diff --git a/mtkclient/Library/Connection/devicehandler.py b/mtkclient/Library/Connection/devicehandler.py index 67cd72a0..0bed1153 100644 --- a/mtkclient/Library/Connection/devicehandler.py +++ b/mtkclient/Library/Connection/devicehandler.py @@ -39,6 +39,12 @@ def __init__(self, loglevel=logging.INFO, portconfig=None, devclass=-1): fh = logging.FileHandler(logfilename, encoding='utf-8') self.__logger.addHandler(fh) + def get_read_packetsize(self): + raise NotImplementedError() + + def get_write_packetsize(self): + raise NotImplementedError() + def connect(self, EP_IN=-1, EP_OUT=-1): raise NotImplementedError() diff --git a/mtkclient/Library/Connection/seriallib.py b/mtkclient/Library/Connection/seriallib.py index 7a194e75..6fc0e03b 100755 --- a/mtkclient/Library/Connection/seriallib.py +++ b/mtkclient/Library/Connection/seriallib.py @@ -27,6 +27,7 @@ class serial_class(DeviceClass): def __init__(self, loglevel=logging.INFO, portconfig=None, devclass=-1): super().__init__(loglevel, portconfig, devclass) self.is_serial = True + self.device = None def connect(self, EP_IN=-1, EP_OUT=-1): if self.connected: @@ -39,11 +40,14 @@ def connect(self, EP_IN=-1, EP_OUT=-1): elif self.portname is not None: self.device = serial.Serial(baudrate=115200, bytesize=serial.EIGHTBITS, parity=serial.PARITY_NONE, stopbits=serial.STOPBITS_ONE, - timeout=50, - xonxoff=False, dsrdtr=True, rtscts=True) + timeout=500, + xonxoff=False, dsrdtr=False, rtscts=False) self.device._reset_input_buffer = _reset_input_buffer self.device.setPort(port=self.portname) - self.device.open() + try: + self.device.open() + except Exception: + pass self.device._reset_input_buffer = _reset_input_buffer_org self.connected = self.device.is_open if self.connected: @@ -56,10 +60,26 @@ def setportname(self, portname: str): def set_fast_mode(self, enabled): pass + def changeBaud(self): + print("Changing Baudrate") + self.write(b'\xD2' + b'\x02' + b'\x01') + self.read(1) + self.write(b'\x5a') + # self.read(1) + self.device.baudrate = 460800 + time.sleep(0.2) + for i in range(10): + self.write(b'\xc0') + self.read(1) + time.sleep(0.02) + self.write(b'\x5a') + self.read(1) + def close(self, reset=False): if self.connected: self.device.close() del self.device + self.device = None self.connected = False def detectdevices(self): @@ -148,18 +168,36 @@ def read(self, length=None, timeout=-1): if self.xmlread: if length > self.device.in_waiting: length = self.device.in_waiting - return self.usbread(length, timeout) + return self.usbread(resplen=length, maxtimeout=timeout) + + def getDevice(self): + return self.device + + def get_read_packetsize(self): + return 0x200 + + def get_write_packetsize(self): + return 0x200 def flush(self): + if self.getDevice() is not None: + self.device.flushOutput() return self.device.flush() - def usbread(self, resplen=None, timeout=0): + def usbread(self, resplen=None, maxtimeout=0, timeout=0): + # print("Reading {} bytes".format(resplen)) + if timeout == 0 and maxtimeout != 0: + timeout = maxtimeout / 1000 # Some code calls this with ms delays, some with seconds. + if timeout < 0.02: + timeout = 0.02 if resplen is None: resplen = self.device.in_waiting if resplen <= 0: self.info("Warning !") res = bytearray() loglevel = self.loglevel + if self.device is None: + return b"" self.device.timeout = timeout epr = self.device.read extend = res.extend diff --git a/mtkclient/Library/Connection/usblib.py b/mtkclient/Library/Connection/usblib.py index 0ee5e6ce..0d4b0b99 100755 --- a/mtkclient/Library/Connection/usblib.py +++ b/mtkclient/Library/Connection/usblib.py @@ -16,8 +16,9 @@ from enum import Enum from binascii import hexlify from ctypes import c_void_p, c_int -from mtkclient.Library.utils import write_object + from mtkclient.Library.DA.xml.xml_param import max_xml_data_length +from mtkclient.Library.utils import write_object from mtkclient.Library.Connection.devicehandler import DeviceClass USB_DIR_OUT = 0 # to device @@ -42,17 +43,54 @@ tag = 0 -CDC_CMDS = { - "SEND_ENCAPSULATED_COMMAND": 0x00, - "GET_ENCAPSULATED_RESPONSE": 0x01, - "SET_COMM_FEATURE": 0x02, - "GET_COMM_FEATURE": 0x03, - "CLEAR_COMM_FEATURE": 0x04, - "SET_LINE_CODING": 0x20, - "GET_LINE_CODING": 0x21, - "SET_CONTROL_LINE_STATE": 0x22, - "SEND_BREAK": 0x23, # wValue is break time -} + +class CDC_CMDS: + SEND_ENCAPSULATED_COMMAND = 0x00 + GET_ENCAPSULATED_RESPONSE = 0x01 + SET_COMM_FEATURE = 0x02 + GET_COMM_FEATURE = 0x03 + CLEAR_COMM_FEATURE = 0x04 + SET_AUX_LINE_STATE = 0x10 + SET_HOOK_STATE = 0x11 + PULSE_SETUP = 0x12 + SEND_PULSE = 0x13 + SEND_PULSE_TIME = 0x14 + RING_AUX_JACK = 0x15 + SET_LINE_CODING = 0x20 + GET_LINE_CODING = 0x21 + SET_CONTROL_LINE_STATE = 0x22 + SEND_BREAK = 0x23 # wValue is break time + SET_RINGER_PARMS = 0x30 + GET_RINGER_PARMS = 0x31 + SET_OPERATION_PARMS = 0x32 + GET_OPERATION_PARMS = 0x33 + SET_LINE_PARMS = 0x34 + GET_LINE_PARMS = 0x35 + DIAL_DIGITS = 0x36 + SET_UNIT_PARAMETER = 0x37 + GET_UNIT_PARAMETER = 0x38 + CLEAR_UNIT_PARAMETER = 0x39 + GET_PROFILE = 0x3A + SET_ETHERNET_MULTICAST_FILTERS = 0x40 + SET_ETHERNET_POWER_MANAGEMENT_PATTERN_FILTER = 0x41 + GET_ETHERNET_POWER_MANAGEMENT_PATTERN_FILTER = 0x42 + SET_ETHERNET_PACKET_FILTER = 0x43 + GET_ETHERNET_STATISTIC = 0x44 + SET_ATM_DATA_FORMAT = 0x50 + GET_ATM_DEVICE_STATISTICS = 0x51 + SET_ATM_DEFAULT_VC = 0x52 + GET_ATM_VC_STATISTICS = 0x53 + GET_NTB_PARAMETERS = 0x80 + GET_NET_ADDRESS = 0x81 + SET_NET_ADDRESS = 0x82 + GET_NTB_FORMAT = 0x83 + SET_NTB_FORMAT = 0x84 + GET_NTB_INPUT_SIZE = 0x85 + SET_NTB_INPUT_SIZE = 0x86 + GET_MAX_DATAGRAM_SIZE = 0x87 + SET_MAX_DATAGRAM_SIZE = 0x88 + GET_CRC_MODE = 0x89 + SET_CRC_MODE = 0x8A class usb_class(DeviceClass): @@ -164,7 +202,7 @@ def setLineCoding(self, baudrate=None, parity=0, databits=8, stopbits=1): dbits = {5, 6, 7, 8, 16} pmodes = {0, 1, 2, 3, 4} brates = {300, 600, 1200, 2400, 4800, 9600, 14400, - 19200, 28800, 38400, 57600, 115200, 230400} + 19200, 28800, 38400, 57600, 115200, 230400, 460800, 921600} if stopbits is not None: if stopbits not in sbits.keys(): @@ -214,7 +252,7 @@ def setLineCoding(self, baudrate=None, parity=0, databits=8, stopbits=1): req_type = (txdir << 7) + (req_type << 5) + recipient data = bytearray(linecode) wlen = self.device.ctrl_transfer( - req_type, CDC_CMDS["SET_LINE_CODING"], + req_type, CDC_CMDS.SET_LINE_CODING, data_or_wLength=data, wIndex=1) self.debug("Linecoding set, {}b sent".format(wlen)) @@ -224,11 +262,12 @@ def setbreak(self): recipient = 1 # 0:device, 1:interface, 2:endpoint, 3:other req_type = (txdir << 7) + (req_type << 5) + recipient wlen = self.device.ctrl_transfer( - bmRequestType=req_type, bRequest=CDC_CMDS["SEND_BREAK"], + bmRequestType=req_type, bRequest=CDC_CMDS.SEND_BREAK, wValue=0, data_or_wLength=0, wIndex=1) self.debug("Break set, {}b sent".format(wlen)) def setcontrollinestate(self, RTS=None, DTR=None, isFTDI=False): + cmds = CDC_CMDS() ctrlstate = (2 if RTS else 0) + (1 if DTR else 0) if isFTDI: ctrlstate += (1 << 8) if DTR is not None else 0 @@ -241,7 +280,7 @@ def setcontrollinestate(self, RTS=None, DTR=None, isFTDI=False): wlen = self.device.ctrl_transfer( bmRequestType=req_type, - bRequest=1 if isFTDI else CDC_CMDS["SET_CONTROL_LINE_STATE"], + bRequest=1 if isFTDI else cmds.SET_CONTROL_LINE_STATE, wValue=ctrlstate, wIndex=1, data_or_wLength=0) @@ -333,13 +372,15 @@ def connect(self, EP_IN=-1, EP_OUT=-1): if EP_OUT == -1: self.EP_OUT = usb.util.find_descriptor(itf, # match the first OUT endpoint - custom_match=lambda em: usb.util.endpoint_direction( - em.bEndpointAddress) == usb.util.ENDPOINT_OUT) + custom_match=lambda e: + usb.util.endpoint_direction(e.bEndpointAddress) == + usb.util.ENDPOINT_OUT) if EP_IN == -1: self.EP_IN = usb.util.find_descriptor(itf, # match the first OUT endpoint - custom_match=lambda em: usb.util.endpoint_direction( - em.bEndpointAddress) == usb.util.ENDPOINT_IN) + custom_match=lambda e: \ + usb.util.endpoint_direction(e.bEndpointAddress) == + usb.util.ENDPOINT_IN) self.connected = True return True print("Couldn't find CDC interface. Aborting.") @@ -379,27 +420,15 @@ def write(self, command, pktsize=None): if isinstance(command, str): command = bytes(command, 'utf-8') pos = 0 - if command == b'': - try: - self.EP_OUT.write(b'') - except usb.core.USBError as err: - error = str(err.strerror) - if "timeout" in error: - # time.sleep(0.01) - try: - self.EP_OUT.write(b'') - except Exception as err: - self.debug(str(err)) - return False - return True - else: + if command != b'': i = 0 while pos < len(command): try: ctr = self.EP_OUT.write(command[pos:pos + pktsize]) if ctr <= 0: self.info(ctr) - pos += pktsize + else: + pos += ctr except Exception as err: self.debug(str(err)) # print("Error while writing") @@ -408,9 +437,28 @@ def write(self, command, pktsize=None): if i == 3: return False pass + else: + try: + self.EP_OUT.write(b'') + except usb.core.USBError as err: + error = str(err.strerror) + if "timeout" in error: + # time.sleep(0.01) + try: + self.EP_OUT.write(b'') + except Exception as err: + self.debug(str(err)) + return False + return True self.verify_data(bytearray(command), "TX:") return True + def get_read_packetsize(self): + return self.EP_IN.wMaxPacketSize + + def get_write_packetsize(self): + return self.EP_OUT.wMaxPacketSize + def usbread(self, resplen=None, maxtimeout=100): if resplen is None: resplen = self.maxsize @@ -743,6 +791,7 @@ def send_alcatel_adbenable(self): # Alcatel MW41 common_cmnd = b"\x16\xf9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" lun = 0 timeout = 5000 + # ret_tag = self.send_mass_storage_command(lun, common_cmnd, USB_DIR_IN, 0x600) if datasize > 0: data = self.usb.read(datasize, timeout) diff --git a/mtkclient/Tools/decode.py b/mtkclient/Tools/decode.py index 0401fc75..ffdf53c9 100755 --- a/mtkclient/Tools/decode.py +++ b/mtkclient/Tools/decode.py @@ -3,236 +3,236 @@ from struct import pack from binascii import hexlify -dat=[ -0x200640, -0x100, -0x2009BC, -0x20060C, -0x1, -0x956FC3F1, -0xFC44ED52, -0x110, -0x30, -0xB88D2DE6, -0x420AFD30, -0x981673DC, -0xCEF139F6, -0x7D7EBEBF, -0x453663E9, -0x80C24808, -0x31D907A3, -0x1A00116C, -0xDA35675B, -0xA5A7407A, -0x93AB1070, -0xA6C10A71, -0xF7DCA502, -0x507F584D, -0xAF6FF845, -0xA987DDCC, -0x59A4A85B, -0xBF79EDB5, -0xAFEE683A, -0x7FB92904, -0xC8AECBF5, -0x417111DF, -0xC9674933, -0xB5584779, -0xCE870108, -0x1EB5ED61, -0x680DA351, -0x11F4C09F, -0x9E657A29, -0x9EC0896, -0xBA8AA025, -0x5DB75909, -0xC9C04648, -0x7CFBF2DE, -0x97401150, -0x9B607559, -0xCDDBB1B4, -0x79F3ABE2, -0x589E0744, -0x783473D3, -0x9E944CF2, -0x105C1944, -0xE2E94E57, -0x2752C848, -0x9F46B50, -0xF9FC82B5, -0x4F27A5C, -0xEE2D404, -0xE4227778, -0xB469652D, -0xB97E773E, -0x5AF74F66, -0x2774802F, -0xD8D46FD, -0x53D02BE9, -0xC981FADC, -0x97448D08, -0x1DE7B5A3, -0x61116241, -0xC2CA39C4, -0x305022B9, -0xB6B88748, -0x2EE14D00, -0xE62F5BB0, -0xA552FFD7, -0x321F0BBE, -0xA637A977, -0x8A7E95D0, -0x93C0EC5F, -0x5E42AA13, -0x10FAB161, -0x4E20BFE3, -0x1208EAAC, -0xDCBC80E8, -0xC6CC5571, -0x4C0C7A75, -0xA5B5AE44, -0x2E9285DE, -0xC9585FC2, -0x8DE3F166, -0xEAD706BC, -0x8362E701, -0x4B3CA8C9, -0xDE2DE227, -0x50D72910, -0x47DDAE24, -0x251A1AE8, -0x6EEA11F3, -0x77213D30, -0xEBF0C572, -0xCB8674AE, -0x1B0C0665, -0xDAC240F6, -0xE13686F6, -0xE1A57AA9, -0x4C95FD31, -0xB4DFE80B, -0x822A2B20, -0x65B82AA1, -0x55933F7B, -0xE9859433, -0x822B1C12, -0xCC62A517, -0x8024C43F, -0xBBBB8397, -0x14E1AA71, -0x5E4B2739, -0x290643A3, -0x5B319383, -0xAFF63229, -0xD533632E, -0x2574FB7D, -0x36584B13, -0x7E3A89A0, -0xA3055297, -0xE1FDC3BB, -0xAC2BCF8B, -0xE2B3D63, -0xB8621010, -0x226C7FC3, -0x16B7325D, -0x1E8D7217, -0x6429282D, -0x857A06BE, -0x93DC2A42, -0xFFEE5953, -0x97E14DC, -0x970A0109, -0xF8569B9E, -0x42D481C4, -0x48463BA2, -0x80439D11, -0x46A26CC8, -0xF9286FFF, -0xAC75485, -0xF041347A, -0xAAF4877A, -0xA62E4D5A, -0x93BD8D8E, -0x10101010, -0x10101010, -0x10101010, -0x10101010, -0x0, -0x0, -0x0, -0x0, -0xF82D9879, -0xDA1900FB, -0x58EBFFF2, -0x4EB2DFB4, -0x1C33F5A4, -0x370C5164, -0x9221FC94, -0x5004E2C3, -0x7FD052F6, -0x7595B765, -0x18DF431D, -0xE9923FD0, -0xA092A13, -0x5FD2884C, -0xC7E313BA, -0xE61A166, -0xC2B78486, -0x7E514A14, -0x19E03A5C, -0xD34147FA, -0xD458DDEC, -0xC944D376, -0x7BBDBA4, -0x13C87753, -0x55524FFD, -0xCCAC8772, -0x542AD157, -0xA0CB045A, -0xB950F97A, -0x2245DF6B, -0x418D3050, -0x26DF2DF2, -0x8A5BC3CE, -0xE142848, -0xE3D8C454, -0xC1DA9D2D, -0x3511D990, -0xD42A0CD0, -0x9132E073, -0x33A1702, -0xEAB064F2, -0x6CF228D0, -0x840D744D, -0xC87F2596, -0xB5166023, -0xCA00D29C, -0x6A5B6AA2, -0x68E72E20, -0x226F2776, -0x8395A840, -0xF7553CAB, -0x21FE7AA6, -0x6CADDABD, -0xDBCA4AD9, -0x43142719, -0x3F8F15DE, -0x22AE6502, -0xFAE8C0C9, -0xD32715EF, -0x53544A23, -0x603C72C2, -0xD0B37957, -0x14D0BCB0, -0x8AF20686, -0x246300, -0x70000000, -0x70000000 +dat = [ + 0x200640, + 0x100, + 0x2009BC, + 0x20060C, + 0x1, + 0x956FC3F1, + 0xFC44ED52, + 0x110, + 0x30, + 0xB88D2DE6, + 0x420AFD30, + 0x981673DC, + 0xCEF139F6, + 0x7D7EBEBF, + 0x453663E9, + 0x80C24808, + 0x31D907A3, + 0x1A00116C, + 0xDA35675B, + 0xA5A7407A, + 0x93AB1070, + 0xA6C10A71, + 0xF7DCA502, + 0x507F584D, + 0xAF6FF845, + 0xA987DDCC, + 0x59A4A85B, + 0xBF79EDB5, + 0xAFEE683A, + 0x7FB92904, + 0xC8AECBF5, + 0x417111DF, + 0xC9674933, + 0xB5584779, + 0xCE870108, + 0x1EB5ED61, + 0x680DA351, + 0x11F4C09F, + 0x9E657A29, + 0x9EC0896, + 0xBA8AA025, + 0x5DB75909, + 0xC9C04648, + 0x7CFBF2DE, + 0x97401150, + 0x9B607559, + 0xCDDBB1B4, + 0x79F3ABE2, + 0x589E0744, + 0x783473D3, + 0x9E944CF2, + 0x105C1944, + 0xE2E94E57, + 0x2752C848, + 0x9F46B50, + 0xF9FC82B5, + 0x4F27A5C, + 0xEE2D404, + 0xE4227778, + 0xB469652D, + 0xB97E773E, + 0x5AF74F66, + 0x2774802F, + 0xD8D46FD, + 0x53D02BE9, + 0xC981FADC, + 0x97448D08, + 0x1DE7B5A3, + 0x61116241, + 0xC2CA39C4, + 0x305022B9, + 0xB6B88748, + 0x2EE14D00, + 0xE62F5BB0, + 0xA552FFD7, + 0x321F0BBE, + 0xA637A977, + 0x8A7E95D0, + 0x93C0EC5F, + 0x5E42AA13, + 0x10FAB161, + 0x4E20BFE3, + 0x1208EAAC, + 0xDCBC80E8, + 0xC6CC5571, + 0x4C0C7A75, + 0xA5B5AE44, + 0x2E9285DE, + 0xC9585FC2, + 0x8DE3F166, + 0xEAD706BC, + 0x8362E701, + 0x4B3CA8C9, + 0xDE2DE227, + 0x50D72910, + 0x47DDAE24, + 0x251A1AE8, + 0x6EEA11F3, + 0x77213D30, + 0xEBF0C572, + 0xCB8674AE, + 0x1B0C0665, + 0xDAC240F6, + 0xE13686F6, + 0xE1A57AA9, + 0x4C95FD31, + 0xB4DFE80B, + 0x822A2B20, + 0x65B82AA1, + 0x55933F7B, + 0xE9859433, + 0x822B1C12, + 0xCC62A517, + 0x8024C43F, + 0xBBBB8397, + 0x14E1AA71, + 0x5E4B2739, + 0x290643A3, + 0x5B319383, + 0xAFF63229, + 0xD533632E, + 0x2574FB7D, + 0x36584B13, + 0x7E3A89A0, + 0xA3055297, + 0xE1FDC3BB, + 0xAC2BCF8B, + 0xE2B3D63, + 0xB8621010, + 0x226C7FC3, + 0x16B7325D, + 0x1E8D7217, + 0x6429282D, + 0x857A06BE, + 0x93DC2A42, + 0xFFEE5953, + 0x97E14DC, + 0x970A0109, + 0xF8569B9E, + 0x42D481C4, + 0x48463BA2, + 0x80439D11, + 0x46A26CC8, + 0xF9286FFF, + 0xAC75485, + 0xF041347A, + 0xAAF4877A, + 0xA62E4D5A, + 0x93BD8D8E, + 0x10101010, + 0x10101010, + 0x10101010, + 0x10101010, + 0x0, + 0x0, + 0x0, + 0x0, + 0xF82D9879, + 0xDA1900FB, + 0x58EBFFF2, + 0x4EB2DFB4, + 0x1C33F5A4, + 0x370C5164, + 0x9221FC94, + 0x5004E2C3, + 0x7FD052F6, + 0x7595B765, + 0x18DF431D, + 0xE9923FD0, + 0xA092A13, + 0x5FD2884C, + 0xC7E313BA, + 0xE61A166, + 0xC2B78486, + 0x7E514A14, + 0x19E03A5C, + 0xD34147FA, + 0xD458DDEC, + 0xC944D376, + 0x7BBDBA4, + 0x13C87753, + 0x55524FFD, + 0xCCAC8772, + 0x542AD157, + 0xA0CB045A, + 0xB950F97A, + 0x2245DF6B, + 0x418D3050, + 0x26DF2DF2, + 0x8A5BC3CE, + 0xE142848, + 0xE3D8C454, + 0xC1DA9D2D, + 0x3511D990, + 0xD42A0CD0, + 0x9132E073, + 0x33A1702, + 0xEAB064F2, + 0x6CF228D0, + 0x840D744D, + 0xC87F2596, + 0xB5166023, + 0xCA00D29C, + 0x6A5B6AA2, + 0x68E72E20, + 0x226F2776, + 0x8395A840, + 0xF7553CAB, + 0x21FE7AA6, + 0x6CADDABD, + 0xDBCA4AD9, + 0x43142719, + 0x3F8F15DE, + 0x22AE6502, + 0xFAE8C0C9, + 0xD32715EF, + 0x53544A23, + 0x603C72C2, + 0xD0B37957, + 0x14D0BCB0, + 0x8AF20686, + 0x246300, + 0x70000000, + 0x70000000 ] -strm="" +strm = "" for val in dat: - strm+=hexlify(pack("address>=0x10210000: - print("CBR %08X:%08X" % (address,value)) + elif 0x10220000 > address >= 0x10210000: + print("CBR %08X:%08X" % (address, value)) return True -def hook_mem_write(uc,access,address,size,value,user_data): +def hook_mem_write(uc, access, address, size, value, user_data): global buffer global data - pc = uc.reg_read(UC_ARM_REG_PC) + # pc = uc.reg_read(UC_ARM_REG_PC) if address == 0x10007000: - data+="WD: 0x10007000" + data += "WD: 0x10007000" print("WD: 0x10007000") return True elif address == 0x1000108C: @@ -84,24 +93,25 @@ def hook_mem_write(uc,access,address,size,value,user_data): elif address == 0x10001088: print("TZCC_CLK 0x10001088 %x" % value) return True - elif 0x10220000>address>=0x10210000: - print("CBW %08X,%08X" % (address,value)) + elif 0x10220000 > address >= 0x10210000: + print("CBW %08X,%08X" % (address, value)) return True - #else: + # else: # data=hex(value) # print("MW %08X:%d:%s" %(address,size,data)) -def hook_code(uc,access,address,size): + +def hook_code(uc, access, address, size): pc = uc.reg_read(UC_ARM_REG_PC) lr = uc.reg_read(UC_ARM_REG_LR) - if pc==0x23158C: + if pc == 0x23158C: r0 = uc.reg_read(UC_ARM_REG_R0) r1 = uc.reg_read(UC_ARM_REG_R1) r2 = uc.reg_read(UC_ARM_REG_R2) - print("sasi_paldmamap PC(%08X) R0:%08X,R1:%08X,R2:%08X" % (lr,r0,r1,r2)) - print("SRC:"+hexlify(uc.mem_read(r0,16)).decode('utf-8')) - print("DST:"+hex(r2)) - elif pc==0x230DF8: + print("sasi_paldmamap PC(%08X) R0:%08X,R1:%08X,R2:%08X" % (lr, r0, r1, r2)) + print("SRC:" + hexlify(uc.mem_read(r0, 16)).decode('utf-8')) + print("DST:" + hex(r2)) + elif pc == 0x230DF8: r0 = uc.reg_read(UC_ARM_REG_R0) r1 = uc.reg_read(UC_ARM_REG_R1) r2 = uc.reg_read(UC_ARM_REG_R2) @@ -110,9 +120,10 @@ def hook_code(uc,access,address,size): r7 = uc.reg_read(UC_ARM_REG_R7) r9 = uc.reg_read(UC_ARM_REG_R9) r11 = uc.reg_read(UC_ARM_REG_R11) - print("SBROM_AesCmac PC(%08X) R0:%08X,R1:%08X,R2:%08X,R3:%08X,R4:%08X,R7:%08X,R9:%08X,R11:%08X" % (lr, r0, r1, r2, r3, r4,r7,r9,r11)) + print("SBROM_AesCmac PC(%08X) R0:%08X,R1:%08X,R2:%08X,R3:%08X,R4:%08X,R7:%08X,R9:%08X,R11:%08X" % ( + lr, r0, r1, r2, r3, r4, r7, r9, r11)) print("Buffer:" + hexlify(uc.mem_read(r9, r7)).decode('utf-8')) - elif pc==0x230CB6: + elif pc == 0x230CB6: r0 = uc.reg_read(UC_ARM_REG_R0) r1 = uc.reg_read(UC_ARM_REG_R1) r2 = uc.reg_read(UC_ARM_REG_R2) @@ -120,22 +131,23 @@ def hook_code(uc,access,address,size): r4 = uc.reg_read(UC_ARM_REG_R4) r5 = uc.reg_read(UC_ARM_REG_R5) r6 = uc.reg_read(UC_ARM_REG_R6) - print("SBROM_AesCmacDriver PC(%08X) R0:%08X,R1:%08X,R2:%08X,R3:%08X,R4:%08X,R5:%08X,R6:%08X" % (lr, r0, r1, r2, r3, r4, r5, r6)) - elif pc==0x22750C: + print("SBROM_AesCmacDriver PC(%08X) R0:%08X,R1:%08X,R2:%08X,R3:%08X,R4:%08X,R5:%08X,R6:%08X" % ( + lr, r0, r1, r2, r3, r4, r5, r6)) + elif pc == 0x22750C: r0 = uc.reg_read(UC_ARM_REG_R0) r1 = uc.reg_read(UC_ARM_REG_R1) r2 = uc.reg_read(UC_ARM_REG_R2) print("memcpy PC(%08X) R0:%08X,R1:%08X,R2:%08X" % (lr, r0, r1, r2)) print("SRC:" + hexlify(uc.mem_read(r1, r2)).decode('utf-8')) print("DST:" + hex(r0)) - elif pc==0x2316F8: + elif pc == 0x2316F8: r0 = uc.reg_read(UC_ARM_REG_R0) r1 = uc.reg_read(UC_ARM_REG_R1) r2 = uc.reg_read(UC_ARM_REG_R2) print("UTIL_memcpy PC(%08X) R0:%08X,R1:%08X,R2:%08X" % (lr, r0, r1, r2)) print("SRC:" + hexlify(uc.mem_read(r1, r2)).decode('utf-8')) print("DST:" + hex(r0)) - elif pc==0x230BB8: + elif pc == 0x230BB8: r0 = uc.reg_read(UC_ARM_REG_R0) r1 = uc.reg_read(UC_ARM_REG_R1) r2 = uc.reg_read(UC_ARM_REG_R2) @@ -145,52 +157,56 @@ def hook_code(uc,access,address,size): r6 = uc.reg_read(UC_ARM_REG_R6) r7 = uc.reg_read(UC_ARM_REG_R7) r12 = uc.reg_read(UC_ARM_REG_R12) - print("SBROM_KeyDerivation PC(%08X)" %lr) + print("SBROM_KeyDerivation PC(%08X)" % lr) print("R0:%08X,R1:%08X,R2:%08X,R3:%08X,R4:%08X,R5:%08X,R6:%08X,R7:%08X,R12:%08X" % ( - r0, r1, r2, r3, r4, r5, r6, r7, r12)) + r0, r1, r2, r3, r4, r5, r6, r7, r12)) print("R2:" + hexlify(uc.mem_read(r2, r3)).decode('utf-8')) print("R5:" + hexlify(uc.mem_read(r5, r6)).decode('utf-8')) - #print("PC %08X" % pc) + # print("PC %08X" % pc) return True + def hook_mem_invalid(uc, access, address, size, value, user_data): pc = uc.reg_read(UC_ARM_REG_PC) if access == UC_MEM_WRITE: - info=("invalid WRITE of 0x%x at 0x%X, data size = %u, data value = 0x%x" % (address, pc, size, value)) + info = ("invalid WRITE of 0x%x at 0x%X, data size = %u, data value = 0x%x" % (address, pc, size, value)) if access == UC_MEM_READ: - info=("invalid READ of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("invalid READ of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_FETCH: - info=("UC_MEM_FETCH of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_FETCH of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_READ_UNMAPPED: - info=("UC_MEM_READ_UNMAPPED of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_READ_UNMAPPED of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_WRITE_UNMAPPED: - info=("UC_MEM_WRITE_UNMAPPED of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_WRITE_UNMAPPED of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_FETCH_UNMAPPED: - info=("UC_MEM_FETCH_UNMAPPED of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_FETCH_UNMAPPED of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_WRITE_PROT: - info=("UC_MEM_WRITE_PROT of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_WRITE_PROT of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_FETCH_PROT: - info=("UC_MEM_FETCH_PROT of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_FETCH_PROT of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_FETCH_PROT: - info=("UC_MEM_FETCH_PROT of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_FETCH_PROT of 0x%x at 0x%X, data size = %u" % (address, pc, size)) if access == UC_MEM_READ_AFTER: - info=("UC_MEM_READ_AFTER of 0x%x at 0x%X, data size = %u" % (address, pc, size)) + info = ("UC_MEM_READ_AFTER of 0x%x at 0x%X, data size = %u" % (address, pc, size)) print(info) return False -def do_generic_emu_setup(mu,reg): - def replace_function(address,callback): + +def do_generic_emu_setup(mu, reg): + def replace_function(address, callback): def hook_code(uc, address, size, user_data): logger.debug(">>> Installed hook at 0x%x, instruction size = 0x%x" % (address, size)) ret = user_data(reg) uc.reg_write(UC_ARM_REG_R0, ret) uc.reg_write(UC_ARM_REG_PC, uc.reg_read(UC_ARM_REG_LR)) + mu.hook_add(UC_HOOK_CODE, hook_code, user_data=callback, begin=address, end=address) - def monitor_function(address,callback): + def monitor_function(address, callback): def hook_code(uc, address, size, user_data): logger.debug(">>> Installed monitor at 0x%x, instruction size = 0x%x" % (address, size)) user_data(reg) + mu.hook_add(UC_HOOK_CODE, hook_code, user_data=callback, begin=address, end=address) """ @@ -200,12 +216,13 @@ def send_usb_response(regs): return 0 """ - #mu.hook_add(UC_HOOK_BLOCK, hook_block) + # mu.hook_add(UC_HOOK_BLOCK, hook_block) mu.hook_add(UC_HOOK_MEM_INVALID, hook_mem_invalid) mu.hook_add(UC_HOOK_CODE, hook_code, begin=0, end=-1) mu.hook_add(UC_HOOK_MEM_READ, hook_mem_read) mu.hook_add(UC_HOOK_MEM_WRITE, hook_mem_write) - #replace_function(brom_base+br[field][0]-1,send_usb_response) + # replace_function(brom_base+br[field][0]-1,send_usb_response) + def main(): pfilename = os.path.join("..", "Loader", "Preloader", "preloader_k71v1_64_bsp.bin") @@ -213,28 +230,28 @@ def main(): mu = Uc(UC_ARCH_ARM, UC_MODE_THUMB) reg = ARMRegisters(mu) - reg["SP"] = 0x2001D4 # Stack from start - preloader_base=0x200E20 + reg["SP"] = 0x2001D4 # Stack from start + preloader_base = 0x200E20 mu.mem_map(0x100000, 0x400000) # Map generic memory for payload try: - mu.mem_map(0x10000000, 0x1000000) # Map WD, TZCC - mu.mem_map(0x11000000, 0x1000000) # Map Uart+SEC_REG - except: + mu.mem_map(0x10000000, 0x1000000) # Map WD, TZCC + mu.mem_map(0x11000000, 0x1000000) # Map Uart+SEC_REG + except Exception: pass reg["R0"] = 1 reg["R1"] = 0x100000 reg["R2"] = 16 mu.mem_write(preloader_base, payload) - do_generic_emu_setup(mu,reg) + do_generic_emu_setup(mu, reg) - #Main EDL emulation + # Main EDL emulation logger.info("Emulating Preloader") try: - mu.emu_start(0x230B1D,-1,0,0) #generate_fde_key - except: + mu.emu_start(0x230B1D, -1, 0, 0) # generate_fde_key + except Exception: pass logger.info("Emulation done.") -if __name__=="__main__": +if __name__ == "__main__": main() diff --git a/mtkclient/Tools/enc_test.py b/mtkclient/Tools/enc_test.py index 0be6c74b..09ca2d68 100755 --- a/mtkclient/Tools/enc_test.py +++ b/mtkclient/Tools/enc_test.py @@ -59,18 +59,19 @@ 0x1020dc74[W] : 0x0 """ -preloader_key=bytes.fromhex("A5DA42C3B4F6C5BAE162C568ADBD26055572247C05586BAA37818D2868949ADB9C4DEE58E7C7AFD090D8951035F84BEB") -aeskey1=preloader_key[:16] -aeskey2=preloader_key[16:32] +preloader_key = bytes.fromhex( + "A5DA42C3B4F6C5BAE162C568ADBD26055572247C05586BAA37818D2868949ADB9C4DEE58E7C7AFD090D8951035F84BEB") +aeskey1 = preloader_key[:16] +aeskey2 = preloader_key[16:32] -seed=bytearray(bytes.fromhex("CEBEA8E5DC1A43A0F0AE425F67AF42047471F1D4B751362F39AE8A5E8BDA0C4C")) +seed = bytearray(bytes.fromhex("CEBEA8E5DC1A43A0F0AE425F67AF42047471F1D4B751362F39AE8A5E8BDA0C4C")) iv = AES.new(aeskey1, AES.MODE_ECB).decrypt(seed[:0x10]) -out=bytearray() +out = bytearray() for i in range(4): - val=unpack("0: - size=min(length,0x200000) - data=rf.read(size) + while length > 0: + size = min(length, 0x200000) + data = rf.read(size) wf.write(data) - length-=size + length -= size if __name__ == "__main__": - main() \ No newline at end of file + main() diff --git a/mtkclient/Tools/patch_legacy.py b/mtkclient/Tools/patch_legacy.py index 225421f8..edb1fb48 100755 --- a/mtkclient/Tools/patch_legacy.py +++ b/mtkclient/Tools/patch_legacy.py @@ -1,35 +1,36 @@ #!/usr/bin/env python3 -import os import sys import hashlib -from mtkclient.Library.utils import LogBase, progress, logsetup, find_binary -from struct import pack -patches=[ - ("B3F5807F01D1", "B3F5807F01D14FF000004FF000007047"), #rsa_verify / usbdl_vfy_da - ("B3F5807F04BF4FF4807305F011B84FF0FF307047", "B3F5807F04BF4FF480734FF000004FF000007047"), #rsa_verify / usbdl_vfy_da - ("2DE9F746802B","4FF000007047"), #rsa_verify / usbdl_vfy_da - ("802B2DE9","4FF000007047"), - ("8023BDE8","4FF000007047"), # DA verify fail - ("800053E3F344","0000A0E31EFF2FE1") +from mtkclient.Library.utils import find_binary + +patches = [ + ("B3F5807F01D1", "B3F5807F01D14FF000004FF000007047"), # rsa_verify / usbdl_vfy_da + ("B3F5807F04BF4FF4807305F011B84FF0FF307047", "B3F5807F04BF4FF480734FF000004FF000007047"), + # rsa_verify / usbdl_vfy_da + ("2DE9F746802B", "4FF000007047"), # rsa_verify / usbdl_vfy_da + ("802B2DE9", "4FF000007047"), + ("8023BDE8", "4FF000007047"), # DA verify fail + ("800053E3F344", "0000A0E31EFF2FE1") ] + def patch_preloader_security(data): - if data[:4]!=b"\x4D\x4D\x4D\x01": + if data[:4] != b"\x4D\x4D\x4D\x01": return data - patched=False + patched = False for patchval in patches: - pattern=bytes.fromhex(patchval[0]) + pattern = bytes.fromhex(patchval[0]) idx = data.find(pattern) - if idx!=-1: - patch=bytes.fromhex(patchval[1]) - data[idx:idx+len(patch)]=patch - patched=True + if idx != -1: + patch = bytes.fromhex(patchval[1]) + data[idx:idx + len(patch)] = patch + patched = True break if patched: - #with open(sys.argv[1]+".patched","wb") as wf: + # with open(sys.argv[1]+".patched","wb") as wf: # wf.write(data) # print("Patched !") - print(f"Patched preloader security") + print("Patched preloader security") else: print(f"Failed to patch preloader security: {sys.argv[1]}") return data @@ -41,12 +42,13 @@ def patch_da2_legacy(da2): # Patch security check_addr = find_binary(da2, b"\x08\xB5\x4F\xF4\x50\x42\xA0\xF1\x81\x53") if check_addr is not None: - da2patched[check_addr:check_addr+4]=b"\x08\xB5\x08\xBD" - print(f"Patched preloader security") + da2patched[check_addr:check_addr + 4] = b"\x08\xB5\x08\xBD" + print("Patched preloader security") else: print(f"Failed to patch preloader security: {sys.argv[1]}") return da2patched + def fix_hash(da1, da2, hashpos, hashmode): da1 = bytearray(da1) dahash = None @@ -57,6 +59,7 @@ def fix_hash(da1, da2, hashpos, hashmode): da1[hashpos:hashpos + len(dahash)] = dahash return da1 + def compute_hash_pos(da1, da2): hashdigest = hashlib.sha1(da2).digest() hashdigest256 = hashlib.sha256(da2).digest() @@ -69,17 +72,19 @@ def compute_hash_pos(da1, da2): return idx, hashmode return None, None + def main(): """ with open(sys.argv[1],"rb") as rf: data=bytearray(rf.read()) data=patch_preloader_security(data) """ - da1=open("loaders/6735_200000MTK_AllInOne_DA_5.2136.bin","rb").read() - da2=open("loaders/6735_40000000MTK_AllInOne_DA_5.2136.bin", "rb").read() - hp,hm=compute_hash_pos(da1, da2[:-0x100]) - da2=patch_da2_legacy(da2) - da1p=fix_hash(da1, da2, hp, hm) + da1 = open("loaders/6735_200000MTK_AllInOne_DA_5.2136.bin", "rb").read() + da2 = open("loaders/6735_40000000MTK_AllInOne_DA_5.2136.bin", "rb").read() + hp, hm = compute_hash_pos(da1, da2[:-0x100]) + da2 = patch_da2_legacy(da2) + fix_hash(da1, da2, hp, hm) + -if __name__=="__main__": - main() \ No newline at end of file +if __name__ == "__main__": + main() diff --git a/mtkclient/Tools/patch_preloader.py b/mtkclient/Tools/patch_preloader.py index 1cb1f6bc..a51c153d 100755 --- a/mtkclient/Tools/patch_preloader.py +++ b/mtkclient/Tools/patch_preloader.py @@ -1,35 +1,36 @@ #!/usr/bin/env python3 -import os import sys import hashlib -from mtkclient.Library.utils import LogBase, progress, logsetup, find_binary -from struct import pack -patches=[ - ("B3F5807F01D1", "B3F5807F01D14FF000004FF000007047"), #rsa_verify / usbdl_vfy_da - ("B3F5807F04BF4FF4807305F011B84FF0FF307047", "B3F5807F04BF4FF480734FF000004FF000007047"), #rsa_verify / usbdl_vfy_da - ("2DE9F746802B","4FF000007047"), #rsa_verify / usbdl_vfy_da - ("802B2DE9","4FF000007047"), - ("8023BDE8","4FF000007047"), # DA verify fail - ("800053E3F344","0000A0E31EFF2FE1") +from mtkclient.Library.utils import find_binary + +patches = [ + ("B3F5807F01D1", "B3F5807F01D14FF000004FF000007047"), # rsa_verify / usbdl_vfy_da + ("B3F5807F04BF4FF4807305F011B84FF0FF307047", "B3F5807F04BF4FF480734FF000004FF000007047"), + # rsa_verify / usbdl_vfy_da + ("2DE9F746802B", "4FF000007047"), # rsa_verify / usbdl_vfy_da + ("802B2DE9", "4FF000007047"), + ("8023BDE8", "4FF000007047"), # DA verify fail + ("800053E3F344", "0000A0E31EFF2FE1") ] + def patch_preloader_security(data): - if data[:4]!=b"\x4D\x4D\x4D\x01": + if data[:4] != b"\x4D\x4D\x4D\x01": return data - patched=False + patched = False for patchval in patches: - pattern=bytes.fromhex(patchval[0]) + pattern = bytes.fromhex(patchval[0]) idx = data.find(pattern) - if idx!=-1: - patch=bytes.fromhex(patchval[1]) - data[idx:idx+len(patch)]=patch - patched=True + if idx != -1: + patch = bytes.fromhex(patchval[1]) + data[idx:idx + len(patch)] = patch + patched = True break if patched: - #with open(sys.argv[1]+".patched","wb") as wf: + # with open(sys.argv[1]+".patched","wb") as wf: # wf.write(data) # print("Patched !") - print(f"Patched preloader security") + print("Patched preloader security") else: print(f"Failed to patch preloader security: {sys.argv[1]}") return data @@ -43,7 +44,7 @@ def patch_da2(da2): if is_security_enabled is not None: da2patched[is_security_enabled:is_security_enabled + 2] = b"\x00\x23" else: - self.warning("Security check not patched.") + print("Security check not patched.") # Patch hash check authaddr = find_binary(da2, b"\x04\x00\x07\xC0") if authaddr: @@ -57,7 +58,7 @@ def patch_da2(da2): if authaddr: da2patched[authaddr:authaddr + 14] = b"\x4F\xF0\x00\x09\x32\x46\x01\x98\x03\x99\x4F\xF0\x00\x09" else: - self.warning("Hash check not patched.") + print("Hash check not patched.") # Patch write not allowed # open("da2.bin","wb").write(da2patched) idx = 0 @@ -81,9 +82,10 @@ def patch_da2(da2): """ patched = True if not patched: - self.warning("Write not allowed not patched.") + print("Write not allowed not patched.") return da2patched + def fix_hash(da1, da2, hashpos, hashmode): da1 = bytearray(da1) dahash = None @@ -94,6 +96,7 @@ def fix_hash(da1, da2, hashpos, hashmode): da1[hashpos:hashpos + len(dahash)] = dahash return da1 + def compute_hash_pos(da1, da2): hashdigest = hashlib.sha1(da2).digest() hashdigest256 = hashlib.sha256(da2).digest() @@ -106,17 +109,19 @@ def compute_hash_pos(da1, da2): return idx, hashmode return None, None + def main(): """ with open(sys.argv[1],"rb") as rf: data=bytearray(rf.read()) data=patch_preloader_security(data) """ - da1=open("loaders/8167_200000MTK_AllInOne_DA_5.2136.bin","rb").read() - da2=open("loaders/8167_40000000MTK_AllInOne_DA_5.2136.bin", "rb").read() - hp,hm=compute_hash_pos(da1, da2[:-0x100]) - da2=patch_da2(da2) - da1p=fix_hash(da1, da2, hp, hm) + da1 = open("loaders/8167_200000MTK_AllInOne_DA_5.2136.bin", "rb").read() + da2 = open("loaders/8167_40000000MTK_AllInOne_DA_5.2136.bin", "rb").read() + hp, hm = compute_hash_pos(da1, da2[:-0x100]) + da2 = patch_da2(da2) + fix_hash(da1, da2, hp, hm) + -if __name__=="__main__": - main() \ No newline at end of file +if __name__ == "__main__": + main() diff --git a/mtkclient/Tools/payload.bin b/mtkclient/Tools/payload.bin deleted file mode 100755 index 6d4ff555..00000000 Binary files a/mtkclient/Tools/payload.bin and /dev/null differ diff --git a/mtkclient/Tools/payload.bin.idb b/mtkclient/Tools/payload.bin.idb deleted file mode 100755 index 8b6bc30b..00000000 Binary files a/mtkclient/Tools/payload.bin.idb and /dev/null differ diff --git a/mtkclient/Tools/preloader_emu_mmc.py b/mtkclient/Tools/preloader_emu_mmc.py index 6d9eb935..c74c59dc 100755 --- a/mtkclient/Tools/preloader_emu_mmc.py +++ b/mtkclient/Tools/preloader_emu_mmc.py @@ -1,32 +1,28 @@ #!/usr/bin/env python3 # (c) B.Kerler 2021 +import os import logging +from binascii import hexlify +from struct import pack, unpack +from mtkclient.Library.Connection.usblib import usb_class +from mtkclient.Library.utils import LogBase +from mtkclient.Library.utils import print_progress +from unicorn import (Uc, UC_MEM_WRITE, UC_MEM_READ, UC_MEM_FETCH, UC_MEM_READ_UNMAPPED, + UC_HOOK_CODE, UC_MEM_WRITE_UNMAPPED, UC_MEM_FETCH_UNMAPPED, UC_MEM_WRITE_PROT, + UC_MEM_FETCH_PROT, UC_MEM_READ_AFTER, UC_HOOK_MEM_INVALID, UC_HOOK_MEM_READ, + UC_HOOK_MEM_WRITE, UC_ARCH_ARM, UC_MODE_ARM) +from unicorn.arm_const import (UC_ARM_REG_PC, UC_ARM_REG_LR, UC_ARM_REG_R0, UC_ARM_REG_R1, UC_ARM_REG_R2, + UC_ARM_REG_R4) logger = logging.getLogger(__name__) # debuglevel=logging.DEBUG debuglevel = logging.INFO logging.basicConfig(format='%(funcName)20s:%(message)s', level=debuglevel) -from unicorn import * -from unicorn.arm_const import * -import os -from struct import pack, unpack -from binascii import hexlify - debug = False -import os -import logging -import sys -import argparse -from binascii import hexlify -from struct import pack, unpack -from Library.usblib import usb_class -from Library.utils import LogBase -from Library.utils import print_progress - class Stage2(metaclass=LogBase): def __init__(self, args, loglevel=logging.INFO): self.__logger = self.__logger @@ -43,7 +39,7 @@ def __init__(self, args, loglevel=logging.INFO): self.__logger.setLevel(logging.DEBUG) else: self.__logger.setLevel(logging.INFO) - portconfig = [[0x0E8D, 0x0003, -1],[0x0E8D, 0x2000, -1]] + portconfig = [[0x0E8D, 0x0003, -1], [0x0E8D, 0x2000, -1]] self.cdc = usb_class(portconfig=portconfig, loglevel=loglevel, devclass=10) def connect(self): @@ -54,13 +50,13 @@ def close(self): if self.cdc.connected: self.cdc.close() - def readflash(self, type: int, start, length, display=False, filename:str=None): + def readflash(self, type: int, start, length, display=False, filename: str = None): wf = None - buffer=bytearray() + buffer = bytearray() if filename is not None: - wf=open(filename, "wb") - sectors=(length//0x200)+(1 if length%0x200 else 0) - startsector=(start // 0x200) + wf = open(filename, "wb") + sectors = (length // 0x200) + (1 if length % 0x200 else 0) + startsector = (start // 0x200) # emmc_switch(1) self.cdc.usbwrite(pack(">I", 0xf00dd00d)) self.cdc.usbwrite(pack(">I", 0x1002)) @@ -104,83 +100,83 @@ def readflash(self, type: int, start, length, display=False, filename:str=None): if wf is not None: wf.close() else: - return buffer[start%0x200:(start%0x200)+length] + return buffer[start % 0x200:(start % 0x200) + length] def preloader(self, start, length, filename): - sectors=0 + sectors = 0 if start != 0: start = (start // 0x200) if length != 0: - sectors=(length//0x200)+(1 if length%0x200 else 0) + sectors = (length // 0x200) + (1 if length % 0x200 else 0) self.info("Reading preloader...") if self.cdc.connected: if sectors == 0: - buffer=self.readflash(type=1, start=0, length=0x1000, display=False) - if len(buffer)!