Replicant

h1. BroadcomVideoCore

h2. Devices

The Raspberry PI don't use code signature, but smartphones using the same SOC may have it enabled.

h2. IRC Logs to sort

<pre>

03:00 < clever> ive also cracked the signing keys on the rpi4 fully, and now know how they get generated

03:01 < clever> so i could (in theory) re-extract them from another broadcom product in the future, with less effort

[...]

03:01 < clever> assuming i get execute on the VPU somehow

[...]

03:03 < clever> basically, there is 20 bytes of "salt" in the mask rom, which gets combined with 16 bytes from the OTP, to create the real 20byte hmac-sha1 

                key

03:04 < clever> you need to understand how .data gets copied from rom->ram (since its an XIP rom), and then find the code that merges the 2, to know what 

                offset in ram to read

[...]

03:08 < clever> GNUtoo: but, ive also heard that the 2nd revision of the mask rom, has proper pub/priv RSA support

03:08 < clever> if they choose to turn that on, we are screwed

[...]

03:15 < clever> all of the broadcom chips in the pi's, have ~60 OTP registers, each 32 bits wide

[...]

03:16 < clever> got a total of ~268 bytes of OTP

03:16 < clever> for*

[...]

< clever> GNUtoo: i do also have some new info on the rpi4 mask rom boot order, that you might 

                want in the wiki

03:19 < clever> GNUtoo: the rpi4, can boot from 3 places, in this order: #1 recovery.bin on the SD card, 

                #2 a tagged blob in SPI flash, #3 usb-device boot

03:19 < clever> GNUtoo: but, you can use OTP to configure any gpio pin, to disable #1 or #2 (and you can 

                set 2 pins, one for each)

[...]

03:22 < clever> 2020-02-21 16:25:14 < clever> for extra confusion, there are 2 sets of numbers for each SoC

03:22 < clever> 2020-02-21 16:27:12 < clever> ali1234: 2838 and 2711 are both rpi4

03:22 < clever> 2020-02-21 16:27:47 < clever> ali1234: 2835 and 2708 are rpi1, i think

03:22 < clever> so the rpi4 is called both bcm2838 and bcm2711

03:22 < clever> i think one is for the base model, and then the other for this specific implementation of the silicon and package

</pre>