#include #include int main(int argc, char *argv[]) { // Seems to come from section at 0x1cf700 in NOR. // More work needs to be done to figure out how it is decrypted const unsigned char key[] = {0x03, 0xBF, 0x2A, 0xE2, 0xE4, 0x6B, 0x63, 0x9B, 0xB8, 0xC0, 0x39, 0x71, 0x69, 0xD4, 0xB1, 0x5C, 0x51, 0xD3, 0x39, 0xB9, 0x1D, 0x9C, 0xCE, 0x88, 0xBB, 0x46, 0x8F, 0x43, 0x6E, 0xCF, 0x8E, 0x4B}; // 0x35, 0x24, 0x79, 0xec, 0xce, 0xf2, 0xf1, 0xe8, 0x58, 0x8e, 0x93, 0x5c, 0x26, 0xc3, 0xa1, 0x15, // 0x2b, 0x43, 0x3f, 0x86, 0xbd, 0x1e, 0xd3, 0x15, 0xcc, 0x1c, 0xed, 0x16, 0xc4, 0x67, 0x5c, 0xa2}; AES_KEY aesk; unsigned char in[16], out[16]; int i; AES_set_decrypt_key(key, sizeof(key)*8, &aesk); if(argc < 2) { printf("%s nor_flash.bin", argv[0]); return -1; } FILE *fd = fopen(argv[1], "rb"); if(fd == 0) { printf("Failed to open %s\n", argv[1]); return -1; } #if 0 fseek(fd, 0x100c9, SEEK_SET); fread(in, 1, 4, fd); fseek(fd, 0x100d3+0x80, SEEK_SET); unsigned int fw_size = (in[0]) | (in[1]<<8) | (in[2]<<16) | (in[3]<<24); fw_size -= 1; FILE *fd_out = fopen("decrypted_kernel.bin", "wb"); #else fseek(fd, 0x89, SEEK_SET); fread(in, 1, 4, fd); fseek(fd, 0x93+0x80, SEEK_SET); unsigned int fw_size = (in[0]) | (in[1]<<8) | (in[2]<<16) | (in[3]<<24); FILE *fd_out = fopen("decrypted_ota.bin.gz", "wb"); #endif // fw_size += 0x80; printf("Firmware size %x\n", fw_size); // for(i=0; i