From 4c4ae97635422916264186295a61f02495a2f3f3 Mon Sep 17 00:00:00 2001 From: Eljakim Date: Wed, 11 Dec 2024 11:54:30 +0100 Subject: [PATCH] started on mib3 kdf --- documentation/source/index.rst | 7 + .../key_derivation/images/fscrypt.drawio.svg | 314 ++++++++++++++++++ documentation/source/key_derivation/index.rst | 71 ++++ 3 files changed, 392 insertions(+) create mode 100644 documentation/source/key_derivation/images/fscrypt.drawio.svg create mode 100644 documentation/source/key_derivation/index.rst diff --git a/documentation/source/index.rst b/documentation/source/index.rst index 321965c..33eb382 100644 --- a/documentation/source/index.rst +++ b/documentation/source/index.rst @@ -16,3 +16,10 @@ Documentation on Samsung devices, currently mainly the Samsung S7. Here we're ex BootROM_8890/03_exploit_boot_chain.rst BootROM_8890/04_xen_and_mib3.rst BootROM_8890/05_notes.rst + + +.. toctree:: + :maxdepth: 2 + :caption: Key derivation: + + key_derivation/index.rst \ No newline at end of file diff --git a/documentation/source/key_derivation/images/fscrypt.drawio.svg b/documentation/source/key_derivation/images/fscrypt.drawio.svg new file mode 100644 index 0000000..dfa2c88 --- /dev/null +++ b/documentation/source/key_derivation/images/fscrypt.drawio.svg @@ -0,0 +1,314 @@ + + + + + + + + +
+
+
+ DomU1 +
+
+
+ + + DomU1 + + + + + + + + + + +
+
+
+ fscrypto +
+
+
+ + + fscrypto + + + + + + + + + +
+
+
+ fscryptUnlock +
+
+
+ + + fscryptUnlock + + + + + + + + + +
+
+
+ KeyStoreOpen +
+
+
+ + + KeyStoreOpen + + + + + + + + + +
+
+
+ get_key_desc +
+
+
+ + + get_key_desc + + + + + + + + + + +
+
+
+ IOCTL via Kernel +
+
+
+ + + IOCTL via Kernel + + + + + + + +
+
+
+ KeyStoreGet +
+
+
+ + + KeyStoreGet + + + + + + + + +
+
+
+ Key is added to kernel keyring +
+
+
+ + + Key is added to kernel keyring + + + + + + + +
+
+
+ + fscryptKeyAdd + +
+
+
+ + + fscryptKeyAdd + + + + + + + + + +
+
+
+ OpenHandle +
+ to +
+ + /dev/mobicore-userif + +
+
+
+ + + OpenHandle... + + + + + + + +
+
+
+ fscrypto +
+
+
+ + + fscrypto + + + + + + + +
+
+
+ Kernel +
+
+
+ + + Kernel + + + + + + + + + + +
+
+
+ Access File +
+
+
+ + + Access File + + + + + + + +
+
+
+ KeyStoreGet +
+
+
+ + + KeyStoreGet + + + + + + + +
+
+
+ Dom1 +
+
+
+ + + Dom1 + + + + + + + +
+
+
+ + KeyStoreClose + +
+
+
+ + + KeyStoreClose + + + + + + + + + Text is not SVG - cannot display + + + + \ No newline at end of file diff --git a/documentation/source/key_derivation/index.rst b/documentation/source/key_derivation/index.rst new file mode 100644 index 0000000..87f7e69 --- /dev/null +++ b/documentation/source/key_derivation/index.rst @@ -0,0 +1,71 @@ +=================== +MIB3 Key derivation +=================== +This section is dedicated to the key derivation process on the MIB3 High (VAG) head unit. + +As per this: + +.. code-block:: c + + void fscryptUnlock(char *path) + + { + int iVar1; + 1. + local_8 = ___stack_chk_guard; + fprintf(_stdout,"Call to fscryptUnlock with Path %s\n",path,&stdout,0); + iVar1 = waitfor_timeout("/dev/mobicore-userif",0xffffffffffffffff,0xffffffffffffffff,1); + if (iVar1 == 0) { + iVar1 = get_key_desc?(path,&local_60); + if (iVar1 == 0) { + iVar2 = KeyStoreOpen(); + if (iVar2 == 0) { + iVar2 = KeyStoreGet(&local_60,0x10,&local_48,0x40); + if (iVar2 == 0) { + KeyStoreClose(); + iVar2 = fscryptKeyAdd(&local_48,&local_60); + if (iVar2 < 0) { + iVar1 = -5; + fscryptKeyWipe(&local_48,0x40); + } + else { + fscryptKeyWipe(&local_48,0x40); + } + } + else { + KeyStoreClose(); + iVar1 = -3; + } + } + else { + iVar1 = -3; + perror("Failed to connect to TEE"); + } + } + } + else { + iVar1 = -3; + fwrite("Failed to wait for kinibi interface\n",1,0x24,_stderr); + } + if (local_8 == ___stack_chk_guard) { + return; + } + /* WARNING: Subroutine does not return */ + __stack_chk_fail(iVar1); + } + +Or in a diagram: + +.. figure:: images/fscrypt.drawio.svg + + + + +.. code-block:: c + + void KeyStoreGet(void *key_id,uint id_len,void *key_buffer,uint key_len) + + +TODO: + + * What is located at ``/dev/mobicore-userif`` in domu1? \ No newline at end of file