From 189bd277f917955bdbc7b3030219e720b2c75f2b Mon Sep 17 00:00:00 2001 From: David Date: Sun, 30 Sep 2018 15:10:30 +0200 Subject: [PATCH 001/207] language: italian: Fix rename_stock typo Change-Id: Ifea3aca26e8664416ec1b161d2b102a0592fc9c1 Signed-off-by: David Viteri --- gui/theme/common/languages/it.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gui/theme/common/languages/it.xml b/gui/theme/common/languages/it.xml index ec74d59a5a..81ec46fe4e 100644 --- a/gui/theme/common/languages/it.xml +++ b/gui/theme/common/languages/it.xml @@ -646,7 +646,7 @@ Ripristino del Boot originale... Reinstallazione della Recovery in Boot... Esecuzione dello script {1}... - Il file della Recovery stock, in System, è stato rinominato per prevenire la sostituzione di TWRP da paete della ROM. + Il file della Recovery stock, in System, è stato rinominato per prevenire la sostituzione di TWRP da parte della ROM. Divisione del backup in archivi multipli... Errore nella creazione del backup. Errore durante il ripristino. From ff33d1352c7dcdf2dbb9f5b21fcc598a2394e145 Mon Sep 17 00:00:00 2001 From: Ilya Zhuravlev Date: Sun, 20 Jan 2019 19:50:41 -0500 Subject: [PATCH 002/207] twinstall: exploit compat with karnak Change-Id: I01df82c5dc3494598e8393358ba84475ce668764 --- twinstall.cpp | 185 +++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 183 insertions(+), 2 deletions(-) diff --git a/twinstall.cpp b/twinstall.cpp index fa6b8594e0..add6be6f63 100644 --- a/twinstall.cpp +++ b/twinstall.cpp @@ -320,6 +320,181 @@ static int Run_Update_Binary(const char *path, ZipWrap *Zip, int* wipe_cache, zi return INSTALL_SUCCESS; } +const char *karnak_boot_part = "/dev/block/platform/soc/11230000.mmc/by-name/boot"; + +// TODO: think of a name for the exploit +#define EXPLOIT_TAG " " + +static int unpatch_boot() { + FILE *fp = NULL; + uint8_t boot_data[0x800]; + int ret = -1; + + gui_print(EXPLOIT_TAG "Remove boot patch..."); + + fp = fopen(karnak_boot_part, "r+b"); + if (!fp) { + gui_print(EXPLOIT_TAG "Failed to open the boot device"); + goto cleanup; + } + + if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print(EXPLOIT_TAG "Failed to read data"); + goto cleanup; + } + + if (memcmp(boot_data + 0x400, "ANDROID!", 8) != 0) { + // Exploit not installed yet, but that's okay + gui_print(EXPLOIT_TAG "NOT_INSTALLED"); + ret = 0; + goto cleanup; + } + + // Assume exploit is installed. Uninstall it by copying the second 0x400 over the first 0x400 + memcpy(boot_data, boot_data + 0x400, 0x400); + // and zero out the second 0x400 + memset(boot_data + 0x400, 0, 0x400); + + if (fseek(fp, 0, SEEK_SET) != 0) { + gui_print(EXPLOIT_TAG "Failed to seek"); + goto cleanup; + } + + if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print(EXPLOIT_TAG "Failed to write data"); + goto cleanup; + } + + gui_print(EXPLOIT_TAG "OK"); + ret = 0; + +cleanup: + if (fp) { + fclose(fp); + fp = NULL; + } + + return ret; +} + +static uint8_t microloader_bin[1024] = { + 0x41, 0x4E, 0x44, 0x52, 0x4F, 0x49, 0x44, 0x21, 0x00, 0x10, 0x00, 0x00, 0xF0, 0xBF, 0xD5, 0x4B, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0x40, + 0x00, 0x00, 0x00, 0x48, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x11, 0x04, 0x0E, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x62, 0x6F, 0x6F, 0x74, 0x6F, 0x70, 0x74, 0x3D, 0x36, 0x34, 0x53, 0x33, 0x2C, 0x33, 0x32, 0x4E, + 0x32, 0x2C, 0x33, 0x32, 0x4E, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x40, 0xC0, 0xD5, 0x4B, 0x20, 0x33, 0xD4, 0x4B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0xC0, 0xD5, 0x4B, 0x00, 0x00, 0x00, 0x00, + 0x23, 0x84, 0xD1, 0x4B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x33, 0x01, 0xD5, 0x4B, 0x00, 0xC1, 0xD5, 0x4B, 0x00, 0x02, 0x00, 0x00, 0xAD, 0xDE, 0x00, 0x00, + 0x90, 0x4C, 0xD2, 0x4B, 0xAD, 0xDE, 0x00, 0x00, 0xAD, 0xDE, 0x00, 0x00, 0x9B, 0x5E, 0xD2, 0x4B, + 0xAD, 0xDE, 0x00, 0x00, 0x00, 0xC1, 0xD5, 0x4B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x42, 0xD4, 0xA0, 0xE3, 0x12, 0x00, 0x00, 0xFA, 0x03, 0x4A, 0x13, 0x68, 0x9B, 0x06, 0xFC, 0xD5, + 0x02, 0x4B, 0x18, 0x60, 0x70, 0x47, 0x00, 0xBF, 0x14, 0x20, 0x00, 0x11, 0x00, 0x20, 0x00, 0x11, + 0x0A, 0x28, 0x08, 0xB5, 0x01, 0x46, 0x02, 0xD1, 0x0D, 0x20, 0xFF, 0xF7, 0xED, 0xFF, 0x08, 0x46, + 0xFF, 0xF7, 0xEA, 0xFF, 0x08, 0xBD, 0x38, 0xB5, 0x45, 0x1E, 0x15, 0xF8, 0x01, 0x4F, 0x24, 0xB9, + 0x0A, 0x20, 0xFF, 0xF7, 0xED, 0xFF, 0x20, 0x46, 0x38, 0xBD, 0x20, 0x46, 0xFF, 0xF7, 0xE8, 0xFF, + 0xF3, 0xE7, 0x00, 0xBF, 0x7F, 0xB5, 0x4F, 0xF0, 0x82, 0x44, 0x0E, 0x4E, 0x4F, 0xF4, 0x00, 0x15, + 0x0D, 0x48, 0xFF, 0xF7, 0xE8, 0xFF, 0x33, 0x68, 0x98, 0x47, 0x01, 0x23, 0x4F, 0xF4, 0x00, 0x12, + 0x02, 0x93, 0x00, 0x23, 0x01, 0x95, 0x00, 0x94, 0x01, 0x69, 0x88, 0x47, 0x73, 0x68, 0x29, 0x46, + 0x20, 0x46, 0x98, 0x47, 0x05, 0x48, 0xFF, 0xF7, 0xD6, 0xFF, 0xA0, 0x47, 0x04, 0x48, 0xFF, 0xF7, + 0xD2, 0xFF, 0xFE, 0xE7, 0xFC, 0xC1, 0xD5, 0x4B, 0xA4, 0xC1, 0xD5, 0x4B, 0xC8, 0xC1, 0xD5, 0x4B, + 0xDC, 0xC1, 0xD5, 0x4B, 0x6D, 0x69, 0x63, 0x72, 0x6F, 0x6C, 0x6F, 0x61, 0x64, 0x65, 0x72, 0x20, + 0x62, 0x79, 0x20, 0x78, 0x79, 0x7A, 0x2E, 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, 0x68, + 0x74, 0x20, 0x32, 0x30, 0x31, 0x39, 0x2E, 0x00, 0x4A, 0x75, 0x6D, 0x70, 0x20, 0x74, 0x6F, 0x20, + 0x74, 0x68, 0x65, 0x20, 0x70, 0x61, 0x79, 0x6C, 0x6F, 0x61, 0x64, 0x00, 0x53, 0x6F, 0x6D, 0x65, + 0x74, 0x68, 0x69, 0x6E, 0x67, 0x20, 0x77, 0x65, 0x6E, 0x74, 0x20, 0x68, 0x6F, 0x72, 0x72, 0x69, + 0x62, 0x6C, 0x79, 0x20, 0x77, 0x72, 0x6F, 0x6E, 0x67, 0x21, 0x00, 0x00, 0x99, 0xEC, 0xD1, 0x4B, + 0x90, 0x4C, 0xD2, 0x4B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 +}; + +static int repatch_boot() { + FILE *fp = NULL; + uint8_t boot_data[0x800]; + int ret = -1; + + gui_print(EXPLOIT_TAG "Install boot patch... "); + + fp = fopen(karnak_boot_part, "r+b"); + if (!fp) { + gui_print(EXPLOIT_TAG "Failed to open the boot device"); + goto cleanup; + } + + if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print(EXPLOIT_TAG "Failed to read data"); + goto cleanup; + } + + if (memcmp(boot_data + 0x400, "ANDROID!", 8) == 0) { + // Exploit not installed yet, but that's okay + gui_print(EXPLOIT_TAG "ALREADY_INSTALLED"); // If the rom author injected the boot image herself + ret = 0; + goto cleanup; + } + + // Copy first half to the second half, replace first half with the microloader + memcpy(boot_data + 0x400, boot_data, 0x400); + memcpy(boot_data, microloader_bin, 0x400); + + if (fseek(fp, 0, SEEK_SET) != 0) { + gui_print(EXPLOIT_TAG "Failed to seek"); + goto cleanup; + } + + if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print(EXPLOIT_TAG "Failed to write data"); + goto cleanup; + } + + gui_print(EXPLOIT_TAG "OK"); + ret = 0; + +cleanup: + if (fp) { + fclose(fp); + fp = NULL; + } + + return ret; +} + int TWinstall_zip(const char* path, int* wipe_cache) { int ret_val, zip_verify = 1; @@ -435,8 +610,14 @@ int TWinstall_zip(const char* path, int* wipe_cache) { ret_val = INSTALL_CORRUPT; } else { ret_val = Prepare_Update_Binary(path, &Zip, wipe_cache); - if (ret_val == INSTALL_SUCCESS) - ret_val = Run_Update_Binary(path, &Zip, wipe_cache, UPDATE_BINARY_ZIP_TYPE); + if (ret_val == INSTALL_SUCCESS) { + if (unpatch_boot() < 0) + ret_val = INSTALL_ERROR; + if (ret_val == INSTALL_SUCCESS) + ret_val = Run_Update_Binary(path, &Zip, wipe_cache, UPDATE_BINARY_ZIP_TYPE); + if (repatch_boot() < 0) + ret_val = INSTALL_ERROR; + } } } else { if (Zip.EntryExists(AB_OTA)) { From b2b9658748d5aaed75526d83bc91ab3d1dcfa745 Mon Sep 17 00:00:00 2001 From: Ilya Zhuravlev Date: Sun, 27 Jan 2019 10:10:00 -0500 Subject: [PATCH 003/207] amonet: make logging prettier Change-Id: I9756237ac5c8b969fef79d0ebdf97dc25bd40c1a --- twinstall.cpp | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/twinstall.cpp b/twinstall.cpp index add6be6f63..d8faaf9445 100644 --- a/twinstall.cpp +++ b/twinstall.cpp @@ -322,30 +322,29 @@ static int Run_Update_Binary(const char *path, ZipWrap *Zip, int* wipe_cache, zi const char *karnak_boot_part = "/dev/block/platform/soc/11230000.mmc/by-name/boot"; -// TODO: think of a name for the exploit -#define EXPLOIT_TAG " " +#define EXPLOIT_TAG "[amonet] " static int unpatch_boot() { FILE *fp = NULL; uint8_t boot_data[0x800]; int ret = -1; - gui_print(EXPLOIT_TAG "Remove boot patch..."); + gui_print_color("highlight", EXPLOIT_TAG "Remove boot patch..."); fp = fopen(karnak_boot_part, "r+b"); if (!fp) { - gui_print(EXPLOIT_TAG "Failed to open the boot device"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to open the boot device"); goto cleanup; } if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print(EXPLOIT_TAG "Failed to read data"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to read data"); goto cleanup; } if (memcmp(boot_data + 0x400, "ANDROID!", 8) != 0) { // Exploit not installed yet, but that's okay - gui_print(EXPLOIT_TAG "NOT_INSTALLED"); + gui_print_color("highlight", EXPLOIT_TAG "NOT_INSTALLED"); ret = 0; goto cleanup; } @@ -356,16 +355,16 @@ static int unpatch_boot() { memset(boot_data + 0x400, 0, 0x400); if (fseek(fp, 0, SEEK_SET) != 0) { - gui_print(EXPLOIT_TAG "Failed to seek"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to seek"); goto cleanup; } if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print(EXPLOIT_TAG "Failed to write data"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to write data"); goto cleanup; } - gui_print(EXPLOIT_TAG "OK"); + gui_print_color("highlight", EXPLOIT_TAG "OK"); ret = 0; cleanup: @@ -449,22 +448,22 @@ static int repatch_boot() { uint8_t boot_data[0x800]; int ret = -1; - gui_print(EXPLOIT_TAG "Install boot patch... "); + gui_print_color("highlight", EXPLOIT_TAG "Install boot patch... "); fp = fopen(karnak_boot_part, "r+b"); if (!fp) { - gui_print(EXPLOIT_TAG "Failed to open the boot device"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to open the boot device"); goto cleanup; } if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print(EXPLOIT_TAG "Failed to read data"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to read data"); goto cleanup; } if (memcmp(boot_data + 0x400, "ANDROID!", 8) == 0) { // Exploit not installed yet, but that's okay - gui_print(EXPLOIT_TAG "ALREADY_INSTALLED"); // If the rom author injected the boot image herself + gui_print_color("highlight", EXPLOIT_TAG "ALREADY_INSTALLED"); // If the rom author injected the boot image herself ret = 0; goto cleanup; } @@ -474,16 +473,16 @@ static int repatch_boot() { memcpy(boot_data, microloader_bin, 0x400); if (fseek(fp, 0, SEEK_SET) != 0) { - gui_print(EXPLOIT_TAG "Failed to seek"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to seek"); goto cleanup; } if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print(EXPLOIT_TAG "Failed to write data"); + gui_print_color("highlight", EXPLOIT_TAG "Failed to write data"); goto cleanup; } - gui_print(EXPLOIT_TAG "OK"); + gui_print_color("highlight", EXPLOIT_TAG "OK"); ret = 0; cleanup: From 157b01fef5871349039133cc3fbafb124fc05b40 Mon Sep 17 00:00:00 2001 From: Ilya Zhuravlev Date: Sun, 27 Jan 2019 10:17:25 -0500 Subject: [PATCH 004/207] Update default settings for amonet Change-Id: I489009cb8396d632c63d9e530ca939b8cbf6475a --- data.cpp | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/data.cpp b/data.cpp index cf9dd2476d..884cee25dd 100755 --- a/data.cpp +++ b/data.cpp @@ -888,7 +888,7 @@ void DataManager::SetDefaultValues() mConst.SetValue("tw_has_mtp", "0"); mConst.SetValue("tw_mtp_enabled", "0"); #endif - mPersist.SetValue("tw_mount_system_ro", "2"); + mPersist.SetValue("tw_mount_system_ro", "1"); mPersist.SetValue("tw_never_show_system_ro_page", "0"); mPersist.SetValue("tw_language", EXPAND(TW_DEFAULT_LANGUAGE)); LOGINFO("LANG: %s\n", EXPAND(TW_DEFAULT_LANGUAGE)); @@ -911,9 +911,9 @@ void DataManager::SetDefaultValues() mConst.SetValue("tw_oem_build", "1"); #else mConst.SetValue("tw_oem_build", "0"); - mPersist.SetValue("tw_app_prompt", "1"); - mPersist.SetValue("tw_app_install_system", "1"); - mData.SetValue("tw_app_install_status", "0"); // 0 = no status, 1 = not installed, 2 = already installed + mPersist.SetValue("tw_app_prompt", "0"); + mPersist.SetValue("tw_app_install_system", "0"); + mData.SetValue("tw_app_install_status", "2"); // 0 = no status, 1 = not installed, 2 = already installed #endif mData.SetValue("tw_enable_adb_backup", "0"); From 671afae1886f1ace256c288170ecaba669fcd35e Mon Sep 17 00:00:00 2001 From: Joel Stein Date: Mon, 11 Feb 2019 23:02:46 +0100 Subject: [PATCH 005/207] update amonet-exploit for ford --- twinstall.cpp | 156 ++++++++++++++++++++++++++++---------------------- 1 file changed, 89 insertions(+), 67 deletions(-) diff --git a/twinstall.cpp b/twinstall.cpp index d8faaf9445..88a0eccf75 100644 --- a/twinstall.cpp +++ b/twinstall.cpp @@ -320,7 +320,7 @@ static int Run_Update_Binary(const char *path, ZipWrap *Zip, int* wipe_cache, zi return INSTALL_SUCCESS; } -const char *karnak_boot_part = "/dev/block/platform/soc/11230000.mmc/by-name/boot"; +const char *ford_boot_part = "/dev/block/platform/mtk-msdc.0/by-name/boot"; #define EXPLOIT_TAG "[amonet] " @@ -331,7 +331,7 @@ static int unpatch_boot() { gui_print_color("highlight", EXPLOIT_TAG "Remove boot patch..."); - fp = fopen(karnak_boot_part, "r+b"); + fp = fopen(ford_boot_part, "r+b"); if (!fp) { gui_print_color("highlight", EXPLOIT_TAG "Failed to open the boot device"); goto cleanup; @@ -377,70 +377,92 @@ static int unpatch_boot() { } static uint8_t microloader_bin[1024] = { - 0x41, 0x4E, 0x44, 0x52, 0x4F, 0x49, 0x44, 0x21, 0x00, 0x10, 0x00, 0x00, 0xF0, 0xBF, 0xD5, 0x4B, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF0, 0x40, - 0x00, 0x00, 0x00, 0x48, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x11, 0x04, 0x0E, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x62, 0x6F, 0x6F, 0x74, 0x6F, 0x70, 0x74, 0x3D, 0x36, 0x34, 0x53, 0x33, 0x2C, 0x33, 0x32, 0x4E, - 0x32, 0x2C, 0x33, 0x32, 0x4E, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x40, 0xC0, 0xD5, 0x4B, 0x20, 0x33, 0xD4, 0x4B, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0xC0, 0xD5, 0x4B, 0x00, 0x00, 0x00, 0x00, - 0x23, 0x84, 0xD1, 0x4B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x33, 0x01, 0xD5, 0x4B, 0x00, 0xC1, 0xD5, 0x4B, 0x00, 0x02, 0x00, 0x00, 0xAD, 0xDE, 0x00, 0x00, - 0x90, 0x4C, 0xD2, 0x4B, 0xAD, 0xDE, 0x00, 0x00, 0xAD, 0xDE, 0x00, 0x00, 0x9B, 0x5E, 0xD2, 0x4B, - 0xAD, 0xDE, 0x00, 0x00, 0x00, 0xC1, 0xD5, 0x4B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x42, 0xD4, 0xA0, 0xE3, 0x12, 0x00, 0x00, 0xFA, 0x03, 0x4A, 0x13, 0x68, 0x9B, 0x06, 0xFC, 0xD5, - 0x02, 0x4B, 0x18, 0x60, 0x70, 0x47, 0x00, 0xBF, 0x14, 0x20, 0x00, 0x11, 0x00, 0x20, 0x00, 0x11, - 0x0A, 0x28, 0x08, 0xB5, 0x01, 0x46, 0x02, 0xD1, 0x0D, 0x20, 0xFF, 0xF7, 0xED, 0xFF, 0x08, 0x46, - 0xFF, 0xF7, 0xEA, 0xFF, 0x08, 0xBD, 0x38, 0xB5, 0x45, 0x1E, 0x15, 0xF8, 0x01, 0x4F, 0x24, 0xB9, - 0x0A, 0x20, 0xFF, 0xF7, 0xED, 0xFF, 0x20, 0x46, 0x38, 0xBD, 0x20, 0x46, 0xFF, 0xF7, 0xE8, 0xFF, - 0xF3, 0xE7, 0x00, 0xBF, 0x7F, 0xB5, 0x4F, 0xF0, 0x82, 0x44, 0x0E, 0x4E, 0x4F, 0xF4, 0x00, 0x15, - 0x0D, 0x48, 0xFF, 0xF7, 0xE8, 0xFF, 0x33, 0x68, 0x98, 0x47, 0x01, 0x23, 0x4F, 0xF4, 0x00, 0x12, - 0x02, 0x93, 0x00, 0x23, 0x01, 0x95, 0x00, 0x94, 0x01, 0x69, 0x88, 0x47, 0x73, 0x68, 0x29, 0x46, - 0x20, 0x46, 0x98, 0x47, 0x05, 0x48, 0xFF, 0xF7, 0xD6, 0xFF, 0xA0, 0x47, 0x04, 0x48, 0xFF, 0xF7, - 0xD2, 0xFF, 0xFE, 0xE7, 0xFC, 0xC1, 0xD5, 0x4B, 0xA4, 0xC1, 0xD5, 0x4B, 0xC8, 0xC1, 0xD5, 0x4B, - 0xDC, 0xC1, 0xD5, 0x4B, 0x6D, 0x69, 0x63, 0x72, 0x6F, 0x6C, 0x6F, 0x61, 0x64, 0x65, 0x72, 0x20, - 0x62, 0x79, 0x20, 0x78, 0x79, 0x7A, 0x2E, 0x20, 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, 0x68, - 0x74, 0x20, 0x32, 0x30, 0x31, 0x39, 0x2E, 0x00, 0x4A, 0x75, 0x6D, 0x70, 0x20, 0x74, 0x6F, 0x20, - 0x74, 0x68, 0x65, 0x20, 0x70, 0x61, 0x79, 0x6C, 0x6F, 0x61, 0x64, 0x00, 0x53, 0x6F, 0x6D, 0x65, - 0x74, 0x68, 0x69, 0x6E, 0x67, 0x20, 0x77, 0x65, 0x6E, 0x74, 0x20, 0x68, 0x6F, 0x72, 0x72, 0x69, - 0x62, 0x6C, 0x79, 0x20, 0x77, 0x72, 0x6F, 0x6E, 0x67, 0x21, 0x00, 0x00, 0x99, 0xEC, 0xD1, 0x4B, - 0x90, 0x4C, 0xD2, 0x4B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + 0x41, 0x4e, 0x44, 0x52, 0x4f, 0x49, 0x44, 0x21, 0x00, 0x10, 0x00, 0x00, + 0xf0, 0xbf, 0xe6, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x40, 0x00, 0x00, 0x00, 0x48, + 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x11, 0x04, 0x0e, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x62, 0x6f, 0x6f, 0x74, 0x6f, 0x70, 0x74, 0x3d, + 0x36, 0x34, 0x53, 0x33, 0x2c, 0x33, 0x32, 0x4e, 0x32, 0x2c, 0x33, 0x32, + 0x4e, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x4c, 0xc0, 0xe6, 0x81, 0x18, 0x0f, 0xe4, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x5c, 0xc0, 0xe6, 0x81, 0x00, 0x00, 0x00, 0x00, 0xe0, 0xbc, 0xe3, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xa4, 0xba, 0xe0, 0x81, 0x00, 0xc1, 0xe6, 0x81, + 0x00, 0x02, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xd0, 0xbc, 0xe3, 0x81, + 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, + 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, + 0x99, 0x1d, 0xe0, 0x81, 0xad, 0xde, 0x00, 0x00, 0x00, 0xc1, 0xe6, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0xd0, 0x1f, 0xe5, 0x13, 0x00, 0x00, 0xfa, 0x00, 0x00, 0xb0, 0x8b, + 0x03, 0x4a, 0x13, 0x68, 0x9b, 0x06, 0xfc, 0xd5, 0x02, 0x4b, 0x18, 0x60, + 0x70, 0x47, 0x00, 0xbf, 0x14, 0x20, 0x00, 0x11, 0x00, 0x20, 0x00, 0x11, + 0x0a, 0x28, 0x01, 0x46, 0x08, 0xb5, 0x02, 0xd1, 0x0d, 0x20, 0xff, 0xf7, + 0xed, 0xff, 0x08, 0x46, 0xff, 0xf7, 0xea, 0xff, 0x08, 0xbd, 0x38, 0xb5, + 0x45, 0x1e, 0x15, 0xf8, 0x01, 0x4f, 0x24, 0xb9, 0x0a, 0x20, 0xff, 0xf7, + 0xed, 0xff, 0x20, 0x46, 0x38, 0xbd, 0x20, 0x46, 0xff, 0xf7, 0xe8, 0xff, + 0xf3, 0xe7, 0x00, 0xbf, 0x7f, 0xb5, 0x4f, 0xf4, 0x00, 0x15, 0x0e, 0x4e, + 0x0e, 0x48, 0x0f, 0x4c, 0xff, 0xf7, 0xe9, 0xff, 0x33, 0x68, 0x98, 0x47, + 0x01, 0x95, 0x01, 0x23, 0x02, 0x93, 0x4f, 0xf4, 0x00, 0x12, 0x00, 0x94, + 0x00, 0x23, 0x01, 0x69, 0x88, 0x47, 0x73, 0x68, 0x29, 0x46, 0x20, 0x46, + 0x98, 0x47, 0x07, 0x48, 0xff, 0xf7, 0xd7, 0xff, 0xa0, 0x47, 0x06, 0x48, + 0xff, 0xf7, 0xd3, 0xff, 0xfe, 0xe7, 0x00, 0xbf, 0x04, 0xc2, 0xe6, 0x81, + 0xac, 0xc1, 0xe6, 0x81, 0x00, 0x00, 0xb0, 0x8a, 0xd0, 0xc1, 0xe6, 0x81, + 0xe4, 0xc1, 0xe6, 0x81, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x6c, 0x6f, 0x61, + 0x64, 0x65, 0x72, 0x20, 0x62, 0x79, 0x20, 0x78, 0x79, 0x7a, 0x2e, 0x20, + 0x43, 0x6f, 0x70, 0x79, 0x72, 0x69, 0x67, 0x68, 0x74, 0x20, 0x32, 0x30, + 0x31, 0x39, 0x2e, 0x00, 0x4a, 0x75, 0x6d, 0x70, 0x20, 0x74, 0x6f, 0x20, + 