From edba8ca9868c101570c32b169aeaa9490063cd80 Mon Sep 17 00:00:00 2001 From: CTCaer Date: Mon, 15 Jun 2020 14:59:45 +0300 Subject: [PATCH] hos: Add BIS keys derivation --- nyx/nyx_gui/hos/hos.c | 295 ++++++++++++++++++++++++++++++++++++++++++ nyx/nyx_gui/hos/hos.h | 4 + 2 files changed, 299 insertions(+) diff --git a/nyx/nyx_gui/hos/hos.c b/nyx/nyx_gui/hos/hos.c index 0151028..6257a6e 100644 --- a/nyx/nyx_gui/hos/hos.c +++ b/nyx/nyx_gui/hos/hos.c @@ -43,6 +43,8 @@ extern hekate_config h_cfg; +static u8 *bis_keys = NULL; + //#define DPRINTF(...) gfx_printf(__VA_ARGS__) #define DPRINTF(...) @@ -90,6 +92,63 @@ static const u8 master_keyseed_620[0x10] = static const u8 console_keyseed_4xx_5xx[0x10] = { 0x0C, 0x91, 0x09, 0xDB, 0x93, 0x93, 0x07, 0x81, 0x07, 0x3C, 0xC4, 0x16, 0x22, 0x7C, 0x6C, 0x28 }; +static const u8 mkey_vectors[KB_FIRMWARE_VERSION_MAX + 1][0x10] = { + { 0x0C, 0xF0, 0x59, 0xAC, 0x85, 0xF6, 0x26, 0x65, 0xE1, 0xE9, 0x19, 0x55, 0xE6, 0xF2, 0x67, 0x3D }, // Zeroes encrypted with mkey 00. + { 0x29, 0x4C, 0x04, 0xC8, 0xEB, 0x10, 0xED, 0x9D, 0x51, 0x64, 0x97, 0xFB, 0xF3, 0x4D, 0x50, 0xDD }, // Mkey 00 encrypted with mkey 01. + { 0xDE, 0xCF, 0xEB, 0xEB, 0x10, 0xAE, 0x74, 0xD8, 0xAD, 0x7C, 0xF4, 0x9E, 0x62, 0xE0, 0xE8, 0x72 }, // Mkey 01 encrypted with mkey 02. + { 0x0A, 0x0D, 0xDF, 0x34, 0x22, 0x06, 0x6C, 0xA4, 0xE6, 0xB1, 0xEC, 0x71, 0x85, 0xCA, 0x4E, 0x07 }, // Mkey 02 encrypted with mkey 03. + { 0x6E, 0x7D, 0x2D, 0xC3, 0x0F, 0x59, 0xC8, 0xFA, 0x87, 0xA8, 0x2E, 0xD5, 0x89, 0x5E, 0xF3, 0xE9 }, // Mkey 03 encrypted with mkey 04. + { 0xEB, 0xF5, 0x6F, 0x83, 0x61, 0x9E, 0xF8, 0xFA, 0xE0, 0x87, 0xD7, 0xA1, 0x4E, 0x25, 0x36, 0xEE }, // Mkey 04 encrypted with mkey 05. + { 0x1E, 0x1E, 0x22, 0xC0, 0x5A, 0x33, 0x3C, 0xB9, 0x0B, 0xA9, 0x03, 0x04, 0xBA, 0xDB, 0x07, 0x57 }, // Mkey 05 encrypted with mkey 06. + { 0xA4, 0xD4, 0x52, 0x6F, 0xD1, 0xE4, 0x36, 0xAA, 0x9F, 0xCB, 0x61, 0x27, 0x1C, 0x67, 0x65, 0x1F }, // Mkey 06 encrypted with mkey 07. + { 0xEA, 0x60, 0xB3, 0xEA, 0xCE, 0x8F, 0x24, 0x46, 0x7D, 0x33, 0x9C, 0xD1, 0xBC, 0x24, 0x98, 0x29 }, // Mkey 07 encrypted with mkey 08. + { 0x4D, 0xD9, 0x98, 0x42, 0x45, 0x0D, 0xB1, 0x3C, 0x52, 0x0C, 0x9A, 0x44, 0xBB, 0xAD, 0xAF, 0x80 }, // Mkey 08 encrypted with mkey 09. + { 0xB8, 0x96, 0x9E, 0x4A, 0x00, 0x0D, 0xD6, 0x28, 0xB3, 0xD1, 0xDB, 0x68, 0x5F, 0xFB, 0xE1, 0x2A }, // Mkey 09 encrypted with mkey 10. +}; + +static const u8 new_console_keyseed_4xx[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] = { + { 0x8B, 0x4E, 0x1C, 0x22, 0x42, 0x07, 0xC8, 0x73, 0x56, 0x94, 0x08, 0x8B, 0xCC, 0x47, 0x0F, 0x5D }, // 4.x New Device Key Source. + { 0x6C, 0xEF, 0xC6, 0x27, 0x8B, 0xEC, 0x8A, 0x91, 0x99, 0xAB, 0x24, 0xAC, 0x4F, 0x1C, 0x8F, 0x1C }, // 5.x New Device Key Source. + { 0x70, 0x08, 0x1B, 0x97, 0x44, 0x64, 0xF8, 0x91, 0x54, 0x9D, 0xC6, 0x84, 0x8F, 0x1A, 0xB2, 0xE4 }, // 6.x New Device Key Source. + { 0x8E, 0x09, 0x1F, 0x7A, 0xBB, 0xCA, 0x6A, 0xFB, 0xB8, 0x9B, 0xD5, 0xC1, 0x25, 0x9C, 0xA9, 0x17 }, // 6.2.0 New Device Key Source. + { 0x8F, 0x77, 0x5A, 0x96, 0xB0, 0x94, 0xFD, 0x8D, 0x28, 0xE4, 0x19, 0xC8, 0x16, 0x1C, 0xDB, 0x3D }, // 7.0.0 New Device Key Source. + { 0x67, 0x62, 0xD4, 0x8E, 0x55, 0xCF, 0xFF, 0x41, 0x31, 0x15, 0x3B, 0x24, 0x0C, 0x7C, 0x07, 0xAE }, // 8.1.0 New Device Key Source. + { 0x4A, 0xC3, 0x4E, 0x14, 0x8B, 0x96, 0x4A, 0xD5, 0xD4, 0x99, 0x73, 0xC4, 0x45, 0xAB, 0x8B, 0x49 }, // 9.0.0 New Device Key Source. + { 0x14, 0xB8, 0x74, 0x12, 0xCB, 0xBD, 0x0B, 0x8F, 0x20, 0xFB, 0x30, 0xDA, 0x27, 0xE4, 0x58, 0x94 }, // 9.1.0 New Device Key Source. +}; + +static const u8 new_console_keyseed[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_400 + 1][0x10] = { + { 0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D }, // 4.x New Device Keygen Source. + { 0x06, 0x1E, 0x7B, 0xE9, 0x6D, 0x47, 0x8C, 0x77, 0xC5, 0xC8, 0xE7, 0x94, 0x9A, 0xA8, 0x5F, 0x2E }, // 5.x New Device Keygen Source. + { 0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF }, // 6.x New Device Keygen Source. + { 0x81, 0x3C, 0x6C, 0xBF, 0x5D, 0x21, 0xDE, 0x77, 0x20, 0xD9, 0x6C, 0xE3, 0x22, 0x06, 0xAE, 0xBB }, // 6.2.0 New Device Keygen Source. + { 0x86, 0x61, 0xB0, 0x16, 0xFA, 0x7A, 0x9A, 0xEA, 0xF6, 0xF5, 0xBE, 0x1A, 0x13, 0x5B, 0x6D, 0x9E }, // 7.0.0 New Device Keygen Source. + { 0xA6, 0x81, 0x71, 0xE7, 0xB5, 0x23, 0x74, 0xB0, 0x39, 0x8C, 0xB7, 0xFF, 0xA0, 0x62, 0x9F, 0x8D }, // 8.1.0 New Device Keygen Source. + { 0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED }, // 9.0.0 New Device Keygen Source. + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, // TODO: 9.1.0 New Device Keygen Source to be added on next change-of-keys. */ +}; + +static const u8 gen_keyseed[0x10] = + { 0x89, 0x61, 0x5E, 0xE0, 0x5C, 0x31, 0xB6, 0x80, 0x5F, 0xE5, 0x8F, 0x3D, 0xA2, 0x4F, 0x7A, 0xA8 }; + +static const u8 gen_kekseed[0x10] = + { 0x4D, 0x87, 0x09, 0x86, 0xC4, 0x5D, 0x20, 0x72, 0x2F, 0xBA, 0x10, 0x53, 0xDA, 0x92, 0xE8, 0xA9 }; + +static const u8 gen_keyseed_retail[0x10] = + { 0xE2, 0xD6, 0xB8, 0x7A, 0x11, 0x9C, 0xB8, 0x80, 0xE8, 0x22, 0x88, 0x8A, 0x46, 0xFB, 0xA1, 0x95 }; + +static const u8 bis_kekseed[0x10] = + { 0x34, 0xC1, 0xA0, 0xC4, 0x82, 0x58, 0xF8, 0xB4, 0xFA, 0x9E, 0x5E, 0x6A, 0xDA, 0xFC, 0x7E, 0x4F }; + +static const u8 bis_keyseed[][0x10] = { + { 0xF8, 0x3F, 0x38, 0x6E, 0x2C, 0xD2, 0xCA, 0x32, 0xA8, 0x9A, 0xB9, 0xAA, 0x29, 0xBF, 0xC7, 0x48 }, // BIS 0 Crypt seed. + { 0x7D, 0x92, 0xB0, 0x3A, 0xA8, 0xBF, 0xDE, 0xE1, 0xA7, 0x4C, 0x3B, 0x6E, 0x35, 0xCB, 0x71, 0x06 }, // BIS 0 Tweak seed. + { 0x41, 0x00, 0x30, 0x49, 0xDD, 0xCC, 0xC0, 0x65, 0x64, 0x7A, 0x7E, 0xB4, 0x1E, 0xED, 0x9C, 0x5F }, // BIS 1 Crypt seed. + { 0x44, 0x42, 0x4E, 0xDA, 0xB4, 0x9D, 0xFC, 0xD9, 0x87, 0x77, 0x24, 0x9A, 0xDC, 0x9F, 0x7C, 0xA4 }, // BIS 1 Tweak seed. + { 0x52, 0xC2, 0xE9, 0xEB, 0x09, 0xE3, 0xEE, 0x29, 0x32, 0xA1, 0x0C, 0x1F, 0xB6, 0xA0, 0x92, 0x6C }, // BIS 2/3 Crypt seed. + { 0x4D, 0x12, 0xE1, 0x4B, 0x2A, 0x47, 0x4C, 0x1C, 0x09, 0xCB, 0x03, 0x59, 0xF0, 0x15, 0xF4, 0xE4 } // BIS 2/3 Tweak seed. +}; + bool hos_eks_rw_try(u8 *buf, bool write) { for (u32 i = 0; i < 3; i++) @@ -248,6 +307,90 @@ out: } } +void hos_eks_bis_save() +{ + bool new_eks = false; + if (!h_cfg.eks) + { + h_cfg.eks = calloc(512 , 1); + new_eks = true; + } + + // If matching blob doesn't exist, create it. + if (!h_cfg.eks->enabled_bis) + { + // Read EKS blob. + u8 *mbr = calloc(512 , 1); + if (!hos_eks_rw_try(mbr, false)) + { + if (new_eks) + { + free(h_cfg.eks); + h_cfg.eks = NULL; + } + + goto out; + } + + // Set magic and personalized info. + h_cfg.eks->magic = HOS_EKS_MAGIC; + h_cfg.eks->enabled_bis = 1; + h_cfg.eks->sbk_low = FUSE(FUSE_PRIVATE_KEY0); + + // Copy new keys. + memcpy(h_cfg.eks->bis_keys[0].crypt, bis_keys + (0 * 0x10), 0x10); + memcpy(h_cfg.eks->bis_keys[0].tweak, bis_keys + (1 * 0x10), 0x10); + + memcpy(h_cfg.eks->bis_keys[1].crypt, bis_keys + (2 * 0x10), 0x10); + memcpy(h_cfg.eks->bis_keys[1].tweak, bis_keys + (3 * 0x10), 0x10); + + memcpy(h_cfg.eks->bis_keys[2].crypt, bis_keys + (4 * 0x10), 0x10); + memcpy(h_cfg.eks->bis_keys[2].tweak, bis_keys + (5 * 0x10), 0x10); + + // Encrypt EKS blob. + u8 *eks = calloc(512 , 1); + memcpy(eks, h_cfg.eks, sizeof(hos_eks_mbr_t)); + se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); + + // Write EKS blob to SD. + memcpy(mbr + 0x60, eks, sizeof(hos_eks_mbr_t)); + hos_eks_rw_try(mbr, true); + + + free(eks); +out: + free(mbr); + } +} + +void hos_eks_bis_clear() +{ + // Check if BIS keys are enabled. + if (h_cfg.eks && h_cfg.eks->enabled_bis) + { + // Read EKS blob. + u8 *mbr = calloc(512 , 1); + if (!hos_eks_rw_try(mbr, false)) + goto out; + + // Disable BIS storage. + h_cfg.eks->enabled_bis = 0; + + // Encrypt EKS blob. + u8 *eks = calloc(512 , 1); + memcpy(eks, h_cfg.eks, sizeof(hos_eks_mbr_t)); + se_aes_crypt_ecb(14, 1, eks, sizeof(hos_eks_mbr_t), eks, sizeof(hos_eks_mbr_t)); + + // Write EKS