diff options
Diffstat (limited to 'utils/nwztools')
-rw-r--r-- | utils/nwztools/upgtools/upgtool.c | 58 |
1 files changed, 26 insertions, 32 deletions
diff --git a/utils/nwztools/upgtools/upgtool.c b/utils/nwztools/upgtools/upgtool.c index 4f8cddad82..65d34ed2ef 100644 --- a/utils/nwztools/upgtools/upgtool.c +++ b/utils/nwztools/upgtools/upgtool.c | |||
@@ -60,12 +60,6 @@ enum keysig_search_method_t g_keysig_search = KEYSIG_SEARCH_NONE; | |||
60 | 60 | ||
61 | static void usage(void); | 61 | static void usage(void); |
62 | 62 | ||
63 | /* key and signature */ | ||
64 | struct nwz_kas_t | ||
65 | { | ||
66 | char kas[NWZ_KAS_SIZE]; | ||
67 | }; | ||
68 | |||
69 | #define HAS_KAS (1 << 0) | 63 | #define HAS_KAS (1 << 0) |
70 | #define HAS_KEY (1 << 1) | 64 | #define HAS_KEY (1 << 1) |
71 | #define HAS_SIG (1 << 2) | 65 | #define HAS_SIG (1 << 2) |
@@ -75,7 +69,7 @@ struct nwz_model_t | |||
75 | { | 69 | { |
76 | const char *model; | 70 | const char *model; |
77 | unsigned flags; | 71 | unsigned flags; |
78 | struct nwz_kas_t kas; | 72 | char kas[NWZ_KAS_SIZE]; /* key and signature */ |
79 | char key[8]; | 73 | char key[8]; |
80 | char sig[8]; | 74 | char sig[8]; |
81 | }; | 75 | }; |
@@ -100,8 +94,8 @@ struct upg_entry_t | |||
100 | 94 | ||
101 | struct nwz_model_t g_model_list[] = | 95 | struct nwz_model_t g_model_list[] = |
102 | { | 96 | { |
103 | { "nwz-e46x", HAS_KAS | HAS_KEY | HAS_SIG | CONFIRMED, {"89d813f8f966efdebd9c9e0ea98156d2"}, "eb4431eb", "4f1d9cac" }, | 97 | { "nwz-e46x", HAS_KAS | HAS_KEY | HAS_SIG | CONFIRMED, "89d813f8f966efdebd9c9e0ea98156d2", "eb4431eb", "4f1d9cac" }, |
104 | { "nwz-a86x", HAS_KAS | HAS_KEY | HAS_SIG | CONFIRMED, {"a7c4af6c28b8900a783f307c1ba538c5"}, "c824e4e2", "7c262bb0" }, | 98 | { "nwz-a86x", HAS_KAS | HAS_KEY | HAS_SIG | CONFIRMED, "a7c4af6c28b8900a783f307c1ba538c5", "c824e4e2", "7c262bb0" }, |
105 | /* The following keys were obtained by brute forcing firmware upgrades, | 99 | /* The following keys were obtained by brute forcing firmware upgrades, |
106 | * someone with a device needs to confirm that they work */ | 100 | * someone with a device needs to confirm that they work */ |
107 | { "nw-a82x", HAS_KEY | HAS_SIG, {""}, "4df06482", "07fa0b6e" }, | 101 | { "nw-a82x", HAS_KEY | HAS_SIG, {""}, "4df06482", "07fa0b6e" }, |
@@ -178,10 +172,10 @@ static int do_upg(void *buf, long size) | |||
178 | return 1; | 172 | return 1; |
179 | } | 173 | } |
180 | 174 | ||
181 | struct nwz_kas_t kas; | 175 | char kas[NWZ_KAS_SIZE]; |
182 | char keysig[NWZ_KEYSIG_SIZE]; | 176 | char keysig[NWZ_KEYSIG_SIZE]; |