=0x1000: + buffer = self.readflash(type=1, start=0, length=0x1000, display=False) + if len(buffer) != 0x1000: print("Error on reading boot1 area.") return - if buffer[:9]==b'EMMC_BOOT': - startbrlyt=unpack("0: - size=min(bytestoread,0x200) + bytestoread = length + addr = start + data = b"" + pos = 0 + while bytestoread > 0: + size = min(bytestoread, 0x200) self.cdc.usbwrite(pack(">I", 0xf00dd00d)) self.cdc.usbwrite(pack(">I", 0x4000)) - self.cdc.usbwrite(pack(">I", addr+pos)) + self.cdc.usbwrite(pack(">I", addr + pos)) self.cdc.usbwrite(pack(">I", size)) - data+=self.cdc.usbread(size) - bytestoread-=size - pos+=size + data += self.cdc.usbread(size) + bytestoread -= size + pos += size return data def memwrite(self, start, data): - if isinstance(data,str): - data=bytes.fromhex(data) - elif isinstance(data,int): - data=pack("0: - size=min(bytestowrite,0x200) + if isinstance(data, str): + data = bytes.fromhex(data) + elif isinstance(data, int): + data = pack(" 0: + size = min(bytestowrite, 0x200) self.cdc.usbwrite(pack(">I", 0xf00dd00d)) self.cdc.usbwrite(pack(">I", 0x4002)) - self.cdc.usbwrite(pack(">I", addr+pos)) + self.cdc.usbwrite(pack(">I", addr + pos)) self.cdc.usbwrite(pack(">I", size)) - self.cdc.usbwrite(data[pos:pos+4]) - bytestowrite-=size - pos+=size - ack=self.cdc.usbread(4) - if ack==b"\xD0\xD0\xD0\xD0": + self.cdc.usbwrite(data[pos:pos + 4]) + bytestowrite -= size + pos += size + ack = self.cdc.usbread(4) + if ack == b"\xD0\xD0\xD0\xD0": return True else: return False def rpmb(self, start, length, filename): if start == 0: - start=0 + start = 0 else: start = (start // 0x100) if length == 0: - sectors=4*1024*1024//0x100 + sectors = 4 * 1024 * 1024 // 0x100 else: - sectors=(length//0x100)+(1 if length%0x100 else 0) + sectors = (length // 0x100) + (1 if length % 0x100 else 0) self.info("Reading rpmb...") self.cdc.usbwrite(pack(">I", 0xf00dd00d)) @@ -192,9 +188,9 @@ def rpmb(self, start, length, filename): self.cdc.usbwrite(pack(">I", 0x3001)) print_progress(0, 100, prefix='Progress:', suffix='Complete', bar_length=50) - bytesread=0 - old=0 - bytestoread=sectors*0x100 + bytesread = 0 + old = 0 + bytestoread = sectors * 0x100 with open(filename, "wb") as wf: for sector in range(start, sectors): self.cdc.usbwrite(pack(">I", 0xf00dd00d)) @@ -210,27 +206,30 @@ def rpmb(self, start, length, filename): suffix='Complete, Sector:' + hex((sectors * 0x200) - bytestoread), bar_length=50) old = round(prog, 1) - bytesread+=0x100 - size=min(bytestoread,len(tmp)) + bytesread += 0x100 + size = min(bytestoread, len(tmp)) wf.write(tmp[:size]) bytestoread -= size print_progress(100, 100, prefix='Complete: ', suffix=filename, bar_length=50) print("Done") + st2 = Stage2(None) + def getint(valuestr): - if valuestr=='': + if valuestr == '': return None try: return int(valuestr) - except: + except Exception: try: return int(valuestr, 16) - except Exception as err: + except Exception: pass return 0 + class ARMRegisters(dict): def __init__(self, mu): super().__init__() @@ -253,7 +252,8 @@ def __getitem__(self, key): buffer = bytearray() data = "" -timer=0 +timer = 0 + def hook_mem_read(uc, access, address, size, value, user_data): global st2 @@ -261,60 +261,61 @@ def hook_mem_read(uc, access, address, size, value, user_data): global timer pc = uc.reg_read(UC_ARM_REG_PC) if 0x10009000 > address > 0x10000000 and not (0x11050000 <= address <= 0x11060000): - value=st2.memread(address,size) - v=unpack(" address > 0x11200000: - value=st2.memread(address,size) - v=unpack(" 0x10009000 and not (0x11050000 <= address <= 0x11060000): - value=st2.memread(address,size) - v=unpack(" 0x10000000 and not (0x11050000 <= address <= 0x11060000): - #print("WRITE of 0x%x at 0x%X, data size = %u, value: 0x%x" % (address, pc, size, value)) - st2.memwrite(address,value) - uc.mem_write(address,pack(" Flag {hex(flag)}+[{info}] Ptr {hex(ptr)} Count {hex(count)}") + flag = whitelist[(i * 3)] + ptr = whitelist[1 + (i * 3)] + count = whitelist[2 + (i * 3)] + info = "" + if flag & 0x2: + info += "R" + if flag & 0x20: + info += "R" + if flag & 0x200: + info += "R" + elif flag & 0x4: + info += "W" + elif flag & 0x40: + info += "W" + if flag & 0x400: + info += "W" + if flag & 0x1: + info += "X" + if flag & 0x10: + info += "X" + if flag & 0x100: + info += "X" + if (flag & 0x16F) != 0: + info += "B" + print( + f"Offset {hex(checklist_generic[0] + (i * 3))} -> Flag {hex(flag)}+[{info}] Ptr {hex(ptr)} Count {hex(count)}") print("----------------------------------------------------------------------------------------------") for field in range(count): - start,end=dword(data,ptr+(field*8),2) + start, end = dword(data, ptr + (field * 8), 2) print(f"Start {hex(start)}, End {hex(end)}") print() -if __name__=="__main__": - main() \ No newline at end of file + +if __name__ == "__main__": + main() diff --git a/mtkclient/config/brom_config.py b/mtkclient/config/brom_config.py index d401f206..a53fa19a 100755 --- a/mtkclient/config/brom_config.py +++ b/mtkclient/config/brom_config.py @@ -38,8 +38,7 @@ def __init__(self, base, hwcode): base+0x090, base+0x094, base+0x098, base+0x09C, base+0x0A0, base+0x0A4, base+0x0A8, base+0x0AC, base+0x810, base+0x814, base+0x818, base+0x81C, base+0x820, base+0x824, base+0x828, - base+0x82C, base+0x964 - ] + base+0x82C, base+0x964] elif hwcode in [0x6582, 0x6595, 0x6752, 0x6795, 0x6592]: self.efuses = [base + 0x20, base + 0x30, base + 0x38, base + 0x40, base + 0x44, base + 0x48, base + 0x60, base + 0x100, base + 0x104, base + 0x108, diff --git a/mtkclient/config/mtk_config.py b/mtkclient/config/mtk_config.py index c577a21d..a2e73cf4 100755 --- a/mtkclient/config/mtk_config.py +++ b/mtkclient/config/mtk_config.py @@ -5,14 +5,16 @@ from mtkclient.Library.utils import LogBase from mtkclient.Library.settings import hwparam from mtkclient.config.brom_config import chipconfig, damodes, hwconfig + try: from PySide6.QtCore import QObject except ImportError: - class QObject(): + class QObject: def tr(self, arg): return pass + class Mtk_Config(metaclass=LogBase): def __init__(self, loglevel=logging.INFO, gui=None, guiprogress=None, update_status_text=None): self.peek = None @@ -104,13 +106,13 @@ def get_cid(self): return self.cid def set_cid(self, cid): - self.hwparam.writesetting("cid",cid.hex()) + self.hwparam.writesetting("cid", cid.hex()) self.cid = cid.hex() - def set_hwcode(self,hwcode): + def set_hwcode(self, hwcode): self.hwparam.writesetting("hwcode", hex(hwcode)) - def set_meid(self,meid): + def set_meid(self, meid): self.hwparam = hwparam(meid, self.hwparam_path) self.meid = meid self.hwparam.writesetting("meid", hexlify(meid).decode('utf-8')) @@ -122,14 +124,14 @@ def get_otp(self): idx = self.preloader.find(b"\x4D\x4D\x4D\x01\x30") if idx != -1: self.otp = self.preloader[idx + 0xC:idx + 0xC + 32] - self.hwparam.writesetting("otp",hexlify(self.otp).decode('utf-8')) + self.hwparam.writesetting("otp", hexlify(self.otp).decode('utf-8')) if self.otp is None: self.otp = 32 * b"\x00" return self.otp - def set_otp(self,otp): + def set_otp(self, otp): self.otp = otp - self.hwparam.writesetting("otp",hexlify(otp).decode('utf-8')) + self.hwparam.writesetting("otp", hexlify(otp).decode('utf-8')) def get_meid(self): if self.meid is None: @@ -137,12 +139,12 @@ def get_meid(self): if self.chipconfig.meid_addr is not None: self.meid = self.peek(self.chipconfig.meid_addr, 0x10) self.meid = self.peek(0x1008ec, 0x10) - #self.set_meid(self.meid) + # self.set_meid(self.meid) return self.meid - def set_socid(self,socid): + def set_socid(self, socid): self.socid = socid - self.hwparam.writesetting("socid",hexlify(socid).decode('utf-8')) + self.hwparam.writesetting("socid", hexlify(socid).decode('utf-8')) def get_socid(self): if self.socid is None: @@ -232,7 +234,8 @@ def bmtsettings(self, hwcode): bmtflag = 1 bmtblockcount = 0xA8 bmtpartsize = 0x1500000 - elif hwcode in [0x6570, 0x8167, 0x6580, 0x6735, 0x6753, 0x6755, 0x6752, 0x6595, 0x6795, 0x6767, 0x6797, 0x8163, 0x8127]: + elif hwcode in [0x6570, 0x8167, 0x6580, 0x6735, 0x6753, 0x6755, 0x6752, 0x6595, 0x6795, 0x6767, 0x6797, 0x8163, + 0x8127]: bmtflag = 1 bmtpartsize = 0 elif hwcode in [0x6571]: diff --git a/mtkclient/config/payloads.py b/mtkclient/config/payloads.py index 963a2ef7..2ef0bb3f 100755 --- a/mtkclient/config/payloads.py +++ b/mtkclient/config/payloads.py @@ -1,20 +1,20 @@ #!/usr/bin/env python3 - import os + class pathconfig: def __init__(self): curscript = os.path.realpath(__file__) self.scriptpath = os.path.dirname(curscript) def get_loader_path(self): - return os.path.abspath(os.path.join(self.scriptpath,"..","Loader")) + return os.path.abspath(os.path.join(self.scriptpath, "..", "Loader")) def get_payloads_path(self): - return os.path.abspath(os.path.join(self.scriptpath,"..","payloads")) + return os.path.abspath(os.path.join(self.scriptpath, "..", "payloads")) def get_gui_path(self): - return os.path.abspath(os.path.join(self.scriptpath,"..","gui")) + return os.path.abspath(os.path.join(self.scriptpath, "..", "gui")) - def get_images_path(self,file=""): - return os.path.abspath(os.path.join(self.scriptpath,"..","gui","images",file)) \ No newline at end of file + def get_images_path(self, file=""): + return os.path.abspath(os.path.join(self.scriptpath, "..", "gui", "images", file)) diff --git a/mtkclient/config/usb_ids.py b/mtkclient/config/usb_ids.py index 72c9b47e..9d1c238e 100755 --- a/mtkclient/config/usb_ids.py +++ b/mtkclient/config/usb_ids.py @@ -1,14 +1,14 @@ default_ids = [ - [0x0E8D, 0x0003, -1], # MTK Brom - [0x0E8D, 0x6000, 2], # MTK Preloader - [0x0E8D, 0x2000, -1], # MTK Preloader - [0x0E8D, 0x2001, -1], # MTK Preloader - [0x0E8D, 0x20FF, -1], # MTK Preloader - [0x1004, 0x6000, 2], # LG Preloader - [0x22d9, 0x0006, -1], # OPPO Preloader - [0x0FCE, 0xF200, -1], # Sony Brom - [0x0FCE, 0xD1E9, -1], # Sony Brom XA1 - [0x0FCE, 0xD1E2, -1], # Sony Brom - [0x0FCE, 0xD1EC, -1], # Sony Brom L1 - [0x0FCE, 0xD1DD, -1], # Sony F3111 + [0x0E8D, 0x0003, -1], # MTK Brom + [0x0E8D, 0x6000, 2], # MTK Preloader + [0x0E8D, 0x2000, -1], # MTK Preloader + [0x0E8D, 0x2001, -1], # MTK Preloader + [0x0E8D, 0x20FF, -1], # MTK Preloader + [0x1004, 0x6000, 2], # LG Preloader + [0x22d9, 0x0006, -1], # OPPO Preloader + [0x0FCE, 0xF200, -1], # Sony Brom + [0x0FCE, 0xD1E9, -1], # Sony Brom XA1 + [0x0FCE, 0xD1E2, -1], # Sony Brom + [0x0FCE, 0xD1EC, -1], # Sony Brom L1 + [0x0FCE, 0xD1DD, -1], # Sony F3111 ] diff --git a/mtkclient/gui/__init__.py b/mtkclient/gui/__init__.py old mode 100644 new mode 100755 diff --git a/mtkclient/gui/eraseFlashPartitions.py b/mtkclient/gui/eraseFlashPartitions.py old mode 100644 new mode 100755 index ae4c7279..495cad50 --- a/mtkclient/gui/eraseFlashPartitions.py +++ b/mtkclient/gui/eraseFlashPartitions.py @@ -7,6 +7,7 @@ sys.excepthook = trap_exc_during_debug + class EraseFlashWindow(QObject): enableButtonsSignal = Signal() disableButtonsSignal = Signal() @@ -34,7 +35,7 @@ def selectAll(self): def erasePartition(self): self.parent.Status["rpmb"] = False self.ui.erasepartitionsbtn.setEnabled(False) - thread = asyncThread(parent=self.parent, n=0, function=self.erasePartitionAsync,parameters=[]) + thread = asyncThread(parent=self.parent, n=0, function=self.erasePartitionAsync, parameters=[]) thread.sendToLogSignal.connect(self.sendToLog) thread.update_status_text.connect(self.parent.update_status_text) thread.sendUpdateSignal.connect(self.parent.updateState) @@ -127,8 +128,9 @@ def erasePartitionAsync(self, toolkit, parameters): self.parent.Status["totalsize"] = totalsize for partition in self.parent.erasepartitionCheckboxes: if self.parent.erasepartitionCheckboxes[partition]['box'].isChecked(): - self.parent.Status["allPartitions"][partition] = {"size": self.parent.erasepartitionCheckboxes[partition]['size'], - "done": False} + self.parent.Status["allPartitions"][partition] = { + "size": self.parent.erasepartitionCheckboxes[partition]['size'], + "done": False} for partition in self.parent.erasepartitionCheckboxes: if self.parent.erasepartitionCheckboxes[partition]['box'].isChecked(): variables = mock.Mock() diff --git a/mtkclient/gui/main_gui.py b/mtkclient/gui/main_gui.py old mode 100644 new mode 100755 index e92bbaf0..b669d558 --- a/mtkclient/gui/main_gui.py +++ b/mtkclient/gui/main_gui.py @@ -1,22 +1,15 @@ # -*- coding: utf-8 -*- -################################################################################ -## Form generated from reading UI file 'main_guiarqDOg.ui' -## -## Created by: Qt User Interface Compiler version 6.4.0 -## -## WARNING! All changes made in this file will be lost when recompiling UI file! -################################################################################ - from PySide6.QtCore import (QCoreApplication, QMetaObject, QRect, - QSize, Qt) + QSize, Qt) from PySide6.QtGui import QAction, QPixmap from PySide6.QtWidgets import (QAbstractScrollArea, QCheckBox, QFrame, - QGridLayout, QHBoxLayout, QLabel, - QLayout, QMenu, QMenuBar, - QPlainTextEdit, QProgressBar, QPushButton, QScrollArea, - QSizePolicy, QSpacerItem, QTabWidget, QTableWidget, - QTableWidgetItem, QVBoxLayout, QWidget) + QGridLayout, QHBoxLayout, QLabel, + QLayout, QMenu, QMenuBar, + QPlainTextEdit, QProgressBar, QPushButton, QScrollArea, + QSizePolicy, QSpacerItem, QTabWidget, QTableWidget, + QTableWidgetItem, QVBoxLayout, QWidget) + class Ui_MainWindow(object): def setupUi(self, MainWindow): @@ -101,7 +94,7 @@ def setupUi(self, MainWindow): sizePolicy1.setHeightForWidth(self.readtitle.sizePolicy().hasHeightForWidth()) self.readtitle.setSizePolicy(sizePolicy1) self.readtitle.setMinimumSize(QSize(0, 20)) - self.readtitle.setAlignment(Qt.AlignLeading|Qt.AlignLeft|Qt.AlignTop) + self.readtitle.setAlignment(Qt.AlignLeading | Qt.AlignLeft | Qt.AlignTop) self.gridLayout_7.addWidget(self.readtitle, 0, 0, 1, 1) @@ -144,7 +137,7 @@ def