scsi_tools: add support for nvp reading

There is a vendor specific command to read the NVP of the device,
including the KAS. The trick is that the data is randomly
scrambled using a so-called para_noise array of random values.
There seems to be a problem when retrieving large entries (>1000
bytes typically) which causes sg_pt do behave strangely.

Change-Id: Iefa6140df78ab9c7dcf7ac34cb1170979123ecd7

4 files changed, 315 insertions, 7 deletions

diff --git a/utils/nwztools/scsitools/Makefile b/utils/nwztools/scsitools/Makefile
index ed4bc88d0b..f51537fe76 100644
--- a/utils/nwztools/scsitools/Makefile
+++ b/utils/nwztools/scsitools/Makefile
@@ -10,7 +10,7 @@ all: $(BINS)
 %.o: %.c
         $(CC) $(CFLAGS) -c -o $@ $<
 
-scsitool: scsitool.o misc.o
+scsitool: scsitool.o misc.o para_noise.o
         $(LD) -o $@ $^ $(LDFLAGS)
 
 clean:
diff --git a/utils/nwztools/scsitools/para_noise.c b/utils/nwztools/scsitools/para_noise.c
new file mode 100644
index 0000000000..fa1c7f9466
--- /dev/null
+++ b/utils/nwztools/scsitools/para_noise.c
@@ -0,0 +1,90 @@
+/***************************************************************************
+ *             __________               __   ___.
+ *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
+ *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
+ *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
+ *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
+ *                     \/            \/     \/    \/            \/
+ * $Id$
+ *
+ * Copyright (C) 2012 Amaury Pouly
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ****************************************************************************/
+#include "para_noise.h"
+
+uint8_t para_noise[1024] =
+{
+    0x42, 0xF2, 0x50, 0xFC, 0x97, 0xB1, 0x08, 0x0E, 0x49, 0x72, 0x34, 0x6C, 0xA8, 0xAC, 0x06, 0x92,
+    0x6A, 0x57, 0x72, 0x82, 0xB1, 0xDD, 0x5F, 0x58, 0x58, 0x72, 0xD9, 0xDF, 0x67, 0xA6, 0xF7, 0x3D,
+    0x7E, 0x9E, 0x89, 0x95, 0x2D, 0x62, 0x0C, 0x6D, 0xFD, 0xF4, 0x33, 0x54, 0x60, 0xD9, 0x20, 0x9D,
+    0xB1, 0x65, 0xBA, 0x9A, 0x23, 0x01, 0xD5, 0x5F, 0x29, 0x9D, 0xCE, 0x98, 0xB1, 0x53, 0x60, 0xF3,
