Ok I have modified the script and created an encode script. Now we just need to know the available commands!
Decoder:
#!/usr/bin/perl
# usage perl decode.pl TEST.KEY
my $filename = (shift);
open(my $fh, $filename) or die $!;
binmode($fh);
my $cnt = 0;
my $encodeString = "";
my $otherString = "";
while (read($fh, my $byte, 1))
{
if ($cnt % 2 == 1)
{
$byte = ord($byte) - 0x14;
$encodeString = $encodeString.chr($byte);
} else {
$byte = ord($byte) - 0x14;
$otherString = chr($byte).$otherString;
}
$cnt++;
}
print $encodeString.$otherString;
print "\n";
close $fh;
Encoder:
#!/usr/bin/perl
# Usage perl encode.pl 008Recovery003ALL00833333333009AllUpdate0082013010100820201230000 OUT.KEY
my $string = shift;
my $outfile = shift;
open(my $ofh, ">", $outfile) or die $!;
binmode($ofh);
my $stringLength = length($string);
$stringHalfLength = ($stringLength/2);
$string1 = substr($string, 0, $stringHalfLength);
$string2 = substr($string, $stringHalfLength, $stringHalfLength+1);
$string2 = reverse $string2;
for (my $i=0; $i < length($string2); $i++) {
my $string1Byte = ord(substr($string1, $i, 1)) + 0x14;
my $string2Byte = ord(substr($string2, $i, 1)) + 0x14;
if($i > length($string1)-1) {
print $ofh chr($string2Byte);
} else {
print $ofh chr($string2Byte), chr($string1Byte);
}
}
print "\n";
close $ofh;
Here is the output of the current TestMode Keys we have that are known to work:
TESTMODE_A.Key - Triggers the unit to reboot once it is started up into what we think is the TestMode.apk
007SERVICE003ALL00833333333007SERVICE0082013010100820201230000
testmode_n_1/TESTMODE_N.key - Triggers the unit to reboot into recovery mode once it is started up.
008Recovery003ALL00833333333009AllUpdate0082013010100820201230000
testmode_n_2/TESTMODE_N.key - Triggers the unit to boot into EasyRecovery Copy & Verify Mode (Where I think it just dd's from the source device to the internal sd card)
008NORFLASH003ALL00833333333010COPYDEVICE0082013010100820201230000
testmode_n_3/TESTMODE_N.key - Triggers the unit to boot into EasyRecovery Mode Change Mode (Where I believe it just changes the mode, as the screen just says mode changed, so the string must contain the mode to change to)
008NORFLASH003ALL00833333333010MODECHANGE0082013010100820201230000
