diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 9da490a..f3dbaf8 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -13,199 +13,10 @@
-
-
-
+
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
@@ -307,45 +118,45 @@
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
-
+
@@ -366,6 +177,15 @@
+
+
+
+ file://$PROJECT_DIR$/main.c
+ 5
+
+
+
+
diff --git a/exploit/exploit.c b/exploit/exploit.c
index fa2b189..42762d3 100644
--- a/exploit/exploit.c
+++ b/exploit/exploit.c
@@ -5,13 +5,26 @@
#include "checkm8.h"
#include "libusb_helpers.h"
-int complete_stage(struct libusb_device_bundle *bundle, int stage_function(struct libusb_device_bundle *bundle))
+int complete_stage(int stage_function(struct libusb_device_bundle *bundle))
{
- libusb_open(bundle->device, &bundle->handle);
- libusb_set_auto_detach_kernel_driver(bundle->handle, 1);
+ libusb_context *usb_ctx = NULL;
+ struct libusb_device_bundle usb_bundle;
+ int ret;
- int ret = stage_function(bundle);
- libusb_close(bundle->handle);
+ libusb_init(&usb_ctx);
+ ret = get_test_device(usb_ctx, &usb_bundle);
+ if(ret != 0)
+ {
+ printf("Error: could not find test device\n");
+ return ret;
+ }
+
+ libusb_open(usb_bundle.device, &usb_bundle.handle);
+ libusb_set_auto_detach_kernel_driver(usb_bundle.handle, 1);
+
+ ret = stage_function(&usb_bundle);
+ libusb_close(usb_bundle.handle);
+ libusb_exit(usb_ctx);
return ret;
}
@@ -95,30 +108,23 @@ int check_function(struct libusb_device_bundle *bundle)
int exploit_device()
{
- libusb_context *usb_ctx = NULL;
- struct libusb_device_bundle usb_bundle;
-
- libusb_init(&usb_ctx);
- get_test_device(usb_ctx, &usb_bundle);
-
- int ret = complete_stage(&usb_bundle, stage1_function);
+ int ret = complete_stage(stage1_function);
if(ret == 0)
{
- ret = complete_stage(&usb_bundle, stage2_function);
+ ret = complete_stage(stage2_function);
usleep(500000);
}
if(ret == 0)
{
- ret = complete_stage(&usb_bundle, stage3_function);
+ ret = complete_stage(stage3_function);
usleep(500000);
}
if(ret == 0)
{
- ret = complete_stage(&usb_bundle, check_function);
+ ret = complete_stage(check_function);
}
- libusb_exit(usb_ctx);
return ret;
}
\ No newline at end of file
diff --git a/exploit/libusb_helpers.c b/exploit/libusb_helpers.c
index 94edf67..afb70f6 100644
--- a/exploit/libusb_helpers.c
+++ b/exploit/libusb_helpers.c
@@ -5,10 +5,10 @@
#include
#include
-void get_test_device(libusb_context *usb_ctx, struct libusb_device_bundle *bundle)
+int get_test_device(libusb_context *usb_ctx, struct libusb_device_bundle *bundle)
{
libusb_device **usb_device_list = NULL;
- int usb_dev_count;
+ int usb_dev_count, ret = 1;
usb_dev_count = libusb_get_device_list(usb_ctx, &usb_device_list);
@@ -23,15 +23,20 @@ void get_test_device(libusb_context *usb_ctx, struct libusb_device_bundle *bundl
if(usb_desc.idVendor == 0x05AC && usb_desc.idProduct == 0x1227)
{
+ ret = 0;
break;
}
}
libusb_free_device_list(usb_device_list, usb_dev_count);
- bundle->ctx = usb_ctx;
- bundle->device = usb_device;
- bundle->handle = usb_handle;
- bundle->descriptor = usb_desc;
+ if(ret == 0)
+ {
+ bundle->device = usb_device;
+ bundle->handle = usb_handle;
+ bundle->descriptor = usb_desc;
+ }
+
+ return ret;
}
void LIBUSB_CALL async_ctrl_transfer_cb(struct libusb_transfer *transfer)
diff --git a/exploit/libusb_helpers.h b/exploit/libusb_helpers.h
index 983ffdb..60bd330 100644
--- a/exploit/libusb_helpers.h
+++ b/exploit/libusb_helpers.h
@@ -5,13 +5,12 @@
struct libusb_device_bundle
{
- struct libusb_context *ctx;
struct libusb_device *device;
struct libusb_device_handle *handle;
struct libusb_device_descriptor descriptor;
};
-void get_test_device(libusb_context *usb_ctx, struct libusb_device_bundle *bundle);
+int get_test_device(libusb_context *usb_ctx, struct libusb_device_bundle *bundle);
void libusb1_async_ctrl_transfer(libusb_device_handle *handle,
unsigned char bmRequestType, unsigned char bRequest,