Finding the key on the Samsung is EASY, it is always in the range of >4000 to >5FFF and it is always followed in front by a number of bytes containing >EE
Yes, samsung keys are very easy to find. They follow this sequence:
01 EE EE EE EE - 16 byte key location - 02 11 11 11 11 - 16 byte key location - 03 EE EE EE EE - 16 byte key location - .... etc ....
I have already written a dos based program to jump to each potential key location and check for repeating values. It then copys from file1 to file2 and compares those two files. File1 is ideally orig.bin and file2 hacked.bin. If there are more than 3 repeating values in the key, it is said not to be valid and continues on to the next potential location. The only thing I did wrong, was only look in the $4000-4400 block. I will fix this right now and it will be done with. Here is the code, written in turbo pascal(I do not program a lot, so it is sloppy and could probably be reduced a lot more than it is):
program KeyTool;
uses crt,dos;
function hexbyte(B : Byte) : String;
const
HexDigits : ARRAY[0..15] OF Char = '0123456789ABCDEF';
var Temp : String;
begin
Temp[0] := #2;
Temp[1] := HexDigits[B SHR 4];
Temp[2] := HexDigits[B AND $F];
hexbyte := Temp;
end;
type
block = array[0..$3ff] of byte;
var
block1, block2, block3:block;
file1, file2:file of block;
match,validkey1,validkey2,validkey3:boolean;
bytematch,keyread2,keystop2,keyread1,keystop1,keyread3,keystop3,i,j,k:integer;
begin
TextColor(LightBlue);
writeln;
writeln('----------------------------------------------------------------------------');
writeln('Firmware KeyTool v0.420 by Caster420 & Klutsh');
writeln('--------------------------------------------[360mods.net]-[x-projects.org]--');
writeln;
TextColor(LightGray);
if (paramstr(1)='') or (paramstr(2)='') then
begin
TextColor(LightRed);
writeln('ERROR: You did not satisfy the required paramaters.');
TextColor(LightGray);
writeln('Proper Usage: KeyTool File1 File2');
halt(1);
end;
assign(file1,paramstr(1));
assign(file2,paramstr(2));
{$i-} reset(file1); {$i+}
if IOResult <> 0 then
begin
TextColor(LightRed);
writeln('ERROR: File ',paramstr(1),' does not exist!');
TextColor(LightGray);
halt(1);
end;
{$i-} reset(file2); {$i+}
if IOResult <> 0 then
begin
TextColor(LightRed);
writeln('ERROR: File ',paramstr(2),' does not exist!');
TextColor(LightGray);
halt(1);
end;
writeln('Copying Key...');
seek(file1,16);
seek(file2,16);
read(file1,block3);
validkey3:=false;
bytematch:=0;
i:=5;
while (i<$400) do
begin
j:=i;
k:=i+1;
while (j<i+15) do
begin
while (k<i+14) do
begin
if (block3[j]=block3[k]) then
begin
bytematch:=bytematch+1;
end;
k:=k+1;
end;
k:=j+2;
j:=j+1;
end;
if (bytematch>3) then
i:=i+21
else
begin
keyread3:=i;
keystop3:=i+16;
i:=$400;
validkey3:=true;
end;
bytematch:=0;
end;
if validkey3 then
begin
write(file2,block3);
writeln;
writeln('Checking Keys...');
writeln;
end;
if not validkey3 then
begin
TextColor(LightRed);
write ('*** ERROR ***');
TextColor(LightGray);
write (' Valid key structure not found!');
halt(1);
end;
seek(file1,16);
seek(file2,16);
read(file1,block1);
read(file2,block2);
close(file1);
close(file2);
match:=true;
validkey1:=false;
bytematch:=0;
i:=5;
while (i<$400) do
begin
j:=i;
k:=i+1;
while (j<i+15) do
begin
while (k<i+14) do
begin
if (block1[j]=block1[k]) then
begin
bytematch:=bytematch+1;
end;
k:=k+1;
end;
k:=j+2;
j:=j+1;
end;
if (bytematch>3) then
i:=i+21
else
begin
keyread1:=i;
keystop1:=i+16;
i:=$400;
validkey1:=true;
end;
bytematch:=0;
end;
write ('Key from ',paramstr(1),': ');
while (keyread1<keystop1) and (validkey1) do
begin
TextColor(White);
write(hexbyte(block1[keyread1]),'');
TextColor(LightGray);
keyread1:=keyread1+1;
end;
if not validkey1 then
begin
TextColor(LightRed);
write ('*** ERROR ***');
TextColor(LightGray);
write (' Valid key structure not found!');
end;
writeln;
validkey2:=false;
bytematch:=0;
i:=5;
while (i<$400) do
begin
j:=i;
k:=i+1;
while (j<i+15) do
begin
while (k<i+14) do
begin
if (block2[j]=block2[k]) then
begin
bytematch:=bytematch+1;
end;
k:=k+1;
end;
k:=j+2;
j:=j+1;
end;
if (bytematch>3) then
i:=i+21
else
begin
keyread2:=i;
keystop2:=i+16;
i:=$400;
validkey2:=true;
end;
bytematch:=0;
end;
write ('Key from ',paramstr(2),': ');
while (keyread2<keystop2) and (validkey2) do
begin
TextColor(White);
write(hexbyte(block2[keyread2]),'');
TextColor(LightGray);
keyread2:=keyread2+1;
end;
if not validkey2 then
begin
TextColor(LightRed);
write ('*** ERROR ***');
TextColor(LightGray);
write (' Valid key structure not found!');
end;
writeln;
keyread1:=keystop1-16;
keyread2:=keystop2-16;
while (keyread1<keystop1) and (match) do
begin
if block1[keyread1]<>block2[keyread2] then match:=false;
keyread1:=keyread1+1;
keyread2:=keyread2+1;
end;
writeln;
if not (validkey1) or not (validkey2) then
begin
TextColor(LightRed);
writeln('*** One or both keys are not valid ***');
TextColor(LightGray);
writeln;
writeln('Here is a brief explination of the valid key not found error...');
writeln;
writeln('Key Check locates the key by comparing the all bytes of the key against');
writeln('the other bytes in the 16 byte key. If there are more than 3 identical');
writeln('bytes in the 16 byte key, it moves to the next logical key location in ');
writeln('key block. So, if all of the 32 key locations have more than 3 identical');
writeln('bytes, then it will respond with valid key structure not found. It is');
writeln('very uncommon for keys to have repeating bytes and the most I have found');
writeln('to date is 3. Double check your images (original or hacked) BEFORE flashing.');
halt(1);
end;
if not match then
begin
TextColor(LightRed);
writeln ('*** WARNING ***');
TextColor(LightGray);
writeln ('Keys do not match, do not flash!!!');
writeln ('Checked dumped and patched image.');
halt(1);
end;
TextColor(LightGreen);
writeln('*** SUCCESS ***');
TextColor(LightGray);
writeln('Drive Key Copied.');
writeln;
writeln('Now unplug the SATA cable and power-cycle the PC & DVD drive');
writeln('On reboot run: FlashDrive');
end.
Anyways, i just need to change the size of the block that is taken from the file and it will be fixed.
Caster.
Dilber MC Theme by HarzeM