NCK generation algorithm: In pseudo code, it looks like this deviceKey = SHA1_hash(norID+chipID) nckKey = custom_hash(norID, chipID, SHA1_hash(NCK), deviceKey) rawSignature = generateSignature(SHA1_hash(So now you can use this algorithm to find exploits to unlock iPhone. I know that it can take a lot of time but there is a real possibility to find the way out. Also I tried to describe you the NCK key signing and verification process in general below. The NOR ID is the hardware chip id burned into the baseband chip of the device. It is actually burned into the chip and the size is 64 bytes for iPhone 3G and 128 bytes for the iPhone 3GS. CHIP IP is the motherboard id. Baseband NCK key signing and verification process: The encryptedSignature is then saved to a protected memory area – the device has been locked. This happens when Apple issues the AT+CLCK=”PN”,1,”NCK” command presumably directly after manufacturing the phone. When testing a network code key, the baseband firmware reads the encryptedSignature, calculates the deviceKey and the nckKey from the entered NCK, decrypts the encryptedSignature with the nckKey using TEA, decrypts it once more with the public RSA key and verifies the signature with the SHA1 hashes of the chipID / norID. Here’s the pseudo code from Dogbert hacker: deviceKey = SHA1_hash(norID+chipID) nckKey = custom_hash(norID, chipID, SHA1_hash(NCK), deviceKey) encryptedSignature = readEncryptedSignature() A correct NCK key can be stored the application processor part of device. When a certain flag is set, the application firmware (iOS) feeds the NCK into the baseband modem during the boot-up. If the decrypted rawSignature passes the check, the baseband unlocks. Bruteforcing the NCK from the SecZone So as you know the NCK code is stored in iPhone baseband memory in the zone which is called SecZone. So the first thing is needed to be done is dumping your NOR memory. When done decrypt it using TEA algorithm (Dogbert’s perl script). There is the algorithm that is used to generate that code. Geohots NCKBF program could do around 100,000 keys/second which would produce a hit in many years, or complete a search in 317 years. But those who don’t know, the Dev Team members have found the NCK to be only of 40 Bits (5 digits) which can theoretically be cracked with a brute force attack.
Posted on: Mon, 14 Jul 2014 18:02:08 +0000
Trending Topics
Recently Viewed Topics
© 2015