From 638a3909c5050ebf72867e8e141c63f0e8039ef7 Mon Sep 17 00:00:00 2001 From: CTCaer Date: Fri, 17 Jul 2020 18:00:32 +0300 Subject: [PATCH] Refactor various variables and names --- bdk/input/als.c | 3 +- bdk/input/joycon.c | 2 +- bdk/input/touch.c | 2 +- bdk/power/max77620.h | 10 +++--- bdk/soc/clock.c | 2 +- bdk/usb/usb_descriptors.h | 2 +- bootloader/hos/fss.c | 1 + bootloader/hos/hos.c | 50 +++++++++++++++------------ bootloader/hos/hos.h | 8 ++--- bootloader/storage/emummc.c | 2 +- nyx/nyx_gui/frontend/gui_info.c | 15 ++++---- nyx/nyx_gui/hos/hos.c | 61 +++++++++++++-------------------- nyx/nyx_gui/hos/hos.h | 8 ++--- 13 files changed, 82 insertions(+), 84 deletions(-) diff --git a/bdk/input/als.c b/bdk/input/als.c index 3f59657..82a4a34 100644 --- a/bdk/input/als.c +++ b/bdk/input/als.c @@ -102,7 +102,8 @@ u8 als_init(als_table_t *als_val) i2c_init(I2C_2); max77620_regulator_set_volt_and_flags(REGULATOR_LDO6, 2900000, MAX77620_POWER_MODE_NORMAL); - i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_LDO6_CFG2, 0xD8 | MAX77620_LDO_CFG2_ADE_MASK); + i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_LDO6_CFG2, + (MAX77620_POWER_MODE_NORMAL << MAX77620_LDO_POWER_MODE_SHIFT | (3 << 3) | MAX77620_LDO_CFG2_ADE_ENABLE)); u8 id = i2c_recv_byte(I2C_2, BH1730_I2C_ADDR, BH1730_ADDR(0x12)); i2c_send_byte(I2C_2, BH1730_I2C_ADDR, BH1730_SPEC(BH1730_SPECCMD_RESET), 0); diff --git a/bdk/input/joycon.c b/bdk/input/joycon.c index 2db1aa6..14fc9ac 100644 --- a/bdk/input/joycon.c +++ b/bdk/input/joycon.c @@ -206,7 +206,7 @@ static u16 jc_packet_add_uart_hdr(jc_wired_hdr_t *out, u8 wired_cmd, u8 *data, u out->uart_hdr.magic[1] = 0x01; out->uart_hdr.magic[2] = 0x3; - out->uart_hdr.total_size_lsb = 7; + out->uart_hdr.total_size_lsb = sizeof(jc_wired_hdr_t) - sizeof(jc_uart_hdr_t); out->uart_hdr.total_size_msb = 0; out->cmd = wired_cmd; diff --git a/bdk/input/touch.c b/bdk/input/touch.c index eef61ec..f24b53a 100644 --- a/bdk/input/touch.c +++ b/bdk/input/touch.c @@ -361,7 +361,7 @@ int touch_power_on() // Enables LDO6 for touchscreen VDD/AVDD supply max77620_regulator_set_volt_and_flags(REGULATOR_LDO6, 2900000, MAX77620_POWER_MODE_NORMAL); i2c_send_byte(I2C_5, MAX77620_I2C_ADDR, MAX77620_REG_LDO6_CFG2, - MAX77620_LDO_CFG2_ADE_ENABLE | (3 << 3) | (MAX77620_POWER_MODE_NORMAL << MAX77620_LDO_POWER_MODE_SHIFT)); + (MAX77620_POWER_MODE_NORMAL << MAX77620_LDO_POWER_MODE_SHIFT | (3 << 3) | MAX77620_LDO_CFG2_ADE_ENABLE)); // Configure touchscreen GPIO. PINMUX_AUX(PINMUX_AUX_DAP4_SCLK) = PINMUX_PULL_DOWN | 1; diff --git a/bdk/power/max77620.h b/bdk/power/max77620.h index 26ea855..6b20250 100644 --- a/bdk/power/max77620.h +++ b/bdk/power/max77620.h @@ -108,11 +108,11 @@ #define MAX77620_LDO_VOLT_MASK 0x3F #define MAX77620_REG_DVSSD0 0x1B #define MAX77620_REG_DVSSD1 0x1C -#define MAX77620_REG_SD0_CFG 0x1D -#define MAX77620_REG_SD1_CFG 0x1E -#define MAX77620_REG_SD2_CFG 0x1F -#define MAX77620_REG_SD3_CFG 0x20 -#define MAX77620_REG_SD4_CFG 0x21 +#define MAX77620_REG_SD0_CFG 0x1D // SD CNFG1. +#define MAX77620_REG_SD1_CFG 0x1E // SD CNFG1. +#define MAX77620_REG_SD2_CFG 0x1F // SD CNFG1. +#define MAX77620_REG_SD3_CFG 0x20 // SD CNFG1. +#define MAX77620_REG_SD4_CFG 0x21 // SD CNFG1. #define MAX77620_REG_SD_CFG2 0x22 #define MAX77620_REG_LDO0_CFG 0x23 #define MAX77620_REG_LDO0_CFG2 0x24 diff --git a/bdk/soc/clock.c b/bdk/soc/clock.c index 7ed36fb..94146f2 100644 --- a/bdk/soc/clock.c +++ b/bdk/soc/clock.c @@ -650,7 +650,7 @@ void clock_sdmmc_get_card_clock_div(u32 *pclock, u16 *pdivisor, u32 type) *pclock = 40800; *pdivisor = 1; break; - case SDHCI_TIMING_MMC_DDR52: // Actual IO Freq: 49.92 MHz. + case SDHCI_TIMING_MMC_HS102: // Actual IO Freq: 99.84 MHz. *pclock = 200000; *pdivisor = 2; break; diff --git a/bdk/usb/usb_descriptors.h b/bdk/usb/usb_descriptors.h index 74556f8..b57e41b 100644 --- a/bdk/usb/usb_descriptors.h +++ b/bdk/usb/usb_descriptors.h @@ -369,7 +369,7 @@ usb_dev_bot_t usb_device_binary_object_descriptor = .wU2DevExitLat = 0 }; -u8 usb_vendor_string_descriptor_ums[32] = +u8 usb_vendor_string_descriptor_ums[32] = { 26, 0x03, 'N', 0, 'y', 0, 'x', 0, ' ', 0, 'U', 0, 'S', 0, 'B', 0, ' ', 0, diff --git a/bootloader/hos/fss.c b/bootloader/hos/fss.c index 028027b..8813591 100644 --- a/bootloader/hos/fss.c +++ b/bootloader/hos/fss.c @@ -111,6 +111,7 @@ int parse_fss(launch_ctxt_t *ctxt, const char *path, fss0_sept_t *sept_ctxt) bool stock = false; int sept_used = 0; + // Skip if stock and Exosphere and warmboot are not needed. if (!sept_ctxt) { LIST_FOREACH_ENTRY(ini_kv_t, kv, &ctxt->cfg->kvs, link) diff --git a/bootloader/hos/hos.c b/bootloader/hos/hos.c index 362fb04..4173f38 100644 --- a/bootloader/hos/hos.c +++ b/bootloader/hos/hos.c @@ -59,6 +59,9 @@ extern hekate_config h_cfg; #define PKG2_LOAD_ADDR 0xA9800000 +#define SECMON_BCT_CFG_ADDR 0x4003D000 +#define SECMON6_BCT_CFG_ADDR 0x4003F800 + // Secmon mailbox. #define SECMON_MAILBOX_ADDR 0x40002E00 #define SECMON7_MAILBOX_ADDR 0x40000000 @@ -87,21 +90,21 @@ static const u8 cmac_keyseed[0x10] = static const u8 master_keyseed_retail[0x10] = { 0xD8, 0xA2, 0x41, 0x0A, 0xC6, 0xC5, 0x90, 0x01, 0xC6, 0x1D, 0x6A, 0x26, 0x7C, 0x51, 0x3F, 0x3C }; -static const u8 console_keyseed[0x10] = - { 0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78 }; - -const u8 package2_keyseed[0x10] = - { 0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7 }; - static const u8 master_keyseed_4xx_5xx_610[0x10] = { 0x2D, 0xC1, 0xF4, 0x8D, 0xF3, 0x5B, 0x69, 0x33, 0x42, 0x10, 0xAC, 0x65, 0xDA, 0x90, 0x46, 0x66 }; static const u8 master_keyseed_620[0x10] = { 0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A }; +static const u8 console_keyseed[0x10] = + { 0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78 }; + static const u8 console_keyseed_4xx_5xx[0x10] = { 0x0C, 0x91, 0x09, 0xDB, 0x93, 0x93, 0x07, 0x81, 0x07, 0x3C, 0xC4, 0x16, 0x22, 0x7C, 0x6C, 0x28 }; +const u8 package2_keyseed[0x10] = + { 0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7 }; + static void _hos_crit_error(const char *text) { gfx_con.mute = false; @@ -214,7 +217,7 @@ void hos_eks_get() goto out; // Decrypt EKS blob. - hos_eks_mbr_t *eks = (hos_eks_mbr_t *)(mbr + 0x60); + hos_eks_mbr_t *eks = (hos_eks_mbr_t *)(mbr + 0x80); se_aes_crypt_ecb(14, 0, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); // Check if valid and for this unit. @@ -292,7 +295,7 @@ void hos_eks_save(u32 kb) se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); // Write EKS blob to SD. - memcpy(mbr + 0x60, eks, sizeof(hos_eks_mbr_t)); + memcpy(mbr + 0x80, eks, sizeof(hos_eks_mbr_t)); hos_eks_rw_try(mbr, true); @@ -329,7 +332,7 @@ void hos_eks_clear(u32 kb) se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); // Write EKS blob to SD. - memcpy(mbr + 0x60, eks, sizeof(hos_eks_mbr_t)); + memcpy(mbr + 0x80, eks, sizeof(hos_eks_mbr_t)); hos_eks_rw_try(mbr, true); EMC(EMC_SCRATCH0) &= ~EMC_SEPT_RUN; @@ -552,7 +555,7 @@ static int _read_emmc_pkg1(launch_ctxt_t *ctxt) (emu_cfg.enabled && !h_cfg.emummc_force_disable) ? "\nOr emuMMC corrupt!" : ""); return 0; } - gfx_printf("Identified pkg1 and Keyblob %d\n\n", ctxt->pkg1_id->kb); + gfx_printf("Identified pkg1 and mkey %d\n\n", ctxt->pkg1_id->kb); // Read the correct keyblob. ctxt->keyblob = (u8 *)calloc(NX_EMMC_BLOCKSIZE, 1); @@ -695,8 +698,10 @@ int hos_launch(ini_sec_t *cfg) goto error; } + bool emummc_enabled = emu_cfg.enabled && !h_cfg.emummc_force_disable; + // Enable emummc patching. - if (emu_cfg.enabled && !h_cfg.emummc_force_disable) + if (emummc_enabled) { if (ctxt.stock) { @@ -721,7 +726,7 @@ int hos_launch(ini_sec_t *cfg) if ((h_cfg.autonogc && ((!(fuses & ~0xF) && (kb >= KB_FIRMWARE_VERSION_400)) || // LAFW v2. (!(fuses & ~0x3FF) && (kb >= KB_FIRMWARE_VERSION_900)))) // LAFW v3. - || ((emu_cfg.enabled && !h_cfg.emummc_force_disable) && + || ((emummc_enabled) && ((fuses & 0x400) && (kb <= KB_FIRMWARE_VERSION_810)))) config_kip1patch(&ctxt, "nogc"); } @@ -763,7 +768,7 @@ int hos_launch(ini_sec_t *cfg) if (kb <= KB_FIRMWARE_VERSION_600) pkg1_decrypt(ctxt.pkg1_id, ctxt.pkg1); - if (kb <= KB_FIRMWARE_VERSION_620 && !