forked from CrackerCat/lgk10exploit
-
Notifications
You must be signed in to change notification settings - Fork 1
/
flash_lk_payload.py
64 lines (49 loc) · 1.75 KB
/
flash_lk_payload.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
from argparse import ArgumentParser
import os
import sys
from utils import switch_device_to_brom_mode
BLOCK_SIZE = 512
MAX_PAYLOAD_LEN = 16384*3
def main():
script_path = os.path.dirname(os.path.abspath(__file__))
working_dir = os.path.join(script_path, '.')
os.chdir(working_dir)
sys.path.append(working_dir)
import plib
import plib.mmc
import config
assert config.LK_PAYLOAD_OFFSET % BLOCK_SIZE == 0
parser = ArgumentParser()
parser.add_argument('payload')
parser.add_argument('-b', '--brom', action='store_true',
help='Use this if your device already is in BROM')
parser.add_argument('--skip-handshake', action='store_true')
args = parser.parse_args()
with open(args.payload, 'rb') as file:
payload = file.read()
#assert len(payload) % BLOCK_SIZE == 0
while len(payload) % BLOCK_SIZE != 0:
payload += b'\x00'
assert len(payload) <= MAX_PAYLOAD_LEN
if not args.brom:
d = plib.Device(config.PL_DEV_PATH, True)
if not args.skip_handshake:
d.handshake()
switch_device_to_brom_mode(d)
d = plib.Device(config.BR_DEV_PATH, True, brom_mode=True)
d.handshake()
d.run_ext_cmd(0xB1)
mmc = plib.mmc.Mmc(d, config.MMC0_BASE, True)
mmc.mmc_init()
mmc.mmc_set_part(1)
blocks_left = len(payload) // BLOCK_SIZE
for block in range(len(payload) // BLOCK_SIZE):
print('%d ' % blocks_left, flush=True, end='\r')
mmc.mmc_write_single_block(
block + (config.LK_PAYLOAD_OFFSET // BLOCK_SIZE), payload[:BLOCK_SIZE])
payload = payload[BLOCK_SIZE:]
blocks_left -= 1
print('\x1b[0;33mREBOOT\x1b[0m', flush=True)
d.wdt_reboot()
if __name__ == '__main__':
main()