06:20 <hexdump0815> efqw: i think it will not boot anything else - at least my box with the encrypted boot was only able to boot this one boot block

08:56 <repk> efqw: yes keys are in OTP fuses

08:59 <efqw> Is this symmetrical encryption or asymmetrical encryption? Can I at least read the efuse content? Looks like the legacy u-boot has efuse commands, but I’m not sure about the address.

09:08 <xdarklight> efqw: /sys/class/nvmem should have a device for the efuse and you can read all of it's contents from user-space. that's assuming that there's not two efuses and you can really read everything from the "non-secure world"

09:09 <xdarklight> sorry, it's /sys/bus/nvmem

09:09 <efqw> From mainline linux or vendor Android?

09:10 <xdarklight> mainline, not sure about vendor kernel

09:14 <efqw> Thanks, I’ll try that and report back.

09:15 <efqw> The most worrying part for me is that I can’t use pyamlboot to start up the box if something goes wrong with the stock boot block.

09:40 <repk> efqw: it is AES CBC if I am not wrong

11:12 <narmstrong> xdarklight: you will only see the the user fuses, the secure fuses are only available to the secure and scp coprocessor

11:27 <efqw> Just tried it and that was indeed the case. There are no obvious keys to be seen in this user-accessible region.

12:13 <efqw> The efuse command in vendor u-boot has access to the same region.

12:13 <efqw> Size is 0xC0 and there's nothing useful inside.