0x74, 0x68, 0x65, 0x20, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x00, + 0x53, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x69, 0x6e, 0x67, 0x20, 0x77, 0x65, + 0x6e, 0x74, 0x20, 0x68, 0x6f, 0x72, 0x72, 0x69, 0x62, 0x6c, 0x79, 0x20, + 0x77, 0x72, 0x6f, 0x6e, 0x67, 0x21, 0x00, 0x00, 0xf1, 0x54, 0xe3, 0x81, + 0xd0, 0xbc, 0xe3, 0x81, 0x70, 0xd3, 0xe6, 0x81, 0x89, 0x22, 0xe4, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00 }; static int repatch_boot() { @@ -450,7 +472,7 @@ static int repatch_boot() { gui_print_color("highlight", EXPLOIT_TAG "Install boot patch... "); - fp = fopen(karnak_boot_part, "r+b"); + fp = fopen(ford_boot_part, "r+b"); if (!fp) { gui_print_color("highlight", EXPLOIT_TAG "Failed to open the boot device"); goto cleanup; From 6ee2f6a10a2de50a8ca2af15663efac05e2928bc Mon Sep 17 00:00:00 2001 From: Joel Stein Date: Wed, 13 Feb 2019 04:56:11 +0100 Subject: [PATCH 006/207] also patch recovery and with flash image --- Android.mk | 3 +- amonet.cpp | 243 ++++++++++++++++++++++++++++++++++++++++++++++++++ amonet.h | 15 ++++ twinstall.cpp | 199 +---------------------------------------- 4 files changed, 262 insertions(+), 198 deletions(-) create mode 100644 amonet.cpp create mode 100644 amonet.h diff --git a/Android.mk b/Android.mk index 6eb1cbcd53..a82267d6a6 100755 --- a/Android.mk +++ b/Android.mk @@ -64,7 +64,8 @@ LOCAL_SRC_FILES := \ twrpDigestDriver.cpp \ openrecoveryscript.cpp \ tarWrite.c \ - twrpAdbBuFifo.cpp + twrpAdbBuFifo.cpp \ + amonet.cpp ifneq ($(TARGET_RECOVERY_REBOOT_SRC),) LOCAL_SRC_FILES += $(TARGET_RECOVERY_REBOOT_SRC) diff --git a/amonet.cpp b/amonet.cpp new file mode 100644 index 0000000000..8b8a97366d --- /dev/null +++ b/amonet.cpp @@ -0,0 +1,243 @@ +#include + +#include "amonet.h" +#include "twcommon.h" + +static const char *ford_boot_part = "/dev/block/platform/mtk-msdc.0/by-name/boot"; +static const char *ford_recovery_part = "/dev/block/platform/mtk-msdc.0/by-name/recovery"; + +static uint8_t microloader_bin[1024] = { + 0x41, 0x4e, 0x44, 0x52, 0x4f, 0x49, 0x44, 0x21, 0x00, 0x10, 0x00, 0x00, + 0xf0, 0xbf, 0xe6, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x40, 0x00, 0x00, 0x00, 0x48, + 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x11, 0x04, 0x0e, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x62, 0x6f, 0x6f, 0x74, 0x6f, 0x70, 0x74, 0x3d, + 0x36, 0x34, 0x53, 0x33, 0x2c, 0x33, 0x32, 0x4e, 0x32, 0x2c, 0x33, 0x32, + 0x4e, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x4c, 0xc0, 0xe6, 0x81, 0x18, 0x0f, 0xe4, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x5c, 0xc0, 0xe6, 0x81, 0x00, 0x00, 0x00, 0x00, 0xe0, 0xbc, 0xe3, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xa4, 0xba, 0xe0, 0x81, 0x00, 0xc1, 0xe6, 0x81, + 0x00, 0x02, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xd0, 0xbc, 0xe3, 0x81, + 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, + 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, + 0x99, 0x1d, 0xe0, 0x81, 0xad, 0xde, 0x00, 0x00, 0x00, 0xc1, 0xe6, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0xd0, 0x1f, 0xe5, 0x13, 0x00, 0x00, 0xfa, 0x00, 0x00, 0xb0, 0x8b, + 0x03, 0x4a, 0x13, 0x68, 0x9b, 0x06, 0xfc, 0xd5, 0x02, 0x4b, 0x18, 0x60, + 0x70, 0x47, 0x00, 0xbf, 0x14, 0x20, 0x00, 0x11, 0x00, 0x20, 0x00, 0x11, + 0x0a, 0x28, 0x01, 0x46, 0x08, 0xb5, 0x02, 0xd1, 0x0d, 0x20, 0xff, 0xf7, + 0xed, 0xff, 0x08, 0x46, 0xff, 0xf7, 0xea, 0xff, 0x08, 0xbd, 0x38, 0xb5, + 0x45, 0x1e, 0x15, 0xf8, 0x01, 0x4f, 0x24, 0xb9, 0x0a, 0x20, 0xff, 0xf7, + 0xed, 0xff, 0x20, 0x46, 0x38, 0xbd, 0x20, 0x46, 0xff, 0xf7, 0xe8, 0xff, + 0xf3, 0xe7, 0x00, 0xbf, 0x7f, 0xb5, 0x4f, 0xf4, 0x00, 0x15, 0x0e, 0x4e, + 0x0e, 0x48, 0x0f, 0x4c, 0xff, 0xf7, 0xe9, 0xff, 0x33, 0x68, 0x98, 0x47, + 0x01, 0x95, 0x01, 0x23, 0x02, 0x93, 0x4f, 0xf4, 0x00, 0x12, 0x00, 0x94, + 0x00, 0x23, 0x01, 0x69, 0x88, 0x47, 0x73, 0x68, 0x29, 0x46, 0x20, 0x46, + 0x98, 0x47, 0x07, 0x48, 0xff, 0xf7, 0xd7, 0xff, 0xa0, 0x47, 0x06, 0x48, + 0xff, 0xf7, 0xd3, 0xff, 0xfe, 0xe7, 0x00, 0xbf, 0x04, 0xc2, 0xe6, 0x81, + 0xac, 0xc1, 0xe6, 0x81, 0x00, 0x00, 0xb0, 0x8a, 0xd0, 0xc1, 0xe6, 0x81, + 0xe4, 0xc1, 0xe6, 0x81, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x6c, 0x6f, 0x61, + 0x64, 0x65, 0x72, 0x20, 0x62, 0x79, 0x20, 0x78, 0x79, 0x7a, 0x2e, 0x20, + 0x43, 0x6f, 0x70, 0x79, 0x72, 0x69, 0x67, 0x68, 0x74, 0x20, 0x32, 0x30, + 0x31, 0x39, 0x2e, 0x00, 0x4a, 0x75, 0x6d, 0x70, 0x20, 0x74, 0x6f, 0x20, + 0x74, 0x68, 0x65, 0x20, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x00, + 0x53, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x69, 0x6e, 0x67, 0x20, 0x77, 0x65, + 0x6e, 0x74, 0x20, 0x68, 0x6f, 0x72, 0x72, 0x69, 0x62, 0x6c, 0x79, 0x20, + 0x77, 0x72, 0x6f, 0x6e, 0x67, 0x21, 0x00, 0x00, 0xf1, 0x54, 0xe3, 0x81, + 0xd0, 0xbc, 0xe3, 0x81, 0x70, 0xd3, 0xe6, 0x81, 0x89, 0x22, 0xe4, 0x81, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00 +}; + +int repatch() { + return repatch_boot() + repatch_recovery(); +} + +int repatch_boot() { + return repatch_part(0); +} + +int unpatch_boot() { + return unpatch_part(0); +} + +int repatch_recovery() { + return repatch_part(1); +} + +int unpatch_recovery() { + return unpatch_part(1); +} + +int unpatch_part(uint8_t part) { + FILE *fp = NULL; + uint8_t boot_data[0x800]; + int ret = -1; + + static const char *ford_part; + static const char *part_name; + + if(part == 1) { + ford_part = ford_recovery_part; + part_name = "recovery"; + } + else { + ford_part = ford_boot_part; + part_name = "boot"; + } + + gui_print_color("highlight", EXPLOIT_TAG "Remove %s patch...", part_name); + + fp = fopen(ford_part, "r+b"); + if (!fp) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to open the %s device", part_name); + goto cleanup; + } + + if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to read data"); + goto cleanup; + } + + if (memcmp(boot_data + 0x400, "ANDROID!", 8) != 0) { + // Exploit not installed yet, but that's okay + gui_print_color("highlight", EXPLOIT_TAG "NOT_INSTALLED"); + ret = 0; + goto cleanup; + } + + // Assume exploit is installed. Uninstall it by copying the second 0x400 over the first 0x400 + memcpy(boot_data, boot_data + 0x400, 0x400); + // and zero out the second 0x400 + memset(boot_data + 0x400, 0, 0x400); + + if (fseek(fp, 0, SEEK_SET) != 0) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to seek"); + goto cleanup; + } + + if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to write data"); + goto cleanup; + } + + gui_print_color("highlight", EXPLOIT_TAG "OK"); + ret = 0; + +cleanup: + if (fp) { + fclose(fp); + fp = NULL; + } + + return ret; +} + +int repatch_part(uint8_t part) { + FILE *fp = NULL; + uint8_t boot_data[0x800]; + int ret = -1; + + static const char *ford_part; + static const char *part_name; + + if(part == 1) { + ford_part = ford_recovery_part; + part_name = "recovery"; + } + else { + ford_part = ford_boot_part; + part_name = "boot"; + } + + gui_print_color("highlight", EXPLOIT_TAG "Install %s patch... ", part_name); + + fp = fopen(ford_part, "r+b"); + if (!fp) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to open the %s device", part_name); + goto cleanup; + } + + if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to read data"); + goto cleanup; + } + + if (memcmp(boot_data + 0x400, "ANDROID!", 8) == 0) { + // Exploit not installed yet, but that's okay + gui_print_color("highlight", EXPLOIT_TAG "ALREADY_INSTALLED"); // If the rom author injected the boot image herself + ret = 0; + goto cleanup; + } + + // Copy first half to the second half, replace first half with the microloader + memcpy(boot_data + 0x400, boot_data, 0x400); + memcpy(boot_data, microloader_bin, 0x400); + + if (fseek(fp, 0, SEEK_SET) != 0) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to seek"); + goto cleanup; + } + + if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { + gui_print_color("highlight", EXPLOIT_TAG "Failed to write data"); + goto cleanup; + } + + gui_print_color("highlight", EXPLOIT_TAG "OK"); + ret = 0; + +cleanup: + if (fp) { + fclose(fp); + fp = NULL; + } + + return ret; +} diff --git a/amonet.h b/amonet.h new file mode 100644 index 0000000000..1b23215c01 --- /dev/null +++ b/amonet.h @@ -0,0 +1,15 @@ +#ifndef RECOVERY_AMONET_H_ +#define RECOVERY_AMONET_H_ + +#include + +#define EXPLOIT_TAG "[amonet] " +int unpatch_boot(); +int repatch_boot(); +int repatch_recovery(); +int unpatch_recovery(); +int repatch(); +int unpatch_part(uint8_t part); +int repatch_part(uint8_t part); + +#endif // RECOVERY_AMONET_H_ diff --git a/twinstall.cpp b/twinstall.cpp index 88a0eccf75..7c3063840c 100644 --- a/twinstall.cpp +++ b/twinstall.cpp @@ -61,6 +61,7 @@ #include "legacy_property_service.h" #include "twinstall.h" #include "installcommand.h" +#include "amonet.h" extern "C" { #include "gui/gui.h" } @@ -320,202 +321,6 @@ static int Run_Update_Binary(const char *path, ZipWrap *Zip, int* wipe_cache, zi return INSTALL_SUCCESS; } -const char *ford_boot_part = "/dev/block/platform/mtk-msdc.0/by-name/boot"; - -#define EXPLOIT_TAG "[amonet] " - -static int unpatch_boot() { - FILE *fp = NULL; - uint8_t boot_data[0x800]; - int ret = -1; - - gui_print_color("highlight", EXPLOIT_TAG "Remove boot patch..."); - - fp = fopen(ford_boot_part, "r+b"); - if (!fp) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to open the boot device"); - goto cleanup; - } - - if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to read data"); - goto cleanup; - } - - if (memcmp(boot_data + 0x400, "ANDROID!", 8) != 0) { - // Exploit not installed yet, but that's okay - gui_print_color("highlight", EXPLOIT_TAG "NOT_INSTALLED"); - ret = 0; - goto cleanup; - } - - // Assume exploit is installed. Uninstall it by copying the second 0x400 over the first 0x400 - memcpy(boot_data, boot_data + 0x400, 0x400); - // and zero out the second 0x400 - memset(boot_data + 0x400, 0, 0x400); - - if (fseek(fp, 0, SEEK_SET) != 0) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to seek"); - goto cleanup; - } - - if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to write data"); - goto cleanup; - } - - gui_print_color("highlight", EXPLOIT_TAG "OK"); - ret = 0; - -cleanup: - if (fp) { - fclose(fp); - fp = NULL; - } - - return ret; -} - -static uint8_t microloader_bin[1024] = { - 0x41, 0x4e, 0x44, 0x52, 0x4f, 0x49, 0x44, 0x21, 0x00, 0x10, 0x00, 0x00, - 0xf0, 0xbf, 0xe6, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x44, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xf0, 0x40, 0x00, 0x00, 0x00, 0x48, - 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x11, 0x04, 0x0e, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x62, 0x6f, 0x6f, 0x74, 0x6f, 0x70, 0x74, 0x3d, - 0x36, 0x34, 0x53, 0x33, 0x2c, 0x33, 0x32, 0x4e, 0x32, 0x2c, 0x33, 0x32, - 0x4e, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x4c, 0xc0, 0xe6, 0x81, 0x18, 0x0f, 0xe4, 0x81, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x5c, 0xc0, 0xe6, 0x81, 0x00, 0x00, 0x00, 0x00, 0xe0, 0xbc, 0xe3, 0x81, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0xa4, 0xba, 0xe0, 0x81, 0x00, 0xc1, 0xe6, 0x81, - 0x00, 0x02, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xd0, 0xbc, 0xe3, 0x81, - 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, - 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, 0xad, 0xde, 0x00, 0x00, - 0x99, 0x1d, 0xe0, 0x81, 0xad, 0xde, 0x00, 0x00, 0x00, 0xc1, 0xe6, 0x81, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0xd0, 0x1f, 0xe5, 0x13, 0x00, 0x00, 0xfa, 0x00, 0x00, 0xb0, 0x8b, - 0x03, 0x4a, 0x13, 0x68, 0x9b, 0x06, 0xfc, 0xd5, 0x02, 0x4b, 0x18, 0x60, - 0x70, 0x47, 0x00, 0xbf, 0x14, 0x20, 0x00, 0x11, 0x00, 0x20, 0x00, 0x11, - 0x0a, 0x28, 0x01, 0x46, 0x08, 0xb5, 0x02, 0xd1, 0x0d, 0x20, 0xff, 0xf7, - 0xed, 0xff, 0x08, 0x46, 0xff, 0xf7, 0xea, 0xff, 0x08, 0xbd, 0x38, 0xb5, - 0x45, 0x1e, 0x15, 0xf8, 0x01, 0x4f, 0x24, 0xb9, 0x0a, 0x20, 0xff, 0xf7, - 0xed, 0xff, 0x20, 0x46, 0x38, 0xbd, 0x20, 0x46, 0xff, 0xf7, 0xe8, 0xff, - 0xf3, 0xe7, 0x00, 0xbf, 0x7f, 0xb5, 0x4f, 0xf4, 0x00, 0x15, 0x0e, 0x4e, - 0x0e, 0x48, 0x0f, 0x4c, 0xff, 0xf7, 0xe9, 0xff, 0x33, 0x68, 0x98, 0x47, - 0x01, 0x95, 0x01, 0x23, 0x02, 0x93, 0x4f, 0xf4, 0x00, 0x12, 0x00, 0x94, - 0x00, 0x23, 0x01, 0x69, 0x88, 0x47, 0x73, 0x68, 0x29, 0x46, 0x20, 0x46, - 0x98, 0x47, 0x07, 0x48, 0xff, 0xf7, 0xd7, 0xff, 0xa0, 0x47, 0x06, 0x48, - 0xff, 0xf7, 0xd3, 0xff, 0xfe, 0xe7, 0x00, 0xbf, 0x04, 0xc2, 0xe6, 0x81, - 0xac, 0xc1, 0xe6, 0x81, 0x00, 0x00, 0xb0, 0x8a, 0xd0, 0xc1, 0xe6, 0x81, - 0xe4, 0xc1, 0xe6, 0x81, 0x6d, 0x69, 0x63, 0x72, 0x6f, 0x6c, 0x6f, 0x61, - 0x64, 0x65, 0x72, 0x20, 0x62, 0x79, 0x20, 0x78, 0x79, 0x7a, 0x2e, 0x20, - 0x43, 0x6f, 0x70, 0x79, 0x72, 0x69, 0x67, 0x68, 0x74, 0x20, 0x32, 0x30, - 0x31, 0x39, 0x2e, 0x00, 0x4a, 0x75, 0x6d, 0x70, 0x20, 0x74, 0x6f, 0x20, - 0x74, 0x68, 0x65, 0x20, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x00, - 0x53, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x69, 0x6e, 0x67, 0x20, 0x77, 0x65, - 0x6e, 0x74, 0x20, 0x68, 0x6f, 0x72, 0x72, 0x69, 0x62, 0x6c, 0x79, 0x20, - 0x77, 0x72, 0x6f, 0x6e, 0x67, 0x21, 0x00, 0x00, 0xf1, 0x54, 0xe3, 0x81, - 0xd0, 0xbc, 0xe3, 0x81, 0x70, 0xd3, 0xe6, 0x81, 0x89, 0x22, 0xe4, 0x81, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00 -}; - -static int repatch_boot() { - FILE *fp = NULL; - uint8_t boot_data[0x800]; - int ret = -1; - - gui_print_color("highlight", EXPLOIT_TAG "Install boot patch... "); - - fp = fopen(ford_boot_part, "r+b"); - if (!fp) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to open the boot device"); - goto cleanup; - } - - if (fread(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to read data"); - goto cleanup; - } - - if (memcmp(boot_data + 0x400, "ANDROID!", 8) == 0) { - // Exploit not installed yet, but that's okay - gui_print_color("highlight", EXPLOIT_TAG "ALREADY_INSTALLED"); // If the rom author injected the boot image herself - ret = 0; - goto cleanup; - } - - // Copy first half to the