Seriously, now I want to buy a camera, smash the chip, and crack their firmware so it doesn't have the check. As far as I know there is no secureboot involved, so it should be trivial. This Is Just Inexplicably Dumb.https://twitter.com/marcan42/status/1088472549715918848 …
-
Show this thread
-
HMAC-SHA256 key for the secret authentication chip: a9ec1b1359251fdb4d06efb95dc19ebcfb39e72e08253e5ab2d603de5800f500 XORing every byte with the previous one, top notch obfuscation there rPi Foundation. sub_EC8ABBC on the latest start_db.elf.pic.twitter.com/YkwZjFbjgY
10 replies 125 retweets 416 likesShow this thread -
Correction: the key is 0d48bfb7fd81bb7fe9a24b1df9653a185f9d438aac819afe1672a77afca451a4. Went down the wrong codepath for the first key (there was an extra xor). I checked and this one computes the same results as the real Camera Module V2 from public I²C traces.
5 replies 48 retweets 169 likesShow this thread -
Here's a Python script for validation:https://gist.github.com/marcan/6dde73a9a0c917cd4fc9784a0a73efe3 …
3 replies 24 retweets 76 likesShow this thread -
Replying to @marcan42
So it took you all of, what, 12h to pwn their shitty drm? Is the stuff in IDA there a fw blob from the chip? What did it take to extract it?
1 reply 0 retweets 7 likes
More like 1h, there was sleep in between. I went to their GitHub, downloaded the blob, threw it into IDA, FindCrypt immediately found the SHA256 table, then I hit 'x' a few times.
-
-
Replying to @marcan42
Ah yes, my favorite fw extraction method, "fw slurp using GitHub"
0 replies 0 retweets 2 likesThanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.