[Sony Cross-Device General] p0kemon:
Well. I colected some things. First one which makes sense http://bits-please.blogspot.rs/2016/06/extracting-qualcomms-keymaster-keys.html . Seems first thing which is need is hardware unique keys (keymaster keys) which curently can't be extracted since all known exploits in trust zone is fixed.

Seccond thing.

That makes sense. For example unit 7DA probably realy have dynamic and static part. Dinamic part contain simlock and things which is changeable by sim unlocking. That have sense since if there is no dynamic and static part than unit 851 have no sense since unit 7DA will be changed by sim unlocking. Definitelly only static part of the 7DA is in combination with certificate from unit 851. If somebody have trim area dump before sim unlocking and after sim unlocking please pm me (need to see if unit 851 is changed or not changed after sim unlocking)! [MENTION=3665957]the_laser[/MENTION] I think unit 851 is not a simlock signature, I can see that cert is signed by sony, I don't think hacker sites which doing online sim unlocking have a valid sony private key for making valid certificate in unit 851, right? I think that unit is related to some more units like for example units 7DA, 1046B and 8B2, right?

third thing:

Unit 851. It contain cert (cert related to unit 7DA). I found first 14 bytes which is not part of the cert! What is that 14 bytes?? Another hash? If you skip first 14 bytes from unit 851 you gets certificate.DER

Four thing. See:

unsigned int __fastcall sub_7C8144C8(int a1, int a2)
{
int v2; // r7@1
int v3; // r6@1
int v4; // r5@1
int v5; // r4@3
char v6; // zf@5
unsigned int v7; // r5@13
int v9; // [sp+10h] [bp-38h]@1
int v10; // [sp+14h] [bp-34h]@3
int v11; // [sp+18h] [bp-30h]@4
int v12; // [sp+1Ch] [bp-2Ch]@1
int v13; // [sp+20h] [bp-28h]@1
int v14; // [sp+24h] [bp-24h]@1
int v15; // [sp+28h] [bp-20h]@1
int v16; // [sp+2Ch] [bp-1Ch]@1

v2 = a2;
v3 = a1;
v16 = 0;
v12 = 0;
v13 = 0;
v14 = 0;
v15 = 0;
v4 = readta(0x1046Bu, &v16, &v9);
if ( v4 >= 0 )
v4 = sub_7C820F30(v7C8407A8, v16, v9);
v5 = readta(0x7DAu, &v13, &v10);
if ( v5 >= 0 )
{
v5 = readta(0x851u, &v14, &v11);
if ( v5 >= 0 )
{
v6 = v3 == 0;
if ( v3 )
v6 = v2 == 0;
if ( v6 )
{
if ( readta(0x8B2u, &v15, &v12) < 0 )
{
v15 = 0;
v12 = 0;
}
}
else
{
v15 = v3;
v12 = v2;
}
v5 = sub_7C822A30(v7C8407A8, v13, v10, v14, v11, v15, v12);
}
}
if ( v4 < 0 )
{
LOG(
"[WARNING IN FAC 0x%X CODE 0x%X @ %s:%d]:\n Device key handling failed!\n",
(unsigned int)(32 * v4) >> 21,
(unsigned __int16)v4,
2088942997,
788);
v7 = 0x8008000Au;
}
else
{
v7 = 0;
}
if ( v5 < 0 )
{
LOG(
"[WARNING IN FAC 0x%X CODE 0x%X @ %s:%d]:\n Controlled rooting handling failed!\n",
(unsigned int)(32 * v5) >> 21,
(unsigned __int16)v5,
2088942997,
794);
v7 = 0x8008000Au;
}
if ( v16 )
sub_7C80E1E0(v16);
if ( v13 )
sub_7C80E1E0(v13);
if ( v14 )
sub_7C80E1E0(v14);
if ( !v3 && v15 )
sub_7C80E1E0(v15);
return v7;
}

I'm still unable to reverse enginer all parts of this function. You can see all that units is handled by that function. Description by the_laser can help a lot here, but still very hard understanding whats going on in function related to unit 1046b and how that unit is proccessed, anybody explain?