+    0x8B, 0x9B, 0x09, 0xA4, 0xEB, 0x50, 0x60, 0xE1, 0xC2, 0x43, 0x91, 0xD2, 0xA0, 0xF9, 0x21, 0x5A,
+    0xA7, 0x94, 0xBF, 0x22, 0xF0, 0x19, 0xC7, 0x84, 0xBF, 0xC1, 0x7B, 0x61, 0x45, 0x58, 0xD6, 0x4D,
+    0x72, 0x0C, 0x8E, 0x76, 0x8C, 0xB1, 0x88, 0x09, 0x55, 0x29, 0xF0, 0x7A, 0x4B, 0xE0, 0x66, 0xD9,
+    0x04, 0x0E, 0x00, 0x55, 0x56, 0x0D, 0x71, 0x82, 0xA3, 0x94, 0x87, 0xC0, 0x2E, 0x39, 0x70, 0x9E,
+    0xDC, 0xC3, 0x20, 0x13, 0x8E, 0xCE, 0x69, 0x73, 0xF3, 0x7A, 0x59, 0xA9, 0xBE, 0x41, 0x72, 0x45,
+    0xA9, 0x14, 0xED, 0x68, 0xA6, 0xAC, 0x53, 0xC4, 0x67, 0x26, 0xF0, 0x21, 0x25, 0x5A, 0x9F, 0x76,
+    0x61, 0x02, 0x47, 0x03, 0xA4, 0x86, 0xE4, 0xB3, 0xB0, 0xF7, 0xFA, 0x66, 0x57, 0x3B, 0xA5, 0xD3,
+    0xBC, 0x86, 0x76, 0xFD, 0x74, 0x34, 0x48, 0x3B, 0x1D, 0x36, 0x7E, 0xFD, 0x05, 0xF1, 0xF4, 0x7A,
+    0x73, 0x02, 0xB8, 0xF9, 0xB3, 0x14, 0x63, 0x57, 0x0D, 0x7F, 0xBA, 0x14, 0x1C, 0xAA, 0x06, 0xB6,
+    0xF9, 0xE6, 0x42, 0x6E, 0x26, 0x8F, 0xDC, 0x2E, 0x93, 0xDC, 0x84, 0x3F, 0xC6, 0x67, 0x3A, 0x81,
+    0x4E, 0x35, 0x01, 0x12, 0x47, 0xE0, 0x2F, 0xFE, 0x66, 0x6F, 0xD9, 0x7B, 0xF3, 0x0B, 0x9C, 0x15,
+    0xFF, 0x2F, 0x46, 0x83, 0xAD, 0xA2, 0x08, 0xFF, 0x8B, 0xD2, 0x2E, 0xC6, 0x8A, 0x89, 0x4E, 0x44,
+    0xC4, 0xAE, 0x06, 0x8E, 0x1B, 0x38, 0x62, 0xD9, 0x3C, 0xEC, 0xDE, 0x75, 0xE1, 0x17, 0x12, 0x80,
+    0xF8, 0xE6, 0x4C, 0x56, 0x91, 0x07, 0xF1, 0xE8, 0x0B, 0x1C, 0x12, 0xE3, 0x74, 0x82, 0x95, 0x4E,
+    0xEE, 0x68, 0xB4, 0xE5, 0x8B, 0x5C, 0x11, 0x6D, 0x59, 0x60, 0x9E, 0x3F, 0x48, 0x58, 0x91, 0x52,
+    0xA7, 0xE5, 0x7A, 0x9E, 0xB1, 0x77, 0xF3, 0x42, 0xBB, 0x77, 0x9E, 0xF6, 0x68, 0x26, 0xAB, 0x4F,
+    0x9F, 0xA3, 0x30, 0x13, 0x6D, 0x45, 0x11, 0xF1, 0x2F, 0x13, 0xD5, 0xA0, 0xD3, 0x8A, 0x5C, 0x1F,
+    0x55, 0xEE, 0xE8, 0xB3, 0xF9, 0xD0, 0x98, 0x07, 0x8E, 0x15, 0x00, 0xD5, 0x51, 0x11, 0x2A, 0x46,
+    0xB5, 0x77, 0xCB, 0xA0, 0x65, 0x57, 0x29, 0xEC, 0x0B, 0x24, 0xF0, 0x3D, 0x54, 0x35, 0x8F, 0x2D,
+    0xEC, 0x33, 0xC6, 0x2E, 0x1D, 0xE3, 0x2F, 0xEC, 0x2F, 0xB7, 0x41, 0x0D, 0xB8, 0xA2, 0xDD, 0xAE,
+    0x9A, 0xF8, 0x68, 0x73, 0xFD, 0x42, 0xEE, 0x21, 0x93, 0x87, 0xEA, 0x85, 0x3F, 0xC8, 0x5F, 0x8D,
