Skip to content

Instantly share code, notes, and snippets.

@pudquick pudquick/ forked from nwert/
Created Jun 18, 2018

What would you like to do?
from Crypto.Cipher import AES
from Crypto.Util import Counter
import struct
typedef struct boot_dat_hdr
unsigned char ident[0x10];
unsigned char sha2_s2[0x20];
unsigned int s2_dst;
unsigned int s2_size;
unsigned int s2_enc;
unsigned char pad[0x10];
unsigned int s3_size;
unsigned char pad2[0x90];
unsigned char sha2_hdr[0x20];
} boot_dat_hdr_t;
def aes_ctr_dec(buf, key, iv):
ctr =, initial_value=long(iv.encode('hex'), 16))
return, AES.MODE_CTR, counter=ctr).encrypt(buf)
f = open("boot.dat", "rb")
b =
s2_key = "47E6BFB05965ABCD00E2EE4DDF540261".decode("hex")
s2_ctr = "8E4C7889CBAE4A3D64797DDA84BDB086".decode("hex")
s2_base, s2_size = struct.unpack("II", b[0x30:0x38])
f = open("stage2_{0:08X}.bin".format(s2_base), "wb")
f.write(aes_ctr_dec(b[0x100:0x100+s2_size], s2_key, s2_ctr))
arm64_key = "35D8FFC4AA1BAB9514825EB0658FB493".decode("hex")
arm64_ctr = "C38EA26FF3CCE98FD8D5ED431D9D5B94".decode("hex")
arm64_off = 0x53BAB0
arm64_size = 0x36370
arm64_base = 0x80FFFE00
f = open("arm64_{0:08X}.bin".format(arm64_base), "wb")
f.write(aes_ctr_dec(b[arm64_off:arm64_off+arm64_size], arm64_key, arm64_ctr))
fb_key = "E2AC05206A701C9AA514D2B2B7C9F395".decode("hex")
fb_ctr = "46FAB59AF0E469EF116614DEC366D15F".decode("hex")
fb_off = 0x17BAB0
fb_size = 0x3C0000
fb_base = 0xF0000000
f = open("fb_{0:08X}.bin".format(fb_base), "wb")
f.write(aes_ctr_dec(b[fb_off:fb_off+fb_size], fb_key, fb_ctr))
data_key = "030D865B7E458B10AD5706F6E227F4EB".decode("hex")
data_ctr = "AFFC93692EBD2E3D252339F01E03416B".decode("hex")
data_off = 0x5F40
data_size = 0x175B70
data_base = 0x80000000
f = open("data_{0:08X}.bin".format(data_base), "wb")
f.write(aes_ctr_dec(b[data_off:data_off+data_size], data_key, data_ctr))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.