = 0x100007668;
|
||||
config->ttbr0_addr = 0x180050000;
|
||||
config->func_gadget = 0x10000CD40;
|
||||
config->write_ttbr0 = 0x1000003B4;
|
||||
config->memcpy_addr = 0x1000106F0;
|
||||
config->aes_crypto_cmd = 0x10000C9D4;
|
||||
config->boot_tramp_end = 0x180044000;
|
||||
config->ttbr0_vrom_off = 0x400;
|
||||
config->ttbr0_sram_off = 0x600;
|
||||
config->gUSBSerialNumber = 0x180047578;
|
||||
config->dfu_handle_request = 0x18004C378;
|
||||
config->usb_core_do_transfer = 0x10000DDA4;
|
||||
config->dfu_handle_bus_reset = 0x18004C3A8;
|
||||
config->insecure_memory_base = 0x180000000;
|
||||
config->handle_interface_request = 0x10000E0B4;
|
||||
config->usb_create_string_descriptor = 0x10000D280;
|
||||
config->usb_serial_number_string_descriptor = 0x18004486A;
|
||||
break;
|
||||
case 0x8003:
|
||||
case 0x8000:
|
||||
config->patch_addr = 0x10000812C;
|
||||
config->ttbr0_addr = 0x1800C8000;
|
||||
config->memcpy_addr = 0x100011030;
|
||||
config->aes_crypto_cmd = 0x10000DAA0;
|
||||
config->boot_tramp_end = 0x1800E1000;
|
||||
config->ttbr0_vrom_off = 0x400;
|
||||
config->ttbr0_sram_off = 0x600;
|
||||
config->gUSBSerialNumber = 0x180087958;
|
||||
config->dfu_handle_request = 0x1800878F8;
|
||||
config->usb_core_do_transfer = 0x10000EE78;
|
||||
config->dfu_handle_bus_reset = 0x180087928;
|
||||
config->insecure_memory_base = 0x180380000;
|
||||
config->handle_interface_request = 0x10000F1B0;
|
||||
config->usb_create_string_descriptor = 0x10000E354;
|
||||
config->usb_serial_number_string_descriptor = 0x1800807DA;
|
||||
break;
|
||||
case 0x7001:
|
||||
config->patch_addr = 0x10000AD04;
|
||||
config->memcpy_addr = 0x100013F10;
|
||||
config->aes_crypto_cmd = 0x100010A90;
|
||||
config->boot_tramp_end = 0x1800E1000;
|
||||
config->gUSBSerialNumber = 0x180088E48;
|
||||
config->dfu_handle_request = 0x180088DF8;
|
||||
config->usb_core_do_transfer = 0x100011BB4;
|
||||
config->dfu_handle_bus_reset = 0x180088E18;
|
||||
config->insecure_memory_base = 0x180380000;
|
||||
config->handle_interface_request = 0x100011EE4;
|
||||
config->usb_create_string_descriptor = 0x100011074;
|
||||
config->usb_serial_number_string_descriptor = 0x180080C2A;
|
||||
break;
|
||||
case 0x7000:
|
||||
config->patch_addr = 0x100007E98;
|
||||
config->memcpy_addr = 0x100010E70;
|
||||
config->aes_crypto_cmd = 0x10000DA90;
|
||||
config->boot_tramp_end = 0x1800E1000;
|
||||
config->gUSBSerialNumber = 0x1800888C8;
|
||||
config->dfu_handle_request = 0x180088878;
|
||||
config->usb_core_do_transfer = 0x10000EBB4;
|
||||
config->dfu_handle_bus_reset = 0x180088898;
|
||||
config->insecure_memory_base = 0x180380000;
|
||||
config->handle_interface_request = 0x10000EEE4;
|
||||
config->usb_create_string_descriptor = 0x10000E074;
|
||||
config->usb_serial_number_string_descriptor = 0x18008062A;
|
||||
break;
|
||||
default:
|
||||
LOG("CPID 0x%x is not supported!", cpid);
|
||||
foundMatchingConfiguration = false;
|
||||
}
|
||||
return foundMatchingConfiguration;
|
||||
}
|
||||
|
||||
void create_pongo_payload_for_device(
|
||||
uint16_t cpid,
|
||||
uint8_t **payload,
|
||||
size_t *payloadSize)
|
||||
{
|
||||
LOG("Preparing YoloDFU payload for CPID 0x%x.", cpid);
|
||||
|
||||
*payload = NULL;
|
||||
*payloadSize = 0;
|
||||
|
||||
switch (cpid) {
|
||||
case 0x8015:
|
||||
*payloadSize = payloads_yolo_t8015_bin_len;
|
||||
*payload = payloads_yolo_t8015_bin;
|
||||
break;
|
||||
|
||||
case 0x8011:
|
||||
*payloadSize = payloads_yolo_t8011_bin_len;
|
||||
*payload = payloads_yolo_t8011_bin;
|
||||
break;
|
||||
|
||||
case 0x8010:
|
||||
*payloadSize = payloads_yolo_t8010_bin_len;
|
||||
*payload = payloads_yolo_t8010_bin;
|
||||
break;
|
||||
|
||||
case 0x8003:
|
||||
*payloadSize = payloads_yolo_s8003_bin_len;
|
||||
*payload = payloads_yolo_s8003_bin;
|
||||
break;
|
||||
|
||||
case 0x8001:
|
||||
*payloadSize = payloads_yolo_s8001_bin_len;
|
||||
*payload = payloads_yolo_s8001_bin;
|
||||
break;
|
||||
|
||||
case 0x8000:
|
||||
*payloadSize = payloads_yolo_s8000_bin_len;
|
||||
*payload = payloads_yolo_s8000_bin;
|
||||
break;
|
||||
|
||||
case 0x7001:
|
||||
*payloadSize = payloads_yolo_t7001_bin_len;
|
||||
*payload = payloads_yolo_t7001_bin;
|
||||
break;
|
||||
|
||||
case 0x7000:
|
||||
*payloadSize = payloads_yolo_t7000_bin_len;
|
||||
*payload = payloads_yolo_t7000_bin;
|
||||
break;
|
||||
|
||||
default:
|
||||
LOG("Failed to prepare payload for device with CPID 0x%x.", cpid);
|
||||
break;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
#ifndef PAYLOAD_H
|
||||
#define PAYLOAD_H
|
||||
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
struct DeviceConfiguration {
|
||||
uint16_t cpid;
|
||||
size_t
|
||||
config_hole,
|
||||
config_large_leak,
|
||||
config_overwrite_pad;
|
||||
};
|
||||
|
||||
struct PayloadConfiguration {
|
||||
uint64_t
|
||||
tlbi,
|
||||
nop_gadget,
|
||||
ret_gadget,
|
||||
patch_addr,
|
||||
ttbr0_addr,
|
||||
func_gadget,
|
||||
write_ttbr0,
|
||||
memcpy_addr,
|
||||
aes_crypto_cmd,
|
||||
boot_tramp_end,
|
||||
ttbr0_vrom_off,
|
||||
ttbr0_sram_off,
|
||||
gUSBSerialNumber, // ??
|
||||
dfu_handle_request,
|
||||
usb_core_do_transfer,
|
||||
dfu_handle_bus_reset,
|
||||
insecure_memory_base,
|
||||
handle_interface_request,
|
||||
usb_create_string_descriptor,
|
||||
usb_serial_number_string_descriptor;
|
||||
};
|
||||
|
||||
bool checkm8_find_device_configuration_for_cpid(int cpid, struct DeviceConfiguration *config);
|
||||
bool checkm8_find_payload_configuration_for_cpid(int cpid, struct PayloadConfiguration *config);
|
||||
void create_pongo_payload_for_device(uint16_t cpid, uint8_t **payload, size_t *payloadSize);
|
||||
|
||||
#endif // PAYLOAD_H
|
||||
+834
-843
File diff suppressed because it is too large.
Load diff
@@ -1,11 +1,87 @@
|
||||
#ifndef RUN_H
|
||||
#define RUN_H
|
||||
|
||||
#include <stdbool.h>
|
||||
#include <stdint.h>
|
||||
#include <stddef.h>
|
||||
|
||||
#ifndef __APPLE__
|
||||
# include <libusb-1.0/libusb.h>
|
||||
# include <openssl/evp.h>
|
||||
# include <stdbool.h>
|
||||
# include <string.h>
|
||||
# include <stddef.h>
|
||||
#else
|
||||
# include <CommonCrypto/CommonCrypto.h>
|
||||
# include <CoreFoundation/CoreFoundation.h>
|
||||
# include <IOKit/IOCFPlugIn.h>
|
||||
# include <IOKit/usb/IOUSBLib.h>
|
||||
#endif
|
||||
|
||||
#include "dfu.h"
|
||||
|
||||
#define APPLE_VID (0x5AC)
|
||||
#define DFU_MODE_PID (0x1227)
|
||||
#define MAX_BLOCK_SZ (0x50)
|
||||
#define EP0_MAX_PACKET_SZ (0x40)
|
||||
#define USB_MAX_STRING_DESCRIPTOR_IDX (10)
|
||||
|
||||
#define USB_TIMEOUT (5)
|
||||
|
||||
#ifdef __APPLE__
|
||||
# if TARGET_OS_IPHONE
|
||||
# define kUSBPipeStalled kUSBHostReturnPipeStalled
|
||||
# else
|
||||
# define kUSBPipeStalled kIOUSBPipeStalled
|
||||
# endif
|
||||
#endif
|
||||
|
||||
#ifndef MIN
|
||||
# define MIN(a, b) ((a) < (b) ? (a) : (b))
|
||||
#endif
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
enum exploit_stage {
|
||||
STAGE_PREPARE = 0,
|
||||
STAGE_RESET = 1,
|
||||
STAGE_SETUP = 2,
|
||||
STAGE_SPRAY = 3,
|
||||
STAGE_PATCH = 4,
|
||||
STAGE_PONGO = 5,
|
||||
STAGE_JAILBREAK = 6,
|
||||
STAGE_DONE = 7,
|
||||
};
|
||||
|
||||
enum usb_transfer {
|
||||
USB_TRANSFER_OK,
|
||||
USB_TRANSFER_ERROR,
|
||||
USB_TRANSFER_STALL
|
||||
};
|
||||
|
||||
typedef struct {
|
||||
enum usb_transfer ret;
|
||||
uint32_t sz;
|
||||
} transfer_ret_t;
|
||||
|
||||
typedef struct {
|
||||
uint16_t vid, pid;
|
||||
#ifndef __APPLE__
|
||||
struct libusb_device_handle *device;
|
||||
#else
|
||||
io_service_t serv;
|
||||
IOUSBDeviceInterface320 **device;
|
||||
CFRunLoopSourceRef async_event_source;
|
||||
#endif
|
||||
} usb_handle_t;
|
||||
|
||||
typedef bool (*usb_check_cb_t)(usb_handle_t *, void *);
|
||||
|
||||
bool gaster_checkm8(usb_handle_t *handle);
|
||||
int checkm8();
|
||||
bool checkm9();
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user