grg/checkm8_tool
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

A whole lot of changes to make the code more device-oriented

Browse Source
This commit is contained in:
Gregor Haas
2019-12-10 16:25:11 -05:00
parent 572ce57230
commit 941c476251
13 changed files with 311 additions and 258 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
checkm8_remote/include/checkm8.h
View File

@@ -1,14 +1,43 @@
#ifndef IPWNDFU_REWRITE_C_CHECKM8_H
#define IPWNDFU_REWRITE_C_CHECKM8_H
int exploit_device();
#include "checkm8_config.h"
#define AES_ENCRYPT 16
#define AES_DECRYPT 17
#define CHECKM8_SUCCESS 0
#define CHECKM8_FAIL_NODEV -1
#define CHECKM8_FAIL_NOEXP -2
#define AES_GID_KEY 0x2000200
#define AES_UID_KEY 0x2000201
#define IS_CHECKM8_FAIL(code) code < 0
int aes(unsigned char *source, unsigned char *target, int encrypt, int key);
#if CHECKM8_PLATFORM == 8010
#define DEV_IDVENDOR 0x05AC
#define DEV_IDPRODUCT 0x1227
#else
#error "Unspported checkm8 platform"
#endif
struct libusb_device_bundle
{
struct libusb_context *ctx;
struct libusb_device *device;
struct libusb_device_handle *handle;
struct libusb_device_descriptor *descriptor;
};
struct pwned_device
{
enum
{
DEV_NORMAL,
DEV_PWNED
} status;
unsigned int idVendor;
unsigned int idProduct;
struct libusb_device_bundle *bundle;
};
struct pwned_device *exploit_device();
void free_device(struct pwned_device *dev);
#endif //IPWNDFU_REWRITE_C_CHECKM8_H

28
checkm8_remote/include/libusb_helpers.h
View File

@@ -1,35 +1,31 @@
#ifndef IPWNDFU_REWRITE_C_LIBUSB_HELPERS_H
#define IPWNDFU_REWRITE_C_LIBUSB_HELPERS_H
#include "libusb-1.0/libusb.h"
#include "checkm8.h"
struct libusb_device_bundle
{
struct libusb_device *device;
struct libusb_device_handle *handle;
struct libusb_device_descriptor descriptor;
};
#define LIBUSB_MAX_PACKET_SIZE 0x800
int get_test_device(libusb_context *usb_ctx, struct libusb_device_bundle *bundle);
int get_device_bundle(struct pwned_device *dev);
int release_device_bundle(struct pwned_device *dev);
void libusb1_async_ctrl_transfer(libusb_device_handle *handle,
void libusb1_async_ctrl_transfer(struct pwned_device *dev,
unsigned char bmRequestType, unsigned char bRequest,
unsigned short wValue, unsigned short wIndex,
unsigned char *data, unsigned short data_len,
unsigned int timeout);
void libusb1_no_error_ctrl_transfer(libusb_device_handle *handle,
void libusb1_no_error_ctrl_transfer(struct pwned_device *dev,
unsigned char bmRequestType, unsigned char bRequest,
unsigned short wValue, unsigned short wIndex,
unsigned char *data, unsigned short data_len,
unsigned int timeout);
void stall(libusb_device_handle *handle);
void leak(libusb_device_handle *handle);
void no_leak(libusb_device_handle *handle);
void stall(struct pwned_device *dev);
void leak(struct pwned_device *dev);
void no_leak(struct pwned_device *dev);
void usb_req_stall(libusb_device_handle *handle);
void usb_req_leak(libusb_device_handle *handle);
void usb_req_no_leak(libusb_device_handle *handle);
void usb_req_stall(struct pwned_device *dev);
void usb_req_leak(struct pwned_device *dev);
void usb_req_no_leak(struct pwned_device *dev);
#endif //IPWNDFU_REWRITE_C_LIBUSB_HELPERS_H

7
checkm8_remote/include/payload.h
View File

@@ -1,4 +1,11 @@
#ifndef IPWNDFU_REWRITE_C_PAYLOAD_H
#define IPWNDFU_REWRITE_C_PAYLOAD_H
typedef enum
{
PAYLOAD_AES
} PAYLOAD_T;
struct payload *get_payload(PAYLOAD_T p);
#endif //IPWNDFU_REWRITE_C_PAYLOAD_H