diff --git a/source/hos/hos.h b/source/hos/hos.h index 984ae3b..ef83f5f 100644 --- a/source/hos/hos.h +++ b/source/hos/hos.h @@ -18,6 +18,8 @@ #ifndef _HOS_H_ #define _HOS_H_ +#define KEYBLOB_OFFSET 0x180000 + #define KB_FIRMWARE_VERSION_100 0 #define KB_FIRMWARE_VERSION_300 1 #define KB_FIRMWARE_VERSION_301 2 diff --git a/source/hos/pkg1.c b/source/hos/pkg1.c deleted file mode 100644 index 1f2942a..0000000 --- a/source/hos/pkg1.c +++ /dev/null @@ -1,68 +0,0 @@ -/* - * Copyright (c) 2018 naehrwert - * Copyright (c) 2018 st4rk - * Copyright (c) 2018-2021 CTCaer - * Copyright (c) 2018 balika011 - * - * This program is free software; you can redistribute it and/or modify it - * under the terms and conditions of the GNU General Public License, - * version 2, as published by the Free Software Foundation. - * - * This program is distributed in the hope it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for - * more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see . - */ - -#include - -#include "pkg1.h" -#include "hos.h" -#include -#include - -static const pkg1_id_t _pkg1_ids[] = { - { "20161121", 0 }, //1.0.0 - { "20170210", 0 }, //2.0.0 - 2.3.0 - { "20170519", 1 }, //3.0.0 - { "20170710", 2 }, //3.0.1 - 3.0.2 - { "20170921", 3 }, //4.0.0 - 4.1.0 - { "20180220", 4 }, //5.0.0 - 5.1.0 - { "20180802", 5 }, //6.0.0 - 6.1.0 - { "20181107", 6 }, //6.2.0 - { "20181218", 7 }, //7.0.0 - { "20190208", 7 }, //7.0.1 - { "20190314", 7 }, //8.0.0 - 8.0.1 - { "20190531", 8 }, //8.1.0 - 8.1.1 - { "20190809", 9 }, //9.0.0 - 9.0.1 - { "20191021", 10}, //9.1.0 - 9.2.0 - { "20200303", 10}, //10.0.0 - 10.2.0 - { "20201030", 10}, //11.0.0 - 11.0.1 - { "20210129", 10}, //12.0.0 - 12.0.1 - { "20210422", 10}, //12.0.2 - 12.0.3 - { "20210607", 11}, //12.1.0 - { NULL } //End. -}; - -const pkg1_id_t *pkg1_identify(u8 *pkg1) -{ - for (u32 i = 0; i < ARRAY_SIZE(_pkg1_ids); i++) - if (!memcmp(pkg1 + 0x10, _pkg1_ids[i].id, 8)) - return &_pkg1_ids[i]; - - char build_date[15]; - memcpy(build_date, (char *)(pkg1 + 0x10), 14); - build_date[14] = 0; - EPRINTFARGS("Found pkg1 ('%s').", build_date); - - if (*(pkg1 + 0xE) != KB_FIRMWARE_VERSION_MAX + 1) { - EPRINTF("Unsupported key generation!\nLockpick_RCM must be updated for support!"); - return NULL; - } - - EPRINTF("Contact if master key derivation fails."); - return &_pkg1_ids[ARRAY_SIZE(_pkg1_ids)-1]; -} diff --git a/source/hos/pkg1.h b/source/hos/pkg1.h deleted file mode 100644 index 81bef20..0000000 --- a/source/hos/pkg1.h +++ /dev/null @@ -1,47 +0,0 @@ -/* - * Copyright (c) 2018 naehrwert - * - * This program is free software; you can redistribute it and/or modify it - * under the terms and conditions of the GNU General Public License, - * version 2, as published by the Free Software Foundation. - * - * This program is distributed in the hope it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for - * more details. - * - * You should have received a copy of the GNU General Public License - * along with this program. If not, see . - */ - -#ifndef _PKG1_H_ -#define _PKG1_H_ - -#include - -#define PKG1_MAX_SIZE 0x40000 -#define PKG1_OFFSET 0x100000 -#define KEYBLOB_OFFSET 0x180000 - -typedef struct _bl_hdr_t210b01_t -{ - u8 aes_mac[0x10]; - u8 rsa_sig[0x100]; - u8 salt[0x20]; - u8 sha256[0x20]; - u32 version; - u32 size; - u32 load_addr; - u32 entrypoint; - u8 rsvd[0x10]; -} bl_hdr_t210b01_t; - -typedef struct _pkg1_id_t -{ - const char *id; - u32 kb; -} pkg1_id_t; - -const pkg1_id_t *pkg1_identify(u8 *pkg1); - -#endif diff --git a/source/keys/key_sources.inl b/source/keys/key_sources.inl index 560efac..3a65539 100644 --- a/source/keys/key_sources.inl +++ b/source/keys/key_sources.inl @@ -28,6 +28,7 @@ static const u8 keyblob_key_sources[][0x10] __attribute__((aligned(4))) = { {0xD8, 0xCC, 0xE1, 0x26, 0x6A, 0x35, 0x3F, 0xCC, 0x20, 0xF3, 0x2D, 0x3B, 0x51, 0x7D, 0xE9, 0xC0} //6.0.0 }; +//!TODO: Update on mkey changes. static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_620 + 1][0x10] __attribute__((aligned(4))) = { {0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A}, //6.2.0 {0x9A, 0x3E, 0xA9, 0xAB, 0xFD, 0x56, 0x46, 0x1C, 0x9B, 0xF6, 0x48, 0x7F, 0x5C, 0xFA, 0x09, 0x5C}, //7.0.0 @@ -37,6 +38,7 @@ static const u8 master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION {0x84, 0x67, 0xB6, 0x7F, 0x13, 0x11, 0xAE, 0xE6, 0x58, 0x9B, 0x19, 0xAF, 0x13, 0x6C, 0x80, 0x7A}, //12.1.0 }; +//!TODO: Update on mkey changes. static const u8 master_key_vectors[KB_FIRMWARE_VERSION_MAX + 1][0x10] __attribute__((aligned(4))) = { {0x0C, 0xF0, 0x59, 0xAC, 0x85, 0xF6, 0x26, 0x65, 0xE1, 0xE9, 0x19, 0x55, 0xE6, 0xF2, 0x67, 0x3D}, /* Zeroes encrypted with Master Key 00. */ {0x29, 0x4C, 0x04, 0xC8, 0xEB, 0x10, 0xED, 0x9D, 0x51, 0x64, 0x97, 0xFB, 0xF3, 0x4D, 0x50, 0xDD}, /* Master key 00 encrypted with Master key 01. */ @@ -52,6 +54,7 @@ static const u8 master_key_vectors[KB_FIRMWARE_VERSION_MAX + 1][0x10] __attribut {0xC1, 0x8D, 0x16, 0xBB, 0x2A, 0xE4, 0x1D, 0xD4, 0xC2, 0xC1, 0xB6, 0x40, 0x94, 0x35, 0x63, 0x98}, /* Master key 0A encrypted with Master key 0B. */ }; +//!TODO: Update on mkey changes. static const u8 master_key_vectors_dev[KB_FIRMWARE_VERSION_MAX + 1][0x10] __attribute__((aligned(4))) = { {0x46, 0x22, 0xB4, 0x51, 0x9A, 0x7E, 0xA7, 0x7F, 0x62, 0xA1, 0x1F, 0x8F, 0xC5, 0x3A, 0xDB, 0xFE}, /* Zeroes encrypted with Master Key 00. */ {0x39, 0x33, 0xF9, 0x31, 0xBA, 0xE4, 0xA7, 0x21, 0x2C, 0xDD, 0xB7, 0xD8, 0xB4, 0x4E, 0x37, 0x23}, /* Master key 00 encrypted with Master key 01. */ @@ -124,7 +127,7 @@ static const u8 mariko_master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_ {0x86, 0x69, 0xF0, 0x09, 0x87, 0xC8, 0x05, 0xAE, 0xB5, 0x7B, 0x48, 0x74, 0xDE, 0x62, 0xA6, 0x13}, // 9.0.0. {0x0E, 0x44, 0x0C, 0xED, 0xB4, 0x36, 0xC0, 0x3F, 0xAA, 0x1D, 0xAE, 0xBF, 0x62, 0xB1, 0x09, 0x82}, // 9.1.0. {0xE5, 0x41, 0xAC, 0xEC, 0xD1, 0xA7, 0xD1, 0xAB, 0xED, 0x03, 0x77, 0xF1, 0x27, 0xCA, 0xF8, 0xF1}, // 12.1.0. -}; +}; //!TODO: Update on mkey changes. static const u8 mariko_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_600 + 1][0x10] __attribute__((aligned(4))) = { {0x32, 0xC0, 0x97, 0x6B, 0x63, 0x6D, 0x44, 0x64, 0xF2, 0x3A, 0xA5, 0xC0, 0xDE, 0x46, 0xCC, 0xE9}, // 6.0.0. {0xCC, 0x97, 0x4C, 0x46, 0x2A, 0x0C, 0xB0, 0xA6, 0xC9, 0xC0, 0xB7, 0xBE, 0x30, 0x2E, 0xC3, 0x68}, // 6.2.0. @@ -133,7 +136,7 @@ static const u8 mariko_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMW {0x82, 0x72, 0x91, 0x65, 0x40, 0x3B, 0x9D, 0x66, 0x60, 0xD0, 0x1B, 0x3D, 0x4D, 0xA5, 0x70, 0xE1}, // 9.0.0. {0xF9, 0x37, 0xCF, 0x9A, 0xBD, 0x86, 0xBB, 0xA9, 0x9C, 0x9E, 0x03, 0xC4, 0xFC, 0xBC, 0x3B, 0xCE}, // 9.1.0. {0x75, 0x2D, 0x2E, 0xF3, 0x2F, 0x3F, 0xFE, 0x65, 0xF4, 0xA9, 0x83, 0xB4, 0xED, 0x42, 0x63, 0xBA}, // 12.1.0. -}; +}; //!TODO: Update on mkey changes. static const u8 device_master_key_source_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] __attribute__((aligned(4))) = { {0x8B, 0x4E, 0x1C, 0x22, 0x42, 0x07, 0xC8, 0x73, 0x56, 0x94, 0x08, 0x8B, 0xCC, 0x47, 0x0F, 0x5D}, /* 4.0.0 Device Master Key Source Source. */ @@ -145,7 +148,7 @@ static const u8 device_master_key_source_sources[KB_FIRMWARE_VERSION_MAX - KB_FI {0x4A, 0xC3, 0x4E, 0x14, 0x8B, 0x96, 0x4A, 0xD5, 0xD4, 0x99, 0x73, 0xC4, 0x45, 0xAB, 0x8B, 0x49}, /* 9.0.0 Device Master Key Source Source. */ {0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94}, /* 9.1.0 Device Master Key Source Source. */ {0xAA, 0xFD, 0xBC, 0xBB, 0x25, 0xC3, 0xA4, 0xEF, 0xE3, 0xEE, 0x58, 0x53, 0xB7, 0xF8, 0xDD, 0xD6}, /* 12.1.0 Device Master Key Source Source. */ -}; +}; //!TODO: Update on mkey changes. // from ES static const u8 eticket_rsa_kek_source[0x10] __attribute__((aligned(4))) = { @@ -171,7 +174,7 @@ static const u8 device_master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_ {0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED}, /* 9.0.0 Device Master Kek Source. */ {0xCE, 0xFE, 0x41, 0x0F, 0x46, 0x9A, 0x30, 0xD6, 0xF2, 0xE9, 0x0C, 0x6B, 0xB7, 0x15, 0x91, 0x36}, /* 9.1.0 Device Master Kek Source. */ {0xC2, 0x65, 0x34, 0x6E, 0xC7, 0xC6, 0x5D, 0x97, 0x3E, 0x34, 0x5C, 0x6B, 0xB3, 0x7E, 0xC6, 0xE3}, /* 12.1.0 Device Master Kek Source. */ -}; +}; //!TODO: Update on mkey changes. static const u8 device_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] __attribute__((aligned(4))) = { {0xD6, 0xBD, 0x9F, 0xC6, 0x18, 0x09, 0xE1, 0x96, 0x20, 0x39, 0x60, 0xD2, 0x89, 0x83, 0x31, 0x34}, /* 4.0.0 Device Master Kek Source. */ @@ -183,7 +186,7 @@ static const u8 device_master_kek_sources_dev[KB_FIRMWARE_VERSION_MAX - KB_FIRMW {0x61, 0x6A, 0x88, 0x21, 0xA3, 0x52, 0xB0, 0x19, 0x16, 0x25, 0xA4, 0xE3, 0x4C, 0x54, 0x02, 0x0F}, /* 9.0.0 Device Master Kek Source. */ {0x9D, 0xB1, 0xAE, 0xCB, 0xF6, 0xF6, 0xE3, 0xFE, 0xAB, 0x6F, 0xCB, 0xAF, 0x38, 0x03, 0xFC, 0x7B}, /* 9.1.0 Device Master Kek Source. */ {0xC4, 0xBB, 0xF3, 0x9F, 0xA3, 0xAA, 0x00, 0x99, 0x7C, 0x97, 0xAD, 0x91, 0x8F, 0xE8, 0x45, 0xCB}, /* 12.1.0 Device Master Kek Source. */ -}; +}; //!TODO: Update on mkey changes. // from SPL static const u8 aes_key_generation_source[0x10] __attribute__((aligned(4))) = { diff --git a/source/keys/keys.c b/source/keys/keys.c index 0103c26..e8d8d49 100644 --- a/source/keys/keys.c +++ b/source/keys/keys.c @@ -22,7 +22,7 @@ #include #include #include "../gfx/tui.h" -#include "../hos/pkg1.h" +#include "../hos/hos.h" #include #include #include @@ -78,35 +78,6 @@ static void _get_device_key(u32 ks, key_derivation_ctx_t *keys, void *out_device // titlekey functions static bool _test_key_pair(const void *E, const void *D, const void *N); -static u8 *_read_pkg1(const pkg1_id_t **pkg1_id) { - if (emummc_storage_init_mmc()) { - EPRINTF("Unable to init MMC."); - return NULL; - } - TPRINTFARGS("%kMMC init... ", colors[(color_idx++) % 6]); - - // Read package1. - u8 *pkg1 = (u8 *)malloc(PKG1_MAX_SIZE); - if (!emummc_storage_set_mmc_partition(EMMC_BOOT0)) { - EPRINTF("Unable to set partition."); - return NULL; - } - if (!emummc_storage_read(PKG1_OFFSET / NX_EMMC_BLOCKSIZE, PKG1_MAX_SIZE / NX_EMMC_BLOCKSIZE, pkg1)) { - EPRINTF("Unable to read pkg1."); - return NULL; - } - - u32 pk1_offset = h_cfg.t210b01 ? sizeof(bl_hdr_t210b01_t) : 0; // Skip T210B01 OEM header. - *pkg1_id = pkg1_identify(pkg1 + pk1_offset); - if (!*pkg1_id) { - EPRINTF("Unknown pkg1 version.\n Make sure you have the latest Lockpick_RCM.\n If a new firmware version just came out,\n Lockpick_RCM must be updated.\n Check Github for new release."); - gfx_hexdump(0, pkg1, 0x20); - return NULL; - } - - return pkg1; -} - static void _derive_master_key_mariko(key_derivation_ctx_t *keys, bool is_dev) { // Relies on the SBK being properly set in slot 14 se_aes_crypt_block_ecb(14, DECRYPT, keys->device_key_4x, device_master_key_source_kek_source); @@ -791,12 +762,16 @@ static void _derive_keys() { u32 start_whole_operation_time = get_tmr_us(); - const pkg1_id_t *pkg1_id; - u8 *pkg1 = _read_pkg1(&pkg1_id); - if (!pkg1) { + if (emummc_storage_init_mmc()) { + EPRINTF("Unable to init MMC."); + return; + } + TPRINTFARGS("%kMMC init... ", colors[(color_idx++) % 6]); + + if (!emummc_storage_set_mmc_partition(EMMC_BOOT0)) { + EPRINTF("Unable to set partition."); return; } - free(pkg1); bool is_dev = fuse_read_hw_state() == FUSE_NX_HW_STATE_DEV; diff --git a/source/main.c b/source/main.c index f9f2e19..4487321 100644 --- a/source/main.c +++ b/source/main.c @@ -23,7 +23,6 @@ #include #include #include "gfx/tui.h" -#include "hos/pkg1.h" #include #include #include @@ -300,8 +299,8 @@ power_state_t STATE_REBOOT_RCM = REBOOT_RCM; power_state_t STATE_REBOOT_BYPASS_FUSES = REBOOT_BYPASS_FUSES; ment_t ment_top[] = { - MDEF_HANDLER("Dump from SysNAND | Key generation: unk", dump_sysnand, COLOR_RED), - MDEF_HANDLER("Dump from EmuNAND | Key generation: unk", dump_emunand, COLOR_ORANGE), + MDEF_HANDLER("Dump from SysNAND", dump_sysnand, COLOR_RED), + MDEF_HANDLER("Dump from EmuNAND", dump_emunand, COLOR_ORANGE), MDEF_CAPTION("---------------", COLOR_YELLOW), MDEF_HANDLER("Payloads...", launch_tools, COLOR_GREEN), MDEF_CAPTION("---------------", COLOR_BLUE), @@ -313,42 +312,6 @@ ment_t ment_top[] = { menu_t menu_top = { ment_top, NULL, 0, 0 }; -void _get_key_generations(char *sysnand_label, char *emunand_label) -{ - sdmmc_t sdmmc; - sdmmc_storage_t storage; - sdmmc_storage_init_mmc(&storage, &sdmmc, SDMMC_BUS_WIDTH_8, SDHCI_TIMING_MMC_HS400); - u8 *pkg1 = (u8 *)malloc(PKG1_MAX_SIZE); - sdmmc_storage_set_mmc_partition(&storage, EMMC_BOOT0); - sdmmc_storage_read(&storage, PKG1_OFFSET / NX_EMMC_BLOCKSIZE, PKG1_MAX_SIZE / NX_EMMC_BLOCKSIZE, pkg1); - sdmmc_storage_end(&storage); - - u32 pk1_offset = h_cfg.t210b01 ? sizeof(bl_hdr_t210b01_t) : 0; // Skip T210B01 OEM header. - const pkg1_id_t *pkg1_id = pkg1_identify(pkg1 + pk1_offset); - if (pkg1_id) { - s_printf(sysnand_label + 36, "% 3d", pkg1_id->kb); - ment_top[0].caption = sysnand_label; - if (h_cfg.emummc_force_disable) - { - free(pkg1); - return; - } - } - - emummc_storage_init_mmc(); - memset(pkg1, 0, PKG1_MAX_SIZE); - emummc_storage_set_mmc_partition(EMMC_BOOT0); - emummc_storage_read(PKG1_OFFSET / NX_EMMC_BLOCKSIZE, PKG1_MAX_SIZE / NX_EMMC_BLOCKSIZE, pkg1); - emummc_storage_end(); - - pkg1_id = pkg1_identify(pkg1 + pk1_offset); - if (pkg1_id) { - s_printf(emunand_label + 36, "% 3d", pkg1_id->kb); - free(pkg1); - ment_top[1].caption = emunand_label; - } -} - extern void pivot_stack(u32 stack_top); void ipl_main() @@ -417,9 +380,6 @@ void ipl_main() ment_top[6].data = &STATE_REBOOT_FULL; } - // Update key generations listed in menu. - _get_key_generations((char *)ment_top[0].caption, (char *)ment_top[1].caption); - while (true) tui_do_menu(&menu_top);