183 | 177 | ||
184 | memset(kas.kas, '?', NWZ_KAS_SIZE); | 178 | memset(kas, '?', NWZ_KAS_SIZE); |
185 | memset(keysig, '?', NWZ_KEYSIG_SIZE); | 179 | memset(keysig, '?', NWZ_KEYSIG_SIZE); |
186 | keysig[32] = keysig[41] = keysig[50] = 0; | 180 | keysig[32] = keysig[41] = keysig[50] = 0; |
187 | 181 | ||
@@ -235,7 +229,7 @@ static int do_upg(void *buf, long size) | |||
235 | else | 229 | else |
236 | { | 230 | { |
237 | if(g_model_list[g_model_index].flags & HAS_KAS) | 231 | if(g_model_list[g_model_index].flags & HAS_KAS) |
238 | g_kas = g_model_list[g_model_index].kas.kas; | 232 | g_kas = g_model_list[g_model_index].kas; |
239 | if(g_model_list[g_model_index].flags & HAS_KEY) | 233 | if(g_model_list[g_model_index].flags & HAS_KEY) |
240 | g_key = g_model_list[g_model_index].key; | 234 | g_key = g_model_list[g_model_index].key; |
241 | if(g_model_list[g_model_index].flags & HAS_SIG) | 235 | if(g_model_list[g_model_index].flags & HAS_SIG) |
@@ -270,22 +264,22 @@ static int do_upg(void *buf, long size) | |||
270 | fwp_setkey("ed295076"); | 264 | fwp_setkey("ed295076"); |
271 | if(g_key) | 265 | if(g_key) |
272 | { | 266 | { |
273 | memcpy(kas.kas, g_key, 8); | 267 | memcpy(kas, g_key, 8); |
274 | fwp_crypt(kas.kas, 8, 0); | 268 | fwp_crypt(kas, 8, 0); |
275 | for(int i = 0; i < 8; i++) | 269 | for(int i = 0; i < 8; i++) |
276 | { | 270 | { |
277 | g_kas[2 * i] = hex_digit((kas.kas[i] >> 4) & 0xf); | 271 | g_kas[2 * i] = hex_digit((kas[i] >> 4) & 0xf); |
278 | g_kas[2 * i + 1] = hex_digit(kas.kas[i] & 0xf); | 272 | g_kas[2 * i + 1] = hex_digit(kas[i] & 0xf); |
279 | } | 273 | } |
280 | } | 274 | } |
281 | if(g_sig) | 275 | if(g_sig) |
282 | { | 276 | { |
283 | memcpy(kas.kas + 8, g_sig, 8); | 277 | memcpy(kas + 8, g_sig, 8); |
284 | fwp_crypt(kas.kas + 8, 8, 0); | 278 | fwp_crypt(kas + 8, 8, 0); |
285 | for(int i = 8; i < 16; i++) | 279 | for(int i = 8; i < 16; i++) |
286 | { | 280 | { |
287 | g_kas[2 * i] = hex_digit((kas.kas[i] >> 4) & 0xf); | 281 | g_kas[2 * i] = hex_digit((kas[i] >> 4) & 0xf); |
288 | g_kas[2 * i + 1] = hex_digit(kas.kas[i] & 0xf); | 282 | g_kas[2 * i + 1] = hex_digit(kas[i] & 0xf); |
289 | } | 283 | } |
290 | } | 284 | } |
291 | } | 285 | } |
@@ -429,10 +423,10 @@ static int create_upg(int argc, char **argv) | |||
429 | return 1; | 423 | return 1; |
430 | } | 424 | } |
431 | 425 | ||
432 | struct nwz_kas_t kas; | 426 | char kas[NWZ_KAS_SIZE]; |
433 | char keysig[NWZ_KEYSIG_SIZE]; | 427 | char keysig[NWZ_KEYSIG_SIZE]; |
434 | 428 | ||
435 | memset(kas.kas, '?', NWZ_KAS_SIZE); | 429 | memset(kas, '?', NWZ_KAS_SIZE); |
