Hacking RELEASE CertNXtractionPack - Get your Switch cert from a NAND dump!

[Addconsult]

What's a command window?

Dont mean to be rude. But if you dont know what CMD is you wont get this running. Its too advanced. You will need a step by step tuturial in detail and this is not for beginners.

 

[NANASHI89]

Alright, Search/Run cmd.exe , that's a command window...

 

[andijames]

Alright Run cmd.exe

Because it's like that and that's the way it is

 

[SocraticBliss]

View attachment 123449

Alright, try

python -m pip install

 

[david watters]

im lost on the 02 file

C:\New folder (2)>python 02.PY
Traceback (most recent call last):
File "02.PY", line 144, in <module>
main()
File "02.PY", line 100, in main
E, N = get_pubk(clcert)
File "02.PY", line 58, in get_pubk
clcert_decoder.enter() # Seq, 3 elem
File "C:\Python36-32\lib\site-packages\asn1.py", line 450, in enter
bytes_data = self._read_bytes(length)
File "C:\Python36-32\lib\site-packages\asn1.py", line 541, in _read_bytes
raise Error('Premature end of input.')
asn1.Error: Premature end of input.

 

[NANASHI89]

Alright, try

python -m pip install

same response

 

[SocraticBliss]

same response

Sounds like your python got installed incorrectly, or you didn't check the box to create an environment variable... might have to uninstall python, then re-install it and make sure the checkbox for create path/environment variable is checked...

 

[Naminave]

Did you edit the 03 file and rename cat to type? Try the zip I uploaded...

I got bored of the editing, and the changes you made in CertNXtractionPack.py did not create the files clcert.der and privk.bin after placing the Keys. I will leave the whole pack, edit the .bat changing cat by type and I already create a 4KB file. Just read the Readme.txt

--------------------- MERGED ---------------------------

What's a command window?

on the keyboard press Windows + R and type cmd in the window, press enter

--------------------- MERGED ---------------------------

If you have problems installing dependencies, change "python3" for only "python" (without quotes) in the commands.

--------------------- MERGED ---------------------------

What's a command window?

I do not understand why you are following this thread if you do not know what CMD is. As you obtained PRODINFO.bin ?, it is necessary to decipher your unique certificate and it is only achieved by executing basic commands in CMD in RCM mode or through script.

 

[ut0pia]

im lost on the 02 file

C:\New folder (2)>python 02.PY
Traceback (most recent call last):
File "02.PY", line 144, in <module>
main()
File "02.PY", line 100, in main
E, N = get_pubk(clcert)
File "02.PY", line 58, in get_pubk
clcert_decoder.enter() # Seq, 3 elem
File "C:\Python36-32\lib\site-packages\asn1.py", line 450, in enter
bytes_data = self._read_bytes(length)
File "C:\Python36-32\lib\site-packages\asn1.py", line 541, in _read_bytes
raise Error('Premature end of input.')
asn1.Error: Premature end of input.

This happens to me too and fix by extracting PRODINFO.bin from my NAND backup using unique BIS Key

 

[david watters]

i got prodinfo from dumping with hekate

 

[subcon959]

Reading a few of the posts in this thread I'm not sure some of you should be messing with this stuff, without learning some of the theory behind it first.

 

[Naminave]

Reading a few of the posts in this thread I'm not sure some of you should be messing with this stuff, without learning some of the theory behind it first.

enlighten us(?

 

[subcon959]

enlighten us(?

I think someone who didnt know what a command prompt was should probably learn the basics before messing about with their console cert.

 

[scottgl]

This doesn't work in producing an unencrypted DER or the private key. Does this only work on firmware version 1.0, or is it supposed to work on all firmware versions? I'm getting the following error from 02_convert_to_der.py:

Traceback (most recent call last):
File "02_convert_to_der.py", line 144, in <module>
main()
File "02_convert_to_der.py", line 100, in main
E, N = get_pubk(clcert)
File "02_convert_to_der.py", line 59, in get_pubk
clcert_decoder.enter() # Seq, 8 elem
File "/usr/local/lib/python3.6/dist-packages/asn1.py", line 447, in enter
if tag.typ != Types.Constructed:
AttributeError: 'NoneType' object has no attribute 'typ'

binwalk clcert.der

DECIMAL HEXADECIMAL DESCRIPTION
--------------------------------------------------------------------------------

We should be seeing cert info from the above command if this was successful.

 

[SocraticBliss]

This doesn't work in producing an unencrypted DER or the private key. Does this only work on firmware version 1.0, or is it supposed to work on all firmware versions? I'm getting the following error from 02_convert_to_der.py:

Traceback (most recent call last):
File "02_convert_to_der.py", line 144, in <module>
main()
File "02_convert_to_der.py", line 100, in main
E, N = get_pubk(clcert)
File "02_convert_to_der.py", line 59, in get_pubk
clcert_decoder.enter() # Seq, 8 elem
File "/usr/local/lib/python3.6/dist-packages/asn1.py", line 447, in enter
if tag.typ != Types.Constructed:
AttributeError: 'NoneType' object has no attribute 'typ'

I don't think you used the correct decrypted PRODINFO.bin, you have to have that first...

 

[Naminave]

I think someone who didnt know what a command prompt was should probably learn the basics before messing about with their console cert.

Well the same I wonder. If you do not know what CMD is, how did you obtain PRODINFO.bin ?. I got it with the latest version of TegraRcmSmash and Payload memloaderv1. It was not easy because I had to dump all the NAND with a text editor and it took me more than 2 hours. Then use HacDiskMount together the keys to dump the RawNand partitions. All that uses CMD or system symbol.

 

[scottgl]

I don't think you used the correct decrypted PRODINFO.bin, you have to have that first...

Ahh, I was using PRODINFO dumped with hexate. I used the script off of gist, so do we need another tool to dump decrypted PRODINFO.bin?

 

[TheZander]

Reading a few of the posts in this thread I'm not sure some of you should be messing with this stuff, without learning some of the theory behind it first.

what's a command window?

 

[SocraticBliss]

Ahh, I was using PRODINFO dumped with hexate. I used the script off of gist, so do we need another tool to dump decrypted PRODINFO.bin?

I used BisKeyDump, Hekate and HacDiskMount...

Hekate
https://github.com/rajkosto/hekate/releases

Bis/Hac
https://switchtools.sshnuke.net/

 

[Addconsult]

What key is it that gets extracted from the prodinfo.bin ?