stooged / pi-pwn Goto Github PK

View Code? Open in Web Editor NEW

434.0 27.0 81.0 29.84 MB

pppwn

Shell 7.62% PHP 6.33% Python 86.05%

pi-pwn's Introduction

PI Pwn

This is a script to setup PPPwn and PPPwn_cpp on the raspberry pi.

GoldHen will run on firmware versions

9.00
9.60
10.00, 10.01
11.00

ps4-hen-vtx will run on firmware versions

7.00, 7.01, 7.02
7.50, 7.51, 7.55
8.00, 8.01, 8.03
8.50, 8.52
9.00
9.03, 9.04
9.50, 9.51, 9.60
10.00, 10.01
10.50, 10.70, 10.71
11.00

It also supports internet access after pwn and access to ftp, klog and binloader servers launched by goldhen.
A dns blocker is also installed and used to prevent updates.

The Raspberry Pi 4, Raspberry Pi 400 and Raspberry Pi 5 can pass through a usb drive inserted into the pi to the console if the pi is plugged into the console usb port

There is also a webserver to control the pi, change settings and send payloads by accessing http://pppwn.local from the console or your pc if you have internet access enabled.

Tested PI Models

These are models i have tested with but pi-pwn is not limited to these models.
Raspberry Pi 5
Raspberry Pi 4 Model B
Raspberry Pi 400
Raspberry Pi 3B+
Raspberry Pi 2 Model B
Raspberry Pi Zero 2 W with usb to ethernet adapter
Raspberry Pi Zero W with usb to ethernet adapter
ROCK PI 4C Plus with armbian Image
BIGTREETECH BTT Pi V1.2 with armbian minimal
pcDuino3b with armbian Image

Install

You need to install Raspberry Pi OS Lite or Armbian Cli / Minimal onto a sd card.

Place the sd card into the raspberry pi, boot it and connect it to the internet then run the following commands

sudo apt update
sudo apt install git -y
sudo rm -f -r PI-Pwn
sudo systemctl stop pipwn
git clone https://github.com/stooged/PI-Pwn
sudo mkdir /boot/firmware/
cd PI-Pwn
sudo cp -r PPPwn /boot/firmware/
cd /boot/firmware/PPPwn
sudo chmod 777 *
sudo bash install.sh

During the install process you will be asked to set some options.

If you are using a usb to ethernet adapter for the connection to the console you need to select yes
If your pi has an ethernet port and you are using a usb to ethernet adapter your interface for the usb adapter should be eth1
If you are using something like a pi zero 2 the interface will be eth0

Once the pi reboots pppwn will run automatically.

On your PS4:

Go to Settings and then Network
Select Set Up Internet connection and choose Use a LAN Cable
Choose Custom setup and choose PPPoE for IP Address Settings
Enter ppp for PPPoE User ID and PPPoE Password
NOTE if you enable internet access you must match the username and password entered during the install or use the default ppp
Choose Automatic for DNS Settings and MTU Settings
Choose Do Not Use for Proxy Server

For GoldHen you need to place the goldhen.bin file onto the root of a usb drive and plug it into the console.
Once goldhen has been loaded for the first time it will be copied to the consoles internal hdd and the usb is no longer required.
To update goldhen just repeat the above process and the new version will be copied to the internal hdd

Console FTP / Binload

If the pi pwn was setup to allow internet access you can use the ftp, klog, and binloader servers on the console
Your pi must be also connected to your home network via wifi or a second ethernet connection
To connect to the servers from your pc just connect to the raspberry pi ip on your network and all requests will be forwarded to the console

For ftp make sure you set the transfer mode on your ftp client software to Active not passive.

USB pass through drive

You can put a usb flash drive in the pi and that will be mounted to the console, you must put a folder on the root of the drive called "payloads"
To use this feature you must plug the raspberry pi 4 / 400 / 5 into the consoles usb port using the usb-c connection on the pi.
If you have power issues you can use a usb Y cable to inject power from another source but in my tests both pi variants ran using a single cable.

Rest Mode

You can enable the option to detect if goldhen is running in the options which will cause pi-pwn to check if goldhen is active before running pppwn, this is useful for rest mode
If you have the pi powered from the console usb port you must disable "Supply Power to USB Ports" in the rest mode settings of the console.
The console must also use the PPPoe user and pass set for the "console internet connection" of pi-pwn or the defaults if you never changed them which are ppp for both user and password.

PI FTP

If you install FTP to access the pppwn folder for the exploit files you must use your root login user/pass to access the server.
The ftp server uses the standard ports 21 and 20.

PI Samba

If you setup samba to access the pppwn folder for the exploit files you can access the drive on...
\\pppwn.local\pppwn
or
smb:\\pppwn.local\pppwn

The share has no user/password required to access it.

What it does

Once everything is setup and the ethernet cable is plugged in between the pi and the console the pi should automatically try and pwn the console.
The exploit may fail many times but the pi will continue to purge the console to keep trying to pwn itself.
Once pwned the process will stop and the pi will shut down if you are not using internet access.

The idea is you boot the console and the pi together and the pi will keep trying to pwn the console without any input from you, just wait on the home screen until the process completes

Updating

You can edit the exploit scripts by putting the sd card in your computer and going to the PPPwn folder.
The commands above can also be run again to install updates or change the settings.
You can also click the update button on the web ui.

Options

Interface - this is the lan interface on the pi that is connected to the console.

Firmware version - version of firmware running on the console.

Time to restart PPPwn if it hangs - a timeout in minutes to restart pppwn if the exploit hangs mid process.

Led activity - on selected pi models this will have the leds flash based on the exploit progress.

Use Python version - enabling this will force the use of the original python pppwn released by TheOfficialFloW

Use GoldHen if available for selected firmware - if this is not enabled or your firmware has no goldhen available vtx-hen will be used.

Use original source ipv6 - this will force pppwn to use the original ipv6 address that was used in pppwn as on some consoles it increases the speed of pwn.

Use usb ethernet adapter for console connection - only enable this if you are using a usb to ethernet adapter to connect to the console.

Detect if goldhen is running - this will make pi-pwn check if goldhen is loaded on the console and skip running pppwn if it is running.

Detect console shutdown and restart PPPwn - with this enabled if the link is lost between the pi and the console pppwn will be restarted.

Enable verbose PPPwn - enables debug output from pppwn so you can see the exploit progress.

Enable console internet access - enabling this will make pi-pwn setup a connection to the console allowing internet access after pppwn succeeds.

Disable DNS blocker - enabling this will turn off the dns blocker that blocks certain servers that are used for updates and telemetry.

Shutdown PI after PWN - if enabled this will make the pi shutdown after pppwn succeeds.

Enable usb drive to console - on selected pi models this will allow a usb drive in the pi to be passed through to the console.

Ports - this is a list of ports that are forwarded from the pi to the console, single ports or port ranges can be used.

Credits

All credit goes to TheOfficialFloW, xfangfang, SiSTR0, Vortex, EchoStretch and many other people who have made this project possible.

pi-pwn's People

Contributors

Stargazers

Watchers

pi-pwn's Issues

PPPwn worked but shell says failed and retries

the exploit ran fine and goldhen got injected successfully but the pi didnt shut down. Console says too many arguments in line 16 and wanted to retry the exploit

[ShowCase]Perfect on rpi2b+ with spi screen

[Feature] : Add another service which will monitor PS4 is turned off or not, and enable Jailbreaking, even if PI is running

My PS4 slim had very low power from its usb ports, so I had to keep the pi running from another power source. What I noticed, if PI has ppwned console once, it will not again try to jailbreak it, unless the PI service is restarted. So, created a small utility which will do this, and thereby separating out PS4 shutdown and PI shutdown.

Create a Shell Script:
Write a script that tails the journalctl logs and checks for the specified line. If the line is found, the script will restart the service.
```
#!/bin/bash

journalctl -fu pipwn | while read line
do
  echo $line | grep "/usr/sbin/pppoe -n -I eth0 -e" &> /dev/null
  if [ $? -eq 0 ]; then
    echo "Restarting pipwn service..."
    systemctl restart pipwn
  fi
done
```
- Save this script in a file, for example, /usr/local/bin/check_and_restart.sh.
- Make sure the script is executable: chmod +x /usr/local/bin/check_and_restart.sh.

Create a systemd Service:
Create a systemd service that runs this script.

Create a systemd service file at /etc/systemd/system/pipwn_monitor.service:

[Unit]
Description=Monitor journalctl for pipwn and restart if needed

[Service]
ExecStart=/usr/local/bin/check_and_restart.sh
Restart=always
User=root

[Install]
WantedBy=multi-user.target

Enable and start the service:

systemctl enable pipwn_monitor.service
systemctl start pipwn_monitor.service

Monitoring and logs:
You can monitor the logs of your script using:
```
journalctl -fu pipwn_monitor.service
```

USB Drive Installs to wrong home

The usb drive installation script assumes that the home folder is "/home/pi" but that is only the case if the default user is called pi. If you setup a different username and password when creating the OS image (which is a smart thing to do for security reasons) the home directory will be called something else.

remove systemctl start pipwn

Thank you for your work. I see you took my suggestion to clone the repo on the pi.
I have another suggestion. You can remove sudo systemctl start pipwn from install.sh as the pi restarts right after. (systemctl enable is necessary )

Feature Request: Kernel panic routine

Please implement a Kernel panic restart routine that boots the consoles if it occurs. And starts the jailbreak again. After the connection is up again. Think is the most needed feature for people with that problem and would automate the 1000 reboots that are needed for a working jailbreak.

Error with P3 B+

hibernate

After you send the console to sleep, Raspberry wakes up and works

Not an issue, update on ssh

If you add the new Web server, your ssh name is changed, mine changed from pppwnpi.local to pppwn.loca.
So if you can't connect via shh, try ssh pppwn.local.

I thought I had messed something up during update, so hopefully helps others.

Also, is it possible for the PS4 to have internet via the Pi? I see others have, but my PS4 thinks its offline.

Remote Package Sender

Hello,
I use remote package sender/remote package installer to install pkg.
https://github.com/flatz/ps4_remote_pkg_installer
However it isn't currently working with the pass through from my Pi to the PS4.
I can access the internet on the PS4 but can't send packages to it.
Is this something you might consider fixing, please?

Thank you,

Latest Version gives system error - PS4 Phat

Just updated from previous release, I now get "An error has occurred in the system software - (CE-36329-3)" every time.

Sadly can't go back to previous version as I deleted the files from my computer, but this never happened on previous PPPwn.

Thanks.

PPPwn launches but stuck on ready for console connection

Working in Orange PI Zero 3

Hello, today I tested it on my Orange PI Zero 3 with Armbian, it worked perfectly!

Tip: if your intention is not to leave your Raspberry Pi or Orange Pi dedicated for this, just disable pipwn in systemctl. I just created an alias to run with "pppwn" command in terminal or cli minimal linux.

Now I have my orange pi running around my processes and I can access it with ssh and run "pppwn".

Thanks!

Add HDMI-CEC to trigger script/check status of PS4

https://gist.github.com/rmtsrc/dc35cd1458cd995631a4f041ab11ff74

How it works is raspberry pi hdmi plugged to any port of the TV, even a cheapo $10 hdmi switch will work too.

You can send commands using CEC,
Example:

When PS4 CEC "power status:" changes from standby to ON
Run script
When PS4 CEC "power status:" changes from ON to standby
Stop script

This will solve, #48 as well

In addition to that, you can turn on PS4 remotely from cold boot (not rest mode).
Playstation Portal users want this feature so bad as they are forced to use rest mode to power on their PS5s, chiaki for us I guess.

