Hacking RELEASE CertNXtractionPack - Get your Switch cert from a NAND dump!

[scottgl]

I don't think you used the correct decrypted PRODINFO.bin, you have to have that first...

Awesome finally got my nx_tls_client_cert.pfx. Note that if you are able to get your public certificate but private key seems non-valid, make sure you run 02_convert_to_der.py! So can I only use this to download content that I have access to? Perhaps we could setup some kind of web server to have something similar to eshop.

 

[PatrickJr]

I got bored of the editing, and the changes you made in CertNXtractionPack.py did not create the files clcert.der and privk.bin after placing the Keys. I will leave the whole pack, edit the .bat changing cat by type and I already create a 4KB file. Just read the Readme.txt

--------------------- MERGED ---------------------------


on the keyboard press Windows + R and type cmd in the window, press enter

--------------------- MERGED ---------------------------

If you have problems installing dependencies, change "python3" for only "python" (without quotes) in the commands.

--------------------- MERGED ---------------------------


I do not understand why you are following this thread if you do not know what CMD is. As you obtained PRODINFO.bin ?, it is necessary to decipher your unique certificate and it is only achieved by executing basic commands in CMD in RCM mode or through script.

I seem to be getting Error: rsa_private_kek_generation_source is incorrect (hash mismatch detected) I filled out all the information, I still get that issue.

 

[ElMeteK]

Hello !

Do the final files generated must be "clcert.der" and "privk.bin" ?

 

[SocraticBliss]

Hello !

Do the final files generated must be "clcert.der" and "privk.bin" ?

Well, I guess you could change them to output in whatever name you want, but the scripts generate those files if you provide the keys and the decrypted PRODINFO.bin...

 

[ElMeteK]

Ok, i think i have made it ... around 4Ko for the correct pfx ?

 

[SocraticBliss]

Ok, i think i have made it ... around 4Ko for the correct pfx ?

yep

 

[ElMeteK]

Ok, thanks a lot

 

[mooglazer]

Same error as @ehnoah - tried this both under Windows and Linux.

edit: extracted PRODINFO.bin using hactool. Under Linux, I tried using both python2 and python3. On Windows, only python3.

The gist posted by SocraticBliss does generate privk.bin and clcert.der from PRODINFO.bin.

$ python3 02_convert_to_der.py
Traceback (most recent call last):
File "02_convert_to_der.py", line 144, in <module>
main()
File "02_convert_to_der.py", line 100, in main
E, N = get_pubk(clcert)
File "02_convert_to_der.py", line 58, in get_pubk
clcert_decoder.enter() # Seq, 3 elem
File "/usr/lib/python3.4/site-packages/asn1.py", line 448, in enter
raise Error('Cannot enter a non-constructed tag.')
asn1.Error: Cannot enter a non-constructed tag.

$ python2 02_convert_to_der.py
Traceback (most recent call last):
File "02_convert_to_der.py", line 144, in <module>
main()
File "02_convert_to_der.py", line 100, in main
E, N = get_pubk(clcert)
File "02_convert_to_der.py", line 58, in get_pubk
clcert_decoder.enter() # Seq, 3 elem
File "/usr/lib/python2.7/site-packages/asn1.py", line 448, in enter
raise Error('Cannot enter a non-constructed tag.')
asn1.Error: Cannot enter a non-constructed tag.

 

[SocraticBliss]

Yea I am currently tweaking the scripts a bit more to give a little help, now when you at least run the file from my gist, it will tell you if you missing installing the pycrypto dependency...

https://gist.github.com/socraticbliss/4410790b6e5a27161f521c45d1eb2684

Let me know if you guys have issues with this... either comment in the gist or comment here...

 

[SimonMKWii]

Yea I am currently tweaking the scripts a bit more to give a little help, now when you at least run the file from my gist, it will tell you if you missing installing the pycrypto dependency...

https://gist.github.com/socraticbliss/4410790b6e5a27161f521c45d1eb2684

Let me know if you guys have issues with this... either comment in the gist or comment here...

Thanks so much for this!
Hopefully this should solve the issues people were having...

 

[mooglazer]

So could the issue I'm running into be caused by invalid output from CertNXtractionPack.py?

$ openssl x509 -in clcert.der -inform der -text
unable to load certificate
139976002414480:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:157:

I believe I'm getting the right ssl_kek, but perhaps it's something specific to the output of clcert.der?

edit: The system is 4.1.0, if it matters

 

[scottgl]

Now that we have the pfx cert, are there any tools available for downloading from CDN and possibly unpacking content from CDN? It seems very doable, I'd like to know what is currently blocking us from unpacking content from CDN to SD and loading onto the NSW.

 

[SocraticBliss]

So could the issue I'm running into be caused by invalid output from CertNXtractionPack.py?

$ openssl x509 -in clcert.der -inform der -text
unable to load certificate
139976002414480:error:0D07207B:asn1 encoding routines:ASN1_get_object:header too long:asn1_lib.c:157:

I believe I'm getting the right ssl_kek, but perhaps it's something specific to the output of clcert.der?

Ensure that you are using a valid/good PRODINFO.bin, I have noticed that there are quite a few people who have been using the encrypted version of the file without first using their BIS 0 key to decrypt it...

I have also put all the scripts in my gist (https://gist.github.com/socraticbliss/4410790b6e5a27161f521c45d1eb2684), download all the files, toss them in a folder with the PRODINFO.bin, and double click/run the CertNXtractionPack.cmd

 

[mooglazer]

people who have been using the encrypted version of the file without first using their BIS 0 key to decrypt it

That was my issue, thanks for the pointer.

 

[Dudamax]

Can't get ssl_kek to generate, command prompt just closes quickly

 

[SocraticBliss]

Can't get ssl_kek to generate, command prompt just closes quickly

Try the scripts from my gist, it has a pause in them so it doesn't close the window automatically...

 

[Dudamax]

And how do I get prodinfo.bin btw

 

[SocraticBliss]

And how do I get prodinfo.bin btw

Gotta dump your SYSNAND, it will be part of that, easiest way is with a 64 GB MicroSD card (can use 32 possibly...)

 

[Dudamax]

Sorry for the repetitiveness of questions, but how do I dump the sysnand?

 

[SocraticBliss]

Sorry for the repetitiveness of questions, but how do I dump the sysnand?

Cmon dude, searching the forum is a bit faster than answering questions back and forth, gotta boot your switch into RCM then load a payload to your switch and dump your SYSNAND, can use something like TegraRcmSmash, biskeydumpv6 and hekate... https://switchtools.sshnuke.net/