Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2018-6242 PoC — NVIDIA Tegra移动处理器BootROM Recovery Mode 缓冲区错误漏洞

Source
Associated Vulnerability
Title:NVIDIA Tegra移动处理器BootROM Recovery Mode 缓冲区错误漏洞 (CVE-2018-6242)
Description:NVIDIA Tegra mobile processors是美国英伟达(NVIDIA)公司的一款中央处理器产品。BootROM Recovery Mode(RCM)是其中的一个能够对数据进行修改的工程模式组件。 NVIDIA Tegra移动处理器2016之前版本中的RCM存在缓冲区溢出漏洞。攻击者可利用该漏洞执行未验证的代码。
Description
My first Android app: Launch Fusée Gelée payloads from stock Android (CVE-2018-6242)
Readme
![logo](https://i.imgur.com/o335KYo.png "logo")

# NXLoader
My first Android app: Launch Fusée Gelée payloads from stock Android

Heavily based on [Fusée Gelée](https://github.com/reswitched/fusee-launcher/) and [ShofEL2](https://github.com/fail0verflow/shofel2). [fusee.bin](https://github.com/ktemkin/Atmosphere/tree/poc_nvidia/fusee) is bundled as a default payload

## Note: Any proprietary payloads are neither tested nor supported by this software.

## Does it work on your device? [Report here](https://github.com/DavidBuchanan314/NXLoader/issues/1)
## [Get the APK release](https://github.com/DavidBuchanan314/NXLoader/releases)

This app is currently in "Alpha" state, it's my first Android app and there
is some rather disgusting code (Potentially blocking tasks on the UI thread 🤢). This will be improved soon™.

## HOWTO:
- Launch the app.
- (Optional) go to the Config tab, and select a custom payload file.
- Plug in your Switch. (On my Nexus 5, I use a micro USB OTG cable, and an A-to-C cable)
- Put it into RCM mode. (Note: your switch will power on by itself when plugged in, be sure to hold VOL+).
- Grant permission to the app to access the USB device.
- Enjoy!

Note: The app does not need to be running in order to launch the payload. The phone can even be locked!

## FAQ:
- Why use this over a web-based launcher?: No internet required, and can auto-launch even if your phone is locked. Plug and play!
- Can it load Linux?: soon™
- Will it brick my phone/switch?: Hopefully not, but I an certainly not responsible if it does!
- Does it need root?: Nope!

## TODO:
- Refactor the code so it's less hacky
- Improve UI/UX
- Implement loader for fail0verflow's Linux

For anyone who wants to look at the exploit source, the magic happens [here](https://github.com/DavidBuchanan314/NXLoader/blob/master/app/src/main/java/io/github/davidbuchanan314/nxloader/PrimaryLoader.java).
File Snapshot

[4.0K] /data/pocs/aaaa16e2e6d1984d2673178c70b946cda91c84b4 ├── [4.0K] app │   ├── [ 969] build.gradle │   ├── [ 133] CMakeLists.txt │   └── [4.0K] src │   └── [4.0K] main │   ├── [1.6K] AndroidManifest.xml │   ├── [4.0K] assets │   │   ├── [ 37K] fusee.bin │   │   └── [ 92] intermezzo.bin │   ├── [4.0K] cpp │   │   └── [1.2K] native-lib.cpp │   ├── [4.0K] java │   │   └── [4.0K] io │   │   └── [4.0K] github │   │   └── [4.0K] davidbuchanan314 │   │   └── [4.0K] nxloader │   │   ├── [ 442] Constants.java │   │   ├── [1.1K] FragmentAbout.java │   │   ├── [ 709] FragmentConfig.java │   │   ├── [1.0K] FragmentLogs.java │   │   ├── [ 387] Logger.java │   │   ├── [5.6K] MainActivity.java │   │   ├── [5.7K] PrimaryLoader.java │   │   ├── [ 211] USBDevHandler.java │   │   ├── [1.4K] USBHandlerActivity.java │   │   └── [2.3K] Utils.java │   └── [4.0K] res │   ├── [4.0K] drawable │   │   ├── [ 964] ic_about_github.xml │   │   └── [ 861] ic_about_twitter.xml │   ├── [4.0K] layout │   │   ├── [1.1K] activity_main.xml │   │   ├── [4.1K] fragment_about.xml │   │   ├── [3.4K] fragment_config.xml │   │   └── [1.6K] fragment_logs.xml │   ├── [4.0K] mipmap-hdpi │   │   └── [5.6K] ic_launcher.png │   ├── [4.0K] mipmap-mdpi │   │   └── [3.0K] ic_launcher.png │   ├── [4.0K] mipmap-xhdpi │   │   └── [7.5K] ic_launcher.png │   ├── [4.0K] mipmap-xxhdpi │   │   └── [ 14K] ic_launcher.png │   ├── [4.0K] mipmap-xxxhdpi │   │   └── [ 22K] ic_launcher.png │   ├── [4.0K] values │   │   ├── [ 325] colors.xml │   │   ├── [1.8K] strings.xml │   │   └── [ 587] styles.xml │   ├── [4.0K] values-ru │   │   └── [1.9K] strings.xml │   ├── [4.0K] values-uk │   │   └── [1.9K] strings.xml │   └── [4.0K] xml │   └── [ 143] device_filter.xml ├── [ 537] build.gradle ├── [4.0K] gradle │   └── [4.0K] wrapper │   ├── [ 52K] gradle-wrapper.jar │   └── [ 233] gradle-wrapper.properties ├── [4.9K] gradlew ├── [2.3K] gradlew.bat ├── [1.0K] LICENSE ├── [1.9K] README.md └── [ 14] settings.gradle 24 directories, 41 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.