I wrote test script, it uses existing code of bootloader v5, can you run it on the radio with bootloader v5 and share results?
It expects that the radio has bootloader v5 in the memory, it won't work with other bootloader.
I'm not familiar with openocd, so there is possible mistakes.
Especially, I'm not sure on how to properly execute subroutine and return to the debugger, if it don't works, try to load reg lr 0xFFFFFFF9 before each call.
proc test_aes {} {
# Stack init
reg sp 0x20001738 ;# value taken from bootloader 5 vector table
# Clocks init
write_memory 0x40000008 32 {0x18000085} ;# AES, CRC, UART1, GPIOC, GPIOA clocks enabled
set dev_clk_gate [read_memory 0x40000008 32 1]
echo [format "DEV_CLK_GATE set: 0x%08x." $dev_clk_gate]
# Fill key and iv buffers
write_memory 0x20000000 8 {0xe1 0x6e 0x0d 0x29 0xe0 0xc8 0x34 0x18 0x98 0x7f 0x94 0x33 0xf5 0xff 0x62 0x0e}
write_memory 0x20000010 8 {0x14 0xb7 0xa2 0xbe 0x02 0x23 0xe2 0x59 0xb2 0x06 0x6d 0x88 0x86 0x97 0x7e 0x36}
# call 0x4f0 => AES_Init(1, key, iv);
reg r0 1
reg r1 0x20000000 ;# Address of the key
reg r2 0x20000010 ;# Address of the IV
reg pc 0x4f0
resume
echo "AES_Init(1, key, iv) completed..."
# call 0x254 => AES_KDF(key2);
reg r0 0x20000020 ;# Address for the key2
reg pc 0x254
resume
echo "AES_KDF(key2) completed..."
# Dump 16 bytes from the key2 array
echo "Dump key2:"
# dump_image key2_dump.bin 0x20000020 16
mdw 0x20000020 4
# call 0x4f0 => AES_Init(2, key2, iv);
reg r0 2
reg r1 0x20000020 ;# Address of the key2
reg r2 0x20000010 ;# Address of the IV
reg pc 0x4f0
resume
echo "AES_Init(2, key2, iv) completed..."
# call 0x21c => AES_ProcessBlock128(key, data);
reg r0 0x20000000 ;# Address of the original key
reg r1 0x20000030 ;# Address for the encrypted data
reg pc 0x21c
resume
echo "AES_ProcessBlock128(key, data) completed..."
# Dump 16 bytes from the data array
echo "Dump data:"
# dump_image data_dump.bin 0x20000030 16
mdw 0x20000030 4
dump_image full_dump.bin 0x20000000 64
}
it should write full_dump.bin file, share it with script output.
This file should contains (key, iv, key2, data) vectors. In total 64 bytes.
key2 is KDF result for key 0 and data is AES decrypt result for key data with (key2,iv) key and can be used for encryption testing.
To be clear, here is C code that I wanted to execute:
void testCode() {
SYSCON_DEV_CLK_GATE = AES_CLK_GATE | CRC_CLK_GATE | UART1_CLK_GATE | GPIOC_CLK_GATE | GPIOA_CLK_GATE;
uint8_t key[16] = { 0xe1,0x6e,0x0d,0x29,0xe0,0xc8,0x34,0x18,0x98,0x7f,0x94,0x33,0xf5,0xff,0x62,0x0e }; // key 00
uint8_t iv[16] = { 0x14,0xb7,0xa2,0xbe,0x02,0x23,0xe2,0x59,0xb2,0x06,0x6d,0x88,0x86,0x97,0x7e,0x36 }; // iv 00
AES_Init(1, key, iv); // r0=1;r1=key;r2=iv;bl 0x4f0
uint8_t key2[16];
AES_KDF(key2); // r0=key2;bl 0x254
// *** dump 16 bytes from key2 array ***
AES_Init(2, key2, iv); // r0=2;r1=key2;r2=iv;bl 0x4f0
uint8_t data[16];
AES_ProcessBlock128(key, data); // r0=key;r1=data;bl 0x21c
// ***dump 16 bytes from data array***
}
Home
Help
Search
Login
Register
