yashsingh1/xdaforums huggingface dataset:
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Now trying to understand the Cert/RSA part...

Strange A

2 Certs found... but they are the same...

So only 1 Cert...

Strange B

It seems this RSA 2048 is used for few different Models...

So human readable text string SM-G960F inside steady.bin NOT tell us from which device taken...

I have now the 256 Byte Signature... IMHO

And from Cert I can take Public Key...

For now I have 270 Byte... I have to cut the ASN part and Modulus blabla...

For me it is few years ago... to play with RSA 2048...

More then 10 years since EF81, SXG75... BREW...

Best Regards

Edit 1.

270 Byte Copy and Paste from Cert - 9 Byte ASN Header...

3082010A0282010100

= 261 Byte...

- last 5 Byte

0203010001

Here IMHO Modulus inside... Little Endian...

So I have the 256 Byte public key... to decrypt 256 Sig... IMHO

Edit 2.

Looks like no additonal data info inside Signature... only the 32 Byte SHA256...

Sorry for mixed Modulus Exponent blabla... it is really long time ago...
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Now need some time to find the part what is exactly signed with SHA256...

I will try before text string INTE...

#define EM_MAGIC_TOKEN_INTEGRITY "INTE"
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
HEX...

Modulus

DBA26CDA310F16FD59AF700FBD264BB4292FC5621435BD7481E314B84CA73CA64AA65C69DE481C1D8F671FB912E505D742350A22EAA79BD3026F67F62FE8604C8904EE11C8451C4B256833F48EB6A40D6CAD3F21A46F177DD8D419247E711B7D53DBF1361652F329802D29D6FD6F90E8931C677AB6FF7426F024207D6599700A90ED59254E6A73BB45A4E71E95120F5B983B67214BFC2F12A643EDEBAE91D6B4FE54866DE9A5A7BDBEA4FD91F607F4587D476F9EA421FBB9EFFE38AB97D93CF993CA122B7E751E6D5D126F3EC36BD69748DF63BCDECEF688EE99A0CC4EA6C429AEE0C333040D9F0748E0171B0D40106F435D22DCD6D8BFFA718C051BA30E94E9

Exponent

010001

Decrypted 256 Byte RSA 2048 Signature looks like this:

0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF00982F3DFA486BA2E34881A2487C519C39F9F90D2DBDBC61FFC18D17C752F73CFE

0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF008C3398F440C74ADCF603665068D1DD3D2DC7E9F0BD6C4BE7C23415B7E4B246DF

Last 32 Byte is SHA256...

Will upload later few files for better understanding...
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Few more stupid tests...

v1

DID_template_v1.tar

Cutted before text string INTE...

So I removed Signature + Cert 1 + Cert 2 + other crap

<ID:0/004> Added!!
<ID:0/004> Odin engine v(ID:3.1401)..
<ID:0/004> File analysis..
<ID:0/004> Total Binary size: 0 M
<ID:0/004> SetupConnection..
<ID:0/004> Initialzation..
<ID:0/004> Get PIT for mapping..
<ID:0/004> Firmware update start..
<ID:0/004> NAND Write Start!!
<ID:0/004> SingleDownload.
<ID:0/004> steady.bin
<ID:0/004> RQT_CLOSE !!
<ID:0/004>
<ID:0/004> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)

This I can see on my Watch... SM-R875F

DOWNLOADING TOKEN...

Failed to install : (0xf02b0010)

bl_install_token error

Searched for Error Code...

#define EM_ERR_EM_TOKEN_PARSE_INTEGRITY_INFO_MAGIC 0xF02B0010

-------------------

v4

DID_template_v4.tar

#define EM_ERR_EM_CRYPTO_GET_SUBJECT_LEN 0xF01B0013

Few attempts deliver same Error... like DID replaced or other untouched steady.bin...

Not sure why exactly... could be different reason like unsupported Format

-------------------

v6

#define EM_ERR_EM_CRYPTO_VERIFY_CERT_LEN 0xF0100010

Cutted AFTER signature... So I removed both Certs + additional Data

Hmmmmm...