(emu_cfg.enabled && !h_cfg.emummc_force_disable)) + if (kb <= KB_FIRMWARE_VERSION_620 && !emummc_enabled) { pkg1_unpack((void *)ctxt.pkg1_id->warmboot_base, (void *)ctxt.pkg1_id->secmon_base, NULL, ctxt.pkg1_id, ctxt.pkg1); gfx_puts("Decrypted & unpacked pkg1\n"); @@ -780,6 +785,7 @@ int hos_launch(ini_sec_t *cfg) memcpy((void *)warmboot_base, ctxt.warmboot, ctxt.warmboot_size); else { + // Patch warmboot on T210 to allow downgrading. if (kb >= KB_FIRMWARE_VERSION_700) { _hos_crit_error("No warmboot provided!"); @@ -795,7 +801,7 @@ int hos_launch(ini_sec_t *cfg) if (kb <= KB_FIRMWARE_VERSION_301) PMC(APBDEV_PMC_SCRATCH1) = warmboot_base; - // Replace 'SecureMonitor' if requested. + // Replace 'SecureMonitor' if requested or patch Pkg2 checks if needed. if (ctxt.secmon) memcpy((void *)secmon_base, ctxt.secmon, ctxt.secmon_size); else if (ctxt.pkg1_id->secmon_patchset) @@ -853,8 +859,8 @@ int hos_launch(ini_sec_t *cfg) if (!ctxt.stock && (ctxt.svcperm || ctxt.debugmode || ctxt.atmosphere)) { - u8 kernel_hash[0x20]; // Hash only Kernel when it embeds INI1. + u8 kernel_hash[0x20]; if (!ctxt.new_pkg2) se_calc_sha256_oneshot(kernel_hash, ctxt.kernel, ctxt.kernel_size); else @@ -976,15 +982,15 @@ int hos_launch(ini_sec_t *cfg) // Clear BCT area for retail units and copy it over if dev unit. if (kb <= KB_FIRMWARE_VERSION_500 && !exo_new) { - memset((void *)0x4003D000, 0, 0x3000); + memset((void *)SECMON_BCT_CFG_ADDR, 0, 0x3000); if ((fuse_read_odm(4) & 3) == 3) - memcpy((void *)0x4003D000, bootConfigBuf, 0x1000); + memcpy((void *)SECMON_BCT_CFG_ADDR, bootConfigBuf, 0x1000); } else { - memset((void *)0x4003F800, 0, 0x800); + memset((void *)SECMON6_BCT_CFG_ADDR, 0, 0x800); if ((fuse_read_odm(4) & 3) == 3) - memcpy((void *)0x4003F800, bootConfigBuf, 0x800); + memcpy((void *)SECMON6_BCT_CFG_ADDR, bootConfigBuf, 0x800); } free(bootConfigBuf); @@ -1043,13 +1049,15 @@ int hos_launch(ini_sec_t *cfg) // emuMMC: Some cards (Sandisk U1), do not like a fast power cycle. Wait min 100ms. sdmmc_storage_init_wait_sd(); - // Wait for secmon to get ready. + // Launch secmon. if (smmu_is_used()) smmu_exit(); else ccplex_boot_cpu0(secmon_base); + + // Wait for secmon to get ready. while (!secmon_mailbox->out) - ; // A usleep(1) only works when in IRAM or with a trained DRAM. + ; // Signal pkg2 ready and continue boot. secmon_mailbox->in = bootStatePkg2Continue; diff --git a/bootloader/hos/hos.h b/bootloader/hos/hos.h index 4ad8747..59f130f 100644 --- a/bootloader/hos/hos.h +++ b/bootloader/hos/hos.h @@ -66,17 +66,17 @@ typedef struct _hos_eks_bis_keys_t typedef struct _hos_eks_mbr_t { u32 magic; - u8 enabled[6]; + u8 enabled[5]; u8 enabled_bis; - u8 rsvd; + u8 rsvd[2]; u32 sbk_low; u8 dkg[0x10]; u8 dkk[0x10]; - hos_eks_keys_t keys[6]; + hos_eks_keys_t