netmdocm
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| netmdocm [2011/01/16 14:33] – nopsled | netmdocm [2011/01/16 17:59] (current) – nopsled | ||
|---|---|---|---|
| Line 937: | Line 937: | ||
| In other words, this extracts the 0-extension of a MACLIST and an encrypted hash of that. | In other words, this extracts the 0-extension of a MACLIST and an encrypted hash of that. | ||
| + | |||
| + | See pcmaclist(6) | ||
| /* | /* | ||
| Line 1085: | Line 1087: | ||
| ===== querycif(09) - Get KEK encrypted content key ===== | ===== querycif(09) - Get KEK encrypted content key ===== | ||
| - | |||
| - | /* | ||
| - | Procedure prototype: | ||
| - | | ||
| - | |||
| - | Input: | ||
| - | |||
| - | SalPointer const &, | ||
| - | SalPointer const &, | ||
| - | long, | ||
| - | long, | ||
| - | SalPointer const &, | ||
| - | SalOmgId const &, | ||
| - | SalPointer const &, | ||
| - | long, | ||
| - | SalExtrinsicsProg const &, | ||
| - | |||
| - | Output: | ||
| - | |||
| - | SalAsnSeqBegin, | ||
| - | long &, | ||
| - | OmgString & | ||
| - | querycif(09) | ||
| - | |||
| - | Process File, SalOmgId, param3, long (3), long (3), Ekb capability table, 00010001_EKB -> Enc(CKEY, KEK) | ||
| - | |||
| - | */ | ||
| - | |||
| - | |||
| - | unsigned char param3[24] = | ||
| - | { | ||
| - | 0x46, 0x73, 0xE4, 0x89, 0x6A, 0xA9, 0x0B, 0x96, 0x69, 0x43, 0xAA, 0x39, 0x99, 0xE2, 0x08, 0xC4, | ||
| - | 0xF8, 0xCA, 0x19, 0x2E, 0x38, 0xE2, 0x3E, 0x4C, | ||
| - | } ; | ||
| - | |||
| - | unsigned char param6_EkbCapabilityTable[24] = | ||
| - | { | ||
| - | 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x03, 0x00, 0x00, 0x00, | ||
| - | 0x02, 0x00, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, | ||
| - | } ; | ||
| - | |||
| - | |||
| - | /* Return value. TODO: double check */ | ||
| - | |||
| - | unsigned char return_value[11] = | ||
| - | { | ||
| - | 0x30, 0x80, 0x02, 0x01, 0x00, 0x04, 0x08, 0x82, 0x19, 0x23, 0xFD, | ||
| - | } ; | ||
| < | < | ||
| Line 1185: | Line 1139: | ||
| - | |||
| - | |||
| - | function GetKekEncCKEY(blob_t OpfImage (arg_2), blob_t EkbCapTableBody (arg_3)) | ||
| - | { | ||
| - | Array ProcessFile[5]; | ||
| - | |||
| - | dict[4] = EkbCapTableBody; | ||
| - | ProcessFile = decode_asn1(opf_image); | ||
| - | dict[3] = OpfImage; | ||
| - | |||
| - | // | ||
| - | // Calculate HMAC for the opf[3] usage information. Check if it matches with the HMAC value in opf[1] | ||
| - | // | ||
| - | // ProcessFile[1]: | ||
| - | |||
| - | blob_t dec_pf2 = devicesal_220_decrypt_hook_249(ProcessFile[2], | ||
| - | blob_t serialized_opf3 = BCSerialize(ProcessFile[3]); | ||
| - | blob_t key = concat ( dec_pf2, serialized_opf3 ); | ||
| - | blob_t hasked_key = inline:: | ||
| - | blob_t key_pf2 = concat ( dec_pf2, hashed_key ); | ||
| - | blob_t hashed_key_pf2 = inline: | ||
| - | |||
| - | // if( HMAC(opf[3], | ||
| - | // | ||
| - | // | ||
| - | if (compare_blob (hashed_key_pf2, | ||
| - | // Test_Small_Int_For_Zero -> 0 (acc) | ||
| - | { | ||
| - | ... todo | ||
| - | } | ||
| - | } | ||
| </ | </ | ||
| Line 1473: | Line 1396: | ||
| CompleteCheckIn netmd(7) | CompleteCheckIn netmd(7) | ||
| - | |||
| - | ===== netmd.ocm Decompiled ===== | ||
| - | < | ||
| - | |||
| - | Dict[0xf9] = {0x63, 0x81, 0x63, 0xB8, 0x2C, 0x4E, 0x31, | ||
| - | 0x81, 0x0F, 0xBE, 0xE0, 0x1B, 0x2E, 0x7F, | ||
| - | 0xC2, 0x5B, 0x87, 0x95, 0x86, 0xE3}; | ||
| - | |||
| - | |||
| - | // CIPHERTEXT must be a serialized and encrypted blob (see dev_0xd8/ | ||
| - | // The PLAINTEXT is appended to that blob and the serialized and encrypted result is returned. | ||
| - | blob_t | ||
| - | netmd_0x07 (blob_t key, blob_t some_plaintext, | ||
| - | { | ||
| - | static blob_t pad[16] = { 0x33, 0x4a, 0x18, 0x94, 0xc1, 0xf3, 0x83, 0xf6, | ||
| - | 0xd3, 0xeb, 0x6a, 0xc2, 0xad, 0x13, 0x07, 0xca }; | ||
| - | blob_t data = dev_0xd8 (some_ciphertext, | ||
| - | data = CONCAT (data, some_plaintext); | ||
| - | return dev_0xd9 (data, XOR (key, pad)); | ||
| - | } | ||
| - | </ | ||
| - | |||
| - | ===== icv.ocm Decompiled ===== | ||
| - | |||
| - | < | ||
| - | |||
| - | // | ||
| - | // Generate a SalOmgId | ||
| - | // | ||
| - | // | ||
| - | // | ||
| - | // < | ||
| - | // | ||
| - | // Note: When OpenMG is used (trough the UI) for the first time this value is generated, | ||
| - | // by calling the salwrap function getSalOmgId. | ||
| - | // | ||
| - | // const unsigned __int8 *__cdecl getSalOmgId() | ||
| - | // | ||
| - | blob_t icv(07) | ||
| - | { | ||
| - | | ||
| - | | ||
| - | data = BCX_01_Concat(PrefixSalOmgId, | ||
| - | Push 1 | ||
| - | | ||
| - | | ||
| - | } | ||
| - | </ | ||
netmdocm.1295188422.txt.gz · Last modified: 2011/01/16 14:33 by nopsled