YuuLuo/a7c2-service-preload

选用指南

AI 根据 README 整理 · 2026/10/16 08:56:19

适用场景

适用于研究ILCE-7CM2固件2.01的USB服务认证、Jiritsu路径解析和预加载代码执行机制。

查看 README 依据

# ILCE-7CM2 Service Mode Preload Research [简体中文](README.zh-CN.md) This repository traces the path from the ILCE-7CM2's USB service session to one-shot root code execution, observed on firmware 2.01. It maps the authentication exchange, Jiritsu path resolution, dynamic loader behavior and execution evidence. ## Execution chain 1. The camera starts as USB Mass Storage (`054C:0E8A`). The host opens interface 0, starts Senser, and completes a three-round challenge–response exchange.

2. The camera re-enumerates as `054C:0336`. A fresh Senser exchange authenticates this service identity. [The protocol notes](PROTOCOL.md) give the control request, frame structure, digest inputs, replies, and two-mode sequence. 3. Jiritsu file commands select paths containing `/tmp/jiritsu/../..`. On the investigated firmware, path resolution reaches outside the Jiritsu directory. A shared object is placed in temporary Work storage; after the preload-path write, a service read of `/etc/ld.so.preload` returns that object's path.

已知限制

观察结果仅针对ILCE-7CM2固件2.01，其他版本需要自行验证。预加载执行不会永久禁用签名检查，安装修改固件还需更新接受路径。

查看 README 依据

The observed result is temporary code execution in the child process. It can be used to inspect internal state or access data allowed by that process. Firmware construction is a separate offline task. Installing a modified firmware image also needs an update acceptance path; preload execution does not permanently disable signature checks. The investigated update workflow restored its temporary gate afterward.

The observations here are specific to ILCE-7CM2 firmware 2.01. Other versions require their own checks of the USB session, Jiritsu path behavior, loader, and child privileges. [Sony-PMCA-RE's Senser source](https://github.com/ma1co/Sony-PMCA-RE/blob/master/pmca/usb/sony.py) is the public reference for the authentication framing. Documentation © 2026 YuuLuo · [CC BY-SA 4.0](LICENSE).