I.mx7 FCB encrypted?

[robertfullagar]

Hi
Great work found it very interesting!

I am currently working with a 512mb nand dump from an I.mx7, as expected the dump is greater that the nand advertised capacity.

According to the manual for the i.mx7 page 1207 "The FCB data structure is protected using a 62-bit ECC" and the info tool fails to find an FCB, kinda expected if it's encrypted, ecc referring to elyptic curve as opposed to error code correction. Hex editor text search also fails to find an FCB.

I can remove the oob, extract the ubi using binwalk and the images using ubireader but fail to extract files with similar error in your video.

The nand page diagrams are same as your presentation 2kb main and 64b consisting of 4 x 512 main with associated parity.

The fcb block has 1 x 32b metadata section, 8 x 128b data sections and 8 parity sections, if 62bit ecc is error code correction not encryption, 8 sections ÷ 62bit, doesn't go?

Knowing the above and knowing UBI is present in the dump, is there a away to analyse the dump to ascertain some FCB constructs, given the location of the UBI#'s in dump to enable the files to be extracted.

If 62bit protection ecc is encryption, I am assuming the ecc key is in the internal storage of the i.mx7 or at best the boot loader code on the nand!

I am hoping the developers have been lazy and used an "out the box" config :)

Time to dig deeper me thinks :)
Any hints/tips would be appreciated...
Regards
Robert

[0x80O0oOverfl0w]

Are you able to share which device you are looking at? I ran into what I believe is an encrypted FCB as well on an i.MX6SX processor. On a different device running an i.MX28 I was able to successfully decode the FCB, but on the i.MX6SX device, the entire 2112 block is full of random data except 2048 where we find the bad data block (0xFF). I looked at the FCB from the i.MX6SX in Veles and the data does not appear completely random though, which makes me think maybe XOR?