├── Makefile ├── .gitignore ├── mec_repack ├── mmapfile.h ├── README.md ├── LICENSE ├── mec_csum_outer.c ├── mec_csum_boot.c ├── mec_csum_flasher.c └── mec_encrypt.c /Makefile: -------------------------------------------------------------------------------- 1 | CFLAGS=-Wall -O2 2 | TOOLS=mec_csum_boot mec_csum_flasher mec_csum_outer mec_encrypt 3 | LD_LIBS_mec_encrypt = -lcrypto 4 | 5 | all: $(TOOLS) 6 | 7 | %: %.c mmapfile.h 8 | $(CC) $(CFLAGS) $< -o $@ $(LD_LIBS_$@) 9 | 10 | clean: 11 | rm -f $(TOOLS) 12 | 13 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Object files 2 | *.o 3 | *.ko 4 | *.obj 5 | *.elf 6 | 7 | # Precompiled Headers 8 | *.gch 9 | *.pch 10 | 11 | # Libraries 12 | *.lib 13 | *.a 14 | *.la 15 | *.lo 16 | 17 | # Shared objects (inc. Windows DLLs) 18 | *.dll 19 | *.so 20 | *.so.* 21 | *.dylib 22 | 23 | # Executables 24 | *.exe 25 | *.out 26 | *.app 27 | *.i*86 28 | *.x86_64 29 | *.hex 30 | 31 | # Debug files 32 | *.dSYM/ 33 | 34 | # Generated Outputs specific to this repo 35 | mec_csum_boot 36 | mec_csum_flasher 37 | mec_csum_outer 38 | mec_encrypt 39 | 40 | -------------------------------------------------------------------------------- /mec_repack: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Script to fix firmware checksums and re-encrypt 3 | # Run on a decrypted firmware image 4 | 5 | if [ $# -lt 2 ]; then 6 | echo usage: $0 input output 7 | exit 1 8 | fi 9 | 10 | echo building $2 from $1 11 | ./mec_csum_boot -f $1 12 | ./mec_csum_flasher -f $1 13 | ./mec_encrypt -e $1 $2 14 | ./mec_csum_outer -f $2 15 | echo 16 | echo reverifying 17 | tmp=`mktemp` 18 | ./mec_csum_outer -c $2 19 | ./mec_encrypt -d $2 $tmp 20 | ./mec_csum_flasher -c $tmp 21 | ./mec_csum_boot -c $tmp 22 | rm -f $tmp 23 | 24 | -------------------------------------------------------------------------------- /mmapfile.h: -------------------------------------------------------------------------------- 1 | /* 2 | * mmapfile.h: utility function for mmapping files 3 | */ 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | static inline void *mmapfile(const char *pathname, int prot, int flags, 10 | size_t *length) 11 | { 12 | struct stat st; 13 | int openflags = (prot & PROT_WRITE) ? O_RDWR : O_RDONLY; 14 | int fd; 15 | void *p; 16 | 17 | fd = open(pathname, openflags); 18 | if (fd == -1) 19 | return MAP_FAILED; 20 | 21 | if (fstat(fd, &st) == -1) 22 | { 23 | close(fd); 24 | return MAP_FAILED; 25 | } 26 | 27 | *length = st.st_size; 28 | p = mmap(NULL, *length, prot, flags, fd, 0); 29 | 30 | close(fd); 31 | return p; 32 | } 33 | 34 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ###Tools for modifying Lenovo embedded controller firmware 2 | 3 | Run make to build (requires OpenSSL). 4 | 5 | To extract an EC firmware image from the BIOS update file: 6 | 7 | ```sh 8 | dd if=\$01DA000.FL2 of=mec.bin bs=4096 skip=1280 count=48 9 | ``` 10 | 11 | To decrypt an EC firmware image: 12 | 13 | ```sh 14 | ./mec_encrypt -d mec.bin >mec-decrypted.bin 15 | ``` 16 | 17 | To reencrypt the image after modification, fixing checksums: 18 | 19 | ```sh 20 | ./mec_repack mec-decrypted.bin mec-new.bin 21 | ``` 22 | 23 | To reembed into the BIOS update file: 24 | 25 | ```sh 26 | dd if=mec-new.bin of=\$01DA000.FL2 conv=notrunc bs=4096 seek=1280 27 | ``` 28 | 29 | Before carrying out your own modifications, follow the above steps on 30 | the unmodified image and check that, in the third step, the checksums 31 | all report as OK. If any checksum shows FIXED or FAIL, do not proceed 32 | until you understand why. In particular, the checksum locations in 33 | mec_csum_boot.c may need to be modified for different laptop models. 34 | 35 | Modifying embedded controller firmware carries the serious risk of 36 | bricking your laptop. These tools are provided in the hope they are 37 | useful, without warranty; use them at your own risk. 38 | 39 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | This is free and unencumbered software released into the public domain. 2 | 3 | Anyone is free to copy, modify, publish, use, compile, sell, or 4 | distribute this software, either in source code form or as a compiled 5 | binary, for any purpose, commercial or non-commercial, and by any 6 | means. 7 | 8 | In jurisdictions that recognize copyright laws, the author or authors 9 | of this software dedicate any and all copyright interest in the 10 | software to the public domain. We make this dedication for the benefit 11 | of the public at large and to the detriment of our heirs and 12 | successors. We intend this dedication to be an overt act of 13 | relinquishment in perpetuity of all present and future rights to this 14 | software under copyright law. 15 | 16 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 17 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 18 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 19 | IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR 20 | OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 21 | ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR 22 | OTHER DEALINGS IN THE SOFTWARE. 23 | 24 | For more information, please refer to 25 | -------------------------------------------------------------------------------- /mec_csum_outer.c: -------------------------------------------------------------------------------- 1 | /* 2 | * mec_csum_outer.c: check/fix outer checksum 3 | * Should be run on the encrypted image 4 | */ 5 | #include 6 | #include 7 | #include 8 | #include "mmapfile.h" 9 | 10 | int main(int argc, char *argv[]) 11 | { 12 | size_t length; 13 | unsigned char *base; 14 | unsigned char *p, *end; 15 | unsigned short csum = 0; 16 | unsigned short stored; 17 | int fix; 18 | 19 | if ((argc >= 3) && (strcmp(argv[1], "-f") == 0)) 20 | fix = 1; 21 | else if ((argc >= 3) && (strcmp(argv[1], "-c") == 0)) 22 | fix = 0; 23 | else 24 | { 25 | fprintf(stderr, "usage: %s {-f|-c} file\n", argv[0]); 26 | return 1; 27 | } 28 | 29 | base = (unsigned char *)mmapfile(argv[2], fix?(PROT_READ|PROT_WRITE):PROT_READ, MAP_SHARED, &length); 30 | if (base == MAP_FAILED) 31 | { 32 | perror("mmapfile"); 33 | return 1; 34 | } 35 | 36 | if (*(unsigned int *)base == 0x0f802020) 37 | { 38 | fprintf(stderr, "you should run this on the encrypted image\n"); 39 | return 1; 40 | } 41 | 42 | end = base + length; 43 | for (p = base; p < end-2; p+=2) 44 | csum += ntohs(*(unsigned short *)p); 45 | csum = -csum; 46 | csum = htons(csum); 47 | 48 | stored = *(unsigned short *)p; 49 | if (fix) 50 | *(unsigned short *)p = csum; 51 | 52 | printf("%04x %04x %s\n", stored, csum, (stored!=csum)?(fix?"FIXED":"FAIL"):"OK"); 53 | return (stored!=csum)&&!fix; 54 | } 55 | -------------------------------------------------------------------------------- /mec_csum_boot.c: -------------------------------------------------------------------------------- 1 | /* 2 | * mec_csum_boot.c: check/fix boot-time checksums 3 | * Should be run on the decrypted image 4 | */ 5 | #include 6 | #include 7 | #include "mmapfile.h" 8 | 9 | int checksum(unsigned char *base, unsigned int location, 10 | unsigned int start, unsigned int end, int fix) 11 | { 12 | unsigned char *p; 13 | unsigned int stored = *(unsigned int *)(base + location); 14 | unsigned int csum = 0; 15 | 16 | for (p = base+start; p < base+end; p += 4) 17 | csum += *(unsigned int *)p; 18 | csum = -csum; 19 | 20 | if (fix) 21 | *(unsigned int *)(base+location) = csum; 22 | 23 | printf("%08x %08x %s\n", stored, csum, (stored!=csum)?(fix?"FIXED":"FAIL"):"OK"); 24 | return (stored!=csum)&&!fix; 25 | } 26 | 27 | int main(int argc, char *argv[]) 28 | { 29 | size_t length; 30 | unsigned char *base; 31 | int fix, r; 32 | 33 | if ((argc >= 3) && (strcmp(argv[1], "-f") == 0)) 34 | fix = 1; 35 | else if ((argc >= 3) && (strcmp(argv[1], "-c") == 0)) 36 | fix = 0; 37 | else 38 | { 39 | fprintf(stderr, "usage: %s {-f|-c} file\n", argv[0]); 40 | return 1; 41 | } 42 | 43 | base = mmapfile(argv[2], fix?(PROT_READ|PROT_WRITE):PROT_READ, MAP_SHARED, &length); 44 | if (base == MAP_FAILED) 45 | { 46 | perror("mmapfile"); 47 | return 1; 48 | } 49 | 50 | if (*(unsigned int *)base != 0x0f802020) 51 | { 52 | fprintf(stderr, "you should run this on the unencrypted image\n"); 53 | return 1; 54 | } 55 | 56 | r = checksum(base, 0x2048, 0, 0x2048, fix); 57 | r |= checksum(base, 0x204c, 0x2080, 0x10000, fix); 58 | r |= checksum(base, 0x2050, 0x10000, 0x20000, fix); 59 | r |= checksum(base, 0x2054, 0x20000, 0x2e000, fix); 60 | munmap(base, length); 61 | return r; 62 | } 63 | 64 | -------------------------------------------------------------------------------- /mec_csum_flasher.c: -------------------------------------------------------------------------------- 1 | /* 2 | * mec_csum_flasher.c: check/fix flash-time checksum 3 | * Should be run on the decrypted image 4 | */ 5 | #include 6 | #include 7 | #include "mmapfile.h" 8 | 9 | unsigned short crc16_table[256] = { 10 | 0x0000, 0x1021, 0x2042, 0x3063, 0x4084, 0x50A5, 0x60C6, 0x70E7, 0x8108, 0x9129, 0xA14A, 0xB16B, 0xC18C, 0xD1AD, 0xE1CE, 0xF1EF, 11 | 0x1231, 0x0210, 0x3273, 0x2252, 0x52B5, 0x4294, 0x72F7, 0x62D6, 0x9339, 0x8318, 0xB37B, 0xA35A, 0xD3BD, 0xC39C, 0xF3FF, 0xE3DE, 12 | 0x2462, 0x3443, 0x0420, 0x1401, 0x64E6, 0x74C7, 0x44A4, 0x5485, 0xA56A, 0xB54B, 0x8528, 0x9509, 0xE5EE, 0xF5CF, 0xC5AC, 0xD58D, 13 | 0x3653, 0x2672, 0x1611, 0x0630, 0x76D7, 0x66F6, 0x5695, 0x46B4, 0xB75B, 0xA77A, 0x9719, 0x8738, 0xF7DF, 0xE7FE, 0xD79D, 0xC7BC, 14 | 0x48C4, 0x58E5, 0x6886, 0x78A7, 0x0840, 0x1861, 0x2802, 0x3823, 0xC9CC, 0xD9ED, 0xE98E, 0xF9AF, 0x8948, 0x9969, 0xA90A, 0xB92B, 15 | 0x5AF5, 0x4AD4, 0x7AB7, 0x6A96, 0x1A71, 0x0A50, 0x3A33, 0x2A12, 0xDBFD, 0xCBDC, 0xFBBF, 0xEB9E, 0x9B79, 0x8B58, 0xBB3B, 0xAB1A, 16 | 0x6CA6, 0x7C87, 0x4CE4, 0x5CC5, 0x2C22, 0x3C03, 0x0C60, 0x1C41, 0xEDAE, 0xFD8F, 0xCDEC, 0xDDCD, 0xAD2A, 0xBD0B, 0x8D68, 0x9D49, 17 | 0x7E97, 0x6EB6, 0x5ED5, 0x4EF4, 0x3E13, 0x2E32, 0x1E51, 0x0E70, 0xFF9F, 0xEFBE, 0xDFDD, 0xCFFC, 0xBF1B, 0xAF3A, 0x9F59, 0x8F78, 18 | 0x9188, 0x81A9, 0xB1CA, 0xA1EB, 0xD10C, 0xC12D, 0xF14E, 0xE16F, 0x1080, 0x00A1, 0x30C2, 0x20E3, 0x5004, 0x4025, 0x7046, 0x6067, 19 | 0x83B9, 0x9398, 0xA3FB, 0xB3DA, 0xC33D, 0xD31C, 0xE37F, 0xF35E, 0x02B1, 0x1290, 0x22F3, 0x32D2, 0x4235, 0x5214, 0x6277, 0x7256, 20 | 0xB5EA, 0xA5CB, 0x95A8, 0x8589, 0xF56E, 0xE54F, 0xD52C, 0xC50D, 0x34E2, 0x24C3, 0x14A0, 0x0481, 0x7466, 0x6447, 0x5424, 0x4405, 21 | 0xA7DB, 0xB7FA, 0x8799, 0x97B8, 0xE75F, 0xF77E, 0xC71D, 0xD73C, 0x26D3, 0x36F2, 0x0691, 0x16B0, 0x6657, 0x7676, 0x4615, 0x5634, 22 | 0xD94C, 0xC96D, 0xF90E, 0xE92F, 0x99C8, 0x89E9, 0xB98A, 0xA9AB, 0x5844, 0x4865, 0x7806, 0x6827, 0x18C0, 0x08E1, 0x3882, 0x28A3, 23 | 0xCB7D, 0xDB5C, 0xEB3F, 0xFB1E, 0x8BF9, 0x9BD8, 0xABBB, 0xBB9A, 0x4A75, 0x5A54, 0x6A37, 0x7A16, 0x0AF1, 0x1AD0, 0x2AB3, 0x3A92, 24 | 0xFD2E, 0xED0F, 0xDD6C, 0xCD4D, 0xBDAA, 0xAD8B, 0x9DE8, 0x8DC9, 0x7C26, 0x6C07, 0x5C64, 0x4C45, 0x3CA2, 0x2C83, 0x1CE0, 0x0CC1, 25 | 0xEF1F, 0xFF3E, 0xCF5D, 0xDF7C, 0xAF9B, 0xBFBA, 0x8FD9, 0x9FF8, 0x6E17, 0x7E36, 0x4E55, 0x5E74, 0x2E93, 0x3EB2, 0x0ED1, 0x1EF0 26 | }; 27 | 28 | int main(int argc, char *argv[]) 29 | { 30 | size_t length; 31 | unsigned char *base; 32 | unsigned char *p, *end; 33 | unsigned short csum = 0xffff; 34 | unsigned short stored; 35 | int fix; 36 | 37 | if ((argc >= 3) && (strcmp(argv[1], "-f") == 0)) 38 | fix = 1; 39 | else if ((argc >= 3) && (strcmp(argv[1], "-c") == 0)) 40 | fix = 0; 41 | else 42 | { 43 | fprintf(stderr, "usage: %s {-f|-c} file\n", argv[0]); 44 | return 1; 45 | } 46 | 47 | base = mmapfile(argv[2], fix?(PROT_READ|PROT_WRITE):PROT_READ, MAP_SHARED, &length); 48 | if (base == MAP_FAILED) 49 | { 50 | perror("mmapfile"); 51 | return 1; 52 | } 53 | 54 | if (*(unsigned int *)base != 0x0f802020) 55 | { 56 | fprintf(stderr, "you should run this on the unencrypted image\n"); 57 | return 1; 58 | } 59 | 60 | end = base + length; 61 | for (p = base; p < end-4; p++) 62 | csum = crc16_table[(csum>>8)^(*p)] ^ (csum<<8); 63 | 64 | /* NOTE: this applies to checksum of firmware image; if trying to use 65 | * this code for the flasher itself, that checksum is byte swapped */ 66 | stored = *(unsigned short *)p; 67 | if (fix) 68 | *(unsigned short *)p = csum; 69 | 70 | printf("%04x %04x %s\n", stored, csum, (stored!=csum)?(fix?"FIXED":"FAIL"):"OK"); 71 | return (stored!=csum)&&!fix; 72 | } 73 | -------------------------------------------------------------------------------- /mec_encrypt.c: -------------------------------------------------------------------------------- 1 | /* 2 | * mec_encrypt.c: encrypt/decrypt firmware images 3 | */ 4 | #include 5 | #include 6 | #include 7 | #include "mmapfile.h" 8 | 9 | static const BF_KEY key = {{ 10 | 0x37FD1F7D, 0xC6A8EF95, 11 | 0x7692330F, 0xBC9106B5, 0xC823E7B6, 0x550C9612, 0xBB52F005, 0xFE24B4F2, 0x4072A551, 0x318F9777, 12 | 0x86EC4125, 0x60B4F9AB, 0x6F2E55B4, 0x3941CD93, 0xFA05B918, 0xCDE4DDD0, 0x71E89A94, 0x2958D3AE 13 | },{ 14 | 0x5CA3EB73, 0x0CBE5E0D, 0x4C1D979B, 0x6DD132B2, 0xB2352F64, 0x88F0A07D, 0x4288365A, 0x34202AC6, 15 | 0xC4A93355, 0x3CDB65CA, 0xF3638748, 0xC3566274, 0x180B9B2C, 0x383B8D68, 0x31C66005, 0xF03F6AC9, 16 | 0x0645D8CF, 0x728AFF56, 0x0F9EEFF8, 0x74AB7ED0, 0x9F43856A, 0x864FA761, 0x7E7C5B0D, 0x6DC78A9C, 17 | 0x08C44F2C, 0x35B24065, 0xDC4559BD, 0xDAFB25F5, 0x8E9C873E, 0x0D9C0689, 0xE82356AA, 0x22464082, 18 | 0x277E1460, 0xCE9B5A4E, 0x81929071, 0x5D499806, 0x0959CD47, 0xE10741B3, 0x388D48FE, 0xC794A4B6, 19 | 0x3203CBD7, 0xCC00D99B, 0xE8BEA14D, 0xEB3A25AC, 0xABB0FCA7, 0x8A003F6C, 0x71E02BF4, 0x39D1A22E, 20 | 0xB6EC2F09, 0xD88F0CC4, 0x7CDF39DA, 0xCBEF4B6A, 0x16BC7C63, 0xFB767467, 0x08A45510, 0xEFAEA553, 21 | 0x5E1B5274, 0xE2F8A5D5, 0xDF5E6E0B, 0x1282323B, 0xCB89E9F7, 0x33B65A1F, 0x8BAFB152, 0x438B65A7, 22 | 0xC8CCFFB3, 0x86F992F6, 0x780A8453, 0xB36CB3E0, 0x825289A7, 0xA08A9B26, 0xBE5EA87A, 0x84C8A92B, 23 | 0x86CA55EA, 0x6E7124C0, 0x51ACECB6, 0xAAD18BFC, 0x69878467, 0x0AB1DF3F, 0xC0E0A388, 0x194F1FB3, 24 | 0xFECE04D4, 0xF8732975, 0x5E545E82, 0x29EA9039, 0x9AE34B58, 0xAFA98FE1, 0xA65D148E, 0x9A6791B2, 25 | 0xD2B90D84, 0xD79C15CA, 0x741372B8, 0x06532B75, 0x0C84BAF0, 0x0116F31A, 0xCD19C0A4, 0x32EF2521, 26 | 0x2402A218, 0x270C2A07, 0xCAE7471B, 0x72B5F859, 0xA3CD55D4, 0x4FB4ED51, 0x97BEECFA, 0x86D7F0FA, 27 | 0x00FC8DF4, 0xC0AF7D3F, 0x07A20004, 0x67D748C4, 0xDBED8C62, 0x0986CEA0, 0xA8ACB955, 0xE028F8A2, 28 | 0x32E8CFED, 0xDA6D463B, 0x4BEF7860, 0x5C7CA750, 0x94A7F208, 0x9BA79D47, 0x451433EC, 0x59CFA8A0, 29 | 0xCABD0AA3, 0xCB341F84, 0xDA955975, 0xB8A21270, 0x4D5330D3, 0x6FB599AF, 0x69AC8A98, 0x89EE923C, 30 | 0xBBD69049, 0x312602B6, 0xFFA58B36, 0x70415C03, 0x7033C596, 0xB8C953D3, 0x5289184E, 0x423D1495, 31 | 0x1B84BEBC, 0x2CDC023D, 0x2C0BE34F, 0xDA588A8D, 0x1227BB7F, 0x5AF986AE, 0xCC4DAB7F, 0x28C5965D, 32 | 0x5B6AA2BC, 0x272172F4, 0x5E6BD465, 0xF9971F73, 0xC5DA4657, 0x4458DDFA, 0xBE9BDA39, 0x8ECB3CD2, 33 | 0x90D9875A, 0xBD120680, 0xED85C961, 0xC6AEAE43, 0x502C9849, 0xB47629A4, 0xE9DBDA44, 0x923CDCE3, 34 | 0xF285C6F2, 0x9D1AA4F4, 0x39AB5876, 0xA8867532, 0x35E8CC2D, 0x9FA993A3, 0x766C3E07, 0x1CC11518, 35 | 0x431AEB56, 0x5FD3FEB5, 0xAFFF5C96, 0xF50B65D0, 0x1776AF81, 0x7C5E3796, 0x9E23F1C2, 0x8E17F277, 36 | 0xCBA8AFC0, 0xFFDE2CF3, 0x4333B926, 0x1C583525, 0xAC53F29B, 0xE3751685, 0x43ADD5D0, 0x94C60540, 37 | 0xF675FCDF, 0x4C71CC63, 0x1A5933EA, 0xA675A258, 0xE485C457, 0xB78533DC, 0x5FF4E678, 0xA51FBB9D, 38 | 0x761DF421, 0x73C0386F, 0x7F1ED7F3, 0x1B2D6270, 0xA446B7FB, 0xFBAEA781, 0x5324FE03, 0x6140E5BE, 39 | 0x6E605FD6, 0x63E2777A, 0xF9448D63, 0x06B08E7D, 0xE27E2865, 0x2A6D651B, 0x82D53902, 0x5D54C0BB, 40 | 0x131CF4F2, 0x8FE40A27, 0x61C5F031, 0xC53CA870, 0x764D8EAA, 0x1A7BEBAC, 0xE7629756, 0x7FB95EF5, 41 | 0x2926DB0B, 0x249625C9, 0x672957E1, 0x648FC3D9, 0x6580AB42, 0xD5C13DA8, 0x677E36E7, 0xCF3855AD, 42 | 0x965C854D, 0x680F92BA, 0x71BB2A5C, 0xA9487B33, 0xE20FD4AA, 0xEE30BB28, 0x362301B6, 0xAD3D8127, 43 | 0x04E1434F, 0xDF0362D9, 0x9010C2D6, 0x1C95F251, 0xEF94DFFC, 0xAFCD1897, 0x7BB72DDA, 0x2FEA1EA4, 44 | 0x787734B9, 0x2B419E0C, 0x675E09F5, 0xDB0705C2, 0x93108EAA, 0xBBA83AF5, 0x166B2EEA, 0x9A668AE2, 45 | 0x0AE317B2, 0xF18E028E, 0x17B51D0D, 0x823B358B, 0x8D7BBD2C, 0x45478AAA, 0x11D76977, 0xA5997C63, 46 | 0x36FA633B, 0x1F46748D, 0x333A5A2D, 0x75804554, 0x5AD3F014, 0xCA7B16A4, 0xDB82A9D8, 0xE5406142, 47 | 0x5B9A4938, 0x99342E52, 0x91B546CF, 0xE1BB7B0A, 0x0DC41CDA, 0xCFF75DDF, 0xAE49B9DF, 0x90CAA015, 48 | 0x8DA7E955, 0xCD2D1201, 0xE71D5271, 0x40A60A3B, 0x6604DE9A, 0x93A53BF4, 0x41EAD9C0, 0x8554FE55, 49 | 0x569E68EA, 0x18D6B679, 0x7A15EE9A, 0x03E13D36, 0xF13A0ED7, 0xE7D0CB80, 0xBB257E96, 0x2DD0778F, 50 | 0x52C118BC, 0x60A8A928, 0x6513C388, 0xFDD3C952, 0x43B655E4, 0xE96E16FC, 0xAFEDC27E, 0x8118FA64, 51 | 0x9DE30645, 0x9E446723, 0xF3C81507, 0xB0BB8C0C, 0xEC939BFB, 0x2CF79072, 0x41EC17FC, 0x42523C4A, 52 | 0x782B104F, 0xEBC20305, 0xEA203919, 0xAE34BD08, 0x8FED7491, 0x1875623E, 0xBCC819F9, 0xA8F7E222, 53 | 0x27732E82, 0x8C4A884E, 0xF8153F16, 0x8C79267C, 0x04F2E6E2, 0xC37E3D93, 0xEF7DFF36, 0x20A89863, 54 | 0xDD3BD377, 0xEE8BD795, 0x9812AA0B, 0x01AAFAE8, 0xC07DFEEC, 0xE768C8D9, 0xD39D8FD1, 0xDACD6A7B, 55 | 0x4A11A699, 0xC4AE00A0, 0x212E758E, 0x098E2DBF, 0x638B0FBF, 0x07C67619, 0x19A2E559, 