From c7d90ec8caf22a901c2b9bb816f6c2e346aa42a6 Mon Sep 17 00:00:00 2001 From: shchmue Date: Wed, 2 Nov 2022 18:36:39 -0700 Subject: [PATCH] Further improve readability --- bdk/sec/se.c | 70 -------------- bdk/sec/se.h | 1 - bdk/utils/util.c | 14 --- bdk/utils/util.h | 3 - source/keys/crypto.c | 83 +++++++++++++++- source/keys/crypto.h | 7 +- source/keys/keys.c | 222 +++++++++++++++++++++---------------------- source/keys/keys.h | 2 +- 8 files changed, 195 insertions(+), 207 deletions(-) diff --git a/bdk/sec/se.c b/bdk/sec/se.c index 02f6f90..5c2a391 100644 --- a/bdk/sec/se.c +++ b/bdk/sec/se.c @@ -718,76 +718,6 @@ out:; return res; } -// _mgf1_xor() and rsa_oaep_decode were derived from Atmosphère -static void _mgf1_xor(void *masked, u32 masked_size, const void *seed, u32 seed_size) -{ - u8 cur_hash[0x20] __attribute__((aligned(4))); - u8 hash_buf[0xe4] __attribute__((aligned(4))); - - u32 hash_buf_size = seed_size + 4; - memcpy(hash_buf, seed, seed_size); - u32 round_num = 0; - - u8 *p_out = (u8 *)masked; - - while (masked_size) { - u32 cur_size = MIN(masked_size, 0x20); - - for (u32 i = 0; i < 4; i++) - hash_buf[seed_size + 3 - i] = (round_num >> (8 * i)) & 0xff; - round_num++; - - se_calc_sha256_oneshot(cur_hash, hash_buf, hash_buf_size); - - for (unsigned int i = 0; i < cur_size; i++) { - *p_out ^= cur_hash[i]; - p_out++; - } - - masked_size -= cur_size; - } -} - -u32 se_rsa_oaep_decode(void *dst, u32 dst_size, const void *label_digest, u32 label_digest_size, u8 *buf, u32 buf_size) -{ - if (dst_size <= 0 || buf_size < 0x43 || label_digest_size != 0x20) - return 0; - - bool is_valid = buf[0] == 0; - - u32 db_len = buf_size - 0x21; - u8 *seed = buf + 1; - u8 *db = seed + 0x20; - _mgf1_xor(seed, 0x20, db, db_len); - _mgf1_xor(db, db_len, seed, 0x20); - - is_valid &= memcmp(label_digest, db, 0x20) ? 0 : 1; - - db += 0x20; - db_len -= 0x20; - - int msg_ofs = 0; - int looking_for_one = 1; - int invalid_db_padding = 0; - int is_zero; - int is_one; - for (int i = 0; i < db_len; ) - { - is_zero = (db[i] == 0); - is_one = (db[i] == 1); - msg_ofs += (looking_for_one & is_one) * (++i); - looking_for_one &= ~is_one; - invalid_db_padding |= (looking_for_one & ~is_zero); - } - - is_valid &= (invalid_db_padding == 0); - - const u32 msg_size = MIN(dst_size, is_valid * (db_len - msg_ofs)); - memcpy(dst, db + msg_ofs, msg_size); - - return msg_size; -} - void se_get_aes_keys(u8 *buf, u8 *keys, u32 keysize) { u8 *aligned_buf = (u8 *)ALIGN((u32)buf, 0x40); diff --git a/bdk/sec/se.h b/bdk/sec/se.h index 2a2f8cd..1bb435d 100644 --- a/bdk/sec/se.h +++ b/bdk/sec/se.h @@ -49,6 +49,5 @@ int se_calc_sha256(void *hash, u32 *msg_left, const void *src, u32 src_size, u64 int se_calc_sha256_oneshot(void *hash, const void *src, u32 src_size); int se_calc_sha256_finalize(void *hash, u32 *msg_left); int se_calc_hmac_sha256(void *dst, const void *src, u32 src_size, const void *key, u32 key_size); -u32 se_rsa_oaep_decode(void *dst, u32 dst_size, const void *label_digest, u32 label_digest_size, u8 *buf, u32 buf_size); #endif diff --git a/bdk/utils/util.c b/bdk/utils/util.c index e05c2bc..bf30929 100644 --- a/bdk/utils/util.c +++ b/bdk/utils/util.c @@ -230,17 +230,3 @@ void power_set_state_ex(void *param) power_state_t *state = (power_state_t *)param; power_set_state(*state); } - -u32 read_le_u32(const void *buffer, u32 offset) { - return (*(u8*)(buffer + offset + 0) ) | - (*(u8*)(buffer + offset + 1) << 0x08) | - (*(u8*)(buffer + offset + 2) << 0x10) | - (*(u8*)(buffer + offset + 3) << 0x18); -} - -u32 read_be_u32(const void *buffer, u32 offset) { - return (*(u8*)(buffer + offset + 3) ) | - (*(u8*)(buffer + offset + 2) << 0x08) | - (*(u8*)(buffer + offset + 1) << 0x10) | - (*(u8*)(buffer + offset + 0) << 0x18); -} diff --git a/bdk/utils/util.h b/bdk/utils/util.h index df929bc..d27d52d 100644 --- a/bdk/utils/util.h +++ b/bdk/utils/util.h @@ -96,7 +96,4 @@ void panic(u32 val); void power_set_state(power_state_t state); void power_set_state_ex(void *param); -u32 read_le_u32(const void *buffer, u32 offset); -u32 read_be_u32(const void *buffer, u32 offset); - #endif diff --git a/source/keys/crypto.c b/source/keys/crypto.c index cd5afd0..42e10bb 100644 --- a/source/keys/crypto.c +++ b/source/keys/crypto.c @@ -1,5 +1,6 @@ /* * Copyright (c) 2022 shchmue + * Copyright (c) 2018 Atmosphère-NX * * This program is free software; you can redistribute it and/or modify it * under the terms and conditions of the GNU General Public License, @@ -27,6 +28,15 @@ extern hekate_config h_cfg; +bool check_keyslot_access() { + u8 test_data[SE_KEY_128_SIZE] = {0}; + const u8 test_ciphertext[SE_KEY_128_SIZE] = {0}; + se_aes_key_set(KS_AES_ECB, "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", SE_KEY_128_SIZE); + se_aes_crypt_block_ecb(KS_AES_ECB, DECRYPT, test_data, test_ciphertext); + + return memcmp(test_data, "\x7b\x1d\x29\xa1\x6c\xf8\xcc\xab\x84\xf0\xb8\xa5\x98\xe4\x2f\xa6", SE_KEY_128_SIZE) == 0; +} + bool test_rsa_keypair(const void *public_exponent, const void *private_exponent, const void *modulus) { u32 plaintext[SE_RSA2048_DIGEST_SIZE / 4] = {0}, ciphertext[SE_RSA2048_DIGEST_SIZE / 4] = {0}, @@ -46,13 +56,82 @@ bool test_rsa_keypair(const void *public_exponent, const void *private_exponent, bool test_eticket_rsa_keypair(const rsa_keypair_t *keypair) { // Unlike the SSL RSA key, we don't need to check the gmac - we can just verify the public exponent // and test the keypair since we have the modulus - if ((read_be_u32(keypair->public_exponent, 0) != RSA_PUBLIC_EXPONENT) || - (!test_rsa_keypair(keypair->public_exponent, keypair->private_exponent, keypair->modulus))) { + if ((byte_swap_32(keypair->public_exponent) != RSA_PUBLIC_EXPONENT) || + (!test_rsa_keypair(&keypair->public_exponent, keypair->private_exponent, keypair->modulus)) + ) { return false; } return true; } +// _mgf1_xor() and rsa_oaep_decode were derived from Atmosphère +static void _mgf1_xor(void *masked, u32 masked_size, const void *seed, u32 seed_size) +{ + u8 cur_hash[0x20] __attribute__((aligned(4))); + u8 hash_buf[0xe4] __attribute__((aligned(4))); + + u32 hash_buf_size = seed_size + 4; + memcpy(hash_buf, seed, seed_size); + u32 round_num = 0; + + u8 *p_out = (u8 *)masked; + + while (masked_size) { + u32 cur_size = MIN(masked_size, 0x20); + + for (u32 i = 0; i < 4; i++) + hash_buf[seed_size + 3 - i] = (round_num >> (8 * i)) & 