+    0x09, 0x63, 0xF3, 0x99, 0xD2, 0xD1, 0x3C, 0x9D, 0x1B, 0xC9, 0xA0, 0x79, 0x26, 0x46, 0xFC, 0x50,
+    0xA9, 0xC1, 0xBC, 0x79, 0x8C, 0xEA, 0xE6, 0xB3, 0xAC, 0x86, 0x95, 0x76, 0x0C, 0xB6, 0x94, 0x52,
+    0x91, 0x3F, 0x13, 0x36, 0x2B, 0xAB, 0x08, 0x80, 0x76, 0xD9, 0xE7, 0x85, 0x78, 0xD7, 0x8A, 0x64,
+    0xFD, 0x8B, 0xCE, 0x5F, 0xA9, 0x9A, 0xD2, 0xC3, 0x75, 0x45, 0x83, 0xBF, 0xEB, 0xD0, 0x67, 0xFD,
+    0x99, 0x87, 0x87, 0x31, 0xEC, 0x99, 0x6A, 0x34, 0xFE, 0xE6, 0x68, 0xC5, 0x20, 0x37, 0x1D, 0x7F,
+    0x59, 0x9F, 0x64, 0x28, 0xDA, 0xDF, 0x75, 0xEF, 0x2F, 0xA5, 0x08, 0xD5, 0x20, 0xD4, 0x96, 0x07,
+    0xDB, 0x43, 0x0D, 0xA4, 0xD3, 0xB2, 0xBE, 0xC1, 0x75, 0x59, 0xF2, 0xD0, 0xFB, 0x8B, 0xEA, 0xCC,
+    0x18, 0xAA, 0x3E, 0x54, 0x27, 0xC6, 0xF5, 0x74, 0x45, 0x8D, 0x87, 0x5C, 0x58, 0x4A, 0x3B, 0x01,
+    0x47, 0x11, 0xED, 0x5E, 0x7C, 0xC5, 0xFB, 0x5E, 0xBB, 0xDD, 0x32, 0xEC, 0x8B, 0x23, 0xEC, 0x66,
+    0x90, 0x23, 0x6C, 0x61, 0x8C, 0x78, 0xA8, 0x77, 0x6F, 0x34, 0xC8, 0x3C, 0x01, 0x6D, 0xBA, 0xEB,
+    0xE6, 0xBD, 0x94, 0x31, 0x1D, 0x5B, 0xCA, 0x2E, 0x54, 0xC4, 0x4D, 0x8D, 0xF6, 0x99, 0xE4, 0x0B,
+    0x55, 0x35, 0x81, 0x15, 0x5B, 0xBB, 0xEB, 0xE8, 0x85, 0x23, 0xB9, 0x30, 0x9D, 0x52, 0xEE, 0xC2,
+    0x18, 0xFF, 0x68, 0x59, 0x56, 0x44, 0x56, 0xE0, 0xC2, 0x4D, 0xA9, 0x65, 0x28, 0xD4, 0xE7, 0xC2,
+    0x67, 0x02, 0x63, 0x90, 0x15, 0xB6, 0x08, 0x24, 0xE2, 0x74, 0x8C, 0xAD, 0xF9, 0x66, 0x45, 0x72,
+    0x7D, 0x4B, 0xCA, 0xCD, 0xDF, 0xBC, 0xCF, 0x51, 0x9F, 0x15, 0xED, 0x66, 0x9E, 0x1B, 0xDB, 0xE9,
+    0xA1, 0xBE, 0x30, 0xB7, 0xF9, 0xE8, 0x7A, 0xD9, 0xAE, 0xA2, 0x1A, 0xB6, 0x53, 0x4A, 0x58, 0x8D,
+    0x23, 0xC8, 0xF5, 0x21, 0x13, 0x80, 0xF6, 0xDE, 0xFB, 0xDE, 0xBC, 0xC1, 0x69, 0x28, 0x9D, 0xC0,
+    0xA0, 0x06, 0xDB, 0x4D, 0x35, 0x13, 0x5B, 0x9F, 0x78, 0x59, 0xB5, 0xCF, 0x2E, 0x62, 0x1E, 0x24,
+    0x25, 0x6C, 0x45, 0x1F, 0xC9, 0x98, 0x9B, 0xF8, 0x66, 0x4B, 0x4A, 0xCA, 0xC3, 0xE7, 0x0B, 0x47,
+    0x7C, 0x59, 0x8D, 0x2D, 0xF0, 0x42, 0xA9, 0x3E, 0x46, 0x6E, 0x1E, 0x6D, 0x02, 0x0E, 0x24, 0xC6,
+    0xE7, 0x3D, 0x9D, 0x15, 0xF1, 0x17, 0xF1, 0x0B, 0x80, 0x64, 0x90, 0x3F, 0x1D, 0x0E, 0x9C, 0x23,
