first and last commit
This commit is contained in:
Chris Nutter committed
commit
1bf4efd552
2612 files changed
+636500
No files matched your search
@@ -0,0 +1,86 @@
|
||||
|
||||
Getting set up with the fake hierarchy:
|
||||
|
||||
Modify lib/pki/rules.mk: set PKI_APPLE_ROOT_CA=0 to switch to the fake hierarchy and build a debug app test, ie. iBSS.
|
||||
Load the various images
|
||||
Get the keys and certs and CSRs from lib/pki/fake_ca.h for the intermediate: intermediate-cert.pem intermediate-key.pem, put them into separate .pem files.
|
||||
Convert intermediate-cert.pem to der using openssl x509 -in intermediate-cert.pem -outform der -out intermediate-cert.der.
|
||||
|
||||
The USB_SERIAL_NUMBER header contains the board specific info, you may need to modify.
|
||||
|
||||
Useful images to create:
|
||||
|
||||
Images that try to set the current settings. Production status, chip and security domain should never be set by image itself.
|
||||
|
||||
img-dev-sdom-chip --development --chipType 0x8720 --domain darwin
|
||||
img-dev-sdom-chip-epoch --development --chipType 0x8720 --domain darwin --epoch 0
|
||||
img-dev-sdom-chip-boardid --development --chipType 0x8720 --domain darwin --boardID 0
|
||||
img-dev-sdom-chip-uniqueid --development --chipType 0x8720 --domain darwin --uniqueID 0x????
|
||||
|
||||
One image to make sure the production switch works as expected. Modify chipid_get_production_mode in platform/*/chipid/chipid.c to simulate a production unit.
|
||||
|
||||
img-prod-sdom-chip --production --chipType 0x8720 --domain darwin
|
||||
|
||||
One leaf for the current settings:
|
||||
|
||||
spec-dev-8720-darwin --development --chipType 0x8720 --domain darwin
|
||||
|
||||
Leafs that modifies one of the settings away from the default (always supposed to come from the cert)
|
||||
|
||||
spec-dev-8720-manu --development --chipType 0x8720 --domain manufacturer
|
||||
spec-dev-8920-darwin --development --chipType 0x8920 --domain darwin
|
||||
spec-prod-8720-darwin --production --chipType 0x8720 --domain darwin
|
||||
|
||||
Leafs that modify epoch, boardid or ecid, away from the default (okay for the image to specify if cert doesn't)
|
||||
|
||||
spec-dev-8720-darwin-wrong-epoch --development --chipType 0x8720 --domain darwin --epoch 1
|
||||
spec-dev-8720-darwin-wrong-boardid --development --chipType 0x8720 --domain darwin --boardID 1
|
||||
spec-dev-8720-darwin-wrong-ecid --development --chipType 0x8720 --domain darwin --uniqueID 0
|
||||
|
||||
Tests of image and leaf combinations:
|
||||
|
||||
spec-dev-8720-darwin img-dev-sdom-chip OK
|
||||
spec-dev-8720-manu img-dev-sdom-chip FAIL
|
||||
spec-dev-8920-darwin img-dev-sdom-chip FAIL
|
||||
spec-prod-8720-darwin img-dev-sdom-chip OK
|
||||
spec-prod-8720-darwin img-dev-sdom-chip OK * board set to return production
|
||||
spec-dev-8720-darwin img-prod-sdom-chip FAIL * board set to return production
|
||||
spec-dev-8720-darwin-wrong-epoch img-dev-sdom-chip-epoch FAIL
|
||||
spec-dev-8720-darwin-wrong-boardid img-dev-sdom-chip-boardid FAIL
|
||||
spec-dev-8720-darwin-wrong-ecid img-dev-sdom-chip-uniqueid FAIL (w/ 32 bit clipped ECID)
|
||||
|
||||
Make img3 specs and put them into the extensions.txt file used during signing:
|
||||
|
||||
make-img3-specs is a shell script that converts img3 blobs into spec extensions to be used when signing.
|
||||
|
||||
make-img3-specs > extensions.txt
|
||||
|
||||
Generating one key that will be shared for all issued leafs:
|
||||
|
||||
openssl req -newkey rsa:1024 -sha1 -days 365 -sha1 \
|
||||
-subj "/C=US/O=Apple Inc./OU=Apple Secure Boot Certification Authority/CN=S5L8900 Secure Boot" \
|
||||
-nodes -out leaf-csr.pem -keyout leaf-key.pem
|
||||
(note: common name is not checked in leaf - platform is derived from embedded img3)
|
||||
|
||||
Sign all leafs:
|
||||
|
||||
for i in spec-dev-8720-darwin spec-dev-8720-manu spec-dev-8920-darwin spec-prod-8720-darwin \
|
||||
spec-dev-8720-darwin-wrong-epoch spec-dev-8720-darwin-wrong-boardid spec-dev-8720-darwin-wrong-ecid;
|
||||
do
|
||||
openssl x509 -req -sha1 -in leaf-csr.pem -CA intermediate-cert.pem -CAkey intermediate-key.pem \
|
||||
-set_serial 42 -outform der -out $i.der -extfile extensions.txt -extensions $i
|
||||
done
|
||||
|
||||
Create and sign images:
|
||||
|
||||
to_binary_hash.c is an emergency hack for conversion from image3maker output.
|
||||
|
||||
The image is generated and signed in the first steps:
|
||||
image3maker --create --imagefile iBSS.img3 --type ibot --data iBSS.bin <pass in tags for image here>
|
||||
image3maker --hashForSigning --imagefile iBSS.img3 | to_binary_hash > iBSS.hash
|
||||
openssl rsautl -sign -inkey leaf-key.pem -in iBSS.hash -out iBSS.sig
|
||||
|
||||
It can be tested with various leafs (because all use the same key):
|
||||
cat intermediate-cert.der spec-dev-8720-darwin.der > chain.der
|
||||
image3maker --signWithData --signWithSignature iBSS.sig --signWithCertChain chain.der --imagefile iBSS.img3
|
||||
|
||||
Binary file not shown.
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEpAIBAAKCAQEAvcWxBbLPL3G9uKlfzEGg9bBBTm9T2Wzl3/GlkcWZwbaZlutT
|
||||
Ir9ywzm454FSBgZd+bhsktYm3JJrJe29guj0FGN0x8AnBg0dzqBixGNNwA8YMPEn
|
||||
SxCvbtHxL90QAyv+bggx1MD4eXbuPMpqn3hgHlLqbMVQsUj8RG95wkRjRfHbQutc
|
||||
zqenlz69mxOUd1HY5LzLu+yu2Dm0FSPjwzCadPTZ3gPos8lBvHt5B2Ty/+6tXHhB
|
||||
YHq4FofmJY0ADRoQrm4Ml8oHtu94Djh+UCtXyC8G36to/j5C+FTYB6cPY33hTTlc
|
||||
+8OPBzijYp1h7lrcLvafpfWIZAXbTGg4ldxvMwIDAQABAoIBAQCvUe5DN3iVel0u
|
||||
NrwcNh2AHb+XuN4cJrEQfWzbCVUNU6b9eJarqXdayP78Ucr3afZz+F/GIDZy3IpE
|
||||
1iiYwqKMG34N9IWY35FEDYRxrtRrtQZCYOhOPzH0DdzmvTJH2+MIwGVZCpYDkU5z
|
||||
twVeIpWaLjwJFRmBT85PYzV3tjqIqFnIzQhU8CRb52MFsyvTSpsycPAaLbnZ2wr2
|
||||
KT9gOtCv61SKuTqPm2NhrYL34lJCHORySBe4Ts5vmjX75pBd00eDFTz6Fzwo9ePk
|
||||
65nV3Vf7CKfqXLyV8ZHLU5xoMaPYvEY/mb1W1J+IsZ77juPAnQQ/aYqdUTDkjsq4
|
||||
F5nJ3PlBAoGBAO5Z44eGsKclr1sVNo+QAchZqYSyyFKojKfnZHWztIfXdR9xZksg
|
||||
zXSPQ0EbGdVK+ETDNZ4FWMCbllx69lLcnig8CN/6XKsKvjkw2mu0aS0I34RmozHo
|
||||
mk2UV7KN3BLN8n7LSl1nucnI0mLFjZYpBQB/fnCS8F03TSDU97WEoupDAoGBAMvS
|
||||
9LvcgfOUzIVD/MIJeYYxRJnroUcSijqs3Pp9ReWzRie9W7FOzM4gsSIs/wZh4dce
|
||||
XIgS8mEobGTQH8dX5GostiKqJQq/E0Oa9i7QDmKOzVYqXjq+RuWu7GDmSb9kZ2g9
|
||||
03GItxlwODNIAgpVT3p4FMDvTR+DsDdDF9jrMXBRAoGAFAOKPnQJ208nxU8nsLBX
|
||||
5fnZaSIV/hLXFLYyUkvPqeRmmkhMXZyYg+QPsqTS630LEcMOeoFabXnjC0rr6hNK
|
||||
WHiKCjyckWQqiuTWQlr4xeZL1nND2sn8Qu1k28Jbq1yNsyXgza0LBa2ONOr/s48o
|
||||
M12BQXSlKD6fhFU9o4lKoL8CgYEAoH3XnyUeXkJIWJcUK2VyfyvELL7RGzmKBnGe
|
||||
/s4tf5UOJLSBwredpKExWQu9M7VXMyABFFR27fH6h9cpbrnSbZgPQnRe/ns+G/mk
|
||||
52+EJC71mGd8Ex1IjgqSriom38GbewVTvQ49vpYSaq7EjIZoMrLjBJhpTetPkfQO
|
||||
jwuCvkECgYAqKEjuLbX+nhzQkd6pvz/69fTL1VyHZlvzS/ZDnSuJWQ1EgJDv39Q8
|
||||
HLdFqzouNmfPU/dZiTPpOQTy2DYcRnFgwIhxKjrlSI8N3NtAjb5F78GixwfvsxVw
|
||||
+jh3GPYgL9xXKDDgnaLdkhGNuHR2aEiAWpXlz5PURgSVMqR8tgKZnw==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,39 @@
|
||||
#!/bin/zsh
|
||||
|
||||
function make-img3-spec()
|
||||
{
|
||||
TEMP_FILE=tmp$$
|
||||
image3maker --create --imagefile "${TEMP_FILE}.img3" --type cert $*
|
||||
if [ $? -ne 0 ]; then exit 1; fi
|
||||
FILESIZE=$(wc -c < "${TEMP_FILE}.img3")
|
||||
if [ ${FILESIZE} -gt 127 ];
|
||||
then echo script too dumb to encode asn.1 length greater than 127
|
||||
exit 1
|
||||
fi
|
||||
printf "1.2.840.113635.100.6.1.1=critical,DER:04:%02X" ${FILESIZE}
|
||||
od -vt x1 "${TEMP_FILE}.img3" |\
|
||||
sed -e 's/^[0-9a-f]*//g' -e 's/ *\([0-9a-f][0-9a-f]\)/:\1/g' |\
|
||||
tr -d ' \n'
|
||||
echo
|
||||
rm ${TEMP_FILE}.img3
|
||||
}
|
||||
|
||||
GENERAL_SPEC="keyUsage = digitalSignature
|
||||
subjectKeyIdentifier=hash
|
||||
authorityKeyIdentifier=keyid:always"
|
||||
|
||||
echo "[ spec-dev-8720-darwin ]"; echo ${GENERAL_SPEC}; echo $(make-img3-spec --development --chipType 0x8720 --domain darwin )
|
||||
echo
|
||||
echo "[ spec-dev-8720-manu ]"; echo ${GENERAL_SPEC}; echo $(make-img3-spec --development --chipType 0x8720 --domain manufacturer )
|
||||
echo
|
||||
echo "[ spec-dev-8920-darwin ]"; echo ${GENERAL_SPEC}; echo $(make-img3-spec --development --chipType 0x8920 --domain darwin )
|
||||
echo
|
||||
echo "[ spec-prod-8720-darwin ]"; echo ${GENERAL_SPEC}; echo $(make-img3-spec --production --chipType 0x8720 --domain darwin )
|
||||
echo
|
||||
echo "[ spec-dev-8720-darwin-wrong-epoch ]"; echo ${GENERAL_SPEC}; echo $(make-img3-spec --development --chipType 0x8720 --domain darwin --epoch 1)
|
||||
echo
|
||||
echo "[ spec-dev-8720-darwin-wrong-boardid ]"; echo ${GENERAL_SPEC}; echo $(make-img3-spec --development --chipType 0x8720 --domain darwin --boardID 1 )
|
||||
echo
|
||||
echo "[ spec-dev-8720-darwin-wrong-ecid ]"; echo ${GENERAL_SPEC}; echo $(make-img3-spec --development --chipType 0x8720 --domain darwin --uniqueID 0 )
|
||||
echo
|
||||
|
||||
@@ -0,0 +1,43 @@
|
||||
|
||||
#include <unistd.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
// SHA1(iBSS.img3)= b51f78b42bb2d13281b4606b1446eb417625a657
|
||||
|
||||
unsigned char hex_to_bin(unsigned char hexchar)
|
||||
{
|
||||
unsigned char val = hexchar - '0';
|
||||
if (val < 10)
|
||||
return val;
|
||||
val -= ('a' - '0' - 10);
|
||||
if (val < 16)
|
||||
return val;
|
||||
return 255;
|
||||
}
|
||||
|
||||
int main(int argc, char *argv[])
|
||||
{
|
||||
const unsigned char sha1oid[] = { 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e,
|
||||
0x03, 0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };
|
||||
const char prefix[] = "SHA1(", postfix[] = ")= ";
|
||||
char data[80];
|
||||
char *hash = fgets(data, sizeof(data), stdin);
|
||||
if (0 == strncmp(prefix, hash, sizeof(prefix) - 1)) {
|
||||
hash += sizeof(prefix) - 1; /* leave off null */
|
||||
hash = strstr(hash, postfix);
|
||||
if (!hash)
|
||||
return -1;
|
||||
hash += sizeof(postfix) - 1; /* leave off null */
|
||||
|
||||
int i;
|
||||
for(i=0; i < sizeof(sha1oid); i++)
|
||||
putc(sha1oid[i], stdout);
|
||||
|
||||
while (*hash && (*hash != '\n')) {
|
||||
unsigned char value = hex_to_bin(*hash++) << 4 | hex_to_bin(*hash++);
|
||||
putc(value, stdout);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user