From c520596b670299f32a4de64fc6957b1744062f72 Mon Sep 17 00:00:00 2001 From: Slluxx Date: Tue, 9 May 2023 01:53:15 +0200 Subject: [PATCH] You aint taking this down --- Makefile | 4 ++-- README.md | 49 +++++++++++++++++++++++++++++++++++++++++-- source/frontend/gui.c | 2 +- source/gfx/tui.c | 2 +- source/keys/crypto.h | 2 +- source/keys/keys.c | 4 ++-- 6 files changed, 54 insertions(+), 9 deletions(-) diff --git a/Makefile b/Makefile index efb9df7..d9938f2 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,7 @@ include ./Versions.inc ################################################################################ -TARGET := Lockpick_RCM +TARGET := Picklock_RCM BUILDDIR := build OUTPUTDIR := output SOURCEDIR := source @@ -102,7 +102,7 @@ $(OUTPUTDIR)/$(TARGET).bin: $(BUILDDIR)/$(TARGET)/$(TARGET).elf $(TOOLS) $(BUILDDIR)/$(TARGET)/$(TARGET).elf: $(OBJS) @$(CC) $(LDFLAGS) -T $(SOURCEDIR)/link.ld $^ -o $@ - @echo "Lockpick_RCM was built with the following flags:\nCFLAGS: "$(CFLAGS)"\nLDFLAGS: "$(LDFLAGS) + @echo "Picklock_RCM was built with the following flags:\nCFLAGS: "$(CFLAGS)"\nLDFLAGS: "$(LDFLAGS) $(OBJS): | $(KEYGENDIR) diff --git a/README.md b/README.md index 170713b..56be624 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,47 @@ -# Picklock_RCM - +Picklock_RCM += +Picklock_RCM is a bare metal Nintendo Switch payload that derives encryption keys for use in Switch file handling software like hactool, hactoolnet/LibHac, ChoiDujour, etc. without booting Horizon OS. + +Due to changes imposed by firmware 7.0.0, Picklock homebrew can no longer derive the latest keys. In the boot-time environment however, there is no such limitation. + +Usage += +* It is highly recommended, but not required, to place Minerva on SD from the latest [Hekate](https://github.com/CTCaer/hekate/releases) for best performance, especially while dumping titlekeys - the file and path is `/bootloader/sys/libsys_minerva.bso` +* Launch Picklock_RCM.bin using your favorite payload injector or chainloader +* Upon completion, keys will be saved to `/switch/prod.keys` and titlekeys to `/switch/title.keys` on SD +* This release bundles the Falcon keygen from [Atmosphère-NX](https://github.com/Atmosphere-NX/Atmosphere) + +Mariko-Specific Keys += +Mariko consoles have several unique keys and protected keyslots. To get your SBK or the Mariko specific keys, you will need to use the `/switch/partialaes.keys` file along with a brute forcing tool such as . The contents of this file are the keyslot number followed by the result of that keyslot encrypting 16 null bytes. With the tool linked above, enter them in sequence for a given keyslot you want the contents of, for example: `PartialAesKeyCrack.exe ` with the `--numthreads=N` where N is the number of threads you can dedicate to the brute force. + +The keyslots are as follows, with names recognized by `hactool`: +* 0-11 - `mariko_aes_class_key_xx` (this is not used by the Switch but is set by the bootrom; hactoolnet recognizes it but it serves no purpose) +* 12 - `mariko_kek` (not unique - this is used for master key derivation) +* 13 - `mariko_bek` (not unique - this is used for BCT and package1 decryption) +* 14 - `secure_boot_key` (console unique - this isn't needed for further key derivation than what Picklock_RCM does but might be nice to have for your records) +* 15 - Secure storage key (console unique - this is not used on retail or dev consoles and not recognized by any tools) + +So if you want to brute force the `mariko_kek`, open your `partialaes.keys` and observe the numbers beneath keyslot 12. Here's an example with fake numbers: +``` +12 +11111111111111111111111111111111 22222222222222222222222222222222 33333333333333333333333333333333 44444444444444444444444444444444 +``` +Then take those numbers and open a command prompt window at the location of the exe linked above and type: +`PartialAesKeyCrack.exe 11111111111111111111111111111111 22222222222222222222222222222222 33333333333333333333333333333333 44444444444444444444444444444444` and if you're on a powerful enough multicore system, add ` --numthreads=[whatever number of threads]`, ideally not your system's maximum if it's, for example, an older laptop with a low-end dual core CPU. On a Ryzen 3900x with 24 threads this generates a lot of heat but finishes in about 45 seconds. + +These keys never change so a brute force need only be conducted once. + +This works due to the security engine immediately flushing writes to keyslots which can be written one 32-bit chunk at a time. See: + +Building += +Install [devkitARM](https://devkitpro.org/) and run `make`. + +Massive Thanks to CTCaer! += +This software is heavily based on [Hekate](https://github.com/CTCaer/hekate). Beyond that, CTCaer was exceptionally helpful in the development of this project, lending loads of advice, expertise, and humor. + +License += +This project is under the GPLv2 license. The Save processing module is adapted from [hactool](https://github.com/SciresM/hactool) code under ISC. \ No newline at end of file diff --git a/source/frontend/gui.c b/source/frontend/gui.c index da5525a..c0cedd4 100644 --- a/source/frontend/gui.c +++ b/source/frontend/gui.c @@ -82,7 +82,7 @@ int save_fb_to_bmp() f_mkdir("sd:/switch"); - char path[0x80] = "sd:/switch/lockpick_rcm.bmp"; + char path[0x80] = "sd:/switch/picklock_rcm.bmp"; // Save screenshot and log. int res = sd_save_to_file(bitmap, file_size, path); diff --git a/source/gfx/tui.c b/source/gfx/tui.c index ec6c08a..6bb0b65 100644 --- a/source/gfx/tui.c +++ b/source/gfx/tui.c @@ -100,7 +100,7 @@ void *tui_do_menu(menu_t *menu) { gfx_con_setcol(0xFFCCCCCC, 1, 0xFF1B1B1B); gfx_con_setpos(menu->x, menu->y); - gfx_printf("[%kLo%kck%kpi%kck%k_R%kCM%k v%d.%d.%d%k]\n\n", + gfx_printf("[%kPi%kck%klo%kck%k_R%kCM%k v%d.%d.%d%k]\n\n", colors[0], colors[1], colors[2], colors[3], colors[4], colors[5], 0xFFFF00FF, LP_VER_MJ, LP_VER_MN, LP_VER_BF, 0xFFCCCCCC); // Skip caption or seperator lines selection. diff --git a/source/keys/crypto.h b/source/keys/crypto.h index f2da17d..0f5d7fb 100644 --- a/source/keys/crypto.h +++ b/source/keys/crypto.h @@ -115,7 +115,7 @@ static const u8 secure_data_tweaks[1][0x10] __attribute__((aligned(4))) = { //!TODO: Update on keygen changes. #define TSEC_ROOT_KEY_VERSION 2 -// Lockpick_RCM keyslots +// Picklock_RCM keyslots #define KS_BIS_00_CRYPT 0 #define KS_BIS_00_TWEAK 1 #define KS_BIS_01_CRYPT 2 diff --git a/source/keys/keys.c b/source/keys/keys.c index 511aef5..37e0047 100644 --- a/source/keys/keys.c +++ b/source/keys/keys.c @@ -740,7 +740,7 @@ static void _derive_keys() { } end_time = get_tmr_us(); - gfx_printf("%kLockpick totally done in %d us\n", colors[(color_idx++) % 6], end_time - start_whole_operation_time); + gfx_printf("%Picklock totally done in %d us\n", colors[(color_idx++) % 6], end_time - start_whole_operation_time); if (h_cfg.t210b01) { // On Mariko, save only relevant key set @@ -839,7 +839,7 @@ void dump_keys() { if (btn == BTN_VOL_UP) { int res = save_fb_to_bmp(); if (!res) { - gfx_printf("%kScreenshot sd:/switch/lockpick_rcm.bmp saved.", colors[(color_idx++) % 6]); + gfx_printf("%kScreenshot sd:/switch/picklock_rcm.bmp saved.", colors[(color_idx++) % 6]); } else { EPRINTF("Screenshot failed."); }