Skip to content

Commit

Permalink
New patch for noPass with asm generation
Browse files Browse the repository at this point in the history
  • Loading branch information
SciLor committed Feb 16, 2021
1 parent e7ad740 commit 7b808b0
Show file tree
Hide file tree
Showing 2 changed files with 47 additions and 1 deletion.
40 changes: 40 additions & 0 deletions sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass3.305.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
{
"general": {
"_desc": "After two failed tag passwords attempts, the box may try it without a password and shut down the rfid for a moment.",
"_memPos": "",
"_fwVer": "3.0.5+"
},
"positions": [{
"_id": 0,
"_name": "rfidFieldRegisterSet?",
"offset": 0,
"search": ["73", "b5", "11", "4d", "2a", "78"]
},{
"_id": 1,
"_name": "rfidReset?",
"offset": 0,
"search": ["73", "b5", "2f", "4e", "33", "78"]
},{
"_id": 2,
"_name": "LAB_AfterPwSuccess",
"offset": 16,
"search": ["00", "23", "23", "60", "??", "??", "??", "??", "64", "20", "??", "??", "??", "??", "??", "e7",
"00", "2c"]
},{
"_id": 3,
"_name": "bne LAB_AfterPwSuccess",
"offset": 4,
"search": ["05", "28", "04", "46"],
"deasmAddress": true
}],
"searchAndReplace": [{
"search": ["4f", "f0", "??", "31", "??", "aa", "00", "20", "11", "91", "??", "??", "??", "??", "05", "28", "04", "46", "??", "d1", "??", "49", "??", "48", "??", "??", "??", "??"],
"replace2": ["??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "00", "24", "0f", "f0", "0d", "fb", "10", "20", "0f", "f0", "6c", "f9", "3c", "e0"],
"replace": ["??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "??", "00", "24",
{"asm":{"instr": "bl", "param":"p0", "length": 4}},
"10", "20",
{"asm":{"instr": "bl", "param":"p1", "length": 4}},
{"asm":{"instr": "b", "param":"p3", "length": 2}}
]
}]
}
8 changes: 7 additions & 1 deletion wiki/OFWPatches.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,16 @@ Usally the toniebox checks if the tag has exactly 8 blocks. The check allows the
*Deprecated doesn't reset the RF field so some tags will fail*
Usally doesn't allow tags without the boxine specific or the NXP specific privacy mode password. With the patch you can use tags without having privacy password support (ex. SLIX).

### No privacy password ([noPass2.308.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass.305.json))
### No privacy password ([noPass3.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass3.305.json))
*Deprecated replaced with noPass3.305*
Usally doesn't allow tags without the boxine specific or the NXP specific privacy mode password. With the patch you can use tags without having privacy password support (ex. SLIX). It disables the rf field for a moment when the second privacy password failed. This patch uses the new dynamic patching engine to generate dynamic arm asm bytecode.

### No privacy password ([noPass2.308.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass2.308.json))
*Deprecated replaced with noPass3.305*
Usally doesn't allow tags without the boxine specific or the NXP specific privacy mode password. With the patch you can use tags without having privacy password support (ex. SLIX). It disables the rf field for a moment when the second privacy password failed.

### No privacy password ([noPass.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/noPass.305.json))
*Deprecated replaced with noPass3.305*
Usally doesn't allow tags without the boxine specific or the NXP specific privacy mode password. With the patch you can use tags without having privacy password support (ex. SLIX).

### Second privacy password to 00000000 ([secondPwZero.305.json](https://github.com/toniebox-reverse-engineering/hackiebox_cfw_ng/blob/master/sd-bootloader-ng/bootmanager/sd/revvox/boot/patch/secondPwZero.305.json))
Expand Down

0 comments on commit 7b808b0

Please sign in to comment.