yashsingh1/xdaforums huggingface dataset:
[P3600 Software Upgrading] pof:
I'd like to introduce Trinity splxploit, a tool that expolits an stack overflow bug in Trinity SPL discovered by stepw.

This bug is present in ALL Trinity SPL versions up to now (from 1.00 to 3.03) allows downloading and running arbitrary unsigned code on the SPL itself, once exploited one can load a modified/patched SPL (such as Olipro's HardSPL or Des crashproof SPL) and unbrick any bricked device stuck in bootloader mode.

UPDATE: Code compiles on linux x86, and windows XP using cygwin, I have not tested other platforms.

To compile run 'gcc splxploit.c -o splxploit'.

To run use './splxploit -F YourSPL.nb'

To run under windows just double click on the file named "unbrick.bat"

Usage:

=== Trinity splxploit by pof - pof[at]eslack[.]org
=== Exploits stack overflow on HTC Trinity SPL

Usage: splxploit -F SPLfilename.nb [options]

SPLfilename.nb:
custom/patched SPL to load on device

options:
-c [1|2|3] call 1:wdata 2:emapi 3:emapi ds (default:autodetect)
-s [serial] use another serial device (default:/dev/ttyUSB0)
-v verbose mode
-d show debug information
-h shows this help message

This exploit will autodetect the current SPL version with some predefined values, if it is unknown the memory and stack layout detection will take more time, and probably you'll need to use '-c' command line argument to call a funciton with entry point properly aligned.

Example output:

# ./splxploit -F TRIN_SPL105.nb
=== Trinity splxploit by pof - pof[at]eslack[.]org
=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_SPL105.nb

[] Detecting IPL & SPL versions...
* Detected Trinity IPL-1.00
* Detected Trinity SPL-2.04.0000

[] Detecting memory layout...
* Trinity SPL-2.04 found (0x8C030D90)
* We need to fill the stack until address 0x8c030d90

[] Detecting stack layout...
* Send === pattern
* Found pattern === crc=0x98ea7ae2 at address 0x8c08db90 with offset 0x0
* Switch to ruustart command mode...
* Send ~~~ pattern
* Found pattern ~~~ crc=0x91aefc33 at address 0x8c08da40
* Send *** pattern
* Found pattern *** crc=0x709a5411 at address 0x8c08d960

[] Loading unsigned code... (wdata buffer at 0x80b00000)

[] We need to overflow 0x5cad5 bytes on the stack...
* Sent 0x4d8c0 bytes - stack overflow reached the SPL end at 0x8c040000
* Sent shellcode - we will jump here later
* We need to send 275 ruustart calls more, containing relative jumps to our shellcode
* Sent 0x5ca40 bytes

[] We need to call a properly aligned function above patch limit now
* Calling emapi...

[] Done, Trinity 0wn3d!!!
* If device is not responding, soft reset and try again!

For details on the stack overflow itself, see the source code :)

All credits go to stepw, everybody should thank him for this, he discovered the bug and was the first to exploit it, but his computer was stolen and lost all his work :( he was very kind to share the vulnerability details with me and I implemented the exploit.

UPDATE:

splxploit available in 3 flavors:

- Download Linux version

- Download Windows Cygwin version

- Download Windows .NET version (thanks Shadowmite!)

Enjoy ;)
[P3600 Software Upgrading] pof:
Hermes & Breeze users see here for technical discussion:

http://xdaforums.com/showthread.php?t=308707
[P3600 Software Upgrading] hcarrega:
make this sticky
[P3600 Software Upgrading] KaYs3r:
Thank you pof.

This is great news :)
[P3600 Software Upgrading] racerx_:
incredible! thanks pof!
[P3600 Software Upgrading] stepw:
You don't seem to have spl.nb file in current folder.

Extract OliPro's HSPL and copy to the same dir renaming to spl.nb
[P3600 Software Upgrading] telemix:
Stepw,

spl.nb is in the same directory where and splxploit.c. But for some reason writes "no such file or directory", "cannot open spl.nb"
[P3600 Software Upgrading] telemix:
Yes it's my error, spl and splxploit in different folders, but upgrade only spl-MFG, at others spl (for example HARD-spl) the black screen on Trinity and it is not overloaded?
[P3600 Software Upgrading] telemix:
And now, as i can dump ROM with information about ID device ("TRINITY100", i crashed it, now "TRINITY")from ROM as I can what further to copy it anew in ROM. What commands and addresses in MTTY? Please, pof and stepw.
[P3600 Software Upgrading] telemix:
All thanks all has turned out.
[P3600 Software Upgrading] stepw:
telemix, you may want to share your experience with the community?
[P3600 Software Upgrading] steveecourt:
I dont have a c compiler has anyone a compiled version thanks
[P3600 Software Upgrading] swartb:
YES!!! Success.

This afternoon i thought my trinity had died for good. But thanks you this great tool I managed to bring it back to live :)

At first I renamed RUU_signed.nbh (in the hard-spl zip) to spl.nb but off-course that didn't work. After extracting the spl file with NBHExtract all went well.

Thanks very much stepw and pof!
[P3600 Software Upgrading] sabestian:
And... can anyone tell me what does that all technical blahblah mean? ;) I've got m700 stuck in bootloader. Being a noob, have I got any chance to do anything about it myself? If not, what to do? Cheers!
[P3600 Software Upgrading] tuannghia1985:
And now, as i can dump ROM with information about ID device ("TRINITY100", i crashed it, now "TRINITY")from ROM as I can what further to copy it anew in ROM. What commands and addresses in MTTY?

-------------------------------------------------------------

same as i want to...pls answer !!!
[P3600 Software Upgrading] tuannghia1985:
some1 ever try compiller on windows xp with msys???
[P3600 Software Upgrading] tuannghia1985:
sorry for annoying. But i got error like that when try to run ,to compiler "splxploit.c"

$ gcc splxploit.c -o splxploit

splxploit.c: in function getchecksum':

splxploit.c:602: parse error before 'char'

splxploit.c:604: 'str' underclared<first use in this function>

splxploit.c:604: <each underclared identifier is reported for once

splxploit.c:604: for each function it appear in .>

seem i used mingw and msys to compiler. thank you for any advise......
[P3600 Software Upgrading] pof:
@tuannghia1985: don't think it will work with Windoze / mingw... get a Linux LiveCD, should be easier :)
[P3600 Software Upgrading] tuannghia1985:
thank you, i get spring one live cd,and it's work very good.

But after all, file ***.nb after you guy extract, must unlock all access to this file, or else it say "not permission"...can't find such file or directory or else can't open file ***.nb

It's my experience for this time.

Dear all. Thank you pof.

It's return to live, and now i enjoy wm6 ^_^
[P3600 Software Upgrading] semsenem:
Trin100 HTC Innovation Broken USB Boot Stuck

Hi!

I need some help.

Trying to xploit my HTC but dont know how to do it, because USB connector is broken, cant connect with ActiveSync.

Last MiniSD card is unredable, bought new one. Have no default system backup.

2GB SD card is formated FAT32 without any label on it.

After trying to boot from sd card only getting this screen:

Tricolor display:

Trin100

IPL-0.50

TRIN100

SPL-1.70.000

SERIAL

Loading...

and back again to same tricolor screen.

I think because i have no USB

this code in unbrick.bat wont work

splxploit.exe -F TRIN_HardSPL.nb -s \\.\\WCEUSBSH001

what should i change in this code?

How to xploit from SD card?

Can you make me a default working windows system what i can copy to my sd card and boot from there?
[P3600 Software Upgrading] pof:
New version, with improved compatibility with new SPL-3.03 is available on my website:

http://pof.eslack.org/HTC/splxploit/
[P3600 Software Upgrading] ww2250:
I compiled a cygwin version which might work in Windows and attached here, in the hope that someone will find it useful - and as usual no warranty nor guarantee is given :-) I haven't actually tried it since I am still lucky not to have a bricked Trinity - yet :D Let me know if it's not working.
[P3600 Software Upgrading] gaz_az:
Thanks for the file - I am hopeful I will be able to use this rather than Linux !

A little progress on my part, but still not quite there. I installed cygwin and it runs ok. I try to run the script but it gives me an error message ...

I type .. /home/splxploit -F spl.nb

but then says /dev/ttyUSB0: No such file or directory

cannot connect to dev/ttyUSB0

1) The phone is in bootloader mode attached to the USB port on the computer. Is there something I have to do to setup the USB port in cygwin ??

2)I just renamed the nb file in HardSPL, is this ok ?? or do I have to work out how to use NBHextract ??
[P3600 Software Upgrading] ward777:
Wouldn't you need Linux to run this file anyways?
[P3600 Software Upgrading] Shadowmite:
No, cygwin should be fine, however opening the weird usb handles is nothing cygwin is going to support natively as a device (or so I think). You'll have to basically create a device driver for it.

A better solution is to port this to a dos c application or better yet port to C# in windows (which I am going to work on and see if I can get this done).
[P3600 Software Upgrading] ww2250:
Don't know if it works or not, but you can try:

mknod /dev/ttyUSB0 c 188 0
[P3600 Software Upgrading] pof:
Here's how to use the cygwin compiled version under windows:

pau@cool /cygdrive/c/Documents and Settings/pau/Desktop/splxploit-cygwin
[B]$ ./splxploit.exe -F ./TRIN_SPL105.nb -s \\\\.\\\WCEUSBSH001[/B]
=== Trinity splxploit by pof - pof[at]eslack[.]org
=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: ./TRIN_SPL105.nb

[] Detecting IPL & SPL versions...
* Detected Trinity IPL-1.00
* Detected Trinity SPL-3.03.0000

[] Detecting memory layout...
* Finding CRC...
* We need to fill the stack until address 0x8c03167c

[] Detecting stack layout...
* Send === pattern
* Found pattern === crc=0x98ea7ae2 at address 0x8c08db90 with offset 0x0
* Switch to ruustart command mode...
* Send ~~~ pattern
* Found pattern ~~~ crc=0x91aefc33 at address 0x8c08da40
* Send *** pattern
* Found pattern *** crc=0x709a5411 at address 0x8c08d960

[] Loading unsigned code... (wdata buffer at 0x80b00000)

[] We need to overflow 0x5c1e9 bytes on the stack...
* Sent 0x4d8c0 bytes - stack overflow reached the SPL end at 0x8c040000
* Sent shellcode - we will jump here later
* We need to send 265 ruustart calls more, containing relative jumps to our shellcode
* Sent 0x5c180 bytes

[] We need to call a properly aligned function above patch limit now
* Calling emapi ds...

[] Done, Trinity 0wn3d!!!
* If device is not responding, soft reset and try again!

pau@cool /cygdrive/c/Documents and Settings/pau/Desktop/splxploit-cygwin

However it seems is not working, my trinity screen turns black when the exploits finishes and doesn't load the provided SPL file at the end :(

Please download a linux LiveCD and run it native, you should have no problems with that.
[P3600 Software Upgrading] pof:
The cygwin version crashes when it loads unsigned code (wdata buffer at 0x80b00000), it correctly sends the NBH header and patched IPL, but it fails to send the SPL file, so the bootloader returns an USB timeout and asks to resend the packet:

Get 0xf bytes from the device:
55 53 42 20 74 69 6D 65 20 6F 75 74 0D 0D 0A USB time out...

Get 0x12 bytes from the device:
52 65 61 64 20 64 61 74 61 20 66 61 69 6C 2E 0D Read data fail..
0D 0A ..

Get 0x10 bytes from the device:
43 6C 65 61 72 20 4E 42 48 20 74 61 67 0D 0D 0A Clear NBH tag...

Get 0x15 bytes from the device:
57 72 69 74 65 20 4E 61 6E 64 20 53 75 63 63 65 Write Nand Succe
73 73 0D 0D 0A ss...

Get 0x11 bytes from the device:
52 65 20 73 6E 65 64 20 70 61 63 6B 65 74 0D 0D Re sned packet..
0A .