blob to SD. + memcpy(mbr + 0x60, eks, sizeof(hos_eks_mbr_t)); + hos_eks_rw_try(mbr, true); + + free(eks); +out: + free(mbr); + } +} + int hos_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt) { u8 tmp[0x30]; @@ -392,3 +535,155 @@ int hos_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt) return 1; } + +static void _hos_validate_sept_mkey(u32 kb) +{ + u8 tmp_mkey[0x10]; + u32 mkey_idx = sizeof(mkey_vectors) / 0x10; + u8 mkey_slot = !h_cfg.aes_slots_new ? 12 : 13; + do + { + mkey_idx--; + se_aes_crypt_ecb(mkey_slot, 0, tmp_mkey, 0x10, mkey_vectors[mkey_idx], 0x10); + for (u32 idx = 0; idx < mkey_idx; idx++) + { + se_aes_key_clear(2); + se_aes_key_set(2, tmp_mkey, 0x10); + se_aes_crypt_ecb(2, 0, tmp_mkey, 0x10, mkey_vectors[mkey_idx - 1 - idx], 0x10); + } + + if (!memcmp(tmp_mkey, "\x00\x00\x00\x00\x00\x00\x00\x00", 8)) + { + se_aes_key_clear(2); + hos_eks_save(kb); + return; + } + } while (mkey_idx); + + se_aes_key_clear(2); + hos_eks_clear(kb); +} + +int hos_bis_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt) +{ + u32 keygen_rev = 0; + u32 console_key_slot = kb >= KB_FIRMWARE_VERSION_400 ? 15 : 13; + + if (!bis_keys) + bis_keys = malloc(0x10 * 6); + + if (!h_cfg.eks || !h_cfg.eks->enabled_bis) + { + ///////// check sept. + hos_keygen(keyblob, kb, tsec_ctxt); + + if (kb >= KB_FIRMWARE_VERSION_400) + keygen_rev = fuse_read_odm_keygen_rev(); + + if (keygen_rev) + { + // Keygen revision uses bootloader version, which starts from 1. + keygen_rev -= (KB_FIRMWARE_VERSION_400 + 1); + + // Derive mkey 0. + u8 tmp_mkey[0x10]; + u32 mkey_idx = sizeof(mkey_vectors) / 0x10; + u8 mkey_slot = kb >= KB_FIRMWARE_VERSION_700 ? (!h_cfg.aes_slots_new ? 12 : 13) : (kb == KB_FIRMWARE_VERSION_620 ? 9 : 12); + do + { + mkey_idx--; + se_aes_crypt_ecb(mkey_slot, 0, tmp_mkey, 0x10, mkey_vectors[mkey_idx], 0x10); + for (u32 idx = 0; idx < mkey_idx; idx++) + { + se_aes_key_clear(2); + se_aes_key_set(2, tmp_mkey, 0x10); + se_aes_crypt_ecb(2, 0, tmp_mkey, 0x10, mkey_vectors[mkey_idx - 1 - idx], 0x10); + } + } while (memcmp(tmp_mkey, "\x00\x00\x00\x00\x00\x00\x00\x00", 8) != 0 && mkey_idx); + + // Derive new device key. + se_aes_key_clear(1); + se_aes_unwrap_key(1, 10, new_console_keyseed_4xx[keygen_rev]); // Uses Device key 4x. + se_aes_crypt_ecb(10, 0, tmp_mkey, 0x10, new_console_keyseed_4xx[keygen_rev], 0x10); // Uses Device key 4x. + se_aes_unwrap_key(1, 2, new_console_keyseed[keygen_rev]); // Uses Master Key 0. + se_aes_unwrap_key(1, 1, tmp_mkey); + + console_key_slot = 1; + } + + // Generate generic kek. + se_aes_key_clear(2); + se_aes_unwrap_key(2, console_key_slot, gen_keyseed_retail); + + // Clear