I will try focus on Cert(s)...

A

Why 2 Certs inside if BOTH are 1:1 same?

B

Where is this Cert?

CN = Samsung corporation
OU = Samsung Mobile
L = Suwon city
C = KR

C

I see DRK... maybe...

IMHO Device Root Key?

0.9.2342.19200300.100.1.1 = DRK_V2:20190411232524:777:h3b_Z0yl3Q41uCRBB2JrRoDFZ0pjXD2n0zj22bphxeU=:CEc4Xfgb0a35sEgCXdBqGHZk6n91ypYScxE9gkm4sgU=
DC = SM-G960F
CN = CEc4Xfgb0a35sEgCXdBqGHZk6n91ypYScxE9gkm4sgU=
OU = Mobile Communications Division
O = Samsung Electronics Co. Ltd
L = SVC
C = KR

Maybe we have "all" things somewhere...

Best Regards
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] kalexander7:
I dont think you can dump the steady.bin from Upload "RDX" mode. Maybe the failed flash log, but that's just a memory dump. Here's one I might've not uploaded generated for a SM-G988U: https://drive.google.com/file/d/11CSv-Ob-jaK8rZPSf8m6fEjE5FrKDyPk/view?usp=sharing
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] kalexander7:
If you'd like to all correspond on this please get ahold of eachother on Telegram: https://t.me/+cjLPl5KynDBmODYx
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] Oswald Boelcke:
@kalexander7 I've edited your above post.

Regarding social media links please observe that as an exemption from the last bullet of rule no. 5 of the XDA Forum Rules, we grant only developers the privilege to share references to their social media in their own development threads and if thorough support is provided in the thread. These conditions obviously don't apply to your posts, threads or you. Additional information is also available here:

Telegram Chat Channels - Way Forward

WhatsApp/Telegram Groups and Channels - Going Forward Hello XDA family! Just notifying all members that posting certain links to Telegram and other sites like WhatsApp is now allowed on XDA. What does that mean? We will allow links to messages...

xdaforums.com

Please refrain for sharing of social media references unless within your own development threads!

Thanks for your future cooperation.

Regards

Oswald Boelcke

Senior Moderator
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Cert related search...

IMHO I found full Cert... where pub key only in sboot...

EVA8\result1_imj\extracted\vendor\tee\00000000-0000-0000-0000-000000534b4d
EVA8\result1_imj\extracted\vendor\lib\libengmode2lite.so
EVA8\result1_imj\extracted\vendor\lib\libengmode15.so
EVA8\result1_imj\extracted\vendor.img
EVA8\result1_imj\extracted\system\system\lib\libsec_sem.so
EVA8\result1_imj\extracted\system.img

Need some time... first hit in dd dump...

So need little bit time to pull out

Edit 1.

In recovery.img RAMDISK...

\system\lib\libengmode2lite_recovery.so

Edit 2.

00000000-0000-0000-0000-000000534b4d only pub key like inside sboot.bin Bootloader usefull human readable text strings inside

libengmode2lite.so Full Cert

libengmode15.so only pub key like inside sboot.bin Bootloader usefull human readable text strings inside

libsec_sem.so Full Cert

libengmode2lite_recovery.so maybe same... need to check if from same Firmware

I can not find Cert as file... only as data inside file(s)...

So need some time to cut correct...

So I can check Hash and decrypt Signature
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
I hope not total wrong... still not verified with HASH and decrypted Sig...

I hope I can manage this in 2022... few days left.

Best Regards

Edit 1.

Hmmm.... seems to me not total wrong...

Signature RSA 2048 from CA Cert....

