it's funny how everybody runs around eating offsets and single hashes having no idea how any of this system works so I'm going to give everybody a hint on how to even get started or even point you in the right direction
Content Unlocked
(_create_aes_sbox_128bit) sub_2440 (is where it takes the key and random bytes)
Code:
// the security engine contains multiple keys, this is important
// 0x00000X**_00000000 X = region, ** = key select
// x = 0 should be physical
// x = 1 should be hashed
// x = 2 should be SoC
// x = 3 should be encrypted
sub_2440 is where it takes the key and random bytes of 0x80
sub_23918 is where the signature is generatedPHP Code:
# =============== S U B R O U T I N E =======================================
sub_23918:
mflr r12
bla __savegprlr_24
stdu r1, -0xA0(r1)
mr r29, r6
mr r24, r3
mr r26, r4
mr r31, r5
mr r28, r7
mr r25, r8
cmplwi cr6, r29, 0x2A
bge cr6, loc_2394C
loc_23944: # CODE XREF: sub_23918+3Cj
li r3, 0
b loc_23A08
# ---------------------------------------------------------------------------
loc_2394C: # CODE XREF: sub_23918+28j
addi r11, r29, -0x2A
cmplw cr6, r26, r11
bgt cr6, loc_23944
cmpldi cr6, r28, 0
bne cr6, loc_23968
addis r11, r2, 1
addi r28, r11, 0x5E48
loc_23968: # CODE XREF: sub_23918+44j
li r11, 0
addi r30, r31, 1
li r5, 0x14
mr r4, r25
mr r3, r30
stb r11, 0(r31)
bla memcpy
addi r31, r31, 0x15
subf r11, r26, r29
mr r4, r28
li r5, 0x14
mr r3, r31
addi r29, r29, -0x15
addi r28, r11, -0x2A
bla memcpy
clrldi r27, r28, 32
li r4, 0
addi r3, r31, 0x14
mr r5, r27
bla memset
addi r11, r28, 0x14
li r10, 1
clrldi r9, r11, 32
add r11, r27, r31
clrldi r5, r26, 32
mr r4, r24
addi r3, r11, 0x15
stbx r10, r9, r31
bla memcpy
mr r6, r29
mr r5, r31
li r4, 0x14
mr r3, r25
bl sub_23830
li r6, 0x14
mr r5, r30
mr r4, r29
mr r3, r31
bl sub_23830
li r3, 1
loc_23A08: # CODE XREF: sub_23918+30j
addi r1, r1, 0xA0
ba __restgprlr_24
# End of function sub_23918
// ------------------- Function Prototypes --------------------
int32_t memcpy(int32_t a1, int32_t a2);
int32_t memset(int32_t a1, char a2, int32_t a3);
int32_t sub_23830(int32_t a1, int32_t a2, int32_t a3, int32_t a4);
int32_t sub_23918(int32_t a1, uint32_t a2, char * a3, uint32_t a4, int32_t a5, int32_t a6, int32_t a7);
// --------------------- Global Variables ---------------------
int32_t g1 = -0x7f31b9e2;
// ------------------------ Functions -------------------------
// Address range: 0x23918 - 0x23a10
int32_t sub_23918(int32_t a1, uint32_t a2, char * a3, uint32_t a4, int32_t a5, int32_t a6, int32_t a7) {
int32_t v1 = (int32_t)a3;
int32_t v2 = a5; // r28
if (a4 < 42 || a4 - 42 < a2) {
// 0x23a08
return 0;
}
// 0x23958
if (a5 == 0) {
// 0x23960
v2 = 0x5e48 + (int32_t)&g1;
// branch -> 0x23968
}
int32_t v3 = v1 + (int32_t)"NDg"; // 0x2396c
*a3 = 0;
memcpy(v3, a6);
int32_t v4 = v1 + 21; // 0x23984
int32_t v5 = a4 - 21; // r29
memcpy(v4, v2);
int32_t v6 = 0; // r27
memset(v4 + 20, 0, v6);
*(char *)(a7 + v4) = (char)"NDg";
memcpy(v6 + 21 + v4, a1);
sub_23830(a6, 20, v4, v5);
sub_23830(v4, v5, v3, 20);
// branch -> 0x23a08
// 0x23a08
return (int32_t)"NDg";
}
(_create_aes_sbox_128bit) sub_2440 (is where it takes the key and random bytes)
Code:
# =============== S U B R O U T I N E =======================================
sub_2440:
.set var_C0, -0xC0
.set var_A0, -0xA0
.set var_20, -0x20
.set var_10, -0x10
.set var_8, -8
mflr r12
std r12, -8(r1)
std r31, -0x10(r1)
stdu r1, -0x110(r1)
addis r11, r2, 1
li r4, 0x14
addi r3, r1, 0x50
lwz r11, 0(r11)
stw r11, 0xF0(r1)
bl sub_B488
addis r11, r2, 1
addi r8, r1, 0x50
addi r3, r11, 0x100
li r7, 0
li r6, 0x80 # '€'
addi r5, r1, 0x70
li r4, 0x30 # '0'
bl sub_B428
cmpwi cr6, r3, 0
beq cr6, loc_24F0
li r4, 0x80 # '€'
addi r3, r1, 0x70
bl sub_B480
li r5, 0x10
addi r4, r1, 0x70
addi r3, r1, 0x70
bl sub_B3A8
addis r11, r2, 1
addi r3, r1, 0x70
addi r5, r11, 0x350
addis r11, r2, 1
addi r31, r11, 0x40
mr r4, r31
bl sub_B3E8
cmpwi cr6, r3, 0
mr r3, r31
bne cr6, loc_24E4
li r5, 0x80 # '€'
li r4, 0
bl sub_AD20
b loc_24F0
# ---------------------------------------------------------------------------
loc_24E4:
li r5, 0x10
mr r4, r31
bl sub_B3A8
loc_24F0:
lwz r3, 0xF0(r1)
bl sub_204
addi r1, r1, 0x110
ld r12, -8(r1)
mtlr r12
ld r31, -0x10(r1)
blr
# End of function sub_2440
# ---------------------------------------------------------------------------now will everyone please stop talking bad about each other to each other and just learn how to work together I mean seriously this community is like a bunch of little children who are all like trying to be the smartest idiot I feel like I'm in grade school with all these kids thinking I'm better than you all need to grow up and be adults
if you like my posts and want to see more please plus rep
![[Image: FiHzeWA.jpg]](https://i.imgur.com/FiHzeWA.jpg)
