2

it has been a couple of months that I'm working on the firmware produced by a company that makes (not licensed) gamepad console adapters. One of my goal was to understand how they bypassed (hacked) the SHA authorization process involved in the new consoles licensed game-pad communication.

Note: I found a very interested response from SYS_V user: Approach to extract useful information from binary file that helped me a lot, but I still struggling with the reverse.

Here the facts:

  1. By looking at one of their circuit board and by doing some reverse engineering on their software update programs, I'm 95% sure that the uC is a Nuvoton M452RG6AE/M452RE6A (ARM-Cortex M4). Here the datasheet.

  2. The company stores the firmware on a public ftp. Some of them are encrypted (with a non canonical algorithm). The no encrypted firmware are the ones included in the P2_P3P4, P2_X1, P3P4_NEO folders.

    Some firmware have the LD and AP words as part of their filename. This made me wonder that, probably, they include the bootloader.

    I'm stuck here.

    My other goal is to find the way to reverse the encryption algorithm and make the firmware "readable".

  3. A guy on github published the firmware upgrade process with a mac. By looking at these files and reversing the update program, it seems that the update program client send the firmware to the uC encrypted. The bootloader writes the payload on a external i2C memory. Once the firmware upload is completed, the bootloader calculates the checksum and it sends to the update program client for cross checking. If the checksum is valid, the update program client send the "0xa6(statusA CMD)" to the bootloader that will read the firmware from i2C memory, decrypt and write on the APROM section.

  4. It is possible to reverse the not encrypted firwmares with IDA (I'm not familiar with radare), by setting the CPU to ARM-v7M. Some parts are decompiled well, some other are detected as unk by IDA and I don't know if there are data or code parts.

Someone wants to help me out or suggest me something that may help me for proceeding with the reversing?

Update:

For the point #1 and #4, in my question, I was referring to this file V21_LD_AP(md5sum: 5e19b55bb46bb642faebcb19478cec92) and this file V21_AP (md5sum: 344facf48a617364d74ad17351678deb) (this version file doesn't contain the LD word in the filename).

My goal is trying to decrypt this file.

I'm pretty sure that they use the same encryption algorithm for every firmware. However, some firmware are released in both ways: encrypted and decrypted. An example is possible to find under the P2_X1 folder (see the firmware V16 versions).

9
  • What is the specific firmware image you are looking at? Please provide the name, location in the FTP server, and md5sum
    – julian
    Feb 8 '18 at 15:42
  • Hi, I edited my original question. However I'm not allowed to post more than 8 links. This company releases many firmware for every adapter that they produce. These firmware can be decrypted and/or encrypted. For instance, this file: 219.84.35.58/brookhex/P2_X1/… and this file 219.84.35.58/brookhex/P2_X1/ZPK0J020_V16_20161206_AP-D7D1.hex are the same but one is encrypted and the other one not. My goal is to understand the encryption algorithm that they use.
    – Avok78
    Feb 9 '18 at 19:09
  • Thank you for making those changes. You are providing quite a bit of information - which is good - but not all of it is strictly relevant to the main difficulty you are facing, which is decrypting file ZP0***_auth.hex. It would be great if you could focus as much as you can on details surrounding this particular file - the exact device, board, processor, and everything you know about this particular file specifically. The question would be more clear if one part focused just on the encrypted file and the another part provided the additional related information.
    – julian
    Feb 9 '18 at 19:22
  • Hi, thanks for you interest. in my opinion, they use the same uC for every product that, as I said, it should a Nuvoton M452RG6AE/M452RE6A (ARM-Cortex M4 - V7M). Since I was not able to decrypt the firmware that I'm interested, I focused my attention on the files that are not encrypted and also on the software update, to try to discover something. But so far, no luck :-(
    – Avok78
    Feb 9 '18 at 19:33
  • I think I understand. Have you identified the bootloader for the device?
    – julian
    Feb 9 '18 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.