4 ms·
Have you looked at any of the files under the N5's /vendor/firmware directory? Specifically, I believe the .bXX and .mdt files are modules that can be runtime-l
by jevinskie 11y ago
Have you looked at any of the files under the N5's /vendor/firmware directory? Specifically, I believe the .bXX and .mdt files are modules that can be runtime-loaded into the secure element. .b00 and .mdt always seem to be some ELF wrapped file. They look to contain X.509 certificates so I'm guessing you can't just ask qseecom to load arbitrary files... without an exploit in the TZ. ;-) /vendor/firmware/discretix/dxhdcp2.b02 is interesting because it has many strings in plaintext and other bytes that seem to disassemble to valid Thumb-2 code. Is TZ code all Thumb or can you mix Thumb and ARM like in regular context?
- laginimaineb 11y agoI've reversed those files in the past as well, and you're correct, they are TrustZone applications (like Widevine, DxDHCP, Keymaster and more). I have a script which can be used to reunite these pieces of code into an ELF file which can be loaded into IDA (more about this in about a month!) Anyway, if you're looking to load arbitrary code into TZ, wait for the next blog post (approx. 2-3 days)!
- jevinskie 11y agoAwesome, thanks!