u/FrancisStokes

19.4k post karma · 9,650 comment karma · joined Mar 2017 · moderator

FrancisStokes

The reader would be something like this: https://aliexpress.com/item/1005001689929545.html (you can get them everywhere, not only aliexpress)

It's likely just AES, though there's a chance they're doing some kind of signing on the clear text code after decryption (i doubt it). I mean, they could be full yololing it and doing some other encryption in software, but it would be a weird choice given the chip has AES onboard.

As for decryption, if it is AES, you really will need the actual key to decrypt it. It is technically possible to leak the key through power analysis, where you measure power usage as the device is decrypting an image. This is because AES (and really any encryption) is a known, deterministic, sequential process. If you have a way to feed different data to be decrypted (by, for example, emulating a SPI nor flash using a raspberry pi pico and sending your controlled data), you can, over many runs, start to statistically tease the key out. Take a look at this video for some inspiration: https://youtu.be/tck7Rw_slIY

I'm honestly not sure what would be the path of less effort; go down the hardware hacking route and try to dump the encryption keys, or design and build a new mp3 player from scratch 😄 both cool side projects either way haha