53D94B7B73DE450FCA6FE8EACC842A6AD282CACD8564BCFAC64854FA18E959FA0DA3E70F0F425B5585ACB224BFC250E1CC755889239A160C2B11C74EAAA6E9595A18C5D6C6809F764AE347672371F51E1B4ED5BF1ECEDF9875740F3C0A268CB55A70DAEB95922F0CD38BE7DFF7A52AA65B6030354BAC3

73C6BF6FA653BE1B2C054D1E82E75CCF4A3F8DBF286BAADE56FD7B5A8903BF18AE80B2B9F5FB7F28BC7904DCBB92BEC78AF7AE7A0D638BCDC1A5A448C53839F72BA6BBCBB8ED27CEF948F6E3049E2BEBE9B3ED886D0D0CF76D8E25453C7BA972875E7CAF74C4D230F0AE633820321664CBB1EFA9665D6

45B99D2DFAA6350272400CEFF36C108B3B0B5A

Modulus (pub key)

E0C2818755AFD2D1E08DA3728023B9F63180DF093106DB52B0985A986B1E5CF3506D66BF82A3AB26427B5A0DBA063FE4E40E8655A77A59A4C3D56DC29BC37EC0383343C3BC8508AD65EAEF5F68994CC4E75D5595E4830E2812169FD4C4C66C0CEF1C0980C1B5F93542E7C7EECF863A05DD941BACC27CD

B20216E6C6AA43B8BF41525C932A28700AAEE75D2A9FB860EDAD6C57ABE76A83BBD6E5119A3D4208B6730DE23C2299E6BD3E4F43E75FB85E06E514714B2441DF0ECE9E4C4E145FE506C4E8A11BF5AB30A470D204420CF8BE5CDF1E01B776EAD24B491D69F4D0D4DE53292584A7490066DD55F513AB132

DD57FE5B021EAF160C21C25DD75DB4A32411DD

Exponent

010001

Decrypted Signature:
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF003031300D060960864801650304020105000420D444B09FE9B778A32F49E94B99D99262657C220D8FE4E6CC0E10557A4DF712E3

Edit 2.

Okidoki... this "CA Cert" really "checks" our "Steady Cert 1"...

Decrypted Signature from "Steady Cert 1"
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF003031300D0609608648016503040201050004208F62129ED67DFA856B19287E1D

80DC88C7B2327A5A6833129E25F540CBBE7A8D

Edit 3.

Also the Cert from the latest steady example in this Thread... is valid by this CA Cert...

Decrypted Signature from "Steady Cert 2"
0001FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF

FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF003031300D06096086480165030402010500042051786F640D73E471241DAED1DE

B61E526706848AF746F1F36B6676A9A79423F4
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Hmmm...

Trying to find more about this Cert...

By simple check my files for this Hex Value:

C0383343C3BC8508AD65EAEF5F68994C

This is part of 256 Byte RSA 2048 public key... IMHO long enough for search...

For instance SM-G920F Firmware...

not in sboot.bin...

But something inside system.img

Edit 1.

Extracted system.img from SM-G920F

e:\ODIN_Samsung\CombinationFirmware\smG920F\extracted1\systemX1\lib64\libterrier.so
e:\ODIN_Samsung\CombinationFirmware\smG920F\extracted1\systemX1\lib64\libgkdp_sv_engine.so
e:\ODIN_Samsung\CombinationFirmware\smG920F\extracted1\systemX1\app\mcRegistry\ffffffff000000000000000000000017.tlbin
e:\ODIN_Samsung\CombinationFirmware\smG920F\extracted1\systemX1\app\mcRegistry\ffffffff00000000000000000000000d.tlbin

Edit 2.

Found also in Tizen world...

SM-R765 Tizen crap... Gear S3

COMBINATION-FT30_R765VVRU1BRB1.tar\rootfs\usr\lib\libsec_skpm.so
COMBINATION-FT30_R765VVRU1BRB1.tar\rootfs\usr\bin\security-util-server
COMBINATION-FT30_R765VVRU1BRB1.tar\rootfs\usr\bin\reactivationlock_server
COMBINATION-FT30_R765VVRU1BRB1.tar\rootfs\usr\apps\sem_daemon\bin\sem_daemon
COMBINATION-FT30_R765VVRU1BRB1.tar\rootfs\usr\apps\mcRegistry\ffffffff00000000000000000000002f.tlbin
COMBINATION-FT30_R765VVRU1BRB1.tar\rootfs\usr\apps\mcRegistry\ffffffff00000000000000000000000d.tlbin

Edit 3.

