// File: /workspace/github_c_makefile_star2_O0/jogolden[P]ps4flashtool/southbridge.c
// Function: verify_eap_kbl
int verify_eap_kbl(unsigned char *flashdata) {
    struct bldr_hdr *blhdr = flash_locate_eap_kbl(flashdata);
    unsigned char *hdraeskey = keymgr_getkey("eapkblaes", KEY_TYPE_AES_128);
    unsigned char *hdrhmackey = keymgr_getkey("eapkblhmac", KEY_TYPE_HMAC_SHA1);

    if(verbose) {
        printf("* EAP KBL header aes key: ");
        hexdump(hdraeskey, 0x10, 0);

        printf("* EAP KBL header hmac-sha1 key: ");
        hexdump(hdrhmackey, 0x10, 0);
    }

    struct bldr_hdr dechdr;
    unsigned char *decbody = (unsigned char *)malloc(blhdr->body_len);
    char bodyhmac[0x14];
    char hdrhmac[0x14];

    // copy the header on to the stack, we dont want to modify anything
    memcpy(&dechdr, blhdr, blhdr->hdr_len);
    
    aes128_cbc_iv_zero_decrypt(hdraeskey, &blhdr->crypteddata, &dechdr.crypteddata, 0x50);

    hmac_sha1(dechdr.crypteddata.iplbodyhmackey, 0x10, &blhdr->bodystart, blhdr->body_len, bodyhmac);
    hmac_sha1(hdrhmackey, 0x10, (unsigned char *)&dechdr, 0x6C, hdrhmac);

    if(verbose) {
        printf("* flash EAP KBL body hmac-sha1: ");
        hexdump(dechdr.crypteddata.iplbodyhmac, 0x14, 0);

        printf("* calculated EAP KBL body hmac-sha1: ");
        hexdump(bodyhmac, 0x14, 0);

        printf("* flash EAP KBL header hmac-sha1: ");
        hexdump(dechdr.crypteddata.headerhmac, 0x14, 0);

        printf("* calculated EAP KBL header hmac-sha1: ");
        hexdump(hdrhmac, 0x14, 0);
    }

    free(decbody);

    return memcmp(bodyhmac, dechdr.crypteddata.iplbodyhmac, sizeof(bodyhmac)) + 
        memcmp(hdrhmac, &dechdr.crypteddata.headerhmac, sizeof(bodyhmac));
}

// Assembly:
pushq %rbp
movq %rsp, %rbp
subq $0x100, %rsp            # imm = 0x100
movq %rdi, -0x8(%rbp)
movq -0x8(%rbp), %rdi
callq 0x9cc0
movq %rax, -0x10(%rbp)
leaq 0x2f9a(%rip), %rdi      # 0xd47d
movl $0xa1, %esi
callq 0x7200
movq %rax, -0x18(%rbp)
leaq 0x2f8f(%rip), %rdi      # 0xd487
movl $0xb1, %esi
callq 0x7200
movq %rax, -0x20(%rbp)
leaq 0x5e37(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa54e
leaq 0x2f79(%rip), %rdi      # 0xd492
movb $0x0, %al
callq 0x2080
movq -0x18(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2f76(%rip), %rdi      # 0xd4ad
movb $0x0, %al
callq 0x2080
movq -0x20(%rbp), %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x5650
movq -0x10(%rbp), %rax
movl 0xc(%rax), %eax
movl %eax, %edi
callq 0x2100
movq %rax, -0xb0(%rbp)
movq -0x10(%rbp), %rsi
movq -0x10(%rbp), %rax
movl 0x8(%rax), %eax
movl %eax, %edx
leaq -0xa1(%rbp), %rdi
callq 0x20f0
movq -0x18(%rbp), %rdi
movq -0x10(%rbp), %rsi
addq $0x30, %rsi
leaq -0xa1(%rbp), %rdx
addq $0x30, %rdx
movl $0x50, %ecx
callq 0x3b60
leaq -0xa1(%rbp), %rdi
addq $0x30, %rdi
addq $0x10, %rdi
movq -0x10(%rbp), %rdx
addq $0x80, %rdx
movq -0x10(%rbp), %rax
movl 0xc(%rax), %eax
movl %eax, %ecx
leaq -0xd0(%rbp), %r8
movl $0x10, %esi
callq 0x6df0
movq -0x20(%rbp), %rdi
leaq -0xf0(%rbp), %r8
movl $0x10, %esi
leaq -0xa1(%rbp), %rdx
movl $0x6c, %ecx
callq 0x6df0
leaq 0x5d4b(%rip), %rax      # 0x10344
cmpl $0x0, (%rax)
je 0xa696
leaq 0x2ec5(%rip), %rdi      # 0xd4ce
movb $0x0, %al
callq 0x2080
leaq -0xa1(%rbp), %rdi
addq $0x30, %rdi
addq $0x20, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2ebd(%rip), %rdi      # 0xd4ef
movb $0x0, %al
callq 0x2080
leaq -0xd0(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2ec2(%rip), %rdi      # 0xd515
movb $0x0, %al
callq 0x2080
leaq -0xa1(%rbp), %rdi
addq $0x30, %rdi
addq $0x3c, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
leaq 0x2ebc(%rip), %rdi      # 0xd538
movb $0x0, %al
callq 0x2080
leaq -0xf0(%rbp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x5650
movq -0xb0(%rbp), %rdi
callq 0x2030
leaq -0xd0(%rbp), %rdi
leaq -0xa1(%rbp), %rsi
addq $0x30, %rsi
addq $0x20, %rsi
movl $0x14, %edx
callq 0x20b0
movl %eax, -0xf4(%rbp)
leaq -0xf0(%rbp), %rdi
leaq -0xa1(%rbp), %rsi
addq $0x30, %rsi
addq $0x3c, %rsi
movl $0x14, %edx
callq 0x20b0
movl %eax, %ecx
movl -0xf4(%rbp), %eax
addl %ecx, %eax
addq $0x100, %rsp            # imm = 0x100
popq %rbp
retq
nopl (%rax,%rax)