最近把很早以前购买的三星平板拿出来继续使用,其SoC是三星半导体自制的Exynos 9611,由于我买的是WIFI+LTE版本,其存在基带。很久以前用搭载Exynos4210的三星S2的时候,就对三星的奇怪的香农基带感到好奇。
历经快十年的对于逆向的爱好,最近再阅读了一些大牛写的代码和他们提供的Loader,成功的对目前最新的Exynos Shannon基带固件做到了解包,解压后可直接使用ShannonRE项目之中的Loader和静态分析工具进行分析。
当然如果你只是对三星的调试模式比较好奇的话,在我的解压工具中,其将自动从main区块中搜索AT指令,可通过终端模拟器连接到Samsung DM端口发送AT指令进行调试。
# siu.py v1.2
import struct
import sys
import re
class TOC:
def __init__(self, fstream, fpos=None):
try:
if fpos != None:
fstream.seek(fpos)
self.buf = fstream.read(32)
except Exception:
print("[!]ERROR Reading TOC Header")
self.buf = []
def unpack(self):
self.name = self.buf[:12].rstrip(b"\x00").decode("utf-8")
self.start = struct.unpack("i", self.buf[12:16])[0]
self.size = struct.unpack("i", self.buf[20:24])[0]
self.secdata = struct.unpack("i", self.buf[24:28])[0]
self.queue = struct.unpack("i", self.buf[28:32])[0]
def printInfo(self):
print("Block Name: %s" % self.name)
print("Start Offset: 0x%08x" % self.start)
print("Size: 0x%08x" % self.size)
print("Sec Data: 0x%08x" % self.secdata)
print("Queue: %d" % self.queue)
class IMG:
def __init__(self, fstream, hdr):
fstream.seek(hdr.start)
self.buf = fstream.read(hdr.size)
def unpack(self):
return
def write(self, dst):
with open(dst + ".bin", "wb") as f:
f.write(self.buf)
class BOOT(IMG):
def unpack(self):
print('Done')
def unpackToc(fileStream, name):
hdr = TOC(fileStream)
hdr.unpack()
hdr.printInfo()
assert (hdr.name == name)
return hdr
def unpackImg(fileStream, hdr, Type):
img = Type(fileStream, hdr)
img.unpack()
return img
def findAt(img):
at_strings = re.findall(rb'AT\+[^\x00]*', img.buf)
with open('AT.TXT', 'wb') as f:
for at_str in at_strings:
f.write(at_str + b'\n')
print("Found %d AT strings" % len(at_strings))
return at_strings
def findVer(img):
model = input("Input model name>>>")
ver_strings = re.findall(rb'%s[^\x00]*' % model.encode(), img.buf)
with open('VER.TXT', 'wb') as f:
for ver_str in ver_strings:
f.write(ver_str + b'\n')
print("Found %d VER strings" % len(ver_strings))
print("Possible Version: %s" % ver_strings[0].decode())
return ver_strings
def alert():
print("SHANNON Image Unpacker v1.2 by Yuu")
print("Idea from ShannonRE by grant-h")
print("Usage: python3 ./siu.py <modem.bin> -at/-ver")
print(" -at: Find AT strings")
print(" -ver: Find version strings")
sys.exit(0)
def main():
if len(sys.argv) < 2:
alert()
path = sys.argv[1]
fileStream = open(path, "rb")
toc_hdr = unpackToc(fileStream, "TOC")
boot_hdr = unpackToc(fileStream, "BOOT")
main_hdr = unpackToc(fileStream, "MAIN")
vss_hdr = unpackToc(fileStream, "VSS")
nv_hdr = unpackToc(fileStream, "NV")
offset_hdr = unpackToc(fileStream, "OFFSET")
boot_img = unpackImg(fileStream, boot_hdr, BOOT)
boot_img.write("boot")
main_img = unpackImg(fileStream, main_hdr, IMG)
main_img.write("main")
vss_img = unpackImg(fileStream, vss_hdr, IMG)
vss_img.write("vss")
nv_img = unpackImg(fileStream, nv_hdr, IMG)
nv_img.write("nv")
fileStream.close()
if len(sys.argv) > 2 and sys.argv[2] == "-at":
findAt(main_img)
if len(sys.argv) > 2 and sys.argv[2] == "-ver":
findVer(main_img)
if __name__ == "__main__":
main()