Cert seems created in 2013...

I found also in Gear S2 SM-R732...

IMHO since they introduced Reactivation Lock...

So steady partition is visible inside PIT...
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Puh...

Because last attempt with RSA 1024 more then 10 years ago...

Anyway.

Found the "to be signed" part...

ASN.1 Header are 4 Bytes

-

Then RSA 2048 Signature is 256 Byte... at end of file... so easy to find...

-

Then the tricky part... few bytes more to remove...

- 20 Bytes... no idea what it is... but then SHA256 matches the decrypted result from RSA 2048 Signature

Now will check the 2 Certs from steady examples...

Then I can test my own Cert... with my own key(s)...

Only to be sure my Bootloader is also dumb...

Or it check in chain... if CA key match...

Best Regards
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Okidoki... found the "to be signed" part also in the 2 other Certs...

In the next few days... I will try to fake...

So I can continue to play with steady.bin...

Best Regards
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Ah... okidoki

#define EMC_ROOT_PUBLIC_KEY_SIZE 294
#define EMC_SIGNATURE_SIZE 256 /* RSA2048 */
#define EMC_DIGEST_SIZE 32 /* SHA256 */
#define EMC_ASN1_DIGEST_SIZE 51 /* 19(ASN1) + 32(SHA256) */
#define EMC_ASN1_CERT_HEADER 4
#define EMC_ASN1_SIGNATURE_HEADER 20
/* CERT(cert_len) = |CERT+SIGN ASN1 HEADER(4)|REAL CERT|SIGN ASN1 HEADER(20)|SIGN(256)| */
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Hmmm... still some weired clicking through Internet...

As search text string...

Samsung Secure Boot Key

https://docs.samsungknox.com/admin/fundamentals/whitepaper/samsung-knox-for-android/core-platform-security/root-of-trust/

IMHO I have the public part of:

Samsung Secure Boot Key (SSBK)

ss_ca_pubkey...
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
P = BD5AE1BD28BF003CA9B2824878A14527C32EA00E932CE67A10125F8E3F8A61A67A4ED5743E0FDCB82F284816A7DFD9E82F6D008F1CD8F0FC4DCAC608BE97F7F7D4F4863783C04368505C18E8EC25D9335B98D893E5EE9CCA3A2788618E847D630AEDACCD53AC4AA225D13AC3FB5A9896C077265C466F8BA207012E816B6F6919
Q = BEF0C4022443AA2B5F909430992987BA8F86E3A9DCA87FA33C20128D51685F2D25DD1BEF281A295F96E83A59EC3F419A19DBF349E28B85C33F06A370E61FB02F62736C4A1673457B417C4A5B0A3F1530B002B36994959F0E1DD69A36B1D006C0F1957BCFAADEF346972EF796CD907868F29D6347B2800ACB6D888CA592E43BB1
Exp1 = 6A309A61EB84D9CC2B5AA9879CE6CC12957A0356C920A80C12114BB7495900944D0902D9D2A8309EB60B8009FC9123F1FB0EC4FE7D2E084F660CEE6C1EFEB8982ABC0ABCFD4D08406AB88B5BAC7B39487CF8C59483A1021AC2EC42A67B373FDE1855DBCFB639EC0CECEA5E6B63FD958F0D568493C1087325258A7B1B2735EE99
Exp2 = 2A33A2CEEA5EFE3C89E9B5A72C230EB9C0414B0E5F13EAEA143EEE7AC7946EFCD692913B01BD0E89EF1BB2D1EF3267F87C60ADDC15B34AC445A8DCF4F617E8E400398CA4AF6398E6CE297F71B1C91190EA461E8B6668CF77DA46755D435DBC3066F4E821951DA3DD654ADF34388906E40343A00ED7B80F2AB931E60C2E743D71
Coeff = B16C596D6351EE963CBC12668038EFBABE7D82627AF360F0C480BD5C1AB475A96BFD30A313C4FA1D0563A48BD3C2523EC342F13C3D0ADCC66513EC526E4CCB69ECE77463401CB79FC3BE8293E221810FE7850B6D65FE008CB6F6094C301E691AE3E634E2424A666BEF75EC83B3368A4900B03B9373F16873924506A7AB42D796

Priv Exp = 0D6D1CCB6657A1C28F0FED86CF9D22ABAF343FB0D490DD768CC8D3DCB6AA8B82F31FC9976F1A932CA06D9DDFC0971E627822EA269CEE1DD808DBFB6E3EC94FFA090382F1450F4777A71F48994C624CDA6FF33ED04265B713D2710FDECFF5F47BBC3FA94561F11E72336E4E04771511E46EBDD2723E187400062FC4789A7FAB1D4211D4CD105462487602608EBD59A9C193EFE65B07680A532E74EF02FC683250401A4F38CFAFB7F10654FB13C8E7C6D3AF258AE4EEBA3FD52310D3B1FBC8F1B078563ECEAC2EABD358F4577EBEEAA8F5C5AD88973DCF5B9BAA16710578A40F66EEACA29B15F3CD989071E0A5E76852590A9D090CD14EF1FBF90CA30E6CDA8D21
Publ Exp = 010001
Modulus = 8D3B89B92FF1604FE995BECCDBF3A4C5ECB4A06B022CEED4CB3EF20557C4AC6EED77CBC8AE38A75E01EBB1889769287CC52A33678F5C938F51C79DB8F1AC1AF81EE185121C4596361E772B6CD0C2D1132BACFD225978DABE49B09B507F930C488DBC33DB70545511B1C3E228C928222A9317706F4B26AE03B9EEE9C13BE8EEC69F2211C9E8496AAE10B69574A3667BDD63D512C2F4D2DEFFE62F9BF6F3A9F0D926189F9D3AB13C3539CDF5F6E92E157F7874850C407F1A527E527482A18A4D8949E7C35F722C62AA776183448DFDCA6751519DE022E823EE850D5524554ECBD24D8B563626193D73A2479AB9603DA83EB2EDE63D9F3F6024FEA29D84D1846D49

For my stupid tests to fake Cert(s)...

Prepared RSA 2048 Key(s)...

IMHO for simplicity will use same key for all 3 Certs...

So my tiny brain will maybe not explode...

Need some time...

Later more...

Best Regards

Edit 1.

Result 1... for CA Cert...
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Short tested unmodified Steady example ... last 1... with my SM-A202F

<ID:0/015> Added!!
<ID:0/015> Odin engine v(ID:3.1401)..
<ID:0/015> File analysis..
<ID:0/015> Total Binary size: 0 M
<ID:0/015> SetupConnection..
<ID:0/015> Initialzation..
<ID:0/015> Get PIT for mapping..
<ID:0/015> Firmware update start..
<ID:0/015> NAND Write Start!!
<ID:0/015> SingleDownload.
<ID:0/015> steady.bin
<ID:0/015> RQT_CLOSE !!
<ID:0/015>
<ID:0/015> Complete(Write) operation failed.
<OSM> All threads completed. (succeed 0 / failed 1)

On Display I can see only this:

TOKEN unique is invalid

No nice Error Codes like on my SM-R875F...

Best Regards
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
First attempt with Fake steady.bin leads to this Error:

#define EM_ERR_EM_CRYPTO_VERIFY_CERT_FAILED_VERIFY 0xF0100015

v1

I have only replaced Cert with my Fake Cert...

So I know for sure 256 Byte Signature is wrong...

v2

I will correct Signature with encrypted SHA256... to check if same Error Code

v0 was Original Steady:

200412BD2ACB3011.tar

This deliver this Error Code:

#define EM_ERR_EM_CRYPTO_GET_SUBJECT_LEN 0xF01B0013

I can also downgrade to much older sboot Bootloader to check if same Errors...
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Found this via Google...

