mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-31 03:05:21 +00:00
42 lines
1.2 KiB
Python
42 lines
1.2 KiB
Python
import usb.core
|
|
import usb.util
|
|
import sys
|
|
|
|
VENDOR_ID = 0x048d
|
|
PRODUCT_ID = 0x1234
|
|
|
|
def probe_backdoor():
|
|
dev = usb.core.find(idVendor=VENDOR_ID, idProduct=PRODUCT_ID)
|
|
if dev is None:
|
|
print("Device not found")
|
|
return
|
|
|
|
print(f"Found Device: {hex(VENDOR_ID)}:{hex(PRODUCT_ID)}")
|
|
|
|
if dev.is_kernel_driver_active(0):
|
|
dev.detach_kernel_driver(0)
|
|
|
|
# bRequest = 0x06 (Execute Vendor Command)
|
|
# wValue = Command Code
|
|
# wIndex = Sub-command
|
|
# wLength = Data Length
|
|
|
|
commands = [
|
|
(0x06, 0x01, 0, 6, "Read NAND ID"),
|
|
(0x06, 0x01, 0x01, 6, "Read NAND ID Alt"),
|
|
(0x01, 0, 0, 1, "Read Register 0"),
|
|
(0x02, 0, 0, 1, "Read Register 0 Alt"),
|
|
]
|
|
|
|
for req, val, idx, length, desc in commands:
|
|
print(f"[*] Testing {desc} (Req: {hex(req)}, Val: {hex(val)})...")
|
|
try:
|
|
# 0xC0 = Device-to-Host, Vendor, Device
|
|
ret = dev.ctrl_transfer(0xC0, req, val, idx, length, timeout=1000)
|
|
if ret:
|
|
print(f" [+] Success! Data: {bytes(ret).hex().upper()}")
|
|
except usb.core.USBError as e:
|
|
print(f" [-] Failed: {e}")
|
|
|
|
if __name__ == "__main__":
|
|
probe_backdoor()
|