[Octopus]

Hello, everybody!
At the last time there was a lot noob news about loading TB lv2_kernel in IDA and what it really does, so I really wanted take a look at this by myself
This thing is really small, and took a few minutes for rce the "salt" of it. I spend more time writing some scripts for it

This is my clean idb http://rghost.ru/37617670
(I dont share my idb with comments, because its mostly Russian comments :D )

How you can see it uses some ofbusctaion, unconditionally branches, complex of instructions mtctr and bctrl.
When you will start reversing sub_80000000007F1114, the first thing what you will see that there is some condition of execution sub_80000000007F0F10.
Let's look this function, allocating a buffers already a good sign) You look subfunctions and see some crypt) sub_80000000007F0B1C is Tiny Encryption Algorithm

void decrypt (uint32_t* v, uint32_t* k) {
    uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i;       /* set up */
    uint32_t delta=0x9e3779b9;                          /* a key schedule constant */
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];        /* cache key */
    for (i=0; i<32; i++) {                              /* basic cycle start */
        v1 -= ((v0<<4) + k2) ^ (v0 + sum) ^ ((v0>>5) + k3);
        v0 -= ((v1<<4) + k0) ^ (v1 + sum) ^ ((v1>>5) + k1);
        sum -= delta;                                   
    }                                                   /* end cycle */
    v[0]=v0; v[1]=v1;
}

r4 - is a key. Tracing it, and wuala decryption key at the adress 800000000035E104.
Look next. I think it dont needs comments )

malloc
memcpy
free
free

Closely look what happens between last two. Do you see it? ))

mtctr     r30
bctrl

There where magic happens) It jumps inside decrypted code)
After this code executed its free a buffer, look back at sub_80000000007F1114, memcpy original code with mounting dev_flash, and jumps to lv2_kernel.self.

TB made really similar to malware.
Now we know that lv2_kernel is Payload Loader, we know where is a key, we know where is Payload)

I dont have TrueBlue so at this point its all what I can done

My Twitter: https://twitter.com/oct0xor
Greetings to my friend and great dev flatz: https://twitter.com/flat_z

UPDATE:

Today I take a look at lv2_kernel's from section 0 of dongle and from TB CFW v2. The first one do the same what lv2_kernel.bin, but for 3.41. Never heard about TB work with 3.41 so they took away this feature. But payload is there, you can see it in updates.
In TB CFW v2 they change decryption key. The new key is 0x10 from 800000000035E104 xored with 67 EE E4 B3 6D DE EC 0E 70 08 8E F6 D2 D4 97 CC. TB CFW v2 is not much more secured xD

[hellsing9]

good finding @Octopus keeps us posted

[mcmrc1]

sounds interessting :D thx for your work @Octopus and you friend wrote
"I am successfully decrypted the second part of eid0 " i know that i understand nothing from the dev things but sounds interessting too :D
and "a nice piece of garbage which zadow28 contributed to the scene lol))" is also funny :D

[Gonzakpo]

Thank you for sharing your findings!

[H3avyRa1n]

at last something new, I'm sick of whinning threads...

[Dolenc]

Do you see the irony in your post

[mirkie]

Thank you for your input! I have a TB dongle. If you can tell me what to do I will give it a try.

[landon]

Hope this will help us !! Thank you Octopus

[Octopus]

Well, now I look and see my post looks very "technical". If you dont understand anything, this what I did: Got 3.55 TB CFW, fully reverse payload in it, understand what it do. Payload from CFW decrypt real payload from dongle. I reversed where it's in the memory, I reversed where the key , I reversed algo. I gave it all to you

[derako]

Originally Posted by Octopus Well, now I look and see my post looks very "technical". If you dont understand anything, this what I did: Got 3.55 TB CFW, fully reverse payload in it, understand what it do. Payload from CFW decrypt real payload from dongle. I reversed where it's in the memory, I reversed where the key , I reversed algo. I gave it all to you

weren't the tb and cobra payloads already released?

Anyway, thanks for your work