it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) the SHA authorization process involved in the new consoles licensed game-pad communication.
Note: I found a very interested response from SYS_V user: Approach to extract useful information from binary file that helped me a lot, but I still struggling with the reverse.
Here the facts:
By looking at one of their circuit board and by doing some reverse engineering on their software update programs, I'm 95% sure that the uC is a Nuvoton M452RG6AE/M452RE6A (ARM-Cortex M4). Here the datasheet.
The company stores the firmware on a public ftp. Some of them are encrypted (with a non canonical algorithm). The no encrypted firmware are the ones included in the P2_P3P4, P2_X1, P3P4_NEO folders.
Some firmware have the LD and AP words as part of their filename. This made me wonder that, probably, they include the bootloader.
I'm stuck here.
My other goal is to find the way to reverse the encryption algorithm and make the firmware "readable".
A guy on github published the firmware upgrade process with a mac. By looking at these files and reversing the update program, it seems that the update program client send the firmware to the uC encrypted. The bootloader writes the payload on a external i2C memory. Once the firmware upload is completed, the bootloader calculates the checksum and it sends to the update program client for cross checking. If the checksum is valid, the update program client send the "0xa6(statusA CMD)" to the bootloader that will read the firmware from i2C memory, decrypt and write on the APROM section.
It is possible to reverse the not encrypted firwmares with IDA (I'm not familiar with radare), by setting the CPU to ARM-v7M. Some parts are decompiled well, some other are detected as unk by IDA and I don't know if there are data or code parts.
Someone wants to help me out or suggest me something that may help me for proceeding with the reversing?
For the point #1 and #4, in my question, I was referring to this file V21_LD_AP(md5sum: 5e19b55bb46bb642faebcb19478cec92) and this file V21_AP (md5sum: 344facf48a617364d74ad17351678deb) (this version file doesn't contain the LD word in the filename).
My goal is trying to decrypt this file.
I'm pretty sure that they use the same encryption algorithm for every firmware. However, some firmware are released in both ways: encrypted and decrypted. An example is possible to find under the P2_X1 folder (see the firmware V16 versions).