Bluray disc

From PS3 Developer wiki
Jump to navigation Jump to search

Overview

  • UDF filesystem (a profile of ECMA-167) in cleartext
  • File entries are not encrypted, some files are not encrypted
  • Some regions of the disc are encrypted (sector by sector)
  • One sector is 2048 bytes

Encryption

The first sector of the disc tells which parts of the disc are unencrypted and which one are encoded.

For example, this is the beginning of "The Last of Us" disc:

00000000: 0000 0003 0000 0000 0000 0000 0000 099f  ................
00000010: 00a2 6160 00ba 73ff 011d dda0 011f ddbf  ..a`..s.........
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
  • 0x00000003 is the number of unencrypted regions
  • The first unencrypted region is from sector 0x00000000 to sector 0x0000099f
  • The first encrypted region is from sector 0x0000099f to sector 0x00a26160
  • The second unencrypted region is from sector 0x00a26160 to sector 0x00ba73ff
  • The second encrypted region is from sector 0x00ba73ff to sector 0x011ddda0
  • The third unencrypted region is from sector 0x011ddda0 to sector 0x011fddbf
  • 0x011fddbf sectors is 38636746752 bytes whereas the file is 38636748800 bytes : the last sector is not included for some reason.

Deriving the disc key

The disc key is obtained by encrypting "data1" with AES CBC:

  • with the secret 0x380bcf0b53455b3c7817ab4fa3ba90ed
  • with the IV 0x69474772af6fdab342743aefaa186287
  • no padding
  • data1 is available in the IRD file
  • it can be found on the disc with a bunch of SCSI commands.

Sector encryption

Each sector is encrypted with AES CBC:

  • using the disc key
  • no padding

The IV is derived from the sector number with:

int num = sectorNumber;
byte[] iv = new byte[16];
for (int j = 0; j < 16; j++)
{
	iv[16 - j - 1] = (byte)(num & 0xFF);
	num >>= 8;
}

File system layout

  • PS3_DISC.SFB
  • PS3_GAME/ICON0.PNG
  • PS3_GAME/LICDIR/LIC.DAT
  • PS3_GAME/PARAM.SFO
  • PS3_GAME/PIC1.PNG
  • PS3_GAME/PS3LOGO.DAT
  • PS3_GAME/SND0.AT3
  • PS3_GAME/TROPDIR/
  • PS3_GAME/USRDIR/build/
  • PS3_GAME/USRDIR/data/
  • PS3_GAME/USRDIR/EBOOT.BIN
  • PS3_UPDATE/PS3UPDAT.PUP
PS3 Disc Game Structure
Disc Path XMB
icon
SFB/SFO/SFX Mandatory Parameters Since Enabled by
APP_VER ATTRIBUTE BOOTABLE CATEGORY TITLE TITLE_ID
dev_bdvd/ PS3_DISC.SFB Yes 1.00 Enables others with HYBRID_FLAG
PS3_GAME/ PARAM.SFO PS3 Blu-ray Disc Opt Opt Opt Game DG Yes Yes 1.00 HYBRID_FLAG (g) in PS3_DISC.FSB
USRDIR/ EBOOT.BIN 1.00 BOOTABLE (1) in parent PARAM.SFO
INSDIR/ PARAM.SFO No? Yes No No Game AR No No ? HYBRID_FLAG (g) in PS3_DISC.FSB ?
DATA000.PKG (up to 999) ?
PKGDIR/ PARAM.SFO PS3 Blu-ray Disc (installable contents) No Yes No Game DP Yes Yes 1.00 ? ATTRIBUTE (131072) in parent PARAM.SFO
PKG01/
(up to 99)
PARAM.SFO Preinstall Package No No No Game IP Yes Yes 1.00 ? ATTRIBUTE (1) in parent PARAM.SFO
INSTALL.PKG 1.00 ?
LICDIR/ LIC.DAT 1.00
TROPDIR/ <NPCOMMID>/ TROPHY.TRP 2.40
PS3_GM01/
(up to 99?)
PARAM.SFO PS3 Blu-ray Disc Opt Opt Opt Game DG Yes Yes 4.00+ ? HYBRID_FLAG (g) in PS3_DISC.FSB
USRDIR/ EBOOT.BIN 4.00+ ? BOOTABLE (1) in parent PARAM.SFO
LICDIR/ LIC.DAT 4.00+ ? dev_bdvd/PS3_GAME/LICDIR/LIC.DAT
PS3_CONTENT/ THEMEDIR/ PARAM.SFO PS3 Blu-ray Disc (installable contents) No Yes No Game TR Yes No ? 2.00+ HYBRID_FLAG (T) in PS3_DISC.FSB
D001/ DATA001.P3T
(up to 999)
Preinstall Package 2.00+ ATTRIBUTE (1) in parent PARAM.SFO
VIDEODIR/ PARAM.SFO PS3 Blu-ray Disc (video contents) No Yes No Video VR Yes No ? ? HYBRID_FLAG (V) in PS3_DISC.FSB
D001/
(up to 999)
PARAM.SFO ? No No No Video VI Yes No ? ATTRIBUTE (1) in parent PARAM.SFO
DATA000.MP4 ?
PS3_EXTRA/ PARAM.SFO PS3 Blu-ray Disc No Yes No Game XR Yes Yes 3.41- HYBRID_FLAG (g) in PS3_DISC.FSB ?
D001/
(up to 999)
PARAM.SFX Package Content No No No Game IP Yes No 3.41- ATTRIBUTE (1) in parent PARAM.SFO
DATA000.PKG 3.41-
D002/
(up to 999)
PARAM.SFX Theme Content No No No Game TI Yes No 3.41- ATTRIBUTE (1) in parent PARAM.SFO
DATA000.P3T 3.41-
D003/
(up to 999)
PARAM.SFX Video Content No No No Game VI Yes No 3.41- ATTRIBUTE (1) in parent PARAM.SFO
DATA000.MP4 3.41-
PS3_VPRM/ PARAM.SFO PS3 Blu-ray Disc (video contents) No No No Video DM No No ? HYBRID_FLAG (v) in PS3_DISC.FSB
PS3_UPDATE/ PS3UPDAT.PUP 1.00 ? HYBRID_FLAG (u) in PS3_DISC.FSB

See also Content Information Files

Extra "tracks"

Disc Information from PIC in pre-recorded area

This information is in the PIC zone. It can be read with the READ DISC STRUCTURE SCSI command with arguments for BluRay.


For example (on Linux),

  unsigned char read_pic_command[12] = {
    173, // Operation Code=READ_DISC_STRUCTURE
    1,   // Reserved=0, MediaType=1 (BD)
    0,
    0,
    0,
    0,
    0,
    0, // FormatCode=0 (Disc Information)
    pic_size / 256,
    pic_size % 256,
    0,
    0
  };
  
  int drive = open(drive_filename, 0, O_RDONLY);
  if (drive == -1) {
    fputs("Can't open file\n", stderr);
    return 1;
  }

  unsigned char sense_data[12];

  // Actually there is a lot more than that:
  unsigned char* pic = malloc(pic_size);
  memset(pic, 0, pic_size);

  struct sg_io_hdr header;
  memset(&header, 0, sizeof(header));
  header.interface_id = 'S'; // SCSI
  header.dxfer_direction = SG_DXFER_FROM_DEV;
  header.cmd_len = sizeof(read_pic_command);
  header.mx_sb_len = sizeof(sense_data);
  header.iovec_count = 0;
  header.dxfer_len = pic_size;
  header.dxferp = pic;
  header.cmdp = (unsigned char*) read_pic_command;
  header.sbp = sense_data;
  header.timeout = 60 * 1000;
  header.flags = 0;
  header.pack_id = 0;
  header.usr_ptr = NULL;
  header.status = 0;
  header.msg_status = 0;
  header.sb_len_wr = 0;
  header.host_status = 0;
  header.driver_status = 0;
  header.resid = 0;
  header.duration = 0;
  header.info = 0;

  if (ioctl(drive, SG_IO, &header) < 0) {
    fputs("ioctl failed\n", stderr);
    return 1;
  }

  if ((header.info & SG_INFO_OK_MASK) != SG_INFO_OK) {
    fputs("SCSI command failed\n", stderr);
    return 1;
  }

Here's the result for "The Last Of Us":

00000000: 1002 0000 4449 0110 0000 2000 4244 4f01  ....DI.... .BDO.
00000010: 2101 0300 0000 0000 019a f5bf 0010 0000  !...............
00000020: 00ca 73fe 0000 0000 0000 0000 0000 0000  ..s.............
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 4449 0111 0001 2000 4244 4f01  ....DI.... .BDO.
00000050: 2101 0300 0000 0000 019a f5bf 0135 8c00  !............5..
00000060: 01ef fffe 0000 0000 0000 0000 0000 0000  ................
00000070: 0000 5b

References

  • 3k3y IsoTools, this is a .NET program available in binary form. The ILspy decompiler produces a very readable output.
  • PS3 ISO Patcher by BlackDaemon, is a .NET program available in source code