Compare commits

...

2 Commits

Author SHA1 Message Date
Will Greenberg be2d70325d Merge pull request #52 from EFForg/update-docs
fix timeout bug in rooting script and update docs
2024-08-02 14:46:51 -07:00
Cooper Quintin 5c4bd161fa fix timeout bug in rooting script and update docs 2024-08-02 14:45:55 -07:00
5 changed files with 87 additions and 107 deletions
+3 -3
View File
@@ -36,7 +36,7 @@ linux/qualcom devices but this is the only one we have tested on. Buy the orbic
## Setup ## Setup
1. Install the Android Debug Bridge (ADB) on your computer (don't worry about instructions for installing it on a phone/device yet). You can find instructions for doing so on your platform [here](https://www.xda-developers.com/install-adb-windows-macos-linux/#how-to-set-up-adb-on-your-computer). 1. Install the Android Debug Bridge (ADB) on your computer (don't worry about instructions for installing it on a phone/device yet). You can find instructions for doing so on your platform [here](https://www.xda-developers.com/install-adb-windows-macos-linux/#how-to-set-up-adb-on-your-computer).
2. Download the latest [rayhunter release bundle](https://github.com/EFForg/rayhunter/releases) and unzip it. 2. Download the latest [rayhunter release bundle](https://github.com/EFForg/rayhunter/releases) and extract it (on Windows use 7zip).
3. Run the install script inside the bundle corresponding to your platform (`install-linux.sh`, `install-mac.sh`). 3. Run the install script inside the bundle corresponding to your platform (`install-linux.sh`, `install-mac.sh`).
4. Once finished, rayhunter should be running! You can verify this by visiting the web UI as described below. 4. Once finished, rayhunter should be running! You can verify this by visiting the web UI as described below.
@@ -61,9 +61,9 @@ rustup target add x86_64-unknown-linux-gnu
rustup target add armv7-unknown-linux-gnueabihf rustup target add armv7-unknown-linux-gnueabihf
``` ```
Now you can root your device and install rayhunter by running `./install.sh` - **Note:** You will have to install the cross compile tooling below before running this. Now you can root your device and install rayhunter by running `./tools/install-dev.sh`
### If you aren't on linux or can't run the install scripts ### If you are on windows or can't run the install scripts
* Root your device on windows using the instructions here: https://xdaforums.com/t/resetting-verizon-orbic-speed-rc400l-firmware-flash-kajeet.4334899/#post-87855183 * Root your device on windows using the instructions here: https://xdaforums.com/t/resetting-verizon-orbic-speed-rc400l-firmware-flash-kajeet.4334899/#post-87855183
* Build for arm using `cargo build` * Build for arm using `cargo build`
+2 -3
View File
@@ -1,5 +1,4 @@
#!/bin/env bash #!/bin/env bash
install() { install() {
if [[ -z "${SERIAL_PATH}" ]]; then if [[ -z "${SERIAL_PATH}" ]]; then
echo "SERIAL_PATH not set, did you run this from install-linux.sh or install-mac.sh?" echo "SERIAL_PATH not set, did you run this from install-linux.sh or install-mac.sh?"
@@ -21,8 +20,8 @@ check_adb() {
} }
force_debug_mode() { force_debug_mode() {
# Force a switch into the debug mode to enable ADB echo " Force a switch into the debug mode to enable ADB"
"$SERIAL_PATH" AT "$SERIAL_PATH" --root
echo -n "adb enabled, waiting for reboot" echo -n "adb enabled, waiting for reboot"
wait_for_adb_shell wait_for_adb_shell
echo "it's alive!" echo "it's alive!"
-34
View File
@@ -1,34 +0,0 @@
#!/bin/env bash
set -e
cargo build --bin serial
cargo build --bin rootshell --target armv7-unknown-linux-gnueabihf --release
# Force a switch into the debug mode to enable ADB
cargo run --bin serial -- AT
echo -n "adb enabled, waiting for reboot"
until adb shell true 2> /dev/null
do
echo -n .
sleep 1
done
echo
echo "it's alive!"
adb push target/armv7-unknown-linux-gnueabihf/release/rootshell /tmp/
cargo run --bin serial -- "AT+SYSCMD=mv /tmp/rootshell /bin/rootshell"
sleep 1
cargo run --bin serial -- "AT+SYSCMD=chown root /bin/rootshell"
sleep 1
cargo run --bin serial -- "AT+SYSCMD=chmod 4755 /bin/rootshell"
echo "we have root!"
