2

Basically there's a boot rom exploit on Tegra X1 chips, specifically the Nintendo Switch that allows you send payloads while it is in Recovery Mode and basically run unsigned code (homebrew, custom firmware, and even launch Linux distros). The payload launcher works on PC, Mac, and Linux, and has been ported to Android, however for it to work on Linux it requires a kernel patch for the EHCI (USB 2.0) driver. Devices that support xHCI (3.0) can execute it without any problems. On Android it is done using a USB-OTG adapter by the way and works without root access. I suspect that the only way to patch the kernel is with root access or a custom ROM/kernel with the patch. Here is one hacking team's (fail0verflow) patch without any instructions: https://github.com/fail0verflow/shofel2/blob/master/linux-ehci-enable-large-ctl-xfers.patch

Someone also wrote a Python script for Linux that patches the kernel memory here: https://gist.github.com/DavidBuchanan314/41b12362cc4d8c539dc441d75155f2e9

I tried to run it using Termux with the python package installed however it results with this error:

0x0
Traceback (most recent call last):
File "ehci_patch.py", line 70, in <module>
" " ".replace("PLACEHOLDER", hex(ksyms["ehci_urb_enqueue"])).replace("PLACE2" hex(ksyms["lookup_address"]))
KeyError: 'lookup_address'

Tried to also run it with su first but it says sh: python: not found Anyway, I don't think that "hotpatch" script could even properly work on Android as it is meant for desktop Linux systems.

I would appreciate any leads or information on a way to patch the kernel either with root access or perhaps a way to get the python script working. I forked the Android app with hopes to improve it and translate it to different languages and I want to be able to provide a solution with instructions to get it to work on EHCI devices (if it's possible at all on Android). It would be amazing if it's possible with a Magisk module as well.

Improve this question
2
  • @iBug I got tsu installed and then tsu puts me into superuser mode (#) but after trying the python command (python ehci_patch.py) it says, bash: /data/data/com.termux/files/usr/bin/python: Permission denied
    – Nishikata
    Commented Aug 29, 2018 at 3:43
  • I really appreciate your question for perfect English language and formatting (that's why I upvoted this off-topic question), but unfortunately, we don't want development questions. You can probably get some better responses over at XDA Deverloper Forum.
    – iBug
    Commented Aug 29, 2018 at 8:02

1 Answer 1

Reset to default
0

That Python script appears to work by generating the source code for, then compiling a custom kernel module, then loading that module to do the actual patch. It expects, among other things, a working C compiler, make program, and kernel sources (at least headers) for the kernel you're running at /lib/modules/$(uname -r)/build.

So, no, that's not going to work on Android. Typically you have none of those things. With a cross-compile environment (on a PC) set up to build your phone's kernel, you could likely build that module, copy it over, then (as root on the Android device) load it. But building it directly on the phone would be quite an undertaking.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .