Mascali
/
Picklock_RCM
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for 8.1.0, new Sept, and master_key_08

This commit is contained in:
shchmue 2019-06-19 18:16:02 -04:00
parent 0b2442fb8e
commit 54d14196e0
6 changed files with 26 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
source/hos/pkg1.c
View File

@ -34,6 +34,7 @@ static const pkg1_id_t _pkg1_ids[] = {
{ "20181218175730", 7 }, //7.0.0 { "20181218175730", 7 }, //7.0.0
{ "20190208150037", 7 }, //7.0.1 { "20190208150037", 7 }, //7.0.1
{ "20190314172056", 7 }, //8.0.0 { "20190314172056", 7 }, //8.0.0
{ "20190531152432", 8 }, //8.1.0
{ NULL } //End. { NULL } //End.
}; };

10
source/hos/sept.c
View File

@ -59,14 +59,14 @@ extern boot_cfg_t b_cfg;
extern void sd_unmount(); extern void sd_unmount();
extern void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size); extern void reloc_patcher(u32 payload_dst, u32 payload_src, u32 payload_size);
int reboot_to_sept(const u8 *tsec_fw) int reboot_to_sept(const u8 *tsec_fw, const u32 tsec_size, const u32 kb)
{ {
FIL fp; FIL fp;
// Copy warmboot reboot code and TSEC fw. // Copy warmboot reboot code and TSEC fw.
memcpy((u8 *)(SEPT_PK1T_ADDR - WB_RST_SIZE), (u8 *)warmboot_reboot, sizeof(warmboot_reboot)); memcpy((u8 *)(SEPT_PK1T_ADDR - WB_RST_SIZE), (u8 *)warmboot_reboot, sizeof(warmboot_reboot));
memcpy((void *)SEPT_PK1T_ADDR, tsec_fw, 0x3000); memcpy((void *)SEPT_PK1T_ADDR, tsec_fw, tsec_size);
*(vu32 *)SEPT_TCSZ_ADDR = 0x3000; *(vu32 *)SEPT_TCSZ_ADDR = tsec_size;
// Copy sept-primary. // Copy sept-primary.
if (f_open(&fp, "sd:/sept/sept-primary.bin", FA_READ)) if (f_open(&fp, "sd:/sept/sept-primary.bin", FA_READ))
@ -80,7 +80,9 @@ int reboot_to_sept(const u8 *tsec_fw)
f_close(&fp); f_close(&fp);
// Copy sept-secondary. // Copy sept-secondary.
if (f_open(&fp, "sd:/sept/sept-secondary.enc", FA_READ)) if ((kb == 7) && f_open(&fp, "sd:/sept/sept-secondary.enc", FA_READ) && f_open(&fp, "sd:/sept/sept-secondary_00.enc", FA_READ))
goto error;
else if ((kb == 8) && f_open(&fp, "sd:/sept/sept-secondary_01.enc", FA_READ))
goto error; goto error;
if (f_read(&fp, (u8 *)SEPT_STG2_ADDR, f_size(&fp), NULL)) if (f_read(&fp, (u8 *)SEPT_STG2_ADDR, f_size(&fp), NULL))

2
source/hos/sept.h
View File

@ -19,6 +19,6 @@
#include "../utils/types.h" #include "../utils/types.h"
int reboot_to_sept(const u8 *tsec_fw); int reboot_to_sept(const u8 *tsec_fw, const u32 tsec_size, const u32 kb);
#endif #endif

