Homebrew AES key scrambler

[windwakr]

$ arm-none-eabi-objdump -b binary -m arm -D arm90.bin|wc -l
142684

I'm not sure how fast you can read disassemblies, but one hundred and forty-two thousand instructions mixed with data (plus a few redumps because objdump isn't clever enough to detect switches to Thumb mode) seems like a lot to sift through.

When I have time, I'll instead try:

1. Encrypt all-0 with keyslot 0x39 as-is. Save that result.
2. Read ARM9 binary for firmware 9.3. For each offset, read 16 bytes, set those as keyY and see if encrypting all-0 matches the result from before.
3. Read ARM9 binary for firmware 9.0. For each offset, read 16 bytes, set those as normalkey and see if encrypting all-0 matches the result from before.

EDIT: That plan seems to have failed with the step for the 9.3 keyY already.

Getting the normalkey from the decrypted firmware would definitely be easier than trying every 16 bytes. And the keyY can probably be obtained from the O3DS 9.3+ firmware.

I'd get this done, but I don't have a N3DS. So I can't decrypt N3DS firmware to get the normalkey.

 

[Suiginou]

Getting the normalkey from the decrypted firmware would definitely be easier than trying every 16 bytes. And the keyY can probably be obtained from the O3DS 9.3+ firmware.

I'd get this done, but I don't have a N3DS. So I can't decrypt N3DS firmware.

Trying every 16 bytes failed anyway, and that was the decrypted ARM9 firmware binary.

N3DS NATIVE_FIRM didn't start using N3DS-only crypto before 9.5, so you can decrypt 8.1, 9.0, 9.3 on an O3DS just as well.

 

[windwakr]

Trying every 16 bytes failed anyway, and that was the decrypted ARM9 firmware binary.

N3DS NATIVE_FIRM didn't start using N3DS-only crypto before 9.5, so you can decrypt 8.1, 9.0, 9.3 on an O3DS just as well.

No, I'm pretty sure arm9loader has always existed on N3DS. You definitely need a N3DS to decrypt the firmware.

If you open your 'decrypted' firmware in a hex editor, you'll find most of it looks like garbage.

 

[Suiginou]

If you open your 'decrypted' firmware in a hex editor, you'll find most of it looks like garbage.

Well shit. That's what the huge block of 0xFF near the beginning meant. Abort mission, I guess.

Oddly enough, hashes checked out:

Section 2              
 Type:                  ARM9
 Address:               0x08006000
 Offset:                0x00066A00
 Size:                  0x0008B600
 Hash (GOOD):           6549A292591840F5730C03323F2A0594F3EAE3486ED63D46B79BE309282C593C

 

[windwakr]

If I'm reading the rxtools code right:
https://github.com/roxas75/rxTools/blob/master/rxtools/source/features/firm.c#L86
https://github.com/roxas75/rxTools/blob/master/rxtools/source/features/configuration.c#L255

It looks like it might save a decrypted copy of N3DS firm when run on N3DS. If someone's running rxtools on a N3DS, please send me your rxtools folder.

 

[Suiginou]

@windwakr On a similar note, can you find the 0x25 keyX anywhere in O3Ds NATIVE_FIRM? I can't find it, and given that it's not glaringly obvious, thorough disassembly may be required to even find the NFC keys.

 

[windwakr]

@windwakr On a similar note, can you find the 0x25 keyX anywhere in O3Ds NATIVE_FIRM? I can't find it, and given that it's not glaringly obvious, thorough disassembly may be required to even find the NFC keys.

No, 0x25 keyX is not found directly in the firmware. The firmware uses some data on the 3DS to generate that key, then clears the data. Which means you need execution before the firmware clears the data to obtain the keyX for yourself. But since it was leaked anyways, it doesn't really matter.

 

[Suiginou]

If I'm reading the rxtools code right:
https://github.com/roxas75/rxTools/blob/master/rxtools/source/features/firm.c#L86
https://github.com/roxas75/rxTools/blob/master/rxtools/source/features/configuration.c#L255

It looks like it might save a decrypted copy of N3DS firm when run on N3DS. If someone's running rxtools on a N3DS, please send me your rxtools folder.

Wasn't the keyY introduced in 9.3, though? Even if you have the 8.1/9.0 NATIVE_FIRM for the normalkey, the corresponding keyY is missing.

 

[windwakr]

Wasn't the keyY introduced in 9.3, though? Even if you have the 8.1/9.0 NATIVE_FIRM for the normalkey, the corresponding keyY is missing.

Like I said, the O3DS 9.3+ firmware probably has it. How else would it support the Amiibo encryption?

 

[Suiginou]

Like I said, the O3DS 9.3+ firmware probably has it. How else would it support the Amiibo encryption?

Note to self, think before you talk.

brb gensokyo

 

[windwakr]

If I'm reading the rxtools code right:
https://github.com/roxas75/rxTools/blob/master/rxtools/source/features/firm.c#L86
https://github.com/roxas75/rxTools/blob/master/rxtools/source/features/configuration.c#L255

It looks like it might save a decrypted copy of N3DS firm when run on N3DS. If someone's running rxtools on a N3DS, please send me your rxtools folder.

Never mind on this, looks like there's a link to a decrypted copy of N3DS firm here:
https://github.com/Reisyukaku/ReiNand

 

[KazoWAR]

I have another question. If we use the NFC crypto normalkey and keyY pair to get KeyX and finally C. does anyone know what KeyX we will be getting? there are different ones right? numerous key slots. what also uses that keyslot? if we have the constant, will we beable to solve for other KeyXs if we dont know the resulting normal key?

 

[windwakr]

...
if we have the constant, will we beable to solve for other KeyXs if we dont know the resulting normal key?

I don't think so. AES output reveals nothing about the key. You'd basically have to bruteforce it, which would never ever happen.
The only way to get the other keyXs would be to dump the bootrom.

But hey, at least we have 0x25's keyX. So, decrypting the RomFS of newer O3DS games will be possible straight from your PC.

 

[Suiginou]

I have another question. If we use the NFC crypto normalkey and keyY pair to get KeyX and finally C. does anyone know what KeyX we will be getting? there are different ones right? numerous key slots. what also uses that keyslot? if we have the constant, will we beable to solve for other KeyXs if we dont know the resulting normal key?

The keyX we'd get is the keyX of slot 0x39, which is part of the keyX series 0x38-0x3B, which includes BOSS, download play (doesn't really help because of signing), DSiWare exports (keyY is console-unique), NFC and cart crypto.

Once C has been found, as long as you have at least two of keyX/keyY/normalkey, you can always solve relatively easily for the missing one without a physical 3DS. In many cases, you're missing two, however.

 

[KazoWAR]

The keyX we'd get is the keyX of slot 0x39, which is part of the keyX series 0x38-0x3B, which includes BOSS, download play (doesn't really help because of signing), DSiWare exports (keyY is console-unique), NFC and cart crypto.

Once C has been found, as long as you have at least two of keyX/keyY/normalkey, you can always solve relatively easily for the missing one without a physical 3DS. In many cases, you're missing two, however.

OK, so we can decrypt 3ds roms, but what about save data, SD files, or NAND?

 

[Suiginou]

OK, so we can decrypt 3ds roms, but what about save data, SD files, or NAND?

Nonsense.

We can only decrypt the RomFS and ExeFS entries that are not "icon" or "banner" of ROMs for fw >= 7.0. This does not include pre-7.0 ROMs or the exheader.

The other things you listed are all missing normalkeys and/or are console-unique.

 

[KazoWAR]

Nonsense.

We can only decrypt the RomFS and ExeFS entries that are not "icon" or "banner" of ROMs for fw >= 7.0. This does not include pre-7.0 ROMs or the exheader.

The other things you listed are all missing normalkeys and/or are console-unique.

OK so then what is the point of this. really? seems like you will still need a 3ds to fully decrpyt a rom so it makes it meaningless.

 

[Suiginou]

OK so then what is the point of this. really? seems like you will still need a 3ds to fully decrpyt a rom so it makes it meaningless.

One day(TM), the bootroms will be dumped and the missing keyX/keyY become available and all shall rejoice and sing in joy and praise the overlords that made this possible.

And what kind of scientist needs a "point" to further his or her knowledge?

 

[mathieulh]

Trying every 16 bytes failed anyway, and that was the decrypted ARM9 firmware binary.

N3DS NATIVE_FIRM didn't start using N3DS-only crypto before 9.5, so you can decrypt 8.1, 9.0, 9.3 on an O3DS just as well.

You need a N3DS with NATIVE_FIRM below 9.5 (9.5 should also work using firmlaunch hack)

 

[Syphurith]

--Snip--

If you're on an exploitable firmware, you may want to setup HBL to load Decrypt9 made by d0k3 to decrypt the CIA content.
Then the decrypted content shares the same Content Index of encrypted ones. Hope you could use that.

--Snip--

May be offtopic but there was a "N3DS 9.5 FIRM slot0x16 keys" leaked that useless before but containing the KeyX,KeyY,CTR.
However this contains no normal key.. hope some guys can write a program to let 3ds compute that out. So you might need to recover a KeyX afterwards.
And for the keyslot0x25 KeyX you might want to look at this page https://www.caitsith2.com/snes/dsp/ around the bottom.

UPDATE::Almost forgot.. I don't know what keys are leaked, and if the normal one is also. Like

      Norm  KeyX  KeyY  CTR
0x16  NO    YES   YES   YES