Talk:Communication Processor

CPUP Python Script

import os
import sys
from Crypto.Cipher import AES
from Crypto.PublicKey import RSA

cui_modulus = 0xA7CCAE0F501188527BF3DACCA3E231C8D8701E7B91927390701DE5E7A96327DAD87167A8F01368ADDFE490E325A290533697058FBA775766698010AFD8FD7A3FFD265E0A52FE04928BCE8B4302F4C70FFAC3C9397FD24B106271E57BDA20D2D702298F6F990ECF9B0FE04FF6CCEE170B555304232012D78E6019DAB29763829E6AF5ADA802204FA551631179CBFE6164732662E8576741949BB136456C11DE355F487211D230267DC05E699A2652AD5C6D74B0568326F4F2F5B86AD956E94404D3A65928F4EA2189567CE9989911B04808517F4C76A8B25DF1D6ABBE8595C469BFD7E870C4F00A89610C2C9B79F625A42CA2B4C6B8D37E62CE9EC61A856FD32FL

cui_pub_exponent = 0x10001L

def aes_decrypt_cbc(key, iv, input):
    return AES.new(key, AES.MODE_CBC, iv).decrypt(input)

def s2i(s):
  result = 0L
  for c in s:
    result = 256 * result + ord(c)
  return result

def as_bytestring(x):
  return ''.join([chr((x >> (i * 8)) & 0xFF) for i in xrange(x.bit_length() / 8 - 1, -1, -1)])


def rsa_public_encrypt(modulus, public_exponent, data):
  key = RSA.construct((modulus, public_exponent))
  data = as_bytestring(key._encrypt(s2i(data)))
  return data

with open(sys.argv[1],"rb") as f:
	f.seek(-0x100, os.SEEK_END)
	cui_sig = f.read()
	cui_sig_out = rsa_public_encrypt(cui_modulus, cui_pub_exponent, cui_sig)[-0x34:]
	iv, key, sig = cui_sig_out[:0x10], cui_sig_out[0x10:0x20], cui_sig_out[0x20:]
	with open(sys.argv[1],"rb") as g:
		body = g.read()[0x20:]
		dec = aes_decrypt_cbc(key, iv, body)
		with open(sys.argv[2],"wb") as h:
			h.write(dec[:-0x100])
	

fsimage1 Python Script

import os
import sys
from Crypto.Cipher import AES
from Crypto.PublicKey import RSA

cui_modulus = 0xA9697F9D9343CADE68E04F9E356E6AB6BBC7DE36A4D81B98A83BC12BE3F6DF96ED7A64389456ACA933BEBFBA4FFEF05CF45F2F886F434FBBC3A01348533070C0B7D5E9C21EFE53E95A6019DB51C12C6BAFEB94E992287963448E59606384B99F3FF3E5EB6AA08BF32A4DBA7A312520CEC2B69BB20A6D0640B117170AA2DDA1FB590AEE7ADFC4E80DFCF27FA55DDEC92C07922FDD05AB1618DCB727AA6FF70027A9410BC845E50EAFD46C0FD92FF500672DE56489C669B0AA481FFD75E99E21A8DC2F9F9E87957B46BBF63FB7DDBE8B8CA861BA349A62458E855EE78C3DD6791F92E76422144E51295B1337E15C126DF6FA0C29321BC1D7C00E3C19EEF3A3E7A5L

cui_pub_exponent = 0x10001L

def aes_decrypt_cbc(key, iv, input):
    return AES.new(key, AES.MODE_CBC, iv).decrypt(input)

def s2i(s):
  result = 0L
  for c in s:
    result = 256 * result + ord(c)
  return result

def as_bytestring(x):
  return ''.join([chr((x >> (i * 8)) & 0xFF) for i in xrange(x.bit_length() / 8 - 1, -1, -1)])


def rsa_public_encrypt(modulus, public_exponent, data):
  key = RSA.construct((modulus, public_exponent))
  data = as_bytestring(key._encrypt(s2i(data)))
  return data

with open(sys.argv[1],"rb") as f:
	f.seek(-0x100, os.SEEK_END)
	cui_sig = f.read()
	cui_sig_out = rsa_public_encrypt(cui_modulus, cui_pub_exponent, cui_sig)[-0x34:]
	iv, key, sig = cui_sig_out[:0x10], cui_sig_out[0x10:0x20], cui_sig_out[0x20:]
	with open(sys.argv[1],"rb") as g:
		body = g.read()[0x120:]
		dec = aes_decrypt_cbc(key, iv, body)
		with open(sys.argv[2],"wb") as h:
			h.write(dec[:-0x100])

lsusb Output

Bus 003 Device 003: ID 054c:0432 Sony Corp. PSP2 Devkit
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x054c Sony Corp.
  idProduct          0x0432 
  bcdDevice            2.20
  iManufacturer           1 Sony Computer Entertainment Inc.
  iProduct                2 PSP2 Devkit
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0020
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          3 deci
    bmAttributes         0xc0
      Self Powered
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              3 deci
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered