garmin_lock.c

#include <stdio.h>

void unlockml (unsigned char *dst, const unsigned char *src,
		int size, unsigned int key)
{
	static const unsigned char shuf[] = {
		0xb, 0xc, 0xa, 0x0,
		0x8, 0xf, 0x2, 0x1,
		0x6, 0x4, 0x9, 0x3,
		0xd, 0x5, 0x7, 0xe};
	int i, ringctr;
	int key_sum = shuf[((key >> 24) + (key >> 16) + (key >> 8) + key) & 0xf];

	for (i = 0, ringctr = 16; i < size; i ++) {
		unsigned int upper = src[i] >> 4;
		unsigned int lower = src[i];

		upper -= key_sum;
		upper -= key >> ringctr;
		upper -= shuf[(key >> ringctr) & 0xf];
		ringctr = ringctr ? ringctr - 4 : 16;

		lower -= key_sum;
		lower -= key >> ringctr;
		lower -= shuf[(key >> ringctr) & 0xf];
		ringctr = ringctr ? ringctr - 4 : 16;

		dst[i] = ((upper << 4) & 0xf0) | (lower & 0xf);
	}
}

#ifdef TESTUNLOCK
void hexdump (const unsigned char *data, int size)
{
	while (size -- > 0)
		printf("%02x", *(data ++));
	printf("\n");
}

int main (void)
{
	const unsigned char enml1[] = "\xea\x6c\x27\x66\xd5\x77\x60\x26\x68\xe6\x87\x6d\x27\x7c\xb2\x67\x6d\x3e\x89\xe4";
	const unsigned char plml1[] = "\x84\x0f\x01\x00\x03\x11\x03\x00\x02\x14\x21\x00\x01\x16\xe0\x01\x00\x18\x23\x12";
	const unsigned int key1 = 0xd7624237;
	unsigned char buffer[20];

	printf("key:          0x%x\n", key1);
	printf("encrypted ml: ");
	hexdump(enml1, 20);
	unlockml(buffer, enml1, 20, key1);
	printf("decrypted ml: ");
	hexdump(buffer, 20);
	printf("correct ml:   ");
	hexdump(plml1, 20);

	return 0;
}
#endif