[Upgrading, Modifying and Unlocking] tonyv2:
Hi

Great work xXhighpowerXx

so theres another kernel in nand ?

i was thinking about sorting out uboot env variable partition crc problem which i guess is responsible for this message

*** Warning - bad CRC or NAND, using default environment

then pass something like this "kgdboc=ttybcm0,38400" /kernel debugger

kgd seems to be in kernel according to .config in kernel source

could set env variables with linux command

http://elinux.org/U-boot_environment_variables_in_linux

About AES:-

in /2835-kernel-2.6.32/drivers/misc/vmcs_services/otp/otp_ioctl.h

// BCM2708B0 has less reliable OTP so we need a redundant row for the boot signing key (and the corresponding parity)

#define OTP_BOOT_SIGNING_KEY_ROW (OTP_BOOT_ROM_ROW_REDUNDANT+OTP_BOOT_ROM_SIZE_IN_ROWS) // 19

#define OTP_BOOT_SIGNING_KEY_SIZE_IN_ROWS 4

#define OTP_BOOT_SIGNING_KEY_ROW_REDUNDANT (OTP_BOOT_SIGNING_KEY_ROW+OTP_BOOT_SIGNING_KEY_SIZE_IN_ROWS) // 23

#define OTP_BOOT_SIGNING_PARITY_ROW (OTP_BOOT_SIGNING_KEY_ROW_REDUNDANT+OTP_BOOT_SIGNING_KEY_SIZE_IN_ROWS) // 27

#define OTP_BOOT_SIGNING_PARITY_SIZE_IN_ROWS 1

#define OTP_CODE_SIGNING_KEY_ROW (OTP_BOOT_SIGNING_PARITY_ROW+OTP_BOOT_SIGNING_PARITY_SIZE_IN_ROWS) // 28

#define OTP_CODE_SIGNING_KEY_SIZE_IN_ROWS 4

#define OTP_CODE_SIGNING_KEY_ROW_REDUNDANT (OTP_CODE_SIGNING_KEY_ROW+OTP_CODE_SIGNING_KEY_SIZE_IN_ROWS) // 32

#define OTP_CODE_SIGNING_PARITY_ROW (OTP_CODE_SIGNING_KEY_ROW_REDUNDANT+OTP_CODE_SIGNING_KEY_SIZE_IN_ROWS) // 36

#define OTP_CODE_SIGNING_PARITY_SIZE_IN_ROWS 1

#define OTP_HDCP_AES_KEY_ROW (OTP_CODE_SIGNING_PARITY_ROW+OTP_CODE_SIGNING_PARITY_SIZE_IN_ROWS) // 37

#define OTP_HDCP_AES_KEY_SIZE_IN_ROWS 4

#define OTP_HDCP_AES_KEY_ROW_REDUNDANT (OTP_HDCP_AES_KEY_ROW+OTP_HDCP_AES_KEY_SIZE_IN_ROWS) // 41

#define OTP_HDCP_AES_PARITY_ROW (OTP_HDCP_AES_KEY_ROW_REDUNDANT+OTP_HDCP_AES_KEY_SIZE_IN_ROWS) // 45

#define OTP_HDCP_AES_PARITY_SIZE_IN_ROWS 1

1 row = 32 bits

location 19 ,23 fit

but aes key is not repeated no idea about parity

there is alternative for BCM2708A0 but doesn't have repeated bootrom signing

in /Roku3/u-boot/include/aimage.h

#define IMG_FLAG_ENCMODE_CBC_4KBLOCKS (2 << 6) /* image data is encrypted before signing: CBC mode, 4k byte blocks, block group iv = (iv + (first block's block offset))

this isn't very clear assume using two meanings of block and

block1=128 bytes

block2=4096 bytes

for no of block1's =n

IV = IV_orig + (n mod (4096/128))

http://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher-block_chaining_.28CBC.29

CBC_4KBLOCKS is found in this source as well

ftp://tiger.satsale.net/tiger/!public_for_users/STB225/stb225_base_gpl.tar.gz seems to be related to roku

dd if=nanddump bs=1 skip=2621696 count=40824832 of=/dev/shm/cramfs

IV in end of 2048 byte cramfs header

see aimage.h

dd if=nanddump bs=1 skip=2623488 count=40824832 of=/dev/shm/cramfs

used binwalk with

magic =

0 string imgARMcC Roku aimage SB ,{offset-adjust:-8}

>8 lelong 0 \b, Release ID: Dev

>8 lelong !0

>>8 lelong 0x585822b8 \b, Release ID: Default

>>8 lelong !0x585822b8

>>>11 byte x \b, Release ID: %d.

>>>10 ubyte x \b%d-

>>>8 leshort x \b%d

>>>8 lelong x (0x%x)

>12 lelong 0x53B22500 \b, Platform ID: Default

>12 lelong !0x53B22500

>>12 lelong x \b, Platform ID: 0x%x

>16 lelong 0x0 invalid

>16 lelong 0x1 \b, Type: text

>16 lelong 0x4 \b, Type: env

>16 lelong 0xa \b, Type: initfs_cramfs

>16 lelong 0xd \b, Type: app_cramfs

>16 lelong 0xe \b, Type: firmware_blob

>16 lelong 0x18 \b, Type: uimage

>16 lelong 0x19 \b, Type: uboot

# Ignore images <256 (minimum header size)

>20 lelong <256 invalid

>20 lelong x \b, length header + data + trailing padding: %d

>24 lelong x \b, length dataStartOfsetToStartPadding: %d

>28 lelong x \b data_start_offset: %d

>32	lelong x	data_link_address: %d

>36	lelong x	data_entry_point_offset: %d

# Flags don't appear to be used for anything other than Encryption state

#>40 lelong x Flags: 0x%08x

>40 ubyte 0x0 \b, Encryption: None

>40 ubyte 0x40 \b, Encryption: cbc_onepass

>40 ubyte 0x80 \b, Encryption: cbc_4kblocks

>40 ubyte 0xC0 \b, Encryption: ctr

# Date must be after 1/1/1990

>44 ledate >631173600

>>44 ledate x \b, Build Date: "%s"

>48 lelong !0

>>(48) lelong !0

>>>(48) lelong !0xffffffff

>>>>(48) string x \b, Build Host: "%s"

>232	lelong	x	\b,iv1 :%x

>236	lelong	x	\b,iv2 :%x

>238	lelong	x	\b,iv3 :%x

>242	lelong	x	\b,iv4 :%x

first larger cramfs

2621440	0x280000	Roku aimage SB ,, Type: initfs_cramfs,iv1 :fe76af5d,iv2 :33633d10,iv3 :9c5a3363,iv4 :95d9

dd if=nanddump bs=1 skip=2623488 count=40824832 of=/dev/shm/cramfs

edit: checked with hex editor binwalk seems to give wrong hex values for IV offset seems correct

tried openssl

openssl enc -aes-128-cbc -d -k 432FF69CB3FAD844F9EA6868A9EBD825 -iv 5DAF76FE103D63335A9CD99500000000 -nosalt -nopad -in cramfs -out decramfs

didn't work

>file decramfs

>data

this didn't

openssl enc -aes-128-cbc -d -k C6EADBEFDF093587E21CA59DAF6E2947 -iv 5DAF76FE103D63335A9CD99500000000 -nopad -nosalt -in cramfs -out decramfs

didn't work

>file decramfs

>data

the first 4k should be ok

could have made a mistake

going to build my own nand reader any tips, links. thinking porting avr source code to msp430.

http://simplemachines.it/martin/mizar32/1.6.0-AT32UC3/COMPONENTS/MEMORY/NAND_FLASH/NAND_FLASH_GPIO/

http://www.atmel.com/Images/doc32110.pdf

Tonyv