Released tools and scripts for Canon MF644

Exploit for Pwn2Own 2021 - Vulnerability in CADM (firmware 10.02)

This repository contains the following files related to the exploit:

• exploit.py : Python exploit working against firmware in version 10.02
• Makefile : Makefile used to assemble the ARM shellcode
• shellcode_ninja.S : ARM shellcode used to receive and a display a picture from a TCP socket
• memdump : Dump from the firmware needed to build the exploit payload

Note: The exploit is working only against firmware in version 10.02.

Exploit for Pwn2Own 2022 - Vulnerability in NetBIOS service (firmware 11.04)

• exploit.py : Python exploit working against firmware in version 11.04
• Makefile : Makefile used to assemble the ARM shellcode
• shellcode_ninja.S : ARM shellcode used to receive and a display a picture from a TCP socket

Note: The exploit is working only against firmware in version 11.04

MISC

• image_delivery.py : Python script implementing the TCP server that will send a picture on a socket

IDA Python script

The IDA Python loader script for handling Canon firmware format is ida/loaders-canon.py

The IDA Python script used to automatically rename functions is ida/rename-bip.py (logging function must first be renamed as logf)