keys[5]; hos_eks_bis_keys_t bis_keys[3]; } hos_eks_mbr_t; -static_assert(sizeof(hos_eks_mbr_t) == 336, "HOS EKS size is wrong!"); +static_assert(sizeof(hos_eks_mbr_t) == 304, "HOS EKS size is wrong!"); typedef struct _launch_ctxt_t { diff --git a/bootloader/storage/emummc.c b/bootloader/storage/emummc.c index 71d62b8..baa4560 100644 --- a/bootloader/storage/emummc.c +++ b/bootloader/storage/emummc.c @@ -136,7 +136,7 @@ int emummc_storage_init_mmc(sdmmc_storage_t *storage, sdmmc_t *sdmmc) FILINFO fno; emu_cfg.active_part = 0; - // Always init eMMC even when in emuMMC. eMMC is needed from theh emuMMC driver anyway. + // Always init eMMC even when in emuMMC. eMMC is needed from the emuMMC driver anyway. if (!sdmmc_storage_init_mmc(storage, sdmmc, SDMMC_BUS_WIDTH_8, SDHCI_TIMING_MMC_HS400)) return 2; diff --git a/nyx/nyx_gui/frontend/gui_info.c b/nyx/nyx_gui/frontend/gui_info.c index 0768b00..a4de3f4 100644 --- a/nyx/nyx_gui/frontend/gui_info.c +++ b/nyx/nyx_gui/frontend/gui_info.c @@ -272,6 +272,7 @@ static lv_res_t _create_mbox_cal0(lv_obj_t *btn) lv_obj_set_width(lb_desc, LV_HOR_RES / 9 * 3); // Read package1. + u8 kb = 0; char *build_date = malloc(32); u8 *pkg1 = (u8 *)malloc(0x40000); sdmmc_storage_init_mmc(&emmc_storage, &emmc_sdmmc, SDMMC_BUS_WIDTH_8, SDHCI_TIMING_MMC_HS400); @@ -293,6 +294,8 @@ static lv_res_t _create_mbox_cal0(lv_obj_t *btn) goto out; } + kb = pkg1_id->kb; + tsec_ctxt_t tsec_ctxt; tsec_ctxt.fw = (u8 *)pkg1 + pkg1_id->tsec_off; tsec_ctxt.pkg1 = pkg1; @@ -301,13 +304,13 @@ static lv_res_t _create_mbox_cal0(lv_obj_t *btn) // Get keys. hos_eks_get(); - if (pkg1_id->kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run) + if (kb >= KB_FIRMWARE_VERSION_700 && !h_cfg.sept_run) { u32 key_idx = 0; - if (pkg1_id->kb >= KB_FIRMWARE_VERSION_810) + if (kb >= KB_FIRMWARE_VERSION_810) key_idx = 1; - if (h_cfg.eks && h_cfg.eks->enabled[key_idx] >= pkg1_id->kb) + if (h_cfg.eks && h_cfg.eks->enabled[key_idx] >= kb) h_cfg.sept_run = true; else { @@ -315,7 +318,7 @@ static lv_res_t _create_mbox_cal0(lv_obj_t *btn) b_cfg->autoboot_list = 0; b_cfg->extra_cfg = EXTRA_CFG_NYX_BIS; - if (!reboot_to_sept((u8 *)tsec_ctxt.fw, pkg1_id->kb)) + if (!reboot_to_sept((u8 *)tsec_ctxt.fw, kb)) { lv_label_set_text(lb_desc, "#FFDD00 Failed to run sept#\n"); goto out; @@ -325,10 +328,10 @@ static lv_res_t _create_mbox_cal0(lv_obj_t *btn) // Read the correct keyblob. u8 *keyblob = (u8 *)calloc(NX_EMMC_BLOCKSIZE, 1); - sdmmc_storage_read(&emmc_storage, 0x180000 / NX_EMMC_BLOCKSIZE + pkg1_id->kb, 1, keyblob); + sdmmc_storage_read(&emmc_storage, 0x180000 / NX_EMMC_BLOCKSIZE + kb, 1, keyblob); // Generate BIS keys - hos_bis_keygen(keyblob, pkg1_id->kb, &tsec_ctxt); + hos_bis_keygen(keyblob, kb, &tsec_ctxt); free(keyblob); diff --git a/nyx/nyx_gui/hos/hos.c b/nyx/nyx_gui/hos/hos.c index 7fec4db..073c8f7 100644 --- a/nyx/nyx_gui/hos/hos.c +++ b/nyx/nyx_gui/hos/hos.c @@ -45,23 +45,6 @@ extern hekate_config h_cfg; static u8 *bis_keys = NULL; -//#define DPRINTF(...) gfx_printf(__VA_ARGS__) -#define DPRINTF(...) - -#define PKG2_LOAD_ADDR 0xA9800000 - - // Secmon mailbox. -#define SECMON_MB_ADDR 0x40002EF8 -#define SECMON7_MB_ADDR 0x400000F8 -typedef struct _secmon_mailbox_t -{ - // < 4.0.0 Signals - 0: Not ready, 1: BCT ready, 2: DRAM and pkg2 ready, 3: Continue boot. - // >= 4.0.0 Signals - 0: Not ready, 1: BCT ready, 2: DRAM ready, 4: pkg2 ready and continue boot. - u32 in; - // Non-zero: Secmon ready. - u32 out; -} secmon_mailbox_t; - static const u8 keyblob_keyseeds[][0x10] = { { 0xDF, 0x20, 0x6F, 0x59, 0x44, 0x54, 0xEF, 0xDC, 0x70, 0x74, 0x48, 0x3B, 0x0D, 0xED, 0x9F, 0xD3 }, // 1.0.0. { 0x0C, 0x25, 0x61, 0x5D, 0x68, 0x4C, 0xEB, 0x42, 0x1C, 0x23, 0x79, 0xEA, 0x82, 0x25, 0x12, 0xAC }, // 3.0.0. @@ -77,21 +60,21 @@ static const u8 cmac_keyseed[0x10] = static const u8 master_keyseed_retail[0x10] = { 0xD8, 0xA2, 0x41, 0x0A, 0xC6, 0xC5, 0x90, 0x01, 0xC6, 0x1D, 0x6A, 0x26, 0x7C, 0x51, 0x3F, 0x3C }; -static const u8 console_keyseed[0x10] = - { 0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78 }; - -const u8 package2_keyseed[0x10] = - { 0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7 }; - static const u8 master_keyseed_4xx_5xx_610[0x10] = { 0x2D, 0xC1, 0xF4, 0x8D, 0xF3, 0x5B, 0x69, 0x33, 0x42, 0x10, 0xAC, 0x65, 0xDA, 0x90, 0x46, 0x66 }; static const u8 master_keyseed_620[0x10] = { 0x37, 0x4B, 0x77, 0x29, 0x59, 0xB4, 0x04, 0x30, 0x81, 0xF6, 0xE5, 0x8C, 0x6D, 0x36, 0x17, 0x9A }; +static const u8 console_keyseed[0x10] = + { 0x4F, 0x02, 0x5F, 0x0E, 0xB6, 0x6D, 0x11, 0x0E, 0xDC, 0x32, 0x7D, 0x41, 0x86, 0xC2, 0xF4, 0x78 }; + static const u8 console_keyseed_4xx_5xx[0x10] = { 0x0C, 0x91, 0x09, 0xDB, 0x93, 0x93, 0x07, 0x81, 0x07, 0x3C, 0xC4, 0x16, 0x22, 0x7C, 0x6C, 0x28 }; +const u8 package2_keyseed[0x10] = + { 0xFB, 0x8B, 0x6A, 0x9C, 0x79, 0x00, 0xC8, 0x49, 0xEF, 0xD2, 0x4D, 0x85, 0x4D, 0x30, 0xA0, 0xC7 }; + static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX + 1][0x10] = { { 0x0C, 0xF0, 0x59, 0xAC, 0x85, 0xF6, 0x26, 0x65, 0xE1, 0xE9, 0x19, 0x55, 0xE6, 0xF2, 0x67, 0x3D }, // Zeroes encrypted with mkey 00. { 0x29, 0x4C, 0x04, 0xC8, 0xEB, 0x10, 0xED, 0x9D, 0x51, 0x64, 0x97, 0xFB, 0xF3, 0x4D, 0x50, 0xDD }, // Mkey 00 encrypted with mkey 01. @@ -106,7 +89,7 @@ static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX + 1][0x10] = { { 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A }, // Mkey 09 encrypted with mkey 10. }; -static const u8 