0xD9DEAE07, 56 | 0x09C5F399, 0x995C45DB, 0x7100C055, 0xDFBD0D39, 0x79C280BA, 0x2B73F0A1, 0x1E37AADF, 0x3D56A928, 57 | 0xF5E0C23E, 0xCCDE803F, 0x8FD22603, 0xBF8B8DDB, 0x764CC521, 0x8613045B, 0xBBA8C82B, 0xDADE0825, 58 | 0x69F296EA, 0x7330DCF9, 0x54BEA654, 0x4F82C85F, 0xAF118FC6, 0x803D2FF7, 0x5839EACD, 0xD6D56785, 59 | 0x0E978F3D, 0x5F93270B, 0x5E6CCF83, 0xE3CF584D, 0x28050197, 0x2266E77A, 0x52CD5AE6, 0x37E447AB, 60 | 0x3C6522EF, 0x8875164B, 0x6CA50FAC, 0xDF679B7F, 0xDC699E93, 0xB0F752BA, 0x9E29D3FD, 0x69F9ED01, 61 | 0x8FAC72EE, 0x34C4AE8A, 0xEF87D917, 0x60DD6E99, 0x1E975DA9, 0x29CF5F3E, 0xC3440DCB, 0xF3CDB7F9, 62 | 0xFD082291, 0xF2CBD415, 0x5DEA0745, 0x277614CB, 0xCD0EEE29, 0xB0FE0BAA, 0x6890DD86, 0x2ABE8137, 63 | 0xF2E71FC5, 0xF9C89BDA, 0xD1538BA1, 0x5A92E234, 0xD7F7B3EC, 0x93884C8F, 0x212883E5, 0x2DF1EB7E, 64 | 0x8B8AF00E, 0x480DBC10, 0x4AA8B942, 0xC51BFDCD, 0xB527BA4A, 0x91392548, 0xC23951B7, 0x83045C59, 65 | 0x4A4A1CB7, 0x8690E976, 0xB1DFA977, 0x887008B8, 0xDB481254, 0x1059A7F9, 0x0EDBA8C4, 0xD452C545, 66 | 0x775B6874, 0x16CA672A, 0xBED50820, 0x3629E7A9, 0xD5D82E64, 0x4A9EC84D, 0x74EC3129, 0xF7226C40, 67 | 0x68DD2359, 0x8E7801F7, 0xFDFEDF7B, 0x1C0444D3, 0x294CF183, 0x08AAF377, 0xCCBEB045, 0x95FFD30D, 68 | 0x918BF218, 0x228B23DD, 0x396A3645, 0x4DC102DD, 0xE80E1642, 0x728903DE, 0x9062C008, 0x7D5C0282, 69 | 0x994752EE, 0x9285A628, 0x1A359D3A, 0x907953A6, 0x15FABC8B, 0xD214EF9A, 0x79F2440B, 0x84A559C7, 70 | 0xB002B2A8, 0xD30ED860, 0x769C2BC5, 0xA654B263, 0x4861F9F6, 0xD48D1E3E, 0x374B9D6B, 0xAA38A9C9, 71 | 0x7D627B70, 0x0A4EE354, 0x6F7B9D58, 0xCE4B0716, 0x9455C5FD, 0x48C3164A, 0xD78ECB0C, 0x38274DB1, 72 | 0xF2A09069, 0x6B34AA5F, 0xFE27FD47, 0x79BB830A, 0x10FEBA4B, 0xED1A3776, 0xF2420051, 0x7FD45D2A, 73 | 0xE0B460A3, 0xA52D8642, 0xB906C287, 0x496F8FA1, 0x52BF74A2, 0x3DB2DFF4, 0xCB13815A, 0x5CCC27D4, 74 | 0x215F7D2B, 0x853A8682, 0xB65FDC8B, 0x5D02D031, 0x1C269768, 0x7ED0571B, 0x4ADCA875, 0x4E2A3A9D, 75 | 0x311C07C7, 0xA87EF0AC, 0xB710AA27, 0x28B31BBE, 0x02F6D2DC, 0x14744F5B, 0x19CB5118, 0xD125B0E0, 76 | 0xD26D22D9, 0x102B2FA3, 0x03FB971F, 0xB6F7FD94, 0xE5CBECD5, 0xFD82DF57, 0xFD58DD36, 0x9D2BA508, 77 | 0xCA8B3E36, 0x2E2E7DC5, 0x59C82A33, 0x882B3E73, 0xB03213AB, 0x15A04934, 0x43C2E8CF, 0xB6B2DEB8, 78 | 0x49F59F0E, 0x20D17DBE, 0xB2451C97, 0x6EC30101, 0x47DAAE6C, 0xA56E21E2, 0x5C8863CE, 0x6249012A, 79 | 0x9C0FAA71, 0xB4604791, 0x11E12F8F, 0xB3CC3E9E, 0x26F0FD74, 0xA1AC1D2C, 0x23474E65, 0xD8F82FA5, 80 | 0xB6AEC9E3, 0xC57CCA3E, 0xE9B082CA, 0xC60279BC, 0x2C681CFB, 0x92BE9087, 0xB9F590EE, 0x819CADF7, 81 | 0xBCE1C6D1, 0xF8D65B6E, 0xFBBF47EB, 0xB3C3C4F1, 0xDF069B7A, 0x0DF302AC, 0x58220D54, 0x97EF72E0, 82 | 0xEA98A5B5, 0x6DC57FC9, 0xB058F59F, 0x86D4EE95, 0xB09C8F97, 0x79EC704C, 0x1424B9F1, 0xCB087157, 83 | 0x21704C1E, 0x7D2280E9, 0xDDBFFD86, 0x3617B403, 0x351001F9, 0xC5DFFC55, 0x4BE45822, 0x94B3C00A, 84 | 0x99D9CE9A, 0x86BDF49F, 0x2478168E, 0x83335088, 0x7F129122, 0xC07B879B, 0xA4ADAB31, 0xDDF9DB57, 85 | 0x51D4DC2A, 0xFB839911, 0x41FCF547, 0x7219DF1E, 0xF1B3163F, 0xA1FF3815, 0x309A0798, 0xC0B6D615, 86 | 0xF5AD086C, 0x3A4D3337, 0x462641AF, 0xF1CF5DC0, 0x92101B20, 0x0697C5F8, 0xB6705CDA, 0xAB980E16, 87 | 0x81D97D3B, 0x8BF0AA8B, 0x864A6464, 0x5124C4A6, 0xD4E3DDB1, 0xB2BE7389, 0x1BE0B80C, 0x749D2066, 88 | 0xEC3AAFC8, 0xA0A4E025, 0x9A5B1D3E, 0x2E1DD29C, 0x67403949, 0x1B9E89EC, 0xBDCC1489, 0xC32DA771, 89 | 0x96639DE4, 0x91AB30B6, 0x234C2662, 0xC59B915A, 0xB917E771, 0x6CD070C1, 0xD46C9C89, 0x46CF53C3, 90 | 0x05121265, 0x38CF872E, 0x34BE9CAF, 0x326DF5A1, 0xA89AD25B, 0x760AED28, 0x6A96027B, 0xB066C0FE, 91 | 0x93C2BF79, 0x4ED8AA52, 0xAA4C02F5, 0xA893289C, 0xC431F842, 0xB760F9C8, 0x62C0AED8, 0xFCB82E45, 92 | 0xE917E340, 0x6F7A4254, 0x13977A89, 0x11630D7C, 0x6CAC9ECC, 0x3581ED3E, 0x79898EBB, 0x7346DCD1, 93 | 0x99FAFB64, 0x7205393D, 0x00F37752, 0x226D6CAA, 0xE2F08622, 0x4B9327FE, 0xEB1FF359, 0x196AEDA4, 94 | 0xC23ED36F, 0xD97E4567, 0x925A3E4E, 0x47B72F21, 0x95CFEAC9, 0xB0A39407, 0x50E39F06, 0x05C4DF49, 95 | 0x1DDBCAFF, 0x335E998C, 0xE534B91B, 0x0FDB8612, 0x3B2F5E79, 0xA38F0FFD, 0x2BD29B7B, 0xF0BB9E2D, 96 | 0x944E0D2D, 0xF934421B, 0x87E324FF, 0x4983A27F, 0xB097DBF6, 0xAC2C545A, 0xC95C881F, 0xA260E679, 97 | 0xAA88F859, 0xD7ACA9DE, 0x57858981, 0xFC6D0C1E, 0xC4AA18FE, 0xEED10F7B, 0xE55AEDD5, 0x3569DCFB, 98 | 0xDC5ACAE8, 0x774A830F, 0x0A604AAA, 0x6FC351B1, 0xCC20EDAA, 0xD20CBD01, 0x8C4CFC88, 0x84041AD4, 99 | 0x756E31C5, 0x0323FFA1, 0x8AD42FB7, 0x9012FBAE, 0xC84FB322, 0x7903D6A2, 0x3A3B6E13, 0xA454A5B0, 100 | 0xC36ED34A, 0x06A0D689, 0x03C66185, 0x841694E0, 0xEC3F052C, 0x02EECB31, 0x830446A8, 0x8E342B2F, 101 | 0x39E50DF0, 0x60D527E2, 0xFADD881E, 0xA118AFB9, 0x1E67EBDA, 0xB694EEE7, 0x5C7653DA, 0x420F9986, 102 | 0x5D1CEFA6, 0x30CC1419, 0x5D9431DE, 0x00ABA1D9, 0x24459396, 0xD1301707, 0x985B928C, 0x778EE66F, 103 | 0x1120BA99, 0xCCFDF154, 0xA7CF7003, 0xE724DA93, 0xFA24BBD9, 0x87ECA4FD, 0xD9F6E331, 0x3C001746, 104 | 0x7D8FE048, 0xA98D84DF, 0x239C45D4, 0xF5042CD7, 0x43AFD301, 0x8DB6D50D, 0xF1C8A9FE, 0x32EB5C96, 105 | 0xE4F870B1, 0x2A876CB6, 0x65B19401, 0xBCE16733, 0x7271A7A0, 0x76933C51, 0xF05F9772, 0xA5E5E661, 106 | 0x499147A6, 0xCD1F3CCA, 0x69E190D1, 0xFA3E5934, 0x4C47F1E0, 0xEF6569A1, 0xB40CD6C0, 0x3F3C605B, 107 | 0x4847FDC7, 0x9F9902E7, 0xE128D6EC, 0x86F9381A, 0xE4298DA8, 0x1B248AE3, 0xEA0E9267, 0x646A6561, 108 | 0x7EBD4B01, 0x54E95440, 0xD16B9723, 0x60BF33CB, 0x3091FC26, 0x7D0F41BF, 0x73E7842E, 0x5665CAD0, 109 | 0x0921C404, 0x611727FD, 0x7D803BB0, 0x90B103EA, 0xBED442DE, 0xD9F399F0, 0x1E8480E1, 0x4ABAA9F4, 110 | 0xD57DEAAA, 0x4722141B, 0x4BBA8913, 0x483C006A, 0xAC39E78C, 0xB0420284, 0xDEFB89F3, 0xD60BF38F, 111 | 0x0AB773BB, 0xF3EA5D65, 0x0F293175, 0x6D328919, 0x286CA388, 0x27AC9DFB, 0x5D09A63D, 0xD6C7FCBE, 112 | 0xC161E550, 0xEC762D8E, 0x4CBAC18C, 0x08319F3F, 0x1AE583E7, 0xD9ACE47A, 0xB67A2FC3, 0xA6D8AC7D, 113 | 0xC9BF1402, 0x17548DE0, 0xFEE657BA, 0x4F0D9386, 0x63170829, 0xA014509C, 0xD8C49477, 0x2FB4A00E, 114 | 0x5E65BFD2, 0x3178400F, 0xC21C1D9D, 0xE524C2ED, 0x16FE34F4, 0x89F3FE49, 0x301CED69, 0xDB803EDD, 115 | 0x7E7B8E07, 0x9B680E4A, 0xE637AF76, 0xED413458, 0xC9E0FFB3, 0xE89FCE8B, 0x6EB330E6, 0x501165B9, 116 | 0xDCB7767E, 0xF06DE78D, 0x96A80D43, 0x2C9F6A9D, 0x5D47ECA2, 0x367CB3C8, 0x4CA6650B, 0x1C2A00B3, 117 | 0x7AA1B7DD, 0xE8A5C939, 0xF99ABE69, 0xD4976B34, 0xCCAD5106, 0xFA7A1429, 0x3CD2F71B, 0x90F702A1, 118 | 0x9E64E442, 0x4B35367F, 0xC3AFA55B, 0xD2776A95, 0x0C92593D, 0xE4C720AE, 0x29B67F02, 0xF650AD6F, 119 | 0x2F3CEBAC, 0x0CF3FA66, 0x435372BA, 0xC7DEE9ED, 0xE7FCADBA, 0x7EC9BAEC, 0x0C3F0443, 0x23FE0633, 120 | 0x407BB6E6, 0x63BC5E4E, 0x6D8A5C67, 0x81F3657D, 0xF93A96D6, 0xFCE518EC, 0x5E146EC4, 0xD3DB846A, 121 | 0xDD0F56DC, 0x1E69CCB4, 0x2420C59D, 0xBD15D809, 0x081BEF0F, 0x557F94D6, 0x67117A82, 0xD840F03F, 122 | 0x7B9D971C, 0x3597EA24, 0x36941F60, 0xA07292FE, 0x33792DB3, 0xFC388DDF, 0x7E09FC9F, 0x079B6733, 123 | 0x24202F2A, 0x0B41E678, 0x0E220461, 0xEDF91C00, 0x1F492802, 0x103F625F, 0x6140C8A1, 0x87958BDF, 124 | 0x8121FFD5, 0x7F32AF0A, 0x265EC377, 0x25FA1765, 0x26AA571A, 0x4BF1291C, 0xBBEC93B7, 0x06C84CCA, 125 | 0x6154CDA8, 0x5EF2656F, 0x89FE4E40, 0xB4C81611, 0x513270DA, 0x9B5EB0EF, 0x4C9B3ED6, 0x6D73E44A, 126 | 0xA27F4B88, 0x2302B0E5, 0xB71E4081, 0xCCCB168B, 0xFF268CDB, 0xBB63BF89, 0xDECA98AB, 0xD74BB4E6, 127 | 0x03EC111E, 0xAABE27CA, 0xC3C76EF4, 0xC120317A, 0xD6EF43B5, 0x66B2550C, 0xE4E13618, 0xEE128231, 128 | 0x99C348AD, 0x4C7488E3, 0x37D20028, 0x7DC578BE, 0x3C611752, 0x815664A0, 0x11AA418F, 0x9BFAEB3C, 129 | 0xF49AA4E1, 0xB517ACF9, 0xE7FA2376, 0x39214EB8, 0xE0B2BA92, 0x4B38EB6C, 0xBA190BDD, 0x804025ED, 130 | 0x2AE74547, 0xEA941AEB, 0x64A42E79, 0xFA96F9FF, 0xC23BEAB3, 0xF9113C32, 0x95435FA7, 0x25D31DC5, 131 | 0xA4226148, 0x0156B563, 0xC3796DF4, 0xFB0D8F8E, 0xCB89FF72, 0x9AC67FC9, 0x5577D742, 0xFC7DEB1E, 132 | 0x99CAC841, 0x406A0CF0, 0x33CFEE0A, 0x4F506512, 0x8B21C5C6, 0x70DEC029, 0x913EA118, 0x108E9534, 133 | 0x4A787350, 0xF83D1B3F, 0x88FDF71B, 0x48DC6A16, 0x48D22832, 0x6D017ADD, 0x03851FEB, 0x968DDFF7, 134 | 0x7C2B6BFC, 0xF513A22F, 0x1C2FE968, 0x2B7AF74B, 0x76380917, 0x80FD2CB1, 0x48F41783, 0x3965913B, 135 | 0x9FDC9614, 0xBBE9F70B, 0x144C8F43, 0xF2415C38, 0xD6560937, 0x6C54F83B, 0x37AD5CC3, 0x71A78D34, 136 | 0x90700069, 0xE15F6D6D, 0xA9AE29FD, 0x5B76E848, 0xF95406A9, 0xA4E9A7FE, 0x479CBB33, 0x63BA6FFA, 137 | 0xD4719C5B, 0x0491EA7B, 0xF8C3F742, 0x3937FE98, 0x0B9B5D9E, 0x5212E2DE, 0xABA45754, 0xE32E8F89, 138 | 0x6364BA06, 0x39C613F5, 0xFC85B994, 0x94319028, 0x2552E0EF, 0x36691520, 0x711D5F06, 0x913D2A9C, 139 | 0x36D85327, 0x3E1DDF69, 0x131A5EBE, 0x8EEC7285, 0xBBB41231, 0xCA974F61, 0x8A59D3E9, 0x103BEBDC, 140 | 0x4FD58975, 0x6996409C, 0x5A8719E0, 0x6A00D9D5, 0xF091E7A9, 0x70A98201, 0xCFBAC62A, 0xAD64E599, 141 | 0xAD75A1E3, 0xEE29F7E3, 0xB0165686, 0x880F7A1D, 0x60C199DA, 0xE119E154, 0x43573FCF, 0x545688A7 142 | }}; 143 | 144 | static unsigned char iv[8] = { 0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3 }; 145 | 146 | int main(int argc, char *argv[]) 147 | { 148 | size_t length; 149 | unsigned char *base; 150 | unsigned char out[0x3000-0xff0]; 151 | unsigned char thisiv[8]; 152 | ssize_t r; 153 | int enc; 154 | int out_fd = STDOUT_FILENO; 155 | 156 | if ((argc >= 3) && (strcmp(argv[1], "-e") == 0)) 157 | enc = 1; 158 | else if ((argc >= 3) && (strcmp(argv[1], "-d") == 0)) 159 | enc = 0; 160 | else 161 | { 162 | fprintf(stderr, "usage: %s {-e|-d} file [outfile]\n", argv[0]); 163 | return 1; 164 | } 165 | 166 | base = (unsigned char *)mmapfile(argv[2], PROT_READ, MAP_SHARED, &length); 167 | if (base == MAP_FAILED) 168 | { 169 | perror("mmapfile"); 170 | return 1; 171 | } 172 | 173 | if (argc >= 4) 174 | { 175 | out_fd = open(argv[3], O_WRONLY|O_CREAT, 0666); 176 | if (out_fd == -1) 177 | { 178 | perror("Could not open output file"); 179 | return 1; 180 | } 181 | } 182 | 183 | memcpy(thisiv, iv, 8); 184 | BF_cbc_encrypt(base, out, 0x200, &key, thisiv, enc); 185 | r = write(out_fd, out, 0x200); 186 | r += write(out_fd, base+0x200, 0xff0-0x200); 187 | memcpy(thisiv, iv, 8); 188 | BF_cbc_encrypt(base+0xff0, out, 0x3000-0xff0, &key, thisiv, enc); 189 | r += write(out_fd, out, 0x3000-0xff0); 190 | r += write(out_fd, base+0x3000, length-0x3000); 191 | munmap(base, length); 192 | close(out_fd); 193 | return (r!=length); 194 | } 195 | --------------------------------------------------------------------------------