Bugfix info regarding CD decryption. If you have a 1920+ CD version it doesn't decrypt CD properly. This was because the "DerivedKey" was only calculated in CE (which was decrypted properly) but should have been done in CD already.
Since 0.88b is already out I will post my changes: (only 0.88a source is released)
Change part of FlashFile.ccp into this (CD decrypt now gets the cpu key, not CE decrypt):
m_CDSection.Initialise(CString("CD"),Base,&m_BlockDriver,m_CBSection.GetKey(),m_CBSection.GetVersion() >= 1920 ? m_pFuse : NULL);
Base += m_CDSection.GetLength();
m_CESection.Initialise(CString("CE"),Base,&m_BlockDriver,m_CDSection.GetKey());
This means removing this line in CXSection.h:
BOOL Initialise(CString& rName, unsigned int BaseAddress, CBlockDriver * pBlockDriver, unsigned char * pKey, unsigned char * pCPUKey);
and changing CD Initialise into this line:
BOOL Initialise(CString& rName, unsigned int BaseAddress, CBlockDriver * pBlockDriver, unsigned char * pKey, unsigned char * pCPUKey);
also remove CCESection::Initialise from CXSection.cpp.
Then change CCDSection::Initialise in CXSection.cpp into this:
BOOL CCDSection::Initialise(CString& rName, unsigned int BaseAddress, CBlockDriver * pBlockDriver, unsigned char * pKey, unsigned char * pCPUKey)
{
BYTE* pData;
m_Name = rName;
m_DecryptedData = NULL;
m_StartBlock = BaseAddress/0x4000;
if(!ReadSection(m_StartBlock,BaseAddress-(m_StartBlock * 0x4000),0x20,&pData,pBlockDriver))
{
return FALSE;
}
if(pKey)
{
Decrypt(pKey,pData,pCPUKey);
}
delete pData;
return TRUE;
}
and add CCDSection::Decrypt to CXSection.cpp:
BOOL CCDSection::Decrypt(unsigned char *pK0, unsigned char * pData, unsigned char * pCPUKey)
{
unsigned char Digest[SHA_DIGEST_LENGTH];
RC4_KEY RC4Key;
if(*pK0 == 0x00)
{
return FALSE;
}
m_DecryptedData = new unsigned char[m_Length];
CalculateHMACSHA(pK0,&pData[0x10],0x10,Digest);
if (pCPUKey) {
CalculateHMACSHA(pCPUKey,Digest,0x10,Digest);
}
memcpy(m_Hdr,pData,0x10);
memcpy(m_Key,Digest,0x10);
//first 16 bytes of Digest is the key
RC4_set_key(&RC4Key, 0x10, Digest);
RC4(&RC4Key,
m_Length - 0x10,
&pData[0x20],
m_DecryptedData);
return TRUE;
}
and of course change CXSection.h accordingly:
virtual BOOL Initialise(CString& rName,unsigned int BaseAddress, CBlockDriver * pBlockDriver, unsigned char * pKey, unsigned char * pCPUKey);
virtual BOOL Decrypt(unsigned char *pK0, unsigned char * pData, unsigned char * pCPUKey);
The above was discussed
here.
Regards,
arnezami