436 | memset(keysig, '?', NWZ_KEYSIG_SIZE); | 430 | memset(keysig, '?', NWZ_KEYSIG_SIZE); |
437 | keysig[32] = keysig[41] = keysig[50] = 0; | 431 | keysig[32] = keysig[41] = keysig[50] = 0; |
438 | 432 | ||
@@ -473,7 +467,7 @@ static int create_upg(int argc, char **argv) | |||
473 | else if(g_model_index != -1) | 467 | else if(g_model_index != -1) |
474 | { | 468 | { |
475 | if(g_model_list[g_model_index].flags & HAS_KAS) | 469 | if(g_model_list[g_model_index].flags & HAS_KAS) |
476 | g_kas = g_model_list[g_model_index].kas.kas; | 470 | g_kas = g_model_list[g_model_index].kas; |
477 | if(g_model_list[g_model_index].flags & HAS_KEY) | 471 | if(g_model_list[g_model_index].flags & HAS_KEY) |
478 | g_key = g_model_list[g_model_index].key; | 472 | g_key = g_model_list[g_model_index].key; |
479 | if(g_model_list[g_model_index].flags & HAS_SIG) | 473 | if(g_model_list[g_model_index].flags & HAS_SIG) |
@@ -510,19 +504,19 @@ static int create_upg(int argc, char **argv) | |||
510 | { | 504 | { |
511 | g_kas = keysig; | 505 | g_kas = keysig; |
512 | fwp_setkey("ed295076"); | 506 | fwp_setkey("ed295076"); |
513 | memcpy(kas.kas, g_key, 8); | 507 | memcpy(kas, g_key, 8); |
514 | fwp_crypt(kas.kas, 8, 0); | 508 | fwp_crypt(kas, 8, 0); |
515 | for(int i = 0; i < 8; i++) | 509 | for(int i = 0; i < 8; i++) |
516 | { | 510 | { |
517 | g_kas[2 * i] = hex_digit((kas.kas[i] >> 4) & 0xf); | 511 | g_kas[2 * i] = hex_digit((kas[i] >> 4) & 0xf); |
518 | g_kas[2 * i + 1] = hex_digit(kas.kas[i] & 0xf); | 512 | g_kas[2 * i + 1] = hex_digit(kas[i] & 0xf); |
519 | } | 513 | } |
520 | memcpy(kas.kas + 8, g_sig, 8); | 514 | memcpy(kas + 8, g_sig, 8); |
521 | fwp_crypt(kas.kas + 8, 8, 0); | 515 | fwp_crypt(kas + 8, 8, 0); |
522 | for(int i = 8; i < 16; i++) | 516 | for(int i = 8; i < 16; i++) |
523 | { | 517 | { |
524 | g_kas[2 * i] = hex_digit((kas.kas[i] >> 4) & 0xf); | 518 | g_kas[2 * i] = hex_digit((kas[i] >> 4) & 0xf); |
525 | g_kas[2 * i + 1] = hex_digit(kas.kas[i] & 0xf); | 519 | g_kas[2 * i + 1] = hex_digit(kas[i] & 0xf); |
526 | } | 520 | } |
527 | } | 521 | } |
528 | 522 | ||
@@ -733,7 +727,7 @@ int main(int argc, char **argv) | |||
733 | if(g_model_list[i].flags & HAS_KAS) | 727 | if(g_model_list[i].flags & HAS_KAS) |
734 | { | 728 | { |
735 | cprintf(RED, " kas="); | 729 | cprintf(RED, " kas="); |
736 | cprintf(YELLOW, "%."STR(NWZ_KAS_SIZE)"s", g_model_list[i].kas.kas); | 730 | cprintf(YELLOW, "%."STR(NWZ_KAS_SIZE)"s", g_model_list[i].kas); |
737 | } | 731 | } |
738 | if(g_model_list[i].flags & HAS_KEY) | 732 | if(g_model_list[i].flags & HAS_KEY) |
739 | { | 733 | { |