Hacking Fusee Gelee with Raspberry Pi 3

[hippy dave]

https://nofile.io/f/7dqzDPJkFd9/rbp2-image-4.14.34-1-osmc.deb
https://nofile.io/f/hKgPQXYAZ8W/rbp2-kernel-4.14.34-1-osmc.deb
https://nofile.io/f/pN5Sm52x4Sg/rbp2-headers-4.14.34-1-osmc.deb

Thanks

 

[KsAmJ]

followed all the steps but the service is shown as it is running but not excuting the exploit when i connect the switch at RCM to the pi automatically . what i am missing ???
btw i have raspberry pi 3 model B

 

[GaM3r2Xtreme]

All this raspberry pi talk here is making me think, would connecting the pi through the dock USB port work?

If it were possible, imagine all you would have to do is power the pi from the dock. You would have a dedicated method to load up Fusee Gelee without needing a usb type C to type A cable.

 

[DarkMelman]

All this raspberry pi talk here is making me think, would connecting the pi through the dock USB port work?

If it were possible, imagine all you would have to do is power the pi from the dock. You would have a dedicated method to load up Fusee Gelee without needing a usb type C to type A cable.

Should not work because then, raspberry Pi is the „Device“. When you connect the switch to the raspberry pi, then switch is the „Device“.

Different between Host and OTG Mode I think

--------------------- MERGED ---------------------------

followed all the steps but the service is shown as it is running but not excuting the exploit when i connect the switch at RCM to the pi automatically . what i am missing ???
btw i have raspberry pi 3 model B

Type lsusb in Terminal and check idVendor and idProduct.

 

[Ronhero]

If anyone has an Android phone this is working great.

https://atlas44.s3-us-west-2.amazonaws.com/web-fusee-launcher/index.html

 

[KsAmJ]

Should not work because then, raspberry Pi is the „Device“. When you connect the switch to the raspberry pi, then switch is the „Device“.

Different between Host and OTG Mode I think

--------------------- MERGED ---------------------------



Type lsusb in Terminal and check idVendor and idProduct.

pi@raspberrypi:~ $ lsusb
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. SMSC9512/9514 Fast Ethernet Adapter
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp. SMC9514 Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

this is what i get "no switch connected when i executed this"

 

[DarkMelman]

Should not work because then, raspberry Pi is the „Device“. When you connect the switch to the raspberry pi, then switch is the „Device“.

Different between Host and OTG Mode I think

--------------------- MERGED ---------------------------


Type lsusb in Terminal and check idVendor and idProduct.

pi@raspberrypi:~ $ lsusb
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. SMSC9512/9514 Fast Ethernet Adapter
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp. SMC9514 Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

this is what i get "no switch connected when i executed this"

Yes.

And now, connect a switch, enter RCM and relaunch lsusb

 

[KsAmJ]

Yes.

And now, connect a switch, enter RCM and relaunch lsusb

lsusb
Bus 001 Device 004: ID 0955:7321 NVidia Corp.
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. SMSC9512/9514 Fast Ethernet Adapter
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp. SMC9514 Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

 

[DarkMelman]

lsusb
Bus 001 Device 004: ID 0955:7321 NVidia Corp.
Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. SMSC9512/9514 Fast Ethernet Adapter
Bus 001 Device 002: ID 0424:9514 Standard Microsystems Corp. SMC9514 Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

idVendor is 0955 and idProduct 7321...looks good...you can try to run fusee.sh manually now with ./fusee.sh under /home/pi

 

[KsAmJ]

idVendor is 0955 and idProduct 7321...looks good...you can try to run fusee.sh manually now with ./fusee.sh under /home/pi

it works manually
i want to make it work automatically when i connect to the pi in the mode
i thought your script is making a background service that it is fire the exploit when i connect without running any command manually.isn't it?
if so what is the order of execution to make it work in that manner

--------------------- MERGED ---------------------------

it works manually
i want to make it work automatically when i connect to the pi in the mode
i thought your script is making a background service that it is fire the exploit when i connect without running any command manually.isn't it?
if so what is the order of execution to make it work in that manner

idVendor is 0955 and idProduct 7321...looks good...you can try to run fusee.sh manually now with ./fusee.sh under /home/pi

sorry

i run the ./fusee.sh

result was

./fusee.sh
Invalid payload path specified!

 

[KsAmJ]

well i have opened the file ./fusee.sh with nano and changed the path of fusee.bin to the full path as it was showing "invalid payload path"
i made the file to be

#!/bin/bash
sleep 3
sudo python3 /home/pi/fusee-launcher/fusee-launcher.py /home/pi/fusee-launcher/fusee.bin

after running the command ./fusee.sh

got

pi@raspberrypi:~ $ ./fusee.sh
Could not find the intermezzo interposer. Did you build it?

 

[DarkMelman]

well i have opened the file ./fusee.sh with nano and changed the path of fusee.bin to the full path as it was showing "invalid payload path"
i made the file to be

#!/bin/bash
sleep 3
sudo python3 /home/pi/fusee-launcher/fusee-launcher.py /home/pi/fusee-launcher/fusee.bin

after running the command ./fusee.sh

got

pi@raspberrypi:~ $ ./fusee.sh
Could not find the intermezzo interposer. Did you build it?

i have updated the GitHub Repo.

