From d8bd3d16bb50338c2592282dc9daa897aedb0b01 Mon Sep 17 00:00:00 2001 From: Michael Scire Date: Tue, 10 Nov 2020 23:25:24 -0800 Subject: [PATCH] ams.mitm: provide different boot0-protection for custom public key --- .../source/fs_mitm/fs_mitm_service.cpp | 27 ++- .../source/fs_mitm/fsmitm_boot0storage.cpp | 186 ++++++++++++++++-- .../source/fs_mitm/fsmitm_boot0storage.hpp | 17 +- 3 files changed, 206 insertions(+), 24 deletions(-) diff --git a/stratosphere/ams_mitm/source/fs_mitm/fs_mitm_service.cpp b/stratosphere/ams_mitm/source/fs_mitm/fs_mitm_service.cpp index 5a3525fcc..1a925a347 100644 --- a/stratosphere/ams_mitm/source/fs_mitm/fs_mitm_service.cpp +++ b/stratosphere/ams_mitm/source/fs_mitm/fs_mitm_service.cpp @@ -33,10 +33,27 @@ namespace ams::mitm::fs { constexpr const char AtmosphereHblWebContentDir[] = "/atmosphere/hbl_html/"; constexpr const char ProgramWebContentDir[] = "/manual_html/"; - os::Mutex g_data_storage_lock(false); - os::Mutex g_storage_cache_lock(false); + constinit os::SdkMutex g_data_storage_lock; + constinit os::SdkMutex g_storage_cache_lock; std::unordered_map> g_storage_cache; + constinit os::SdkMutex g_boot0_detect_lock; + constinit bool g_detected_boot0_kind = false; + constinit bool g_is_boot0_custom_public_key = false; + + bool IsBoot0CustomPublicKey(::FsStorage &storage) { + if (AMS_UNLIKELY(!g_detected_boot0_kind)) { + std::scoped_lock lk(g_boot0_detect_lock); + + if (AMS_LIKELY(!g_detected_boot0_kind)) { + g_is_boot0_custom_public_key = DetectBoot0CustomPublicKey(storage); + g_detected_boot0_kind = true; + } + } + + return g_is_boot0_custom_public_key; + } + std::shared_ptr GetStorageCacheEntry(ncm::ProgramId program_id) { std::scoped_lock lk(g_storage_cache_lock); @@ -275,7 +292,11 @@ namespace ams::mitm::fs { /* Set output storage. */ if (bis_partition_id == FsBisPartitionId_BootPartition1Root) { - out.SetValue(MakeSharedStorage(new Boot0Storage(bis_storage, this->client_info)), target_object_id); + if (IsBoot0CustomPublicKey(bis_storage)) { + out.SetValue(MakeSharedStorage(new CustomPublicKeyBoot0Storage(bis_storage, this->client_info, spl::GetSocType())), target_object_id); + } else { + out.SetValue(MakeSharedStorage(new Boot0Storage(bis_storage, this->client_info)), target_object_id); + } } else if (bis_partition_id == FsBisPartitionId_CalibrationBinary) { out.SetValue(MakeSharedStorage(new CalibrationBinaryStorage(bis_storage, this->client_info)), target_object_id); } else { diff --git a/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.cpp b/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.cpp index d30758196..adfc7cea7 100644 --- a/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.cpp +++ b/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.cpp @@ -22,9 +22,36 @@ namespace ams::mitm::fs { namespace { - os::Mutex g_boot0_access_mutex(false); + os::SdkMutex g_boot0_access_mutex; + constinit bool g_custom_public_key = false; u8 g_boot0_bct_buffer[Boot0Storage::BctEndOffset]; + /* Recognize special public key (https://gist.github.com/SciresM/16b63ac1d80494522bdba2c57995257c). */ + /* P = 19 */ + /* Q = 1696986749729493925354392349339746171297507422986462747526968361144447230710192316397327889522451749459854070558277878297255552508603806832852079596337539247651161831569525505882103311631577368514276343192042634740927726070847704397913856975832811679847928433261678072951551065705680482548543833651752439700272736498378724153330763357721354498194000536297732323628263256733931353143625854828275237159155585342783077681713929284136658773985266864804093157854331138230313706015557050002740810464618031715670281442110238274404626065924786185264268216336867948322976979393032640085259926883014490947373494538254895109731 */ + /* N = 0xFF696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696969696959 */ + /* E = 0x10001 */ + /* D = 