360trev
Full Member
Karma: +68/-2
 Offline
Posts: 235
|
 |
« Reply #9 on: August 28, 2018, 02:19:19 AM »
|
|
|
I know this is an old thread but here's some hopefully useful additional material for anyone else interested in ME7.x seed keys. A slightly different approach is to identify the seedkey routine in the bootloader and then modify the exit condition to ALWAYS return #1... (key matched) which means it doesn't matter which seed you use you'll alway get a positive answer!  Here's 2 different variants to get you started...
; Seedkey Routine - VAG Variant
;
; $inputs: r14,r15=seed1,seed2
; r12=xortable offset
;
; OUT: r4 - 0=key bad, 1=key matches...
ME7_Seedcheck: mov [-r0], r6
mov r4, r13
addb rl4, #23h
mov r13, r4
cmpb rl4, #23h
jmpr cc_NC, loc_475A
mov r13, #0FFh
loc_475A: movb rl6, #0
jmpr cc_UC, loc_4792
loc_475E: cmp r15, #8000h
jmpr cc_NZ, loc_4766
cmp r14, #0
loc_4766: jmpr cc_C, loc_478C
mov r4, r12
movbz r4, rl4
shl r4, #2
extp #0, #2 ; boot loader segment
mov r10, [r4+seed_hi] ; key hi from boot loader rom
mov r11, [r4+seed_lo] ; key lo from boot loader rom
mov r4, r14
mov r5, r15
add r4, r4
addc r5, r5
xor r4, r10
xor r5, r11
mov r14, r4
mov r15, r5
jmpr cc_UC, loc_4790
loc_478C: add r14, r14
addc r15, r15
loc_4790: addb rl6, #1
loc_4792: mov r4, r13
cmpb rl6, rl4
jmpr cc_C, loc_475E
mov r4, [r0+2] ; seed key hi
mov r5, [r0+4] ; seed key lo
sub r4, r14
subc r5, r15
jmpr cc_NZ, loc_47AA
*** mov r4, #1 ; seed key matched
jmpr cc_UC, loc_47AC
loc_47AA:
*** mov r4, #0 ; seed key did not match <----- ** CHANGE THIS TO a 1 instead of a zero and it will ALWAYS be successful
loc_47AC: mov r6, [r0+]
rets
Here's the one I found in my Ferrari firmware...
; Seedkey Routine - Ferrari/Alfa Variant
;
; $inputs: r14,r15=seed1,seed2
; r12=xortable offset
;
; OUT: r4 - 0=key bad, 1=key matches...
///
ME7_SeedKeyCheck:
mov [-r0], r12
mov [-r0], r9
mov [-r0], r8
mov [-r0], r7
mov [-r0], r6
mov r7, r13
mov r8, r14
mov r9, r15
addb rl7, #23h
cmpb rl7, #23h
jmpr cc_NC, loc_4764
movb rl7, #0FFh
loc_4764: movb rl6, #0
jmpr cc_UC, loop_enter
loop_key:
cmp r9, #8000h
jmpr cc_NZ, loc_4770
cmp r8, #0
loc_4770: jmpr cc_C, loc_4786
movb rl4, [r0+8]
movbz r12, rl4
mov r13, r8
mov r14, r9
calls 0, unk_6090
mov r8, r4
mov r9, r5
jmpr cc_UC, loc_478A
loc_4786: add r8, r8
addc r9, r9
loc_478A: addb rl6, #1
loop_enter:
cmpb rl6, rl7
jmpr cc_C, loop_key
mov r4, [r0+0Ah] ; seed key hi word
mov r5, [r0+0Ch] ; seed key lo word
sub r4, r8
subc r5, r9
jmpr cc_NZ, key_bad_exit
*** mov r4, #1 ; OUT: r4 - 1=key matched...
jmpr cc_UC, key_match_exit
key_bad_exit:
*** mov r4, #0 ; OUT: r4 - 0=key bad... <----- ** CHANGE THIS TO a 1 instead of a zero and it will ALWAYS be successful
key_match_exit: mov r6, [r0+]
mov r7, [r0+]
mov r8, [r0+]
mov r9, [r0+]
add r0, #2
rets
|
