| Commit message (Collapse) | Author | Age |
| ... | |
| |
|
|
|
|
|
|
|
|
|
| |
The new search has two new features:
- it takes advantage of the fact that DES keys are only 56-bit long (and not 64)
- it is now multithreaded
As a proof of concept, I ran it on the A10 series firmware upgrade and was able
to find the key in a few seconds using 4 threads. The search is still limited
to ascii hex passwords (seems to work on all devices I have tried thus far).
Change-Id: Ied080286d2bbdc493a6ceaecaaadba802b429666
|
| |
|
|
|
|
| |
The power off/option does not exist on some models.
Change-Id: Ifb45293b3b3faa96d9fece2340cbd98299a4a0b7
|
| |
|
|
| |
Change-Id: I55ca29627801b5e760d1dbe407d96cd055f659ab
|
| |
|
|
| |
Change-Id: Ic3ef964e8b5cc7b8ca3f02f141e9e4436a4d41db
|
| |
|
|
| |
Change-Id: I4bef0824eeed54238578d8b24a9845e8602d61af
|
| |
|
|
|
|
|
|
|
|
|
|
| |
This is code is intended to development into a library of code for the NWZ that
will be useful to write the "bootloader" on those device. At the same time, it
comes with test programs that are easy to run in firmware upgrade mode and also
provide a great test bench for the library. At the moment, two test programs are
available:
- test_display: simply prints two messages using /usr/bin/lcdmsg
- test_keys: displays input key event
Change-Id: I9d214894ffc9127b528fcdd3eb5d6b61f4e657a7
|
| |
|
|
|
|
| |
The new script allows the upgrade to execute a file found on the user partition.
Change-Id: I564941d01bcdbae050002e77cb119f3d95ecdc21
|
| |
|
|
|
|
|
|
| |
The exec_file allows to embed a script/executable and run it on target. It takes
of unpacking, remounting contents rw and redirect output to exec.txt at the root
of the drive. More generally, rework how the makefile works.
Change-Id: Iec719227be96e80701ad8f5398d2d34389f4da9e
|
| |
|
|
|
|
|
|
| |
There was a lot of copy and paste, and the code was just crap. This commit tries
to clarify the code and also document the encryption procedure. Hopefully I didn't
break anything.
Change-Id: I257793010e7cf94f2b090b30bb8608359d3886e3
|
| |
|
|
|
|
| |
Also fix a typo in the script makefile
Change-Id: Ie747d8b99ca0f6a98bbcaf1c82e66c7788f00e6e
|
| |
|
|
|
|
| |
KAS was in its own structure for historical reasons, but it's stupid now.
Change-Id: Ie8d69ac6d489337cd857ace1abe5b1e4b1177172
|
| |
|
|
| |
Change-Id: I315d1010ce5477c0112f4a890156b360e8123e11
|
| |
|
|
|
|
|
|
|
| |
There is a windows port of the sg_utils library for scsi pass-
through. This little changes make it compile under mingw. A better
fix would be to implement direct ioctl on both windows and linux
but that's already better than nothing
Change-Id: I0d77cd1bad69806a66f0590362f165f24fa240e9
|
| |
|
|
| |
Change-Id: I882956c0022db846882c68f8aac7f9d8fe49dfa8
|
| |
|
|
| |
Change-Id: I9c3e2eb95f7eb6d41591b006328fd720dfcf93a5
|
| |
|
|
| |
Change-Id: Iaebb442611c64fe4d47a07ce3b3d12c3230cafe5
|
| |
|
|
| |
Change-Id: I9a15c347cfaab821b0cfc01744c5b6b8267c40ea
|
| |
|
|
| |
Change-Id: Iaa89df27b7a0c4eb9fc6603c431de3d1fe791fa1
|
| |
|
|
|
|
|
|
|
|
| |
There is a vendor specific command to read the NVP of the device,
including the KAS. The trick is that the data is randomly
scrambled using a so-called para_noise array of random values.
There seems to be a problem when retrieving large entries (>1000
bytes typically) which causes sg_pt do behave strangely.
Change-Id: Iefa6140df78ab9c7dcf7ac34cb1170979123ecd7
|
| |
|
|
|
|
|
|
|
|
| |
This tool can send vendor specific scsi commands to sony nwz
players such as getting serial number, model id, device info,
and others. It can potentially be used to get some private keys
stored on the device but probably not the KAS used to encrypt
firmware upgrades images(UPG).
Change-Id: Ia49c1edf8d421b20c4e9afeb1192e00e06eb6047
|
| |
|
|
|
|
| |
This tool can unpack UPG archives for firmware updates.
Change-Id: I32f5f1a84759198c7af4a4ecfd7aa65eaeda567a
|
|
|
This tool is specific to the em1/mp200 sony based players. In
deals with raw emmc images (which is possible but hard to get).
This tool is also useful as a documentation of the underlying
emmc format used for a future port.
Change-Id: I66c9b0e47351e5d89f6a404aa62038e00fdc1093
|