Skip to content

Commit

Permalink
Improvements to KTR firm decryption
Browse files Browse the repository at this point in the history
  • Loading branch information
@AlbertoSONIC
AlbertoSONIC committed Dec 5, 2015
1 parent 378e20b commit a08cfdd
Showing 1 changed file with 19 additions and 9 deletions.
28 changes: 19 additions & 9 deletions rxtools/source/features/firm.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,27 +83,36 @@ static int loadFirm(char *path, UINT *fsz)
return ((FirmHdr *)FIRM_ADDR)->magic == 0x4D524946 ? 0 : -1;
}

static void decryptFirmKtrArm9(void *p)
static int decryptFirmKtrArm9(void *p)
{
uint8_t key[AES_BLOCK_SIZE];
PartitionInfo info;
Arm9Hdr *hdr;
FirmSeg *seg, *btm;

hdr = (void *)(p + ((FirmHdr *)p)->segs[2].offset);
seg = ((FirmHdr *)p)->segs;
for (btm = seg + FIRM_SEG_NUM; seg->isArm11; seg++)
if (seg == btm)
return -1;

hdr = (void *)(p + seg->offset);

info.ctr = hdr->ctr;
info.buffer = (uint8_t *)hdr + 0x800;
info.keyY = hdr->keyY;
info.size = atoi(hdr->size);
info.keyslot = hdr->ext.pad[0] == 0xFFFFFFFF ? 0x15 : 0x16;

use_aeskey(0x11);
if (info.keyslot == 0x16) {
aes_decrypt(hdr->ext.s.keyX_0x16, hdr->ext.s.keyX_0x16, NULL,
1, AES_ECB_DECRYPT_MODE);
setup_aeskeyX(info.keyslot, hdr->ext.s.keyX_0x16);
if (hdr->ext.pad[0] == 0xFFFFFFFF) {
info.keyslot = 0x15;
aes_decrypt(hdr->keyX, key, NULL, 1, AES_ECB_DECRYPT_MODE);
} else {
info.keyslot = 0x16;
aes_decrypt(hdr->ext.s.keyX_0x16, key, NULL, 1, AES_ECB_DECRYPT_MODE);
}

DecryptPartition(&info);
setup_aeskeyX(info.keyslot, key);
return DecryptPartition(&info);
}

uint8_t* decryptFirmTitleNcch(uint8_t* title, size_t *size)
Expand All @@ -125,7 +134,8 @@ uint8_t* decryptFirmTitleNcch(uint8_t* title, size_t *size)
uint8_t* firm = (uint8_t*)(INFO.buffer + header);

if (getMpInfo() == MPINFO_KTR)
decryptFirmKtrArm9(firm);
if (decryptFirmKtrArm9(firm))
return NULL;

return firm;
}
Expand Down

13 comments on commit a08cfdd

@AlbertoSONIC
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

xD

@Syphurith
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AlbertoSONIC @173210 Forgive my using this as a talk place.
IIRC, To achive the firmlaunch of EmuNAND, we must have to redirect the FS calls, and remove the sig-patch. Cause we have no keys to decrypt the process9 inside 9.6 FIRM of N3DS, we can not patch it thus we can not support this FIRM. My question is, if without a sig-patch could it be launched? If so, is it hookable? you may just use the original FIRM to decrypt the process9 and write it to file.
This is just a question.. Yes, i'm being noob again.

@173210
Copy link
Contributor

@173210 173210 commented on a08cfdd Dec 10, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Syphurith The current firmlaunch is supported by replacing our own code which loads the firmware from SDMC and doesn't have signature check.
You cannot launch 9.6 FIRM because 9.2 FIRM can't decrypt it. If you succeeded in launch rxTools with 9.6 FIRM (i.e. you found ARM9 kernel vulnerability available on 9.6), you can decrypt it and launch it with rxTools.

@Syphurith
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@173210 Thanks for reply. I was wondering if the corresponding key is set during the normal code aside with the process9. And .. 1.Process9 of N3DS NATIVE_FIRM 9.6 cann't decrypted by us now. 2.fs, pxi, sm, and other modules are inside ARM11 and all plain without encryption.
I don't expect a full launch, I just wonder if we can have it decrypted by using the code with it in ARM9, and don't need to do a full boot. Eh, just use it for a decryption.
Maybe i've missed something, but still thanks for your answer.

@173210
Copy link
Contributor

@173210 173210 commented on a08cfdd Dec 10, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Syphurith The key is not set on 9.2 normal code.

I just wonder if we can have it decrypted by using the code with it in ARM9
What is "it"?

@Syphurith
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@173210 The It refers to the process9 inside ARM9 section. I doubt if the code that with it would try the decryption. If that is not set even in its normal launch (even partially) then it might be in something related to the system update procedure. And, thanks for clarification.

@MelonGx
Copy link

@MelonGx MelonGx commented on a08cfdd Mar 1, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[For people who still want Tool-enhanced rxTools]
This, Dec.05 (a08cfdd), is the LAST version Generate FAT16 XORPAD works.
All the later versions's Generate FAT16 XORPAD are broken.

@urherenow
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Strange... AuReinand launches 9.6 firm, doesn't it?

@MelonGx
Copy link

@MelonGx MelonGx commented on a08cfdd Mar 1, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@urherenow
Who are you talking with?

@urherenow
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you even read the posts? Lol...

@urherenow
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But I guess other CFWs that launch it require the decrypted firm on SD.

@MelonGx
Copy link

@MelonGx MelonGx commented on a08cfdd Mar 1, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you're not talking to me then none of my business.
I just wondered why you reply this thread since nothing need to discuss.

@Syphurith
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@urherenow @MelonGx Orz. So better tag who you talk to..

Please sign in to comment.