26
edits
Changes
Jump to navigation
Jump to search
Line 28:
Line 28: + +
Fun stuff
With a way to modify the encrypted state buffer, one can thus dump keys from "write-only" keyslots, etc.
With a way to modify the encrypted state buffer, one can thus dump keys from "write-only" keyslots, etc.
This also bypasses the SBK protection of the bootROM: indeed, at warmboot, bootROM will always clear keyslot 0xE to prevent malicious code from saving the SBK. Moving the SBK to another keyslot in the saved context renders this protection moot.
| None
| None
| HAC-001
| HAC-001