Kernel Panic

This is extremely helpful if you're using a smart plug to replug PS4 from Kernel Panic since you can add a webhook command to echo cec command to turn on PS4 after smart plug is on (no need to use controller) or (press power button on ps4). An automation using Tasmota "Rules" or home assistant automation.

New Board request

If you have time to create a file for a Raspberry Pi Pico W with a Wiznet Ethernet Adapter https://thepihut.com/products/wiznet-ethernet-hat-for-pico I am more than happy to test as my Ethernet adapter arrives in next couple days.

Thanks

9.00 support?

Would be cool to see.

PS4 pro model 7116B failing

My PS4 Pro

updated to fw 11.00 from 10.5 on this i made a factory reset

i have tried this.

output from pi 3B is
waiting for connection
system 11.00
connected to eth0

then nothing happens for hrs

i have also tried the windows tool nothing happens

100% CPU usage for pppwn64

Is this normal when waiting for console connection and during the jailbreak process?
Using C++ method.

Raspberry Pi 3 Model B V1.02

Tested it on a Raspberry Pi 3 Model B V1.02 on the first model of PS4 with firmware 9.00 with the CPP version and works like a charm, 1/10 it had to try 2 times, so it's safe to say it works on this model too!
Good Job guys!

Crash of PS4 slim with fw 11.0 using a Raspberry Pi 3B+

I have a PS4 slim with fw 11.0 and for pppwn via Raspberry I used a Raspberry Pi 3B+ and an ethernet cable without any adapter. During the installation procedure there is no problem, but when the console is about to be jailbroken the PS4 turns off, any ideas or solutions?

[FEEDBACK] Working on BananaPi M2 Berry with Armbian

Testing and working perfectly with BananaPi M2 Berry and Armbian.
Ethernet adapter is called end0, other than that it's working great OOB.

Great job :)

Raspberry Pi 2w enc28j60

Hi,

i have a rpi zero 2w and connected with enc28j60, turned on the spi and inserted dtoverlay=enc28j60 in config.txt.. the interface shows as eth0 and the internet works fine (tested by disabling the wifi).

TLDR; the ps4 says Lan not connected and the test internet fails eventhough the setup works fine.

Edit: Tried the below command directly but doesnt work. the command just quits

sudo /boot/firmware/PPPwn/pppwn64 --interface eth0 --fw 1100 --stage1 stage1_11.00.bin --stage2 stage2_11.00.bin --auto-retry

Unreliable; no real-time output

So far I have had little success with the script.
Often nothing seems to happen.
Even with a display connected to the Pi, I can't tell whether anything is happening or not.
Sometimes "failed retrying..." appears but most of the time, as I said, nothing happens.
I am using a Raspberry Pi4.

Feature Request

Back again sorry.

I much prefer the Pi-Pwn over Exfat Hax, but I miss having a landing page for Payloads.
Possible to have a Payloads Section in the Web server? My thinking was, download source, inside that is a folder named Payloads, when installing, the Payloads are added from the folder, accessing Web server via PS4 or Computer we can send Payloads.

From using an ESP32-S2 with a landing page, I feel the Raspberry Pi method has so much new potential.

Thanks again.

6.72 support

Can you add support for 6.72

Avoid the USB?

Hi,
Since the PI has and SD card, i think we use the GoldHen directly on that memory without use the USB. Maybe you can add a parameter with the path of GoldHen, USB or SD card.
Thanks

No signal from PS4 Pro on 9.00 - Rpi3 b+

Formatted and remake with latest release.

