MTPZ: Initialization, Part 1
It’s been a while, but at least some progress has been made. Hopefully during this absence of posts, you haven’t forgotten about the basic rules of programming.
So here’s a question: before you can use an instance of a class, what must you do first?
Initialization?
That’s right. Before the client software (for this project, I’m looking at the Windows Phone 7 Connector application for Mac OS X) can do any interfacing with the device, it must initialize itself to be ready for communication. This post goes into the first part of what is done.
First and foremost, there are two blocks of data, 640 bytes and 708 bytes long, that are loaded into memory and subsequently have a function applied to both of them. Right off the bat, this seems like decryption, but at that point there really is no way to be certain. Peeking into that function, the following 16 bytes are loaded into memory:
| 000000 | B1 CE 71 1C 1E 1B 46 87 84 A0 84 90 D5 96 22 16 | ..q...F.......". |
Another function is then applied to these 16 bytes. Fortunately, the nature of this function was easy to discover, as it referenced a constant array which, according to Google, is the AES substitution box. These 16 bytes are indeed the decryption key used in the AES algorithm. This key is then expanded, resulting in the following decryption key:
| 000000 | B1 CE 71 1C 1E 1B 46 87 84 A0 84 90 D5 96 22 16 20 5D 36 1F 3E 46 70 98 | ..q...F.......". ]6.>Fp. |
| 000030 | BA E6 F4 08 6F 70 D6 1E 73 AB 44 B7 4D ED 34 2F F7 0B C0 27 98 7B 16 39 | ....op..s.D.M.4/...'.{.9 |
| 000060 | 56 EC 56 F1 1B 01 62 DE EC 0A A2 F9 74 71 B4 C0 FD 61 EC 63 E6 60 8E BD | V.V...b.....tq...a.c.`.. |
| 000090 | 0A 6A 2C 44 7E 1B 98 84 42 27 B3 90 A4 47 3D 2D AE 2D 11 69 D0 36 89 ED | .j,D~...B'...G=-.-.i.6.. |
| 0000c0 | 67 80 E6 E0 C3 C7 DB CD 6D EA CA A4 BD DC 43 49 A1 9A DD 9A 62 5D 06 57 | g.......m.....CI....b].W |
| 0000f0 | 0F B7 CC F3 B2 6B 8F BA 5E E9 29 AD 3C B4 2F FA 33 03 E3 09 81 68 6C B3 | .....k..^.).<./.3....hl. |
| 000120 | 00 B9 44 A1 3C 0D 6B 5B 0F 0E 88 52 8E 66 E4 E1 05 D0 BC B8 39 DD D7 E3 | ..D.<.k[...R.f......9... |
| 000150 | 36 D3 5F B1 B8 B5 BB 50 | 6._....P |
As per AES, the first round of decryption uses the input key exactly, which is why the first 16 bytes of the expanded key are the same as the unexpanded key. However, Microsoft goes off book at this point, calling the AES routine InvMixColumns on the key, where it normally would not be used. This leads us to our final expanded key:
| 000000 | B1 CE 71 1C 1E 1B 46 87 84 A0 84 90 D5 96 22 16 40 5A FE B0 91 03 E4 E6 | ..q...F.......".@Z...... |
| 000030 | F6 80 E3 35 B6 B1 BA 6A 6C 76 0D 3C FD 75 E9 DA 0B F5 0A EF BD 44 B0 85 | ...5...jlv.<.u.......D.. |
| 000060 | CC 02 F6 25 31 77 1F FF 3A 82 15 10 87 C6 A5 95 11 E3 26 C7 20 94 39 38 | ...%1w..:.........&. .98 |
| 000090 | 1A 16 2C 28 9D D0 89 BD 21 BE 5C 85 01 2A 65 BD 1B 3C 49 95 86 EC C0 28 | ..,(....!.\..*e..<I....( |
| 0000c0 | 28 7F 70 C6 29 55 15 7B 32 69 5C EE B4 85 9C C6 8D A5 09 5D A4 F0 1C 26 | (.p.)U.{2i\........]...& |
| 0000f0 | 96 99 40 C8 22 1C DC 0E 5C C9 4D EB F8 39 51 CD 6E A0 11 05 4C BC CD 0B | ..@."...\.M..9Q.n...L... |
| 000120 | E8 B2 14 12 10 8B 45 DF 7E 2B 54 DA 32 97 99 D1 05 D0 BC B8 39 DD D7 E3 | ......E.~+T.2.......9... |
| 000150 | 36 D3 5F B1 B8 B5 BB 50 | 6._....P |
Microsoft can be entertaining at times; under the presence of a debugger, the application actually uses the first expanded key (without the InvMixColumns) as the decryption key instead, which effectively prevents it from synchronizing. Oh well, no harm done.
Decryption
So we have the decryption key; now we have to actually decrypt. The data to be decrypted:
Block 1 (640 bytes)
| 000000 | 27 17 A7 24 16 49 16 34 E2 AE B7 5F DF 8E 2A 95 C5 31 20 AE DE F5 3A E7 | '..$.I.4..._..*..1 ...:. |
| 000030 | 81 82 B1 A4 34 F1 43 A7 A5 90 94 E5 E2 D6 04 34 1B D6 E3 66 07 A7 BA B4 | ....4.C........4...f.... |
| 000060 | CA 0C 5A 2D 05 EF 9F 4C 58 B9 61 11 D5 DD DD 5E D5 04 B4 70 1A EB 10 57 | ..Z-...LX.a....^...p...W |
| 000090 | B5 E8 6A BA 96 67 5F 03 DB E4 41 16 B0 4B 30 31 63 72 67 6C 46 8F 1D 12 | ..j..g_...A..K01crglF... |
| 0000c0 | 24 33 20 D7 62 20 22 99 90 DE 06 2B 19 2E 74 16 1A 65 C0 DA D6 38 ED 36 | $3 .b "....+..t..e...8.6 |
| 0000f0 | 8A 29 75 03 97 86 4A 2E 96 31 CB A2 68 18 9C 64 D3 48 E4 96 5B 22 43 88 | .)u...J..1..h..d.H..["C. |
| 000120 | 8D 83 93 48 07 EB 47 B9 08 51 25 3A EF E4 02 9B 94 7B 2E 06 CA 1F EF BB | ...H..G..Q%:.....{...... |
| 000150 | 20 BB B6 13 0E D1 77 82 7D D4 BB CB AB FE 7C 39 90 74 6D BD 7E 90 B0 CC | .....w.}.....|9.tm.~... |
| 000180 | 24 7C 3B 28 39 3A 94 34 1E 8D B2 39 06 4C 11 E7 F1 48 FF A3 FE 26 80 F0 | $|;(9:.4...9.L...H...&.. |
| 0001b0 | C4 37 0F C6 A2 9C 12 5D 28 C8 D0 2A 84 37 61 03 53 E6 15 D8 E8 FA EB C3 | .7.....](..*.7a.S....... |
| 0001e0 | 13 DA 93 E7 38 B8 17 3B 2C 1C 3F 04 32 F0 2A A6 E0 EC A3 BB 91 DC A0 41 | ....8..;,.?.2.*........A |
| 000210 | 49 A6 78 95 61 CE 39 AA CA 3A 12 C5 FD 22 B4 5B E0 4A 5E 9F A2 9D 21 E6 | I.x.a.9..:...".[.J^...!. |
| 000240 | C2 39 ED 03 62 AB 6D C9 DA 3E D1 16 BA 30 5F 89 69 97 B6 BC C2 A6 7B B2 | .9..b.m..>...0_.i.....{. |
| 000270 | 8F F9 FB D6 2C 78 41 CF F1 EB E5 47 5B 4D 4A BB 63 E8 E0 B8 01 30 CA 20 | ....,xA....G[MJ.c....0. |
| 0002a0 | 60 5F C8 70 11 E7 A5 1D D4 BA EB B5 07 ED BA 74 DC B2 A3 EE 58 CF 33 89 | `_.p...........t....X.3. |
| 0002d0 | 89 AA 55 14 AB 86 0E 76 24 52 D1 75 6F 6A 45 19 26 81 01 96 95 73 F2 FF | ..U....v$R.uojE.&....s.. |
| 000300 | 5E B4 D3 46 1F 84 C9 AB 59 55 3B 34 80 D5 9B 2D F8 FB B9 38 BE B4 08 11 | ^..F....YU;4...-...8.... |
| 000330 | C1 D5 78 13 7B 8B 75 5A 66 AA 89 C0 6A 1D D7 63 A0 1D 95 4C DD CF 33 F7 | ..x.{.uZf...j..c...L..3. |
| 000360 | CF 64 6E 4B 71 70 3F 85 F0 88 97 34 1F B1 AB 5E 27 2B 43 C3 67 8E 53 3F | .dnKqp?....4...^'+C.g.S? |
| 000390 | 78 E1 0E 13 B1 81 CF 2E 11 AF 6F EF 15 1D 4F 05 FD 9C D7 98 A3 0B 84 9F | x.........o...O......... |
| 0003c0 | BE 77 7F 48 D0 A1 A2 C9 8F AF 02 4F 48 2B EC 67 64 A9 71 7D 6E 0B A5 10 | .wH.......OH+.gd.q}n... |
| 0003f0 | 7F D1 A8 D0 F1 7C 05 10 91 C9 54 E5 DC 7F 50 42 49 9E 18 49 B0 4F 0E AA | ....|....T..PBI..I.O.. |
| 000420 | 61 77 BB 82 66 35 76 C1 3C 10 F2 A7 5F 8E A7 B1 CD 2D 4A 6D 65 19 3F 77 | aw..f5v.<..._....-Jme.?w |
| 000450 | 2F 07 BA 7D 60 3F A8 E2 BF 10 0D 2B 34 C5 A8 99 06 C2 5F 82 B4 AA 6C F5 | /..}`?.....+4....._...l. |
| 000480 | D2 8A 59 61 4B 78 A5 FF F3 A3 5F 93 D4 21 77 0F 06 1E 58 87 E5 EB 50 DF | ..YaKx...._..!w...X...P. |
| 0004b0 | 47 EA 28 6D F2 68 ED 43 77 FA E7 58 62 CE 8A 4C 59 1D 69 72 FA 43 8E A8 | G.(m.h.Cw..Xb..LY.ir.C.. |
| 0004e0 | 67 9C 68 B6 68 A3 3E 38 7A 7D 71 2B D0 DB FB 3E | g.h.h.>8z}q+...> |
Block 2 (708 bytes)
| 000000 | 4A 84 6A E0 82 F9 F3 41 A1 CF 8B B7 E0 20 35 7B B7 61 03 DE 27 D1 F5 A0 | J.j....A..... 5{.a..'... |
| 000030 | A2 46 C9 73 2D 50 74 1E A8 DE D9 6B D2 7D 8D 69 6B F3 34 6D 42 14 2E B9 | .F.s-Pt....k.}.ik.4mB... |
| 000060 | 1D 5B 82 1D 7F 72 40 5D 67 07 33 CA 1A D3 CA 8E 18 29 48 60 43 48 D6 FC | .[..r@]g.3......)H`CH.. |
| 000090 | 9A EA 77 7F 43 C6 43 A9 D5 86 61 4B D6 7A 10 85 12 6A CF 2C 1B 1E B4 3C | ..wC.C...aK.z...j.,...< |
| 0000c0 | F5 A4 27 D7 9A FC A4 D1 FA 41 85 0F 72 48 6A 2F DA 2D 29 72 3F E5 01 DD | ..'......A..rHj/.-)r?... |
| 0000f0 | 61 F4 F6 F4 14 91 CC A2 DA 2B 4F B7 73 BB 80 E8 4A F0 4E C6 63 C4 4A 22 | a........+O.s...J.N.c.J" |
| 000120 | EF 33 CE 29 28 CE CB FB AE FC 64 87 60 F2 FE 6D F8 30 C2 5B 1A 73 0C 5A | .3.)(.....d.`..m.0.[.s.Z |
| 000150 | 2C 0B EE 18 E6 78 18 08 7E C9 D4 37 C8 97 49 BD 38 75 EE 31 2F 52 2B F1 | ,....x..~..7..I.8u.1/R+. |
| 000180 | CA 4B FB D2 37 A8 38 3B 9B A1 AB 61 7A 75 2B A0 85 15 F8 E8 9F A2 5B 02 | .K..7.8;...azu+.......[. |
| 0001b0 | 8C EB 9B DE CD 41 69 0A F1 84 56 3A A7 AD 01 BD 7C 7E 2B BE 79 62 4E 7F | .....Ai...V:....|~+.ybN |
| 0001e0 | 2F AB B8 33 9E B4 A2 C7 46 38 56 03 88 EB E3 3B D5 60 74 31 7F A3 8A 9F | /..3....F8V....;.`t1... |
| 000210 | C6 14 7F D9 19 44 E0 E3 8C F8 5F D6 F3 31 53 4E 06 BF C4 ED D2 65 52 1A | ....D...._..1SN.....eR. |
| 000240 | 94 74 98 4A 6A 7C F4 74 60 6D 3B 41 75 6E 86 27 32 6F D7 C9 10 1A 07 67 | .t.Jj|.t`m;Aun.'2o.....g |
| 000270 | 82 8C B6 2C 28 33 CC 23 83 D1 9B 4D 24 52 3E C3 DE 33 A1 5D 31 64 8F F5 | ...,(3.#...M$R>..3.]1d.. |
| 0002a0 | 3C 5C FC 24 6B AC 1B FA 1F EB 7F 82 13 B2 B7 70 35 BF 7C 7C E1 3F 74 1A | <\.$k.........p5.||.?t. |
| 0002d0 | E0 2A 1C B0 14 4F AB E3 49 7E A6 CE DA D5 94 DB FF 4C 6B E8 5D 30 9C DC | .*...O..I~.......Lk.]0.. |
| 000300 | 0B ED AF 59 0F 48 17 3C EF A9 F5 25 20 CD 12 22 64 17 E8 ED F9 59 87 89 | ...Y.H.<...% .."d....Y.. |
| 000330 | A2 71 1A E0 BF F5 AC F5 E0 1E 00 B7 7D 4D E0 35 69 DF E0 03 7C 6E 0A E5 | .q..........}M.5i...|n.. |
| 000360 | 7A E9 D6 14 9F A0 BE B2 36 1A 86 68 F6 BC 6A 97 75 47 C7 89 2E 13 77 B2 | z.......6..h..j.uG....w. |
| 000390 | CD 34 EC 07 D2 AC 02 90 C4 1D 2E A7 29 70 C0 B8 F0 9A A1 7C 29 65 84 4A | .4..........)p.....|)e.J |