setupUi(self, MainWindow): sizePolicy1.setHeightForWidth(self.writetitle.sizePolicy().hasHeightForWidth()) self.writetitle.setSizePolicy(sizePolicy1) self.writetitle.setMinimumSize(QSize(0, 20)) - self.writetitle.setAlignment(Qt.AlignLeading|Qt.AlignLeft|Qt.AlignTop) + self.writetitle.setAlignment(Qt.AlignLeading | Qt.AlignLeft | Qt.AlignTop) self.gridLayout_6.addWidget(self.writetitle, 0, 0, 1, 1) @@ -203,7 +196,7 @@ def setupUi(self, MainWindow): sizePolicy1.setHeightForWidth(self.erasetitle.sizePolicy().hasHeightForWidth()) self.erasetitle.setSizePolicy(sizePolicy1) self.erasetitle.setMinimumSize(QSize(0, 20)) - self.erasetitle.setAlignment(Qt.AlignLeading|Qt.AlignLeft|Qt.AlignTop) + self.erasetitle.setAlignment(Qt.AlignLeading | Qt.AlignLeft | Qt.AlignTop) self.gridLayout_5.addWidget(self.erasetitle, 0, 0, 1, 1) @@ -248,7 +241,6 @@ def setupUi(self, MainWindow): self.verticalLayout_2.addItem(self.verticalSpacer) - self.gridLayout_4.addLayout(self.verticalLayout_2, 0, 0, 2, 1) self.verticalLayout_3 = QVBoxLayout() @@ -277,7 +269,6 @@ def setupUi(self, MainWindow): self.verticalLayout_3.addItem(self.verticalSpacer_2) - self.gridLayout_4.addLayout(self.verticalLayout_3, 0, 1, 2, 1) self.verticalLayout_4 = QVBoxLayout() @@ -301,7 +292,6 @@ def setupUi(self, MainWindow): self.verticalLayout_4.addItem(self.verticalSpacer_3) - self.gridLayout_4.addLayout(self.verticalLayout_4, 0, 2, 1, 1) self.verticalLayout_5 = QVBoxLayout() @@ -316,7 +306,6 @@ def setupUi(self, MainWindow): self.verticalLayout_5.addWidget(self.unlockbutton) - self.gridLayout_4.addLayout(self.verticalLayout_5, 1, 2, 1, 1) self.tabWidget.addTab(self.tab, "") @@ -396,7 +385,6 @@ def setupUi(self, MainWindow): self.gridLayout.addWidget(self.logBox, 0, 0, 1, 2) - self.gridLayout_3.addLayout(self.gridLayout, 0, 0, 1, 1) self.tabWidget.addTab(self.debugtab, "") @@ -425,7 +413,6 @@ def setupUi(self, MainWindow): self.Main.addWidget(self.fullProgress) - self.gridLayout_8.addLayout(self.Main, 3, 0, 1, 1) self.connectInfo = QWidget(self.centralwidget) @@ -458,7 +445,7 @@ def setupUi(self, MainWindow): self.initStepsImage.setFrameShape(QFrame.NoFrame) self.initStepsImage.setPixmap(QPixmap(u"images/initsteps.png")) self.initStepsImage.setScaledContents(True) - self.initStepsImage.setAlignment(Qt.AlignHCenter|Qt.AlignTop) + self.initStepsImage.setAlignment(Qt.AlignHCenter | Qt.AlignTop) self.initStepsImage.setWordWrap(False) self.initStepsImage.setMargin(0) @@ -468,7 +455,6 @@ def setupUi(self, MainWindow): self.horizontalLayout_4.addItem(self.horizontalSpacer) - self.verticalLayout_6.addLayout(self.horizontalLayout_4) self.horizontalLayout_3 = QHBoxLayout() @@ -486,7 +472,7 @@ def setupUi(self, MainWindow): self.label_2.setSizePolicy(sizePolicy5) self.label_2.setMinimumSize(QSize(195, 0)) self.label_2.setMaximumSize(QSize(195, 16777215)) - self.label_2.setAlignment(Qt.AlignHCenter|Qt.AlignTop) + self.label_2.setAlignment(Qt.AlignHCenter | Qt.AlignTop) self.label_2.setWordWrap(True) self.label_2.setMargin(5) @@ -502,7 +488,7 @@ def setupUi(self, MainWindow): self.label_3.setSizePolicy(sizePolicy5) self.label_3.setMinimumSize(QSize(195, 10)) self.label_3.setMaximumSize(QSize(195, 16777215)) - self.label_3.setAlignment(Qt.AlignHCenter|Qt.AlignTop) + self.label_3.setAlignment(Qt.AlignHCenter | Qt.AlignTop) self.label_3.setWordWrap(True) self.label_3.setMargin(5) @@ -519,7 +505,7 @@ def setupUi(self, MainWindow): self.label_4.setMinimumSize(QSize(195, 0)) self.label_4.setMaximumSize(QSize(195, 16777215)) self.label_4.setScaledContents(False) - self.label_4.setAlignment(Qt.AlignHCenter|Qt.AlignTop) + self.label_4.setAlignment(Qt.AlignHCenter | Qt.AlignTop) self.label_4.setWordWrap(True) self.label_4.setMargin(5) @@ -529,7 +515,6 @@ def setupUi(self, MainWindow): self.horizontalLayout_3.addItem(self.horizontalSpacer_5) - self.verticalLayout_6.addLayout(self.horizontalLayout_3) self.horizontalLayout_5 = QHBoxLayout() @@ -543,10 +528,8 @@ def setupUi(self, MainWindow): self.horizontalLayout_5.addWidget(self.showdebugbtn) - self.verticalLayout_6.addLayout(self.horizontalLayout_5) - self.gridLayout_8.addWidget(self.connectInfo, 2, 0, 1, 1) self.line_2 = QFrame(self.centralwidget) @@ -578,7 +561,7 @@ def setupUi(self, MainWindow): self.logoPic.setMaximumSize(QSize(158, 158)) self.logoPic.setPixmap(QPixmap(u"images/logo_256.png")) self.logoPic.setScaledContents(True) - self.logoPic.setAlignment(Qt.AlignLeading|Qt.AlignLeft|Qt.AlignTop) + self.logoPic.setAlignment(Qt.AlignLeading | Qt.AlignLeft | Qt.AlignTop) self.horizontalLayout.addWidget(self.logoPic) @@ -589,10 +572,8 @@ def setupUi(self, MainWindow): self.horizontalLayout.addWidget(self.copyrightInfo) - self.verticalLayout.addLayout(self.horizontalLayout) - self.topInfo.addLayout(self.verticalLayout) self.verticalLayout_7 = QVBoxLayout() @@ -605,7 +586,7 @@ def setupUi(self, MainWindow): sizePolicy7.setVerticalStretch(0) sizePolicy7.setHeightForWidth(self.phoneInfoTextbox.sizePolicy().hasHeightForWidth()) self.phoneInfoTextbox.setSizePolicy(sizePolicy7) - self.phoneInfoTextbox.setAlignment(Qt.AlignRight|Qt.AlignTop|Qt.AlignTrailing) + self.phoneInfoTextbox.setAlignment(Qt.AlignRight | Qt.AlignTop | Qt.AlignTrailing) self.phoneInfoTextbox.setWordWrap(True) self.verticalLayout_7.addWidget(self.phoneInfoTextbox) @@ -621,7 +602,7 @@ def setupUi(self, MainWindow): self.phoneDebugInfoTextbox.setMaximumSize(QSize(16777215, 110)) self.phoneDebugInfoTextbox.setStyleSheet(u"color:#888;") self.phoneDebugInfoTextbox.setTextFormat(Qt.PlainText) - self.phoneDebugInfoTextbox.setAlignment(Qt.AlignBottom|Qt.AlignRight|Qt.AlignTrailing) + self.phoneDebugInfoTextbox.setAlignment(Qt.AlignBottom | Qt.AlignRight | Qt.AlignTrailing) self.verticalLayout_7.addWidget(self.phoneDebugInfoTextbox) @@ -642,14 +623,12 @@ def setupUi(self, MainWindow): self.horizontalLayout_2.addWidget(self.consettingsbtn) - self.verticalLayout_7.addLayout(self.horizontalLayout_2) self.verticalSpacer_5 = QSpacerItem(20, 2, QSizePolicy.Minimum, QSizePolicy.Maximum) self.verticalLayout_7.addItem(self.verticalSpacer_5) - self.topInfo.addLayout(self.verticalLayout_7) self.widget_3 = QWidget(self.centralwidget) @@ -679,7 +658,6 @@ def setupUi(self, MainWindow): self.topInfo.addWidget(self.widget_3) - self.gridLayout_8.addLayout(self.topInfo, 0, 0, 1, 1) MainWindow.setCentralWidget(self.centralwidget) @@ -691,9 +669,9 @@ def setupUi(self, MainWindow): self.menuFile = QMenu(self.menubar) self.menuFile.setObjectName(u"menuFile") MainWindow.setMenuBar(self.menubar) -#if QT_CONFIG(shortcut) + # if QT_CONFIG(shortcut) self.logoPic.setBuddy(self.logoPic) -#endif // QT_CONFIG(shortcut) + # endif // QT_CONFIG(shortcut) self.menubar.addAction(self.menuFile.menuAction()) self.menuFile.addAction(self.action_Quit) @@ -702,8 +680,8 @@ def setupUi(self, MainWindow): self.tabWidget.setCurrentIndex(5) - QMetaObject.connectSlotsByName(MainWindow) + # setupUi def retranslateUi(self, MainWindow): @@ -730,15 +708,19 @@ def retranslateUi(self, MainWindow): self.readtitle.setText(QCoreApplication.translate("MainWindow", u"Select partitions to read", None)) self.readpartitionsbtn.setText(QCoreApplication.translate("MainWindow", u"Read partition(s)", None)) self.readselectallcheckbox.setText(QCoreApplication.translate("MainWindow", u"Select all partitions", None)) - self.tabWidget.setTabText(self.tabWidget.indexOf(self.readtab), QCoreApplication.translate("MainWindow", u"Read partition(s)", None)) + self.tabWidget.setTabText(self.tabWidget.indexOf(self.readtab), + QCoreApplication.translate("MainWindow", u"Read partition(s)", None)) self.writetitle.setText(QCoreApplication.translate("MainWindow", u"Select partitions to write", None)) self.writepartbtn.setText(QCoreApplication.translate("MainWindow", u"Write partition(s)", None)) self.writeselectfromdir.setText(QCoreApplication.translate("MainWindow", u"Select from directory", None)) - self.tabWidget.setTabText(self.tabWidget.indexOf(self.writetab), QCoreApplication.translate("MainWindow", u"Write partition(s)", None)) + self.tabWidget.setTabText(self.tabWidget.indexOf(self.writetab), + QCoreApplication.translate("MainWindow", u"Write partition(s)", None)) self.erasetitle.setText(QCoreApplication.translate("MainWindow", u"Select partitions to erase", None)) self.erasepartitionsbtn.setText(QCoreApplication.translate("MainWindow", u"Erase partition(s)", None)) - self.eraseselectallpartitionscheckbox.setText(QCoreApplication.translate("MainWindow", u"Select all partitions", None)) - self.tabWidget.setTabText(self.tabWidget.indexOf(self.erasetab), QCoreApplication.translate("MainWindow", u"Erase partition(s)", None)) + self.eraseselectallpartitionscheckbox.setText( + QCoreApplication.translate("MainWindow", u"Select all partitions", None)) + self.tabWidget.setTabText(self.tabWidget.indexOf(self.erasetab), + QCoreApplication.translate("MainWindow", u"Erase partition(s)", None)) self.readflashbtn.setText(QCoreApplication.translate("MainWindow", u"Read flash", None)) self.readpreloaderbtn.setText(QCoreApplication.translate("MainWindow", u"Read preloader", None)) self.readboot2btn.setText(QCoreApplication.translate("MainWindow", u"Read boot2", None)) @@ -752,38 +734,49 @@ def retranslateUi(self, MainWindow): self.eraserpmbbtn.setText(QCoreApplication.translate("MainWindow", u"Erase RPMB", None)) self.lockbutton.setText(QCoreApplication.translate("MainWindow", u"Lock bootloader", None)) self.unlockbutton.setText(QCoreApplication.translate("MainWindow", u"Unlock bootloader", None)) - self.tabWidget.setTabText(self.tabWidget.indexOf(self.tab), QCoreApplication.translate("MainWindow", u"Flash Tools", None)) + self.tabWidget.setTabText(self.tabWidget.indexOf(self.tab), + QCoreApplication.translate("MainWindow", u"Flash Tools", None)) ___qtablewidgetitem = self.keytable.horizontalHeaderItem(0) - ___qtablewidgetitem.setText(QCoreApplication.translate("MainWindow", u"Type", None)); + ___qtablewidgetitem.setText(QCoreApplication.translate("MainWindow", u"Type", None)) ___qtablewidgetitem1 = self.keytable.horizontalHeaderItem(1) - ___qtablewidgetitem1.setText(QCoreApplication.translate("MainWindow", u"Value", None)); + ___qtablewidgetitem1.setText(QCoreApplication.translate("MainWindow", u"Value", None)) ___qtablewidgetitem2 = self.keytable.verticalHeaderItem(0) - ___qtablewidgetitem2.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)); + ___qtablewidgetitem2.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)) ___qtablewidgetitem3 = self.keytable.verticalHeaderItem(1) - ___qtablewidgetitem3.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)); + ___qtablewidgetitem3.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)) ___qtablewidgetitem4 = self.keytable.verticalHeaderItem(2) - ___qtablewidgetitem4.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)); + ___qtablewidgetitem4.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)) ___qtablewidgetitem5 = self.keytable.verticalHeaderItem(3) - ___qtablewidgetitem5.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)); + ___qtablewidgetitem5.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)) ___qtablewidgetitem6 = self.keytable.verticalHeaderItem(4) - ___qtablewidgetitem6.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)); + ___qtablewidgetitem6.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)) ___qtablewidgetitem7 = self.keytable.verticalHeaderItem(5) - ___qtablewidgetitem7.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)); + ___qtablewidgetitem7.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)) ___qtablewidgetitem8 = self.keytable.verticalHeaderItem(6) - ___qtablewidgetitem8.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)); + ___qtablewidgetitem8.setText(QCoreApplication.translate("MainWindow", u"Neue Zeile", None)) self.keystatuslabel.setText(QCoreApplication.translate("MainWindow", u"Ready.", None)) self.generatekeybtn.setText(QCoreApplication.translate("MainWindow", u"Generate Keys", None)) - self.tabWidget.setTabText(self.tabWidget.indexOf(self.keytab), QCoreApplication.translate("MainWindow", u"Keys", None)) - self.tabWidget.setTabText(self.tabWidget.indexOf(self.debugtab), QCoreApplication.translate("MainWindow", u"Debug Log", None)) + self.tabWidget.setTabText(self.tabWidget.indexOf(self.keytab), + QCoreApplication.translate("MainWindow", u"Keys", None)) + self.tabWidget.setTabText(self.tabWidget.indexOf(self.debugtab), + QCoreApplication.translate("MainWindow", u"Debug Log", None)) self.partProgressText.setText("") self.fullProgressText.setText("") self.initStepsImage.setText("") - self.label_2.setText(QCoreApplication.translate("MainWindow", u"

