Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2018-6242 PoC — NVIDIA Tegra移动处理器BootROM Recovery Mode 缓冲区错误漏洞

Source
Associated Vulnerability
Title:NVIDIA Tegra移动处理器BootROM Recovery Mode 缓冲区错误漏洞 (CVE-2018-6242)
Description:Some NVIDIA Tegra mobile processors released prior to 2016 contain a buffer overflow vulnerability in BootROM Recovery Mode (RCM). An attacker with physical access to the device's USB and the ability to force the device to reboot into RCM could exploit the vulnerability to execute unverified code.
Description
My first Android app: Launch Fusée Gelée payloads from stock Android (CVE-2018-6242)
Readme
![logo](https://i.imgur.com/o335KYo.png "logo")

# NXLoader
My first Android app: Launch Fusée Gelée payloads from stock Android

Heavily based on [Fusée Gelée](https://github.com/reswitched/fusee-launcher/) and [ShofEL2](https://github.com/fail0verflow/shofel2). [fusee.bin](https://github.com/ktemkin/Atmosphere/tree/poc_nvidia/fusee) is bundled as a default payload

## Note: Any proprietary payloads are neither tested nor supported by this software.

## Does it work on your device? [Report here](https://github.com/DavidBuchanan314/NXLoader/issues/1)
## [Get the APK release](https://github.com/DavidBuchanan314/NXLoader/releases)

This app is currently in "Alpha" state, it's my first Android app and there
is some rather disgusting code (Potentially blocking tasks on the UI thread 🤢). This will be improved soon™.

## HOWTO:
- Launch the app.
- (Optional) go to the Config tab, and select a custom payload file.
- Plug in your Switch. (On my Nexus 5, I use a micro USB OTG cable, and an A-to-C cable)
- Put it into RCM mode. (Note: your switch will power on by itself when plugged in, be sure to hold VOL+).
- Grant permission to the app to access the USB device.
- Enjoy!

Note: The app does not need to be running in order to launch the payload. The phone can even be locked!

## FAQ:
- Why use this over a web-based launcher?: No internet required, and can auto-launch even if your phone is locked. Plug and play!
- Can it load Linux?: soon™
- Will it brick my phone/switch?: Hopefully not, but I an certainly not responsible if it does!
- Does it need root?: Nope!

## TODO:
- Refactor the code so it's less hacky
- Improve UI/UX
- Implement loader for fail0verflow's Linux

For anyone who wants to look at the exploit source, the magic happens [here](https://github.com/DavidBuchanan314/NXLoader/blob/master/app/src/main/java/io/github/davidbuchanan314/nxloader/PrimaryLoader.java).
File Snapshot

[4.0K] /data/pocs/aaaa16e2e6d1984d2673178c70b946cda91c84b4 ├── [4.0K] app │   ├── [ 969] build.gradle │   ├── [ 133] CMakeLists.txt │   └── [4.0K] src │   └── [4.0K] main │   ├── [1.6K] AndroidManifest.xml │   ├── [4.0K] assets │   │   ├── [ 37K] fusee.bin │   │   └── [ 92] intermezzo.bin │   ├── [4.0K] cpp │   │   └── [1.2K] native-lib.cpp │   ├── [4.0K] java │   │   └── [4.0K] io │   │   └── [4.0K] github │   │   └── [4.0K] davidbuchanan314 │   │   └── [4.0K] nxloader │   │   ├── [ 442] Constants.java │   │   ├── [1.1K] FragmentAbout.java │   │   ├── [ 709] FragmentConfig.java │   │   ├── [1.0K] FragmentLogs.java │   │   ├── [ 387] Logger.java │   │   ├── [5.6K] MainActivity.java │   │   ├── [5.7K] PrimaryLoader.java │   │   ├── [ 211] USBDevHandler.java │   │   ├── [1.4K] USBHandlerActivity.java │   │   └── [2.3K] Utils.java │   └── [4.0K] res │   ├── [4.0K] drawable │   │   ├── [ 964] ic_about_github.xml │   │   └── [ 861] ic_about_twitter.xml │   ├── [4.0K] layout │   │   ├── [1.1K] activity_main.xml │   │   ├── [4.1K] fragment_about.xml │   │   ├── [3.4K] fragment_config.xml │   │   └── [1.6K] fragment_logs.xml │   ├── [4.0K] mipmap-hdpi │   │   └── [5.6K] ic_launcher.png │   ├── [4.0K] mipmap-mdpi │   │   └── [3.0K] ic_launcher.png │   ├── [4.0K] mipmap-xhdpi │   │   └── [7.5K] ic_launcher.png │   ├── [4.0K] mipmap-xxhdpi │   │   └── [ 14K] ic_launcher.png │   ├── [4.0K] mipmap-xxxhdpi │   │   └── [ 22K] ic_launcher.png │   ├── [4.0K] values │   │   ├── [ 325] colors.xml │   │   ├── [1.8K] strings.xml │   │   └── [ 587] styles.xml │   ├── [4.0K] values-ru │   │   └── [1.9K] strings.xml │   ├── [4.0K] values-uk │   │   └── [1.9K] strings.xml │   └── [4.0K] xml │   └── [ 143] device_filter.xml ├── [ 537] build.gradle ├── [4.0K] gradle │   └── [4.0K] wrapper │   ├── [ 52K] gradle-wrapper.jar │   └── [ 233] gradle-wrapper.properties ├── [4.9K] gradlew ├── [2.3K] gradlew.bat ├── [1.0K] LICENSE ├── [1.9K] README.md └── [ 14] settings.gradle 24 directories, 41 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
    3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →