‘‘‘
	Tool?to?extract?security?keys?from?the?MBOOT

	That?tool?can?be?used?only?if?you?have?Mstar.Key.Bank?section?in?the?mboot
	To?check?that?you?need?to?enable?debug?mode?in?the?mboot?console?
	and?check?for?next?lines?during?the?boot:
		[DEBUG]?isCustomerKeyBankCipher:926:?keyBankOffset=0x168e00
		[DEBUG]?isCustomerKeyBankCipher:927:?keyBankSize=0x450

	keyBankOffset?-?is?an?offset?of?the?key?bank?section?in?the?mboot
	keyBankSize?-?section?size

	There?will?be?similar?lines?for?the?key?bank?backup.

	Another?way?to?check?it?is?to?open?MBOOT?binary?in?the?hex?editor?and
	do?search?for?u8MagicID?which?is?most?of?the?time?equals?to?“Mstar.Key.Bank“?string.?
	You?should?get?two?equal?sections?the?key?bank?and?the?key?bank?backup.

	====?Key?bank?structures?===

	#define?AES_IV_LEN?		16
	#define?AES_KEY_LEN?	16
	#define?HMAC_KEY_LEN?	32

	#define?SIGNATURE_LEN????????	256
	#define?RSA_PUBLIC_KEY_N_LEN?	256
	#define?RSA_PUBLIC_KEY_E_LEN?	4
	#define?RSA_PUBLIC_KEY_LEN???	（RSA_PUBLIC_KEY_N_LEN+RSA_PUBLIC_KEY_E_LEN）

	typedef?struct
	{
	????U32?u32Num;
	????U32?u32Size;
	}IMAGE_INFO;

	typedef?struct
	{
	??U8?u8SecIdentify[8];?
	??IMAGE_INFO?info;
	??U8?u8Signature[SIGNATURE_LEN];
	}_SUB_SECURE_INFO;

	typedef?struct
	{
	??U8?N[RSA_PUBLIC_KEY_N_LEN];
	??U8?E[RSA_PUBLIC_KEY_E_LEN];
	}RSA_PUBLIC_KEY;

	typedef?struct
	{
	????_SUB_SECURE_INFO?customer;
	????RSA_PUBLIC_KEY?u8RSABootPublicKey;
	????RSA_PUBLIC_KEY?u8RSAUpgradePublicKey;
	????RSA_PUBLIC_KEY?u8RSAImagePublicKey;
	????U8?u8AESBootKey[AES_KEY_LEN];???
	????U8?u8AESUpgradeKey[AES_KEY_LEN];???????
	????U8?u8MagicID[16];
	????U8?crc[4];
	}CUSTOMER_KEY_BANK;

	====?End?Key?bank?structures?===

‘‘‘

from?ctypes?import?*
import?os
import?sys
import?utils

DEBUG?=?False

#?Default?values
defOutFolder?=?“keys“
defOffet?=?“0x168e00“
defSize?=?“0x450“
#defKey=“hex:E01001FF0FAA55FC924D535441FF0700“

#?Structures
AES_IV_LEN?		=?16
AES_KEY_LEN?	=?16
HMAC_KEY_LEN?	=?32

SIGNATURE_LEN????????	=?256
RSA_PUBLIC_KEY_N_LEN?	=?256
RSA_PUBLIC_KEY_E_LEN?	=?4
RSA_PUBLIC_KEY_LEN???	=?RSA_PUBLIC_KEY_N_LEN?+?RSA_PUBLIC_KEY_E_LEN

class?IMAGE_INFO（Structure）:
	_fields_?=?[（“u32Num“?c_uint32）
				（“u32Size“?c_uint32）]

class?SUB_SECURE_INFO（Structure）:
	_fields_?=?[（“u8SecIdentify“?c_uint8?*?8）
				（“info“?IMAGE_INFO）
				（“u8Signature“?c_uint8?*?SIGNATURE_LEN）]

class?RSA_PUBLIC_KEY（Structure）:
	_fields_?=?[（“N“?c_uint8?*?RSA_PUBLIC_KEY_N_LEN）
				（“E“?c_uint8?*?RSA_PUBLIC_KEY_E_LEN）]

class?CUSTOMER_KEY_BANK（Structure）:
	_fields_?=?[（“customer“?SUB_SECURE_INFO）
				（“u8RSABootPublicKey“?RSA_PUBLIC_KEY）
				（“u8RSAUpgradePublicKey“?RSA_PUBLIC_KEY）
				（“u8RSAImagePublicKey“?RSA_PUBLIC_KEY）
				（“u8AESBootKey“?c_uint8?*?AES_KEY_LEN）
				（“u8AESUpgradeKey“?c_uint8?*?AES_KEY_LEN）
				（“u8MagicID“?c_uint8?*?16）
				（“crc“?c_uint8?*?4）]


#?Command?line?args
if?len（sys.argv）?==?1:?
	print?（“Usage:?extract_keys.py??[]?[]?[]“）
	prin

?屬性????????????大小?????日期????時間???名稱
-----------?---------??----------?-----??----

?????文件??????10065??2019-05-22?10:22??__pycache__\utils.cpython-37.pyc

????.......?????71622??2019-03-28?08:06??bin\win32\aescrypt2.exe

????.......?????61709??2019-03-28?08:06??bin\win32\alignment.exe

????.......????131072??2019-03-28?08:06??bin\win32\lzop.exe

????.......????137974??2019-03-28?08:06??bin\win32\rsa_sign.exe

????.......?????71915??2019-03-28?08:06??bin\win32\SubSecureInfoGen.exe

????.......???????650??2019-03-28?08:06??configs\dexp-madison-system.ini

????.......???????613??2019-03-28?08:06??configs\empty-skip-example.ini

????.......??????1116??2019-03-28?08:06??configs\letv-emmc2usb.ini

????.......???????339??2019-03-28?08:06??configs\letv-enable-uart.ini

????.......???????339??2019-03-28?08:06??configs\letv-force-bin-update.ini

????.......???????910??2019-03-28?08:06??configs\letv-x340-43-recovery-no-secure.ini

????.......??????5426??2019-03-28?08:06??configs\letv-x355pro-full.ini

????.......???????932??2019-03-28?08:06??configs\letv-x355pro-recovery-no-secure.ini

????.......??????1188??2019-03-28?08:06??configs\letv-x355pro-recovery.ini

????.......???????632??2019-03-28?08:06??configs\letv-x355pro-system.ini

????.......??????1072??2019-03-28?08:06??configs\letv-x4-recovery-no-secure.ini

????.......???????997??2019-03-28?08:06??configs\letv-x4-systemless-live.ini

????.......???????652??2019-03-28?08:06??configs\letv-x450pro-system.ini

????.......???????522??2019-03-28?08:06??configs\LETV_USB_script_938.ini

????.......???????703??2019-03-28?08:06??configs\tcl-s68at02-system.ini

????.......???????484??2019-03-28?08:06??configs\xgimi.ini

????.......????????16??2019-03-28?08:06??default_keys\AESboot.bin

????.......????????16??2019-03-28?08:06??default_keys\AESupgrade.bin

????.......???????155??2019-03-28?08:06??default_keys\README.md

????.......??????2353??2019-03-28?08:06??default_keys\RSAboot_priv.txt

????.......???????260??2019-03-28?08:06??default_keys\RSAboot_pub.bin

????.......???????528??2019-03-28?08:06??default_keys\RSAboot_pub.txt

????.......??????2353??2019-03-28?08:06??default_keys\RSAimage_priv.txt

????.......???????260??2019-03-28?08:06??default_keys\RSAimage_pub.bin

............此處省略31個文件信息