├── .gitignore ├── CITATION.cff ├── LICENSE ├── README.md ├── images ├── fido2.png ├── keystore.png ├── poc.png ├── poc_rsa.png ├── poc_s9.png ├── salt.png ├── secure_key_import.png ├── teegris_key_wrap.png ├── teegris_keymaster_api.png ├── trustzone_hw.png ├── tz_unwrap_graph.png ├── tz_wrap_graph.png └── xor.png ├── jni ├── Android.mk ├── Application.mk ├── config.h ├── core │ ├── attack.c │ ├── attack.h │ ├── file_utils.c │ ├── file_utils.h │ ├── main.c │ ├── skeymaster_api.c │ ├── skeymaster_api.h │ ├── skeymaster_asn1.c │ ├── skeymaster_asn1.h │ ├── skeymaster_commands.c │ ├── skeymaster_commands.h │ ├── skeymaster_crypto.c │ ├── skeymaster_crypto.h │ ├── skeymaster_defs.c │ ├── skeymaster_defs.h │ ├── skeymaster_helper.h │ ├── skeymaster_key_params.c │ ├── skeymaster_key_params.h │ ├── skeymaster_key_request.h │ ├── skeymaster_libs.c │ ├── skeymaster_libs.h │ ├── skeymaster_log.h │ ├── skeymaster_status.h │ ├── skeymaster_utils.c │ └── skeymaster_utils.h ├── keymaster_helper_lib │ └── skeymaster_helper_lib.c └── test │ ├── test.c │ ├── test.h │ ├── test_commands.c │ └── test_utils.c ├── poc ├── downgrade │ ├── README.md │ ├── poc_asn1.py │ ├── poc_attacker.py │ ├── poc_requirements.txt │ ├── poc_s10_secure_key_import.sh │ ├── poc_secure_key_import.md │ ├── poc_server.py │ └── rsa-4096-private-key.p8 └── iv_reuse │ ├── README.md │ ├── key_1_4096.der │ ├── key_2_4096.der │ ├── poc.sh │ ├── poc_rsa.sh │ └── poc_s9.sh └── writeup.md /.gitignore: -------------------------------------------------------------------------------- 1 | obj/ 2 | libs/ 3 | -------------------------------------------------------------------------------- /CITATION.cff: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/CITATION.cff -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/LICENSE -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/README.md -------------------------------------------------------------------------------- /images/fido2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/fido2.png -------------------------------------------------------------------------------- /images/keystore.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/keystore.png -------------------------------------------------------------------------------- /images/poc.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/poc.png -------------------------------------------------------------------------------- /images/poc_rsa.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/poc_rsa.png -------------------------------------------------------------------------------- /images/poc_s9.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/poc_s9.png -------------------------------------------------------------------------------- /images/salt.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/salt.png -------------------------------------------------------------------------------- /images/secure_key_import.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/secure_key_import.png -------------------------------------------------------------------------------- /images/teegris_key_wrap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/teegris_key_wrap.png -------------------------------------------------------------------------------- /images/teegris_keymaster_api.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/teegris_keymaster_api.png -------------------------------------------------------------------------------- /images/trustzone_hw.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/trustzone_hw.png -------------------------------------------------------------------------------- /images/tz_unwrap_graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/tz_unwrap_graph.png -------------------------------------------------------------------------------- /images/tz_wrap_graph.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/tz_wrap_graph.png -------------------------------------------------------------------------------- /images/xor.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/images/xor.png -------------------------------------------------------------------------------- /jni/Android.mk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/Android.mk -------------------------------------------------------------------------------- /jni/Application.mk: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/Application.mk -------------------------------------------------------------------------------- /jni/config.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/config.h -------------------------------------------------------------------------------- /jni/core/attack.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/attack.c -------------------------------------------------------------------------------- /jni/core/attack.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/attack.h -------------------------------------------------------------------------------- /jni/core/file_utils.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/file_utils.c -------------------------------------------------------------------------------- /jni/core/file_utils.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/file_utils.h -------------------------------------------------------------------------------- /jni/core/main.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/main.c -------------------------------------------------------------------------------- /jni/core/skeymaster_api.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_api.c -------------------------------------------------------------------------------- /jni/core/skeymaster_api.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_api.h -------------------------------------------------------------------------------- /jni/core/skeymaster_asn1.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_asn1.c -------------------------------------------------------------------------------- /jni/core/skeymaster_asn1.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_asn1.h -------------------------------------------------------------------------------- /jni/core/skeymaster_commands.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_commands.c -------------------------------------------------------------------------------- /jni/core/skeymaster_commands.