+    0x25, 0x46, 0xEE, 0x19, 0x71, 0x59, 0xCA, 0x32, 0x25, 0xAB, 0x5D, 0xD6, 0x7B, 0xA8, 0x65, 0x26,
+    0xEC, 0x50, 0x4A, 0x4A, 0xC4, 0xFB, 0x50, 0x83, 0x6A, 0xBA, 0xC1, 0x4D, 0xBB, 0x2C, 0xF0, 0x4C,
+    0x91, 0x89, 0xCE, 0x43, 0xD8, 0xF5, 0xC2, 0x98, 0xF8, 0x74, 0x02, 0x92, 0x52, 0xB5, 0xAC, 0xA2,
+    0x06, 0xC7, 0x3C, 0x5A, 0x03, 0x00, 0x12, 0x49, 0xD8, 0x98, 0x76, 0x4B, 0xA9, 0x41, 0xBB, 0x65,
+    0xD7, 0x2E, 0xF0, 0x50, 0xE0, 0xE6, 0xDE, 0x18, 0x55, 0xC4, 0x43, 0xB5, 0x41, 0x11, 0xC9, 0xCD,
+    0xCD, 0xF5, 0x17, 0xC9, 0xE9, 0x5E, 0x44, 0x27, 0x25, 0x7E, 0x0C, 0xC7, 0x51, 0xEE, 0xD0, 0x51,
+    0x27, 0xF0, 0x2F, 0x1D, 0xED, 0x17, 0x5B, 0xA7, 0x9A, 0x87, 0x95, 0x78, 0x34, 0x01, 0x1C, 0x7F,
+    0x57, 0xA7, 0xD3, 0xA0, 0xF7, 0x19, 0xED, 0x2F, 0xB9, 0x79, 0xBA, 0x30, 0x8F, 0x1B, 0x36, 0x5A,
+    0x6E, 0xB4, 0xC1, 0x18, 0xED, 0x21, 0x81, 0xCE, 0x32, 0x1D, 0x49, 0x83, 0xF6, 0xCC, 0xB2, 0x06,
+    0x24, 0xB7, 0x22, 0x81, 0xDC, 0x7B, 0xC5, 0xD1, 0xF5, 0xBD, 0x65, 0xF3, 0xBD, 0x41, 0x60, 0x0C,
+    0x71, 0x8C, 0x9B, 0x23, 0x0F, 0xED, 0xE8, 0xA1, 0xB0, 0x08, 0x00, 0x71, 0xC5, 0xBC, 0x41, 0x6E,
+    0x34, 0xC6, 0x04, 0xB6, 0xE5, 0x97, 0x2D, 0x7E, 0x7D, 0x02, 0xED, 0xAF, 0xBE, 0x65, 0xE1, 0xF4,
+    0x99, 0xF8, 0x7A, 0x3A, 0x25, 0xDA, 0x98, 0x6A, 0x3A, 0xC6, 0x51, 0xE0, 0xE8, 0xE6, 0xAF, 0xDD,
+    0xE9, 0x85, 0x2D, 0x81, 0x87, 0x15, 0x7F, 0x28, 0x5A, 0xD8, 0x69, 0xB4, 0xEB, 0xB3, 0xEB, 0x99,
+    0x40, 0x9F, 0xF8, 0x5E, 0xA9, 0x94, 0xEA, 0x74, 0xFD, 0x68, 0x45, 0x27, 0x2B, 0x46, 0xBB, 0x4F,
+    0x7C, 0x28, 0x48, 0x91, 0xB1, 0x2C, 0x9D, 0xF8, 0x42, 0xD8, 0xFB, 0xFA, 0x2F, 0x70, 0x59, 0xC4,
+    0x0A, 0x92, 0x23, 0x70, 0x10, 0xE3, 0x68, 0xF3, 0xFA, 0x5E, 0xB5, 0xE5, 0x85, 0x64, 0xA6, 0xE5,
+    0x74, 0xA6, 0x06, 0xFF, 0xDE, 0x84, 0x23, 0xB7, 0x08, 0x2A, 0xDA, 0xC3, 0x04, 0x80, 0x3F, 0xFE,
+};
+
diff --git a/utils/nwztools/scsitools/para_noise.h b/utils/nwztools/scsitools/para_noise.h
new file mode 100644
index 0000000000..c0f4531ef5
--- /dev/null
+++ b/utils/nwztools/scsitools/para_noise.h
@@ -0,0 +1,28 @@
+/***************************************************************************
+ *             __________               __   ___.
