> For the complete documentation index, see [llms.txt](https://open-rt.gitbook.io/open-surfacert/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://open-rt.gitbook.io/open-surfacert/surface-rt/firmware/extract-and-decrypt-orignal-firmware.md).

# Decrypt Firmware

The following script processes a SPI dump.\
It extracts and decrypts the BCT & Bootloader

{% code title="Decrypt BCT" %}

```
#!/bin/bash
echo "Extract BCT/Bootloader from SPI flash"
dd if=mtd0Original_CTS.bin     of=BCT_Block_enc.bin           bs=1 count=8192                #extract the BCT block
dd if=mtd0Original_CTS.bin     of=Bootloader_Block_enc.bin    bs=1 count=520192 skip=1048576 #extract the Bootloader block
dd if=BCT_Block_enc.bin        of=BCT_enc.bin                 bs=1 count=6128                #extract BCT from block
dd if=Bootloader_Block_enc.bin of=Bootloader_enc.bin          bs=1 count=517472              #extract Bootloader from block
dd if=BCT_enc.bin              of=BCT_trimmed_enc.bin         bs=1 skip=16                   #extract BCT without hash
dd if=BCT_enc.bin              of=BCT_hash.bin                bs=1 count=16                  #extract BCT hash

echo ""
echo "decrypting Files"
openssl aes-128-cbc -d -K deadbeefdeadc0dedeadd00dfee1dead -iv 00000000000000000000000000000000 -nopad -nosalt -in BCT_enc.bin        -out BCT_dec.bin         #decrypt BCT
openssl aes-128-cbc -d -K deadbeefdeadc0dedeadd00dfee1dead -iv 00000000000000000000000000000000 -nopad -nosalt -in Bootloader_enc.bin -out Bootloader_dec.bin  #decrypt Bootloader

echo ""
echo "Extracted BCT hash"
xxd -ps BCT_hash.bin
echo "Calculated BCT hash"
openssl dgst -mac cmac -macopt cipher:aes-128-cbc -macopt hexkey:deadbeefdeadc0dedeadd00dfee1dead BCT_trimmed_enc.bin #hash of enc-BCT           #calc BCT hash

echo ""
echo "Extracted Bootloader hash"
bct_dump BCT_dec.bin | grep AES
echo "Calculated Bootloader hash"
openssl dgst -mac cmac -macopt cipher:aes-128-cbc -macopt hexkey:deadbeefdeadc0dedeadd00dfee1dead Bootloader_enc.bin #hash of enc-Bootloader     #calc Bootloader hash

echo ""
echo "remove temp files"
rm BCT_Block_enc.bin
rm BCT_enc.bin
rm BCT_trimmed_enc.bin
rm Bootloader_Block_enc.bin
rm Bootloader_enc.bin
```

{% endcode %}