Basically there's a boot rom exploit on Tegra X1 chips, specifically the Nintendo Switch that allows you send payloads while it is in Recovery Mode and basically run unsigned code (homebrew, custom firmware, and even launch Linux distros). The payload launcher works on PC, Mac, and Linux, and has been ported to Android, however for it to work on Linux it requires a kernel patch for the EHCI (USB 2.0) driver. Devices that support xHCI (3.0) can execute it without any problems. On Android it is done using a USB-OTG adapter by the way and works without root access. I suspect that the only way to patch the kernel is with root access or a custom ROM/kernel with the patch. Here is one hacking team's (fail0verflow) patch without any instructions: https://github.com/fail0verflow/shofel2/blob/master/linux-ehci-enable-large-ctl-xfers.patch
Someone also wrote a Python script for Linux that patches the kernel memory here: https://gist.github.com/DavidBuchanan314/41b12362cc4d8c539dc441d75155f2e9
I tried to run it using Termux with the python package installed however it results with this error:
0x0 Traceback (most recent call last): File "ehci_patch.py", line 70, in <module> " " ".replace("PLACEHOLDER", hex(ksyms["ehci_urb_enqueue"])).replace("PLACE2" hex(ksyms["lookup_address"])) KeyError: 'lookup_address'
Tried to also run it with su first but it says sh: python: not found Anyway, I don't think that "hotpatch" script could even properly work on Android as it is meant for desktop Linux systems.
I would appreciate any leads or information on a way to patch the kernel either with root access or perhaps a way to get the python script working. I forked the Android app with hopes to improve it and translate it to different languages and I want to be able to provide a solution with instructions to get it to work on EHCI devices (if it's possible at all on Android). It would be amazing if it's possible with a Magisk module as well.