Attacking RSA keys

RSA keys need to conform to certain mathematical properties in order to be secure. If the key is not generated carefully it can have vulnerabilities which may totally compromise the encryption algorithm. Sometimes this can be determined from the public key alone. This article describes...

www.sjoerdlangkemper.nl

Leads for instance to this:

GitHub - RsaCtfTool/RsaCtfTool: RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data - RsaCtfTool/RsaCtfTool

github.com

Not tested yet...

Best Regards
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Summary for 2022...

A

I have only steady.bin aka eToken from this thread... no latest IMHO...

So no idea what changed for newer Bootloader nor Phones

B

I found in nearly all steady.bin 1 Cert...

I have 2 different...

But both are verified by Samsung CA Cert... see Screenshot

So IMHO chain is Samsung crap

C

it is RSA 2048...

public key and Signature have same size... 256 Byte

D

From Samsung CA Cert...

pubkey Samsung CA SSBK

E0C2818755AFD2D1E08DA3728023B9F63180DF093106DB52B0985A986B1E5CF3506D66BF82A3AB26427B5A0DBA063FE4E40E8655A77A59A4C3D56DC29BC37EC0383343C3BC8508AD65EAEF5F68994CC4E75D5595E4830E2812169FD4C4C66C0CEF1C0980C1B5F93542E7C7EECF863A05DD941BACC27CDB20216E6C6AA43B8BF41525C932A28700AAEE75D2A9FB860EDAD6C57ABE76A83BBD6E5119A3D4208B6730DE23C2299E6BD3E4F43E75FB85E06E514714B2441DF0ECE9E4C4E145FE506C4E8A11BF5AB30A470D204420CF8BE5CDF1E01B776EAD24B491D69F4D0D4DE53292584A7490066DD55F513AB132DD57FE5B021EAF160C21C25DD75DB4A32411DD

D.1

For simple search through your files... you can take 16 Byte of these 256 Byte...

E0C2818755AFD2D1E08DA3728023B9F6

16 Byte seems enough to find public key and full cert...

Examples from my Total Commander search...

SM-F700N_1_20200623141033_qxilrt588r_fac\AP_F700NKOU1ATF4_CL18932600_QB32309976_REV00_user_low_ship_MULTI_CERT_meta_OS10.tar.md5
SM-F700N_1_20200623141033_qxilrt588r_fac\AP_F700NKOU1ATF4_CL18932600_QB32309976_REV00_user_low_ship_MULTI_CERT_meta_OS10.tar\super.img.lz4
SM-F700N_1_20200623141033_qxilrt588r_fac\BL_F700NKOU1ATF4_CL18932600_QB32309976_REV00_user_low_ship_MULTI_CERT.tar.md5
SM-F700N_1_20200623141033_qxilrt588r_fac\BL_F700NKOU1ATF4_CL18932600_QB32309976_REV00_user_low_ship_MULTI_CERT.tar\NON-HLOS.bin.lz4
SM-F700N_1_20200623141033_qxilrt588r_fac\BL_F700NKOU1ATF4_CL18932600_QB32309976_REV00_user_low_ship_MULTI_CERT.tar\vaultkeeper.mbn.lz4
SM-T280_1_20181211170627_owma15duls_fac\AP_T280XXS0ARJ2_CL10429622_QB20196516_REV00_user_low_ship.tar.md5
SM-T280_1_20181211170627_owma15duls_fac\AP_T280XXS0ARJ2_CL10429622_QB20196516_REV00_user_low_ship.tar\system.img
SM-G920F_Factory_Firmware_XXU_Engineering_Bootloader.tar.md5
SM-G920F_Factory_Firmware_XXU_Engineering_Bootloader.tar\system.img

Many more... found it in Tizen crap... Exynos and also Qualcomm devices...

E.

Maybe it leads to:

/efs/sec_efs/root_cert.der

/efs/sec_efs/drk_cert.der

/efs/sec_efs/service_cert.der

F.

Fake steady.bin not work as CA Cert is in Bootloader sboot.bin for instance...

G.

IMHO "we" have 3 public keyS aka Modulus...

Maybe 1 weaker...

Maybe it is possible to do some RSA hack...

H.

