tinfoil™ 1.2 html decryptor

decryptdzhtml.py

# simon wrote a decryptor first, so i based this off of his
import sys
from binascii import hexlify
from Crypto.PublicKey import RSA
from Crypto.Hash import SHA256
from Crypto.Cipher import PKCS1_OAEP
from Crypto.Cipher import AES

if len(sys.argv) != 3:
    print('usage: decryptdzhtml.py [input] [output]')
    exit(1)

try:
    in_file = open(sys.argv[1], 'rb')
except:
    print('could not open input')
try:
    out_file = open(sys.argv[2], 'wb')
except:
    print('could not open output')
try:
    key_file = open('tinfoildzpriv.pem', 'rb')
except:
    print('could not open tinfoildzpriv.pem, did you run dumpdzprivkey.py?')

key = RSA.import_key(key_file.read())
oaep_cipher = PKCS1_OAEP.new(key, hashAlgo = SHA256)

if in_file.read(8) != b'TINFOIL\xff':
    print('not an encrypted tinfoil™ html file')
enc_aes_key = in_file.read(256)
aes_key = oaep_cipher.decrypt(enc_aes_key)
print('aes key is ' + hexlify(aes_key).decode('utf-8'))
size = int.from_bytes(in_file.read(8), byteorder='little')
enc_buffer = in_file.read()
in_file.close()
aes_cipher = AES.new(aes_key, AES.MODE_ECB)
dec_buffer = aes_cipher.decrypt(enc_buffer)
dec_buffer = dec_buffer[:size]
out_file.write(dec_buffer)
out_file.close()

dumpdzprivkey.py

import sys
from binascii import hexlify
from Crypto.PublicKey import RSA
from Crypto.Hash import SHA256

# is it even encryption if it's just a xor?
def decrypt(array):
    key = int(array[-1:][0])
    dec_array = b''
    print('key is ' + str(key))
    for byte in range(0, len(array) - 3, 1):
        dec_array = dec_array + bytes([array[byte] ^ key])
    return dec_array

try:
    nro_file = open('tinfoil.nro', 'rb')
except FileNotFoundError:
    print('could not open tinfoil.nro')
    sys.exit(1)

nro = nro_file.read()
nro_file.close()
nro_size = len(nro)

if nro_size != 0xE3EA50:
    print('tinfoil.nro does not appear to be a tinfoil™ 1.2 nro')
    sys.exit(2)

sha256_obj = SHA256.new(data=nro)
if sha256_obj.hexdigest() != '7525d2f35db1c749a72b2b66e214abbd8d24403b9a70795c24507faba8ece0cf':
    print('tinfoil.nro does not appear to be a tinfoil™ 1.2 nro')
    sys.exit(2)

enc_priv_exp = nro[0x7BEF70:0x7BF073]
print('decrypting private exponent')
priv_exp = decrypt(enc_priv_exp)

enc_modulus = nro[0x7BF078:0x7BF17B]
print('decrypting modulus')
modulus = decrypt(enc_modulus)

print('creating key')
key = RSA.construct((int.from_bytes(modulus, byteorder='big'), 0x10001, int.from_bytes(priv_exp, byteorder='big')))
key_file = open('tinfoildzpriv.pem', 'wb')
key_file.write(key.export_key('PEM'))
key_file.close()

How did you found where the key was ? And do you know how could i find where it is for the latest version ?