It would be nice to let the script find the most probable method chain on its own instead of relying on pattern matching by human based on the result produced by dec-nochain.

Hello @dogtopus , Im trying to generate the files needed to passinglink to authenticate ds4, I tried running your e3.py this way:

python e3.py jedi_flash.bin -o [some destination] --gen-passinglink-ds4key

But only get "No more keys found" as response.

What should I do to get ds4.der ds4.sig and ds4.serial?

Also I tried to generate manually the ds4.sig and ds4.serial via HxD and slicing the adresses on your code, I think they are right, but I dont know how to generate the ds4.der

Thanks in advance!

Write a payload for extracting IV directly from the target board by flashing the payload as a partially encrypted OTA file and reading back the first flash DWORD/initial stack pointer via one of the hardware serial port.

The payload must be either stackless or the startup code must NOT depend on any initial SP value since bad IV will cause the stack pointer to be initialized to an unpredictable value. The payload should support at least NUC121 and M453 with NUC121 given priority since I have the chip for testing.