decrypt_dcn.py

#!/usr/bin/env python3

import os
import sys
import hashlib
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

SHA384_SIZE=48

if len(sys.argv) != 4:
    print("Usage: %s <sprl_exe> <DCNKernel> <output_filename>" % sys.argv[0])
    sys.exit(1)

sprl = open(sys.argv[1], 'rb').read()
dcn = open(sys.argv[2],'rb').read()
dcnhash = hashlib.sha384(dcn).digest()
print(f'SHA384 of {os.path.basename(sys.argv[2])}: {dcnhash.hex()}')
off = sprl.find(dcnhash)
if off == -1:
    print("[e] Couldn't find hash in Mach-O file")
    sys.exit(1)
print(f'Found hash at offset {off:#x}')
iv = sprl[off+SHA384_SIZE:off+SHA384_SIZE+16]
key = sprl[off+SHA384_SIZE+16:off+SHA384_SIZE+16+32]
print(f' IV: {iv.hex()}')
print(f'Key: {key.hex()}')
cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
decryptor = cipher.decryptor()
dcn_decrypted = decryptor.update(dcn) + decryptor.finalize()
with open(sys.argv[3],'wb') as dcn_out:
    dcn_out.write(dcn_decrypted)
print(f'Saved decrypted kernel to {sys.argv[3]}')