| 0003c0 | 12 F9 7C E0 E0 58 A6 DF C6 36 83 47 AC 2C 5A AA C5 31 20 AE DE F5 3A E7 | ..|..X...6.G.,Z..1 ...:. |
| 0003f0 | 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 | ....4.C..1 ...:.....4.C. |
| 000420 | C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 | .1 ...:.....4.C..1 ...:. |
| 000450 | 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 | ....4.C..1 ...:.....4.C. |
| 000480 | C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 | .1 ...:.....4.C..1 ...:. |
| 0004b0 | 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 | ....4.C..1 ...:.....4.C. |
| 0004e0 | C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 | .1 ...:.....4.C..1 ...:. |
| 000510 | 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 | ....4.C..1 ...:.....4.C. |
| 000540 | C5 31 20 AE DE F5 3A E7 81 82 B1 A4 34 F1 43 A7 C5 31 20 AE DE F5 3A E7 | .1 ...:.....4.C..1 ...:. |
| 000570 | 81 82 B1 A4 34 F1 43 A7 | ....4.C. |
From here, the decryption routine seems to be the standard AES decryption with the exception of InvMixColumns. That is, the round key is added at the very beginning. Then, the rows are shifted, the bytes substituted, and the next round key added in a loop. The loop has 10 iterations, after which the final round key is added, resulting in the decrypted data.
Decrypted Block 1 (Certificates)
| 000000 | 02 00 00 01 35 01 00 00 00 00 B5 01 00 00 00 01 00 00 00 00 00 00 00 00 | ....5................... |
| 000030 | 00 00 00 00 00 00 00 00 00 12 5A 75 6E 65 20 53 6F 66 74 77 61 72 65 20 | ..........Zune Software |
| 000060 | 43 41 20 31 00 01 00 01 00 80 33 6E E6 AA 07 BF B3 FF D0 40 24 CE C3 8B | CA 1......3n.......@$... |
| 000090 | E6 49 7E F6 0E 3D 7F 68 2E 0F F1 5E 6C 65 FF 61 3B DE 17 6F AD 71 37 88 | .I~..=h...^le.a;..o.q7. |
| 0000c0 | 4E 80 A8 13 CF 53 C3 10 1A A5 1B 9E 4F 54 B2 4F D5 14 CD C5 09 B6 B7 1E | N....S......OT.O........ |
| 0000f0 | 1F 48 51 3D F0 64 44 D9 B5 59 63 E8 12 1C 4C 69 B6 7D 6A 13 14 F9 73 C9 | .HQ=.dD..Yc...Li.}j...s. |
| 000120 | 58 5C 29 BB 99 0A D7 FD 15 1D BB CB 4F 9E D7 DF E2 92 BA 4E D9 C6 AC F5 | X\).........O......N.... |
| 000150 | 8E 6A DE EF 5B 87 7A 1C 15 45 74 26 34 91 69 46 45 9B 09 4B 25 9E D8 5E | .j..[.z..Et&4.iFE..K%..^ |
| 000180 | F0 2B 08 A3 18 E6 7A FD 68 C2 89 A8 C6 A6 1B C8 02 3C A8 7F E3 67 BD CC | .+....z.h........<..g.. |
| 0001b0 | 08 56 C3 D1 57 58 C8 66 E5 3F B5 2E 86 EC 56 9C 9C 07 0A 22 17 4F BD 7C | .V..WX.f.?....V....".O.| |
| 0001e0 | 4D CD 39 5E C6 85 30 16 34 51 CE 1F 58 80 44 A0 6E BB 95 A6 D4 BE 68 B0 | M.9^..0.4Q..X.D.n.....h. |
| 000210 | 89 A4 F2 5A 61 2F FC EA 56 C1 C3 F8 A6 88 0C 05 76 F2 65 74 B6 4F F8 3D | ...Za/..V.......v.et.O.= |
| 000240 | 28 68 F0 FE 36 96 BC 84 25 48 7A E0 62 D4 8A AD FD 08 8A 97 87 B8 06 81 | (h..6...%Hz.b........... |
| 000270 | 0B ED 00 00 01 37 01 00 00 00 00 B7 03 00 00 00 00 00 00 00 00 00 00 00 | .....7.................. |
| 0002a0 | 00 00 00 00 00 00 00 00 00 00 14 5A 75 6E 65 20 53 6F 66 74 77 61 72 65 | ...........Zune Software |
| 0002d0 | 20 4C 65 61 66 20 31 00 01 00 01 00 80 E5 77 D3 FC BE 3F 03 E2 4F E8 8C | Leaf 1.......w...?..O.. |
| 000300 | 19 F4 64 98 E1 C7 36 18 1B B2 FE BE 2E EB 1E 26 92 B6 DB D0 D1 83 EB 2B | ..d...6........&.......+ |
| 000330 | 29 B2 D3 36 45 B8 09 8D C6 74 DD 25 D2 A6 5E DA CD 16 FE 8E 3D FF 01 B2 | )..6E....t.%..^.....=... |
| 000360 | 21 3A A4 4F 3B 2C 68 36 A1 03 56 D4 24 17 01 C2 DB 54 74 9D 89 77 7F 7A | !:.O;,h6..V.$....Tt..wz |
| 000390 | 80 90 0F 84 B2 97 35 69 8C 21 2D F5 16 5B 50 22 B5 F3 BF B6 A7 8B F0 34 | ......5i.!-..[P".......4 |
| 0003c0 | E2 9F 9B 2B 97 16 D3 D3 29 50 9A 95 AD D7 2D 34 57 C3 D4 D0 CA 7E EA C9 | ...+....)P....-4W....~.. |
| 0003f0 | 77 6F 4D 73 A4 AA FD 89 6B AA 5A 86 85 C0 5D 5B 74 66 65 21 84 81 67 5E | woMs....k.Z...][tfe!..g^ |
| 000420 | D6 29 B2 55 3A 9D F0 3D 74 58 66 C5 CF 24 03 51 A7 6C 6D BB D0 28 30 E5 | .).U:..=tXf..$.Q.lm..(0. |
| 000450 | F4 72 E2 AD 24 58 7C 7C AB 60 18 FD D9 34 C0 93 DF 41 CA B6 18 7E 6E 1E | .r..$X||.`...4...A...~n. |
| 000480 | E9 BB 8D D5 99 F9 A2 10 F4 05 1F CD FD 55 28 8D 97 61 CA 22 C3 21 9E 72 | .............U(..a.".!.r |
| 0004b0 | 24 76 46 AB 50 50 B0 B2 C7 7F 1D FB 6F 95 45 64 03 61 A2 7C AF CC 59 F3 | $vF.PP.....o.Ed.a.|..Y. |
| 0004e0 | 24 42 E2 1B 7B 00 00 00 00 00 00 00 00 00 00 00 | $B..{........... |
Decrypted Block 2 (Public Key Encryption)
| 000000 | 52 53 41 32 88 00 00 00 00 04 00 00 7F 00 00 00 01 00 01 00 E5 77 D3 FC | RSA2................w.. |
| 000030 | BE 3F 03 E2 4F E8 8C 19 F4 64 98 E1 C7 36 18 1B B2 FE BE 2E EB 1E 26 92 | .?..O....d...6........&. |
| 000060 | B6 DB D0 D1 83 EB 2B 29 B2 D3 36 45 B8 09 8D C6 74 DD 25 D2 A6 5E DA CD | ......+)..6E....t.%..^.. |
| 000090 | 16 FE 8E 3D FF 01 B2 21 3A A4 4F 3B 2C 68 36 A1 03 56 D4 24 17 01 C2 DB | ...=...!:.O;,h6..V.$.... |
| 0000c0 | 54 74 9D 89 77 7F 7A 80 90 0F 84 B2 97 35 69 8C 21 2D F5 16 5B 50 22 B5 | Tt..wz......5i.!-..[P". |
| 0000f0 | F3 BF B6 A7 8B F0 34 E2 9F 9B 2B 97 16 D3 D3 29 50 9A 95 AD D7 2D 34 57 | ......4...+....)P....-4W |
| 000120 | C3 D4 D0 CA 00 00 00 00 00 00 00 00 B1 BD E4 73 BB 64 DB 05 0B 4A 94 AE | ...............s.d...J.. |
| 000150 | D6 EC 30 28 F0 2A BD BE 8D E0 B6 F1 1D 06 97 C8 56 58 8E B8 62 F3 0A 37 | ..0(.*..........VX..b..7 |
| 000180 | 98 0F 71 21 A3 86 61 C2 7F 54 22 DF 90 A1 A5 67 AB 41 63 9A 1B 9C 64 1C | ..q!..a.T"....g.Ac...d. |
| 0001b0 | 91 65 B2 E7 00 00 00 00 75 A6 C8 80 60 AD 10 A0 9E 0A B5 AE CF DB A6 F3 | .e......u...`........... |
| 0001e0 | 83 C9 07 53 45 1D A1 ED 31 F1 32 52 E5 31 92 A4 94 8A F9 1A 5A 49 23 00 | ...SE...1.2R.1......ZI#. |
| 000210 | C1 6C 60 F3 F2 58 DE BB A3 EB B7 35 5C B8 39 A9 B7 1D D7 B2 A5 E8 16 E0 | .l`..X.....5\.9......... |
| 000240 | 00 00 00 00 C1 E9 CC FE F9 E3 C3 A0 58 73 5D 80 93 27 05 9B C0 83 5B EA | ............Xs]..'....[. |
| 000270 | 36 FC 2C 0C E5 60 3B 6C 7D 69 07 8B D5 78 C0 99 96 9A 67 4B D5 F8 84 5B | 6.,..`;l}i...x....gK...[ |
| 0002a0 | 0C 6C E2 C4 1C A5 9B 72 41 67 9F 51 2B 20 57 28 FB A3 4E 45 00 00 00 00 | .l.....rAg.Q+ W(..NE.... |
| 0002d0 | BD 4E BB 77 C7 70 77 DF 27 9A 56 42 76 2C 93 B7 85 93 E3 41 B2 BF AD 9B | .N.w.pw.'.VBv,.....A.... |
| 000300 | 5C BF 80 7D EF 54 06 4F 69 67 1E 26 55 8B 29 62 D2 94 29 75 02 36 7E 3B | \..}.T.Oig.&U.)b..)u.6~; |
| 000330 | 83 BB 5B D1 41 03 3A F4 E5 0E EF 9E 4B 34 E4 05 00 00 00 00 32 B5 C7 64 | ..[.A.:.....K4......2..d |
| 000360 | BB 32 EF EE D0 71 78 1D F6 64 3B 62 00 7A CD 86 CD B9 E5 53 AF A1 76 4A | .2...qx..d;b.z.....S..vJ |
| 000390 | 5A F2 DA 16 D0 20 68 FC 8D B2 1D 11 E5 BB F4 39 94 72 5F 4F 87 6F F5 7D | Z.... h........9.r_O.o.} |
| 0003c0 | 2D A5 05 EF F0 3B D7 EF EB B4 47 04 00 00 00 00 00 00 00 00 00 00 00 00 | -....;....G............. |
| 0003f0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 000420 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 000450 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 000480 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 0004b0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 0004e0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 000510 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 000540 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ........................ |
| 000570 | 00 00 00 00 00 00 00 00 | ........ |
If you didn’t notice, the first decrypted blocks are a byte-for-byte match with what is sent to the device in the USB sessions that I captured. As always, these seem to be certificates provided by the client software to show the device that it is indeed a valid client.
The second block is more interesting as this is the first time I have seen it. The first three bytes, RSA, show that this has something to do with RSA public key encryption. How this is used is still unknown.
What makes me happy to say is that I’ve managed to implement everything I have described above in my own C# code, which, besides making me feel awesome, is hopefully an indication that this project is viable.
In the next part, I will go over what the software then does with these two decrypted blocks.