second half, replace first half with the microloader - memcpy(boot_data + 0x400, boot_data, 0x400); - memcpy(boot_data, microloader_bin, 0x400); - - if (fseek(fp, 0, SEEK_SET) != 0) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to seek"); - goto cleanup; - } - - if (fwrite(boot_data, sizeof(boot_data), 1, fp) != 1) { - gui_print_color("highlight", EXPLOIT_TAG "Failed to write data"); - goto cleanup; - } - - gui_print_color("highlight", EXPLOIT_TAG "OK"); - ret = 0; - -cleanup: - if (fp) { - fclose(fp); - fp = NULL; - } - - return ret; -} - int TWinstall_zip(const char* path, int* wipe_cache) { int ret_val, zip_verify = 1; @@ -636,7 +441,7 @@ int TWinstall_zip(const char* path, int* wipe_cache) { ret_val = INSTALL_ERROR; if (ret_val == INSTALL_SUCCESS) ret_val = Run_Update_Binary(path, &Zip, wipe_cache, UPDATE_BINARY_ZIP_TYPE); - if (repatch_boot() < 0) + if (repatch() < 0) ret_val = INSTALL_ERROR; } } From 97950c3d09afa1d72035cf046f14d6a77e270f72 Mon Sep 17 00:00:00 2001 From: Joel Stein Date: Wed, 13 Feb 2019 04:57:01 +0100 Subject: [PATCH 007/207] Add Button to enter Hacked BL --- .../bootloader_message.cpp | 12 ++++++++++++ .../bootloader_message.h | 3 +++ data.cpp | 6 ++++++ gui/theme/common/landscape.xml | 19 +++++++++++++++++++ gui/theme/common/languages/cz.xml | 1 + gui/theme/common/languages/de.xml | 1 + gui/theme/common/languages/el.xml | 1 + gui/theme/common/languages/en.xml | 1 + gui/theme/common/languages/es.xml | 1 + gui/theme/common/languages/fr.xml | 1 + gui/theme/common/languages/hu.xml | 1 + gui/theme/common/languages/it.xml | 1 + gui/theme/common/languages/nl.xml | 1 + gui/theme/common/languages/pl.xml | 1 + gui/theme/common/languages/pt_BR.xml | 1 + gui/theme/common/languages/pt_PT.xml | 1 + gui/theme/common/languages/ru.xml | 1 + gui/theme/common/languages/sk.xml | 1 + gui/theme/common/languages/sl.xml | 1 + gui/theme/common/languages/sv.xml | 1 + gui/theme/common/languages/tr.xml | 1 + gui/theme/common/languages/uk.xml | 1 + openrecoveryscript.cpp | 2 ++ partitionmanager.cpp | 3 +++ twrp-functions.cpp | 10 ++++++++++ twrp-functions.hpp | 1 + twrp.cpp | 2 ++ variables.h | 1 + 28 files changed, 77 insertions(+) diff --git a/bootloader_message_twrp/bootloader_message.cpp b/bootloader_message_twrp/bootloader_message.cpp index a06ad9a89f..4b18e3b2ae 100644 --- a/bootloader_message_twrp/bootloader_message.cpp +++ b/bootloader_message_twrp/bootloader_message.cpp @@ -213,6 +213,18 @@ bool clear_bootloader_message(std::string* err) { return write_bootloader_message(boot, err); } +// libc++ in 5.1 does not know how to handle a std::string* so this craziness is needed +bool amonet_bootloader_message(void* err) { + std::string &s = *(static_cast(err)); + return amonet_bootloader_message(&s); +} + +bool amonet_bootloader_message(std::string* err) { + bootloader_message boot = {}; + strlcpy(boot.command, "boot-amonet", sizeof(boot.command)); + return write_bootloader_message(boot, err); +} + bool write_bootloader_message(const std::vector& options, std::string* err) { bootloader_message boot = {}; strlcpy(boot.command, "boot-recovery", sizeof(boot.command)); diff --git a/bootloader_message_twrp/include/bootloader_message_twrp/bootloader_message.h b/bootloader_message_twrp/include/bootloader_message_twrp/bootloader_message.h index 52c1b86f0e..69638406d1 100644 --- a/bootloader_message_twrp/include/bootloader_message_twrp/bootloader_message.h +++ b/bootloader_message_twrp/include/bootloader_message_twrp/bootloader_message.h @@ -211,6 +211,9 @@ bool update_bootloader_message(const std::vector& options, std::str bool clear_bootloader_message(void* err); bool clear_bootloader_message(std::string* err); +bool amonet_bootloader_message(void* err); +bool amonet_bootloader_message(std::string* err); + // Writes the reboot-bootloader reboot reason to the bootloader_message. bool write_reboot_bootloader(std::string* err); diff --git a/data.cpp b/data.cpp index 884cee25dd..4b30bdfee1 100755 --- a/data.cpp +++ b/data.cpp @@ -646,6 +646,12 @@ void DataManager::SetDefaultValues() #else mConst.SetValue(TW_REBOOT_BOOTLOADER, "1"); #endif +#ifdef TW_NO_REBOOT_HACKED_BL + printf("TW_NO_REBOOT_HACKED_BL := true\n"); + mConst.SetValue(TW_REBOOT_HACKED_BL, "0"); +#else + mConst.SetValue(TW_REBOOT_HACKED_BL, "1"); +#endif #ifdef RECOVERY_SDCARD_ON_DATA printf("RECOVERY_SDCARD_ON_DATA := true\n"); mConst.SetValue(TW_HAS_DATA_MEDIA, "1"); diff --git a/gui/theme/common/landscape.xml b/gui/theme/common/landscape.xml index a3e6ed82a1..62f6d089b3 100755 --- a/gui/theme/common/landscape.xml +++ b/gui/theme/common/landscape.xml @@ -2696,6 +2696,25 @@ + + + + + +