I need more time to search through my files...

Maybe more hints TEE related or Samsung Pay or...

I have no idea about DRK ... Device Root Key etc...

All I know is... CA Cert is since 2013...

So this sh it is inside MANY Samsung PhoneSSSSSSSSSSSSSSSSSSSSSSS.

Since nearly 10 yearS

Best Regards
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
No idea if false alarm... or maybe closer...

After found 2 text strings... inside:

/lib/libsec_skpm.so

from SM-G960F Firmware...

Also stuff like this inside...

-----BEGIN RSA PRIVATE KEY-----

d:\GW4_****\2023\G960\extracted\x\image1\lib64\liberis_strongswan.so
d:\GW4_****\2023\G960\extracted\x\image1\lib64\libstrongswan.so
d:\GW4_****\2023\G960\extracted\x\image1\priv-app\Fast\Fast.apk

d:\GW4_****\2023\G970\extractedG970U\extracted\x\image\system\carrier\ATT\priv-app\MobileSecurity_ATT\MobileSecurity_ATT.apk
d:\GW4_****\2023\G970\extractedG970U\extracted\x\image\system\lib64\liberis_strongswan.so
d:\GW4_****\2023\G970\extractedG970U\extracted\x\image\system\lib64\libstrongswan.so
d:\GW4_****\2023\G970\extractedG970U\extracted\x\image\system\priv-app\Fast\Fast.apk

alt Tab SM-T...forgotten
d:\GW4_****\ddDumps\dddump1\extract\Partition25\lib\libstrongswan.so

SM-A202F
d:\GW4_****\ddDumps\dddump_smA202F\extract\Partition25.bin
d:\GW4_****\ddDumps\dddump_smA202F\extract\Partition25\system\lib64\liberis_strongswan.so
d:\GW4_****\ddDumps\dddump_smA202F\extract\Partition25\system\lib64\libstrongswan.so
d:\GW4_****\ddDumps\dddump_smA202F\extract\Partition25\system\priv-app\Fast\Fast.apk
[Samsung Galaxy S20 / S20+ / S20 Ultra Questions & ] adfree:
Easier for me... I have installed the Samsung CA Cert...

So easier to see chain...

Meanwhile I have 4 Certs...

1 CA

2 from steady.bin exampleS

1 found in libterrier.so in many Samsung devices

Oldest device I have at home is SM-G800F where I can find the CA Cert...

So Samsung S5 use this Cert for something...

So I have 4 RSA 2048 public key aka Modulus...

No idea if 1 is easier/weaker to crack...

Perfect would be to have the CA private Exponent aka private key...

Copy and Paste from these 3 "Server Certs"...

0.9.2342.19200300.100.1.1 = DRK_V2:20190411232524:777:h3b_Z0yl3Q41uCRBB2JrRoDFZ0pjXD2n0zj22bphxeU=:CEc4Xfgb0a35sEgCXdBqGHZk6n91ypYScxE9gkm4sgU=
DC = SM-G960F
CN = CEc4Xfgb0a35sEgCXdBqGHZk6n91ypYScxE9gkm4sgU=
OU = Mobile Communications Division
O = Samsung Electronics Co. Ltd
L = SVC
C = KR

------------

0.9.2342.19200300.100.1.1 = DRK_V2:20190309124437:520:B4EuVjHlakYeIrsy69XJ92tpArRVJ3z1Lvig9e1xPVM=:Q5hIIhaIP7wxOTvVM3eLnWa1CDAIxe3lhZ8M5yZ3cx4=
DC = SM-G970U
CN = Q5hIIhaIP7wxOTvVM3eLnWa1CDAIxe3lhZ8M5yZ3cx4=
OU = Mobile Communications Division
O = Samsung Electronics Co. Ltd
L = SEVT
C = VN

----------------------------------

0.9.2342.19200300.100.1.1 = SVR-P:20131205:KRCS00:RU
OU = Samsung Mobile
CN = Samsung corporation
L = Suwon city
C = KR

-----------------

So it looks interesting to me... deliver few text search stringS...

Best Regards