6512128715229088976470211610075969347035078304643231077895577077900787352712063823560162578441773733649014439616165727455431015055675770987914713980812453585413988983206576233689754710500864883529402371292948326392791238474661859182717295176679567362482790015587820446999760239570255254879359445627372805817473978644067558931078225451477635089763009580492462097185005355990612929951162366081631888011031830742459571000203341001926135389508196521518687349554188686396554248868403128728646457247197407637887195043486221295751496667162366700477934591694110831002874992896076061627516220934290742867397720103040314639313 */ + + constexpr const u8 CustomPublicKey[0x100] = { + 0x59, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, + 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0x69, 0xFF, + }; + } bool Boot0Storage::CanModifyBctPublicKey() { @@ -42,24 +69,22 @@ namespace ams::mitm::fs { Result Boot0Storage::Read(s64 offset, void *_buffer, size_t size) { std::scoped_lock lk{g_boot0_access_mutex}; + AMS_ABORT_UNLESS(!g_custom_public_key); /* Check if we have nothing to do. */ - if (size == 0) { - return ResultSuccess(); - } + R_SUCCEED_IF(size == 0); return Base::Read(offset, _buffer, size); } Result Boot0Storage::Write(s64 offset, const void *_buffer, size_t size) { std::scoped_lock lk{g_boot0_access_mutex}; + AMS_ABORT_UNLESS(!g_custom_public_key); const u8 *buffer = static_cast(_buffer); /* Check if we have nothing to do. */ - if (size == 0) { - return ResultSuccess(); - } + R_SUCCEED_IF(size == 0); /* Protect the EKS region from writes. */ if (offset <= EksStart) { @@ -75,22 +100,18 @@ namespace ams::mitm::fs { size = EksStart - offset; } } else if (offset < EksEnd) { - if (offset + size <= EksEnd) { - /* Ignore writes falling strictly within the region. */ - return ResultSuccess(); - } else { - /* Only write past the end of the region. */ - const s64 diff = EksEnd - offset; - buffer += diff; - size -= diff; - offset = EksEnd; - } + /* Ignore writes falling strictly within the region. */ + R_SUCCEED_IF(offset + size <= EksEnd); + + /* Only write past the end of the region. */ + const s64 diff = EksEnd - offset; + buffer += diff; + size -= diff; + offset = EksEnd; } /* If we have nothing to write, succeed immediately. */ - if (size == 0) { - return ResultSuccess(); - } + R_SUCCEED_IF(size == 0); /* We want to protect AutoRCM from NS on ipatched units. If we can modify bct pubks or we're not touching any of them, proceed. */ if (this->CanModifyBctPublicKey() || offset >= BctEndOffset || (util::AlignUp(offset, BctSize) >= BctEndOffset && (offset % BctSize) >= BctPubkEnd)) { @@ -118,4 +139,129 @@ namespace ams::mitm::fs { return Base::Write(0, g_boot0_bct_buffer, BctEndOffset); } + CustomPublicKeyBoot0Storage::CustomPublicKeyBoot0Storage(FsStorage &s, const sm::MitmProcessInfo &c, spl::SocType soc) : Base(s), client_info(c), soc_type(soc) { + std::scoped_lock lk{g_boot0_access_mutex}; + + /* We're custom public key. */ + g_custom_public_key = true; + } + + Result CustomPublicKeyBoot0Storage::Read(s64 offset, void *_buffer, size_t size) { + std::scoped_lock lk{g_boot0_access_mutex}; + AMS_ABORT_UNLESS(g_custom_public_key); + + /* Check if we have nothing to do. */ + R_SUCCEED_IF(size == 0); + + u8 *buffer = static_cast(_buffer); + + /* Check if we're reading the first BCTs for NS. */ + /* If we are, we want to lie about the contents of BCT0/1 so that they validate. */ + if (offset < 0x8000 && this->client_info.program_id == ncm::SystemProgramId::Ns) { + R_TRY(Base::Read(0, g_boot0_bct_buffer, Boot0Storage::BctEndOffset)); + + /* Determine the readable size. */ + const size_t readable_bct01_size = std::min(0x8000, offset + size) - offset; + std::memcpy(buffer, g_boot0_bct_buffer + 0x8000 + offset, readable_bct01_size); + + /* Advance. */ + buffer += readable_bct01_size; + offset += readable_bct01_size; + size -= readable_bct01_size; + } + + /* Check if we have nothing to do. */ + R_SUCCEED_IF(size == 0); + + /* Perform whatever remains of the read. */ + return Base::Read(offset, buffer, size); + } + + Result CustomPublicKeyBoot0Storage::Write(s64 offset, const