adb shell /bin/rootshell -c id
adb shell '/bin/rootshell -c "mkdir /data/rayhunter"'
adb push config.toml.example /data/rayhunter/config.toml
adb push scripts/rayhunter_daemon /tmp/rayhunter_daemon
adb push scripts/misc-daemon /tmp/misc-daemon
adb shell '/bin/rootshell -c "mv /tmp/rayhunter_daemon /etc/init.d/rayhunter_daemon"'
adb shell '/bin/rootshell -c "mv /tmp/misc-daemon /etc/init.d/misc-daemon"'
adb shell '/bin/rootshell -c "chmod 755 /etc/init.d/rayhunter_daemon"'
adb shell '/bin/rootshell -c "chmod 755 /etc/init.d/misc-daemon"'
./make.sh
+64 -67
View File
@@ -1,13 +1,13 @@
//! Serial communication with the orbic device //! Serial communication with the orbic device
//! //!
//! This binary has two main functions, putting the orbic device in update mode which enables ADB //! This binary has two main functions, putting the orbic device in update mode which enables ADB
//! and running AT commands on the serial modem interface which can be used to upload a shell and chown it to root //! and running AT commands on the serial modem interface which can be used to upload a shell and chown it to root
//! //!
//! # Panics //! # Panics
//! //!
//! No device found - make sure your device is plugged in and turned on. If it is, it's possible you have a device with a different //! No device found - make sure your device is plugged in and turned on. If it is, it's possible you have a device with a different
//! usb id, file a bug with the output of `lsusb` attached. //! usb id, file a bug with the output of `lsusb` attached.
//! //!
//! # Examples //! # Examples
//! ``` //! ```
//! match rusb::Context::new() { //! match rusb::Context::new() {
@@ -23,9 +23,7 @@ use std::str;
use std::thread::sleep; use std::thread::sleep;
use std::time::Duration; use std::time::Duration;
use rusb::{ use rusb::{Context, DeviceHandle, UsbContext};
Context, DeviceHandle, UsbContext,
};
fn main() { fn main() {
let args: Vec<String> = std::env::args().collect(); let args: Vec<String> = std::env::args().collect();
@@ -36,22 +34,21 @@ fn main() {
} }
match Context::new() { match Context::new() {
Ok(mut context) => match open_orbic(&mut context) { Ok(mut context) => match open_orbic(&mut context) {
Some(mut handle) => { Some(mut handle) => {
send_command(&mut handle, &args[1]) if &args[1] != "--root" {
}, send_command(&mut handle, &args[1])
None => panic!("No Orbic device found"), }
}, }
Err(e) => panic!("Failed to initialize libusb: {0}", e), None => panic!("No Orbic device found"),
},
Err(e) => panic!("Failed to initialize libusb: {0}", e),
} }
} }
/// Sends an AT command to the usb device over the serial port /// Sends an AT command to the usb device over the serial port
/// ///
/// First establish a USB handle and context by calling `open_orbic(<T>) /// First establish a USB handle and context by calling `open_orbic(<T>)
fn send_command<T: UsbContext>( fn send_command<T: UsbContext>(handle: &mut DeviceHandle<T>, command: &str) {
handle: &mut DeviceHandle<T>,
command: &str,
) {
let mut data = String::new(); let mut data = String::new();
data.push_str("\r\n"); data.push_str("\r\n");
data.push_str(command); data.push_str(command);
@@ -61,95 +58,95 @@ fn send_command<T: UsbContext>(
let mut response = [0; 256]; let mut response = [0; 256];
// Set up the serial port appropriately // Set up the serial port appropriately
handle.write_control(0x21, 0x22, 3, 1, &[], timeout).expect("Failed to send control request"); handle
.write_control(0x21, 0x22, 3, 1, &[], timeout)
.expect("Failed to send control request");
// Send the command // Send the command
handle.write_bulk(0x2, data.as_bytes(), timeout).expect("Failed to write command"); handle
.write_bulk(0x2, data.as_bytes(), timeout)
.expect("Failed to write command");
// Consume the echoed command // Consume the echoed command
handle.read_bulk(0x82, &mut response, timeout).expect("Failed to read submitted command"); handle
.read_bulk(0x82, &mut response, timeout)
.expect("Failed to read submitted command");
// Read the actual response // Read the actual response
handle.read_bulk(0x82, &mut response, timeout).expect("Failed to read response"); handle
.read_bulk(0x82, &mut response, timeout)
.expect("Failed to read response");
let responsestr = str::from_utf8(&response).expect("Failed to parse response"); let responsestr = str::from_utf8(&response).expect("Failed to parse response");
if !responsestr.starts_with("\r\nOK\r\n") { if !responsestr.starts_with("\r\nOK\r\n") {
println!("Received unexpected response{0}", responsestr) println!("Received unexpected response{0}", responsestr)
} }
} }
/// Send a command to switch the device into generic mode, exposing serial /// Send a command to switch the device into generic mode, exposing serial
/// ///
/// If the device reboots while the command is still executing you may get a pipe error here, not sure what to do about this race condition. /// If the device reboots while the command is still executing you may get a pipe error here, not sure what to do about this race condition.