new_console_keyseed_4xx[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] = { +static const u8 new_console_keyseed[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] = { { 0x8B, 0x4E, 0x1C, 0x22, 0x42, 0x07, 0xC8, 0x73, 0x56, 0x94, 0x08, 0x8B, 0xCC, 0x47, 0x0F, 0x5D }, // 4.x New Device Key Source. { 0x6C, 0xEF, 0xC6, 0x27, 0x8B, 0xEC, 0x8A, 0x91, 0x99, 0xAB, 0x24, 0xAC, 0x4F, 0x1C, 0x8F, 0x1C }, // 5.x New Device Key Source. { 0x70, 0x08, 0x1B, 0x97, 0x44, 0x64, 0xF8, 0x91, 0x54, 0x9D, 0xC6, 0x84, 0x8F, 0x1A, 0xB2, 0xE4 }, // 6.x New Device Key Source. @@ -117,7 +100,7 @@ static const u8 new_console_keyseed_4xx[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VE { 0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94 }, // 9.1.0 New Device Key Source. }; -static const u8 new_console_keyseed[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] = { +static const u8 new_console_kekseed[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] = { { 0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D }, // 4.x New Device Keygen Source. { 0x06, 0x1E, 0x7B, 0xE9, 0x6D, 0x47, 0x8C, 0x77, 0xC5, 0xC8, 0xE7, 0x94, 0x9A, 0xA8, 0x5F, 0x2E }, // 5.x New Device Keygen Source. { 0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF }, // 6.x New Device Keygen Source. @@ -125,7 +108,7 @@ static const u8 new_console_keyseed[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSIO { 0x86, 0x61, 0xB0, 0x16, 0xFA, 0x7A, 0x9A, 0xEA, 0xF6, 0xF5, 0xBE, 0x1A, 0x13, 0x5B, 0x6D, 0x9E }, // 7.0.0 New Device Keygen Source. { 0xA6, 0x81, 0x71, 0xE7, 0xB5, 0x23, 0x74, 0xB0, 0x39, 0x8C, 0xB7, 0xFF, 0xA0, 0x62, 0x9F, 0x8D }, // 8.1.0 New Device Keygen Source. { 0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED }, // 9.0.0 New Device Keygen Source. - { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, // TODO: 9.1.0 New Device Keygen Source to be added on next change-of-keys. */ + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, // TODO: 9.1.0 New Device Keygen Source to be added on next change-of-keys. }; static const u8 gen_keyseed[0x10] = @@ -179,7 +162,7 @@ void hos_eks_get() goto out; // Decrypt EKS blob. - hos_eks_mbr_t *eks = (hos_eks_mbr_t *)(mbr + 0x60); + hos_eks_mbr_t *eks = (hos_eks_mbr_t *)(mbr + 0x80); se_aes_crypt_ecb(14, 0, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); // Check if valid and for this unit. @@ -257,7 +240,7 @@ void hos_eks_save(u32 kb) se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); // Write EKS blob to SD. - memcpy(mbr + 0x60, eks, sizeof(hos_eks_mbr_t)); + memcpy(mbr + 0x80, eks, sizeof(hos_eks_mbr_t)); hos_eks_rw_try(mbr, true); @@ -294,7 +277,7 @@ void hos_eks_clear(u32 kb) se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); // Write EKS blob to SD. - memcpy(mbr + 0x60, eks, sizeof(hos_eks_mbr_t)); + memcpy(mbr + 0x80, eks, sizeof(hos_eks_mbr_t)); hos_eks_rw_try(mbr, true); EMC(EMC_SCRATCH0) &= ~EMC_SEPT_RUN; @@ -353,7 +336,7 @@ void hos_eks_bis_save() se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); // Write EKS blob to SD. - memcpy(mbr + 0x60, eks, sizeof(hos_eks_mbr_t)); + memcpy(mbr + 0x80, eks, sizeof(hos_eks_mbr_t)); hos_eks_rw_try(mbr, true); @@ -576,18 +559,20 @@ int hos_bis_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt) { hos_keygen(keyblob, kb, tsec_ctxt); - if (kb >= KB_FIRMWARE_VERSION_400) - keygen_rev = fuse_read_odm_keygen_rev(); + // New keygen was introduced in 4.0.0. + // We check unconditionally in order to support downgrades. + keygen_rev = fuse_read_odm_keygen_rev(); if (keygen_rev) { + u8 tmp_mkey[0x10]; + u32 mkey_idx = sizeof(mkey_vectors) / 0x10; + u8 mkey_slot = kb >= KB_FIRMWARE_VERSION_700 ? (!h_cfg.aes_slots_new ? 12 : 13) : (kb == KB_FIRMWARE_VERSION_620 ? 9 : 12); + // Keygen revision uses bootloader version, which starts from 1. keygen_rev -= (KB_FIRMWARE_VERSION_400 + 1); // Derive mkey 0. - u8 tmp_mkey[0x10]; - u32 mkey_idx = sizeof(mkey_vectors) / 0x10; - u8 mkey_slot = kb >= KB_FIRMWARE_VERSION_700 ? (!h_cfg.aes_slots_new ? 12 : 13) : (kb == KB_FIRMWARE_VERSION_620 ? 9 : 12); do { mkey_idx--; @@ -602,9 +587,9 @@ int hos_bis_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt) // Derive new device key. se_aes_key_clear(1); - se_aes_unwrap_key(1, 10, new_console_keyseed_4xx[keygen_rev]); // Uses Device key 4x. - se_aes_crypt_ecb(10, 0, tmp_mkey, 0x10, new_console_keyseed_4xx[keygen_rev], 0x10); // Uses Device key 4x. - se_aes_unwrap_key(1, 2, new_console_keyseed[keygen_rev]); // Uses Master Key 0. + se_aes_unwrap_key(1, 10, new_console_keyseed[keygen_rev]); // Uses Device key 4x. + se_aes_crypt_ecb(10, 0, tmp_mkey, 0x10, new_console_keyseed[keygen_rev], 0x10); // Uses Device key 4x. + se_aes_unwrap_key(1, 2, new_console_kekseed[keygen_rev]); // Uses Master Key 0. se_aes_unwrap_key(1, 1, tmp_mkey); console_key_slot = 1; diff --git a/nyx/nyx_gui/hos/hos.h b/nyx/nyx_gui/hos/hos.h index 7d48250..c8830e8 100644 --- a/nyx/nyx_gui/hos/hos.h +++ b/nyx/nyx_gui/hos/hos.h @@ -57,17 +57,17 @@ typedef struct _hos_eks_bis_keys_t typedef struct _hos_eks_mbr_t { u32 magic; - u8 enabled[6]; + u8 enabled[5]; u8 enabled_bis; - u8 rsvd; + u8 rsvd[2]; u32 sbk_low; u8 dkg[0x10]; u8 dkk[0x10]; - hos_eks_keys_t keys[6]; + hos_eks_keys_t keys[5]; hos_eks_bis_keys_t bis_keys[3]; } hos_eks_mbr_t; -static_assert(sizeof(hos_eks_mbr_t) == 336, "HOS EKS size is wrong!"); +static_assert(sizeof(hos_eks_mbr_t) == 304, "HOS EKS size is wrong!"); typedef struct _launch_ctxt_t {