challenge_rotpk.c

#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

#define set_wbit(addr, v)                                                      \
  (*((volatile unsigned long *)(addr)) |= (unsigned long)(v))
#define readl(addr) (*((volatile unsigned long *)(addr)))
#define writel(v, addr)                                                        \
  (*((volatile unsigned long *)(addr)) = (unsigned long)(v))

#define SUN8I_SID_BASE 0x01C14000

// xxd -i rotpk.bin
static const unsigned char rotpk_bin[] = {
    0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa,
    0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x00, 0x11, 0x22, 0x33, 0x44, 0x55,
    0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff};

int main(int argc, char *argv[]) {

  off_t offset = SUN8I_SID_BASE;

  // Truncate offset to a multiple of the page size, or mmap will fail.
  size_t pagesize = sysconf(_SC_PAGE_SIZE);
  off_t page_base = (offset / pagesize) * pagesize;
  off_t page_offset = offset - page_base;

  int fd = open("/dev/mem", O_RDWR | O_SYNC);
  volatile void *mem =
      mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, page_base);
  if (mem == MAP_FAILED) {
    perror("Can't map memory");
    return -1;
  }

  volatile unsigned long *checkRotpk = mem + 0x120;
  volatile unsigned long *trigger = mem + 0x140;

  // key must be written in little endian instead big endian!
  unsigned long rotpk[8];
  for (int i = 0; i < 8; i++) {
    int idx = 4 * i;
    rotpk[i] = 0;
    rotpk[i] += rotpk_bin[idx];
    rotpk[i] += rotpk_bin[idx + 1] << 8;
    rotpk[i] += rotpk_bin[idx + 2] << 16;
    rotpk[i] += rotpk_bin[idx + 3] << 24;
  }

  for (int i = 0; i < 8; i++) {
    writel(rotpk[i], checkRotpk + 4 * i);
  }

  writel(0x80000000, trigger);

  sleep(1);

  unsigned long res = readl(trigger);
  printf("%08x\n\r", (unsigned int)res);

  close(fd);

  return 0;
}