houston

Exploit for Exynos devices to gain ACE in BootROM context.

Caution

The code for this exploit was previously stolen and used in an AI vibecoded tool made by Creeeeger. Be extremely careful when using his stuff, it might be broken and cause harm to your device.

How does this even work

A length parameter left unchecked in the USB Control Request code allows iRAM to be dumped, modified and resent to the device, allowing for code execution.

Known vulnerable SoCs

Caution

An SoC being vulnerable does not mean payloads and support are available for it.

• Exynos9810
• Exynos9820
• Exynos9830
• Exynos8825
• Exynos9925

There probably are many more.

Other available tools

There is another tool made by a great friend VDavid003, which supports the same platforms with the new exploit and also incorporates the old exploit to support Exynos8890/Exynos8895.

SoCs Supported by houston

Symbol	Meaning
✅	Working
❌	Not Working
❓	Should work, not tested

Retail Name	Internal Name	Tested Payloads	Tested by	State
Exynos990	S5E9830	exynos990-payloads All Branches	halal-beef	✅
Exynos850	S5E3830	N/A, Not tested in houston.	N/A	❓
Exynos9810	S5E9810	open-mini-bl1	Robotix22	✅
Exynos9610	S5E9610	N/A, Not tested in houston.	N/A	❓
Exynos7885	S5E7885	N/A, Not tested in houston.	N/A	❓
Exynos7870	S5E7870	N/A, Not tested in houston.	N/A	❓

Usage

usage: houston.py [-h] [-e] [-p PAYLOAD] [-d] [-o OUTPUT] [-c] files [files ...]

Exploit for Exynos devices to gain ACE in BootROM context.

positional arguments:
  files                 Files to send to the device post exploit (seperated by a space)

options:
  -h, --help            show this help message and exit
  -e, --exploit         Run the exploit before sending files
  -p, --payload PAYLOAD
                        Path to the payload to launch
  -d, --debug           Debug Mode (hexdumps device responses when console output is enabled and control transfer responses)
  -o, --output OUTPUT   Path to a folder where to save payload output to
  -c, --console-output  Show output to console

Environment preparation

Linux

• Run bash udev_rules.sh as root to setup udev rules
• You can now run the tool.

Windows

• Uninstall any existing BootROM Drivers
• Import the needed certificates by double clicking the ## Driver Certificate (INSTALL ME FIRST BEFORE THE DRIVER).reg file and importing the regkeys
• Install the ones provided by right clicking the inf and pressing install
• You can now run the tool.

Credits

Thanks to these teams and people we have houston!

• Chimera Tool First discovery of the exploit circa 2021-2022. They provide the most advanced Exynos servicing capabilities in the market to a broad amount of devices, and that is thanks to this specific exploit, and many more.
• CVE-2024-56426 This is the CVE houston is based off as we know.
• Christopher Wade Reported CVE-2024-56426 to Samsung
• kethily-daniel Gave me access to the tool for USB packet tracing to extract samples.
• BotchedRPR Helped with the initial research and creation of carte2.
• VDavid003 Helped me reverse engineer the PoC via the packet dumps and personally tested on his devices.
• halal-beef Initial USB packet dumps and analysis of the PoC during the research lifecycle.
• R0rt1z2 Huge help, even in payload creation, some stuff was based off his project, kaeru.
• AntiEngineer Huge help, gave knowledge and hints about ARM and is all around a great friend.
• AA Vulnerability inspiration, first use outside of Chimera. Someone I knew who conducted research on this exploit.