Logging status on webview

Hello there,

It'd be great to have a status logger on the webview, currently if there's something wrong on the config we have no way of knowing

USB ethernet network bridge possible?

eth0 = Pi RJ45 to PS4
eth1 = (USB) RJ45 to router for internet access

br0 = bridge between eth0 & eth1 with dhcp from router

So the main purpose is to get internet access or local access without replugging after goldhen payload is successful.
Will this config work?

pppwn7 run with nothing

please check it for 32 bits devices

Need help with understanding the code

Hello, I'm trying to adapt your run.sh script for Alpine Linux. And I can't understand what coproc read -t 15 && wait "$!" || true does? What the purpose of it?

Since Alpine doesn't have Bash, I need either to remove it or make some workaround.

Stuck on "waiting for connection"

My PS4 Pro is on FW 11.00

I use a Raspberry Pi B Rev. 1.2

output from Pi is:

waiting for connection
system 11.00
connected to eth0

then nothing happens anymore

There is compatibility with TV Box mxq pro 4k - rk3228a with armbian for rk322x confirmed by me.

https://drive.google.com/file/d/1jQQ9uLjPpFN3-Il2Do7yAOvfjVHOcGr8/view?usp=sharing
https://drive.google.com/file/d/1gi0p3Vh63H1MKMWXncUrw4U6dqyvuJ4J/view?usp=sharing

pppwn64 binary not working on Raspberry Pi 3b

pppwn64 does nothing on Raspberry Pi 3b. When launched directly form console it gives no output.

Raspberry Pi Zero 2 W with Ethernet

Can this work with this model too ?

https://fr.aliexpress.com/item/1005005919648945.html?spm=a2g0o.productlist.main.45.40d961858o2K4l&algo_pvid=72d9f2f3-6819-439d-891b-6d4969dc4d40&algo_exp_id=72d9f2f3-6819-439d-891b-6d4969dc4d40-22&pdp_npi=4%40dis%21EUR%2111.62%2111.04%21%21%2112.23%2111.62%21%402101e9ec17153966364588903e2bbe%2112000034854939009%21sea%21FR%21908207159%21&curPageLogUid=iY8TIEGU4Z2P&utparam-url=scene%3Asearch%7Cquery_from%3A

Add this script to run what you want

#!/bin/bash

echo -e "arg = '"$1"'"
case $1 in
	""|"pipwn") 
		echo "Run PiPwn"
        # run your actual run.sh rename it to what you want (source [ pathToYourScript])
        ;;
	"install")
		echo "Run Install"
                # run install.sh
		;;
	"update")
		echo "Run Update"
        # run maybe update.sh
		;;
	*)
		echo "Error"
        ;;
	esac
exit 0

ex: './run.sh install' run install.sh

C++ version confirmed working on raspberry Pi 2 model B

See title.....fast response (ca 30-45sec between each attempt) from Pi2 model B. 4th attempt successfull
You can add it to you're Readme ;-)
Many Thanks!!!

GoldHen - ftp server

I have followed your installation guide and my internet is working. Under View Connection status following IP will be shown like in your video at 03:10 minutes. It is possible to change the bridge function to local network? I want to access the PS4 from my computer via GH ftp server ;-)

raspberry pi freezes after 2 tries

hello I am currently using a raspberry pi 4 model b 4gb but I have a little problem the raspberry after trying to inject twice in a row automatically it does not reset then it remains blocked and you have to turn it off manually and the restart and its always after 2 or 3 times of tries. I tried to change the SD card and change the ethernet cable but the problem still persists

I don't know if I'm in the right place to report problems, I'm new to this platform but I absolutely want to contribute and help the progress of this project, it's just fantastic, so if I'm not placed, you can tell me . thank you

Error creating USB in latest build.

Last step of the install script followed by immediate error. - There is a 128GB microSD in the Pi4 B.
Do you want the pi to act as a flash drive to the console

(Y|N)?: y
dd: error writing '/boot/firmware/PPPwn/pwndev': No space left on device
48364+0 records in
48363+0 records out
198094848 bytes (198 MB, 189 MiB) copied, 0.868351 s, 228 MB/s
mkfs.fat 4.2 (2021-01-31)
dtoverlay=dwc2
mkdir: cannot create directory ‘/media/pwndev’: File exists
mount: (hint) your fstab has been modified, but systemd still uses
the old version; use 'systemctl daemon-reload' to reload.
cp: cannot stat '/root/PI-Pwn/USB Drive/goldhen.bin': No such file or directory
The pi will mount as a drive and goldhen.bin has been placed in the drive
You must plug the pi into the console usb port using the usb-c of the pi
#!/bin/bash
INTERFACE="eth0"
FIRMWAREVERSION="9.00"
SHUTDOWN=false
USBETHERNET=false
USECPP=true
PPPOECONN=true
VMUSB=true
rm: cannot remove '/usr/lib/systemd/system/bluetooth.target': No such file or directory
rm: cannot remove '/usr/lib/systemd/system/network-online.target': No such file or directory
[Service]
WorkingDirectory=/boot/firmware/PPPwn
ExecStart=/boot/firmware/PPPwn/run.sh
Restart=never
User=root
Group=root
Environment=NODE_ENV=production
[Install]
WantedBy=multi-user.target
Install complete, Rebooting

Broadcast message from root@PPPwn on pts/3 (Tue 2024-05-14 14:21:04 BST):

The system will reboot now!

Broadcast message from root@PPPwn on pts/3 (Tue 2024-05-14 14:21:04 BST):

The system will reboot now!

Of note my user account isn't root, which is possibly why it's not finding the USB Drive folder?

dnsmasq.service failed but the internet works fine

First of all, I didn't use a Raspberry Pi but an Armbian Bookworm installed on the HG680P TV Box.
This script runs well and smoothly.
It's just that when installing there was an error as follows:

Job for dnsmasq.service failed because the control process exited with error code.
See "systemctl status dnsmasq.service" and "journalctl -xeu dnsmasq.service" for details.
invoke-rc.d: initscript dnsmasq, action "start" failed.
× dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server
     Loaded: loaded (/lib/systemd/system/dnsmasq.service; enabled; preset: enabled)
     Active: failed (Result: exit-code) since Sat 2024-05-11 16:43:38 WIT; 41ms ago
    Process: 2712 ExecStartPre=/etc/init.d/dnsmasq checkconfig (code=exited, status=0/SUCCESS)
    Process: 2721 ExecStart=/etc/init.d/dnsmasq systemd-exec (code=exited, status=2)
        CPU: 111ms

May 11 16:43:38 armbian systemd[1]: Starting dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server...
May 11 16:43:38 armbian dnsmasq[2721]: dnsmasq: failed to create listening socket for port 53: Address already in use
May 11 16:43:38 armbian dnsmasq[2721]: failed to create listening socket for port 53: Address already in use
May 11 16:43:38 armbian dnsmasq[2721]: FAILED to start up
May 11 16:43:38 armbian systemd[1]: dnsmasq.service: Control process exited, code=exited, status=2/INVALIDARGUMENT
May 11 16:43:38 armbian systemd[1]: dnsmasq.service: Failed with result 'exit-code'.
May 11 16:43:38 armbian systemd[1]: Failed to start dnsmasq.service - dnsmasq - A lightweight DHCP and caching DNS server.

But the installation process runs to completion.
Then reboot.
After rebooting, I ran the systemctl status dnsmasq.service command and there was an error:

armbian resolvconf[1333]: Failed to set DNS configuration: Unit dbus-org.freedesktop.network1.service not found.
armbian dnsmasq[1316]: failed to access /run/dnsmasq/resolv.conf: No such file or directory.

Otherwise, the pwned process runs and is successful, as well as the internet connection working.

