// File: /workspace/github_c_makefile_star2_O3/jogolden[P]ps4flashtool/southbridge.c
// Function: verify_eap_kbl
int verify_eap_kbl(unsigned char *flashdata) {
    struct bldr_hdr *blhdr = flash_locate_eap_kbl(flashdata);
    unsigned char *hdraeskey = keymgr_getkey("eapkblaes", KEY_TYPE_AES_128);
    unsigned char *hdrhmackey = keymgr_getkey("eapkblhmac", KEY_TYPE_HMAC_SHA1);

    if(verbose) {
        printf("* EAP KBL header aes key: ");
        hexdump(hdraeskey, 0x10, 0);

        printf("* EAP KBL header hmac-sha1 key: ");
        hexdump(hdrhmackey, 0x10, 0);
    }

    struct bldr_hdr dechdr;
    unsigned char *decbody = (unsigned char *)malloc(blhdr->body_len);
    char bodyhmac[0x14];
    char hdrhmac[0x14];

    // copy the header on to the stack, we dont want to modify anything
    memcpy(&dechdr, blhdr, blhdr->hdr_len);
    
    aes128_cbc_iv_zero_decrypt(hdraeskey, &blhdr->crypteddata, &dechdr.crypteddata, 0x50);

    hmac_sha1(dechdr.crypteddata.iplbodyhmackey, 0x10, &blhdr->bodystart, blhdr->body_len, bodyhmac);
    hmac_sha1(hdrhmackey, 0x10, (unsigned char *)&dechdr, 0x6C, hdrhmac);

    if(verbose) {
        printf("* flash EAP KBL body hmac-sha1: ");
        hexdump(dechdr.crypteddata.iplbodyhmac, 0x14, 0);

        printf("* calculated EAP KBL body hmac-sha1: ");
        hexdump(bodyhmac, 0x14, 0);

        printf("* flash EAP KBL header hmac-sha1: ");
        hexdump(dechdr.crypteddata.headerhmac, 0x14, 0);

        printf("* calculated EAP KBL header hmac-sha1: ");
        hexdump(hdrhmac, 0x14, 0);
    }

    free(decbody);

    return memcmp(bodyhmac, dechdr.crypteddata.iplbodyhmac, sizeof(bodyhmac)) + 
        memcmp(hdrhmac, &dechdr.crypteddata.headerhmac, sizeof(bodyhmac));
}

// Assembly:
pushq %r15
pushq %r14
pushq %r13
pushq %r12
pushq %rbx
subq $0xc0, %rsp
callq 0x64e9
movq %rax, %r14
leaq 0x2901(%rip), %rdi      # 0x938c
movl $0xa1, %esi
callq 0x4dbd
movq %rax, %r15
leaq 0x28f7(%rip), %rdi      # 0x9396
movl $0xb1, %esi
callq 0x4dbd
movq %rax, %rbx
leaq 0x5871(%rip), %r13      # 0xc324
cmpl $0x0, (%r13)
je 0x6af4
leaq 0x28e0(%rip), %rdi      # 0x93a1
xorl %eax, %eax
callq 0x20b0
movq %r15, %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x38a5
leaq 0x28de(%rip), %rdi      # 0x93bc
xorl %eax, %eax
callq 0x20b0
movq %rbx, %rdi
movl $0x10, %esi
xorl %edx, %edx
callq 0x38a5
movl 0x8(%r14), %edx
leaq 0x3f(%rsp), %r12
movq %r12, %rdi
movq %r14, %rsi
callq 0x2140
leaq 0x30(%r14), %rsi
leaq 0x6f(%rsp), %rdx
movq %r15, %rdi
movl $0x50, %ecx
callq 0x2cf4
leaq 0x7f(%rsp), %rdi
movq %r14, %rdx
subq $-0x80, %rdx
movl 0xc(%r14), %ecx
leaq 0x20(%rsp), %r8
movl $0x10, %esi
callq 0x4a2f
movq %rsp, %r8
movl $0x10, %esi
movl $0x6c, %ecx
movq %rbx, %rdi
movq %r12, %rdx
callq 0x4a2f
cmpl $0x0, (%r13)
je 0x6be0
leaq 0x2876(%rip), %rdi      # 0x93dd
xorl %eax, %eax
callq 0x20b0
leaq 0x8f(%rsp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x38a5
leaq 0x2875(%rip), %rdi      # 0x93fe
xorl %eax, %eax
callq 0x20b0
leaq 0x20(%rsp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x38a5
leaq 0x287c(%rip), %rdi      # 0x9424
xorl %eax, %eax
callq 0x20b0
leaq 0xab(%rsp), %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x38a5
leaq 0x287d(%rip), %rdi      # 0x9447
xorl %eax, %eax
callq 0x20b0
movq %rsp, %rdi
movl $0x14, %esi
xorl %edx, %edx
callq 0x38a5
leaq 0x8f(%rsp), %rsi
leaq 0x20(%rsp), %rdi
movl $0x14, %edx
callq 0x20f0
movl %eax, %ebx
leaq 0xab(%rsp), %rsi
movq %rsp, %rdi
movl $0x14, %edx
callq 0x20f0
addl %ebx, %eax
addq $0xc0, %rsp
popq %rbx
popq %r12
popq %r13
popq %r14
popq %r15
retq