#!/usr/bin/env python3 # python -I solve.py files/beacon_flash.bin import sys d = open(sys.argv[1] if len(sys.argv) > 1 else 'files/beacon_flash.bin', 'rb').read() M = 0xffffffff # DROM: vaddr 0x42030020 <-> file 0x10020 ; code ref'd 0x42039d20/30/40 def drom(va): return 0x10020 + (va - 0x42030020) def cstr(va): o = drom(va); return d[o:d.index(b'\0', o)] s_id, s_board = cstr(0x42039d20), cstr(0x42039d30) ct = d[drom(0x42039d40):drom(0x42039d40) + 31] def fnv(b): h = 0x811c9dc5 for c in b: h = ((h ^ c) * 0x01000193) & M return h rotl = lambda x, n: ((x << n) | (x >> (32 - n))) & M h1, h2 = fnv(s_board), fnv(s_id) # a4, a5 code = rotl(h1, 7) ^ h2 print('id=%r board=%r' % (s_id, s_board)) print('activation code: %08x' % code) a4, a5 = h1, h2 out = bytearray() for c in ct: a1 = ((a5 >> 19) | (a4 << 13)) & M; a6 = (a5 << 13) & M a4 ^= a1; a5 ^= a6 a1 = ((a5 >> 7) | (a4 << 25)) & M; a6 = a4 >> 7 a5 ^= a1; a4 ^= a6 a1 = ((a5 >> 15) | (a4 << 17)) & M a4 ^= a1 a5 ^= (a5 << 17) & M out.append(c ^ (a5 & 0xff)) print(out.decode(errors='replace'))