void *_buffer, size_t size) { + std::scoped_lock lk{g_boot0_access_mutex}; + AMS_ABORT_UNLESS(g_custom_public_key); + + const u8 *buffer = static_cast(_buffer); + + /* Check if we have nothing to do. */ + R_SUCCEED_IF(size == 0); + + /* Drop writes to the first BCTs. */ + if (offset < 0x8000) { + /* Determine the writable size. */ + const size_t writable_bct01_size = std::min(0x8000, offset + size) - offset; + + /* Advance. */ + buffer += writable_bct01_size; + offset += writable_bct01_size; + size -= writable_bct01_size; + } + + /* Check if we have nothing to do. */ + R_SUCCEED_IF(size == 0); + + /* Similarly, we want to drop writes to the end of boot0, where custom bootloader lives. */ + R_SUCCEED_IF(offset >= 0x380000); + if (offset + size >= 0x380000) { + size = 0x380000 - offset; + } + + /* On erista, we want to protect the EKS region. */ + if (this->soc_type == spl::SocType_Erista) { + if (offset <= Boot0Storage::EksStart) { + if (offset + size < Boot0Storage::EksStart) { + /* Fall through, no need to do anything here. */ + } else { + if (offset + size > Boot0Storage::EksEnd) { + /* Perform portion of write falling past end of keyblobs. */ + const s64 diff = Boot0Storage::EksEnd - offset; + R_TRY(Base::Write(Boot0Storage::EksEnd, buffer + diff, size - diff)); + } + /* Adjust size to avoid writing end of data. */ + size = Boot0Storage::EksStart - offset; + } + } else if (offset < Boot0Storage::EksEnd) { + /* Ignore writes falling strictly within the region. */ + R_SUCCEED_IF(offset + size <= Boot0Storage::EksEnd); + + /* Only write past the end of the region. */ + const s64 diff = Boot0Storage::EksEnd - offset; + buffer += diff; + size -= diff; + offset = Boot0Storage::EksEnd; + } + } + + /* If we have nothing to write, succeed immediately. */ + R_SUCCEED_IF(size == 0); + + /* Perform whatever remains of the write. */ + return Base::Write(offset, buffer, size); + } + + bool DetectBoot0CustomPublicKey(::FsStorage &storage) { + /* Determine public key offset. */ + const size_t bct_pubk_offset = spl::GetSocType() == spl::SocType_Mariko ? 0x10 : 0x210; + + u8 work_buffer[0x400]; + + /* Read BCT-Normal-Main. */ + R_ABORT_UNLESS(::fsStorageRead(std::addressof(storage), 0, work_buffer, sizeof(work_buffer))); + + /* Check for custom public key. */ + if (std::memcmp(work_buffer + bct_pubk_offset, CustomPublicKey, sizeof(CustomPublicKey)) != 0) { + return false; + } + + /* Read BCT-Safe-Main. */ + R_ABORT_UNLESS(::fsStorageRead(std::addressof(storage), 0x4000, work_buffer, sizeof(work_buffer))); + + /* Check for custom public key. */ + if (std::memcmp(work_buffer + bct_pubk_offset, CustomPublicKey, sizeof(CustomPublicKey)) != 0) { + return false; + } + + return true; + } + } diff --git a/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.hpp b/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.hpp index a1ac52ed2..09f7d1775 100644 --- a/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.hpp +++ b/stratosphere/ams_mitm/source/fs_mitm/fsmitm_boot0storage.hpp @@ -140,10 +140,25 @@ namespace ams::mitm::fs { private: bool CanModifyBctPublicKey(); public: - Boot0Storage(FsStorage &s, const sm::MitmProcessInfo &c) : Base(s), client_info(c) { /* ... */ } + Boot0Storage(FsStorage &s, const sm::MitmProcessInfo &c) : Base(s), client_info(c) { /* ... */ } public: virtual Result Read(s64 offset, void *_buffer, size_t size) override; virtual Result Write(s64 offset, const void *_buffer, size_t size) override; }; + class CustomPublicKeyBoot0Storage : public SectoredStorageAdapter { + public: + using Base = SectoredStorageAdapter; + private: + sm::MitmProcessInfo client_info; + spl::SocType soc_type; + public: + CustomPublicKeyBoot0Storage(FsStorage &s, const sm::MitmProcessInfo &c, spl::SocType soc); + public: + virtual Result Read(s64 offset, void *_buffer, size_t size) override; + virtual Result Write(s64 offset, const void *_buffer, size_t size) override; + }; + + bool DetectBoot0CustomPublicKey(::FsStorage &storage); + }