Will There Be a new Emu For Ireland?

[nozzer]

OMG, that is the most info i have ever seen in one post

I like to do the odd techy post once in a while. It keeps the old braincells from ozyfying.

Excellent post nozzer, too bad nearly all of it was over my head

Study it for a while and maybe ask some questions. You may realise that its not as far over your head as you think it is

 

[mgb]

If the example would haveB8 A7/ B7 A7 instead of B8 AF/ B7 AF. I would be able to understand it.

 

[carboid]

Great post nozzer. It's after getting me thinking again! hehe

 

[conorc]

Fab detail Nozzer!

 

[nozzer]

If the example would haveB8 A7/ B7 A7 instead of B8 AF/ B7 AF. I would be able to understand it.

Substitute whatever values you like, my example Emm was purely fictional and just for use as a teaching aid.

If you want to understand the real Emm's then you need to capture/aquire them and work from there. If the real Emm's bear any resemlance whatsoever to my example then its purely coincidental.

 

[Ginkman]

so what we need is an emu that rewrites a new keyline where each digit is correct to 2 out of the 3 roms

how easy or hard is that to do . . .

 

[mgb]

Substitute whatever values you like, my example Emm was purely fictional and just for use as a teaching aid.

If you want to understand the real Emm's then you need to capture/aquire them and work from there. If the real Emm's bear any resemlance whatsoever to my example then its purely coincidental.

As far as I understand your example you point at the wrong memory allocation.
21 is located at A7.

 

[nozzer]

As far as I understand your example you point at the wrong memory allocation.
21 is located at A7.

Well spotted !

Even I screw up occasionally


Edit: ok, corrected I think. You may find more errors if you look closely though !

 

[mgb]

It looks like I understand the new keyroll now.
You simply need the wrong key from a evocamd rom7 auto update and only the fifth byte has to be xored with 8.
Time for windows calculator in scentific mode and switching the thing to hex.

 

[nozzer]

It looks like I understand the new keyroll now.
You simply need the wrong key from a evocamd rom7 auto update and only the fifth byte has to be xored with 8.
Time for windows calculator in scentific mode and switching the thing to hex.

Bear in mind that my example isn't necessarily the same as the real keyrolls and that each of the six keyroll emm's are themselves different.

There are 2 keyrolls for each card type (Rom7/10/11). A standard keyroll and a signature swapped keyroll.

The signature swapped ones are for the later revision cards (cant remember exactly but I think it may be > RevA38) where the Emm decryption algorithm is a little different (the 8 byte signature is swapped with part of the 64 byte Emm payload after stage1 decryption - hence the name SigSwapped)

If you are going to apply fixes based on any particular keyroll then you need to make sure that you are actually dealing with the results of the correct keyroll