Add duming tools for nvtegra devices

sogeti-esec-lab · Feb 3, 2015 · ed15459 · ed15459
1 parent c08198b
commit ed15459
Show file tree

Hide file tree

Showing 21 changed files with 633 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -6,10 +6,12 @@ It can be used on an encrypted data.img, over USB from recovery mode and over fa
 
 ## Disclaimer
 
-The Full Disk Encryption tools are heavily based on Thomas Cannon tools and now support HTC One. See below.
+The Full Disk Encryption tools are heavily based on Thomas Cannon tools and support HTC One, Wiko WAX (including the Blackphone). See below.
 
 Use over "fastboot oem read_mmc" currently only supports HTC One HBOOT < 1.56.0000.
 
+To dump Wiko WAX phones, use the scripts included in the "dump_nvtegra" directory. The dumping process for Linux and Windows is discribed also in the README.md of this same directory.
+
 ## License
 
 android-fde is released under the **BSD 3-Clause License**.
@@ -135,4 +137,4 @@ After use, unmount the raw device and the FUSE device
 
 ```bash
 $ ./clean.sh
-```
+```
diff --git a/dump_nvtegra/Linux/dumpEncryptedPart.sh b/dump_nvtegra/Linux/dumpEncryptedPart.sh
@@ -0,0 +1,5 @@
+mkdir ROM
+sudo ./nvflash --bct ../common_bct.cfg --bl ../bootloader.bin --go
+sudo ./nvflash -r --read 25 ROM/userdata_footer.img
+sudo ./nvflash -r --read 26 ROM/userdata.img
+sudo chmod 777 -R ROM
diff --git a/dump_nvtegra/Linux/dumpos.sh b/dump_nvtegra/Linux/dumpos.sh
@@ -0,0 +1,18 @@
+mkdir ROM
+sudo ./nvflash --bct ../common_bct.cfg --bl ../bootloader.bin --go
+sudo ./nvflash -r --read 4 ROM/bootloader.bin
+sudo ./nvflash -r --read 6 ROM/bootlogo.bmp
+sudo ./nvflash -r --read 7 ROM/lowbat.bmp
+sudo ./nvflash -r --read 8 ROM/charging.bmp
+sudo ./nvflash -r --read 9 ROM/lowbatcharge.bmp
+sudo ./nvflash -r --read 11 ROM/tos.img
+sudo ./nvflash -r --read 12 ROM/eks.dat
+sudo ./nvflash -r --read 15 ROM/recovery.img
+sudo ./nvflash -r --read 16 ROM/tegra148-ceres.dtb
+sudo ./nvflash -r --read 17 ROM/boot.img
+sudo ./nvflash -r --read 18 ROM/system.img
+sudo ./nvflash -r --read 19 ROM/cache.img
+sudo ./nvflash -r --read 23 ROM/MDM.img
+sudo ./nvflash -r --read 24 ROM/log.img
+sudo ./nvflash -r --read 26 ROM/userdata.img
+sudo chmod 777 -R ROM
diff --git a/dump_nvtegra/Linux/nvflash b/dump_nvtegra/Linux/nvflash
diff --git a/dump_nvtegra/README.md b/dump_nvtegra/README.md
@@ -0,0 +1,25 @@
+# nvflash dumping tools
+
+These tools are used to dump deviced based on NVidia Tegra processor, like The Blackphone and the Wiko WAX of course.
+
+## How to use it?
+
+### Step 1 : APX mode
+
+NVidia Tegra based device have a diagnostic mode called APX. To turn it On with Wiko WAX and Blackphone devices press the POWER button when the phone is off until it vibrates, then quickly press volume UP and DOWN buttons in the same time.
