raxone/amlogic-usbdl_s905x3

Dump s905x3

unsigned code loader for Amlogic bootrom

• https://github.com/frederic/amlogic-usbdl.git
• https://github.com/Raxone/amlogic-usbdl_s905x3.git

Changes

• 22.07.2023
• add support for usb password protect
• fix some script

Disclaimer

You will be solely responsible for any damage caused to your hardware/software/warranty/data/cat/etc...

Description

Amlogic bootrom supports booting from USB. This method of boot requires an USB host to send a signed bootloader to the bootrom via USB port.

This tool exploits a vulnerability in the USB download mode to load and run unsigned code in Secure World.

Supported targets

• X88proX3
• Probably work with all s905x3 box.

Scripts

• all.sh
• Dump bootloader+dtb+boot
• Convert dtb to dts
• Dump efuse extract bl2 asekey and iv
• Decrypt bootloader
• Extract u-boot
• Decrypt u-boot
• Decrypt boot
• Extract bl3xaeskey+kernelaeskes
• All files be in dump_all dir.

Usage

Box must be in usbdl mod. To put box to usbdl mod with toopick in AV hole on box push button and connect box with USB-A to USB-A cable with PC, keep button pushed (10sec) after connect usb cable with pc.

• git clone https://github.com/Raxone/amlogic-usbdl_s905x3.git

• If board usb password protect, put password file in password folder,and rename to password.bin

• cd amlogic-usbdl_s905x3

• ./scripts/all.sh

• All files be in dump_all dir.

• If board in nonsecured mode

• Only dump boot.bin dtb.bin bootloader.bin efuse.bin and extract dtb.bin to dts.

• If board in secured mode

• bl2aeskey -Bootloader(BL2) aeskey used for decrypt bootloader.

• bl2aesiv -Bootloader(BL2) initialization vector(IV)used for decrypt bootloader.bin.

• bl3xaeskey -U-boot aeskey

• kernelaeskey - Kernel aeskey

• bootloader.bin -Dumped main bootloader from box(BL2,FIP,BL3.1,BL33(U-boot)).

• bootloader_dec.bin -Decrypted bootloader.bin

• Extract -u-boot

• Decrypt -u-boot

• Decrypt -boot/kernel

• dtb.bin -Device tree blob binary

• dtb_dts -Device tree blob txt

• root_rsa_keys.sha -sha256 of rootkeys used for encrypt bootloader.

• pattern.secureboot.efuse -pattern burned in efuse from manufacturer to enable secureboot

./amlogic-usbdl <input_file> [<output_file>]
	input_file: payload binary to load and execute (max size 65280 bytes)
	output_file: file to write data returned by payload

Payloads

Payloads are raw binary AArch64 executables. Some are provided in directory payloads/.

License

Please see LICENSE.

amlogic-usbdl_s905x3's Issues

question about u-boot for Armbian

Hi, thanks for this brilliant script :)

I was able to decrypt bootloader on X88proX3

USB Connect
Dump Bootloader
Dump DTB'S
Dump Boot
Reboot to BL1
Board is in secure mode
Dump Efuse 0xFFFE0000
Run Amlogic-usbdl playload
- exploit: starting.
- exploit: sending payload...
- exploit: sending 823 dummy transfers...
- exploit: sending last transfer to overwrite RAM...
- exploit: done.
Received data saved to file EFuse.bin (2048 bytes).
Board is in secure mode
Decrypt bootloader
Extract All
Decrypt U-boot
Decrypt Boot
Extract_DTB
Dumped 00_kernel, start=0 end=0
Dumped 01_dtbdump_Amlogic.dtb, start=0 end=92160
Dumped 02_dtbdump_Amlogic.dtb, start=92160 end=196608
Extracted 2 appended dtbs + kernel to dts
DTB_to_DTS
Done

now in the dump_all I have:

-rw-r--r--  1 root    root          64 sie  8 12:51 bl2aeskey
-rw-r--r--  1 root    root       61440 sie  8 12:51 bl2_cfg.bin
-rw-r--r--  1 root    root          32 sie  8 12:51 bl2ivkey
-rw-r--r--  1 root    root        1036 sie  8 12:51 bl2key.bin
-rw-r--r--  1 root    root          64 sie  8 12:51 bl3xaeskey
-rw-r--r--  1 root    root    16777216 sie  8 12:51 boot.bin
-rw-r--r--  1 root    root    16777216 sie  8 12:51 boot_dec.bin
-rw-r--r--  1 root    root     2097152 sie  8 12:51 bootloader.bin
-rw-r--r--  1 root    root     2097152 sie  8 12:51 bootloader_dec.bin
-rw-r--r--  1 root    root      196608 sie  8 12:51 dtb.bin
drwxr-xr-x  2 root    root        4096 sie  8 12:51 dts/
-rw-r--r--  1 root    root        2048 sie  8 12:51 EFuse.bin
-rw-r--r--  1 root    root       16384 sie  8 12:51 fip.bin
-rw-r--r--  1 root    root          64 sie  8 12:51 kernelaeskey
-rw-r--r--  1 root    root          64 sie  8 12:51 pattern.secureboot.efuse
-rw-r--r--  1 root    root        1036 sie  8 12:51 rootkey.bin
-rw-r--r--  1 root    root          64 sie  8 12:51 root_rsa_key.sha
-rw-r--r--  1 root    root      787968 sie  8 12:51 u-boot_dec.bin
-rw-r--r--  1 root    root      787968 sie  8 12:51 u-boot_enc.bin

now I want to use this method to prepare u-boot for armbian:
https://github.com/unifreq/u-boot/blob/master/doc/board/amlogic/h96max-x3.rst

and finally add X88proX3 as a supported device according to this instruction:
https://github.com/araczkowski/amlogic-s9xxx-armbian/blob/main/documents/README.md#1215-how-to-add-new-supported-devices

Do you have any experience with Linux on X88proX3?
Perhaps you are trying to do the same, maybe we can share the knowledge and do this together?

Thanks in advance 👍

question about UART Debug tool for X88proX3

I'm trying to check the boot logs on the device, I'm using CuteCom for this

I checked different connection settings but there are no data on /dev/ttyUSB0

on your video I saw that it works for you

what program are you using? do I have to do something special to see the logs? It works fine for my other boxes but not for X88proX3

I'm wondering that maybe something is physically missing on my board...