bis keys storage. + memset(bis_keys, 0, 0x10 * 6); + + // Generate BIS 0 Keys. + se_aes_crypt_block_ecb(2, 0, bis_keys + (0 * 0x10), bis_keyseed[0]); + se_aes_crypt_block_ecb(2, 0, bis_keys + (1 * 0x10), bis_keyseed[1]); + + // Generate generic kek. + se_aes_key_clear(2); + se_aes_unwrap_key(2, console_key_slot, gen_kekseed); + se_aes_unwrap_key(2, 2, bis_kekseed); + se_aes_unwrap_key(2, 2, gen_keyseed); + + // Generate BIS 1 Keys. + se_aes_crypt_block_ecb(2, 0, bis_keys + (2 * 0x10), bis_keyseed[2]); + se_aes_crypt_block_ecb(2, 0, bis_keys + (3 * 0x10), bis_keyseed[3]); + + // Generate BIS 2/3 Keys. + se_aes_crypt_block_ecb(2, 0, bis_keys + (4 * 0x10), bis_keyseed[4]); + se_aes_crypt_block_ecb(2, 0, bis_keys + (5 * 0x10), bis_keyseed[5]); + } + else + { + memcpy(bis_keys + (0 * 0x10), h_cfg.eks->bis_keys[0].crypt, 0x10); + memcpy(bis_keys + (1 * 0x10), h_cfg.eks->bis_keys[0].tweak, 0x10); + + memcpy(bis_keys + (2 * 0x10), h_cfg.eks->bis_keys[1].crypt, 0x10); + memcpy(bis_keys + (3 * 0x10), h_cfg.eks->bis_keys[1].tweak, 0x10); + + memcpy(bis_keys + (4 * 0x10), h_cfg.eks->bis_keys[2].crypt, 0x10); + memcpy(bis_keys + (5 * 0x10), h_cfg.eks->bis_keys[2].tweak, 0x10); + } + + if (kb >= KB_FIRMWARE_VERSION_700) + _hos_validate_sept_mkey(kb); + + // Clear all AES keyslots. + for (u32 i = 0; i < 6; i++) + se_aes_key_clear(i); + + // Set BIS keys. + se_aes_key_set(0, bis_keys + (0 * 0x10), 0x10); + se_aes_key_set(1, bis_keys + (1 * 0x10), 0x10); + + se_aes_key_set(2, bis_keys + (2 * 0x10), 0x10); + se_aes_key_set(3, bis_keys + (3 * 0x10), 0x10); + + se_aes_key_set(4, bis_keys + (4 * 0x10), 0x10); + se_aes_key_set(5, bis_keys + (5 * 0x10), 0x10); + + return 1; +} + +void hos_bis_keys_clear() +{ + // Clear all aes keyslots. + for (u32 i = 0; i < 6; i++) + se_aes_key_clear(i); + + // Set SBK back. + u32 sbk[4] = { + FUSE(FUSE_PRIVATE_KEY0), + FUSE(FUSE_PRIVATE_KEY1), + FUSE(FUSE_PRIVATE_KEY2), + FUSE(FUSE_PRIVATE_KEY3) + }; + // Set SBK to slot 14. + se_aes_key_set(14, sbk, 0x10); + + // Lock SBK from being read. + se_key_acc_ctrl(14, SE_KEY_TBL_DIS_KEYREAD_FLAG); +} \ No newline at end of file diff --git a/nyx/nyx_gui/hos/hos.h b/nyx/nyx_gui/hos/hos.h index fcc19ae..7d48250 100644 --- a/nyx/nyx_gui/hos/hos.h +++ b/nyx/nyx_gui/hos/hos.h @@ -96,6 +96,10 @@ typedef struct _launch_ctxt_t void hos_eks_get(); void hos_eks_save(u32 kb); void hos_eks_clear(u32 kb); +void hos_eks_bis_save(); +void hos_eks_bis_clear(); int hos_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt); +int hos_bis_keygen(u8 *keyblob, u32 kb, tsec_ctxt_t *tsec_ctxt); +void hos_bis_keys_clear(); #endif