Qualcomm Rpmb

[Amit Bolds]

Helloall users of this forum.

I have question about access to RPMB area by UFI box.

Is it possible to read RPMB area when this area is protected when I know AES key? And is it possible to write data and key to RPMB in new eMMC. I know taht it is possible for example by Beeprog tool from Elnec.

It is impossible to read and write RPMB using third party tool, including tool you mention.

To gain access to RPMB, you need pre-program key (common key and per device key) according to HRID of the cpu in every device to generate HMAC(Hardware Massage Authentication Code) to get authorize access to RPMB area.

Please lock for this picture. I know that is possible to write key to new eMMC by Beeprog programeer. Our busines partner use this method for analise defective eMMC. And also is possible to read RPMB after put know key to Autenthication area i bufet 32B.

Can you implement similar function in UFI?

I know that is not possible to read key from old/defective eMMMC, this is obvious. I know key from userarea data and I want to read data from RPMB with a this know/ valid key, just like CPU-> eMMC does. If elnec cannot read rpmb with the key and write the key to the new eMMC then what is the 'Authentication key' 32B area for. OK, on Monday I will talk to the salesman / trainer from elnec again.

Hi AdamS did you have any joy with this

We are in the same situation , we have some blank H26M52103FMR on order but any advice on gaining access to the rpmb from the old ic would be much appreciated

3a8082e126