FreeCalypso > hg > freecalypso-reveng
comparison mot931c/hack-payload.disasm @ 157:9082f3991fe5
mot931c break-in procedure cracked
| author | Michael Spacefalcon <msokolov@ivan.Harhan.ORG> |
|---|---|
| date | Wed, 14 May 2014 05:34:37 +0000 |
| parents | |
| children |
comparison
equal
deleted
inserted
replaced
| 156:275d0f71a014 | 157:9082f3991fe5 |
|---|---|
| 1 ; This hack payload must be receiving control in the ARM state, | |
| 2 ; as the instruction at 0 makes sense as ARM, but not as Thumb. | |
| 3 | |
| 4 ; SVC mode, IRQ & FIQ disabled | |
| 5 0: e321f0d3 msr CPSR_c, #211 ; 0xd3 | |
| 6 ; disable the watchdog | |
| 7 4: e59f10b4 ldr r1, =0xfffff802 ; via 0xc0 | |
| 8 8: e3a000f5 mov r0, #245 ; 0xf5 | |
| 9 c: e1c100b2 strh r0, [r1, #2] | |
| 10 10: e3a000a0 mov r0, #160 ; 0xa0 | |
| 11 14: e1c100b2 strh r0, [r1, #2] | |
| 12 ; MODEM UART | |
| 13 18: e59f60a4 ldr r6, =0xffff5800 ; via 0xc4 | |
| 14 ; wait for "INT" input | |
| 15 1c: e5d60005 ldrb r0, [r6, #5] | |
| 16 20: e3100001 tst r0, #1 | |
| 17 24: 0afffffc beq 0x1c | |
| 18 28: e5d65000 ldrb r5, [r6] | |
| 19 2c: e3550049 cmp r5, #73 ; 0x49 | |
| 20 30: 1afffff9 bne 0x1c | |
| 21 34: e5d60005 ldrb r0, [r6, #5] | |
| 22 38: e3100001 tst r0, #1 | |
| 23 3c: 0afffffc beq 0x34 | |
| 24 40: e5d65000 ldrb r5, [r6] | |
| 25 44: e355004e cmp r5, #78 ; 0x4e | |
| 26 48: 1afffff3 bne 0x1c | |
| 27 4c: e5d60005 ldrb r0, [r6, #5] | |
| 28 50: e3100001 tst r0, #1 | |
| 29 54: 0afffffc beq 0x4c | |
| 30 58: e5d65000 ldrb r5, [r6] | |
| 31 5c: e3550054 cmp r5, #84 ; 0x54 | |
| 32 60: 1affffed bne 0x1c | |
| 33 ; send 'X' | |
| 34 64: e3a00058 mov r0, #88 ; 0x58 | |
| 35 68: e5c60000 strb r0, [r6] | |
| 36 ; receive 2 bytes of length (LSB first) | |
| 37 6c: e1a00000 mov r0, r0 | |
| 38 70: e5d60005 ldrb r0, [r6, #5] | |
| 39 74: e3100001 tst r0, #1 | |
| 40 78: 0afffffc beq 0x70 | |
| 41 7c: e5d65000 ldrb r5, [r6] | |
| 42 80: e5d60005 ldrb r0, [r6, #5] | |
| 43 84: e3100001 tst r0, #1 | |
| 44 88: 0afffffc beq 0x80 | |
| 45 8c: e5d60000 ldrb r0, [r6] | |
| 46 90: e1855400 orr r5, r5, r0, lsl #8 | |
| 47 ; receive next stage payload | |
| 48 94: e59f402c ldr r4, =0x800100 ; via 0xc8 | |
| 49 98: e1a03004 mov r3, r4 | |
| 50 9c: e5d60005 ldrb r0, [r6, #5] | |
| 51 a0: e3100001 tst r0, #1 | |
| 52 a4: 0afffffc beq 0x9c | |
| 53 a8: e5d60000 ldrb r0, [r6] | |
| 54 ac: e5c40000 strb r0, [r4] | |
| 55 b0: e2844001 add r4, r4, #1 | |
| 56 b4: e2555001 subs r5, r5, #1 | |
| 57 b8: 1afffff7 bne 0x9c | |
| 58 ; jump to it | |
| 59 bc: e12fff13 bx r3 | |
| 60 | |
| 61 ; literal pool | |
| 62 c0: fffff802 | |
| 63 c4: ffff5800 | |
| 64 c8: 00800100 |