-rw-rw-r-- 1 apple apple 192794916 Apr 29 2013 exe.img.sec
-rw-rw-r-- 1 apple apple 132 Apr 29 2013 exe.img.sec.cmac
-rw-rw-r-- 1 apple apple 256 Apr 29 2013 exe.img.sec.cs
-rw-rw-r-- 1 apple apple 256 Apr 29 2013 exe.img.sec.vs
-rw-rw-r-- 1 apple apple 3272292 Apr 29 2013 Image.sec
-rw-rw-r-- 1 apple apple 132 Apr 29 2013 Image.sec.cmac
-rw-rw-r-- 1 apple apple 256 Apr 29 2013 Image.sec.cs
-rw-rw-r-- 1 apple apple 256 Apr 29 2013 Image.sec.vs
-rw-rw-r-- 1 apple apple 17 Apr 29 2013 info.txt
-rw-rw-r-- 1 apple apple 7 Apr 29 2013 major_version
-rw-rw-r-- 1 apple apple 6 Apr 29 2013 minor_version
-rw-rw-r-- 1 apple apple 5763492 Apr 29 2013 rootfs.img.sec
-rw-rw-r-- 1 apple apple 132 Apr 29 2013 rootfs.img.sec.cmac
-rw-rw-r-- 1 apple apple 256 Apr 29 2013 rootfs.img.sec.cs
-rw-rw-r-- 1 apple apple 256 Apr 29 2013 rootfs.img.sec.vs
-rw-rw-r-- 1 apple apple 65 Apr 29 2013 validinfo.txt
-rw-rw-r-- 1 apple apple 48 Apr 29 2013 version_info.txtTo decrypt this firmware, we can use the SamyGO Firmware Patcher, which has the
leaked secret key embedded in the tool:
$ ./SamyGO.py decrypt_all ./T-ECPDEUC
SamyGO Firmware Patcher v0.34 (c) 2010-2011 Erdem U. Altinyurt
-=BIG FAT WARNING!=-
You can brick your TV with this tool!
Authors accept no responsibility about ANY DAMAGE on your devices!
project home: http://www.SamyGO.tv
Firmware: T-ECPDEUC v2008.2
AES Encrytped CI+ firmware detected.
Processing file Image.sec
secret key : 3EF6067262CF0C678598BFF22169D1F1EA57C284
Decrypting AES...
Decrypting with XOR Key : T-ECPDEUC
Crypto package found, using fast XOR engine.
Calculated CRC : 0xEF4527E9
CRC Validation passed
Processing file rootfs.img.sec
secret key : 3EF6067262CF0C678598BFF22169D1F1EA57C284
Decrypting AES...
Decrypting with XOR Key : T-ECPDEUC
Crypto package found, using fast XOR engine.
Calculated CRC : 0xCF5DC1D2
CRC Validation passed
Processing file exe.img.sec
secret key : 3EF6067262CF0C678598BFF22169D1F1EA57C284UNDERSTANDING AND EXPLOITING THE APP WORLD 137