Skip to content

Instantly share code, notes, and snippets.

View ktemkin's full-sized avatar

Kate Temkin ktemkin

View GitHub Profile
@ktemkin
ktemkin / demo_trampoline_xen.c
Created September 9, 2016 00:37
Tampoline E0->EL2 PoC
/**
* Stuck inside the Xen domain-setup code...
*/
static struct mmio_handler_ops poc_mmio_ops;
static void memory_trampoline_demo(struct domain *d)
{
/*
* Remove domain permissions for the guest-physical memory address
I spent a couple of hours spinning back up on this today, and got the VMware debug stub working (and with symbols!) for both the Linux kernel and for Bareflank. Thought I'd share, as this seems like it'll be really useful-- included below. I'll probably throw this on the Wiki once I'm sure the instructions are all sensical.
#Install homebrew, if you haven't already.
ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
#Add a repository of cross compilers to your existing Homebrew installation.
brew tap sevki/homebrew-gcc_cross_compilers
#Install GDB for x86_64, which should allow us to debug Bareflank.
brew install x86_64-elf-gdb
@ktemkin
ktemkin / glitchkit_tablet.py
Created December 26, 2017 13:38
reproduces @scanlime's tablet work using GlitchKit instead of the FaceWhisperer
#!/usr/bin/env python2
import sys
import binascii
from greatfet import GreatFET
from greatfet.protocol import vendor_requests as vr
gf = GreatFET()
# USBKeyboard.py
#
# Contains class definitions to implement a USB keyboard.
import greatfet
import random
from facedancer.USB import *
from facedancer.USBDevice import *
from facedancer.USBConfiguration import *
# USBKeyboard.py
#
# Contains class definitions to implement a USB keyboard.
import greatfet
import random
from facedancer.USB import *
from facedancer.USBDevice import *
from facedancer.USBConfiguration import *

Keybase proof

I hereby claim:

  • I am ktemkin on github.
  • I am ktemkin (https://keybase.io/ktemkin) on keybase.
  • I have a public key ASDo7EYFovlepz-vLDylxAChJ17lPF2Anl9OXluvmrZwcQo

To claim this, I am signing this object:

#include <stdint.h>
#include "registers.h"
#define UART_PROVIDES_PUTS_PUTC
#define CAR_BASE 0x60006000UL
#define PINMUX_BASE 0x70003000UL
#define HEX_CHAR(x) ((((x) + '0') > '9') ? ((x) + '7') : ((x) + '0'))
# USBKeyboard.py
#
# Contains class definitions to implement a USB keyboard.
import greatfet
import random
import inputs
from facedancer.USB import *
from facedancer.USBDevice import *
#!/usr/bin/env python3
import greatfet
from greatfet import GreatFET
from facedancer.backends.GreatDancerApp import GreatDancerApp
from facedancer.backends.GreatDancerHostApp import GreatDancerHostApp
TESTER_SERIAL_NUMBER = '0000d1c466e6380c5213'
# Note that these don't exactly line up with the data printed in the EHCI
@ktemkin
ktemkin / .ccls
Created January 16, 2019 15:24
ccls config for GreatFET
%compile_commands.json
%c %cpp %h %hpp -I/usr/local/Cellar/arm-none-eabi-gcc/20150921/arm-none-eabi/include/