0xff; + round_num++; + + se_calc_sha256_oneshot(cur_hash, hash_buf, hash_buf_size); + + for (unsigned int i = 0; i < cur_size; i++) { + *p_out ^= cur_hash[i]; + p_out++; + } + + masked_size -= cur_size; + } +} + +u32 rsa_oaep_decode(void *dst, u32 dst_size, const void *label_digest, u32 label_digest_size, u8 *buf, u32 buf_size) { + if (dst_size <= 0 || buf_size < 0x43 || label_digest_size != 0x20) + return 0; + + bool is_valid = buf[0] == 0; + + u32 db_len = buf_size - 0x21; + u8 *seed = buf + 1; + u8 *db = seed + 0x20; + _mgf1_xor(seed, 0x20, db, db_len); + _mgf1_xor(db, db_len, seed, 0x20); + + is_valid &= memcmp(label_digest, db, 0x20) ? 0 : 1; + + db += 0x20; + db_len -= 0x20; + + int msg_ofs = 0; + int looking_for_one = 1; + int invalid_db_padding = 0; + int is_zero; + int is_one; + for (int i = 0; i < db_len; ) { + is_zero = (db[i] == 0); + is_one = (db[i] == 1); + msg_ofs += (looking_for_one & is_one) * (++i); + looking_for_one &= ~is_one; + invalid_db_padding |= (looking_for_one & ~is_zero); + } + + is_valid &= (invalid_db_padding == 0); + + const u32 msg_size = MIN(dst_size, is_valid * (db_len - msg_ofs)); + memcpy(dst, db + msg_ofs, msg_size); + + return msg_size; +} + // Equivalent to spl::GenerateAesKek void generate_aes_kek(u32 ks, key_storage_t *keys, void *out_kek, const void *kek_source, u32 generation, u32 option) { bool device_unique = GET_IS_DEVICE_UNIQUE(option); diff --git a/source/keys/crypto.h b/source/keys/crypto.h index 4e1d0d7..33389f8 100644 --- a/source/keys/crypto.h +++ b/source/keys/crypto.h @@ -127,10 +127,12 @@ static const u8 secure_data_tweaks[1][0x10] __attribute__((aligned(4))) = { #define SSL_RSA_KEY_SIZE (SE_AES_IV_SIZE + SE_RSA2048_DIGEST_SIZE) #define ETICKET_RSA_KEYPAIR_SIZE (SE_AES_IV_SIZE + SE_RSA2048_DIGEST_SIZE * 2 + SE_KEY_128_SIZE) +#define TICKET_SIG_TYPE_RSA2048_SHA256 0x10004 + typedef struct { u8 private_exponent[SE_RSA2048_DIGEST_SIZE]; u8 modulus[SE_RSA2048_DIGEST_SIZE]; - u8 public_exponent[4]; + u32 public_exponent; u8 reserved[0xC]; } rsa_keypair_t; @@ -199,8 +201,11 @@ typedef enum { #define GET_SEAL_KEY_INDEX(x) (((x) >> 5) & 7) #define GET_IS_DEVICE_UNIQUE(x) ((x) & 1) +bool check_keyslot_access(); + bool test_rsa_keypair(const void *public_exponent, const void *private_exponent, const void *modulus); bool test_eticket_rsa_keypair(const rsa_keypair_t *keypair); +u32 rsa_oaep_decode(void *dst, u32 dst_size, const void *label_digest, u32 label_digest_size, u8 *buf, u32 buf_size); // Equivalent to spl::GenerateAesKek void generate_aes_kek(u32 ks, key_storage_t *keys, void *out_kek, const void *kek_source, u32 generation, u32 option); diff --git a/source/keys/keys.c b/source/keys/keys.c index a53061e..f7fc7c3 100644 --- a/source/keys/keys.c +++ b/source/keys/keys.c @@ -65,6 +65,7 @@ static void _save_key(const char *name, const void *data, u32 len, char *outbuf) static void _save_key_family(const char *name, const void *data, u32 start_key, u32 num_keys, u32 len, char *outbuf); static void _derive_master_key_mariko(key_storage_t *keys, bool is_dev) { + minerva_periodic_training(); // Relies on the SBK being properly set in slot 14 se_aes_crypt_block_ecb(KS_SECURE_BOOT, DECRYPT, keys->device_key_4x, device_master_key_source_kek_source); // Derive all master keys based on Mariko KEK @@ -94,6 +95,7 @@ static int _run_ams_keygen(key_storage_t *keys) { } static void _derive_master_keys_from_latest_key(key_storage_t *keys, bool is_dev) { + minerva_periodic_training(); if (!h_cfg.t210b01) { u32 tsec_root_key_slot = is_dev ? 