Yaya48
5d9a60a926
Model the A6 crypto, interrupt, USB, and platform blocks needed to boot SecureROM through iBSS into iBEC Recovery. Add local lab identity, IMG3, and APTicket tooling, patched macOS recovery utilities, UART and GDB access, and English end-user documentation.
53 lines
3.1 KiB
INI
53 lines
3.1 KiB
INI
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
|
|
[req]
|
|
distinguished_name = distinguished_name
|
|
prompt = no
|
|
# The A6 SecureROM compares the complete ASN.1 Common Name object, including
|
|
# its PrintableString tag, for the public Apple secure-boot authority name.
|
|
string_mask = default
|
|
|
|
[distinguished_name]
|
|
C = ZZ
|
|
O = QEMU A6 Lab
|
|
OU = Secure Boot Research
|
|
CN = QEMU A6 Lab
|
|
|
|
[v3_root]
|
|
keyUsage = critical, keyCertSign, cRLSign
|
|
basicConstraints = critical, CA:true
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always
|
|
# Standard public Apple Root CA policy metadata. Reusing its DER shape keeps
|
|
# the generated lab root at the exact 1215-byte A6 trust-anchor size; the
|
|
# certificate public key and signature are still generated locally.
|
|
2.5.29.32 = DER:30:82:01:04:30:82:01:00:06:09:2A:86:48:86:F7:63:64:05:01:30:81:F2:30:2A:06:08:2B:06:01:05:05:07:02:01:16:1E:68:74:74:70:73:3A:2F:2F:77:77:77:2E:61:70:70:6C:65:2E:63:6F:6D:2F:61:70:70:6C:65:63:61:2F:30:81:C3:06:08:2B:06:01:05:05:07:02:02:30:81:B6:1A:81:B3:52:65:6C:69:61:6E:63:65:20:6F:6E:20:74:68:69:73:20:63:65:72:74:69:66:69:63:61:74:65:20:62:79:20:61:6E:79:20:70:61:72:74:79:20:61:73:73:75:6D:65:73:20:61:63:63:65:70:74:61:6E:63:65:20:6F:66:20:74:68:65:20:74:68:65:6E:20:61:70:70:6C:69:63:61:62:6C:65:20:73:74:61:6E:64:61:72:64:20:74:65:72:6D:73:20:61:6E:64:20:63:6F:6E:64:69:74:69:6F:6E:73:20:6F:66:20:75:73:65:2C:20:63:65:72:74:69:66:69:63:61:74:65:20:70:6F:6C:69:63:79:20:61:6E:64:20:63:65:72:74:69:66:69:63:61:74:69:6F:6E:20:70:72:61:63:74:69:63:65:20:73:74:61:74:65:6D:65:6E:74:73:2E
|
|
|
|
[v3_intermediate]
|
|
basicConstraints = critical, CA:true, pathlen:0
|
|
keyUsage = critical, digitalSignature, keyCertSign, cRLSign
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always, issuer
|
|
|
|
[v3_img3_leaf]
|
|
basicConstraints = critical, CA:false
|
|
keyUsage = digitalSignature
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always, issuer
|
|
# Apple IMG3 certificate constraint object for A6 production/Darwin images.
|
|
# This is public metadata, not an Apple key. The nested DER object constrains
|
|
# CEPO=0x10, SDOM=3, PROD=1 and CHIP=0x8950, matching the emulated
|
|
# 0x3f500000 fuse word (0x200d).
|
|
1.2.840.113635.100.6.1.1 = critical, DER:04:81:84:33:67:6d:49:84:00:00:00:70:00:00:00:00:00:00:00:74:72:65:63:4f:50:45:43:1c:00:00:00:04:00:00:00:10:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:4d:4f:44:53:1c:00:00:00:04:00:00:00:03:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:44:4f:52:50:1c:00:00:00:04:00:00:00:01:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:50:49:48:43:1c:00:00:00:04:00:00:00:50:89:00:00:00:00:00:00:00:00:00:00:00:00:00:00
|
|
|
|
[v3_ticket_leaf]
|
|
basicConstraints = critical, CA:false
|
|
keyUsage = digitalSignature
|
|
subjectKeyIdentifier = hash
|
|
authorityKeyIdentifier = keyid:always, issuer
|
|
# A6 APTicket signing constraint. The original iBSS decoder requires the
|
|
# public ticket OID and constrains CHIP=0x8950, PROD=1 and SDOM=3. These are
|
|
# values of the emulated n41ap, while the certificate and key remain private
|
|
# to this lab identity.
|
|
1.2.840.113635.100.6.1.11 = critical, DER:30:1e:a1:1c:31:1a:82:04:50:89:00:00:84:04:01:00:00:00:85:04:03:00:00:00:9f:81:6b:04:10:00:00:00
|