S5Late

S5Late Exploit tethered del bootrom/DFU per iPod. Attualmente supporta solo Nano 7G; per supportare Nano 6G è necessario aggiornare gli offset. Esecuzione Metti l'iPod in modalità DFU. Poi esegui: root@kitploit: ./S5Late hax 2024-12-15T23:11:34Z INFO S5Late We found an Apple Device in DFU mode...

katana

Katana Ein BootROM-Exploit für Qualcomm-Geräte, die zwischen 2016 und 2019 veröffentlicht wurden. Kurze Erklärung des Exploits Mit dem MSM8998 Nazgul-SoC wurde der Befehl 0x13 SAHARARESETSTATEMACHINEID hinzugefügt. Der Befehl ruft bootsaharaentry auf, das Sahara neu initialisieren soll. Der Fehle...

spd_flasher

Exploit irrobustito CVE-2022-38694 — Auto Flasher USB Host RP2350 中文版 README Tutorial Tutorial sul Reverse Engineering della Boot Chain UDX710 e sul Boot Hardened RP2350 Sfruttando la vulnerabilità CVE-2022-38694 del BootROM Unisoc tramite Raspberry Pi RP2350 USB Host per inviare automaticamente...

CVE-2022-38694_unlock_bootloader

CVE-2022-38694 Un attaccante con accesso fisico al dispositivo può sovrascrivere un puntatore a funzione in qualche parte della sezione dati del BootROM o un indirizzo di ritorno memorizzato nello stack ed eseguire il proprio codice con privilegi di BootROM. Per informazioni dettagliate, leggi...

CVE-2026-40003

CVE-2026-40003, também conhecido como Joselito, é uma vulnerabilidade de escrita arbitrária de memória encontrada no BootROM do SoC ZXIC/Sanechips ZX297520V3. !CAUTION Este PoC foi publicado apenas para fins de pesquisa. Você NÃO deve usar este exploit para fins maliciosos. NÃO use o exploit em...

UnisocBootROMs

Questo repository non contiene un README...

ipwndfu

Strumento open-source per il jailbreak di molti dispositivi iOS Leggidichiarazione di non responsabilità prima di usare questo software. checkm8 Exploit bootrom permanente e non correggibile per centinaia di milioni di dispositivi iOS Pensato per ricercatori, non è ancora un jailbreak con Cydia...

spd_dump-macos

spddump for macOS English | 简体中文 Porting macOS dello strumento di flashing BootROM/FDL UNISOC Spreadtrum. Basato su ilyakurdyukov/spreadtrumflash MIT, completa la funzionalità execaddr2 bypass del controllo firma CVE-2022-38694 della spddump closed-source e realizza l'intera catena su macOS arm64...

CVE-2024-13942

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

CVE-2024-13942

The RK3588s BootROM (secure) version 350B20210512V100 reads the next-stage loader header twice: a partial read (module hashes only) and a full read (with signature). Module authenticity is checked against the partial data, enabling a TOCTOU attack where an attacker swaps in a modified header on-t...

CVE-2024-13942 Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

EUVD-2024-55729

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...

mt6897-unlock-attempt

UnlockPOCOX6Pro — duchamp POCO X6 Pro 5G recovery research...

CVE-2026-40003

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

Exploit for CVE-2026-40003

CVE-2026-40003 aka Joselito is arbitrary memory write vulnerabil...

CVE-2026-40003

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

CVE-2026-40003

CVE-2026-40003 describes a USB-based arbitrary memory write vulnerability in the ZTE ZX297520V3 BootROM. The issue arises from lack of target address validation in the USB download mode, allowing writes to arbitrary locations in BootROM runtime memory. Potential consequences, as stated, include o...

CVE-2026-40003 USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

CVE-2026-40003 USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

ZTE ZX297520V3 BootROM contains a vulnerability that allows arbitrary memory writes via USB. Attackers can exploit the lack of target address validation in the USB download mode to write data to any location in BootROM runtime memory, thereby overwriting the stack, hijacking the execution flow,...

PT-2026-38322

Name of the Vulnerable Software and Affected Versions ZTE ZX297520V3 affected versions not specified Description The BootROM contains an issue allowing arbitrary memory writes via USB. Due to a lack of target address validation in the USB download mode, it is possible to write data to any locatio...