11 : 13; // Derive all master keys based on current root key @@ -103,6 +105,8 @@ static void _derive_master_keys_from_latest_key(key_storage_t *keys, bool is_dev } } + minerva_periodic_training(); + // Derive all lower master keys for (u32 i = KB_FIRMWARE_VERSION_MAX; i > 0; i--) { load_aes_key(KS_AES_ECB, keys->master_key[i - 1], keys->master_key[i], is_dev ? master_key_vectors_dev[i] : master_key_vectors[i]); @@ -116,6 +120,8 @@ static void _derive_master_keys_from_latest_key(key_storage_t *keys, bool is_dev } static void _derive_keyblob_keys(key_storage_t *keys) { + minerva_periodic_training(); + u8 *keyblob_block = (u8 *)calloc(KB_FIRMWARE_VERSION_600 + 1, NX_EMMC_BLOCKSIZE); u32 keyblob_mac[SE_KEY_128_SIZE / 4] = {0}; bool have_keyblobs = true; @@ -194,6 +200,7 @@ static void _derive_bis_keys(key_storage_t *keys) { } static void _derive_non_unique_keys(key_storage_t *keys, bool is_dev) { + minerva_periodic_training(); if (_key_exists(keys->master_key[0])) { const u32 generation = 0; const u32 option = GET_IS_DEVICE_UNIQUE(NOT_DEVICE_UNIQUE); @@ -209,6 +216,7 @@ static void _derive_rsa_kek(u32 ks, key_storage_t *keys, void *out_rsa_kek, cons } static void _derive_misc_keys(key_storage_t *keys, bool is_dev) { + minerva_periodic_training(); if (_key_exists(keys->device_key) || (_key_exists(keys->master_key[0]) && _key_exists(keys->device_key_4x))) { void *access_key = keys->temp_key; const u32 generation = 0; @@ -231,6 +239,7 @@ static void _derive_misc_keys(key_storage_t *keys, bool is_dev) { static void _derive_per_generation_keys(key_storage_t *keys) { for (u32 generation = 0; generation < ARRAY_SIZE(keys->master_key); generation++) { + minerva_periodic_training(); if (!_key_exists(keys->master_key[generation])) continue; for (u32 source_type = 0; source_type < ARRAY_SIZE(key_area_key_sources); source_type++) { @@ -244,6 +253,45 @@ static void _derive_per_generation_keys(key_storage_t *keys) { } } +// Returns true when terminator is found +static bool _count_ticket_records(u32 buf_size, titlekey_buffer_t *titlekey_buffer, u32 *tkey_count) { + ticket_record_t *curr_ticket_record = (ticket_record_t *)titlekey_buffer->read_buffer; + for (u32 i = 0; i < buf_size; i += sizeof(ticket_record_t), curr_ticket_record++) { + if (curr_ticket_record->rights_id[0] == 0xFF) + return true; + (*tkey_count)++; + } + return false; +} + +static void _decode_tickets(u32 buf_size, titlekey_buffer_t *titlekey_buffer, u32 remaining, u32 total, u32 x, u32 y, u32 *pct, u32 *last_pct, bool is_personalized) { + ticket_t *curr_ticket = (ticket_t *)titlekey_buffer->read_buffer; + for (u32 i = 0; i < MIN(buf_size / sizeof(ticket_t), remaining) * sizeof(ticket_t) && curr_ticket->signature_type != 0; i += sizeof(ticket_t), curr_ticket++) { + minerva_periodic_training(); + *pct = (total - remaining) * 100 / total; + if (*pct > *last_pct && *pct <= 100) { + *last_pct = *pct; + tui_pbar(x, y, *pct, COLOR_GREEN, 0xFF155500); + } + + // This is in case an encrypted volatile ticket is left behind + if (curr_ticket->signature_type != TICKET_SIG_TYPE_RSA2048_SHA256) + continue; + + u8 *curr_titlekey = curr_ticket->titlekey_block; + const u32 block_size = SE_RSA2048_DIGEST_SIZE; + const u32 titlekey_size = sizeof(titlekey_buffer->titlekeys[0]); + if (is_personalized) { + se_rsa_exp_mod(0, curr_titlekey, block_size, curr_titlekey, block_size); + if (rsa_oaep_decode(curr_titlekey, titlekey_size, null_hash, sizeof(null_hash), curr_titlekey, block_size) != titlekey_size) + continue; + } + memcpy(titlekey_buffer->rights_ids[_titlekey_count], curr_ticket->rights_id, sizeof(titlekey_buffer->rights_ids[0])); + memcpy(titlekey_buffer->titlekeys[_titlekey_count], curr_titlekey, titlekey_size); + _titlekey_count++; + } +} + static bool _get_titlekeys_from_save(u32 buf_size, const u8 *save_mac_key, titlekey_buffer_t *titlekey_buffer, rsa_keypair_t *rsa_keypair) { FIL fp; u64 br = buf_size; @@ -251,8 +299,10 @@ static bool _get_titlekeys_from_save(u32 buf_size, const u8 *save_mac_key, title u32 file_tkey_count = 0; u32 save_x = gfx_con.x, save_y = gfx_con.y; bool is_personalized = rsa_keypair != NULL; - u32 start_titlekey_count = _titlekey_count; + const char ticket_bin_path[32] = "/ticket.bin"; + const char ticket_list_bin_path[32] = "/ticket_list.bin"; char titlekey_save_path[32] = "bis:/save/80000000000000E1"; + save_data_file_ctx_t ticket_file; if (is_personalized) { titlekey_save_path[25] = '2'; @@ -280,10 +330,6 @@ static bool _get_titlekeys_from_save(u32 buf_size, const u8 *save_mac_key, title return false; } - const char ticket_bin_path[32] = "/ticket.bin"; - const char ticket_list_bin_path[32] = "/ticket_list.bin"; - save_data_file_ctx_t ticket_file; - if (!save_open_file(save_ctx, &ticket_file, ticket_list_bin_path, OPEN_MODE_READ)) { EPRINTF("Unable to locate ticket_list.bin in save."); f_close(&fp); @@ -292,22 +338,19 @@ static bool _get_titlekeys_from_save(u32 buf_size, const u8 *save_mac_key, title return false; } - bool terminator_reached = false; - while (offset < ticket_file.size && !terminator_reached) { - if (!save_data_file_read(&ticket_file, &br, offset, titlekey_buffer->read_buffer, buf_size) || titlekey_buffer->read_buffer[0] == 0 || br != buf_size) - break; - offset += br; + // Read ticket list to get ticket count + while (offset < ticket_file.size) { minerva_periodic_training(); - ticket_record_t *curr_ticket_record = (ticket_record_t *)titlekey_buffer->read_buffer; - for (u32 i = 0; i < buf_size; i += sizeof(ticket_record_t), curr_ticket_record++) { - if (curr_ticket_record->rights_id[0] == 0xFF) { - terminator_reached = true; - break; - } - file_tkey_count++; + if (!save_data_file_read(&ticket_file, &br, offset, titlekey_buffer->read_buffer, buf_size) || + titlekey_buffer->read_buffer[0] == 0 || + br != buf_size || + _count_ticket_records(buf_size, titlekey_buffer, &file_tkey_count) + ) { + break; } + offset += br; } - TPRINTF(" Count keys..."); + TPRINTF(" Count titlekeys..."); if (!save_open_file(save_ctx, &ticket_file, ticket_bin_path, OPEN_MODE_READ)) { EPRINTF("Unable to locate ticket.bin in save."); @@ -317,50 +360,17 @@ static bool _get_titlekeys_from_save(u32 buf_size, const u8 *save_mac_key, title return false; } - if (is_personalized) { + if (is_personalized) se_rsa_key_set(0, rsa_keypair->modulus, sizeof(rsa_keypair->modulus), rsa_keypair->private_exponent, sizeof(rsa_keypair->private_exponent)); - } - - const u32 ticket_sig_type_rsa2048_sha256 = 0x10004; offset = 0; - terminator_reached = false; - u32 pct = 0, last_pct = 0, i = 0; - while (offset < ticket_file.size && !terminator_reached) { + u32 pct = 0, last_pct = 0, remaining = file_tkey_count; + while (offset < ticket_file.size && remaining) { if (!save_data_file_read(&ticket_file, &br, offset, titlekey_buffer->read_buffer, buf_size) || titlekey_buffer->read_buffer[0] == 0 || br != buf_size) break; offset += br; - ticket_t *curr_ticket = (ticket_t *)titlekey_buffer->read_buffer; - for (u32 j = 0; j < buf_size; j += sizeof(ticket_t), curr_ticket++) { - minerva_periodic_training(); - pct = (_titlekey_count - start_titlekey_count) * 100 / file_tkey_count; - if (pct > last_pct && pct <= 100) { - last_pct = pct; - tui_pbar(save_x, save_y, pct, COLOR_GREEN, 0xFF155500); - } - if (i == file_tkey_count || curr_ticket->signature_type == 0) { - terminator_reached = true; - break; - } - if (curr_ticket->signature_type != ticket_sig_type_rsa2048_sha256) { - i++; - continue; - } - if (is_personalized) { - se_rsa_exp_mod(0, curr_ticket->titlekey_block, sizeof(curr_ticket->titlekey_block), curr_ticket->titlekey_block, sizeof(curr_ticket->titlekey_block)); - if (se_rsa_oaep_decode( - curr_ticket->titlekey_block, sizeof(titlekey_buffer->titlekeys[0]), - null_hash, sizeof(null_hash), - curr_ticket->titlekey_block, sizeof(curr_ticket->titlekey_block) - ) != sizeof(titlekey_buffer->titlekeys[0]) - ) - continue; - } - memcpy(titlekey_buffer->rights_ids[_titlekey_count], curr_ticket->rights_id, sizeof(titlekey_buffer->rights_ids[0])); - memcpy(titlekey_buffer->titlekeys[_titlekey_count], curr_ticket->titlekey_block, sizeof(titlekey_buffer->titlekeys[0])); - _titlekey_count++; - i++; - } + _decode_tickets(buf_size, titlekey_buffer, remaining, file_tkey_count, save_x, save_y, &pct, &last_pct, is_personalized); + remaining -= MIN(buf_size / sizeof(ticket_t), remaining); } tui_pbar(save_x, save_y, 100, COLOR_GREEN, 0xFF155500); f_close(&fp); @@ -844,21 +854,11 @@ static void _save_keys_to_sd(key_storage_t *keys, titlekey_buffer_t *titlekey_bu free(text_buffer); } -static bool _check_keyslot_access() { - u8 test_data[SE_KEY_128_SIZE] = {0}; - const u8 test_ciphertext[SE_KEY_128_SIZE] = {0}; - se_aes_key_set(KS_AES_ECB, "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f", SE_KEY_128_SIZE); - se_aes_crypt_block_ecb(KS_AES_ECB, DECRYPT, test_data, test_ciphertext); - - return memcmp(test_data, "\x7b\x1d\x29\xa1\x6c\xf8\xcc\xab\x84\xf0\xb8\xa5\x98\xe4\x2f\xa6", SE_KEY_128_SIZE) == 0; -} - static void _derive_master_keys(key_storage_t *prod_keys, key_storage_t *dev_keys, bool is_dev) { key_storage_t *keys = is_dev ? dev_keys : prod_keys; if (h_cfg.t210b01) { _derive_master_key_mariko(keys, is_dev); - minerva_periodic_training(); _derive_master_keys_from_latest_key(keys, is_dev); } else { int res = _run_ams_keygen(keys); @@ -874,9 +874,7 @@ static void _derive_master_keys(key_storage_t *prod_keys, key_storage_t *dev_key free(aes_keys); _derive_master_keys_from_latest_key(prod_keys, false); - minerva_periodic_training(); _derive_master_keys_from_latest_key(dev_keys, true); - minerva_periodic_training(); _derive_keyblob_keys(keys); } } @@ -884,7 +882,7 @@ static void _derive_master_keys(key_storage_t *prod_keys, key_storage_t *dev_key static void _derive_keys() { minerva_periodic_training(); - if (!_check_keyslot_access()) { + if (!check_keyslot_access()) { EPRINTF("Unable to set crypto keyslots!\nTry launching payload differently\n or flash Spacecraft-NX if using a modchip."); return; } @@ -917,19 +915,10 @@ static void _derive_keys() { TPRINTFARGS("%kBIS keys... ", colors[(color_idx++) % 6]); - minerva_periodic_training(); _derive_misc_keys(keys, is_dev); - - minerva_periodic_training(); _derive_non_unique_keys(&prod_keys, is_dev); - - minerva_periodic_training(); _derive_non_unique_keys(&dev_keys, is_dev); - - minerva_periodic_training(); _derive_per_generation_keys(&prod_keys); - - minerva_periodic_training(); _derive_per_generation_keys(&dev_keys); titlekey_buffer_t *titlekey_buffer = (titlekey_buffer_t *)TITLEKEY_BUF_ADR; @@ -957,6 +946,37 @@ static void _derive_keys() { } } + static void _decrypt_amiibo_keys(key_storage_t *keys, const u8 *encrypted_keys, nfc_save_key_t nfc_save_keys[2]) { + u32 kek[SE_KEY_128_SIZE / 4] = {0}; + decrypt_aes_key(KS_AES_ECB, keys, kek, nfc_key_source, 0, 0); + + nfc_keyblob_t __attribute__((aligned(4))) nfc_keyblob; + static const u8 nfc_iv[SE_KEY_128_SIZE] = { + 0xB9, 0x1D, 0xC1, 0xCF, 0x33, 0x5F, 0xA6, 0x13, 0x2A, 0xEF, 0x90, 0x99, 0xAA, 0xCA, 0x93, 0xC8}; + se_aes_key_set(KS_AES_CTR, kek, SE_KEY_128_SIZE); + se_aes_crypt_ctr(KS_AES_CTR, &nfc_keyblob, sizeof(nfc_keyblob), encrypted_keys, sizeof(nfc_keyblob), &nfc_iv); + + minerva_periodic_training(); + + u32 xor_pad[0x20 / 4] = {0}; + se_aes_key_set(KS_AES_CTR, nfc_keyblob.ctr_key, SE_KEY_128_SIZE); + se_aes_crypt_ctr(KS_AES_CTR, xor_pad, sizeof(xor_pad), xor_pad, sizeof(xor_pad), nfc_keyblob.ctr_iv); + + minerva_periodic_training(); + + memcpy(nfc_save_keys[0].hmac_key, nfc_keyblob.hmac_key, sizeof(nfc_keyblob.hmac_key)); + memcpy(nfc_save_keys[0].phrase, nfc_keyblob.phrase, sizeof(nfc_keyblob.phrase)); + nfc_save_keys[0].seed_size = sizeof(nfc_keyblob.seed); + memcpy(nfc_save_keys[0].seed, nfc_keyblob.seed, sizeof(nfc_keyblob.seed)); + memcpy(nfc_save_keys[0].xor_pad, xor_pad, sizeof(xor_pad)); + + memcpy(nfc_save_keys[1].hmac_key, nfc_keyblob.hmac_key_for_verif, sizeof(nfc_keyblob.hmac_key_for_verif)); + memcpy(nfc_save_keys[1].phrase, nfc_keyblob.phrase_for_verif, sizeof(nfc_keyblob.phrase_for_verif)); + nfc_save_keys[1].seed_size = sizeof(nfc_keyblob.seed_for_verif); + memcpy(nfc_save_keys[1].seed, nfc_keyblob.seed_for_verif, sizeof(nfc_keyblob.seed_for_verif)); + memcpy(nfc_save_keys[1].xor_pad, xor_pad, sizeof(xor_pad)); + } + void derive_amiibo_keys() { minerva_change_freq(FREQ_1600); @@ -985,53 +1005,25 @@ void