Dumps the 8 SYNCP AES-128 keys + ESN from the DPS partition on SYNC 3

dump_syncp_keys.c

// Dumps the 8 SYNCP AES-128 keys + ESN from the DPS partition on SYNC 3

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>

#define EMMC_DEVICE "/dev/hd0"
#define DPS_SIZE 0x100000

struct dps_partition {
    unsigned char provisioning_flag;
    unsigned char syncp_keys[8][16];
    unsigned char esn[8];
    // there are a bunch more fields stored in DPS
    // including Nav license, region config, audio calibration, illumination calibration, etc.
};

int main(void) {
    int fd = open64(EMMC_DEVICE, O_RDONLY);
    if (fd < 0) { perror("open"); return 1; }

    // DPS partition is the last 1MiB in the raw eMMC
    if (lseek64(fd, -(off64_t)DPS_SIZE, SEEK_END) < 0) { perror("lseek"); close(fd); return 1; }
    // Only read the part of DPS we care about
    struct dps_partition dps;
    size_t total = 0;
    while (total < sizeof(dps)) {
        ssize_t count = read(fd, (unsigned char *)&dps + total,
                             sizeof(dps) - total);
        if (count < 0) {
            if (errno == EINTR) continue;
            perror("read");
            close(fd);
            return 1;
        }
        if (count == 0) {
            fprintf(stderr, "read: unexpected end of device after %lu bytes\n",
                    (unsigned long)total);
            close(fd);
            return 1;
        }
        total += (size_t)count;
    }
    close(fd);

    printf("provisioning flag: %02x\n", dps.provisioning_flag);

    for (int k = 0; k < (int)(sizeof(dps.syncp_keys) / sizeof(dps.syncp_keys[0])); k++) {
        printf("SYNCP key[%d]: ", k);
        for (int i = 0; i < (int)sizeof(dps.syncp_keys[0]); i++) printf("%02x", dps.syncp_keys[k][i]);
        printf("\n");
    }

    printf("ESN: %.*s\n", (int)sizeof(dps.esn), dps.esn);
    return 0;
}