Get 0x14 bytes from the device:
48 54 43 53 01 80 03 00 01 00 00 00 A7 FF 94 7A HTCS.€......§ÿ”z
48 54 43 45 HTCE

The problem is in the function exploit_flashNBH(), just when it does write (fd, nbhbuffer, readlen). Don't know why cygwin fails with that :confused:

I'll try to setup gcc on cygwin and see if i can work something out, for those lazys not willing to use a native Linux ;)
[P3600 Software Upgrading] Shadowmite:
Hey pof, I may need a few questions answered about the way this works to get my C# version going... But I've got a bootloader interface working now...
[P3600 Software Upgrading] pof:
@Shadowmite: feel free to ask... i'll be in irc channel later if you prefere :)
[P3600 Software Upgrading] pof:
OK, i fixed the problem which was preventing it to work properly under windows :D

See the first post to download a windows compatible version :cool:
[P3600 Software Upgrading] ward777:
Works perfect!!

YOU

ARE

A

GENIUS!!!

:)
[P3600 Software Upgrading] ww2250:
pof you are so quick, as always!
[P3600 Software Upgrading] DevilEye:
Hey pof,

thanks for your info, but I still cannot recover my device :confused: by using the program you provided (windows ver), error message is Permission Denied

How can I do?

This term of brick is cause being RUU to WM6, but continue of error, then can't for back :eek:, after this the screen only hold on the bootloader

Any solution to solve this please?
[P3600 Software Upgrading] pof:
Where do u get this message? You must use a Windows XP computer and run "unbrick.bat" as Administrator user.
[P3600 Software Upgrading] Xtacy:
Same here I run a bat file under windows when in the device got the three color bars and in the white bar they appear USB then I hit the unbrick.bat it come this message and yes I run under admin as well

[B]
Please make sure ActiveSync USB connection is DISABLED
Press any key to continue . . .

=== Trinity splxploit by pof - pof[at]eslack[.]org
=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_HardSPL.nb
\\.\\WCEUSBSH001: Permission denied
cannot connect to \\.\\WCEUSBSH001

Press any key to continue . . .[/B]

Thanks Pof for your hard working and fully support here
[P3600 Software Upgrading] qubz:
this tool fixed my phone!!!

cheers pof you nifty progam saved the day. After spending the good half of the day flashing to recover ->tried 4 different HardSPL's and about 8 backward os installations , I got vmware running XP in vista working , ran your solution on it and it did the job perfectly, so now I'm back on PDAVIET and happy :) !!!
[P3600 Software Upgrading] Xtacy:
Please give more instruction howto or easy way to unbrick my dopod D810 as above post I always have that message I m really appreciated what ever your guys done Thanks a lot
[P3600 Software Upgrading] Xtacy:
I read the bat file see this line is there anything do I need to change

like this WCEUSBSH001 I don't know what is this

@echo off
cls
echo.
echo Please make sure ActiveSync USB connection is DISABLED
pause
echo.
splxploit.exe -F TRIN_HardSPL.nb -s \\.\\WCEUSBSH001
echo.
pause
[P3600 Software Upgrading] Xtacy:
OK let me follow up this topic as what I see my my Device now is a bootloader with 3 color bars

TRIN100

IPL-0.50

TRIN100

SPL-1.20.Olipro

Then in the white bar before conect in the USB it show Serial then conect in it show USB In this state the windows activesync still not connect but in the device it conect say USB is it correct

Then go to dir splxploit-windows double click on the unbrick.bat it show me this

Please make sure ActiveSync USB connection is DISABLED
Press any key to continue . . .

=== Trinity splxploit by pof - pof[at]eslack[.]org
=== Exploits stack overflow on HTC Trinity SPL

[] SPL file: TRIN_HardSPL.nb
\\.\\WCEUSBSH001: Permission denied
cannot connect to \\.\\WCEUSBSH001

Press any key to continue . . .

I wonder any step there I miss out some thing Please help me ;)

Thanks
[P3600 Software Upgrading] Xtacy:
Horay it work

Now let me thanks Pof for his hard work and for this community I have to do some thing about this as follow so far pof should tell us there is done after running the bat file even there say is

Permission denied

cannot connect to \\.\\WCEUSBSH001

Press any key to continue . . .

I then go to the and run this RUU_Trinity_DOPODASIA_WWE_1.23.707.2_6275_1.29.00.11_108_Test.exe

Sorry I could not provide this link in this state

Horay it work for me now May be I just leave it for now befor I can find the steady version for this Maybe PDAViet I hope

Thanks every one thanks the community and special thanks to Pof as well with your script

BTW anyone can give the link for the Rom Viet they said it steady and fast I could go and try as for the test device then
[P3600 Software Upgrading] Shadowmite:
I've ported pof's application to a Windows .NET application, and while it's still a early version, I believe it's functional now (at least on mine!). Simply unzip the file, the tool is in the tool folder, sources are included also... Pof, feel free to link this one on your main post if you like... This might help those of you having problems with security.
[P3600 Software Upgrading] DevilEye:
My status are almost like you, just show with a difference version number in my device

TRIN100

IPL-1.00

TRIN100

SPL-3.03

Anyone have experience to help us? Thanks

Pof: to reply the post of you, I'm using the Administrator Class to run the splxploit - unbrick.bat, any other info. I need to follow

thanks you for you help and work in here

(forgive for my English) ;)
[P3600 Software Upgrading] pof:
@shadowmite: thanks, first post updated :)

@ Xtacy: if it shows spl-1.20.olipro is not bricked, flashing any rom will unbrick it

@ DevilEye: can you mtty into bootloader? Are you sure activesync is disabled? Also try using the .NET version from shadowmite.
[P3600 Software Upgrading] DevilEye:
Nice to hear this message for recover my TRIN100, after I had tried, my device can be recover to the previous version WM5 (since I never successful to upgrade to WM6), BTW now I can recover this, thanks for Xtacy to share his experience.

Then I also hope to HTC can provide a steady version for WM6 upgrade, waiting for the good news ;)
[P3600 Software Upgrading] DevilEye:
Thanks pof

I had been recover my device by using the method given by Xtacy, it should be foreback to WM5 in currently, but I'm still want to upgrade it to the WM6.

My previous status are holding on the bootloader (which screen in 4 color sections including the white), and the white section is caption in USB while I'm connecting the device to PC with USB.

Then, my ActiveSync can't found any kind of device, I not sure that is ENABLE or not, how can I know this?
[P3600 Software Upgrading] tuannghia1985:
NBHEXtract is ok, everything is ok, but u need to "properties" this file first.

If u can see,this file is set to "read only"...need permission to "read and write".

I got the error like u ever on Linux,cause this file is "read only" :D :D :D

So try again...good luck
[P3600 Software Upgrading] gaz_az:
All Hail Pof - Got home after a long weekend away and tried the windows .bat version. Worked a charm, and I have now fixed my dad's phone. He will be very pleased and might start speaking to me again !!!

Got the ...

[] SPL file: TRIN_HardSPL.nb

\\.\\WCEUSBSH001: Permission denied

cannot connect to \\.\\WCEUSBSH001

message first, but worked out it was because activesync was loaded in the background (even though it was not connected !). Just turned it off and all was well :)

GREAT !!!!!!!! :)
[P3600 Software Upgrading] Xtacy:
;)

That is fine just same as mine in the USB status there you can run the unbrick.bat then just ignore the error message in the message window then run the RUU_Trinity_DOPODASIA_WWE_1.23.707.2_6275_1.29.00. 11_108_Test.exe

check in this link

http://wiki.xda-developers.com/index.php?pagename=Trinity_Upgrades

and now I have run the PdViet version work like a charm

http://xdaforums.com/showthread.php?t=299618&highlight=pdviet
[P3600 Software Upgrading] alexk:
I have tryed this, I just downgrated my Radio, no changes to the ROM. still at 02.10.00

it seams that the SPL when manualy started shows:

TRIN100

IPL-0.50

TRIN100

SPL-1.20.Olipro

and a split second

Loading...

and than..

IPL-0.50

SPL-1.20.Olipro

no more TRIN100
[P3600 Software Upgrading] stepw:
Device name must be pulled up from flash, a certain block must be erased or damaged.
[P3600 Software Upgrading] Mash_fr2000:
Hi

First, thank you so much for this, it just saved my day (and my P3600 )

It seems there is a slight syntax error in the windows version batch file from the first post of the thread.

I had to edit it and replace \\.\\WCEUSBSH001 by \\.\WCEUSBSH001 (difference: one backslash only after the point)

So, if any of you try to run the thing and gets an immediate error with the \\.\\WCEUSBSH001 stuff mentioned, just edit the unbrick.bat with notepad, erase the faulty '\', and enjoy the power of Pof's tool :)

M
[P3600 Software Upgrading] steveecourt:
Has anyone a version of this that works under VISTA?

Thanks
[P3600 Software Upgrading] racerx_:
i saw your post on this, but i don't understand why only you would be encountering this so far.. i've used windows version numerous times with no problems..
[P3600 Software Upgrading] steveecourt:
under vista

you get

\.\\wceusbsh001: no such file or directory
[P3600 Software Upgrading] racerx_:
ah got it..
[P3600 Software Upgrading] colrou:
pd with xp

hello

i have an problem with the splxploit-windows .

i have this screen can you help me ?

i have 1.07 de Des
[P3600 Software Upgrading] guyjones:
You're my godness !!!!

BIG THANKS TO YOU !!!

I had a brick :)
[P3600 Software Upgrading] macars:
Help PLZ

After the second strike at "cannot connect to \\WCEUSBSH001" Press any key to continue.....

when I press the key eveything disappear and and i tried again and again the result is the same.

Any advice guys. thanks
[P3600 Software Upgrading] malibusa:
tnhanks

thanks thanks thanks thanks
[P3600 Software Upgrading] speedyduck:
Thanks Pof,

I tried to flash the trinity from HK to the English version and the process stopped at 1%. Then the trinity was stuck at the bootloader.

Just thought my trinity was bricked and I came across your post and the life saving program.

I've unbricked the device.

Thanks heaps
[P3600 Software Upgrading] Markos:
I have done that. I didn't came further than the screenshot above. So I started unbrick.dat again and this time it doesn't go further than this:

Even after another retry to start it, it doesn't go further. It doesn't reach the same status as this picture:

(picture is from http://trinityguides.info/index.php?option=content&task=view&id=22 )

What do I have to do now? I'm stucked again..
[P3600 Software Upgrading] Markos:
And after a few times retrying I get till this point:

But now it doesn't go further. I don't understand why it stopped the first times on those positions, than on that other position and now on this position? Why is this? And now I can't come any further. I shall let the program work for an houre of two. But I am afraid it doesn't reach another position.

If someone can help me, or thinks that he/she can help me. Let me know! Every idea/hint/tip is welcome!
[P3600 Software Upgrading] darkstave83:
You made my Trinity breath again

Thanks Pof,

I have also a trinity and i flash it for a third time in 5 months. I managed to brick it. The trinity was stuck at the bootloader.

As i came to your post and used that information I've unbricked my device.

You are a life savior

My smile has reached my ears.

Thanks
[P3600 Software Upgrading] Markos:
I was forgotten to tell it here, but I have done it. Don't ask how, I don't understand. I just reply doing the same over and over again. And I really mean the same. Exact the same steps. Don't know why there is a difference.. even when I do the same steps..
[P3600 Software Upgrading] Jadatmag:
I really can't figure out what to do..

I dont understand the steps.. lol

"" # To compile run 'gcc splxploit.c -o splxploit'.

# To run use './splxploit -F YourSPL.nb'

# To run under windows just double click on the file named "unbrick.bat"

What file do I need to change?

How do I unpack the file with the nhb extractor? (when I double press the exe when their both in the same map, nothing happens)

Can my p3600 be in ANY usb port?

I really hope I can fix the obly phone I have :/