6
source/keys/key_sources.inl
View File

@ -26,8 +26,9 @@ static const u8 keyblob_key_source[][0x10] = {
}; };
static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_600][0x10] = { static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_600][0x10] = {
{0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A}, {0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A}, //6.2.0
{0x9A, 0x3E, 0xA9, 0xAB, 0xFD, 0x56, 0x46, 0x1C, 0x9B, 0xF6, 0x48, 0x7F, 0x5C, 0xFA, 0x09, 0x5C} {0x9A, 0x3E, 0xA9, 0xAB, 0xFD, 0x56, 0x46, 0x1C, 0x9B, 0xF6, 0x48, 0x7F, 0x5C, 0xFA, 0x09, 0x5C}, //7.0.0
{0xDE, 0xDC, 0xE3, 0x39, 0x30, 0x88, 0x16, 0xF8, 0xAE, 0x97, 0xAD, 0xEC, 0x64, 0x2D, 0x41, 0x41}, //8.1.0
}; };
static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX+1][0x10] = static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX+1][0x10] =
@ -40,6 +41,7 @@ static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX+1][0x10] =
{0xEB, 0xF5, 0x6F, 0x83, 0x61, 0x9E, 0xF8, 0xFA, 0xE0, 0x87, 0xD7, 0xA1, 0x4E, 0x25, 0x36, 0xEE}, /* Master key 04 encrypted with Master key 05. */ {0xEB, 0xF5, 0x6F, 0x83, 0x61, 0x9E, 0xF8, 0xFA, 0xE0, 0x87, 0xD7, 0xA1, 0x4E, 0x25, 0x36, 0xEE}, /* Master key 04 encrypted with Master key 05. */
{0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57}, /* Master key 05 encrypted with Master key 06. */ {0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57}, /* Master key 05 encrypted with Master key 06. */
{0xA4, 0xD4, 0x52, 0x6F, 0xD1, 0xE4, 0x36, 0xAA, 0x9F, 0xCB, 0x61, 0x27, 0x1C, 0x67, 0x65, 0x1F}, /* Master key 06 encrypted with Master key 07. */ {0xA4, 0xD4, 0x52, 0x6F, 0xD1, 0xE4, 0x36, 0xAA, 0x9F, 0xCB, 0x61, 0x27, 0x1C, 0x67, 0x65, 0x1F}, /* Master key 06 encrypted with Master key 07. */
{0xEA, 0x60, 0xB3, 0xEA, 0xCE, 0x8F, 0x24, 0x46, 0x7D, 0x33, 0x9C, 0xD1, 0xBC, 0x24, 0x98, 0x29}, /* Master key 07 encrypted with Master key 08. */
}; };
//======================================Keys======================================// //======================================Keys======================================//

