[Windows Mobile Development and Hacking General] oryan_dunn:
Some of the information in this post may be sprinkled throughout this thread, but I wanted to figure out how to create the SdCard.key file and how it worked.

It turns out, there is no magic, and can be done without using dodgy software downloaded from the internet (more on this later).

The main take-away is that the SdCard.key file is just the SD card Product Serial Number in decimal encrypted with an RSA public key.

The hurdles to make this happen are #1 obtaining the SD card PSN, and #2 getting the RSA key.

Hurdle #1:

The PSN is read out of the SD Card Card Identification (CID) register. To read this register requires an SD Card reader directly connected to the computer as opposed to via the USB bus. I had originally tried my modern HP laptop, but even though it was an internal SD Card slot, it was connected via the USB bus. Same with my Dad's new Dell laptop. I have an old Dell Inspiron 1420 that has an SD card slot, and it was connected directly. It's then possible with Linux to read that register with the command cat /sys/block/mmcblk0/device/cid (if that doesn't work, search the /sys file tree for cid to find it).

Thanks to Gough Lui [1], using his page, you can quickly grab the PSN.

The CID register has the following format:

0x1234567890ABCDEF1234567890ABCDEF

where

0x 12 3456 7890ABCDEF 12 34567890 ABCD EF
| | | | | | |
| OEM ID | Revision | | CRC
| Product Name ASCII | Manufacture Date
Manufacturer ID Product Serial Number

In this case, the PSN would be 0x34567890 and in decimal is 878082192.

Hurdle #2:

The public key to encrypt the PSN is all that's needed. Finding it was a bit of a challenge, but both the FordActivator.apk and GenFordKey.exe windows app have the necessary key embedded into them. It's possible to find download links for both of these, but it's usually from dodgy download sites. Both apps do make the process "easy", but FordActivator requires an Android 5 or 6 device with an SD card slot, and a micro SD card. The windows app that I got, the UI was all question marks (probably a missing language pack on my Windows install), but luckily it's super simple with just a text field, 3 radio buttons and a button. To use it, just put the in the PSN in hex without 0x, select the top radio button, and click the button.

I just happened upon the key from the GenFordKey windows application because the executable was on my NAS, and my old Windows laptop didn't trust my SMB share. When running the UI, Windows asked if I trusted the location, I clicked yes to get the UI.

Then after putting in the serial number (in hex but without the 0x), and clicking the button, it again asked if I trusted the location, this time to run the included openssl.exe. However, because it paused at this point, it had written out two temporary files (to the directory where GenFordKey.exe was located), in.txt and key.txt which was the RSA private key in PEM format. With this key, it's possible to both encrypt and decrypt the SdCard.key file.

I was also curious about the FordActivator.apk, and I used http://www.javadecompilers.com to decompile the APK. In sources/com/n0b0dy/fordactivator/Keygen.java is the modulus and exponent for the public key.

Using oliv's excellent answer at [2], we can create an ASN1 definition file, which we can give to openssl to create the public key PEM file for use with openssl.

I could just attach the public key file here, but I'll leave it up to someone else to post the key directly.

Once you have both the PSN in decimal and a key file (either the public or private key), you can just run openssl to create SdCard.key. Using the example from above, here's a linux command line to create the SdCard.key file:

If you have the public key:

echo "878082192" > openssl rsautl -encrypt -inkey publickey.pem -pubin -out SdCard.key

And with the private key:

echo "878082192" > openssl rsautl -encrypt -inkey privatekey.pem -out SdCard.key

If you have the private key, you can verify the results with:

openssl rsautl -decrypt -inkey privatekey.pem -in SdCard.key -out out.txt

And you should see the PSN in decimial in out.txt

[1]: https://goughlui.com/2014/01/02/project-read-collect-decode-sd-card-cid-register-data/

[2]: https://stackoverflow.com/a/36448243/3362479