+ *   Open      \______   \ ____   ____ |  | _\_ |__   _______  ___
+ *   Source     |       _//  _ \_/ ___\|  |/ /| __ \ /  _ \  \/  /
+ *   Jukebox    |    |   (  <_> )  \___|    < | \_\ (  <_> > <  <
+ *   Firmware   |____|_  /\____/ \___  >__|_ \|___  /\____/__/\_ \
+ *                     \/            \/     \/    \/            \/
+ * $Id$
+ *
+ * Copyright (C) 2012 Amaury Pouly
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ ****************************************************************************/
+#ifndef __para_noise_h__
+#define __para_noise_h__
+
+#include <stdint.h>
+
+uint8_t para_noise[1024];
+
+#endif /* __para_noise_h__ */
diff --git a/utils/nwztools/scsitools/scsitool.c b/utils/nwztools/scsitools/scsitool.c
index 6848fb90de..97ecee4370 100644
--- a/utils/nwztools/scsitools/scsitool.c
+++ b/utils/nwztools/scsitools/scsitool.c
@@ -35,6 +35,7 @@
 #include <scsi/sg_lib.h>
 #include <scsi/sg_pt.h>
 #include "misc.h"
+#include "para_noise.h"
 
 bool g_debug = false;
 bool g_force = false;
@@ -151,22 +152,27 @@ int do_scsi(uint8_t *cdb, int cdb_size, unsigned flags, void *sense, int *sense_
 
 int do_sense_analysis(int status, uint8_t *sense, int sense_size)
 {
-    cprintf_field("Status:", " "); fflush(stdout);
-    sg_print_scsi_status(status);
-    cprintf_field("\nSense:", " "); fflush(stdout);
-    sg_print_sense(NULL, sense, sense_size, 0);
+    if(status != GOOD || g_debug)
+    {
+        cprintf_field("Status:", " "); fflush(stdout);
+        sg_print_scsi_status(status);
+        cprintf_field("\nSense:", " "); fflush(stdout);
+        sg_print_sense(NULL, sense, sense_size, 0);
+    }
     if(status == GOOD)
         return 0;
     return status;
 }
 
-int do_dnk_cmd(uint32_t cmd, uint8_t sub_cmd, void *buffer, int *buffer_size)
+int do_dnk_cmd(uint32_t cmd, uint8_t sub_cmd, uint16_t arg, void *buffer, int *buffer_size)
 {
     uint8_t cdb[12] = {0xdd, 0, 0, 0, 0, 0, 0, 0xbc, 0, 0, 0, 0};
     cdb[10] = cmd;
     cdb[11] = sub_cmd;
     cdb[8] = (*buffer_size) >> 8;
     cdb[9] = (*buffer_size) & 0xff;
+    cdb[4] = (arg >> 8) & 0xff;
+    cdb[5] = arg & 0xff;
     
     uint8_t sense[32];
     int sense_size = 32;
@@ -242,7 +248,7 @@ int get_dnk_prop(int argc, char **argv)
 
     char *buffer = buffer_alloc(prop.size + 1);
     int buffer_size = prop.size;
-    int ret = do_dnk_cmd(prop.cmd, prop.subcmd, buffer, &buffer_size);
+    int ret = do_dnk_cmd(prop.cmd, prop.subcmd, 0, buffer, &buffer_size);
     if(ret)
         return ret;
     if(buffer_size == 0)
