Homebrew AES key scrambler

[Deleted User]

Trying every 16 bytes failed anyway, and that was the decrypted ARM9 firmware binary.

N3DS NATIVE_FIRM didn't start using N3DS-only crypto before 9.5, so you can decrypt 8.1, 9.0, 9.3 on an O3DS just as well.

I'm fairly certain you should be checking the 8.1 NFC service, not the ARM9 firmware. They did say Nintendo left the normal key in NFC, no?

 

[Suiginou]

I'm fairly certain you should be checking the 8.1 NFC service, not the ARM9 firmware. They did say Nintendo left the normal key in NFC, no?

https://gbatemp.net/threads/aes-key-scrambler.406951/page-3 -- keyslot 0x39 is written to by NATIVE_FIRM.

Also letting ARM11 services ask ARM9 to overwrite keyslots sounds like a recipe for disaster.

 

[Deleted User]

https://gbatemp.net/threads/aes-key-scrambler.406951/page-3 -- keyslot 0x39 is written to by NATIVE_FIRM.

Also letting ARM11 services ask ARM9 to overwrite keyslots sounds like a recipe for disaster.

Well yes, but you're looking for a hard-coded normal key, not a key slot value.

 

[Myria]

I and someone else managed to reproduce the key scrambler attack, and acquired the constant C and the keyX for slot 0x38-0x3B (they all use the same keyX). 0x39 was the one we attacked, yes.

The final formula is:
k = (((x <<< 2) ^ y) + C) <<< 87

The math is all done as unsigned 128-bit integers in big-endian format. <<< denotes left rotation.

Have fun =^-^=

 

[Xenon Hacks]

I and someone else managed to reproduce the key scrambler attack, and acquired the constant C and the keyX for slot 0x38-0x3B (they all use the same keyX). 0x39 was the one we attacked, yes.

The final formula is:
k = (((x <<< 2) ^ y) + C) <<< 87

The math is all done as unsigned 128-bit integers in big-endian format. <<< denotes left rotation.

Have fun =^-^=

I LOVE YOU YOU SWEAT BASTARD I COULD KISS YOU NOW IF I COULD

 

[dark_samus3]

I and someone else managed to reproduce the key scrambler attack, and acquired the constant C and the keyX for slot 0x38-0x3B (they all use the same keyX). 0x39 was the one we attacked, yes.

The final formula is:
k = (((x <<< 2) ^ y) + C) <<< 87

The math is all done as unsigned 128-bit integers in big-endian format. <<< denotes left rotation.

Have fun =^-^=

The rotation is just a basic (assuming it's only one rotation)

Original:
100000

Shifted 1 to the left:
000001

Right?

 

[Earth97]

I and someone else managed to reproduce the key scrambler attack, and acquired the constant C and the keyX for slot 0x38-0x3B (they all use the same keyX). 0x39 was the one we attacked, yes.

The final formula is:
k = (((x <<< 2) ^ y) + C) <<< 87

The math is all done as unsigned 128-bit integers in big-endian format. <<< denotes left rotation.

Have fun =^-^=

Sorry for bothering, I'd like to understand what you can do with this stuff now: is it needed for arm9hax?

 

[dark_samus3]

Sorry for bothering, I'd like to understand what you can do with this stuff now: is it needed for arm9hax?

It can be used to get KeyX for keyslots

 

[Earth97]

So, we have the keyY and that formula -> we get keyX -> we get C -> key scrambler is not a problem anymore -> arm9hax. Am I missing anything?

 

[dark_samus3]

So, we have the keyY and that formula -> we get keyX -> we get C -> key scrambler is not a problem anymore -> arm9hax. Am I missing anything?

How does that give us arm9? It just lets us decrypt stuff on PC

 

[Earth97]

and what about the arm9 payload described by the third guy (plutoo or derrek?) that would make coldboot possible?

 

[dark_samus3]

and what about the arm9 payload described by the third guy (plutoo or derrek?) that would make coldboot possible?

Yes, coldboot on N3DS ONLY since arm9loader was added in n3ds and doesn't exist for o3ds and that's what is being exploited

 

[Myria]

It can be used to get KeyX for keyslots

Only keyslots 0x38-0x3B, because Nintendo leaked the corresponding normal-key to keyslot 0x39. You need the normal-key and either keyX or keyY in order to figure out the other. (Keyslots 0x38, 0x3A and 0x3B are broken just because boot ROM sets all four keyslots' keyX to the same value.)

How does that give us arm9? It just lets us decrypt stuff on PC

It doesn't even let us decrypt on PC for the most part. Now the problem is that because boot ROM isn't dumped, we don't know the keyX for keyslot 0x2C, a critical keyslot for NCCH decryption.

I suppose that this *does* allow decryption of Amiibos on PC, then, but that can be done with just the normal-key Nintendo leaked.

The formula I gave above is very generic. You'll still have to do the exploit if you actually want to find C and the 0x39 keyX.

 

[windwakr]

Never mind on this, looks like there's a link to a decrypted copy of N3DS firm here:
https://github.com/Reisyukaku/ReiNand

Turns out this contains firmware 9.3. So, it's useless. Needs to be <9.3.


Wish I had a N3DS so I could do this myself.

 

[Suiginou]

I and someone else managed to reproduce the key scrambler attack, and acquired the constant C and the keyX for slot 0x38-0x3B (they all use the same keyX). 0x39 was the one we attacked, yes.

The final formula is:
k = (((x <<< 2) ^ y) + C) <<< 87

The math is all done as unsigned 128-bit integers in big-endian format. <<< denotes left rotation.

Have fun =^-^=

We've known that since plutoo's presentation, see windwakr's post earlier in this thread. The rest of this thread has been finding C for the rest of the world that isn't you or plutoo.

Turns out this contains firmware 9.3. So, it's useless. Needs to be <9.3.

Partially useless, unless you've located the key in O3DS NATIVE_FIRM already. And it should contain 9.5, not just 9.3.

Wish I had a N3DS so I could do this myself.

I'll see what I can dig up.

 

[Reisyukaku]

Turns out this contains firmware 9.3. So, it's useless. Needs to be <9.3.


Wish I had a N3DS so I could do this myself.

that should be 9.5 actually. I could help run some things when i get home from work in about 8 hrs.

 

[motezazer]

I and someone else managed to reproduce the key scrambler attack, and acquired the constant C and the keyX for slot 0x38-0x3B (they all use the same keyX). 0x39 was the one we attacked, yes.

The final formula is:

k = (((x <<< 2) ^ y) + C) <<< 87

The math is all done as unsigned 128-bit integers in big-endian format. <<< denotes left rotation.

Have fun =^-^=

Wow, you gave us the formula that was in the slides!

Seriously, I found the normal key, but I have some trouble to find the KeyY.

 

[Earth97]

Only keyslots 0x38-0x3B, because Nintendo leaked the corresponding normal-key to keyslot 0x39. You need the normal-key and either keyX or keyY in order to figure out the other. (Keyslots 0x38, 0x3A and 0x3B are broken just because boot ROM sets all four keyslots' keyX to the same value.)



It doesn't even let us decrypt on PC for the most part. Now the problem is that because boot ROM isn't dumped, we don't know the keyX for keyslot 0x2C, a critical keyslot for NCCH decryption.

I suppose that this *does* allow decryption of Amiibos on PC, then, but that can be done with just the normal-key Nintendo leaked.

The formula I gave above is very generic. You'll still have to do the exploit if you actually want to find C and the 0x39 keyX.

Do you mean the memchunkhax2 to gain ARM11 kernel on new firmwares? Is it just a matter of calculations and we'll eventually get the keyY or something is still missing?

 

[motezazer]

Only keyslots 0x38-0x3B, because Nintendo leaked the corresponding normal-key to keyslot 0x39. You need the normal-key and either keyX or keyY in order to figure out the other. (Keyslots 0x38, 0x3A and 0x3B are broken just because boot ROM sets all four keyslots' keyX to the same value.)

Side note: as 0x3B is broken, anyone can make a Sky3DS clone...

 

[Suiginou]

Wow, you gave us the formula that was in the slides!

Seriously, I found the normal key, but I have some trouble to find the KeyY.

About the keyY, https://github.com/mid-kid/CakesForeveryWan/blob/master/patches/emunand/info.json#L160 may help. I didn't bother tracing that function yet because I don't have a 8.1/9.0 decrypted arm9bin yet, and without that, I can't proceed anyway.