BadUSB(Psychson) on PS2251-07(2307) 続報

コメント

1. Adam より:

   2016年10月2日 17:31

   Can someone translate this to english? even with google translate I cant make it through the first few steps. For example, which files are we meant to patch in the first part?

   返信
   • nk. より:

     2016年10月2日 18:03

     Don’t multi-post.

     返信
2. Aidyn より:

   2016年10月3日 08:28

   So how did you resolve the problem? Do we have to use the BN07V502TAW.BIN as a source for asm code implantation into firmware source? Which steps to take?

   返信
   • nk. より:

     2016年10月3日 18:58

     Check this article: https://vivibit.net/psychson2307/

     返信
   • xx2zz より:

     2016年10月3日 19:55

     > Do we have to use the BN07V502TAW.BIN as a source for asm code implantation into firmware source?
     I add this information to the article: https://vivibit.net/psychson2307/

     返信
3. xoxoibo より:

   2016年12月16日 05:21

   I have two questions where did you get the action SendFirmware07, did you write it? And why are you executing the action without a burner parameter?
   I cant get this working even with the BN07V502TAW.BIN maybe I am missing something

   返信
   • xx2zz より:

     2016年12月21日 22:00

     >I have two questions where did you get the action SendFirmware07, did you write it? And why are you executing the action without a burner parameter?

     “SendFirmware07” is equivalent to “SendFirmware” that patched https://vivibit.net/psychson2307/.

     >I cant get this working even with the BN07V502TAW.BIN maybe I am missing something

     The BN07V502TAW.BIN returns the encrypted data by the “Pseudo Random XOR scrambler” of the phison controller.
     It is necessary to rewrite BN07V502TAW.BIN a few bytes if you want to bypass the encryption.
     Please see the following for more information about the “Pseudo Random XOR scrambler”.
     https://bitbucket.org/flowswitch/phison/wiki/PS2303NDP

     返信
     • Nathan より:

       2017年1月11日 04:57

       I have read the “Random XOR Scrambler Pseudo” page, but I am still unsure of how I need to rewrite BN07V502TAW.BIN.

       The page says
       -038 SCRAMMODE
       -Scrambler mode. Clear bit 7 and set bits 3, 4 to bypass scrambler.

       In BN07V502TAW.BIN, there is no value on 0038. Is this what I should edit? Or do I edit NANDCSOUT registers?

       I am working with a Kingston DataTraveler 100 G3 8GB (2251-07) PS2307 Controller.

       Drivecom has given me this so far:

       ———————
       BEFORE ANY CHANGES
       C:\Psychson-master\tools>DriveCom /Drive=F /action=GetInfo
       Action specified: GetInfo
       Gathering information…
       Reported chip type: 2307
       Reported chip ID: 98-DE-88-A3-72-51
       Reported firmware version: 1.02.55
       Mode: Firmware

       ————————————-
       AFTER ATTEMPTING TO SEND FIRMWARE

       C:\Psychson-master>tools\drivecom /drive=F /action=GetInfo
       Action specified: GetInfo
       Gathering information…
       Reported chip type: 2307
       Reported chip ID: 98-DE-88-A3-72-51
       Reported firmware version: 1.06.10
       Mode: Burner

       Notice how the reported firmware has been changed in the second GetInfo after I tried to sendfirmware. It is also in Burner mode. Not sure if this means anything.

       Anyway, I just need help figuring how to rewrite the BN07v502TAW.BIN. Anything is appreciated, thank you for your time.

       返信
       • xx2zz より:

         2017年1月11日 06:33

         Wasn’t it successful with the BN07V106M.BIN? (BN07V106M.BIN does not encrypt(decrypt) the firmware)

         返信
         • Nathan より:

           2017年1月11日 08:55

           Using Drivecom to send firmware BN07V106M.BIN gave me this:

           Psychson-master>tools\drivecom /drive=f /action=SendFirmware /burner=Burner\BN07V106M.BIN /firmware=firmware\bin\fw.bin
           Action specified: SendFirmware
           Gathering information…
           Reported chip type: 2307
           Reported chip ID: 98-DE-88-A3-72-51
           Reported firmware version: 1.06.10
           Mode: Burner
           Rebooting…
           Sending firmware…
           FATAL: System.InvalidOperationException: Header not accepted
           at DriveCom.PhisonDevice.TransferFile(Byte[] data, Byte header, Byte body) in c:\Users\User\Desktop\New folder\Psychson-master\DriveCom\DriveCom\PhisonDevice.cs:line 256
           at DriveCom.Startup._RunFirmware(String fileName) in c:\Users\User\Desktop\New folder\Psychson-master\DriveCom\DriveCom\Startup.cs:line 427
           at DriveCom.Startup._SendFirmware() in c:\Users\User\Desktop\New folder\Psychson-master\DriveCom\DriveCom\Startup.cs:line 378
           at DriveCom.Startup.Main(String[] args) in c:\Users\User\Desktop\New folder\Psychson-master\DriveCom\DriveCom\Startup.cs:line 114
         • xx2zz より:

           2017年1月11日 23:47

           >In BN07V502TAW.BIN, there is no value on 0038. Is this what I should edit? Or do I edit NANDCSOUT registers?
           It is “F638”, not “0038”.

           See this comments: https://vivibit.net/psychson2307/#comment-5958.