@@ -268,6 +274,189 @@ int get_dnk_prop(int argc, char **argv)
     return 0;
 }
 
+#define NVP_EXACT_LENGTH    (1 << 0)
+#define NVP_STRING          (1 << 1)
+#define NVP_UINT32          (1 << 2)
+
+struct nvp_prop_t
+{
+    const char *name;
+    const char *desc;
+    uint8_t node;
+    int size;
+    unsigned flags;
+};
+
+#define NVP_ENTRY(node, name,desc,size,flag) { name, desc, node, size, flag }
+
+struct nvp_prop_t nvp_prop_list[] =
+{
+    NVP_ENTRY(1, "bti", "boot image", 262144, 0),
+    NVP_ENTRY(2, "hdi", "hold image", 262144, 0),
+    NVP_ENTRY(3, "cng", "aad key", 704, 0),
+    NVP_ENTRY(4, "ser", "serial number", 16, NVP_STRING),
+    NVP_ENTRY(5, "app", "application parameter", 4096, 0),
+    NVP_ENTRY(6, "eri", "update error image", 262144, 0),
+    NVP_ENTRY(7, "dcc", "secure clock", 20, 0),
+    NVP_ENTRY(8, "mdl", "middleware parameter", 8, 0),
+    NVP_ENTRY(9, "fup", "firmware update flag", 4, 0),
+    NVP_ENTRY(10, "bok", "beep ok flag", 4, 0),
+    NVP_ENTRY(11, "shp", "ship information", 32, 0),
+    NVP_ENTRY(12, "dba", "aad icv", 160, 0),
+    NVP_ENTRY(13, "dbv", "empr key", 520, 0),
+    NVP_ENTRY(14, "tr0", "EKB 0", 16384, 0),
+    NVP_ENTRY(15, "tr1", "EKB 1", 16384, 0),
+    NVP_ENTRY(16, "mid", "model id", 64, 0),
+    NVP_ENTRY(17, "tst", "test mode flag", 4, 0),
+    NVP_ENTRY(18, "gty", "getty mode flag", 4, 0),
+    NVP_ENTRY(19, "fui", "update image", 262144, 0),
+    NVP_ENTRY(20, "lbi", "low battery image", 262144, 0),
+    NVP_ENTRY(21, "dor", "key mode (debug/release)", 4, 0),
+    NVP_ENTRY(22, "edw", "quick shutdown flag", 4, 0),
+    NVP_ENTRY(23, "ubp", "u-boot password", 32, 0),
+    NVP_ENTRY(24, "syi", "system information", 4, 0),
+    NVP_ENTRY(25, "exm", "exception monitor mode", 4, 0),
+    NVP_ENTRY(26, "pcd", "product code", 5, 0),
+    NVP_ENTRY(27, "btc", "battery calibration", 4, 0),
+    NVP_ENTRY(28, "rnd", "wmt key", 64, 0),
+    NVP_ENTRY(29, "ufn", "update file name", 8, 0),
+    NVP_ENTRY(30, "sdp", "sound driver parameter", 64, 0),
+    NVP_ENTRY(31, "ncp", "noise cancel driver parameter", 64, 0),
+    NVP_ENTRY(32, "kas", "key and signature", 64, 0),
+    NVP_ENTRY(33, "sfi", "starfish id", 64, 0),
+    NVP_ENTRY(34, "rtc", "rtc alarm", 16, 0),
+    NVP_ENTRY(35, "bpr", "bluetooth address", 2048, 0),
+    NVP_ENTRY(36, "e00", "EMPR  0", 1024, 0),
+    NVP_ENTRY(37, "e01", "EMPR  1", 1024, 0),
+    NVP_ENTRY(38, "e02", "EMPR  2", 1024, 0),
+    NVP_ENTRY(39, "e03", "EMPR  3", 1024, 0),
+    NVP_ENTRY(40, "e04", "EMPR  4", 1024, 0),
+    NVP_ENTRY(41, "e05", "EMPR  5", 1024, 0),
