The decryption function
If you are just joining this story you may want to start at part 1.
In part 2, we discovered that a embedded controller update is performed by uploading a small ‘flasher’ program to the EC. This flasher program is then responsible for programming a new firmware image to the EC’s internal flash memory. However, both the flasher program and part of the firmware image are encrypted: the old (currently running) EC firmware decrypts the flasher program, and the flasher program then decrypts the new firmware update. This creates a bit of a chicken-and-egg problem that prevents discovering the encryption algorithm from firmware update files alone. Continue reading

BETA
Welcome to the newly redesigned zmatt.net. I seem to only get around to upgrading my personal website once every decade so this is a special day indeed. The biggest change is that I now have a blog here (powered by WordPress). I used to blog on LiveJournal but I was seduced by short attention span media like Facebook, I’m trying to restart the blogging habit.