There was the wrong path to the fusee-launcher.

Sorry.

Here the corrected fusee.sh:

#!/bin/bash
sleep 3
cd /home/pi/fusee-launcher
sudo python3 /home/pi/fusee-launcher/fusee-launcher.py fusee.bin

 

[Heidi_Hasenhoppel]

On PI3 working on the first run automated on plugging the Switch in RCM Mode at the PI3. Compiled Fusee-Gelee and created scripts in customs paths for myself from your examples. Done the Joy-Con-Mod with Pin 10 and 1. Thx so far @All. (Only wondering why false idVendor und false idProduct in 100-switch.rules working. Nevermind )

pi@pi3:/opt/switch $ cat /opt/switch/fusee_start.sh
#!/bin/bash
sleep 3
cd /opt/switch/fusee-launcher
python3 ./fusee-launcher.py fusee.bin

pi@pi3:/opt/switch $ cat /etc/udev/rules.d/100-switch.rules
####################################################################################
# change idVendor and idProduct
# lsusb gives for example ID 0424:ec00
# the string befoe the : is the idVendor and after the : idProduct
#
ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="0424", ATTR{idProduct}=="ec00"
, RUN+="/opt/switch/fusee_start.sh"
#####################################################################################

pi3:/var/www/html $ uname -a
Linux pi3 4.14.34-v7+ #1110 SMP Mon Apr 16 15:18:51 BST 2018 armv7l GNU/Linux

Log in messages:
Apr 29 10:04:23 pi3 kernel: [412098.968396] usb 1-1.5: new high-speed USB device number 8 using dwc_otg
Apr 29 10:04:23 pi3 kernel: [412099.099073] usb 1-1.5: New USB device found, idVendor=0955, idProduct=7321
Apr 29 10:04:23 pi3 kernel: [412099.099088] usb 1-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=0
Apr 29 10:04:23 pi3 kernel: [412099.099096] usb 1-1.5: Product: APX
Apr 29 10:04:23 pi3 kernel: [412099.099104] usb 1-1.5: Manufacturer: NVIDIA Corp.

 

[KsAmJ]

i have updated the GitHub Repo.

There was the wrong path to the fusee-launcher.

Sorry.

Here the corrected fusee.sh:

#!/bin/bash
sleep 3
cd /home/pi/fusee-launcher
sudo python3 /home/pi/fusee-launcher/fusee-launcher.py fusee.bin

Worked perfectly
Thanks alot

 

[Boogus]

Working perfectly on the RPi0W
with an automated script to run on boot!

 

[shmadul]

Working perfectly on the RPi0W
with an automated script to run on boot!

Mind sharing an img ?

 

[mulat]

Working perfectly on the RPi0W
with an automated script to run on boot!

Would it be nice to power raspberry zero directly from switch. Do you think is it possible?

Wysłane z mojego Redmi 4 Prime przy użyciu Tapatalka

 

[Joxley192]

Anyone with rpi0w that's got this working can u tell me how to use this fully please

 

[MaxiBus]

Would it be nice to power raspberry zero directly from switch. Do you think is it possible?

Wysłane z mojego Redmi 4 Prime przy użyciu Tapatalka

Since the PI0 can power up over the OTG port, it should be possible. Problem with the PI in general is, you have to wait for it to boot. I think, more specialized devices are much faster to boot into.

 

[Proto-Propski]

I'm getting an error whenever I lauch the modchip.sh I'll provide a log on what it says, IDK what happened, and ATM I'm way too tired to find out I hope one of you guys know anything about this cause I'm clueless, not a regular with my Raspberry Pi, but I wanted to try to make a portable way to boot into Hekate at the very least... won't even start the Fusee Gelee test payload though Oof.

Important note: on desktop Linux systems, we currently require an XHCI host controller.
A good way to ensure you're likely using an XHCI backend is to plug your
device into a blue 'USB 3' port.

Identified a Linux system; setting up the appropriate backend.
Traceback (most recent call last):
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 223, in get_interface_and_endpoint
KeyError: 129

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "./fusee-launcher.py", line 606, in <module>
    raise e
  File "./fusee-launcher.py", line 601, in <module>
    device_id = switch.read_device_id()
  File "./fusee-launcher.py", line 543, in read_device_id
    return self.read(16)
  File "./fusee-launcher.py", line 500, in read
    return self.backend.read(length)
  File "./fusee-launcher.py", line 118, in read
    return bytes(self.dev.read(0x81, length, 1000))
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 975, in read
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 102, in wrapper
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 215, in setup_request
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 102, in wrapper
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 225, in get_interface_and_endpoint
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 102, in wrapper
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 236, in get_active_configuration
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 102, in wrapper
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/core.py", line 120, in managed_open
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/backend/libusb1.py", line 786, in open_device
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/backend/libusb1.py", line 643, in __init__
  File "/usr/local/lib/python3.5/dist-packages/pyusb-1.0.2-py3.5.egg/usb/backend/libusb1.py", line 595, in _check
usb.core.USBError: [Errno 13] Access denied (insufficient permissions)