[G1 Android Development] hause:
Magic reboots when flooding the AT-Command Interpreter

Hi,

when I flood the AT-Command Interpreter on my (again) bricked 32A/B-mix-magic I get massive output and the magic reboots.

Serial output after powering on the magic:

| 0d 0a 62 6f 6f 74 20 72 65 61 73 6f 6e 3a 20 50 | ..boot reason: P |
| 4d 5f 55 53 42 5f 42 55 53 5f 56 41 4c 49 44 5f | M_USB_BUS_VALID_ |
| 52 54 5f 53 54 0d 0a 0d 0a 62 6f 6f 74 20 72 65 | RT_ST....boot re |
| 61 73 6f 6e 3a 20 50 4d 5f 57 44 4f 47 5f 54 4f | ason: PM_WDOG_TO |
| 55 54 5f 52 54 5f 53 54 0d 0a 0d 0a 28 50 6f 77 | UT_RT_ST....(Pow |
| 65 72 4f 6e 20 53 74 61 74 75 73 2c 42 6f 6f 74 | erOn Status,Boot |
| 20 52 65 61 73 6f 6e 29 3d 28 34 38 2c 36 29 0d | Reason)=(48,6). |
| 0a 4e 41 4e 44 5f 46 4c 41 53 48 5f 52 45 41 44 | .NAND_FLASH_READ |
| 5f 49 44 20 3a 20 48 59 4e 49 58 5f 35 31 32 4d | _ID : HYNIX_512M |
| 42 5f 46 4c 41 53 48 5f 31 32 38 4d 42 5f 53 44 | B_FLASH_128MB_SD |
| 52 41 4d 0d 0d 0a 0d 0a 41 52 4d 39 5f 42 4f 4f | RAM.....ARM9_BOO |
| 54 5f 4d 4f 44 45 30 2c 20 42 6f 6f 74 20 41 6e | T_MODE0, Boot An |
| 64 72 6f 69 64 0d 0a 5d a9 b5 7d b9 85 b9 91 7d | droid..]©µ}????} |
| c1 c9 bd 89 95 0d 85 b5 95 c9 85 35 ff 5b 4d 44 | ÁÉ???.?µ?É?5ÿ[MD |
| 44 49 5d 20 42 69 74 6d 61 70 5f 57 69 64 74 68 | DI] Bitmap_Width |
| 20 3d 20 34 38 30 0d 0a 5b 4d 44 44 49 5d 20 42 | = 480..[MDDI] B |
| 69 74 6d 61 70 5f 48 65 69 67 68 74 20 3d 20 36 | itmap_Height = 6 |
| 34 30 0d 0a 5b 4d 44 44 49 5d 20 52 47 42 5f 43 | 40..[MDDI] RGB_C |
| 61 70 61 62 69 6c 69 74 79 20 3d 20 30 78 38 38 | apability = 0x88 |
| 38 38 0d 0a 5b 4d 44 44 49 5d 20 4d 66 72 5f 4e | 88..[MDDI] Mfr_N |
| 61 6d 65 20 3d 20 30 78 44 32 36 33 0d 0a 5b 4d | ame = 0xD263..[M |
| 44 44 49 5d 20 50 72 6f 64 75 63 74 5f 43 6f 64 | DDI] Product_Cod |
| 65 20 3d 20 30 78 30 0d 0a 45 45 50 52 4f 4d 3a | e = 0x0..EEPROM: |
| 20 72 65 61 64 20 32 30 33 32 20 62 79 74 65 73 | read 2032 bytes |
| 0d 0a 42 6f 61 72 64 5f 50 49 44 20 3a 20 30 78 | ..Board_PID : 0x |
| 32 45 0d 0a 57 6c 61 6e 20 64 61 74 61 20 68 65 | 2E..Wlan data he |
| 61 64 65 72 20 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b | ader +++++++++++ |
| 2b 2b 2b 2b 2b 2b 2b 2b 2b 0a 53 69 67 6e 61 74 | +++++++++.Signat |
| 75 72 65 20 3a 20 30 78 45 45 31 32 35 31 0d 0a | ure : 0xEE1251.. |
| 55 70 64 61 74 65 53 74 61 74 75 73 20 3a 20 30 | UpdateStatus : 0 |
| 78 32 0d 0a 55 70 64 61 74 65 43 6f 75 6e 74 20 | x2..UpdateCount |
| 3a 20 30 78 33 0d 0a 42 6f 64 79 4c 65 6e 67 74 | : 0x3..BodyLengt |
| 68 20 3a 20 30 78 32 46 30 0d 0a 42 6f 64 79 43 | h : 0x2F0..BodyC |
| 52 43 20 3a 20 30 78 33 45 33 45 38 39 30 37 0d | RC : 0x3E3E8907. |
| 0a 61 44 69 65 49 64 28 30 29 20 3a 20 30 78 30 | .aDieId(0) : 0x0 |
| 0d 0a 61 44 69 65 49 64 28 31 29 20 3a 20 30 78 | ..aDieId(1) : 0x |
| 30 0d 0a 61 44 69 65 49 64 28 32 29 20 3a 20 30 | 0..aDieId(2) : 0 |
| 78 30 0d 0a 61 44 69 65 49 64 28 33 29 20 3a 20 | x0..aDieId(3) : |
| 30 78 30 0d 0a 63 6f 75 6e 74 72 79 49 44 20 3a | 0x0..countryID : |
| 20 30 78 33 30 0d 0a 57 6c 61 6e 20 64 61 74 61 | 0x30..Wlan data |
| 20 68 65 61 64 65 72 20 2d 2d 2d 2d 2d 2d 2d 2d | header -------- |
| 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d | ---------------- |
| 2d 2d 0a 41 52 4d 31 31 20 42 6f 6f 74 20 4d 6f | --.ARM11 Boot Mo |
| 64 65 3a 20 33 0d 0a 50 6c 61 74 66 6f 72 6d 3a | de: 3..Platform: |
| 20 48 42 4f 4f 54 2d 37 32 30 31 41 0d 0a 5b 45 | HBOOT-7201A..[E |
| 52 52 5d 20 70 61 72 74 69 74 69 6f 6e 5f 72 65 | RR] partition_re |
| 61 64 3a 3a 46 61 69 6c 65 64 20 74 6f 20 72 65 | ad::Failed to re |
| 61 64 20 70 61 67 65 20 31 39 30 37 32 20 6f 72 | ad page 19072 or |
| 20 69 74 20 69 73 20 65 6d 70 74 79 0d 0a 5b 45 | it is empty..[E |
| 52 52 5d 20 70 61 72 74 69 74 69 6f 6e 5f 72 65 | RR] partition_re |
| 61 64 3a 3a 46 61 69 6c 65 64 20 74 6f 20 72 65 | ad::Failed to re |
| 61 64 20 70 61 67 65 20 31 39 38 34 30 20 6f 72 | ad page 19840 or |
| 20 69 74 20 69 73 20 65 6d 70 74 79 0d 0a 5b 45 | it is empty..[E |
| 52 52 5d 20 62 6f 6f 74 20 69 6d 61 67 65 20 64 | RR] boot image d |
| 6f 65 73 20 6e 6f 74 20 65 78 69 73 74 21 21 21 | oes not exist!!! |
| 0d 0a 0d 0a 23 23 23 5b 20 46 61 73 74 62 6f 6f | ....###[ Fastboo |

Serial out after starting the AT-Command Interpreter ("./fastboot oem rtask b"):

| 74 20 4d 6f 64 65 20 5d 23 23 23 0d 0a 66 61 73 | t Mode ]###..fas |
| 74 62 6f 6f 74 5f 63 6f 6d 6d 61 6e 64 3a 5b 6f | tboot_command:[o |
| 65 6d 20 72 74 61 73 6b 20 62 5d 0d 0a 66 62 5f | em rtask b]..fb_ |
| 63 6d 64 5f 6f 65 6d 3a 72 74 61 73 6b 20 62 0d | cmd_oem:rtask b. |
| 0a 41 54 2d 43 6f 6d 6d 61 6e 64 20 49 6e 74 65 | .AT-Command Inte |

Then doing this:

public void writeStringReturn(String string)
{
try
{
outputStream.write(string.getBytes(), 0, string.length());
outputStream.write(0x0d);
}
catch (IOException e) { e.printStackTrace(); }
}

public void testSimlock()
{
for ( int i=0; i<2000 ;i++ )
{
writeStringReturn("AT@SIMLOCK?"+String.valueOf(i));
}
}

The magic's serial response (and it reboots):

| 72 70 72 65 74 65 72 20 72 65 61 64 79 0d 0a 34 | rpreter ready..4 |
| 0d 30 0d 34 0d 30 0d 34 0d 34 0d 34 0d 30 0d 34 | .0.4.0.4.4.4.0.4 |
| 0d 30 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 | .0.4.4.4.4.4.4.4 |
| 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 | .4.4.4.4.4.4.4.4 |
| 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 0d 34 | .4.4.4.4.4.4.4.4 |
| 0d 34 0d 34 0d 05 25 11 54 24 45 15 14 15 11 05 | .4.4..%.T$E..... |
| 41 54 40 51 49 45 44 41 41 49 01 11 15 51 14 2a | AT@QIEDAAI...Q.* |
| 54 54 51 01 45 25 15 11 05 05 25 50 54 52 51 50 | TTQ.E%....%PTRQP |
| 50 52 40 44 45 44 41 01 45 25 15 11 05 05 25 05 | PR@DEDA.E%....%. |
| 51 40 51 49 45 44 41 41 49 01 11 15 09 05 41 54 | Q@QIEDAAI.....AT |
| 40 54 52 51 50 50 52 40 14 14 24 14 45 15 45 44 | @TRQPPR@..$.E.ED |
| 41 41 49 01 11 12 12 05 41 54 40 51 49 45 24 14 | AAI.....AT@QIE$. |
| 45 15 41 49 01 11 12 14 05 41 54 40 51 49 45 44 | E.AI.....AT@QIED |
| 41 00 50 52 40 51 14 01 11 12 12 05 41 54 40 51 | A.PR@Q......AT@Q |

