ORAS Secret Base QR codes

[SciresM]

In ORAS you can share secret bases via QR code.

This seems like an obvious thing to try to decrypt.

There are a few qrs posted to the various foreign language websites (Example: http://www.pokemonrubysapphire.com/_ui/img/_en/july/screenshots/july_p26_07_bbp.jpg ), and I'm attaching the binaries the QR codes detail in a zip here:

I know we're almost certainly not going to be able to figure out much until ORAS release and we can generate QR codes ourselves, but if anyone sees anything notable post it here.

Initial things of interest: Lots of 0x11EC at the end, all of them start with "40 23".

qr_oras.zip

[Kaphotics]

byte[] qr = 0x24D

via http://www.thonky.com/qr-code-tutorial/data-encoding/

starting 4 bits is mode (since it is 0100 it is byte encoding)

qr code in picture is scaled by 2 to 162x162, normal dimensions are 81x81 - version 16 qr code.

next 16 bits are character length - 0x0238

01000000 00100011 1000[data][padding 0bits if bitlength%8!=0][EC 11 to fill max length]

so in summary:

qr[] =

4 bit mode (byte mode)

16 bit length (0x238)

byte[] 0x238 data

4 bit unused padding

remainder (0x12 byte) unused EC 11 pads.

data[] =

0xC header[](?)

0x4 zeros

0x228 data2[](?)

Mii QR Code structure & Encryption (3dbrew)

with that said, here's the trimmed data for the QR codes (just the data[])

qr_data.zip

Edited July 17, 2014 by Kaphotics

[Kaphotics]

more mii qr code info:

http://3dbrew.org/wiki/PSPXI:EncryptDecryptAes#Key_Types

http://3dbrew.org/wiki/NS

http://3dbrew.org/wiki/APT:Unwrap

http://3dbrew.org/wiki/APT:Wrap

Mii QR codes use keytype2 @ keyslot 0x31 and the wrap/unwrap commands to en/decrypt data with a 0x8 sized nonce.

ORAS secret bases are possibly using a 0xC nonce (at the start of the data[]) and follow a similar struct. Why change it if it already works?