BL31 Exploit for Amlogic S905X2, S905X3, and S922X SoCs

This repository contains a modified version of Blasty's exploit for the Amlogic A113X SoC, adapted to work with the Amlogic S905X2, S905X3, and S922X SoCs. Thanks to Taco for s922x the assistance in modifying the exploit.

Features

Compatibility with CoreELEC versions 19.5, 20.2, and 21
Added dump_mem function to read from RAM and SRAM
Tested on Linux/arm64 kernel 4.9.269

Note: This module does not work with CoreELEC versions 20.3 or 20.4.

Getting Started

Prerequisites

**Linux Kernel amlogic 4.9-5.10_meson64.
**LKM need __flush_dcache_area
CoreELEC: Ensure CoreELEC (versions 19.5-21) is booted on the target device.
SMB Server: Use CoreELEC’s default SMB server to transfer files to the target.

Installation

Clone or download the repository files.
Transfer the following files to the Downloads folder of CoreELEC:
- aml_pwn
- khax.ko
- load_lkm.sh
Establish an SSH or UART connection to the CoreELEC device.

SSH Example

ssh root@<ip_address_of_device>  # Example: ssh root@192.168.x.x

Default SSH password: coreelec

Usage

Load the kernel exploit module:
```
./load_lkm.sh
```
Use aml_pwn to dump different parts of the system memory:
- Dump BootROM/BL1:
```
./aml_pwn dump_bootrom bootrom.bin
```
- Dump efuse/OTP pattern:
```
./aml_pwn dump_otp otp.bin
```
- Dump efuse values from SRAM:
```
./aml_pwn dump_mem 0x800 0xfffe0000 efuse.bin
```
- Dump decrypted BL2 from SRAM:
```
./aml_pwn dump_mem 0x10000 0xfffa0000 bl2.bin
```

Compilation Resources

To compile the necessary tools and kernel modules, follow these steps:

GCC for `aml_pwn`

Download and install the GCC toolchain:

Download aarch64-linux-musl Cross Compiler

GCC for Kernel Module (`khax.ko`)

Install GCC for AArch64 cross-compilation:

sudo apt install gcc-aarch64-linux-gnu

Kernel Configuration

Use the Linux/arm64 kernel 4.9.269 configuration for compilation:

Kernel Source

Video Demo

Watch a demo of the exploit in action on YouTube:

BL31 Exploit Demo

Credits

License

This project is licensed under the MIT License – see the LICENSE file for details.

Raxone/Amlogic-exploit

ErrorLooks like something went wrong!

About

Topics

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Languages

Error
Looks like something went wrong!

Packages