houston

Exploit for Exynos devices to gain ACE in BootROM context.

[!CAUTION]

The code for this exploit was previously stolen and used in an AI vibecoded tool made by Creeeeger.

Be extremely careful when using his stuff, it might be broken and cause harm to your device.

How does this even work

A length parameter left unchecked in the USB Control Request code allows iRAM to be dumped, modified and resent to the device, allowing for code execution.

Known vulnerable SoCs

[!CAUTION]

An SoC being vulnerable does not mean payloads and support are available for it.

• Exynos9810
• Exynos9820
• Exynos9830
• Exynos8825
• Exynos9925

Other available tools

There is another tool made by a great friend VDavid003, which supports the same platforms with the new exploit and also incorporates the old exploit to support Exynos8890/Exynos8895.

SoCs Supported by houston

| Symbol | Meaning | |:------:|:-----------------------:| | ✅ | Working | | ❌ | Not Working | | ❓ | Should work, not tested |

| Retail Name | Internal Name | Tested Payloads | Tested by | State | |:-----------------|:--------------|:-----------------------------------------------------------------------------------:|:------------------------------------------------------|:-----:| | Exynos990 | S5E9830 | exynos990-payloads All Branches | halal-beef | ✅ | | Exynos850 | S5E3830 | N/A, Not tested in houston. | N/A | ❓ | | Exynos9810 | S5E9810 | open-mini-bl1 | Robotix22 | ✅ | | Exynos9610 | S5E9610 | N/A, Not tested in houston. | N/A | ❓ | | Exynos7885 | S5E7885 | N/A, Not tested in houston. | N/A | ❓ | | Exynos7870 | S5E7870 | N/A, Not tested in houston. | N/A | ❓ | | Exynos8890 | S5E8890 | 8890_boot_custom_key.S from henr1kas/Exynos | henr1kas | ✅ |

Usage

usage: houston.py [-h] [-e] [-p PAYLOAD] [-d] [-o OUTPUT] [-c] files [files ...]
Exploit for Exynos devices to gain ACE in BootROM context.
positional arguments:
  files                 Files to send to the device post exploit (seperated by a space)
options:
  -h, --help            show this help message and exit
  -e, --exploit         Run the exploit before sending files
  -p, --payload PAYLOAD
                        Path to the payload to launch
  -d, --debug           Debug Mode (hexdumps device responses when console output is enabled and control transfer responses)
  -o, --output OUTPUT   Path to a folder where to save payload output to
  -c, --console-output  Show output to console

Environment preparation

Linux

- Run ``bash udev_rules.sh` as root to setup udev rules - You can now run the tool.

- Uninstall any existing BootROM Drivers - Import the needed certificates by double clicking the `## Driver Certificate (INSTALL ME FIRST BEFORE THE DRIVER).reg` file and importing the regkeys - Install the ones provided by right clicking the inf and pressing install - You can now run the tool.

• Chimera Tool `First discovery of the exploit circa 2021-2022. They provide the most advanced Exynos servicing capabilities in the market to a broad amount of devices, and that is thanks to this specific exploit, and many more.

  - CVE-2024-56426

  This is the CVE houston is based off as we know.

  - Christopher Wade

  Reported CVE-2024-56426 to Samsung

  - kethily-daniel

  Gave me access to the tool for USB packet tracing to extract samples.

  - BotchedRPR

  Helped with the initial research and creation of carte2.

  - VDavid003

  Helped me reverse engineer the PoC via the packet dumps and personally tested on his devices.

  - halal-beef

  Initial USB packet dumps and analysis of the PoC during the research lifecycle.

  - R0rt1z2

  Huge help, even in payload creation, some stuff was based off his project, kaeru.

  - AntiEngineer

  Huge help, gave knowledge and hints about ARM and is all around a great friend.

  - AA

  Vulnerability inspiration, first use outside of Chimera. Someone I knew who conducted research on this exploit.``