derive_amiibo_keys() { return; } - decrypt_aes_key(KS_AES_ECB, keys, keys->temp_key, nfc_key_source, 0, 0); - - nfc_keyblob_t __attribute__((aligned(4))) nfc_keyblob; - static const u8 nfc_iv[SE_KEY_128_SIZE] = { - 0xB9, 0x1D, 0xC1, 0xCF, 0x33, 0x5F, 0xA6, 0x13, 0x2A, 0xEF, 0x90, 0x99, 0xAA, 0xCA, 0x93, 0xC8}; - se_aes_key_set(KS_AES_CTR, keys->temp_key, SE_KEY_128_SIZE); - se_aes_crypt_ctr(KS_AES_CTR, &nfc_keyblob, sizeof(nfc_keyblob), encrypted_keys, sizeof(nfc_keyblob), &nfc_iv); - - minerva_periodic_training(); - - u8 xor_pad[0x20] __attribute__((aligned(4))) = {0}; - se_aes_key_set(KS_AES_CTR, nfc_keyblob.ctr_key, SE_KEY_128_SIZE); - se_aes_crypt_ctr(KS_AES_CTR, xor_pad, sizeof(xor_pad), xor_pad, sizeof(xor_pad), nfc_keyblob.ctr_iv); - - minerva_periodic_training(); - nfc_save_key_t __attribute__((aligned(4))) nfc_save_keys[2] = {0}; - memcpy(nfc_save_keys[0].hmac_key, nfc_keyblob.hmac_key, sizeof(nfc_keyblob.hmac_key)); - memcpy(nfc_save_keys[0].phrase, nfc_keyblob.phrase, sizeof(nfc_keyblob.phrase)); - nfc_save_keys[0].seed_size = sizeof(nfc_keyblob.seed); - memcpy(nfc_save_keys[0].seed, nfc_keyblob.seed, sizeof(nfc_keyblob.seed)); - memcpy(nfc_save_keys[0].xor_pad, xor_pad, sizeof(xor_pad)); - memcpy(nfc_save_keys[1].hmac_key, nfc_keyblob.hmac_key_for_verif, sizeof(nfc_keyblob.hmac_key_for_verif)); - memcpy(nfc_save_keys[1].phrase, nfc_keyblob.phrase_for_verif, sizeof(nfc_keyblob.phrase_for_verif)); - nfc_save_keys[1].seed_size = sizeof(nfc_keyblob.seed_for_verif); - memcpy(nfc_save_keys[1].seed, nfc_keyblob.seed_for_verif, sizeof(nfc_keyblob.seed_for_verif)); - memcpy(nfc_save_keys[1].xor_pad, xor_pad, sizeof(xor_pad)); + _decrypt_amiibo_keys(keys, encrypted_keys, nfc_save_keys); minerva_periodic_training(); - u8 hash[0x20] = {0}; + u32 hash[SE_SHA_256_SIZE / 4] = {0}; se_calc_sha256_oneshot(hash, &nfc_save_keys[0], sizeof(nfc_save_keys)); if (memcmp(hash, is_dev ? nfc_blob_hash_dev : nfc_blob_hash, sizeof(hash)) != 0) { EPRINTF("Amiibo hash mismatch. Skipping save."); - minerva_change_freq(FREQ_800); - btn_wait(); - return; - } - - const char *keyfile_path = is_dev ? "sd:/switch/key_dev.bin" : "sd:/switch/key_retail.bin"; - - if (!sd_save_to_file(&nfc_save_keys[0], sizeof(nfc_save_keys), keyfile_path)) { - gfx_printf("%kWrote Amiibo keys to\n %s\n", colors[(color_idx++) % 6], keyfile_path); } else { - EPRINTF("Unable to save Amiibo keys to SD."); + const char *keyfile_path = is_dev ? "sd:/switch/key_dev.bin" : "sd:/switch/key_retail.bin"; + + if (!sd_save_to_file(&nfc_save_keys[0], sizeof(nfc_save_keys), keyfile_path)) { + gfx_printf("%kWrote Amiibo keys to\n %s\n", colors[(color_idx++) % 6], keyfile_path); + } else { + EPRINTF("Unable to save Amiibo keys to SD."); + } } gfx_printf("\n%kPress a button to return to the menu.", colors[(color_idx++) % 6]); diff --git a/source/keys/keys.h b/source/keys/keys.h index ca84f85..3f15719 100644 --- a/source/keys/keys.h +++ b/source/keys/keys.h @@ -25,7 +25,7 @@ // only tickets of type Rsa2048Sha256 are expected typedef struct { - u32 signature_type; // always 0x10004 + u32 signature_type; // always 0x10004 u8 signature[SE_RSA2048_DIGEST_SIZE]; u8 sig_padding[0x3C]; char issuer[0x40];