fn switch_device<T: UsbContext>( fn switch_device<T: UsbContext>(handle: &mut DeviceHandle<T>) {
handle: &mut DeviceHandle<T>,
) {
let timeout = Duration::from_secs(1); let timeout = Duration::from_secs(1);
if let Err(e) = handle.write_control(0x40, 0xa0, 0, 0, &[], timeout) { if let Err(e) = handle.write_control(0x40, 0xa0, 0, 0, &[], timeout) {
// If the device reboots while the command is still executing we // If the device reboots while the command is still executing we
// may get a pipe error here // may get a pipe error here
if e == rusb::Error::Pipe { if e == rusb::Error::Pipe {
return return;
} }
panic!("Failed to send device switch control request: {0}", e) panic!("Failed to send device switch control request: {0}", e)
} }
} }
/// Get a handle and contet for the orbic device /// Get a handle and contet for the orbic device
/// ///
/// If the device isn't already in command mode this function will call swtich_device to switch it into command mode /// If the device isn't already in command mode this function will call swtich_device to switch it into command mode
fn open_orbic<T: UsbContext>( fn open_orbic<T: UsbContext>(context: &mut T) -> Option<DeviceHandle<T>> {
context: &mut T,
) -> Option<DeviceHandle<T>> {
// Device after initial mode switch // Device after initial mode switch
if let Some(handle) = open_device(context, 0x05c6, 0xf601) { if let Some(handle) = open_device(context, 0x05c6, 0xf601) {
return Some(handle) return Some(handle);
} }
// Device with rndis enabled as well // Device with rndis enabled as well
if let Some(handle) = open_device(context, 0x05c6, 0xf622) { if let Some(handle) = open_device(context, 0x05c6, 0xf622) {
return Some(handle) return Some(handle);
} }
// Device in out-of-the-box state, need to switch to diag mode // Device in out-of-the-box state, need to switch to diag mode
match open_device(context, 0x05c6, 0xf626) { match open_device(context, 0x05c6, 0xf626) {
Some(mut handle) => switch_device(&mut handle), Some(mut handle) => switch_device(&mut handle),
None => panic!("No Orbic device detected") None => panic!("No Orbic device detected"),
} }
for _ in 1..10 { for _ in 1..10 {
if let Some(handle) = open_device(context, 0x05c6, 0xf601) { if let Some(handle) = open_device(context, 0x05c6, 0xf601) {
return Some(handle) return Some(handle);
} }
sleep(Duration::from_secs(10)) sleep(Duration::from_secs(10))
} }
panic!("No Orbic device detected") panic!("No Orbic device detected")
} }
/// Generic function to open a USB device /// Generic function to open a USB device
fn open_device<T: UsbContext>( fn open_device<T: UsbContext>(context: &mut T, vid: u16, pid: u16) -> Option<DeviceHandle<T>> {
context: &mut T,
vid: u16,
pid: u16,
) -> Option<DeviceHandle<T>> {
let devices = match context.devices() { let devices = match context.devices() {
Ok(d) => d, Ok(d) => d,
Err(_) => return None, Err(_) => return None,
}; };
for device in devices.iter() { for device in devices.iter() {
let device_desc = match device.device_descriptor() { let device_desc = match device.device_descriptor() {
Ok(d) => d, Ok(d) => d,
Err(_) => continue, Err(_) => continue,
}; };
if device_desc.vendor_id() == vid && device_desc.product_id() == pid { if device_desc.vendor_id() == vid && device_desc.product_id() == pid {
match device.open() { match device.open() {
Ok(handle) => return Some(handle), Ok(handle) => return Some(handle),
Err(e) => panic!("device found but failed to open: {}", e), Err(e) => panic!("device found but failed to open: {}", e),
} }
} }
} }
None None
+18
View File
@@ -0,0 +1,18 @@
#!/bin/env bash
set -e
mkdir build
cd build
curl -LOs "https://github.com/EFForg/rayhunter/releases/latest/download/release.tar"
curl -LOs "https://github.com/EFForg/rayhunter/releases/latest/download/release.tar.sha256"
if ! sha256sum -c --quiet release.tar.sha256; then
echo "Download corrupted! (╯°□°)╯︵ ┻━┻"
exit 1
fi
tar -xf release.tar
./install-linux.sh
cd ..
rm -rf build