--- tons more ---

| 14 10 14 54 44 14 45 44 25 15 11 05 05 25 05 51 | ...TD.ED%....%.Q |
| 01 01 54 52 51 50 50 52 40 44 45 42 41 25 15 11 | ..TRQPPR@DEBA%.. |
| 05 05 25 05 51 01 01 54 52 51 50 50 52 40 44 45 | ..%.Q..TRQPPR@DE |
| 45 44 41 25 15 11 05 05 25 05 51 01 01 54 52 51 | EDA%....%.Q..TRQ |
| 50 50 52 40 44 45 45 44 41 e8 0d 0a 62 6f 6f 74 | PPR@DEEDAè..boot |
| 20 72 65 61 73 6f 6e 3a 20 50 4d 5f 55 53 42 5f | reason: PM_USB_ |
| 42 55 53 5f 56 41 4c 49 44 5f 52 54 5f 53 54 0d | BUS_VALID_RT_ST. |
| 0a 0d 0a 62 6f 6f 74 20 72 65 61 73 6f 6e 3a 20 | ...boot reason: |
| 50 4d 5f 57 44 4f 47 5f 54 4f 55 54 5f 52 54 5f | PM_WDOG_TOUT_RT_ |
| 53 54 0d 0a 0d 0a 28 50 6f 77 65 72 4f 6e 20 53 | ST....(PowerOn S |
| 74 61 74 75 73 2c 42 6f 6f 74 20 52 65 61 73 6f | tatus,Boot Reaso |
| 6e 29 3d 28 34 38 2c 36 29 0d 0a 4e 41 4e 44 5f | n)=(48,6)..NAND_ |
| 46 4c 41 53 48 5f 52 45 41 44 5f 49 44 20 3a 20 | FLASH_READ_ID : |
| 48 59 4e 49 58 5f 35 31 32 4d 42 5f 46 4c 41 53 | HYNIX_512MB_FLAS |
| 48 5f 31 32 38 4d 42 5f 53 44 52 41 4d 0d 0d 0a | H_128MB_SDRAM... |
| 0d 0a 41 52 4d 39 5f 42 4f 4f 54 5f 4d 4f 44 45 | ..ARM9_BOOT_MODE |
| 30 2c 20 42 6f 6f 74 20 41 6e 64 72 6f 69 64 0d | 0, Boot Android. |
| 0a 5d a9 b5 7d b9 85 b9 91 7d c1 c9 bd 89 95 0d | .]©µ}????}ÁÉ???. |
| 85 b5 95 c9 85 35 ff 5b 4d 44 44 49 5d 20 42 69 | ?µ?É?5ÿ[MDDI] Bi |
| 74 6d 61 70 5f 57 69 64 74 68 20 3d 20 34 38 30 | tmap_Width = 480 |
| 0d 0a 5b 4d 44 44 49 5d 20 42 69 74 6d 61 70 5f | ..[MDDI] Bitmap_ |
| 48 65 69 67 68 74 20 3d 20 36 34 30 0d 0a 5b 4d | Height = 640..[M |
| 44 44 49 5d 20 52 47 42 5f 43 61 70 61 62 69 6c | DDI] RGB_Capabil |
| 69 74 79 20 3d 20 30 78 38 38 38 38 0d 0a 5b 4d | ity = 0x8888..[M |
| 44 44 49 5d 20 4d 66 72 5f 4e 61 6d 65 20 3d 20 | DDI] Mfr_Name = |
| 30 78 44 32 36 33 0d 0a 5b 4d 44 44 49 5d 20 50 | 0xD263..[MDDI] P |
| 72 6f 64 75 63 74 5f 43 6f 64 65 20 3d 20 30 78 | roduct_Code = 0x |
| 30 0d 0a 45 45 50 52 4f 4d 3a 20 72 65 61 64 20 | 0..EEPROM: read |
| 32 30 33 32 20 62 79 74 65 73 0d 0a 42 6f 61 72 | 2032 bytes..Boar |
| 64 5f 50 49 44 20 3a 20 30 78 32 45 0d 0a 57 6c | d_PID : 0x2E..Wl |
| 61 6e 20 64 61 74 61 20 68 65 61 64 65 72 20 2b | an data header + |
| 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b 2b | ++++++++++++++++ |