+    NVP_ENTRY(42, "e06", "EMPR  6", 1024, 0),
+    NVP_ENTRY(43, "e07", "EMPR  7", 1024, 0),
+    NVP_ENTRY(44, "e08", "EMPR  8", 1024, 0),
+    NVP_ENTRY(45, "e09", "EMPR  9", 1024, 0),
+    NVP_ENTRY(46, "e10", "EMPR 10", 1024, 0),
+    NVP_ENTRY(47, "e11", "EMPR 11", 1024, 0),
+    NVP_ENTRY(48, "e12", "EMPR 12", 1024, 0),
+    NVP_ENTRY(49, "e13", "EMPR 13", 1024, 0),
+    NVP_ENTRY(50, "e14", "EMPR 14", 1024, 0),
+    NVP_ENTRY(51, "e15", "EMPR 15", 1024, 0),
+    NVP_ENTRY(52, "e16", "EMPR 16", 1024, 0),
+    NVP_ENTRY(53, "e17", "EMPR 17", 1024, 0),
+    NVP_ENTRY(54, "e18", "EMPR 18", 1024, 0),
+    NVP_ENTRY(55, "e19", "EMPR 19", 1024, 0),
+    NVP_ENTRY(56, "e20", "EMPR 20", 1024, 0),
+    NVP_ENTRY(57, "e21", "EMPR 21", 1024, 0),
+    NVP_ENTRY(58, "e22", "EMPR 22", 1024, 0),
+    NVP_ENTRY(59, "e23", "EMPR 23", 1024, 0),
+    NVP_ENTRY(60, "e24", "EMPR 24", 1024, 0),
+    NVP_ENTRY(61, "e25", "EMPR 25", 1024, 0),
+    NVP_ENTRY(62, "e26", "EMPR 26", 1024, 0),
+    NVP_ENTRY(63, "e27", "EMPR 27", 1024, 0),
+    NVP_ENTRY(64, "e28", "EMPR 28", 1024, 0),
+    NVP_ENTRY(65, "e29", "EMPR 29", 1024, 0),
+    NVP_ENTRY(66, "e30", "EMPR 30", 1024, 0),
+    NVP_ENTRY(67, "e31", "EMPR 31", 1024, 0),
+    NVP_ENTRY(68, "clv", "color variation", 4, 0),
+    NVP_ENTRY(69, "slp", "time out to sleep", 4, 0),
+    NVP_ENTRY(70, "ipt", "disable iptable flag", 4, 0),
+    NVP_ENTRY(71, "mtm", "marlin time", 64, 0),
+    NVP_ENTRY(72, "mcr", "marlin crl", 16384, 0),
+    NVP_ENTRY(73, "mdk", "marlin device key", 33024, 0),
+    NVP_ENTRY(74, "muk", "marlin user key", 24576, 0),
+    NVP_ENTRY(75, "pts", "wifi protected setup", 4, 0),
+    NVP_ENTRY(76, "skt", "slacker time", 16, 0),
+    NVP_ENTRY(77, "mac", "wifi mac address", 6, 0),
+    NVP_ENTRY(78, "apd", "application debug mode flag", 4, 0),
+    NVP_ENTRY(79, "blf", "browser log mode flag", 4, 0),
+    NVP_ENTRY(80, "hld", "hold mode", 4, 0),
+    NVP_ENTRY(81, "skd", "slacker id file", 8224, 0),
+    NVP_ENTRY(82, "fmp", "fm parameter", 16, 0),
+    NVP_ENTRY(83, "sps", "speaker ship info", 4, 0),
+    NVP_ENTRY(84, "msc", "mass storage class mode", 4, 0),
+    NVP_ENTRY(85, "vrt", "europe vol regulation flag", 4, 0),
+    NVP_ENTRY(86, "psk", "bluetooth pskey", 512, 0),
+    NVP_ENTRY(87, "bml", "btmw log mode flag", 4, 0),
+    NVP_ENTRY(88, "bfd", "btmw factory scdb", 512, 0),
+    NVP_ENTRY(89, "bfp", "btmw factory pair info", 512, 0),
+};
+
+#define NR_NVP_PROPS   (sizeof(nvp_prop_list) / sizeof(nvp_prop_list[0]))
+
+int get_dnk_nvp(int argc, char **argv)
+{
+    if(argc != 1 && argc != 3)
+    {
+        printf("You must specify a known nvp node or a full node specification:\n");
+        printf("Full usage: <node> <size> <flags>\n");
+        printf("Node usage: <node>\n");
+        printf("Nodes:\n");
+        for(unsigned i = 0; i < NR_NVP_PROPS; i++)
+            printf("  %s\t%s", nvp_prop_list[i].name, nvp_prop_list[i].desc);
+        printf("\n");
+        return 1;
+    }
+
+    struct nvp_prop_t prop;
+    memset(&prop, 0, sizeof(prop));
+    if(argc == 1)
+    {
+        for(unsigned i = 0; i < NR_NVP_PROPS; i++)
+            if(strcmp(nvp_prop_list[i].name, argv[0]) == 0)
+                prop = nvp_prop_list[i];
+        if(prop.name == NULL)
+        {
+            cprintf(GREY, "Unknown node '%s'\n", argv[0]);
+            return 1;
+        }
+    }
+    else
+    {
+        prop.node = strtoul(argv[0], NULL, 0);
+        prop.size = strtoul(argv[1], NULL, 0);
+        prop.flags = strtoul(argv[2], NULL, 0);
+    }
+
+    int buffer_size = prop.size + 4;
+    uint8_t *buffer = buffer_alloc(buffer_size + 1);
+    int ret = do_dnk_cmd(0x23, 10, prop.node, buffer, &buffer_size);
+    if(ret)
+        return ret;
+    if(buffer_size <= 4)
+    {
+        cprintf(GREY, "Device didn't send any data\n");
+        return 1;
+    }
+    if(buffer[0] != 0 || buffer[2] != 0 || buffer[3] != prop.node)
+    {
+        cprintf(GREY, "Device responded with invalid data\n");
+        return 1;
+    }
+
+    for(int i = 4, idx = buffer[1]; i < buffer_size; i++, idx++)
+        buffer[i] ^= para_noise[idx];
+    buffer[buffer_size] = 0;
+    buffer += 4;
+    buffer_size -= 4;
+    if((prop.flags & DNK_EXACT_LENGTH) && buffer_size != prop.size)
+    {
+        cprintf(GREY, "Device didn't send the expected amount of data\n");
+        return 2;
+    }
+    
+    if(prop.flags & DNK_STRING)
+        cprintf_field("Node: ", "%s\n", buffer);
+    else if(prop.flags & DNK_UINT32)
+        cprintf_field("Node: ", "0x%x\n", *(uint32_t *)buffer);
+    else
+    {
+        cprintf(GREEN, "Node:\n");
+        print_hex(buffer, buffer_size);
+    }
+    return 0;
+}
+
 struct dpcc_prop_t
 {
     char *user_name;
@@ -419,6 +608,7 @@ struct cmd_t
 struct cmd_t cmd_list[] =
 {
     { "get_dnk_prop", "Get DNK property", get_dnk_prop },
+    { "get_dnk_nvp", "Get DNK NVP content", get_dnk_nvp },
     { "get_dpcc_prop", "Get DPCC property", get_dpcc_prop },
     { "get_user_time", "Get user time", get_user_time },
     { "get_dev_info", "Get device info", get_dev_info },