写在最前面，先知我YY下硬刷最好可能实现的功能：
1.把软件刷入flash，修改loader后，可以实现上电就自动运行程序；
2.硬刷后，程序自动起来，可以修改loader就行加密
3.硬刷后，有可能把osmocon cell 等软件整到windwos 省去虚拟机.操作方便...(这个是YY的，暂时还不知道....)
4.硬刷后，手机可以变成砖头.
5.刷机有风险，变砖头就损失20RMB，请慎重....哈哈！~
大家自己玩玩就好了，有啥问题就别找我麻烦了...哈哈哈~~
资料来源：
http://bb.osmocom.org/trac/wiki/flashing_new
1.flash layout & memory layout
The memory is mapped as follows: 0x000000-0x00ffff: Flash page 0 0x010000-0x01ffff: Flash page 1 ... more Flash pages ... 0x800000-0x83ffff: Ram Our flash layout is: 0x000000-0x001fff: Compal loader 0x002000-0x00ffff: OSMOCOM menu 0x010000-........: OSMOCOM application and storage
2.代码修改：
git branch * master 请用这个分支; $ cd src/target/firmware/ $ vim Makefile CFLAGS += -DCONFIG_FLASH_WRITE CFLAGS += -DCONFIG_FLASH_WRITE_LOADER CFLAGS += -DCONFIG_TX_ENABLE 编译代码 make clean make
3.下载一个loader程序到ram，为后面刷机程序提供一个平台.
cd src host/osmocon/osmocon -p /dev/ttyUSB0 -m c123xor target/firmware/board/compal_e88/loader.compalram.bin 按开机.
终端打印如下：
root@ubuntu:/home/ll/osmocombb/testing/osmocom-bb/src/host/osmocon# ./osmocon -p /dev/ttyUSB0 -m c123xor ../../target/firmware/board/compal_e88/loader.compalram.bin got 1 bytes from modem, data looks like: 2f / got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 3 bytes from modem, data looks like: 02 00 41 ..A got 1 bytes from modem, data looks like: 01 . got 1 bytes from modem, data looks like: 40 @ Received PROMPT1 from phone, responding with CMD read_file(../../target/firmware/board/compal_e88/loader.compalram.bin): file_size=32988, hdr_len=4, dnload_len=32995 got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 43 C Received PROMPT2 from phone, starting download handle_write(): 4096 bytes (4096/32995) handle_write(): 4096 bytes (8192/32995) handle_write(): 4096 bytes (12288/32995) handle_write(): 4096 bytes (16384/32995) handle_write(): 4096 bytes (20480/32995) handle_write(): 4096 bytes (24576/32995) handle_write(): 4096 bytes (28672/32995) handle_write(): 4096 bytes (32768/32995) handle_write(): 227 bytes (32995/32995) handle_write(): finished got 1 bytes from modem, data looks like: 1b . got 1 bytes from modem, data looks like: f6 . got 1 bytes from modem, data looks like: 02 . got 1 bytes from modem, data looks like: 00 . got 1 bytes from modem, data looks like: 41 A got 1 bytes from modem, data looks like: 03 . got 1 bytes from modem, data looks like: 42 B Received DOWNLOAD ACK from phone, your code is running now! Received DOWNLOAD ACK from phone, your code is running now! battery_compal_e88_init: starting up OsmocomBB Loader (revision osmocon_v0.0.0-1753-ge6372a2-modified) ====================================================================== Running on compal_e88 in environment compalram
4.保留原始的loader
$ cd src $ host/osmocon/osmoload memdump 0x000000 0x2000 compal_loader.bin 备份好这个 compal_loader.bin 文件.
5.为了避免把手机变成砖头先测试下是否可以读写flash.(请参照上面一步的办法把手机里面原始flash的数据备份一份，否则整坏以后，手机就不能复原了)
$ host/osmocon/osmoload funlock 0x010000 0x10000 $ host/osmocon/osmoload ferase 0x010000 0x10000 $ host/osmocon/osmoload fprogram 0 0x010000 compal_loader.bin $ host/osmocon/osmoload fprogram 0 0x012000 target/firmware/board/compal_e88/menu.e88loader.bin
测试如果没有问题，我们就可以刷入loader了.
$ host/osmocon/osmoload funlock 0x000000 0x10000 $ host/osmocon/osmoload ferase 0x000000 0x10000 $ host/osmocon/osmoload fprogram 0 0x000000 compal_loader.bin $ host/osmocon/osmoload fprogram 0 0x002000 target/firmware/board/compal_e88/menu.e88loader.bin
这里需要注意的
menu.e88loader.bin 这个是* jolly/menu branch才能有的.请自行下载编译.
funlock 每次开机后都需要做这个。
menu这个文件，就是类似一个菜单的东西.
6.把app程序刷入flash.
app刷入flash，需要利用第五步的menu程序.
menu程序识别app的方式：header + app
echo "highram:RSSI" >temp cat target/firmware/board/compal_e88/rssi.highram.bin >>temp
temp文件必须是偶数长度
$ ls -la temp -rw-r--r-- 1 root root 83761 Sep 27 10:08 temp $ echo >>temp $ ls -la temp -rw-r--r-- 1 root root 83762 Sep 27 10:08 temp
刷app到flash:
$ host/osmocon/osmoload funlock 0x010000 0x20000 $ host/osmocon/osmoload ferase 0x010000 0x20000 $ host/osmocon/osmoload fprogram 0 0x010000 temp
注意刷入数据flash的范围
0x010000到0x200000,单位为0x10000；
7.余下来的操作：
Power off your phone.
Disconnect the serial cable.
Turn it on (push power button), the OSMOCOM menu will appear and show available applications.
Use up/down keys or digits to select the application.
Press the green off-hook button, the application will be loaded to ram and is started.
Alternatively press the digit as shown in front of the application's name.
刷机后的效果图，刷机确实成功了..不是YY的..
![[CTF]pwnable.kr fd Wp](https://ucc.alicdn.com/pic/developer-ecology/08f602a648f647bcbf1987129d34653c.png?x-oss-process=image/resize,h_160,m_lfit)