RPMB reading using valid authentication key, key programming in new eMMC chip

AdamS

Hello all users of this forum.
I have question about access to RPMB area by UFI box.
Is it possible to read RPMB area when this area is protected when I know AES key? And is it possible to write data and key to RPMB in new eMMC. I know taht it is possible for example by Beeprog tool from Elnec.

Best regards
Adam

madgoeslim

AdamS Is it possible to read RPMB area when this area is protected when I know AES key? And is it possible to write data and key to RPMB in new eMMC

It is impossible to read and write RPMB using third party tool, including tool you mention.
To gain access to RPMB, you need pre-program key (common key and per device key) according to HRID of the cpu in every device to generate HMAC(Hardware Massage Authentication Code) to get authorize access to RPMB area.

kapil

oppo cph 1911 isp pinout send plz

AdamS

I forgot to add that I'm working on copying the corrupted eMMC to new one from an android smart tv, I found the area where the RPMB key is being used. IC sky hynix H26M52103FMR id used.

AdamS

madgoeslim It is impossible to read and write RPMB using third party tool, including tool you mention.

madgoeslim It is impossible to read and write RPMB using third party tool, including tool you mention.

Hello madgoeslim,

Please lock for this picture. I know that is possible to write key to new eMMC by Beeprog programeer. Our busines partner use this method for analise defective eMMC. And also is possible to read RPMB after put know key to Autenthication area i bufet 32B.
Can you implement similar function in UFI?

screen from Beeprog ptogrammer

Jane

AdamS Are you sure of that? As far as I know not even ELNEC company (Beeprog programmer owner) can not copy RMPB key from an old/not properly working eMMC and write that RMPB key to a new eMMC.

AdamS

Hello Jane,

I know that is not possible to read key from old/defective eMMMC, this is obvious. I know key from userarea data and I want to read data from RPMB with a this know/ valid key, just like CPU-> eMMC does. If elnec cannot read rpmb with the key and write the key to the new eMMC then what is the 'Authentication key' 32B area for. OK, on Monday I will talk to the salesman / trainer from elnec again.

AdamS

Instruction about acces to RPMB: http://lkml.iu.edu/hypermail/linux/kernel/1604.0/01227.html

Jane

From my understanding :it is possible to read/write RPMB area but not decode the content of that area. Not even ELNEC company does not know how to.

AdamS

Hello Jean,

Can you clarification what does mean decode the content of area.
Do the data read from RPMB with a valid key still need to be decoded?

I found a partial explanation here:http://forum.gsmhosting.com/vbb/13617913-post1.html

Unlockers

Hi AdamS did you have any joy with this
We are in the same situation , we have some blank H26M52103FMR on order but any advice on gaining access to the rpmb from the old ic would be much appreciated

sardar333

Unlockers

hi did you find out how to gain acess to rpmb?