unisoc_secure_boot_bypass

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #typescript #llm #go #golang #android #machine-learning #rust #deep-learning #linux

unisoc_secure_boot_bypass

★ 22 Open GitHub ↗

A poc about bypassing unisoc's secure boot permanently and gaining EL3 code execution.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# unisoc_secure_boot_bypass
A poc about bypassing unisoc's secure boot permanently and gaining EL3 code execution.

This vulnerability has been patched by Unisoc.
## Description

Unisoc's secure boot chain is like BOOTROM->SPL/FDL1->(TOS)->UBOOT/FDL2->KERNEL(For newer socs,POSTROM is added between BOOTROM and SPL)

BOOTROM verifies SPL correctly.

But for other verification,unisoc does not validate the image header.

There is a 0x200 byte-length image header on the top of the image.

It tells the payload len.

And at the end of the image ,located at 0x200+payload len offset,a cert header and a cert lie there.

The cert header tells the payload offset and payload len again.

And the verification logic only uses the payload offset and payload len in the cert header.

But the image loading function jumps to image load address + 0x200

So we can put the shellcode at 0x200 offset.And then put the original signed image after the shellcode.

And then change the payload offset at the cert header.

If you put the shellcode into TRUSTOS,you can gain EL3 code execution.

Thanks to @Tomking062 and its tools,this exploit can work via flashing the modified image into the partition or directly loading it in download mode.
## DISCLAIMER

This is just a poc.

It is only for research and study.

I will not be responsible for any damage of your device and any abuse.

unisoc_secure_boot_bypass

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README