Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@tewilove
tewilove / f-04j_verity_bypass.c
Last active March 6, 2024 11:39
F-04J verity bypass bug
#include <sys/types.h>
#include <fcntl.h>
#include <inttypes.h>
#include <unistd.h>
#include "f-04j.h"
#define OFFSET_ENTRY 0xA0
#define OFFSET_DATA 0x3620
struct nv_entry {
B - 724192 - huawei_oba_mode_check begin
B - 2539125 - emmc read sucessfully
B - 2546231 - huawei_sd_auto_update_check: init efs error
B - 2553338 - huawei_check_sd_app_exist
B - 2739235 - card and update.app are all exist
B - 2793342 - huawei_check_sd_boot
B - 2807128 - Error mounting /hdev/sdc1h0p33 on /sys_boot : 1024
@tewilove
tewilove / relf2koji.c
Created March 3, 2022 10:37
My own elf packer for ARM/AARCH64.
#include <sys/types.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stddef.h>
#include <stdio.h>
@tewilove
tewilove / 903KC_dlpager.py
Created July 22, 2021 07:56
Uncompress ROX segment for Qualcomm modem firmware.
#/bin/env python
from idautils import *
from idaapi import *
from ida_bytes import *
from ida_segment import *
PAGE_SIZE = 4096
# Tested version:
@tewilove
tewilove / MO-01J_dlpager.py
Last active July 22, 2021 07:56
Uncompress ROX segment for Qualcomm modem firmware.
#/bin/env python
from idautils import *
from idaapi import *
from ida_bytes import *
from ida_segment import *
PAGE_SIZE = 4096
# Tested version:
@tewilove
tewilove / checkupgrade.lua
Last active December 29, 2020 05:17
From Xiaomi AX3600, version 1.0.79, produced by unluac_2020_05_28.jar.
--c736578b1d7c82e2df2a4f770e46ecb3e50c393776a03300ab45428cec78ecda ./rootfs/usr/sbin/checkupgrade.lua
--d0069d4b6c0bb716b07e0e014757f99f7baaabf7b270d17da6bfc5637a4cb2bb ./rootfs/usr/sbin/checkupgrade.lua.dec
local L0, L1, L2, L3, L4, L5, L6, L7, L8, L9, L10, L11, L12, L13, L14, L15, L16, L17, L18, L19, L20, L21, L22, L23, L24, L25
L0 = require
L1 = "xiaoqiang.common.XQConfigs"
L0 = L0(L1)
L1 = require
L2 = "xiaoqiang.common.XQFunction"
L1 = L1(L2)
L2 = require
@tewilove
tewilove / N-02E_diag.c
Created August 17, 2020 13:08
Enables or disables N-02E diag interface without root.
#include <dlfcn.h>
#include <fcntl.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
typedef int (*nv_cmd_remote_t)(int, int, void *);
int main(int argc, char *argv[])
{
@tewilove
tewilove / CVE-2018-9568.c
Last active April 8, 2020 11:15
CVE-2018-9568
/*
* The BUG:
* *(obj + offset_v4) remains unchanged.
* Subsequential allcation will return a live object.
* Side effect:
* *(obj + offset_v6) = 0.
* The page will be linked into v6 slab CPU partial list.
* Plan A:
* A full slab.
* 1 2 3 4 W A B C D
<?php
$req = array(
"method" => "get_all_builds",
"params" => array(
"device" => "icesky_msm8992_user", // ro.product.device + "_" + ro.build.type
"version" => "2.5.3-2016012303-user-is", // ro.smartisan.version
"buildtime" => "1453489594", // ro.build.date.utc
"deviceid" => "990006210028584", // IMEI
"flag" => "0", // rooted
)