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_commands.h -------------------------------------------------------------------------------- /jni/core/skeymaster_crypto.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_crypto.c -------------------------------------------------------------------------------- /jni/core/skeymaster_crypto.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_crypto.h -------------------------------------------------------------------------------- /jni/core/skeymaster_defs.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_defs.c -------------------------------------------------------------------------------- /jni/core/skeymaster_defs.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_defs.h -------------------------------------------------------------------------------- /jni/core/skeymaster_helper.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_helper.h -------------------------------------------------------------------------------- /jni/core/skeymaster_key_params.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_key_params.c -------------------------------------------------------------------------------- /jni/core/skeymaster_key_params.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_key_params.h -------------------------------------------------------------------------------- /jni/core/skeymaster_key_request.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_key_request.h -------------------------------------------------------------------------------- /jni/core/skeymaster_libs.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_libs.c -------------------------------------------------------------------------------- /jni/core/skeymaster_libs.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_libs.h -------------------------------------------------------------------------------- /jni/core/skeymaster_log.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_log.h -------------------------------------------------------------------------------- /jni/core/skeymaster_status.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_status.h -------------------------------------------------------------------------------- /jni/core/skeymaster_utils.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_utils.c -------------------------------------------------------------------------------- /jni/core/skeymaster_utils.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/core/skeymaster_utils.h -------------------------------------------------------------------------------- /jni/keymaster_helper_lib/skeymaster_helper_lib.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/keymaster_helper_lib/skeymaster_helper_lib.c -------------------------------------------------------------------------------- /jni/test/test.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/test/test.c -------------------------------------------------------------------------------- /jni/test/test.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/test/test.h -------------------------------------------------------------------------------- /jni/test/test_commands.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/test/test_commands.c -------------------------------------------------------------------------------- /jni/test/test_utils.c: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/jni/test/test_utils.c -------------------------------------------------------------------------------- /poc/downgrade/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/downgrade/README.md -------------------------------------------------------------------------------- /poc/downgrade/poc_asn1.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/downgrade/poc_asn1.py -------------------------------------------------------------------------------- /poc/downgrade/poc_attacker.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/downgrade/poc_attacker.py -------------------------------------------------------------------------------- /poc/downgrade/poc_requirements.txt: -------------------------------------------------------------------------------- 1 | pyasn1 2 | pycryptodome 3 | click 4 | -------------------------------------------------------------------------------- /poc/downgrade/poc_s10_secure_key_import.sh: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/downgrade/poc_s10_secure_key_import.sh -------------------------------------------------------------------------------- /poc/downgrade/poc_secure_key_import.md: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /poc/downgrade/poc_server.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/downgrade/poc_server.py -------------------------------------------------------------------------------- /poc/downgrade/rsa-4096-private-key.p8: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/downgrade/rsa-4096-private-key.p8 -------------------------------------------------------------------------------- /poc/iv_reuse/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/iv_reuse/README.md -------------------------------------------------------------------------------- /poc/iv_reuse/key_1_4096.der: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/iv_reuse/key_1_4096.der -------------------------------------------------------------------------------- /poc/iv_reuse/key_2_4096.der: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/iv_reuse/key_2_4096.der -------------------------------------------------------------------------------- /poc/iv_reuse/poc.sh: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/iv_reuse/poc.sh -------------------------------------------------------------------------------- /poc/iv_reuse/poc_rsa.sh: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/iv_reuse/poc_rsa.sh -------------------------------------------------------------------------------- /poc/iv_reuse/poc_s9.sh: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/poc/iv_reuse/poc_s9.sh -------------------------------------------------------------------------------- /writeup.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/salvogiangri/keybuster/HEAD/writeup.md --------------------------------------------------------------------------------