| 2b 2b 2b 0a 53 69 67 6e 61 74 75 72 65 20 3a 20 | +++.Signature : |
| 30 78 45 45 31 32 35 31 0d 0a 55 70 64 61 74 65 | 0xEE1251..Update |
| 53 74 61 74 75 73 20 3a 20 30 78 32 0d 0a 55 70 | Status : 0x2..Up |
| 64 61 74 65 43 6f 75 6e 74 20 3a 20 30 78 33 0d | dateCount : 0x3. |
| 0a 42 6f 64 79 4c 65 6e 67 74 68 20 3a 20 30 78 | .BodyLength : 0x |
| 32 46 30 0d 0a 42 6f 64 79 43 52 43 20 3a 20 30 | 2F0..BodyCRC : 0 |
| 78 33 45 33 45 38 39 30 37 0d 0a 61 44 69 65 49 | x3E3E8907..aDieI |
| 64 28 30 29 20 3a 20 30 78 30 0d 0a 61 44 69 65 | d(0) : 0x0..aDie |
| 49 64 28 31 29 20 3a 20 30 78 30 0d 0a 61 44 69 | Id(1) : 0x0..aDi |
| 65 49 64 28 32 29 20 3a 20 30 78 30 0d 0a 61 44 | eId(2) : 0x0..aD |
| 69 65 49 64 28 33 29 20 3a 20 30 78 30 0d 0a 63 | ieId(3) : 0x0..c |
| 6f 75 6e 74 72 79 49 44 20 3a 20 30 78 33 30 0d | ountryID : 0x30. |
| 0a 57 6c 61 6e 20 64 61 74 61 20 68 65 61 64 65 | .Wlan data heade |
| 72 20 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d | r -------------- |
| 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 41 52 4d | ------------.ARM |
| 31 31 20 42 6f 6f 74 20 4d 6f 64 65 3a 20 33 0d | 11 Boot Mode: 3. |
| 0a 50 6c 61 74 66 6f 72 6d 3a 20 48 42 4f 4f 54 | .Platform: HBOOT |
| 2d 37 32 30 31 41 0d 0a 5b 45 52 52 5d 20 70 61 | -7201A..[ERR] pa |
| 72 74 69 74 69 6f 6e 5f 72 65 61 64 3a 3a 46 61 | rtition_read::Fa |
| 69 6c 65 64 20 74 6f 20 72 65 61 64 20 70 61 67 | iled to read pag |
| 65 20 31 39 30 37 32 20 6f 72 20 69 74 20 69 73 | e 19072 or it is |
| 20 65 6d 70 74 79 0d 0a 5b 45 52 52 5d 20 70 61 | empty..[ERR] pa |
| 72 74 69 74 69 6f 6e 5f 72 65 61 64 3a 3a 46 61 | rtition_read::Fa |
| 69 6c 65 64 20 74 6f 20 72 65 61 64 20 70 61 67 | iled to read pag |
| 65 20 31 39 38 34 30 20 6f 72 20 69 74 20 69 73 | e 19840 or it is |
| 20 65 6d 70 74 79 0d 0a 5b 45 52 52 5d 20 62 6f | empty..[ERR] bo |
| 6f 74 20 69 6d 61 67 65 20 64 6f 65 73 20 6e 6f | ot image does no |
| 74 20 65 78 69 73 74 21 21 21 0d 0a 0d 0a 23 23 | t exist!!!....## |
| 23 5b 20 46 61 73 74 62 6f 6f 74 20 4d 6f 64 65 | #[ Fastboot Mode |

Can anyone try something like this to confirm?

I never hacked a buffer-overflow but I want to give it a try.

Alphanumeric RISC ARM Shellcode:

http://www.phrack.org/issues.html?issue=66&id=12#article

Thanks!