Step 1:

Power off the phone

", None)) - self.label_3.setText(QCoreApplication.translate("MainWindow", u"

Step 2:

Connect the USB cable, hold both volume buttons if needed

", None)) - self.label_4.setText(QCoreApplication.translate("MainWindow", u"

No connection? Try shorting the test point to ground

", None)) + self.label_2.setText(QCoreApplication.translate("MainWindow", + u"

Step 1:

Power off the phone

", + None)) + self.label_3.setText(QCoreApplication.translate("MainWindow", + u"

Step 2:

Connect the USB cable, hold both volume buttons if needed

", + None)) + self.label_4.setText(QCoreApplication.translate("MainWindow", + u"

No connection? Try shorting the test point to ground

", + None)) self.showdebugbtn.setText(QCoreApplication.translate("MainWindow", u"Show Debug Log", None)) self.logoPic.setText("") - self.copyrightInfo.setText(QCoreApplication.translate("MainWindow", u"Made by: Bjoern Kerler
GUI by: Geert-Jan Kreileman

Credits:
kamakiri [xyzz]
linecode exploit [chimera]
Chaosmaster
and all contributors

", None)) + self.copyrightInfo.setText(QCoreApplication.translate("MainWindow", + u"Made by: Bjoern Kerler
GUI by: Geert-Jan Kreileman

