How to convert eCWPK to dCWPK

It can't work, every operator has an encryption algo.

Thank you for your nice help.

Here I would use u-boot or SoC reball.

Cau Adas
 
Maybe you can edit/reflash rootfs to enable SSH, Telnet or UART to get access and decrypt CWPK.

Try open your dump with 7zip ;P
Or you can extract squashfs from address 0x5C0028 and open with 7zip.

Anyway you can edit u-boot in your dump too and reflash.
 
leandrotsampa said:
Maybe you can edit/reflash rootfs to enable SSH, Telnet or UART to get access and decrypt CWPK.

Try open your dump with 7zip ;P
Or you can extract squashfs from address 0x5C0028 and open with 7zip.

Anyway you can edit u-boot in your dump too and reflash.
Click to expand...
i have opend UART what ssh command for CWPK
 
Without ALGO or SoC, nobody will count anything.
You need U-Boot, and you start playing with SoC.

Cau Adas
 
Good morning all
I relaunch the post, I have uart access on a soc7105jud, how to calculate the cwpk
of course I have the flash dump
Thanks for your help
 
gazoil12 said:
Good morning all
I relaunch the post, I have uart access on a soc7105jud, how to calculate the cwpk
of course I have the flash dump
Thanks for your help
Click to expand...
for sti7105-jud you need to use new method called dma bruteforce because dcw adress is locked by security fuse
in short decrypt + encrypt works but 3des decryption result is unreadable from fixed models
dma bruteforce method is explained in latest security explorations pdfs
 
schwarzekatze said:
for sti7105-jud you need to use new method called dma bruteforce because dcw adress is locked by security fuse
in short decrypt + encrypt works but 3des decryption result is unreadable from fixed models
dma bruteforce method is explained in latest security explorations pdfs
Click to expand...
can tell me more about this brut force method
do you have a link for the documents
thanks
 
gazoil12 said:
can tell me more about this brut force method
do you have a link for the documents
thanks
Click to expand...
Mon ami gazoil, you need to put your receiver in upgrade mode , that way the protected memory address will be free to dump ;)
Play a little on the receivers firmware via shell and check how upgrade mode is launched, check receivers initialisations and conditions and you will get it :)
Some inits modifications do the trick.
 
pachecoso said:
Mon ami gazoil, you need to put your receiver in upgrade mode , that way the protected memory address will be free to dump ;)
Play a little on the receivers firmware via shell and check how upgrade mode is launched, check receivers initialisations and conditions and you will get it :)
Some inits modifications do the trick.
Click to expand...
it is otp security in cpu you cant unlock dcw adress by upgrading receiver firmware or whatsoever , any of firmware modiffications also would not help
 
no body wants to help on this brute force method !!!!
this is a mutual aid forum
if I posted the method to open the box you would all be bothered
 
@gazoil12 when you cant post public better to pm, my pm blocked plz pm me, im looking for learn how its works, many experts here but no one putted post on this forum, i came here to learn more here, but experts not share him experience
 
You must log in or register to reply here.
Back
Top