+
+To finish, enter to NVflash mode (APX mode).
+
+### Step 2 : Dump Dump dump...
+
+#### Windows
+
+Go to Windows directory and start to dump the device using "dumpos.bat". But if want to dump an encrypted device to crack a "userdata.img" partition, run the "dumpEncryptedPart.bat" batch script.
+
+#### Linux
+
+Go to Linux directory and use bash scripts instead.
+
+## Acknowledgement
+
+- alexDey for his Wiko WAX archive : http://www.wikoandco.com/fr/forum-wiko/rom-wiko-wax/8352-tuto-dump-rom-wax
diff --git a/dump_nvtegra/Windows/dumpEncryptedPart.bat b/dump_nvtegra/Windows/dumpEncryptedPart.bat
@@ -0,0 +1,4 @@
+mkdir ROM
+nvflash.exe --bct ../common_bct.cfg --bl ../bootloader.bin --go
+nvflash.exe -r --read 26 ROM/userdata_footer.img
+nvflash.exe -r --read 26 ROM/userdata.img
diff --git a/dump_nvtegra/Windows/dumpos.bat b/dump_nvtegra/Windows/dumpos.bat
@@ -0,0 +1,18 @@
+sudo mkdir ROM
+nvflash.exe --bct ../common_bct.cfg --bl ../bootloader.bin --go
+nvflash.exe -r --read 4 ROM/bootloader.bin
+nvflash.exe -r --read 6 ROM/bootlogo.bmp
+nvflash.exe -r --read 7 ROM/lowbat.bmp
+nvflash.exe -r --read 8 ROM/charging.bmp
+nvflash.exe -r --read 9 ROM/lowbatcharge.bmp
+nvflash.exe -r --read 11 ROM/tos.img
+nvflash.exe -r --read 12 ROM/eks.dat
+nvflash.exe -r --read 15 ROM/recovery.img
+nvflash.exe -r --read 16 ROM/tegra148-ceres.dtb
+nvflash.exe -r --read 17 ROM/boot.img
+nvflash.exe -r --read 18 ROM/system.img
+nvflash.exe -r --read 19 ROM/cache.img
+nvflash.exe -r --read 23 ROM/MDM.img
+nvflash.exe -r --read 24 ROM/log.img
+nvflash.exe -r --read 26 ROM/userdata.img
+
diff --git a/dump_nvtegra/Windows/libnv3p.dll b/dump_nvtegra/Windows/libnv3p.dll
diff --git a/dump_nvtegra/Windows/libnvaes_ref.dll b/dump_nvtegra/Windows/libnvaes_ref.dll
diff --git a/dump_nvtegra/Windows/libnvapputil.dll b/dump_nvtegra/Windows/libnvapputil.dll
diff --git a/dump_nvtegra/Windows/libnvboothost.dll b/dump_nvtegra/Windows/libnvboothost.dll
diff --git a/dump_nvtegra/Windows/libnvdioconverter.dll b/dump_nvtegra/Windows/libnvdioconverter.dll
diff --git a/dump_nvtegra/Windows/libnvflash.dll b/dump_nvtegra/Windows/libnvflash.dll
diff --git a/dump_nvtegra/Windows/libnvos.dll b/dump_nvtegra/Windows/libnvos.dll
diff --git a/dump_nvtegra/Windows/libnvtestio.dll b/dump_nvtegra/Windows/libnvtestio.dll
diff --git a/dump_nvtegra/Windows/libnvtestresults.dll b/dump_nvtegra/Windows/libnvtestresults.dll
diff --git a/dump_nvtegra/Windows/libnvusbhost.dll b/dump_nvtegra/Windows/libnvusbhost.dll
diff --git a/dump_nvtegra/Windows/nvflash.exe b/dump_nvtegra/Windows/nvflash.exe
diff --git a/dump_nvtegra/bootloader.bin b/dump_nvtegra/bootloader.bin
diff --git a/dump_nvtegra/common_bct.cfg b/dump_nvtegra/common_bct.cfg
diff --git a/dump_nvtegra/microboot.bin b/dump_nvtegra/microboot.bin