improve exploit assembler. support new firmware

banxian · Jun 23, 2023 · 00a5ef5 · 00a5ef5
1 parent b3137a5
commit 00a5ef5
Show file tree

Hide file tree

Showing 10 changed files with 588 additions and 392 deletions.
diff --git a/EDUReViver.suo b/EDUReViver.suo
diff --git a/EDUReViver/EDUReViver.manifest b/EDUReViver/EDUReViver.manifest
@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1" xmlns:asmv3="urn:schemas-microsoft-com:asm.v3">
+    <assemblyIdentity
+        type="win32"
+        name="Banxian.EDUReViver.Console"
+        version="0.3.7.0"
+        processorArchitecture="x86"
+    />
+    <description>EDUReViver for J-Link EDU</description>
+    <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+        <application>
+            <!-- Windows 10 and Windows 11 -->
+            <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
+            <!-- Windows 8.1 -->
+            <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>
+            <!-- Windows 8 -->
+            <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>
+            <!-- Windows 7 -->
+            <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>
+            <!-- Windows Vista -->
+            <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/> 
+        </application>
+    </compatibility>
+    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+        <security>
+            <requestedPrivileges>
+                <!--
+                  UAC settings:
+                  - app should run at same integrity level as calling process
+                  - app does not need to manipulate windows belonging to
+                    higher-integrity-level processes
+                  -->
+                <requestedExecutionLevel
+                    level="asInvoker"
+                    uiAccess="false"
+                />   
+            </requestedPrivileges>
+        </security>
+    </trustInfo>
+</assembly>
diff --git a/EDUReViver/EDUReViver.vcxproj b/EDUReViver/EDUReViver.vcxproj
@@ -104,6 +104,7 @@
       <GenerateDebugInformation>true</GenerateDebugInformation>
       <AdditionalDependencies>setupapi.lib;wininet.lib;shlwapi.lib;version.lib;crypt32.lib;ws2_32.lib;capstone_dll_d.lib;libcurld.lib;libeay32.lib;ssleay32.lib;%(AdditionalDependencies)</AdditionalDependencies>
     </Link>
+    <Manifest />
   </ItemDefinitionGroup>
   <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
     <ClCompile>
@@ -127,7 +128,6 @@
       <WarningLevel>Level3</WarningLevel>
       <Optimization>MaxSpeed</Optimization>
       <FunctionLevelLinking>true</FunctionLevelLinking>
-      <IntrinsicFunctions>true</IntrinsicFunctions>
       <PreprocessorDefinitions>DENYCLONE;WIN32;NDEBUG;_CONSOLE;_STL70_;_STATIC_CPPLIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
     <Link>
@@ -170,6 +170,9 @@
     <ClInclude Include="usbconn.h" />
     <ClInclude Include="usbtypes.h" />
   </ItemGroup>
+  <ItemGroup>
+    <Manifest Include="EDUReViver.manifest" />
+  </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>

diff --git a/EDUReViver/EDUReViver.vcxproj.filters b/EDUReViver/EDUReViver.vcxproj.filters
@@ -54,4 +54,9 @@
       <Filter>Header Files</Filter>
     </ClInclude>
   </ItemGroup>
+  <ItemGroup>
+    <Manifest Include="EDUReViver.manifest">
+      <Filter>Source Files</Filter>
+    </Manifest>
+  </ItemGroup>
 </Project>
diff --git a/EDUReViver/configstore.cpp b/EDUReViver/configstore.cpp
diff --git a/EDUReViver/configstore.h b/EDUReViver/configstore.h
@@ -6,13 +6,14 @@
 struct patcher_config
 {
     //const char* version;
-    uint32_t sp;    // 定位代码运行和覆盖位置
-    uint32_t lr;    // 返回dispatchcmd正常执行
+    uint32_t sptop;     // 定位代码运行和覆盖位置(finearg头部)
+    uint32_t lr;        // 原LR, 返回原usbcmd分拣流程
     uint32_t usbrx;
-    bool isSES;     // SES需要使用R4-R6值
-    char cmdReg;    // 能自由使用的寄存器
-    uint32_t R4, R5, R6;
-    bool nopad;     // 栈末尾没有4字节空洞
+    bool isSES;         // SES需要使用R4-R6值
+    uint8_t regCnt;     // 额外保存的寄存器数量(不含LR)
+    //char cmdReg;      // 能自由使用的寄存器
+    uint32_t regs[9];   // R4-R6值, 最多预留到R12
+    uint8_t endgap;     // 栈尾空洞长度(IAR里可用, SES里不可用)
 };
 
 tm get_build_date(const char* version);