Just wanted you to know.
Oh and btw, your goldhen.bin is not the latest release from SiSTR0 here:
https://github.com/GoldHEN/GoldHEN/tree/beta

Connect PC to ps4 through FTP after pppoe connection

would this be possible?
currently, I have my PC and Pi hooked up to a network switch, the pi has its main eth and an adapter to the switch
would it be possible to connect to the PS4's FTP server without needing another adapter?

Use Pi as USB flash drive

According to the latest documentation:
"The Raspberry Pi 4 and Raspberry Pi 5 can act as a virtual flash drive to the console if the pi is plugged into the console usb port removing the need for a flash drive to load payloads."
However when I've selected that I wish to use it as a flash drive to load payloads the hack doesn't find the payload.
Where do I have to copy the bin file to so that it will use it, please?

Orange Pi Zero 2W

Hello. When trying to compile on an Orange Pi Zero 2W it gives me a syntax error:
gcc -c -o start.o start.S
start.S: Mensajes del ensamblador:
start.S:8: Error: pseudo-operador desconocido: «.intel_syntax»
start.S:16: Error: mnemónico inválido call' -- call stage1'
start.S:19: Error: operando 1 debe ser an integer register -- mov rsp,rbx' start.S:20: Error: operando 1 debe ser an integer or stack pointer register -- sub rsp,(0x88+0x38)'
start.S:23: Error: operando 1 debe ser an integer or stack pointer register -- add rsp,8' start.S:24: Error: mnemónico inválido pop' -- pop rbx' start.S:25: Error: mnemónico inválido pop' -- pop r12' start.S:26: Error: mnemónico inválido pop' -- pop r13' start.S:27: Error: mnemónico inválido pop' -- pop r14' start.S:28: Error: mnemónico inválido pop' -- pop r15' start.S:29: Error: mnemónico inválido pop' -- `pop rbp'

What would I have to modify to be able to compile?
Thank you so much

Not an issue, Request

I was wondering if it was possible when updating, it detects the config file and asks if we would like to use current config, pressing Y loads previous settings such as PS4 firmware, Ethernet port etc, Pressing N starts the usual config process.

Thanks.

It stays at the Ready for console connection

It stays there without proceeding, even going to the check network on ps4 it dosent do anything.
Running this:
sudo python3 /boot/firmware/PPPwn/pppwn.py --interface=$INTERFACE --fw=$FIRMWAREVERSION --stage1=/boot/firmware/PPPwn/pppwn.bin --stage2=/boot/firmware/PPPwn/stage2_$FIRMWAREVERSION.bin

it shows this error:
usage: pppwn.py [-h] --interface INTERFACE [--fw {900,1100,9.00,11.00}] [--stage1 STAGE1] [--stage2 STAGE2] pppwn.py: error: argument --fw: invalid choice: '' (choose from '900', '1100', '9.00', '11.00')
I am using a Raspberry Pi 3 b+
Do you have any idea why its doing this?

Support for 9.0.0 fw

This is great!
I was looking for this kind of solution!
What should i change in the repo for it to work on 9.0.0 firmware?

Maxes out PI3B+ CPU

I have noticed that with the C++ version while it is fast between retries it will eventually max out the CPU of the PI causing the script to hang for a very long time (5+ minutes). This wasn't the case with the old python script.

Adding support for 10.71 firmware

Thank you for the tool! Is there an easy way to support 10.71? If so, I'd like to contribute!

Waiting for link obstructive when trying to run terminal commands

The "link detection" block of code addition to run.sh causes the "waiting for link" message to repetitively print on screen and become obstructive while trying to utilize the terminal to run install.sh or any other tasks with the console off and Ethernet cable plugged in or even unplugged. Perhaps if there was a way to have it print the one time and wait indefinitely without printing again when other input/output is being performed, or halt when the user interrupts the process to log into and use the terminal. Not a huge issue, more of an annoyance/inconvenience or bug that can make changing parameters using install.sh after initial setup a bit of a pain especially if one is not familiar with the questions being asked along with the acceptable responses or access to a computer to modify config.sh.