Credits:
kamakiri [xyzz]
linecode exploit [chimera]
Chaosmaster
and all contributors

", + None)) self.phoneInfoTextbox.setText(QCoreApplication.translate("MainWindow", u"No phone detected.", None)) self.phoneDebugInfoTextbox.setText("") self.consettingsbtn.setText(QCoreApplication.translate("MainWindow", u"Connection settings", None)) @@ -791,4 +784,3 @@ def retranslateUi(self, MainWindow): self.spinner_pic.setText("") self.menuFile.setTitle(QCoreApplication.translate("MainWindow", u"&File", None)) # retranslateUi - diff --git a/mtkclient/gui/readFlashPartitions.py b/mtkclient/gui/readFlashPartitions.py old mode 100644 new mode 100755 index 3a3ae1e5..ff9ab449 --- a/mtkclient/gui/readFlashPartitions.py +++ b/mtkclient/gui/readFlashPartitions.py @@ -6,6 +6,7 @@ sys.excepthook = trap_exc_during_debug + class ReadFlashWindow(QObject): enableButtonsSignal = Signal() disableButtonsSignal = Signal() @@ -39,7 +40,7 @@ def dumpPartition(self): self.parent.Status["rpmb"] = False self.dumpFolder = self.fdialog.opendir(self.tr("Select output directory")) if self.dumpFolder: - thread = asyncThread(parent=self.parent, n=0, function=self.dumpPartitionAsync,parameters=[]) + thread = asyncThread(parent=self.parent, n=0, function=self.dumpPartitionAsync, parameters=[]) thread.sendToLogSignal.connect(self.sendToLog) thread.update_status_text.connect(self.parent.update_status_text) thread.sendUpdateSignal.connect(self.parent.updateState) @@ -82,7 +83,7 @@ def dumpPartitionAsync(self, toolkit, parameters): self.parent.Status["allPartitions"][partition]['done'] = True # MtkTool.cmd_stage(mtkClass, None, None, None, False) if self.ui.readDumpGPTCheckbox.isChecked(): - #also dump the GPT + # also dump the GPT variables = mock.Mock() variables.directory = self.dumpFolder variables.parttype = None @@ -115,7 +116,7 @@ def dumpFlash(self, parttype): self.parent.Status["currentPartitionSize"] = self.flashsize self.parent.Status["currentPartition"] = parttype self.ui.partProgressText.setText(self.tr("Ready to dump ") + convert_size(self.flashsize)) - self.dumpFile = self.fdialog.save(self.parttype+".bin") + self.dumpFile = self.fdialog.save(self.parttype + ".bin") if self.dumpFile: thread = asyncThread(parent=self.parent, n=0, function=self.dumpFlashAsync, parameters=[self.parttype]) thread.sendToLogSignal.connect(self.sendToLog) @@ -130,7 +131,7 @@ def dumpFlashAsync(self, toolkit, parameters): self.sendToLogSignal = toolkit.sendToLogSignal self.parent.Status["done"] = False thread = asyncThread(self.parent.parent(), 0, self.parent.updateStateAsync, []) - #thread.sendUpdateSignal.connect(self.updateDumpState) + # thread.sendUpdateSignal.connect(self.updateDumpState) thread.start() self.disableButtonsSignal.emit() variables = mock.Mock() diff --git a/mtkclient/gui/toolkit.py b/mtkclient/gui/toolkit.py old mode 100644 new mode 100755 index 97ac1184..75c69818 --- a/mtkclient/gui/toolkit.py +++ b/mtkclient/gui/toolkit.py @@ -8,6 +8,7 @@ from traceback import print_exception from mtkclient.config.payloads import pathconfig + class TimeEstim: def calcProcessTime(self, starttime, cur_iter, max_iter): telapsed = time.time() - starttime @@ -49,44 +50,46 @@ def update(self, pos, total): self.progtime = t0 return hinfo + class CheckBox(QCheckBox): - def __init__( self, *args ): + def __init__(self, *args): super(CheckBox, self).__init__(*args) self._readOnly = False - def isReadOnly( self ): + def isReadOnly(self): return self._readOnly - def mousePressEvent( self, event ): + def mousePressEvent(self, event): if self.isReadOnly(): event.accept() else: super(CheckBox, self).mousePressEvent(event) - def mouseMoveEvent( self, event ): + def mouseMoveEvent(self, event): if self.isReadOnly(): event.accept() else: super(CheckBox, self).mouseMoveEvent(event) - def mouseReleaseEvent( self, event ): + def mouseReleaseEvent(self, event): if self.isReadOnly(): event.accept() else: super(CheckBox, self).mouseReleaseEvent(event) - def keyPressEvent( self, event ): + def keyPressEvent(self, event): if self.isReadOnly(): event.accept() else: super(CheckBox, self).keyPressEvent(event) @Slot(bool) - def setReadOnly( self, state ): + def setReadOnly(self, state): self._readOnly = state readOnly = Property(bool, isReadOnly, setReadOnly) + def convert_size(size_bytes): if size_bytes <= 0: return "0B" @@ -112,11 +115,12 @@ def __init__(self, parent, n, function, parameters): def run(self): self.function(self, self.parameters) + class FDialog(): def __init__(self, parent): pc = pathconfig() self.parent = parent - self.fdialog=QFileDialog(parent) + self.fdialog = QFileDialog(parent) self.lastpath = os.path.dirname(os.path.dirname(pc.scriptpath)) self.fdialog.setDirectory(self.lastpath) @@ -125,7 +129,7 @@ def save(self, filename=""): self.fdialog.setDirectory(self.lastpath) self.fdialog.selectFile(fname) ret = self.fdialog.getSaveFileName(self.parent, self.parent.tr("Select output file"), fname, - "Binary dump (*.bin)") + "Binary dump (*.bin)") if ret: fname = ret[0] if fname != "": @@ -138,7 +142,7 @@ def open(self, filename=""): self.fdialog.setDirectory(self.lastpath) self.fdialog.selectFile(fname) ret = self.fdialog.getOpenFileName(self.parent, self.parent.tr("Select input file"), - fname, "Binary dump (*.bin)") + fname, "Binary dump (*.bin)") if ret: if isinstance(ret, tuple): fname = os.path.normpath(ret[0]) # fixes backslash problem on windows @@ -147,20 +151,21 @@ def open(self, filename=""): return fname return None - def opendir(self,caption): + def opendir(self, caption): options = QFileDialog.Options() if sys.platform.startswith('freebsd') or sys.platform.startswith('linux'): options |= QFileDialog.DontUseNativeDialog options |= QFileDialog.DontUseCustomDirectoryIcons fname = os.path.join(self.lastpath) self.fdialog.setDirectory(self.lastpath) - fdir=self.fdialog.getExistingDirectory(self.parent, self.parent.tr(caption), fname, options=options) - fdir = os.path.normpath(fdir) #fixes backslash problem on windows + fdir = self.fdialog.getExistingDirectory(self.parent, self.parent.tr(caption), fname, options=options) + fdir = os.path.normpath(fdir) # fixes backslash problem on windows if fdir != "" and fdir != ".": self.lastpath = fdir return fdir return None + def trap_exc_during_debug(type_, value, traceback): print(print_exception(type_, value, traceback), flush=True) # sendToLog("Error: "+str(value)) diff --git a/mtkclient/gui/toolsMenu.py b/mtkclient/gui/toolsMenu.py old mode 100644 new mode 100755 index 8c3738e6..036d443c --- a/mtkclient/gui/toolsMenu.py +++ b/mtkclient/gui/toolsMenu.py @@ -5,8 +5,10 @@ import os import sys import json + sys.excepthook = trap_exc_during_debug + class UnlockMenu(QObject): enableButtonsSignal = Signal() disableButtonsSignal = Signal() @@ -40,7 +42,7 @@ def unlock(self, unlockflag): def UnlockAsync(self, toolkit, parameters): self.sendToLogSignal = toolkit.sendToLogSignal self.sendUpdateSignal = toolkit.sendUpdateSignal - toolkit.sendToLogSignal.emit(self.tr("Bootloader: ")+parameters[0]) + toolkit.sendToLogSignal.emit(self.tr("Bootloader: ") + parameters[0]) self.parent.Status["result"] = self.mtkClass.daloader.seccfg(parameters[0]) self.parent.Status["done"] = True self.sendUpdateSignal.emit() @@ -73,7 +75,7 @@ def updateKeys(self): if skey is not None: self.ui.keytable.setItem(column, 0, QTableWidgetItem(key)) self.ui.keytable.setItem(column, 1, QTableWidgetItem(skey)) - column+=1 + column += 1 self.sendToLogSignal.emit(self.tr("Keys generated!")) self.enableButtonsSignal.emit() @@ -98,10 +100,8 @@ def generateKeysAsync(self, toolkit, parameters): toolkit.sendToLogSignal.emit(self.tr("Generating keys")) res = self.mtkClass.daloader.keys() if res: - with open(os.path.join(parameters[0],"hwparam.json"),"w") as wf: + with open(os.path.join(parameters[0], "hwparam.json"), "w") as wf: wf.write(json.dumps(res)) self.parent.Status["result"] = res self.parent.Status["done"] = True self.sendUpdateSignal.emit() - - diff --git a/mtkclient/gui/writeFlashPartitions.py b/mtkclient/gui/writeFlashPartitions.py old mode 100644 new mode 100755 index fcb39dd5..7f881dcc --- a/mtkclient/gui/writeFlashPartitions.py +++ b/mtkclient/gui/writeFlashPartitions.py @@ -6,6 +6,7 @@ sys.excepthook = trap_exc_during_debug + class WriteFlashWindow(QObject): enableButtonsSignal = Signal() disableButtonsSignal = Signal() @@ -22,7 +23,6 @@ def __init__(self, ui, parent, da_handler, sendToLog): # def __init__(self, *ar def writePartDone(self): self.sendToLogSignal.emit("write done!") - def selectFiles(self): self.folder = self.fdialog.opendir(self.tr("Select input directory")) if self.folder: @@ -30,8 +30,8 @@ def selectFiles(self): checkbox, lineedit, button = self.parent.writepartitionCheckboxes[partition]['box'] for root, dirs, files in os.walk(self.folder): for file in files: - if file in [partition+".bin",partition+".img"]: - lineedit.setText(os.path.join(root,file)) + if file in [partition + ".bin", partition + ".img"]: + lineedit.setText(os.path.join(root, file)) lineedit.setDisabled(False) checkbox.setChecked(True) break @@ -40,14 +40,14 @@ def selectFiles(self): def writePartition(self): self.disableButtonsSignal.emit() self.parent.Status["rpmb"] = False - thread = asyncThread(parent=self, n=0, function=self.writePartitionAsync,parameters=[]) + thread = asyncThread(parent=self, n=0, function=self.writePartitionAsync, parameters=[]) thread.sendToLogSignal.connect(self.sendToLog) thread.sendUpdateSignal.connect(self.parent.updateState) thread.sendToProgressSignal.connect(self.parent.updateProgress) thread.start() def openFile(self, partition, checkbox, lineedit): - fname = self.fdialog.open(partition+".bin") + fname = self.fdialog.open(partition + ".bin") if fname is None: checkbox.setChecked(False) lineedit.setText("") @@ -79,7 +79,8 @@ def writePartitionAsync(self, toolkit, parameters): for partition in self.parent.writepartitionCheckboxes: checkbox, lineedit, button = self.parent.writepartitionCheckboxes[partition]['box'] if checkbox.isChecked(): - totalsize += min(self.parent.writepartitionCheckboxes[partition]['size'], os.stat(lineedit.text()).st_size) + totalsize += min(self.parent.writepartitionCheckboxes[partition]['size'], + os.stat(lineedit.text()).st_size) self.parent.Status["totalsize"] = totalsize for partition in self.parent.writepartitionCheckboxes: @@ -87,7 +88,7 @@ def writePartitionAsync(self, toolkit, parameters): if checkbox.isChecked(): size = min(self.parent.writepartitionCheckboxes[partition]['size'], os.stat(lineedit.text()).st_size) self.parent.Status["allPartitions"][partition] = {"size": size, - "done": False} + "done": False} for partition in self.parent.writepartitionCheckboxes: checkbox, lineedit, button = self.parent.writepartitionCheckboxes[partition]['box'] if checkbox.isChecked(): @@ -95,7 +96,7 @@ def writePartitionAsync(self, toolkit, parameters): variables.partitionname = partition variables.filename = lineedit.text() variables.parttype = "user" - size = min(self.parent.writepartitionCheckboxes[partition]['size'],os.stat(variables.filename).st_size) + size = min(self.parent.writepartitionCheckboxes[partition]['size'], os.stat(variables.filename).st_size) self.parent.Status["currentPartitionSize"] = size self.parent.Status["currentPartition"] = partition self.parent.Status["currentPartitionFile"] = variables.filename @@ -108,7 +109,7 @@ def writePartitionAsync(self, toolkit, parameters): self.enableButtonsSignal.emit() def writeFlash(self, parttype): - self.writeFile = self.fdialog.open(parttype+".bin") + self.writeFile = self.fdialog.open(parttype + ".bin") self.parent.Status["rpmb"] = False if parttype == "user": self.flashsize = self.mtkClass.daloader.daconfig.flashsize @@ -163,5 +164,3 @@ def writeFlashAsync(self, toolkit, parameters): self.parent.Status["done"] = True thread.wait() self.enableButtonsSignal.emit() - - diff --git a/mtkclient/src/da_xml/da_xml.c b/mtkclient/src/da_xml/da_xml.c index f6c6d7dc..38b8698f 100755 --- a/mtkclient/src/da_xml/da_xml.c +++ b/mtkclient/src/da_xml/da_xml.c @@ -1197,4 +1197,4 @@ __attribute__ ((section(".text.main"))) int main() { //register_xml_cmd("CUSTOM","1",(void*)register_rw); cache_close(1); return 0; -} \ No newline at end of file +} diff --git a/mtkclient/src/stage1/emu_config/payload_config.py b/mtkclient/src/stage1/emu_config/payload_config.py index a42ce2a1..d3d155ed 100755 --- a/mtkclient/src/stage1/emu_config/payload_config.py +++ b/mtkclient/src/stage1/emu_config/payload_config.py @@ -1,71 +1,70 @@ -br={ # filename:(*send_usb_response,*usbdl_put_data,*usbdl_get_data,*SEC_REG,*SEC_REG2,wdt,*uart_reg1,brom_base) - "mt6580.bin": - (0x62E5, 0xB5EF, 0xB569, 0x1026D8, 0x0, 0x10007000, 0x11005000,0x0), - "mt6572.bin": - (0x6AC9, 0xBA4B, 0xB9C5, 0x11141E80, 0x0, 0x10007000, 0x11005000,0x400000), - "mt6582_6582.bin": - (0x568D, 0xA5DF, 0xA559, 0x1026FC, 0x0, 0x10007000, 0x11002000, 0x0), - "mt6592_6592.bin": - (0x535D, 0xA547, 0xA4C1, 0x1026d8, 0, 0x10007000, 0x11002000, 0x0), - "mt6595_6595.bin": - (0x5E2B, 0xB1FB, 0xB175, 0x1026DC, 0, 0x10007000, 0x11002000, 0x0), - "mt6735.bin": - (0x4293, 0x95DB, 0x9555, 0x1026D4, 0x0, 0x10212000, 0x11002000,0x0), - "mt6737_335.bin": - (0x42a3,0x95eb,0x9565,0x1026D4,0x0,0x10212000,0x11002000,0x0), - "mt6739_699.bin": - (0x508B, 0xDEFF, 0xDE71, 0x102A8C, 0x1027A8, 0x10007000, 0x11002000,0x0), - "mt6753_337.bin": - (0x42A3, 0x964B, 0x95C5, 0x1026D4, 0x0, 0x10211000, 0x11002000, 0x0), - "mt6755_326.bin": - (0x449f, 0x9a4f, 0x99c9, 0x1026DC, 0x0, 0x10007000, 0x11002000,0x0), - "mt6757_551.bin": - (0x455f, 0x9C0F, 0x9B89, 0x1026E4, 0x0, 0x10007000, 0x11002000,0x0), - "mt6758_688.bin": - (0x4937, 0xd843, 0xd7bd, 0x102B8C, 0x1027ac, 0x10007000, 0x11002000,0x0), - "mt6761_717.bin": - (0x2CDF, 0xBC6F, 0xBBE1, 0x102a8c, 0x1027A4, 0x10007000, 0x11002000,0x0), - "mt6763_690.bin": - (0x4877, 0xD64F, 0xD5C9, 0x102B0C, 0x1027B0, 0x10007000, 0x11002000, 0x0), - "mt6765_766.bin": - (0x2D2B, 0xBDA3, 0xBD15, 0x102a8c, 0x1027A4, 0x10007000, 0x11002000,0x0), - "mt6768_707.bin": - (0x2c2f,0xc173,0xc0e5,0x102A8c,0x1027A4,0x10007000,0x11002000,0x0), - "mt6771_788.bin": - (0x4DAF, 0xDE9F, 0xDE11, 0x102acc, 0x01027B0, 0x10007000, 0x11002000,0x0), - "mt6779_725.bin": - (0x4CDB, 0xE02F, 0xDFA1, 0x102ACC, 0x1027B0, 0x10007000, 0x11002000, 0x0), - "mt6781_1066.bin": - (0x4AA7, 0xE5BB, 0xE52D, 0x102B0C, 0x1027BC, 0x10007000, 0x11002000, 0x0), - "mt6785_813.bin": - (0x4C8F, 0xe287, 0xe1f9, 0x102acc, 0x1027B0, 0x10007000, 0x11002000,0x0), - "mt6795_6795.bin": - (0x4347, 0x976F, 0x96E9, 0x1026D8, 0x0, 0x10007000, 0x11020000, 0x0), - "mt6797_279.bin": - (0x4807, 0x9e8f, 0x9e09, 0x0, 0x1026DC, 0x10007000, 0x11002000, 0x0), - "mt6799_562.bin": - (0x66AF, 0xF58F, 0xF509, 0x10334C, 0x1027EC, 0x10211000, 0x11020000, 0x0), - "mt6833_989.bin": - (0x48F3, 0xDFC3, 0xDF35, 0x102B0C, 0x1027BC, 0x10211000, 0x11002000, 0x0), - "mt6853_996.bin": - (0x538F, 0xEA47, 0xE9B9, 0x102b0c, 0x1027C4, 0x10007000, 0x11002000, 0x0), - "mt6873_886.bin": - (0x53af, 0xea5b, 0xe9cd, 0x102b0c, 0x1027C4, 0x10007000, 0x11002000,0x0), - "mt6877_886.bin": - (0x5187, 0xE8B3, 0xE825, 0x102b0c, 0x1027c0, 0x10007000, 0x11002000, 0x0), - "mt6885_816.bin": - (0x505B, 0xE6DF, 0xE651, 0x102B0C, 0x1027C0, 0x10007000, 0x11002000, 0x0), - "mt8173_8172.bin": - (0x4c5f,0xa0c7,0xa041,0x1226e8,0x0,0x10007000,0x11002000,0x0), - "mt8163.bin": - (0x6d6f,0xc10f,0xc089,0x1027dc,0x0,0x10007000,0x11002000,0x0), - "mt8127.bin": - (0x62a1,0xb29b,0xb215,0x1027e4,0x0,0x10007000,0x11002000,0x0), - "mt8167_8167.bin": - (0x6C7D, 0xD2C7, 0xD241, 0x10340C, 0x1028E4, 0x10007000, 0x11005000, 0x0), - "mt8590_mt8521_mt7623_8590.bin": - (0x6bc9, 0xbbc7, 0xbb41, 0x1027E4, 0x0, 0x10007000,0x11002000,0x0), - "mt8695.bin": - (0x55bb, 0xbed1, 0xbe4b, 0x102FBC, 0x0, 0x10007000,0x11003000,0x0), +br = { # filename:(*send_usb_response,*usbdl_put_data,*usbdl_get_data,*SEC_REG,*SEC_REG2,wdt,*uart_reg1,brom_base) + "mt6580.bin": + (0x62E5, 0xB5EF, 0xB569, 0x1026D8, 0x0, 0x10007000, 0x11005000, 0x0), + "mt6572.bin": + (0x6AC9, 0xBA4B, 0xB9C5, 0x11141E80, 0x0, 0x10007000, 0x11005000, 0x400000), + "mt6582_6582.bin": + (0x568D, 0xA5DF, 0xA559, 0x1026FC, 0x0, 0x10007000, 0x11002000, 0x0), + "mt6592_6592.bin": + (0x535D, 0xA547, 0xA4C1, 0x1026d8, 0, 0x10007000, 0x11002000, 0x0), + "mt6595_6595.bin": + (0x5E2B, 0xB1FB, 0xB175, 0x1026DC, 0, 0x10007000, 0x11002000, 0x0), + "mt6735.bin": + (0x4293, 0x95DB, 0x9555, 0x1026D4, 0x0, 0x10212000, 0x11002000, 0x0), + "mt6737_335.bin": + (0x42a3, 0x95eb, 0x9565, 0x1026D4, 0x0, 0x10212000, 0x11002000, 0x0), + "mt6739_699.bin": + (0x508B, 0xDEFF, 0xDE71, 0x102A8C, 0x1027A8, 0x10007000, 0x11002000, 0x0), + "mt6753_337.bin": + (0x42A3, 0x964B, 0x95C5, 0x1026D4, 0x0, 0x10211000, 0x11002000, 0x0), + "mt6755_326.bin": + (0x449f, 0x9a4f, 0x99c9, 0x1026DC, 0x0, 0x10007000, 0x11002000, 0x0), + "mt6757_551.bin": + (0x455f, 0x9C0F, 0x9B89, 0x1026E4, 0x0, 0x10007000, 0x11002000, 0x0), + "mt6758_688.bin": + (0x4937, 0xd843, 0xd7bd, 0x102B8C, 0x1027ac, 0x10007000, 0x11002000, 0x0), + "mt6761_717.bin": + (0x2CDF, 0xBC6F, 0xBBE1, 0x102a8c, 0x1027A4, 0x10007000, 0x11002000, 0x0), + "mt6763_690.bin": + (0x4877, 0xD64F, 0xD5C9, 0x102B0C, 0x1027B0, 0x10007000, 0x11002000, 0x0), + "mt6765_766.bin": + (0x2D2B, 0xBDA3, 0xBD15, 0x102a8c, 0x1027A4, 0x10007000, 0x11002000, 0x0), + "mt6768_707.bin": + (0x2c2f, 0xc173, 0xc0e5, 0x102A8c, 0x1027A4, 0x10007000, 0x11002000, 0x0), + "mt6771_788.bin": + (0x4DAF, 0xDE9F, 0xDE11, 0x102acc, 0x01027B0, 0x10007000, 0x11002000, 0x0), + "mt6779_725.bin": + (0x4CDB, 0xE02F, 0xDFA1, 0x102ACC, 0x1027B0, 0x10007000, 0x11002000, 0x0), + "mt6781_1066.bin": + (0x4AA7, 0xE5BB, 0xE52D, 0x102B0C, 0x1027BC, 0x10007000, 0x11002000, 0x0), + "mt6785_813.bin": + (0x4C8F, 0xe287, 0xe1f9, 0x102acc, 0x1027B0, 0x10007000, 0x11002000, 0x0), + "mt6795_6795.bin": + (0x4347, 0x976F, 0x96E9, 0x1026D8, 0x0, 0x10007000, 0x11020000, 0x0), + "mt6797_279.bin": + (0x4807, 0x9e8f, 0x9e09, 0x0, 0x1026DC, 0x10007000, 0x11002000, 0x0), + "mt6799_562.bin": + (0x66AF, 0xF58F, 0xF509, 0x10334C, 0x1027EC, 0x10211000, 0x11020000, 0x0), + "mt6833_989.bin": + (0x48F3, 0xDFC3, 0xDF35, 0x102B0C, 0x1027BC, 0x10211000, 0x11002000, 0x0), + "mt6853_996.bin": + (0x538F, 0xEA47, 0xE9B9, 0x102b0c, 0x1027C4, 0x10007000, 0x11002000, 0x0), + "mt6873_886.bin": + (0x53af, 0xea5b, 0xe9cd, 0x102b0c, 0x1027C4, 0x10007000, 0x11002000, 0x0), + "mt6877_886.bin": + (0x5187, 0xE8B3, 0xE825, 0x102b0c, 0x1027c0, 0x10007000, 0x11002000, 0x0), + "mt6885_816.bin": + (0x505B, 0xE6DF, 0xE651, 0x102B0C, 0x1027C0, 0x10007000, 0x11002000, 0x0), + "mt8173_8172.bin": + (0x4c5f, 0xa0c7, 0xa041, 0x1226e8, 0x0, 0x10007000, 0x11002000, 0x0), + "mt8163.bin": + (0x6d6f, 0xc10f, 0xc089, 0x1027dc, 0x0, 0x10007000, 0x11002000, 0x0), + "mt8127.bin": + (0x62a1, 0xb29b, 0xb215, 0x1027e4, 0x0, 0x10007000, 0x11002000, 0x0), + "mt8167_8167.bin": + (0x6C7D, 0xD2C7, 0xD241, 0x10340C, 0x1028E4, 0x10007000, 0x11005000, 0x0), + "mt8590_mt8521_mt7623_8590.bin": + (0x6bc9, 0xbbc7, 0xbb41, 0x1027E4, 0x0, 0x10007000, 0x11002000, 0x0), + "mt8695.bin": + (0x55bb, 0xbed1, 0xbe4b, 0x102FBC, 0x0, 0x10007000, 0x11003000, 0x0), } - diff --git a/mtkclient/src/stage1/emulate_payload.py b/mtkclient/src/stage1/emulate_payload.py index 24303b58..9ac87a1d 100755 --- a/mtkclient/src/stage1/emulate_payload.py +++ b/mtkclient/src/stage1/emulate_payload.py @@ -3,18 +3,19 @@ import logging from emu_config.payload_config import br +from unicorn import (Uc, UC_MEM_WRITE, UC_MEM_READ, UC_MEM_FETCH, UC_MEM_READ_UNMAPPED, + UC_HOOK_CODE, UC_MEM_WRITE_UNMAPPED, UC_MEM_FETCH_UNMAPPED, UC_MEM_WRITE_PROT, + UC_MEM_FETCH_PROT, UC_MEM_READ_AFTER, UC_HOOK_MEM_INVALID, UC_HOOK_MEM_READ, + UC_HOOK_MEM_WRITE, UC_ARCH_ARM, UC_MODE_THUMB) +from unicorn.arm_const import (UC_ARM_REG_PC, UC_ARM_REG_LR, UC_ARM_REG_R0) +import os +from struct import pack +from binascii import hexlify logger = logging.getLogger(__name__) # debuglevel=logging.DEBUG debuglevel = logging.INFO logging.basicConfig(format='%(funcName)20s:%(message)s', level=debuglevel) - -from unicorn import * -from unicorn.arm_const import * -import os -from struct import pack, unpack -from binascii import hexlify - debug = False @@ -43,7 +44,7 @@ def __getitem__(self, key): def hook_mem_read(uc, access, address, size, value, user_data): global data - pc = uc.reg_read(UC_ARM_REG_PC) + # pc = uc.reg_read(UC_ARM_REG_PC) # if address<0xF000000: # #print("READ of 0x%x at 0x%X, data size = %u" % (address, pc, size)) # #return True @@ -84,7 +85,7 @@ def hook_mem_read(uc, access, address, size, value, user_data): print("UART1 R") return True elif 0x102000 > address >= 0x100FF0: - val = unpack(" address >= 0x100A00 + 0x10000: # hide stack return True if address == 0x10007000: @@ -146,7 +147,7 @@ def hook_mem_write(uc, access, address, size, value, user_data): else: print("Write : %08X - %08X" % (address, value)) if address >= 0x100FF0: - val = unpack("