Other Parts Discussed in Thread: BQ26100, EV2400
Hello,
I have to manage unseal and full access to bq30z554 from MCU.
I try to have full access on bq30z554 using following steps:
1. Send Full Access (0x0032) command to ManufacturerAccess().
2. Read 160-bit message M from ManufacturerInput() -> read B3A974B295F6BD42A644A872B09260C0F6A94C59 (first byte read is B9, last is 59)
3. Generate SHA-1 input block B1 of 512 bytes (total input =128-bit unseal/full access key KD + 160 bit message M + 1 + 159 0s + 100100000).
4. Generate SHA-1 hash HMAC1 using B1.
5. Generate SHA-1 input block B2 of 512 bytes (total input =128-bit unseal/full access key KD + 160 bit hash HMAC1 + 1 + 159 0s + 100100000).
6. Generate SHA-1 hash HMAC2 using B2.
7. Write 160-bit hash HMAC2 to ManufacturerInput()
8. wait 250ma (I try also 500ms)
If i check device, it is still "SEALED"
I can't understand where is the error...
device has default key: 0x0123456789ABCDEFFEDCBA9876543210
message read is B3A974B295F6BD42A644A872B09260C0F6A94C59 that I have inverted to 594CA9F6C06092B072A844A642BDF695B274A9B3
is it correct to calculate first SHA-1 input block with bytes in follow order?
KEY || RANDOM || 1 + 159 0s + 100100000
0x0123456789ABCDEFFEDCBA9876543210 || 594CA9F6C06092B072A844A642BDF695B274A9B3 || 1 + 159 0s + 100100000
I have tryed also 0x0123456789ABCDEFFEDCBA9876543210 || B3A974B295F6BD42A644A872B09260C0F6A94C59 || 1 + 159 0s + 100100000
after I send HMAC2 to ManufacturerInput() (also inverting HMAC2) but bq30z554 is SEALED
I haven't EV2300 to make some test.
Does anybody can sniff SMBus of BQ30Z554 using unseal sequence with EV2300 and give me the file?
Thank you a lot!
