Skip to content

Conversation

@impeeza
Copy link

@impeeza impeeza commented Nov 23, 2025

I am changing some small indent corrected on previous versions of LockPick

  • On the file source/hos/hos.h the max firmware value is upgraded to 21

  • On the file source/keys/crypto.h some values for firmware 21 are missing

  • Also please check the next corrections in order to look where the discrepancy is:

On your LockPick_RCM_MOD's source for the file source\keys\key_sources.inl the lines 32 and 33 are keys for master_kek_sources maxtrix, the values are from Erista Master Kek Source (EristaMasterKekSource).

Normally those values should be get from the file fusee/program/source/fusee_key_derivation.cpp on the Atmosphere's source more specific from the namespace

	alignas(se::AesBlockSize) constexpr inline const u8 EristaMasterKekSource[se::AesBlockSize] = {

on the Atmosphere 1.9.x source that namespace have the values:

        alignas(se::AesBlockSize) constexpr inline const u8 EristaMasterKekSource[se::AesBlockSize] = {
            /* TODO: Update on next change of keys. */
            0xA1, 0x7D, 0x34, 0xDB, 0x2D, 0x9D, 0xDA, 0xE5, 0xF8, 0x15, 0x63, 0x4C, 0x8F, 0xE7, 0x6C, 0xD8
        };

and on the Atmosphsere 1.10.0 source that namespace have the values:

        alignas(se::AesBlockSize) constexpr inline const u8 EristaMasterKekSource[se::AesBlockSize] = {
            /* TODO: Update on next change of keys. */
            0x66, 0xC8, 0xCB, 0x3D, 0xEC, 0xF4, 0x59, 0x73, 0x54, 0x88, 0xE1, 0x2E, 0xE6, 0x3D, 0x68, 0x46
        };

Your code have values from the file fusee/program/source/fusee_key_derivation.cpp on the namespace

        alignas(se::AesBlockSize) constexpr inline const u8 DeviceMasterKekSources[pkg1::OldDeviceMasterKeyCount][se::AesBlockSize] = {
            { 0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D }, /* 4.x    Device Master Kek Source. */

°
°
°
            { 0xDA, 0xFB, 0x61, 0x39, 0x48, 0x2D, 0xC2, 0x7E, 0x0D, 0x8E, 0x8F, 0x98, 0x57, 0x20, 0xB8, 0x15 }, /* 20.0.0 Device Master Kek Source. */
            { 0x92, 0xBF, 0x37, 0x80, 0x0E, 0x79, 0x56, 0x8C, 0x57, 0x75, 0x72, 0x0A, 0x48, 0xD8, 0x15, 0x39 }, /* 21.0.0 Device Master Kek Source. */
        };

Those values also are on the Atmosphère's source file exosphere\program\source\boot\secmon_boot_key_data.s on the namespace Production Device Master Kek Sources. of the Atmosphère's source code.

Those values normally are used on the LockPick's source for the file source/keys/crypto.h in the section static const u8 device_master_kek_sources

Please look at it and let me to know if I should correct my code or you can improve yours.

I am changing some small indent corrected on previous versions of LockPicl


Also please check the next corrections in order to look where the discrepancy is:

On your LockPick_RCM_MOD's source for the file `source\keys\key_sources.inl` the lines 32 and 33 are keys for 
master_kek_sources maxtrix, the values are from Erista Master Kek Source (EristaMasterKekSource).

Normally those values should be get from the file `fusee/program/source/fusee_key_derivation.cpp` on the Atmosphere's source more specific from the namespace
```
	alignas(se::AesBlockSize) constexpr inline const u8 EristaMasterKekSource[se::AesBlockSize] = {
```

on the Atmosphere 1.9.x source that namespace have the values:
```
        alignas(se::AesBlockSize) constexpr inline const u8 EristaMasterKekSource[se::AesBlockSize] = {
            /* TODO: Update on next change of keys. */
            0xA1, 0x7D, 0x34, 0xDB, 0x2D, 0x9D, 0xDA, 0xE5, 0xF8, 0x15, 0x63, 0x4C, 0x8F, 0xE7, 0x6C, 0xD8
        };
```

and on the Atmosphsere 1.10.0 source that namespace have the values:
```
        alignas(se::AesBlockSize) constexpr inline const u8 EristaMasterKekSource[se::AesBlockSize] = {
            /* TODO: Update on next change of keys. */
            0x66, 0xC8, 0xCB, 0x3D, 0xEC, 0xF4, 0x59, 0x73, 0x54, 0x88, 0xE1, 0x2E, 0xE6, 0x3D, 0x68, 0x46
        };
```

