SynoDecrypt

A tool to decrypt all Synology encrypted archives (SPK, PAT, ...). The reverse engineering work is explained in our blog post.

Installation

pip install -r requirements.txt

Usage

You first have to extract the encryption keys and put them into a JSON file (e.g. into keys.json). This JSON file must have the following format:

{
  "keypairs": [
    {
      "keytypes": [0, 1, 2],
      "signing": "hex_signing_key",
      "master": "hex_master_key"
    },
    {
      "keytypes": [6],
      "signing": "hex_signing_key",
      "master": "hex_master_key"
    },
    {
      "keytypes": [3],
      "signing": "hex_signing_key",
      "master": "hex_master_key"
    },
    [...]
  ],
  "dev_signing_key": "hex_dev_signing_key"
}

$ python3 synodecrypt.py --help
usage: synodecrypt.py [-h] [-o OUTPUT] [-v] [-k KEYTYPE] [-f KEYFILE] [-d] archive

positional arguments:
  archive

options:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        name of the decrypted archive, defaults to archive path with ".tar" suffix
                        (default: None)
  -v, --verbose
  -k KEYTYPE, --keytype KEYTYPE
                        force a specific keytype (default: None)
  -f KEYFILE, --keyfile KEYFILE
                        path to the json containing the encryption keys (default: ./keys.json)
  -d, --dev-signing-key
                        use the dev signing key, must specify the keytype (default: False)

Example

$ python3 synodecrypt.py BSM_BST150-4T_65374.pat
[+] found matching keys
[+] header signature verified
[+] 53 entries
DiskCompatibilityDB.tar
VERSION
hda1.tgz
indexdb.txz
model.dtb
rd.bin
synohdpack_img.txz
uboot_MANGO.bin
uboot_do_upd.sh
updater
zImage
checksum.syno
Synology.sig
packages/BeePhotos-BSM-armv8-1.1.0-10053.spk
packages/CloudSync-BSM-armv8-2.7.1-4001.spk
packages/CodecPack-BSM-rtd1619bmango-4.0.0-4051.spk
packages/FileStation-BSM-armv8-1.3.5-1721.spk
packages/HyperBackup-BSM-armv8-4.1.1-3735.spk
packages/MangoDrive-BSM-armv8-1.1.0-10555.spk
packages/Node.js_v20-BSM-armv8-20.13.0-2009.spk
packages/PHP7.4-BSM-armv8-7.4.33-0140.spk
packages/QuickConnect-BSM-armv8-1.0.8-0149.spk
packages/SMBService-BSM-armv8-4.15.13-2101.spk
packages/SynologyApplicationService-BSM-armv8-1.8.0-20663.spk
packages/SynologyDrive-BSM-armv8-3.4.1-25812.spk
packages/SynologyPhotosBSM-BSM-rtd1619bmango-1.7.0-0829.spk
packages/SynologyUniversalSearch-BSM-armv8-1.7.0-0743.spk
packages/USBCopy-BSM-armv8-2.2.1-2306.spk
packages/UniversalViewer-BSM-armv8-1.4.0-0611.spk
packages/bee-AdminCenter-BSM-armv8-1.1-0136.spk
packages/bee-Fonts-BSM-armv8-1.1.0-0007.spk
packages/exFAT-Free-BSM-armv8-7.3.0-0402.spk
texts/chs/strings
texts/cht/strings
texts/csy/strings
texts/dan/strings
texts/enu/strings
texts/fre/strings
texts/ger/strings
texts/hun/strings
texts/ita/strings
texts/jpn/strings
texts/krn/strings
texts/nld/strings
texts/nor/strings
texts/plk/strings
texts/ptb/strings
texts/ptg/strings
texts/rus/strings
texts/spn/strings
texts/sve/strings
texts/tha/strings
texts/trk/strings
[+] archive successfully decrypted
[+] output at BSM_BST150-4T_65374.tar