Buffer Overflow in Qualcomm Fastboot Command Processing

This repository is a small standalone C exploit with two files: a brief README and a single source file, main.c. The README explicitly states the exploit is archival and not directly reusable because memory addresses differ per device. The code is not a framework module; it is a purpose-built USB exploit targeting a specific Sony Xperia 5 Docomo SO-01M (noted as P42) in bootloader/fastboot mode. The exploit uses libusb to communicate directly with a USB device identified by vendor ID 0x0fce and product ID 0x0dde. It enumerates bulk IN/OUT endpoints, claims interface 0, and exchanges raw bulk data that resembles fastboot protocol traffic. Response handling looks for the strings "OKAY" and "FAIL", reinforcing that the target interface is a fastboot-like bootloader service. The core capability is not remote code execution over a network, but low-level bootloader/firmware memory manipulation over USB. The code contains numerous hardcoded firmware addresses and offsets for components such as ClockDxe, UfsDxe, RPMB listener structures, USB buffer memory, and LinuxLoader. From the visible code, the exploit builds crafted buffers, sends them with a fastboot command (notably "oem lock"), and uses helper primitives to read 8-byte values, write 4/8-byte values, and invoke function pointers at chosen addresses. This indicates the exploit achieves arbitrary read/write/call primitives inside the boot environment. The later stage patches fastboot command structures in memory: it writes entries containing the string pointer for "oem unlock", its length, and a function pointer to an unlock handler. It also modifies related command-line or command-table state and then restores execution. The intended result is that the bootloader exposes or redirects an OEM unlock command, allowing the device bootloader to be unlocked after reboot. The comments indicate the device may hang during the process, but the unlock persists on next boot. Repository structure is minimal: main.c is the only code file and likely the sole entry point. There is no evidence of a detection-only script, no network C2, and no generalized payload framework. Because the exploit includes concrete memory patching logic and a usable USB interaction path, it is best classified as an operational proof-of-concept for a specific device/firmware combination, with strong dependence on exact memory layout and physical access.

This repository contains a single C program (main.c) that interacts with a USB device (likely a BlackBerry Key2 in fastboot mode, VID=0x0fca, PID=0x8040) using the libusb library. The program can detect the firmware version of the connected device by sending the 'oem info' command and parsing the response. It can also patch the device's firmware by reading a firmware file ('575' or '160'), applying a series of binary modifications at specific offsets, and uploading the patched firmware to the device over USB bulk transfer. The exploit requires physical access to the device and is intended to be run on a host computer with the appropriate firmware files present. The code demonstrates a practical firmware patching attack, potentially exploiting weaknesses in the device's firmware update process. No network endpoints are present; all communication is via USB.