RGH 2.0
How we retrieved the dual CB
----------------------------
We bought a Jasper console which had 6752, dumped the entire flash, updated to 6753.
The new bootloaders extracted from the update were downloaded from xbins.
Taking advantage that 9188 does not sport fuse verification, we decrypted CBv2 (aka CB_B) 6753 using the xor hack, as described and implemented by Tiros.
This constitutes of the following:
a = per_cpu_cbv2_6753 (from our updated console)
b = plain_cbv2_6753 (from the xbins files)
c = custom_cb_b
d = a xor b (d is a byte from the keystream table)
a = d xor c (a is a pseudo-reencrypted byte)
This simple but effective fail can be observed from Tiros' readme and proven by reading the following:
1:
addi %r6, %r6, 1
clrlwi %r6, %r6, 24
lbzx %r8, %r3, %r6 # load byte from keystream table (this table is 256 bytes long)
add %r7, %r7, %r8
clrlwi %r7, %r7, 24 # the above statement is proven here, will not go into details
lbzx %r9, %r3, %r7
stbx %r9, %r3, %r6
stbx %r8, %r3, %r7
add %r8, %r8, %r9
clrlwi %r8, %r8, 24
lbzx %r8, %r3, %r8 # load keystream byte
lbz %r9, 0(%r4) # load data byte, now watch the magic trick
xor %r8, %r8, %r9 # bam motherfucker, see what's done here?
stb %r8, 0(%r4) # aaaaaaaand store the encrypted or decrypted data byte. this is symmetric so no need to differ between enc and dec.
addi %r4, %r4, 1
bdnz 1b
See? Suave, simple.
Needless to say, we can now execute 9188 without much hassle BUT WAIT!
Now we can actually use the trinity timing because we have the same HANA and can therefore use I2C.
What's stopping us now?! (Besides recharging the input capacitor of the CPU_RST, because we are going thru a 1kOhm resistor, so we're just gonna hold it high for a few extra cycles like GliGli did on fats)
Exactly, the cpu key. Because the system initialization differs between trinity and jasper, we actually need to use a Jasper CB.
* Scratch head *
I know! We'll extract the CPU key! Using serial!
So now that we're able to run our own code on the console, we'll hook up our Squirt Slave Programmer which also boasts 1 or 2 UART ports.
For some reason it ain't working...
We were stuck with this problem, I kid you not, for 2 weeks! Finally we found a solution.
But how? Oh I know! We'll do the same thing those cool guys did using JTAG!
So we took a look at Kev's POST 0x2E initialization code and thought we'd just use the exact same thing, but that didn't work.
Left with only very little choice, we gave up and went with 9188. BUT!!! We used the 0x2E data from Jasper 6750!
Without much hassle, we branch to Post 0x2E, init the bridge between Southbridge and CPU and we're good to go.
Now we can actually use serial.
1:
li %r4, 0x200
oris %r4, %r4, 0x8000
rldicr %r4, %r4, 32, 31
oris %r4, %r4, 2
ld %r3, 0xC0(%r4)
bl Serial_PrintHexQWord
ld %r3, 0x140(%r4)
bl Serial_PrintHexQWord
li %r3, 0xD
bl Serial_PrintRawByte
li %r3, 0xA
bl Serial_PrintRawByte
b 1b
Brilliant, we now get a flood of our CPU key on our terminal but it is separated by LF,CR, so we see it clearly.
Now we put our cpu key in flashtool, opened our original dump (6752) and extracted the decrypted dual CB.
Luckily, this also doesn't sport a fuse check.
Now we take the patches from trinity (the ones made by Marchisio and Vola from ConsoleOpen; because they skip the fuse verification in CBv2) and just port them to our 6752.
We're done here. We do the same with Falcon, about a day before release.
We put it up on our github to be tested by our beta team and they only applied very small changes.
That's it folks! Maybe now you would like to explain why you released yours a few hours later, claiming we stole it from you, when we could be the ones accusing you?
The guy's English may not be good (it's terrible actually, sorry bro) but give the rest of the team some credit!
We sat by this for a lengthy amount of time and in the end, people give us shit for releasing something another team would claim doesn't work on the current glitchers.
Don't take the customer for a fool, give them a little respect. They're the ones your business depends on. Everybody deserves respect.
Team Squirt 360
27Likes
LinkBack URL
About LinkBacks
Rispondi Citando
mio al dayone XD
[/EMAIL][URL="http://obcj@libero.it"][/URL]
...grazie...scusate per OT
Segnalibri