shinyquagsire23/cve-2020-12753-pocCVE-2020-12753에 대한 개념 증명
이 저장소는 LG Stylo 4 (AMZ/Q710ULM)에서 Secure EL3 임의 코드 실행을 위한 SBL1/aboot 취약점인 🔋📱❄️🥾🔓의 개념 증명(PoC)을 포함합니다. 업데이트 20a 및 20c와 취약점의 SBL1 변형에서만 테스트되었습니다.
- Makefile : Builds raw_resources_a_mod.img given sbl_rop.s and raw_resources.img_884736
- raw_resources.img_884736 : Original raw_resources partition; sha256 510def86aa7608ac02f243d3c161bf973ac4add066be763c8abcb2fee90a454c
- raw_resources_a_mod.img : pre-compiled raw_resources partition to be flashed; sha256 26ee5f4589009bc20269bdb813a78d729b9daba44f7826560f6b7201f5396e73
- payload.bin : pre-compiled output of sbl_rop.s (no RLE compression)
- lg-craftres.py : Python3 script which takes in raw_resources.img_884736 and payload.bin and outputs raw_resources_a_mod.img
- sbl_rop.s : ROP payload to be written to the stack by load_res_888rle_image
- sbl_gadgets.s : ROP gadget defines for SBL1, included by sbl_rop.s
소스에서 빌드하려면 armips (https://github.com/Kingcom/armips)와 Python 3가 필요합니다.