yashsingh1/xdaforums huggingface dataset:
[LG Optimus 4X HD] marsgod:
I think this is the same as http://xdaforums.com/showpost.php?p=33407854&postcount=16

so the tegra_fuse_dumper work fine. and it dump the so called secure_boot_key fuse register. (I don't know is it the same register used by nvflash or not.....:))
[LG Optimus 4X HD] Tim_Pan:
I forgot the site I ever posted..

http://androidroot.mobi/t3_nvflash/

and I got this

nvflash -w

Nvflash started
rcm version 0X4
Command send failed (usb write failed)

but

nvflash -w --sbk

Nvflash started
unknown command: --sbk
[LG Optimus 4X HD] Dexter_nlb:
they made a "wheelie" wrapper to use this tool i think. and they used a tegra edition of nvflash where sbk was not included it seems, but not helping us. i saw the same "usb write failed", so if we can add sbk, it might be better but its missing.
[LG Optimus 4X HD] reas0n:
What about to research Hidden Menu (3845#*880#) maybe we could find something
[LG Optimus 4X HD] The_0ne:
I have found this on the internet.

Is this related to our SBK consisting of zeros?
[LG Optimus 4X HD] reas0n:
nah, i have the same.

@edit that apx driver works http://d-h.st/OvU

@edit2 now after nvflash -w it shows Nvflash started and doesn't do nothing, lol

@edit3 and i also get unknown command: --sbk
[LG Optimus 4X HD] adverserath:
thinking about it, that would be a very secure key. If you brute forced it, it would be the 3rd to last key you test. and you might guess all positive bits, or ending in 0. could we not test this against any public key. I run a logcat on startup a while ago and seen some startup keys displayed. not sure what they were. Might be worth looking again.
[LG Optimus 4X HD] arnookie:
Will this help?

LG Open Source Code

Is this any use at all?

http://www.lg.com/global/support/opensource/opensource-detail.jsp?detailCustomerModelCode=LGP880

http://www.lg.com/global/support/opensource/opensource-detail.jsp?detailCustomerModelCode=LGP880G
[LG Optimus 4X HD] Tim_Pan:
http://whrl.pl/RcEqHL

so,can we rewrite sbk?
[LG Optimus 4X HD] marsgod:
tegra fuse registers , is so-called OTP memory(One Time Program), this means you have only one time to write to these registers(burn, program....). After you "burned" your fuse registers , you can't burn it again, you can only read it out. And fuse registers is non-valitied memory, so after you remove battery, their values will be still there after you power on again.

fuse registers can be used for the OEM factory "burn" their device infomation, serial no, etc.

For the tegra2/tegra3 devices, the fuse registers function have been pre-defined by nvdia, some area store device's key, secure_boot_key, odm_production flag, and something else.

The tegra2/tegra3 APX interface , may use the fuse-burned secure_boot_key to AES encrypt it's commuication, so every OEM factory can define it's own secure_boot_key by burned the key into fuse-registers before the device goto sell.... For example, LG defines its secure_boot_key=0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFF00, and burned every LG-P880 devices with this key. When LG get back a so-called "hard-brick" device, it use nvflash --sbk 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFF00 to re-write the device's bootloader, and re-flash the ROM, this is so-called unbrick.

I think Nvdia has not set security protection on fuse registers read/write in hardware. So every fuse register can be read/write in bootloader or somewhere(sure, you can only program it once).

To protect the SBK from being read out by user, there is a if-else check in linux kernel source , if it found that in odm_production_mode , then it deny the read secure_boot_key in user space through the /sys/firmware/fuse/secure_boot_key.

This program will try to dump out the whole fuse registers, and bypass the kernel protection.

BTW, there is some probility that nvflash use a "computed SBK" as a AES key. for example , it use a 0xFFFFFFFF FFFFFFFF FFFFFFFF FFFFFF00 XOR 0x3275923 4324322 2345996 000233 as the AES key, and the later part of the values is hardcode in the tegra2/tegra3 hardware.
[LG Optimus 4X HD] Tim_Pan:
@marsgod

I get it.:p

but what should we do now?

