[Defy General] youlsa:
Original first article is as follows...

ohnholic(right, he's the man) is writing his second article.(No, actually he's appending to his original article.)

-------------------------------------------

[Tools] Motorola RSA Signature Bypass Tool..	|	rom정보&자료방

2011.03.14 23:59

작은별빛(ohnholic)

중수

http://cafe.naver.com/androiders/801614

안녕하세요..

Motorola RSA Signature 분석(우회/트릭) 완료했습니다..

전세계 최초로 공개합니다..

모든 모토로라 안드로이드 스마트폰 사용자분들은 자유를 느껴봐요..

지금은 술한잔 해서 정리를 못했지만.. 조만간 정리해서 올려드리겠습니다..

테스트는 모토로라 디파이에서만 했습니다..

커널 및 안드로이드 빌드 능력자분들 또는 의지가 있으신분들은 쪽지주세요....

내일(03.15) 공개하겠습니다....ㅜㅠ

ReVeRse.attack.KoRea

and ReverseAttack

IT KOREA....

----------------

자 설명들어갑니다..

**** 모토로라 RSA 개인키를 찾은게 아닙니다.. - 이게 핸드폰모델마다 다른걸로 알고있습니다.. ****

**** 우회법을 찾은겁니다.. ****

기본

====

기본 지식 공부는 아래 링크에서..

http://en.wikipedia.org/wiki/Public-key_cryptography

http://en.wikipedia.org/wiki/RSA

어찌되었든.. 모토로라 안드로이드 스마트폰에는 RSA Sign이 들어가 있어서 부팅할때마다 Sign을 체크합니다..

맞지않으면 부트로더에서(mbm?) 오류를 뿜죠..

Sign 공부는 아래에서..

http://en.wikipedia.org/wiki/Digital_signature

원리

====

Sign은 개인키로 합니다..

Verify는 공개키로 하죠..

부트로더가 Verify하려면 공개키가 필요하겠죠??

그럼 공개키가 어디있냐...

각 파티션의 끝(?)에 있습니다..

아래를 보세요..

-- boot partition --

07ff780: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ff790: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ff7a0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ff7b0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ff7c0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ff7d0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ff7e0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ff7f0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 0200 0000 ????????????....

07ff800: 3f01 003f 0214 da95 1b6d dc97 073f 403f ?..?.....m...?@?

07ff810: 530f 3f20 3f3f 203f 2f3f 0030 3f3f 0000 S.? ?? ?/?.0??..

07ff820: 024e 293f 3f3f 5758 1f75 183f 3f76 3f3f .N)???WX.u.??v??

07ff830: 1757 3f78 3f1d 0102 0c30 0011 013f 1000 .W?x?....0...?..

07ff840: 0000 7f3f 0000 0003 3f02 5d3f 3f51 4102 ...?....?.]??QA.

07ff850: 743f dfad 3e50 3f33 3f11 536c 4c24 3f40 t?..>P?3?.SlL$?@

07ff860: 195f cfb5 3f7d 3f3f 5676 3f62 2373 0b3f ._..?}??Vv?b#s.?

07ff870: 5544 7e3f 3f3f 733f 443f 3f21 3802 3f3f UD~???s?D??!8.??

07ff880: 103f 3f68 3f3c 3f3f 3fc8 b23f 3f3f 3f30 .??h?<???..????0

07ff890: 3f6b 3f52 623f 3f3f 7e3f 0d3f 2b3f 643f ?k?Rb???~?.?+?d?

07ff8a0: 3f09 6f3f c487 5548 3f3f 436b 3f3f 3f4a ?.o?..UH??Ck???J

07ff8b0: 0a3f 3f3f 7a26 6920 3f3f 3f5f 3fc8 9b3f .???z&i ???_?..?

07ff8c0: 6f39 3f48 3fc7 903f 3f0d 0102 0100 042e o9?H?..??.......

07ff8d0: 4f3d 4d6f 746f 726f 6c61 2049 6e63 2c20 O=Motorola Inc,

07ff8e0: 4f55 3d4d 6f74 6f72 6f6c 6120 504b 492c OU=Motorola PKI,

07ff8f0: 2043 4e3d 4841 4220 4341 2034 3733 4b3f CN=HAB CA 473K?

07ff900: 3f3f 673f 3f41 0100 0439 4f3d 4d6f 746f ??g??A...9O=Moto

07ff910: 726f 6c61 2049 6e63 2c20 4f55 3d4d 6f74 rola Inc, OU=Mot

07ff920: 6f72 6f6c 6120 504b 492c 2043 4e3d 4353 orola PKI, CN=CS

07ff930: 4620 4341 2034 3733 2d31 3b20 534e 3d34 F CA 473-1; SN=4

07ff940: 3439 3602 0000 0301 0001 003f 3f3f 3f22 496........????"

07ff950: 5033 3f0c 3f3f 3f25 3f3f 1542 3f55 3f3f P3?.???%??.B?U??

....

07ffb30: 393f 203f 3f3f 525d 773f 3f35 4b5d 3f2d 9? ???R]w??5K]?-

07ffb40: 3f24 153f 3f3f 663f 133f 3f3f 1375 244e ?$.???f?.???.u$N

07ffb50: 4300 3f46 3f3f 2619 323f 533f 4918 3fe5 C.?F??&.2?S?I.?.

07ffb60: af90 1e3f 3f46 3f1c 7f43 cc97 3f47 1670 ...??F?..C..?G.p

07ffb70: 4a3f 345a caae 7c14 253f 3d7a 0e3f 6f15 J?4Z..|.%?=z.?o.

07ffb80: 3f0b 3f3f 4515 3f47 3f3f 033f 3b59 0f09 ?.??E.?G??.?;Y..

07ffb90: 3f3f 723f 3f3f 6e28 7d3f 683f 2970 773f ??r???n(}?h?)pw?

07ffba0: 7272 743f 6c3f 3f07 3fca 9f5d 3f64 0f2d rrt?l??.?..]?d.-

07ffbb0: 3fd7 8f20 3f00 063f 6d50 c486 3f30 4ad8 ?.. ?..?mP..?0J.

07ffbc0: 9670 323f 3f2c 224e 3d3f 2401 3f3f 1820 .p2??,"N=?$.??.

07ffbd0: 3f3f 3f52 c2b3 3f3f 2d3f c7ae 6d3f 3f3f ???R..??-?..m???

07ffbe0: 3f29 4f3f 1716 073f 0b3f 583f 3f62 3f3f ?)O?...?.?X??b??

07ffbf0: 163c 3fda b866 3f5a 033f 513f 563f 0362 .<?..f?Z.?Q?V?.b

07ffc00: 3f3f 1d3f c2af 3f34 5133 193a 3f69 723f ??.?..?4Q3.:?ir?

07ffc10: 3f1e 653f 7d78 3f31 5d4b 3f78 3f4a 3f3f ?.e?}x?1]K?x?J??

07ffc20: 193f 3f2d 3f3f 663f 4b42 3f1f 3f6f 213f .??-??f?KB?.?o!?

07ffc30: 193f 2c15 110f 3f75 3f3f 7a35 7a10 3f3f .?,...?u??z5z.??

07ffc40: 683f 0b3f 7b1f 063f 3f2e c0a1 4014 1879 h?.?{..??...@..y

07ffc50: 3f51 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ?Q??????????????

07ffc60: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffc70: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffc80: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffc90: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffca0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffcb0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffcc0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffcd0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffce0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffcf0: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

07ffd00: 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f 3f3f ????????????????

모토로라 공개키 2개가 보입니다..

그리고 마지막 1024bit 가 Sign 입니다..(2048bit 일수도 있습니다.)

바이너리 포맷은 아래 링크.. 참고하세요..

https://www.droid-developers.org/wiki/BootRecoverySignature

자 Sign을 검증해보죠..

아래는 루비 프로그래밍 언어 코드입니다..

(Here is how to verify the public key in Ruby language)

--

ga1axy@rvr ~/android $ cat motorola_rsa_sign.rb
#!/usr/bin/env ruby
#encoding: utf-8
require 'openssl'
content_addr = 0x0000000
content_size = 0x07FF800
public_key_addr = 0x07FFAD1
public_key_size = 1024 / 8
rsa_sign_addr = 0x07FFBD3
rsa_sign_size = 1024 / 8
def read_content(file, addr, size)
buffer = nil
File.open(file, 'rb') do |f|
f.seek(addr)
buffer = f.read(size)
end
buffer
end
def hex2dec(hex)
buffer = ''
hex.each_byte do |byte|
buffer << "%02X" % byte
end
buffer.to_i(16)
end
content = read_content('mmcblk1p15', content_addr, content_size)
motorola_public_key = read_content('mmcblk1p15', public_key_addr, public_key_size)
sign = read_content('mmcblk1p15', rsa_sign_addr, rsa_sign_size)
cert = OpenSSL::PKey::RSA.new(1024)
public_key = cert.public_key
public_key.n = hex2dec(motorola_public_key)
puts public_key.verify('sha1', sign, content)
ga1axy@rvr ~/android $
ga1axy@rvr ~/android $ ./motorola_rsa_sign.rb
true
ga1axy@rvr ~/android $
ga1axy@rvr ~/android $

--

당연히 맞다고 나옵니다..

커피한잔 먹고 계속....