Skip to content

Commit

Permalink
Update exploit.js
Browse files Browse the repository at this point in the history
  • Loading branch information
j005u authored Sep 24, 2022
1 parent d039f16 commit bf7c9d9
Showing 1 changed file with 1 addition and 59 deletions.
60 changes: 1 addition & 59 deletions src/exploit.js
Original file line number Diff line number Diff line change
Expand Up @@ -271,64 +271,7 @@ async function lock(path) {

}

async function hardlock(path) {

console.log("This will attempt to flash back stock FW (without any real verification) and reset secure_debug and dm_verity. Type 'yes' to confirm?")
return confirm()
.then(() => {
return identifyDevice(path)
.then(() => {
console.log("sending flash command for first slot")
return shell(`
umount /proc/cmdline || true
update_engine --update_package=/cache/ota.zip
reboot`)
})
.then(() => {
console.log("waiting 2 minutes (30 seconds spare on just flash v2 goggles) for the flash to complete")
return sleep(120000)
})
.then(() => {
port = new SerialPort({path: portPath, baudRate})
})
.then(() => {
console.log("sending flash command for second slot")
return shell(`
umount /proc/cmdline || true
update_engine --update_package=/cache/ota.zip
reboot`)
})
.then(() => {
console.log("waiting 2 minutes (30 seconds spare on just flash v2 goggles) for the flash to complete")
return sleep(120000)
})
.then(() => {
port = new SerialPort({path: portPath, baudRate})
})
.then(patch)
.then(()=> {
const config = configs[device].debug
config.data = Buffer.from("00000E00AF5C5F2800295F2FAF4849444A490000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FF0000000000000000000000880AEE0E01D4E85374710961DECE84176BF1F91800000000000000000000000000000000000000000000000000000000", "hex")

//config.data = Uint8Array.from(Buffer.from("00000E00AF5C5F2800295F2FAF4849444A490000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FF0000000000000000000000880AEE0E01D4E85374710961DECE84176BF1F91800000000000000000000000000000000000000000000000000000000", "hex"))
return talk(port, config, false)
.then((result) => {
console.log(result)
port.close()
console.log("hardlock should be done, power cycle your device")
console.log("you can use 'shell reboot' and verify nothing happens")
console.log("you should get:")
console.log("harry, i'm sorry, you're not a wizard")
process.exit(0)
})
})
.catch((error)=> {
console.log(error)
process.exit(1)
})
})

}


function makeShellPayload(script) {
Expand All @@ -347,6 +290,5 @@ function makeShellPayload(script) {


module.exports.unlock = unlock
module.exports.hardlock = hardlock
module.exports.lock = lock
module.exports.doShell = doShell
module.exports.doShell = doShell

0 comments on commit bf7c9d9

Please sign in to comment.