Simple tool for viewing of Bada firmware
- Thread starter ho1od
- Start date
TriX generate valid checksum
btw, that hash is just md5 aligned to 64 bytes, that's all
http://xdaforums.com/showpost.php?p=10506092&postcount=38
Code:
// generate md5 hash, remaining bytes needs to be zeroed
crypto_generate_md5 ( dst->data, ALIGN_BY ( src->length, 0x40 ), md5 );
Last edited:
I just now tested and can confirm that files extracted by trix can't be signed with your app. It used to be stuck at save running and never showed the popup box saying "File is signed". But when I extracted and recompiled usin gyour software, it worked! Thanks a lot for the software
I feel this tool is more easier than trix. Hope you implement csc, amss and rc2 features as soon as possible.
You are saying that we would be able to modify amms file??
not modify, extract only ELF files
RC1 is folder System on Wave... see here:
http://xdaforums.com/showpost.php?p=12532416&postcount=14
If you need study decompressed RC1... download language packs from bada SDK.
http://xdaforums.com/showpost.php?p=11169144&postcount=10
Best Regards
http://xdaforums.com/showpost.php?p=12532416&postcount=14
If you need study decompressed RC1... download language packs from bada SDK.
http://xdaforums.com/showpost.php?p=11169144&postcount=10
Best Regards
http://developer.bada.com/apis/docs/commonpage.do?menu=MC01041000
For RC1 study look into these Language packs... you will find:
Rsrc_bada_S8500.rc1.org
and
CSC.rcs.org (first 7 MB of CSC file) in Win32_Bin.img
Both are compressed via QMD... IMRC was older Algo... for instance in XXJB6...
Best Regards
For RC1 study look into these Language packs... you will find:
Rsrc_bada_S8500.rc1.org
and
CSC.rcs.org (first 7 MB of CSC file) in Win32_Bin.img
Both are compressed via QMD... IMRC was older Algo... for instance in XXJB6...
Best Regards
You can only change the modem name right now in amss.bin using trix. Use the change_modem_name.trx script.Wich version? wich script?
a bit OT but...
yes indeed, for now only simple change modem name script for amss is done but what for do you want to modify amss? If you've some idea just analyze code and patch it - just like that simple script did
yes indeed, for now only simple change modem name script for amss is done but what for do you want to modify amss? If you've some idea just analyze code and patch it - just like that simple script did
Hi ho1od, when change the primary image on RC2 and save the file at "Debug0 or 1 or 2" i have this error:
Error:
If i clic continue, the Wave Remaker create a RC2 file with 132kb dimension.
Why? The file is BMP 24bpp
Error:
Code:
Unhandled exception has occurred in your application. If you click Continue, the application will ignore this error and attempt to continue. If you clock Quit, the application will close immediately.
The format of the specified path is not supported.If i clic continue, the Wave Remaker create a RC2 file with 132kb dimension.
Why? The file is BMP 24bpp
Last edited:
Hello Ho1od.
Thanks for this wonderful tool. It's easy to use. Simplier than Trix.
Please can you rectify the error of all files being saved as .pfs by default?
Example, if you save "ShpApp.app" it comes out as ShpApp.pfs.
Same with when you save xxxx.ffs file, it comes out as xxxx.pfs.
Thanks and kudos to your hardwork.
Thanks for this wonderful tool. It's easy to use. Simplier than Trix.
Please can you rectify the error of all files being saved as .pfs by default?
Example, if you save "ShpApp.app" it comes out as ShpApp.pfs.
Same with when you save xxxx.ffs file, it comes out as xxxx.pfs.
Thanks and kudos to your hardwork.
Last edited:
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
12bada 2.0 has enabled signature checking. as we know last 0x10 bytes of encrypted data are stored in footer at offset 0x198. Next 0x40 bytes is rsa signature taken from sha1 hash of 0x160 bytes (in footer 0x48-0x1A7).
No chance to generate valid signature but we can reverse this pattern and modify encrypted data to pass rsa1 signature check
3 things needs to be done to pass BL security:
1. rsa signature needs to be valid (in footer)
2. last 0x10 bytes of encrypted data must be equal to 0x10 bytes at footer offset 0x198
3. last 0x10 bytes of decrypted data must be equal to 0x10 bytes of seed key (FF FF FF FF ...)
attached routines does that - encrypted apps pass BL security checks and we can download it to phone with no problems. We lose 0x10 bytes of nand apps space but who cares?
regards,
Bartek
