search

notcbw / 2019_android_walkman

Findings from the Android firmware of the Sony Walkman NW-A100 series and NW-ZX500 series
25 stars 3 forks source link

Can't find file /vendor/usr/data/icx_nvp.cfg #2

Open Exhen opened 11 months ago

Exhen commented 11 months ago

Device : ZX707 ixc1302

can't find file /vendor/usr/data/icx_nvp.cfg
it seems that Sony has removed this plain text file in firmware of ZX707

notcbw commented 11 months ago

Sadly Sony may have found out about their mistake. Definitely try searching for this file with the find command though.

Exhen commented 11 months ago

updated:

I traced the logcat info while com.sony.walkman.systemupdater decrypting upg file and found out that getKey method is provided by vendor.sony.securestorage@1.0::ISstorage. I extract this .so lib but still have some trouble decompiling it.

vendor.sony.securestorage@1.0.zip

notcbw commented 11 months ago

@Exhen the key is most likely still stored in the nvp partition. (They have been doing it like that for 10+ years) Just decompiling this shouldn't make any difference since we still don't have the privilege to access the nvp partition.

They only hope is that if the firmware is early enough, we might have a chance to find a temp root exploit that gets us a root shell. Then we can dump the key with the official nvp tools.