Is the "zero" sbk correct?

or should we need a special nvflash?
[LG Optimus 4X HD] roesti91:
But wont this be just the public encryption key stored on the device, so the phone can check you are authentic "LG" using nvflash or sending firmware updates etc.? I think the private key is the actual "sbk parameter" for the nvflash software and can only be leaked or computed, nothing to do with the public key stored on the phone? Probably I am wrong, but please correct me :confused:
[LG Optimus 4X HD] marsgod:
Good question.

Public encryption implementation in hardware is not so easy. According to Tegra2 hardware manual, there is no public encryption hardware engine in it. Only an AES encrytion engine.

Implement a RSA or ECC encryption in software need a lot of software coding, I don't think it is possible implement in the Nvidia APX interface. But it is possible in bootloader, so the AES encrypt the APX communication, prevent user modify its official bootloader, then the official bootloader use a public key verify the ROM.

If we can make out the AES encryption key (maybe it is just the secure_boot_key), then we can use nvflash flash a new cracked-bootloader, which has no ROM verfication feature, then we can flash any custom ROMs.
[LG Optimus 4X HD] marsgod:
yes, I built the tegra_fuse_dumper v0.1/v0.2 according to these files.
[LG Optimus 4X HD] marsgod:
If anyone has a lenovo K1 pad , please run tegra_fuse_dumper , to see wheather the secure_boot_key is

0x0d0a6f49 0x6c577634 0x4d634e55 0x47336d55
[LG Optimus 4X HD] infeu:
has anyone used the tool to get SBK from Atrix?
[LG Optimus 4X HD] Dexter_nlb:
i believe question was, how an Atrix reacted on the sbk hack? this is a LG dump
[LG Optimus 4X HD] roesti91:
Thanks, I agree, this SBK dumper must work (unless the key is accessed some other way) during the APX comm init. Can one dissamble the way the APX-receiving-end on the phone accesses the SBK on the tegra to decrypt incoming traffic from nvflash?
[LG Optimus 4X HD] Dexter_nlb:
I disagree, just take the OneX, it got no APX mode at all, so no chance of unlocking except using the standard htcdev.com unlock , as it no more than easy for the vendor to modify the bootloader to suit their wishes, so LG could as it is shown, use additional security and use different nvflash tools if any exists, since their primary way of updating is through their serial driver, using kdz files.

SBK can be useless or it can be a key to use for the broken apx mode, but since we got no details and reengineering of the bootloader is not done yet, we got no real details.

im still looking for a compatible IDA advanced decompiler, so i can modify the ARMv7 binaries, so far it seems incompatible, and im not gonna pay for a new update as it looks now.
[LG Optimus 4X HD] WillySonicteam:
This tools of the Asus Prime helps??

http://www.xda-developers.com/andro...loader-is-locked-encrypted-show-your-outrage/

I edited this post two months rear...

Open a .apk and read the command, helps to find the bootkey?

This models have a Tegra 3 Cpu's:

This is the .apk for Unlook the bootloader in the Asus Prime.

Unlock Device App: Unlock boot loader(Only works with TF201 ICS OS)

http://www.mediafire.com/?vh8mto3jvezaavk

Bug solution...

http://www.xda-developers.com/android/asus-unlocker-tool-broken-asus-claims-rma-is-the-answer/

And...

This tool now only works with TF300T ICS & JB of TW,US,WW CN SKU. It won’t work

http://www.mediafire.com/?i8qenn0pp0etitb
[LG Optimus 4X HD] The_0ne:
Which binaries do you mean exactly?
[LG Optimus 4X HD] Dexter_nlb:
im just looking for IDA compiler update :) lol

at least do not comment on that any further here or it gets OT and very wrong ;)
[LG Optimus 4X HD] marsgod:
The code maybe lie in the BootROM, and I don't know is there any way to dump it out.
[LG Optimus 4X HD] maberib:
Dexter, have you seen the Hopper decompiler? I've never used it, but one of the security researchers I follow on Twitter, @0xabad1dea , recommends it. It's cheap too.
[LG Optimus 4X HD] The_0ne:
http://pan.baidu.com/share/link?shareid=176361&uk=3475199254

I don't know if this is already known (properly it is), but I found this in a Chinese forum. Maybe it's useful for somebody.
[LG Optimus 4X HD] Dexter_nlb:
you got a link, or should i just use google on hopper? (sounds like a chopper to me :) )
[LG Optimus 4X HD] Tim_Pan:
special?

just a mod of stock rom...
[LG Optimus 4X HD] Dexter_nlb:
it was just a system backup with malware apps removed, still the stock v10e
[LG Optimus 4X HD] The_0ne:
OK, thx for enlightenment :good:

I wasn't able to read Chinese. :o
[LG Optimus 4X HD] maberib:
Hopperapp dot com is the site. There's a basic tutorial from the researcher here: h tee tee pee double dot slash slash abad1dea.tumblr.com/post/23487860422/analyzing-binaries-with-hoppers-decompiler .
[LG Optimus 4X HD] akizakian:
did anybody actually test this 0xFF...FF00 key? Did it work? Does anybody here have a factory cable to test in in APX mode? If somebody here can try to dump the SBK from working Atrix 4g, I would test it on my bricked device. I have a factory cable ready.
[LG Optimus 4X HD] Entropy512:
There's almost no way in hell that the real key value is 0xFFFFFFFFFFFFFF... (and so on...) - This would constitute a MASSIVE security ****up on the part of whoever burned the fuse, might as well not lock it at all!

That would be like someone setting their luggage combination to 0000

Those fuses are protected by readback in hardware. If you're reading a fuse value that's all foxes or a combination of foxes and zeroes - the hardware is blocking you from reading the value.

The number of people who have failed to be able to talk to the device using the "pulled" key is a clear indication it's not real.
[LG Optimus 4X HD] lilstevie:
Wheelie is not a wrapper in the slightest. Wheelie was built by reverse engineering nvflash and reimplementing the low level functions to bootstrap the device. nvflash communications do not require the SBK past RCM communication, wheelie steps through the RCM protocol into the unencrypted nv3p part of the protocol.

The locking of fuses is controlled by the bootrom very very early on. If ODM Operating mode is set to ODMSecure read access to the SBK fuse lines are locked out. You cannot get access to them again without power cycling the fuse cluster which is on die and cannot be done without a reboot. You are speculating without basis for what you "think" without having reversed bootrom or bootloaders and have no idea on what is the case.
[LG Optimus 4X HD] marsgod:
But I want to know, where do you get this conculsion? tegra2 datasheet?

In tegra2 datasheet, I only found that the "Scratch Registers" has secure bits that can enable the read/write of special scratch registers. And if you try to read back a read-protected scratch register, hardware will send you all zero.(not FFFFF....)

There is no fuse register document in the datasheet....

According to tegra linux kernel source, you can find that user can program the fuse, and read them back.They are in the /sys/firmware/fuse/ .....

BTW, I don't think scratch register == fuse.
[LG Optimus 4X HD] lilstevie:
Some simple logic would tell you that the SBK is not 0xFFFFFFFFFFFFFFFFFFFFFF00 especially when others in the thread have tried it and gotten the 0x4 error from nvflash which means that it is not the sbk. Also the fuses are designed to be secure, that would be one monumental ****up by nvidia if all it took was a kernel patch to reveal the sbk.
[LG Optimus 4X HD] Shuny:
Actually I don't think versions of nvflash previously used to test the SBK were the good ones. The latest version of nvflash doesn't have a --sbk switch. The help included with nvflash mentions a "nvsbktool" tool, but I have no idea how to get it or how to use it. I would gladly make some tests but I feel it would be too dangerous to mess around, especially when my device is in APX mode.

Here is the nvflash found in the Tegra development pack found on the nVidia website: http://www.mediafire.com/?g8sr4hzu7p82291

If anyone knows how to use the SBK with this version of the tool, I think it would be worth it.
[LG Optimus 4X HD] Entropy512:
It's this thing called "common sense". A device that allowed you to read back a security key burned into its fuses would be an epic failure in terms of security design.

Similarly, anyone who knows anything about cryptography would see that 0xFFFFFF.... pattern and know that it couldn't possibly be a real key from a production device. A good crypto key is indistinguishable from random data.

Also, frequently, reading back memory that doesn't exist gives you foxes and not zeroes.

Manufacturers often make security mistakes - but there's no way LG made one as incredibly stupid as what would be required for this key dumper to actually pull a real key.
[LG Optimus 4X HD] lilstevie:
it doesn't matter, the 0x4 error is a 0x4 error regardless.

also danger is nil when you issue --sync on the command line with the bare minimum, it does nothing but step the device into nv3p and leave the server waiting for further instruction, but again 0x4 means the SBK is wrong period.
[LG Optimus 4X HD] twaffle:
You can read the SBK all day long, but I don't believe you'll ever actually read it. What'd be really interesting is to be able to write an SBK, and use this to unlock a phone. lol
[LG Optimus 4X HD] The_0ne:
Regardless of how the SBK looks like what would be a possible way for LG to open the bootloader (via OTA)?

Maybe a noob question?
[LG Optimus 4X HD] lilstevie:
in this case no, the same mechanism that prevents you from reading it also prevents writing, writing requires the device to not be in ODM_PRODUCTION or ODM_SECURE modes (which are the same modes which shut down read access to the fuse set)
[LG Optimus 4X HD] kholk:
Guys, perhaps I'm a bit late on this thread, but well, I wasn't that late because I already tried that way prior my O4X to go to LG's service center.

Just... delete that way from your minds.

There isn't only a permissions problem and kernel driver protection.... the problem resides elsewhere.

The SBK is being masked by an HW register at every boot. That register can only be set ONCE, so, after it being set by the bootloader, you can't set it back to zero in any way.

The only way to reset that register that will mask the content of the fuse array containing the SBK (remember: OTP!) is to power down the chip and, well, you know, if you power it down, then you'll have to power it up, pass from the bootloader again and ... looks like rendundant, eh?

I'm sorry to destroy that dream.
[LG Optimus 4X HD] emre81tr:
nice to see u againe

have read dexters thread doing a htc sens alpha rom back up which is not working only cell
[LG Optimus 4X HD] RuedasLocas:
No one have nothing to say?...
[LG Optimus 4X HD] muellersmattes:
Kholk, can you please tell us how you bricked the phone? And what else you have tried so far?

Gesendet von meinem Transformer mit Tapatalk 2
[LG Optimus 4X HD] reas0n:
He had just flashed another bootloader :D
[LG Optimus 4X HD] muellersmattes:
thanks. But how could he do it?

Gesendet von meinem Transformer mit Tapatalk 2
[LG Optimus 4X HD] reas0n:
Maybe via recovery..
[LG Optimus 4X HD] friartuckme:
hi guys,, il first say that im new to the andoid side of things so please forgive me for any noob questions or thoughts.

what i wanted to ask is there not a way to make a tool similar to sbcalc for your sbk which being generated from the androidboot.serialno

now i know this wont be correct but i tried the method of getting ny androidboot.serialno or cpuid and used the sbcalc and it gave me this - 0xA2195100 0x761CD506 0x7EE73604 0xBE055203
[LG Optimus 4X HD] reas0n:
Man : O i think u did it!!!!!! Cause it really looks like SBK. So what we have to do now?

@edit damnit.
[LG Optimus 4X HD] Dexter_nlb:
:( sbcalc is made for Acer A500 , it was used on tegra2 devices to calculate the unique sbk which all Acer A500 had got calculated using their serial.

sorry, but i doubt it works although the calculator creates something that looks good :(
[LG Optimus 4X HD] lilstevie:
The A500 SBK calculation algorithm leaked for that, it is specific to A500 devices as that is acers own implementation
[LG Optimus 4X HD] twaffle:
The SBK can never really BE read. Ever.

The SBK can be used by the hardware AES engine alone.
[LG Optimus 4X HD] reas0n:
So we have to wait for LG, that's all. They unlocked P990 so we're going to get the unlocked BL too as they said
[LG Optimus 4X HD] Marcb:
Since it's practically confirmed that we'll have an unlock bootloader in Jelly Bean update.... why don't you just wait? why have all the trouble to do this?

Just sit back and chill...
[LG Optimus 4X HD] RuedasLocas:
I'm happy cause not everybody share the same attitude... :rolleyes:
[LG Optimus 4X HD] Marcb:
LG already said they are going to unlock the bootloader, so everybody should break their minds, waste their time, trying to figure out how to unlock the bootloader with no actual chance of success, so that a couple of weeks later LG releases the new firmware with the bootloader already unlocked?

Wow... sounds like an awesome idea! :good:
[LG Optimus 4X HD] dfreake:
or help dexter :)
[LG Optimus 4X HD] Dexter_nlb:
or simply release their own build from source, which some devs like much more :)

i just shown it is possible without unlocking bootloader.

anyways i got patience for a LG release if they believe they will release it for Europe, we always seem to get their release first, like nordics do with some LG models with different products, like tv as well.

kholk could always spend some time building a cm10 from source, which we all will benefit from. im still trying to get my stupid pc working 100% on that build , LOL
[LG Optimus 4X HD] Tim_Pan:
good news here

http://xdaforums.com/showthread.php?t=2100111
[LG Optimus 4X HD] OopsWare:
i write a new kernel module, to read SBK from the fuse IO directly, but got full of 0xff too.

and then i modify the code, to full dump the fuse data .

View attachment 1646874
[LG Optimus 4X HD] naset:
I know u oopsware. Ur are from motorolafans.com a long time ago.u create awesome apps for motorola e680i eventho there is no sdk. Ur a very2 good developer. :)
[LG Optimus 4X HD] OopsWare:
glad meet u
[LG Optimus 4X HD] Lightsword1942:
Is this something that should work on the Motorola Photon/Atrix Tegra 2 devices? For v.2 I get the error "insmod: init_module 'ss.ko' failed <Exec format error>" and for v.4 I get "Can't open /sys/firmware/fuse/secure_boot_key! Are you ROOT?!" On my devices there is nothing named "secure_boot_key" inside of fuse but there is something named "SecureBootKey".
[LG Optimus 4X HD] RuedasLocas:
:eek:
[LG Optimus 4X HD] friartuckme:
hi OopsWare,ive given your one a test and heres what i get

<6>[ 948.961835] lge-battery lge-battery: read recording data is [48]

<4>[ 952.486572] testk: module license 'unspecified' taints kernel.

<4>[ 952.492679] Disabling lock debugging due to kernel taint

<1>[ 952.501170] ---------------------------------

<1>[ 952.505906] Module is loaded

<1>[ 952.508981] ---------------------------------

<1>[ 952.513747] clk_enable ...

<1>[ 952.516672] fuse_cmd_sense ...

<1>[ 952.519970] 0000: 02b00009 57003381 270fe600 02128000

<1>[ 952.525454] 0008: 40000000 91414946 93c40000 ffc71789

<1>[ 952.530733] 0010: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.536187] 0018: 047fffff 00000200 00000000 00000000

<1>[ 952.541462] 0020: 00000000 00000000 00000000 00000000

<1>[ 952.546933] 0028: 00000000 03b50000 4b000000 4042485c

<1>[ 952.552227] 0030: 0000000b 0077e150 00000000 00000000

<1>[ 952.557505] 0038: 00000400 00000000 00002fc0 2e5ee5c0

<1>[ 952.562968] 0040: 03fcccc0 00000000 00000000 00000000

<1>[ 952.568242] 0048: 00000000 00000000 00000000 00000000

<1>[ 952.573863] 0050: 00b76178 00000000 00000000 00000000

<1>[ 952.588151] 0058: 00000000 00000000 00000000 00000000

<1>[ 952.593546] 0060: 00000000 00000000 00000000 00000000

<1>[ 952.598768] 0068: 00000000 00000000 00000000 00000000

<1>[ 952.604275] 0070: 00000000 00000000 00000000 00000000

<1>[ 952.609566] 0078: 00000000 00000000 00000000 00000000

<1>[ 952.615021] 0080: 00000000 00000000 00000000 00000000

<1>[ 952.620313] 0088: 00000000 00000000 00000000 00000000

<1>[ 952.625600] 0090: 00000000 00000000 00000000 00000000

<1>[ 952.631048] 0098: 00000000 00000000 00000000 00000000

<1>[ 952.636242] 00a0: 00000000 00000000 00000000 00000000

<1>[ 952.641506] 00a8: 00000000 00000000 00000000 00000000

<1>[ 952.648406] 00b0: 00000000 46f70652 e002bc04 43882103

<1>[ 952.653673] 00b8: 0034fff4 002ad000 22b8df00 124b2202

<1>[ 952.658841] 00c0: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.664093] 00c8: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.669475] 00d0: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.674650] 00d8: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.679882] 00e0: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.685124] 00e8: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.690546] 00f0: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.695713] 00f8: ffffffff ffffffff ffffffff ffffffff

<1>[ 952.700899] clk_disable ...
[LG Optimus 4X HD] reas0n:
^ you didn't add the most important part of that.
[LG Optimus 4X HD] friartuckme:
heres it is again but in 2 parts(pages)
[LG Optimus 4X HD] tdhite:
Hi,

just fyi -- I compiled the module for the Photon 4G (locked bootloader and matching kernel). Loading the module results in:

<4>[99994.600252] Disabling lock debugging due to kernel taint

<1>[99994.606898] ---------------------------------

<1>[99994.606922] Module is loaded

<1>[99994.606937] ---------------------------------

<1>[99994.607174] Error get fuse clk

I'll look into it a bit. Device names for the fuse apparently don't match your phone.
[LG Optimus 4X HD] Dexter_nlb:
as we see the need for the source code, you should maybe either post the sourcecode attached to this or remove it from topic?
[LG Optimus 4X HD] tdhite:
Huh? The source was attached in the quoted text. Look for: Attachment 1646874.
[LG Optimus 4X HD] muellersmattes:
That's Oopsware's sbk/fuse dumper, not the one from marsgod.
[LG Optimus 4X HD] tdhite:
And that's the one I commented on. I'm happy to help out, here, but when I comment on an included quote, I make a (seemingly grand? :confused:) assumption folks will realize that is the information to which I refer.

I can happily try out the OP's original source as well (margod, I think), so I'll take a look.

But if you want the source to the results regarding my post, that remains in the quoted text.

Sorry if I confused, but I'm not sure how to better explain to what I refer than an explicit quote. I must be missing something :(.

---------- Post added at 10:49 AM ---------- Previous post was at 10:36 AM ----------

eek -- I might have missed the point. Upon downloading the module from the OP, seems *that* source is missing. :silly:
[LG Optimus 4X HD] The_0ne:
http://http.download.nvidia.com/tegra-public-appnotes/

http://nv-tegra.nvidia.com/gitweb/?p=tools/tegrarcm.git;a=summary

http://nv-tegra.nvidia.com/gitweb/?p=tools/tegra-cbootimage-configs.git;a=summary

Maybe these links help somebody out there.
[LG Optimus 4X HD] Lightsword1942:
Just wondering if anyone has more information on this, trying to get it to work on the Motorola Photon.
[LG Optimus 4X HD] thediksta:
i got there in the end but found it easier with this tool,

confirmed working on a500 iconia and nexus 7 and lg 4x hd
[LG Optimus 4X HD] Lightsword1942:
So you actually have a working nexus 7 SBK?
[LG Optimus 4X HD] thediksta:
Yeh, just used this tool and its easy, why is this a big deal or something?
[LG Optimus 4X HD] Lightsword1942:
Is the SBK valid? What rom on the nexus 7 did you use? and what specific version of this program?