Update old insyde 8 digit generator

(x * 0x66666667) >> 34 is a compiler optimized modulo operation (0x66666667 / 2 ** 34) is a 0.1 (or 1/10). Also, some implementations have different salt and has a bug in serial formatting (leading zeroes a lost).
bacher09 · Jun 12, 2020 · 7966f46 · 7966f46
1 parent 0b025a7
commit 7966f46
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 19 deletions.
diff --git a/src/keygen/insyde.spec.ts b/src/keygen/insyde.spec.ts
@@ -2,10 +2,19 @@ import { acerInsyde10Solver, AES128, Crc64, insydeSolver, Sha256} from "./insyde
 
 describe("Insyde BIOS", () => {
     it("Insyde key for 03133610 is 12891236", () => {
-        expect(insydeSolver("03133610")).toEqual(["12891236"]);
+        expect(insydeSolver("03133610")[0]).toEqual("12891236");
     });
     it("Insyde key for 12345678 is 03023278", () => {
-        expect(insydeSolver("12345678")).toEqual(["03023278"]);
+        expect(insydeSolver("12345678")[0]).toEqual("03023278");
+    });
+
+    it("Insyde key for 87654321 is 38732907", () => {
+        expect(insydeSolver("87654321")[0]).toEqual("38732907");
+    });
+
+    it("Insyde key for 12345678 (all variants)", () => {
+        expect(insydeSolver("12345678")).toEqual(["03023278", "16503512"]);
+        expect(insydeSolver("03133610")).toEqual(["12891236", "24094120", "99534862"]);
     });
 
     it("test invalid keys", () => {

diff --git a/src/keygen/insyde.ts b/src/keygen/insyde.ts
@@ -534,24 +534,31 @@ export function acerInsydeKeygen(serial: string): string[] {
 }
 
 function insydeKeygen(serial: string): string[] {
-    const salt = "Iou|hj&Z";
-    let password = "";
-    let b = 0;
-    let a = 0;
+    const salt1 = "Insyde Software Corp.";
+    const salt2 = ":\x16@>\x1496H\x07.\x0f\x0e\nG-MDGHBT";
+    // some firmware has a bug in number convesion to string
+    // they use simple snprintf(dst, 0x16, "%d", serial) so leading zeros are lost
+    // and at the end buffer is filled with \x00
+    const serial2 = (parseInt(serial, 10).toString() + "\x00".repeat(8)).slice(0, 8);
+    let password1 = "";
+    let password2 = "";
+    let password3 = "";
     for (let i = 0; i < 8; i++) {
-        b = salt.charCodeAt(i) ^ serial.charCodeAt(i);
-        a = b;
-        // a = (a * 0x66666667) >> 32;
-        a = (a * 0x66666667);
-        a = Math.floor(a  / Math.pow(2, 32));
-        a = (a >> 2) | (a & 0xC0);
-        if (a & 0x80000000) {
-            a++;
-        }
-        a *= 10;
-        password += (b - a).toString();
-    }
-    return [password];
+        // salt.charCodeAt(i % salt.length) + (i % salt.length)
+        let b: number = (salt1.charCodeAt(i) + i) ^ serial.charCodeAt(i);
+        password1 += (b % 10).toString();
+
+        b = (salt1.charCodeAt(i) + i) ^ serial2.charCodeAt(i);
+        password2 += (b % 10).toString();
+
+        b = salt2.charCodeAt(i) ^ serial2.charCodeAt(i);
+        password3 += (b % 10).toString();
+    }
+    if (password1 === password2) {
+        return [password1, password3];
+    } else {
+        return [password1, password2, password3];
+    }
 }
 
 export let insydeSolver = makeSolver({