22
source/keys/keys.c
View File

@ -135,6 +135,10 @@ void dump_keys() {
goto out_wait; goto out_wait;
} }
tsec_key_data_t *key_data = (tsec_key_data_t *)(tsec_ctxt.fw + TSEC_KEY_DATA_ADDR);
tsec_ctxt.pkg1 = pkg1;
tsec_ctxt.size = 0x100 + key_data->blob0_size + key_data->blob1_size + key_data->blob2_size + key_data->blob3_size + key_data->blob4_size;
u32 MAX_KEY = 6; u32 MAX_KEY = 6;
if (pkg1_id->kb >= KB_FIRMWARE_VERSION_620) if (pkg1_id->kb >= KB_FIRMWARE_VERSION_620)
MAX_KEY = pkg1_id->kb + 1; MAX_KEY = pkg1_id->kb + 1;
@ -149,8 +153,8 @@ void dump_keys() {
// bundle lp0 fw for sept instead of loading it from SD as hekate does // bundle lp0 fw for sept instead of loading it from SD as hekate does
sdram_lp0_save_params(sdram_get_params_patched()); sdram_lp0_save_params(sdram_get_params_patched());
FIL fp; FIL fp;
if (f_stat("sd:/sept/sept-primary.bin", NULL) || f_stat("sd:/sept/sept-secondary.enc", NULL)) { if (f_stat("sd:/sept", NULL)) {
EPRINTF("On firmware 7.x or higher but no sept payload present\nSkipping new key derivation..."); EPRINTF("On firmware 7.x+ but Sept missing.\nSkipping new key derivation...");
goto get_tsec; goto get_tsec;
} }
// backup post-reboot payload // backup post-reboot payload
@ -164,7 +168,7 @@ void dump_keys() {
gfx_printf("%kFirmware 7.x or higher detected.\n%kRenamed /sept/payload.bin", colors[0], colors[1]); gfx_printf("%kFirmware 7.x or higher detected.\n%kRenamed /sept/payload.bin", colors[0], colors[1]);
gfx_printf("\n%k to /sept/payload.bak\n%kCopied self to /sept/payload.bin",colors[2], colors[3]); gfx_printf("\n%k to /sept/payload.bak\n%kCopied self to /sept/payload.bin",colors[2], colors[3]);
sdmmc_storage_end(&storage); sdmmc_storage_end(&storage);
if (!reboot_to_sept((u8 *)tsec_ctxt.fw)) if (!reboot_to_sept((u8 *)tsec_ctxt.fw, tsec_ctxt.size, pkg1_id->kb))
goto out_wait; goto out_wait;
} else { } else {
se_aes_key_read(12, master_key[pkg1_id->kb], 0x10); se_aes_key_read(12, master_key[pkg1_id->kb], 0x10);
@ -174,14 +178,6 @@ void dump_keys() {
get_tsec: ; get_tsec: ;
u8 tsec_keys[0x10 * 2] = {0}; u8 tsec_keys[0x10 * 2] = {0};
tsec_key_data_t *key_data = (tsec_key_data_t *)(tsec_ctxt.fw + TSEC_KEY_DATA_ADDR);
tsec_ctxt.pkg1 = pkg1;
tsec_ctxt.size = 0x100 + key_data->blob0_size + key_data->blob1_size + key_data->blob2_size + key_data->blob3_size + key_data->blob4_size;
if (pkg1_id->kb >= KB_FIRMWARE_VERSION_700) {
// Exit after TSEC key generation.
*((vu16 *)((u32)tsec_ctxt.fw + 0x2DB5)) = 0x02F8;
}
if (pkg1_id->kb == KB_FIRMWARE_VERSION_620) { if (pkg1_id->kb == KB_FIRMWARE_VERSION_620) {
u8 *tsec_paged = (u8 *)page_alloc(3); u8 *tsec_paged = (u8 *)page_alloc(3);
memcpy(tsec_paged, (void *)tsec_ctxt.fw, tsec_ctxt.size); memcpy(tsec_paged, (void *)tsec_ctxt.fw, tsec_ctxt.size);
@ -404,6 +400,7 @@ get_tsec: ;
alignment = 8; alignment = 8;
break; break;
case KB_FIRMWARE_VERSION_700: case KB_FIRMWARE_VERSION_700:
case KB_FIRMWARE_VERSION_810:
start_offset = 0x29c50; start_offset = 0x29c50;
hks_offset_from_end -= 0x6a73; hks_offset_from_end -= 0x6a73;
alignment = 8; alignment = 8;
@ -553,6 +550,7 @@ pkg2_done:
start_offset = 0x5674; start_offset = 0x5674;
break; break;
case KB_FIRMWARE_VERSION_700: case KB_FIRMWARE_VERSION_700:
case KB_FIRMWARE_VERSION_810:
start_offset = 0x5563; start_offset = 0x5563;
break; break;
} }
@ -603,6 +601,7 @@ pkg2_done:
start_offset = 0x1d5be; start_offset = 0x1d5be;
break; break;
case KB_FIRMWARE_VERSION_700: case KB_FIRMWARE_VERSION_700:
case KB_FIRMWARE_VERSION_810:
start_offset = 0x1d437; start_offset = 0x1d437;
break; break;
} }
@ -716,6 +715,7 @@ key_output: ;
SAVE_KEY_FAMILY("master_kek", master_kek, MAX_KEY, 0x10); SAVE_KEY_FAMILY("master_kek", master_kek, MAX_KEY, 0x10);
SAVE_KEY("master_kek_source_06", master_kek_sources[0], 0x10); SAVE_KEY("master_kek_source_06", master_kek_sources[0], 0x10);
SAVE_KEY("master_kek_source_07", master_kek_sources[1], 0x10); SAVE_KEY("master_kek_source_07", master_kek_sources[1], 0x10);
SAVE_KEY("master_kek_source_08", master_kek_sources[2], 0x10);
SAVE_KEY_FAMILY("master_key", master_key, MAX_KEY, 0x10); SAVE_KEY_FAMILY("master_key", master_key, MAX_KEY, 0x10);
SAVE_KEY("master_key_source", master_key_source, 0x10); SAVE_KEY("master_key_source", master_key_source, 0x10);
SAVE_KEY_FAMILY("package1_key", package1_key, 6, 0x10); SAVE_KEY_FAMILY("package1_key", package1_key, 6, 0x10);

3
source/utils/types.h
View File

@ -34,7 +34,8 @@
#define KB_FIRMWARE_VERSION_600 5 #define KB_FIRMWARE_VERSION_600 5
#define KB_FIRMWARE_VERSION_620 6 #define KB_FIRMWARE_VERSION_620 6
#define KB_FIRMWARE_VERSION_700 7 #define KB_FIRMWARE_VERSION_700 7
#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_700 #define KB_FIRMWARE_VERSION_810 8
#define KB_FIRMWARE_VERSION_MAX KB_FIRMWARE_VERSION_810
#define HOS_PKG11_MAGIC 0x31314B50 #define HOS_PKG11_MAGIC 0x31314B50