Your code have values from the file `fusee/program/source/fusee_key_derivation.cpp` on the namespace
```
        alignas(se::AesBlockSize) constexpr inline const u8 DeviceMasterKekSources[pkg1::OldDeviceMasterKeyCount][se::AesBlockSize] = {
            { 0x88, 0x62, 0x34, 0x6E, 0xFA, 0xF7, 0xD8, 0x3F, 0xE1, 0x30, 0x39, 0x50, 0xF0, 0xB7, 0x5D, 0x5D }, /* 4.x    Device Master Kek Source. */
            { 0x06, 0x1E, 0x7B, 0xE9, 0x6D, 0x47, 0x8C, 0x77, 0xC5, 0xC8, 0xE7, 0x94, 0x9A, 0xA8, 0x5F, 0x2E }, /* 5.x    Device Master Kek Source. */
            { 0x99, 0xFA, 0x98, 0xBD, 0x15, 0x1C, 0x72, 0xFD, 0x7D, 0x9A, 0xD5, 0x41, 0x00, 0xFD, 0xB2, 0xEF }, /* 6.x    Device Master Kek Source. */
            { 0x81, 0x3C, 0x6C, 0xBF, 0x5D, 0x21, 0xDE, 0x77, 0x20, 0xD9, 0x6C, 0xE3, 0x22, 0x06, 0xAE, 0xBB }, /* 6.2.0  Device Master Kek Source. */
            { 0x86, 0x61, 0xB0, 0x16, 0xFA, 0x7A, 0x9A, 0xEA, 0xF6, 0xF5, 0xBE, 0x1A, 0x13, 0x5B, 0x6D, 0x9E }, /* 7.0.0  Device Master Kek Source. */
            { 0xA6, 0x81, 0x71, 0xE7, 0xB5, 0x23, 0x74, 0xB0, 0x39, 0x8C, 0xB7, 0xFF, 0xA0, 0x62, 0x9F, 0x8D }, /* 8.1.0  Device Master Kek Source. */
            { 0x03, 0xE7, 0xEB, 0x43, 0x1B, 0xCF, 0x5F, 0xB5, 0xED, 0xDC, 0x97, 0xAE, 0x21, 0x8D, 0x19, 0xED }, /* 9.0.0  Device Master Kek Source. */
            { 0xCE, 0xFE, 0x41, 0x0F, 0x46, 0x9A, 0x30, 0xD6, 0xF2, 0xE9, 0x0C, 0x6B, 0xB7, 0x15, 0x91, 0x36 }, /* 9.1.0  Device Master Kek Source. */
            { 0xC2, 0x65, 0x34, 0x6E, 0xC7, 0xC6, 0x5D, 0x97, 0x3E, 0x34, 0x5C, 0x6B, 0xB3, 0x7E, 0xC6, 0xE3 }, /* 12.1.0 Device Master Kek Source. */
            { 0x77, 0x52, 0x92, 0xF0, 0xAA, 0xE3, 0xFB, 0xE0, 0x60, 0x16, 0xB3, 0x78, 0x68, 0x53, 0xF7, 0xA8 }, /* 13.0.0 Device Master Kek Source. */
            { 0x67, 0xD5, 0xD6, 0x0C, 0x08, 0xF5, 0xA3, 0x11, 0xBD, 0x6D, 0x5A, 0xEB, 0x96, 0x24, 0xB0, 0xD2 }, /* 14.0.0 Device Master Kek Source. */
            { 0x7C, 0x30, 0xED, 0x8B, 0x39, 0x25, 0x2C, 0x08, 0x8F, 0x48, 0xDC, 0x28, 0xE6, 0x1A, 0x6B, 0x49 }, /* 15.0.0 Device Master Kek Source. */
            { 0xF0, 0xF3, 0xFF, 0x52, 0x75, 0x2F, 0xBA, 0x4D, 0x09, 0x72, 0x30, 0x89, 0xA9, 0xDF, 0xFE, 0x1F }, /* 16.0.0 Device Master Kek Source. */
            { 0x21, 0xD6, 0x35, 0xF1, 0x0F, 0x7A, 0xF0, 0x5D, 0xDF, 0x79, 0x1C, 0x7A, 0xE4, 0x32, 0x82, 0x9E }, /* 17.0.0 Device Master Kek Source. */
            { 0xE7, 0x85, 0x8C, 0xA2, 0xF4, 0x49, 0xCB, 0x07, 0xD1, 0x8E, 0x48, 0x1B, 0xE8, 0x1E, 0x28, 0x3B }, /* 18.0.0 Device Master Kek Source. */
            { 0x9B, 0xA5, 0xFD, 0x74, 0x7F, 0xCD, 0x23, 0xD1, 0xD9, 0xBD, 0x6C, 0x51, 0x72, 0x5F, 0x3D, 0x1F }, /* 19.0.0 Device Master Kek Source. */
            { 0xDA, 0xFB, 0x61, 0x39, 0x48, 0x2D, 0xC2, 0x7E, 0x0D, 0x8E, 0x8F, 0x98, 0x57, 0x20, 0xB8, 0x15 }, /* 20.0.0 Device Master Kek Source. */
            { 0x92, 0xBF, 0x37, 0x80, 0x0E, 0x79, 0x56, 0x8C, 0x57, 0x75, 0x72, 0x0A, 0x48, 0xD8, 0x15, 0x39 }, /* 21.0.0 Device Master Kek Source. */
        };
```
Those values also are on the Atmosphère's source  file `exosphere\program\source\boot\secmon_boot_key_data.s` on the namespace `Production Device Master Kek Sources.` of the Atmosphère's source code.


Those values normally are used on the LockPick's source for the file `source/keys/crypto.h` in the section `static const u8 device_master_kek_sources` 


Please look at it and let me to know if I should correct my code or you can improve yours.
@impeeza
Copy link
Author

impeeza commented Nov 23, 2025

By the way I should started Thank you so much with the nice touch removing the insufferable rainbow. now is a nice and neat payload. and the nice additions with the PRODINFO partition.

This extra values do not belong to this section they are belonging to the ```/* mariko_master_kek_sources Mariko Production Master Kek Source. (MarikoMasterKekSource) */
static const u8 mariko_master_kek_sources[KB_FIRMWARE_VERSION_MAX - KB_FIRMWARE_VERSION_600 + 1][0x10] __attribute__((aligned(4))) = {
``` section
@ThexXTURBOXx
Copy link

Without this patch, nxdumptool complained about a missing mariko_kek upon startup on my device (running FW 21.1.0).
With this PR, it found master_key_14, which removed the need for me to brute-force the mariko_kek.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants