Homebrew Official 5.5.X ELF Loader

[ZAMI]

success is 90% perseverence, 5% inspiration, 4% desperation, 1% luck.

Download your firmware from nus...decrypt kernel.img with expresso ancast key and openssl. slice off the 0x100 byte header, load into IDA set ROM address to 0xffe00100 and load address to 0xffe00100 or thereabouts check the mem kernel memmap for exact offset. Make sure your using PPC as your processor type. go to 0xffe00110 and start your code decompiler there. The 1st function is systemreset at that offset. go to subview...search for strings
find all strings and make sure they are at the appropriate offsets, cross refernce strings to function calls. By default IdA will try to compile to code some stuff that are string. Once you've got your kernel setup, you can start cross referencing your syscalls from coreinit.rpl to kernel.elf. Look for things that are not thread-safe, allow for cross processor sharing of memory addresses and use syscalls. Find some, get addresses, write tests.....wash, rinse, repeat. Find vulnerable functions...write rop, make kxploit, decide to keep private considering how much work it took to do all the above....enjoy your kxploit.

is this exploit for 5.50 or what

 

[Onion_Knight]

is this exploit for 5.50 or what

what?

 

[ZAMI]

what?

what r you expling

 

[Onion_Knight]

what r you expling

that is what you want to do for any firmware. Certainly makes finding vulnerabilities easier.

 

[DeslotlCL]

The only thing that comes to my mind is makerpl.exe

so you guys are trying to get access to kernel stuff? Does that mean you will release a kernel explot soon™? ( ͡° ͜ʖ ͡°)

 

[Don Jon]

so you guys are trying to get access to kernel stuff? Does that mean you will release a kernel explot soon™? ( ͡° ͜ʖ ͡°)

probably not
i guess the hype for kernels and IOUs exploits have died

 

[DeslotlCL]

probably not
i guess the hype for kernels and IOUs exploits have died

i wasnt even being serious, but have fun with whatever you are doing

 

[Jow Banks]

success is 90% perseverence, 5% inspiration, 4% desperation, 1% luck.

Download your firmware from nus...decrypt kernel.img with expresso ancast key and openssl. slice off the 0x100 byte header, load into IDA set ROM address to 0xffe00100 and load address to 0xffe00100 or thereabouts check the mem kernel memmap for exact offset. Make sure your using PPC as your processor type. go to 0xffe00110 and start your code decompiler there. The 1st function is systemreset at that offset. go to subview...search for strings
find all strings and make sure they are at the appropriate offsets, cross refernce strings to function calls. By default IdA will try to compile to code some stuff that are string. Once you've got your kernel setup, you can start cross referencing your syscalls from coreinit.rpl to kernel.elf. Look for things that are not thread-safe, allow for cross processor sharing of memory addresses and use syscalls. Find some, get addresses, write tests.....wash, rinse, repeat. Find vulnerable functions...write rop, make kxploit, decide to keep private considering how much work it took to do all the above....enjoy your kxploit.

OK, I'll byte

What type of cypher is used for kernel.img?
Is it
aes-256-cbc
aes-256-cbf8
des-256-gcm
camellia-256-ofb
or ????

 

[NWPlayer123]

OK, I'll byte

What type of cypher is used for kernel.img?
Is it
aes-256-cbc
aes-256-cbf8
des-256-gcm
camellia-256-ofb
or ????

cbc, with an IV I'm not sure of, it only matters for the 0x10 bytes at the very start after the header, just use an IV of 0

 

[Jow Banks]

so...
openssl enc -aes-256-cbc -d -in kernel.img -out kernel.bin -iv 0
then enter the proper expresso ancast key should work - or am I off track here?

 

[NWPlayer123]

so...
openssl enc -aes-256-cbc -d -in kernel.img -out kernel.bin -iv 0
then enter the proper expresso ancast key should work - or am I off track here?

yes, that should work fine

 

[Onion_Knight]

so...
openssl enc -aes-256-cbc -d -in kernel.img -out kernel.bin -iv 0
then enter the proper expresso ancast key should work - or am I off track here?

you might need to add the -nopad option after -iv 0

 

[Jow Banks]

hmmm. I get a "bad magic number" error.
I verified my expresso ancast key is correct using UWizard - it is green and says Verified as Correct by SHA1

 

[Onion_Knight]

hmmm. I get a "bad magic number" error.
I verified my expresso ancast key is correct using UWizard - it is green and says Verified as Correct by SHA1

your using it as an ascii string right, not as a .bin file

 

[Jow Banks]

your using it as an ascii string right, not as a .bin file

Not a bin file, tried typing it at the Password Prompt, then tried adding it to the command line like this
(replaced the middle real digits with xxx)

openssl enc -aes-256-cbc -d -in kernel.img -out kernel.bin -iv 0 -k 8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7 -nopad

both ways = same error msg.
i must be missing something simple

 

[Onion_Knight]

Not a bin file, tried typing it at the Password Prompt, then tried adding it to the command line like this
(replaced the middle real digits with xxx)

openssl enc -aes-256-cbc -d -in kernel.img -out kernel.bin -iv 0 -k 8xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx7 -nopad

both ways = same error msg.
i must be missing something simple

openssl enc -d -aes-256-cbc -K "KEY HERE" -iv 0 -nopad -in kernel.img -out kernel.bin

try that

 

[Jow Banks]

openssl enc -d -aes-256-cbc -K "KEY HERE" -iv 0 -nopad -in kernel.img -out kernel.bin

try that

That Worked!!!

Thank You, I completely missed that the "K" is case sensitive!
dumb me - I should have known better - being linux and all.

Thank You again - now off to visit my good old friend IDA

Update:
Got it!
It's a 128 Cipher, not a 256!
openssl enc -d -aes-128-cbc -K "KEY HERE" -iv 0 -nopad -in kernel.img -out kernel.bin

 

[davetheshrew]

So @Jow Banks are you going to be a holder, or releaser? lol

 

[Jow Banks]

So @Jow Banks are you going to be a holder, or releaser? lol

I will share everything I find in here.
Right now, i'm looking at the kernel for 5.5.1 and tracing back the function calls so i can give them proper names.

some of the strings i'm cleaning up sample:
kernel.elf (located Kernel_Address_Table at 0xFFEAB7A0)

Spoiler

http://pastebin.com/xVw7XwVn

as you can see, some of the text is misaligned - so im going to fix all of those first.
Done! Updated Spoiler with a pastebin to all stings in align

To use and compare function references to coreinit.rpl strings here:

Spoiler

http://pastebin.com/MXSn37Qv

(Thanks to @aerosoul94 for the IDA .RPL loader)

Its all for fun and learning how to drive this thing now that Mr. Hykem has left the keys in the ignition for us.
(with some prodding and help by Onion_Knight and NWPlayer123 of course)


Update:
@SonyUSA is right and this isn't the right place to discuss this.
I wont add to this thread.

Sorry for the hijack

I'll poke around here until I find a good place for this.

Lastly - If anyone is interested in decoding the FW.IMG for IDA-
do the same this as here except use the STARBUCK ANCAST KEY instead of the expresso and you will find success.

Some ALL of the strings in FW.IMG
(UPDATE: I added all of the strings in three pastebins)
(Note: This does not include all of the null-spaced strings in FW.IMG - yet)

Spoiler

http://pastebin.com/3Sfht3Km
http://pastebin.com/v4b4rk6R
http://pastebin.com/hYz5BF9D

 

[Deleted User]

This all looks very positive! I think we could actually pull this off!